From 16663ba9980c30fa481f1aa44e65098a3fb49852 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:44:01 -0400
Subject: [PATCH 01/14] The upgrade and installer accept a hand-named
 darling.json.bak-* backup in the install folder (#5649)

The pre-lock check trusted the service account only on darling.json and on
stamped backup names, while the hardening makes the service the owner of every
darling.json.bak-* file. One glob per language now drives the check, the
install-time hardening, the manifest guard, the service sweep and the CLI check.
A refusal that lists only such files names them and gives the one-file fix.
The U1 upgrade-shape legs carry a service-owned hand-named backup.
---
 .github/scripts/darling-upgrade-shapes.ps1    |  30 ++-
 .github/workflows/darling-upgrade-shapes.yml  |   1 +
 .../DarlingDeployStaleFileTests.cs            |   3 +-
 .../DarlingInstallLocationTests.cs            | 222 ++++++++++++++++--
 .../DarlingCliCommands.cs                     |   2 +-
 .../DarlingConfigBackup.cs                    |  26 ++
 .../DarlingWorker.cs                          |   2 +-
 Darling/tools/install-darling.ps1             |  62 ++++-
 Darling/tools/upgrade-darling.ps1             |  62 ++++-
 9 files changed, 372 insertions(+), 38 deletions(-)
 create mode 100644 Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs

diff --git a/.github/scripts/darling-upgrade-shapes.ps1 b/.github/scripts/darling-upgrade-shapes.ps1
index fc3a597fa9..5ac94c7671 100644
--- a/.github/scripts/darling-upgrade-shapes.ps1
+++ b/.github/scripts/darling-upgrade-shapes.ps1
@@ -13,6 +13,8 @@
 
   Shapes (the leg name is <shape>-<script>):
     U1  current release in C:\Program Files\PerformanceMonitorDarling, service stopped.      must PASS
+        The folder also holds a hand-named darling.json.bak-before-edit, service-owned after the
+        base install and its service start (#5649); it must not refuse either script.
     U2  as U1, service logon changed to a non-default local account and started once on it.  must PASS
     U3  as U1, service deleted. install-darling.ps1 must PASS; upgrade-darling.ps1 has no
         service to upgrade and must say so, without listing the product's own files.
@@ -28,6 +30,7 @@ param(
 $ErrorActionPreference = 'Continue'
 $shape, $which = $Leg.Split('-')
 $svc = 'PerformanceMonitor Darling'
+$HandNamedBackup = 'darling.json.bak-before-edit'
 $work = 'C:\darling-shapes-work'
 $repo = if ($env:GITHUB_REPOSITORY) { $env:GITHUB_REPOSITORY } else { 'erikdarlingdata/PerformanceMonitor' }
 $tools = Join-Path $Workspace 'Darling\tools'
@@ -107,13 +110,17 @@ function Stop-Darling {
 
 # Installs <version> into <root> the way an operator does (extract, write darling.json, run its install script) and
 # lets the SERVICE extract pg-runtime. A base without pg-runtime.stamp is not the shape under test, so it fails the leg.
-function New-Base([string]$version, [string]$root, [bool]$acceptWritable) {
+function New-Base([string]$version, [string]$root, [bool]$acceptWritable, [bool]$handNamedBackup = $false) {
     Say "BASE: install $version into $root"
     $zip = Get-Zip $version
     New-Item -ItemType Directory -Force -Path $root | Out-Null
     tar -xf $zip -C $root
     $cfg = '{ "postgres": { "managed": true, "port": 5641, "dataDirectory": null, "connectAs": "admin" }, "servers": [ { "name": "nosuch", "host": "nosuch.invalid", "auth": "integrated" } ] }'
     Set-Content -LiteralPath (Join-Path $root 'darling.json') -Value $cfg
+    # #5649: a backup the operator named by hand, put there before the base install so the release's own install
+    # script and the service (both harden every darling.json.bak-* file) make it service-owned, the way a real one is
+    # after a service start. The script under test must then accept it.
+    if ($handNamedBackup) { Set-Content -LiteralPath (Join-Path $root $HandNamedBackup) -Value $cfg }
     $script = Join-Path $root 'install-darling.ps1'
     $declared = @(Select-String -LiteralPath $script -Pattern '^\s*\[switch\]\$(\w+)' | ForEach-Object { $_.Matches[0].Groups[1].Value })
     $a = @(); foreach ($w in 'SkipPreflight', 'NoShortcuts') { if ($declared -contains $w) { $a += "-$w" } }
@@ -130,6 +137,16 @@ function New-Base([string]$version, [string]$root, [bool]$acceptWritable) {
     }
     Start-Sleep -Seconds 10
     Stop-Darling
+    if ($handNamedBackup) {
+        # The shape only means something if the file really is the service's now. If the hardening did not make it so,
+        # the leg is not testing the refusal it exists to prevent, so it fails here instead of passing for nothing.
+        $backup = Join-Path $root $HandNamedBackup
+        if (-not (Test-Path -LiteralPath $backup)) { Fail-Leg "the hand-named backup $HandNamedBackup is gone from $root after the base install" }
+        $owner = (Get-Acl -LiteralPath $backup).GetOwner([System.Security.Principal.SecurityIdentifier])
+        $ownerName = try { $owner.Translate([System.Security.Principal.NTAccount]).Value } catch { '(untranslatable)' }
+        Write-Host "owner of ${backup}: $ownerName"
+        if ($ownerName -notlike "NT SERVICE\$svc") { Fail-Leg "the hand-named backup is owned by $ownerName after the base install, not by the service, so the leg would not exercise the check" }
+    }
     Write-Host "BASE: $version installed in $root, pg-runtime extracted by its service, service stopped"
 }
 
@@ -178,7 +195,8 @@ Say "LEG $Leg on $([Environment]::OSVersion.VersionString) (current $CurrentVers
 
 # -- the base for the shape ----------------------------------------------------------------------------------------
 $root = if ($shape -eq 'U4') { 'C:\PerformanceMonitorDarling' } else { 'C:\Program Files\PerformanceMonitorDarling' }
-New-Base $(if ($shape -eq 'U4') { $OldVersion } else { $CurrentVersion }) $root $false
+# U1 (both its install and its upgrade leg) carries a hand-named backup in the root (#5649).
+New-Base $(if ($shape -eq 'U4') { $OldVersion } else { $CurrentVersion }) $root $false ($shape -eq 'U1')
 
 switch ($shape) {
     'U2' {
@@ -233,7 +251,13 @@ else {
 
 # -- the expectation of the leg ------------------------------------------------------------------------------------
 switch ($Leg) {
-    { $_ -in 'U1-install', 'U1-upgrade', 'U2-install', 'U2-upgrade' } { Expect-Success $r "$which-darling.ps1" }
+    { $_ -in 'U1-install', 'U1-upgrade', 'U2-install', 'U2-upgrade' } {
+        Expect-Success $r "$which-darling.ps1"
+        if ($shape -eq 'U1') {
+            # #5649: the service-owned hand-named backup does not refuse the run (Expect-Success above) and stays where it was.
+            if (-not (Test-Path -LiteralPath (Join-Path $root $HandNamedBackup))) { Fail-Leg "$which-darling.ps1 removed the hand-named backup $HandNamedBackup" }
+        }
+    }
     'U3-install' {
         Expect-Success $r 'install-darling.ps1'
         if (-not (Get-Service -Name $svc -ErrorAction SilentlyContinue)) { Fail-Leg 'install-darling.ps1 exited 0 but left no service registered' }
diff --git a/.github/workflows/darling-upgrade-shapes.yml b/.github/workflows/darling-upgrade-shapes.yml
index e73482a7a7..f5531ff9a1 100644
--- a/.github/workflows/darling-upgrade-shapes.yml
+++ b/.github/workflows/darling-upgrade-shapes.yml
@@ -5,6 +5,7 @@ name: Darling upgrade shapes
 # build with its own install script, lets its service extract pg-runtime, stops it, and then runs the script
 # under test:
 #   U1  the current release in C:\Program Files\PerformanceMonitorDarling                  must pass
+#       (with a hand-named darling.json.bak-before-edit in the folder, service-owned, #5649)
 #   U2  as U1, the service logon changed to a non-default local account and run once on it must pass
 #   U3  as U1, the service deleted: install passes, upgrade says there is no service        see the leg's expectation
 #   U4  a release before 3.9 in C:\PerformanceMonitorDarling: install refuses, names only
diff --git a/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs b/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs
index 01327a395e..8f20f54af3 100644
--- a/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs
+++ b/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs
@@ -62,6 +62,7 @@ public sealed class DarlingDeployStaleFileTests
     private static readonly string[] s_functions =
     [
         "Test-DarlingRollbackBackupName",
+        "Get-DarlingServiceWrittenNames",
         "Format-DarlingBytes",
         "ConvertTo-DarlingManifestPath",
         "Join-DarlingInstallPath",
@@ -618,7 +619,7 @@ public void TheInstallScript_FindsOlderConfigBackupsByLiteralPath()
     {
         var script = InstallScript;
 
-        Assert.Contains("Get-ChildItem -LiteralPath $root -Filter 'darling.json.bak-*' -File -ErrorAction SilentlyContinue", script, StringComparison.Ordinal);
+        Assert.Contains("Get-ChildItem -LiteralPath $root -Filter (Get-DarlingServiceWrittenNames).BackupGlob -File -ErrorAction SilentlyContinue", script, StringComparison.Ordinal);
         Assert.DoesNotContain("Get-ChildItem -Path $root", script, StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index 813c86f4d4..f223883cde 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -567,7 +567,7 @@ public void TheNarrowedLock_KeepsTheServiceOnItsConfig_AndHandsTheKeyFolderOverA
         Assert.Contains("return @((Get-DarlingServiceWrittenNames).KeyDirectories)", helper, StringComparison.Ordinal);
         Assert.Contains("(Get-DarlingServiceWrittenNames).Directories", lockText, StringComparison.Ordinal);
         Assert.Contains("$names.Files", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
-        Assert.Contains("$names.BackupPattern", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+        Assert.Contains("$names.BackupGlob", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
         Assert.Contains("'darling-keys'", ExtractFunction(InstallScript, "Get-DarlingServiceWrittenNames"), StringComparison.Ordinal);
         Assert.Equal(PerformanceMonitor.Darling.Service.DarlingLogHashKeyFile.BringYourOwnDirectoryName, "darling-keys");
         Assert.DoesNotContain("(Split-Path -LiteralPath $configPath -Parent)", helper, StringComparison.Ordinal);
@@ -598,7 +598,7 @@ public void ThePreLockWritableExtractionCheck_ShipsIdenticallyInTheInstallAndUpg
             "Get-DarlingServiceSids", "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName",
             "Test-DarlingServiceWrittenPath", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
             "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice",
-            "Get-DarlingRefusalAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
+            "Get-DarlingRefusalAdvice", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
         })
         {
             Assert.Equal(ExtractFunction(InstallScript, name), ExtractFunction(upgrade, name));
@@ -724,9 +724,9 @@ public void TheExistingInstallRefusal_GivesTheNumberedSteps_AndAFreshFolderKeeps
         Assert.DoesNotContain("Stop the", fresh, StringComparison.Ordinal);
 
         // Both scripts choose the steps by where the registered service runs from: no darling.json or pg-runtime test.
-        Assert.Contains("$advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName)", InstallScript, StringComparison.Ordinal);
+        Assert.Contains("$advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable", InstallScript, StringComparison.Ordinal);
         Assert.DoesNotContain("$existingInstall", InstallScript, StringComparison.Ordinal);
-        Assert.Contains("$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName))", upgrade, StringComparison.Ordinal);
+        Assert.Contains("$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable)", upgrade, StringComparison.Ordinal);
         Assert.DoesNotContain("Get-DarlingExistingInstallSteps $InstallRoot", upgrade, StringComparison.Ordinal);
         Assert.DoesNotContain("Get-DarlingExistingInstallSteps $root", InstallScript, StringComparison.Ordinal);
         Assert.DoesNotContain("a fresh install into a folder only an administrator can write to", upgrade, StringComparison.Ordinal);
@@ -1003,7 +1003,7 @@ Use @('{', ((1..12 | ForEach-Object { '  "postgres": { "dataDirectory": "@@\\d'
 
     /// <summary>
     /// #5627: the service-written list matches the names the service writes and nothing wider. A backup is
-    /// darling.json.bak-yyyyMMdd-HHmmss with an optional -N counter, the FIRST name below the install folder is
+    /// any darling.json.bak-* name (#5649: the glob the hardening covers), the FIRST name below the install folder is
     /// compared exactly (a trailing dot, a longer name or a '..' step matches nothing), the listed files count only in
     /// the install folder itself, and the key folder counts only when it is handed in.
     /// </summary>
@@ -1016,13 +1016,13 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
             $ErrorActionPreference = 'Stop'
             $root = 'C:\Program Files\PerformanceMonitorDarling'
             foreach ($name in @('darling.json', 'DARLING.JSON', 'darling.json.bak-20260101-120000', 'darling.json.bak-20260101-120000-2',
-                                'darling.json.bak-x.dll', 'darling.json.bak-20260101', 'darling.json.bak-20260101-120000.dll', 'darling.json.bak-', 'darling.json.', 'xdarling.json')) {
+                                'darling.json.bak-x.dll', 'darling.json.bak-20260101', 'darling.json.bak-before-edit', 'DARLING.JSON.BAK-Upper', 'darling.json.bak-', 'darling.json.bak', 'darling.jsonbak-x', 'xdarling.json.bak-x', 'darling.json.', 'xdarling.json')) {
                 'name:' + $name + '=' + (Test-DarlingServiceWrittenFileName $name)
             }
             foreach ($case in @(
                 @('pg-runtime', @()), @('pg-runtime\pgsql\bin\postgres.exe', @()), @('pg-runtime-prev\a.dll', @()), @('PG-RUNTIME\a.dll', @()),
                 @('pg-runtime.\a.dll', @()), @('pg-runtime-x\a.dll', @()), @('pg-runtimeX', @()), @('pg-runtime\..\a.dll', @()), @('other\pg-runtime\a.dll', @()),
-                @('darling.json', @()), @('darling.json.bak-20260101-120000', @()), @('darling.json.bak-x.dll', @()), @('other\darling.json', @()), @('darling.json\x', @()),
+                @('darling.json', @()), @('darling.json.bak-20260101-120000', @()), @('darling.json.bak-x.dll', @()), @('darling.json.bak-before-edit', @()), @('xdarling.json.bak-x', @()), @('darling.json.bak', @()), @('other\darling.json', @()), @('darling.json\x', @()),
                 @('darling-keys\log-hash.key', @()), @('darling-keys\log-hash.key', @('darling-keys')), @('darling-keys-x\a', @('darling-keys')), @('PerformanceMonitor.Darling.Service.exe', @()))) {
                 'path:' + $case[0] + '|' + @($case[1]).Count + '=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root $case[0]) @($case[1]))
             }
@@ -1032,22 +1032,23 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
 
         var answers = RunWindowsPowerShell(probe.ToString());
 
-        foreach (var yes in new[] { "darling.json", "DARLING.JSON", "darling.json.bak-20260101-120000", "darling.json.bak-20260101-120000-2" })
+        foreach (var yes in new[] { "darling.json", "DARLING.JSON", "darling.json.bak-20260101-120000", "darling.json.bak-20260101-120000-2",
+            "darling.json.bak-x.dll", "darling.json.bak-20260101", "darling.json.bak-before-edit", "DARLING.JSON.BAK-Upper", "darling.json.bak-" })
         {
             Assert.Contains($"name:{yes}=True", answers);
         }
 
-        foreach (var no in new[] { "darling.json.bak-x.dll", "darling.json.bak-20260101", "darling.json.bak-20260101-120000.dll", "darling.json.bak-", "darling.json.", "xdarling.json" })
+        foreach (var no in new[] { "darling.json.bak", "darling.jsonbak-x", "xdarling.json.bak-x", "darling.json.", "xdarling.json" })
         {
             Assert.Contains($"name:{no}=False", answers);
         }
 
-        foreach (var yes in new[] { "pg-runtime|0", "pg-runtime\\pgsql\\bin\\postgres.exe|0", "pg-runtime-prev\\a.dll|0", "PG-RUNTIME\\a.dll|0", "darling.json|0", "darling.json.bak-20260101-120000|0", "darling-keys\\log-hash.key|1" })
+        foreach (var yes in new[] { "pg-runtime|0", "pg-runtime\\pgsql\\bin\\postgres.exe|0", "pg-runtime-prev\\a.dll|0", "PG-RUNTIME\\a.dll|0", "darling.json|0", "darling.json.bak-20260101-120000|0", "darling.json.bak-x.dll|0", "darling.json.bak-before-edit|0", "darling-keys\\log-hash.key|1" })
         {
             Assert.Contains($"path:{yes}=True", answers);
         }
 
-        foreach (var no in new[] { "pg-runtime.\\a.dll|0", "pg-runtime-x\\a.dll|0", "pg-runtimeX|0", "pg-runtime\\..\\a.dll|0", "other\\pg-runtime\\a.dll|0", "darling.json.bak-x.dll|0",
+        foreach (var no in new[] { "pg-runtime.\\a.dll|0", "pg-runtime-x\\a.dll|0", "pg-runtimeX|0", "pg-runtime\\..\\a.dll|0", "other\\pg-runtime\\a.dll|0", "xdarling.json.bak-x|0", "darling.json.bak|0",
             "other\\darling.json|0", "darling.json\\x|0", "darling-keys\\log-hash.key|0", "darling-keys-x\\a|1", "PerformanceMonitor.Darling.Service.exe|0" })
         {
             Assert.Contains($"path:{no}=False", answers);
@@ -1057,11 +1058,200 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
         Assert.Contains("path:outside=False", answers);
     }
 
-    private static void AppendStepFunctions(StringBuilder probe)
+    /// <summary>
+    /// #5649: the pre-lock walk trusts the service account (as grantee and as owner) on EVERY file in the install root
+    /// whose name starts with darling.json.bak-, the glob the hardening covers, so a backup an operator named by hand
+    /// (the hardening makes the service its owner at the next start) is not read as a stranger's file. Narrow: any other
+    /// grantee on that file still refuses, the service on any other root file still refuses, a folder with that name is
+    /// not a file the service writes, and a file below the root is not in the root.
+    /// </summary>
+    [Fact]
+    public void ThePreLockWalk_TrustsTheServiceOnAnyHandNamedBackupInTheRoot_AndNothingWider()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine("""
+            $usersSid = New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinUsersSid, $null)
+            $extras = @('darling.json.bak-before-edit', 'DARLING.JSON.BAK-Upper', 'darling.json.bak', 'notes.txt', 'darling.json.bak-dir', 'other\darling.json.bak-nested')
+            function New-Extras {
+                foreach ($e in $extras) {
+                    if ($e -eq 'darling.json.bak-dir') { New-Item -ItemType Directory -Path "$($script:root)\$e" -Force | Out-Null }
+                    else { Set-Content -LiteralPath "$($script:root)\$e" -Value '{}' }
+                }
+            }
+            function Reset-Extras {
+                $script:serviceOwned = @()
+                $script:fileGrants = @{}
+            }
+            function Own([string]$relative, $grantees) { $script:serviceOwned += $relative; $script:fileGrants[$relative] = @($grantees) }
+            try {
+                New-Extras
+                'setup.extrasCreated=' + (@($extras | Where-Object { Test-Path -LiteralPath "$($script:root)\$_" }).Count -eq $extras.Count)
+
+                # The hand-named backup the service owns and holds a grant on: passes, registered or not.
+                Own 'darling.json.bak-before-edit' @($script:serviceSid)
+                Own 'DARLING.JSON.BAK-Upper' @($script:serviceSid)
+                Show 'handNamed' $registered "NT SERVICE\$serviceName"
+                Show 'handNamedDeleted' $null $null
+                Reset-Extras
+
+                # The same file granted to Users as well: still refuses, naming Users and not the service.
+                Own 'darling.json.bak-before-edit' @($script:serviceSid, $usersSid)
+                Show 'handNamedUsers' $registered "NT SERVICE\$serviceName"
+                Reset-Extras
+
+                # The service owning and holding a grant on a root file that is not a backup: refuses (grant and owner).
+                Own 'notes.txt' @($script:serviceSid)
+                Show 'notBackup' $registered "NT SERVICE\$serviceName"
+                Reset-Extras
+                Own 'darling.json.bak' @($script:serviceSid)
+                Show 'noDash' $registered "NT SERVICE\$serviceName"
+                Reset-Extras
+
+                # A folder named like a backup, owned by the service: not a file the service writes.
+                Own 'darling.json.bak-dir' @()
+                Show 'folder' $registered "NT SERVICE\$serviceName"
+                Reset-Extras
+
+                # A backup-named file below the root: the root only.
+                Own 'other\darling.json.bak-nested' @($script:serviceSid)
+                Show 'nested' $registered "NT SERVICE\$serviceName"
+                Reset-Extras
+            }
+            finally {
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        Assert.Contains("handNamed.count=0", answers);
+        Assert.Contains("handNamedDeleted.count=0", answers);
+
+        Assert.Contains("handNamedUsers.count=1", answers);
+        Assert.Contains(answers, a => a.StartsWith("handNamedUsers.text=", StringComparison.Ordinal)
+            && a.Contains("Users on <root>\\darling.json.bak-before-edit", StringComparison.Ordinal)
+            && !a.Contains("owned by", StringComparison.Ordinal));
+
+        foreach (var (label, file) in new[] { ("notBackup", "notes.txt"), ("noDash", "darling.json.bak"), ("nested", "other\\darling.json.bak-nested") })
+        {
+            Assert.Contains($"{label}.count=2", answers);
+            Assert.Contains(answers, a => a.StartsWith($"{label}.text=", StringComparison.Ordinal)
+                && a.Contains(" on <root>\\" + file, StringComparison.Ordinal)
+                && a.Contains("<root>\\" + file + " (owned by", StringComparison.Ordinal));
+        }
+
+        Assert.Contains("folder.count=1", answers);
+        Assert.Contains(answers, a => a.StartsWith("folder.text=", StringComparison.Ordinal)
+            && a.Contains("<root>\\darling.json.bak-dir (owned by", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// #5649: the refusal's advice. When EVERY entry is on a darling.json.bak-* file directly in the install folder,
+    /// it names the files and gives the one-file fix (move them to a folder only Administrators can read, then run the
+    /// command again), and says nothing about moving the install. Any other entry (another file, a folder, a link, a
+    /// path inside a folder, darling.json itself) keeps the old advice. Both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1")]
+    [InlineData("upgrade-darling.ps1")]
+    public void TheRefusalAdvice_NamesTheBackupFilesAndTheOneFileFix_OnlyWhenEveryEntryIsABackup(string scriptName)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        AppendStepFunctions(probe, script);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = Join-Path $env:TEMP ('pm5649-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path "$root\other", "$root\darling.json.bak-dir" -Force | Out-Null
+            foreach ($n in @('darling.json.bak-before-edit', 'darling.json.bak-20260101-120000', 'notes.txt', 'darling.json', 'other\darling.json.bak-nested')) { Set-Content -LiteralPath "$root\$n" -Value '{}' }
+            $root = [System.IO.Path]::GetFullPath($root)
+            function Show([string]$label, [array]$findings, [string]$registered) {
+                '@@' + $label
+                Get-DarlingRefusalAdvice $root 'PerformanceMonitor Darling' $registered $findings
+            }
+            try {
+                $all = @("BUILTIN\Users on $root\darling.json.bak-before-edit",
+                         "$root\darling.json.bak-before-edit (owned by CONTOSO\someone)",
+                         "BUILTIN\Users on $root\darling.json.bak-20260101-120000")
+                Show 'backupsOnly' $all ''
+                Show 'backupsOnlyInstalledHere' $all $root
+                Show 'withOtherFile' ($all + "BUILTIN\Users on $root\notes.txt") ''
+                Show 'withFolder' ($all + "BUILTIN\Users on $root\darling.json.bak-dir") ''
+                Show 'withLink' ($all + "$root\darling.json.bak-before-edit (a junction or link)") ''
+                Show 'withNested' ($all + "BUILTIN\Users on $root\other\darling.json.bak-nested") ''
+                Show 'withConfig' ($all + "BUILTIN\Users on $root\darling.json") ''
+                Show 'withRoot' ($all + "BUILTIN\Users on $root") ''
+                Show 'withMissing' ($all + "BUILTIN\Users on $root\darling.json.bak-gone") ''
+                Show 'noFindings' @() ''
+            }
+            finally {
+                Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var text = string.Join("\n", RunWindowsPowerShell(probe.ToString())).Replace("\r\n", "\n", StringComparison.Ordinal);
+        string Section(string label) => System.Text.RegularExpressions.Regex.Match(text, "@@" + label + "\n(?<body>.*?)(?=\n@@|$)", System.Text.RegularExpressions.RegexOptions.Singleline).Groups["body"].Value;
+
+        foreach (var label in new[] { "backupsOnly", "backupsOnlyInstalledHere" })
+        {
+            var advice = Section(label);
+            Assert.Contains("Every entry above is a darling.json.bak-* backup file in this folder: darling.json.bak-before-edit, darling.json.bak-20260101-120000.", advice, StringComparison.Ordinal);
+            Assert.Contains("You do not need to move the install. Move just those files out of this folder, into a folder only", advice, StringComparison.Ordinal);
+            Assert.Contains("Administrators can read, because a backup can hold the secrets that were in darling.json. Then run", advice, StringComparison.Ordinal);
+            Assert.Contains("this command again.", advice, StringComparison.Ordinal);
+            Assert.DoesNotContain("Do NOT try to repair", advice, StringComparison.Ordinal);
+            Assert.DoesNotContain("Stop the", advice, StringComparison.Ordinal);
+            Assert.DoesNotContain("Extract the zip", advice, StringComparison.Ordinal);
+        }
+
+        foreach (var label in new[] { "withOtherFile", "withFolder", "withLink", "withNested", "withConfig", "withRoot", "withMissing", "noFindings" })
+        {
+            var advice = Section(label);
+            Assert.Contains("Do NOT try to repair this folder's permissions in place.", advice, StringComparison.Ordinal);
+            Assert.DoesNotContain("backup file in this folder", advice, StringComparison.Ordinal);
+            Assert.DoesNotContain("You do not need to move the install", advice, StringComparison.Ordinal);
+        }
+    }
+
+    /// <summary>
+    /// #5649: one definition of which files are a config backup, per language, and the two are the same text. In
+    /// PowerShell it is BackupGlob in the list both scripts share; the pre-lock walk, the install-time hardening and the
+    /// upgrade's manifest guard all read it. In C# it is DarlingConfigBackup, which TryHardenConfigBackups and the CLI's
+    /// permission check read. Nothing spells the glob a second time, and the stamped-name pattern is gone.
+    /// </summary>
+    [Fact]
+    public void TheBackupGlob_HasOneDefinitionPerLanguage_AndTheSameText()
+    {
+        var upgrade = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
+        var worker = ReadRepoFile(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"));
+        var cli = ReadRepoFile(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingCliCommands.cs"));
+
+        foreach (var script in new[] { InstallScript, upgrade })
+        {
+            var glob = System.Text.RegularExpressions.Regex.Matches(ExtractFunction(script, "Get-DarlingServiceWrittenNames"), @"BackupGlob\s*=\s*'(?<g>[^']+)'");
+            Assert.Single(glob);
+            Assert.Equal(PerformanceMonitor.Darling.Service.DarlingConfigBackup.Glob, glob[0].Groups["g"].Value);
+            Assert.Contains("$name -like $names.BackupGlob", ExtractFunction(script, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+            Assert.DoesNotContain("BackupPattern", script, StringComparison.Ordinal);
+            Assert.DoesNotContain("-Filter 'darling.json.bak-", script, StringComparison.Ordinal);
+            Assert.DoesNotContain("StartsWith('darling.json.bak-'", script, StringComparison.Ordinal);
+        }
+
+        Assert.Contains("-Filter (Get-DarlingServiceWrittenNames).BackupGlob -File", InstallScript, StringComparison.Ordinal);
+        Assert.Contains("$leaf -like (Get-DarlingServiceWrittenNames).BackupGlob", upgrade, StringComparison.Ordinal);
+
+        Assert.Equal("darling.json.bak-*", PerformanceMonitor.Darling.Service.DarlingConfigBackup.Glob);
+        Assert.Contains("Path.GetFileName(configPath) + DarlingConfigBackup.GlobSuffix", worker, StringComparison.Ordinal);
+        Assert.DoesNotContain("\".bak-*\"", worker, StringComparison.Ordinal);
+        Assert.Contains("SafeEnumerate(Path.GetDirectoryName(resolvedConfig), DarlingConfigBackup.Glob)", cli, StringComparison.Ordinal);
+        Assert.DoesNotContain("\"darling.json.bak-*\"", cli, StringComparison.Ordinal);
+    }
+
+    private static void AppendStepFunctions(StringBuilder probe, string? script = null)
     {
-        foreach (var name in new[] { "Test-PathIsAtOrUnder", "Test-DarlingSamePath", "Get-DarlingConfiguredPathsUnder", "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice", "Get-DarlingRefusalAdvice" })
+        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-PathIsAtOrUnder", "Test-DarlingSamePath", "Get-DarlingConfiguredPathsUnder", "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice", "Get-DarlingRefusalAdvice" })
         {
-            probe.AppendLine(ExtractFunction(InstallScript, name));
+            probe.AppendLine(ExtractFunction(script ?? InstallScript, name));
         }
     }
 
@@ -1155,6 +1345,7 @@ private static StringBuilder ServiceOwnedTreeProbe()
             $script:serviceAce = $script:serviceSid        # the account the lock/install granted Modify on pg-runtime
             $script:serviceOwned = @()                     # extra paths (relative to the root) the service owns
             $script:serviceDirs = @('darling-keys')        # the extra folders Get-DarlingExtraServiceWriteDirectories returns
+            $script:fileGrants = @{}                       # relative path -> SIDs holding Modify on that one file (#5649)
 
             function Get-Acl {
                 [CmdletBinding()]
@@ -1172,6 +1363,9 @@ function Get-Acl {
                     $sec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($script:rootWriter, 'Modify', 'ContainerInherit, ObjectInherit', 'None', 'Allow')))
                 }
                 $relative = if ($LiteralPath.Length -gt $script:root.Length) { $LiteralPath.Substring($script:root.Length + 1) } else { '' }
+                foreach ($granted in @($script:fileGrants[$relative])) {
+                    if ($granted) { $sec.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($granted, 'Modify', 'None', 'None', 'Allow'))) }
+                }
                 $sec.SetOwner($(if ($underRuntime) { $script:runtimeOwner } elseif ($script:serviceOwned -contains $relative) { $script:serviceSid } else { $script:adminsSid }))
                 return $sec
             }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
index e873463fc7..25df180f06 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
@@ -4122,7 +4122,7 @@ and the CLI verbs run as the operator and must still read the live config. Nothi
             new(resolvedConfig, AllowInteractive: true, IsDirectory: false, "the live config"),
         };
 
-        foreach (var backup in SafeEnumerate(Path.GetDirectoryName(resolvedConfig), "darling.json.bak-*"))
+        foreach (var backup in SafeEnumerate(Path.GetDirectoryName(resolvedConfig), DarlingConfigBackup.Glob))
         {
             targets.Add(new(backup, AllowInteractive: false, IsDirectory: false, "a config backup"));
         }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
new file mode 100644
index 0000000000..f763a4ad1a
--- /dev/null
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2026 Erik Darling, Darling Data LLC
+ *
+ * This file is part of the SQL Server Performance Monitor.
+ *
+ * Licensed under the MIT License. See LICENSE file in the project root for full license information.
+ */
+
+namespace PerformanceMonitor.Darling.Service;
+
+/// <summary>
+/// #5649: the ONE spelling of which files beside <c>darling.json</c> count as its backups. The service's
+/// start-up hardening (<c>DarlingWorker.TryHardenConfigBackups</c>) and the CLI's permission check both take
+/// EVERY <c>darling.json.bak-*</c> file, not only the <c>darling.json.bak-yyyyMMdd-HHmmss</c> names the config
+/// verbs write, because a backup an operator named by hand holds the same secrets. The install and upgrade
+/// scripts spell the same glob once (<c>BackupGlob</c> in <c>Get-DarlingServiceWrittenNames</c>), and a test pins
+/// that spelling to <see cref="Glob"/> so the scripts' pre-lock check and this hardening cannot drift apart.
+/// </summary>
+internal static class DarlingConfigBackup
+{
+    /// <summary>The tail every backup name carries after the config file's own name, as a search pattern.</summary>
+    public const string GlobSuffix = ".bak-*";
+
+    /// <summary>The search pattern for every backup of the default <c>darling.json</c>.</summary>
+    public const string Glob = "darling.json" + GlobSuffix;
+}
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
index 22c9b466d0..bd2f62065a 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
@@ -2245,7 +2245,7 @@ internal static void TryHardenConfigBackups(string configPath, ILogger logger)
                 return;
             }
 
-            backups = Directory.GetFiles(directory, Path.GetFileName(configPath) + ".bak-*");
+            backups = Directory.GetFiles(directory, Path.GetFileName(configPath) + DarlingConfigBackup.GlobSuffix);
         }
         catch (Exception ex)
         {
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index 07e8fce4ab..1ea8e3021a 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -255,15 +255,20 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
 # (what it creates, grants and keeps the service's ownership of) and by the pre-lock walk (where the service's own
 # account is trusted as owner and as a write grantee), so the two cannot drift apart. Directories are always
 # created and granted; KeyDirectories only on a bring-your-own PostgreSQL install (Get-DarlingExtraServiceWriteDirectories
-# returns them, and only then are they on the list). Files are matched by exact name in the install root only: darling.json,
-# and its backups, which the config-editing verbs name darling.json.bak-yyyyMMdd-HHmmss with an optional -N counter
-# (BackupPattern). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# returns them, and only then are they on the list). Files are matched in the install root only, and only files (a folder of the same name is not on the
+# list): darling.json, and every darling.json.bak-* file (BackupGlob, #5649). That is the glob the hardening covers: the
+# install-time pass in install-darling.ps1, the service's TryHardenConfigBackups and the CLI's backup enumeration all
+# take every darling.json.bak-* name, not only the darling.json.bak-yyyyMMdd-HHmmss(-N) names the config-editing verbs
+# write, so a backup an operator named by hand (darling.json.bak-before-edit) becomes service-owned at the next start
+# and must not read as a stranger's file. A backup is data the service reads and writes, never code that runs. This is
+# the ONE spelling of that glob in these scripts; DarlingConfigBackup.Glob in the service is the one in C#, and a test
+# pins the two to the same text. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingServiceWrittenNames {
     return [pscustomobject]@{
         Directories    = @('pg-runtime', 'pg-runtime-prev')
         KeyDirectories = @('darling-keys')
         Files          = @('darling.json')
-        BackupPattern  = '^darling\.json\.bak-[0-9]{8}-[0-9]{6}(-[0-9]+)?$'
+        BackupGlob     = 'darling.json.bak-*'
     }
 }
 
@@ -273,7 +278,7 @@ function Test-DarlingServiceWrittenFileName([string]$name) {
     foreach ($file in @($names.Files)) {
         if ($name -ieq $file) { return $true }
     }
-    return [bool]($name -match $names.BackupPattern)
+    return [bool]($name -like $names.BackupGlob)
 }
 
 # True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
@@ -293,7 +298,8 @@ function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [stri
     foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
         if ($segments[0] -ieq $directory) { return $true }
     }
-    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]))
+    # Files only (#5649): a folder that carries a listed name is not a file the service writes.
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and -not (Test-Path -LiteralPath $candidate -PathType Container))
 }
 
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
@@ -489,11 +495,49 @@ Then run install-darling.ps1 from there.
 "@
 }
 
+# The file names, when EVERY finding of a refusal is on a darling.json.bak-* file directly in $root (#5649): a grant
+# on it ("<account> on <path>") or its owner ("<path> (owned by <account>)"). Anything else among the findings, a
+# folder, a link, a file that is not a backup, a finding about a path that could not be read, returns nothing, and the
+# refusal keeps its install-replacement advice. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingBackupFileFindingNames([string]$root, [array]$findings) {
+    if (@($findings).Count -eq 0) { return @() }
+    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
+    catch { return @() }
+    $escaped = [regex]::Escape($rootText)
+    $names = @()
+    foreach ($finding in @($findings)) {
+        $m = [regex]::Match("$finding", "^.+ on (?<path>$escaped\\[^\\]+)$", 'IgnoreCase')
+        if (-not $m.Success) { $m = [regex]::Match("$finding", "^(?<path>$escaped\\[^\\]+) \(owned by .+\)$", 'IgnoreCase') }
+        if (-not $m.Success) { return @() }
+        $path = $m.Groups['path'].Value
+        $leaf = $path.Substring($rootText.Length + 1)
+        if (-not (Test-DarlingServiceWrittenFileName $leaf) -or $leaf -ieq 'darling.json') { return @() }
+        if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return @() }
+        if ($names -notcontains $leaf) { $names += $leaf }
+    }
+    return @($names)
+}
+
+# The advice for a refusal that lists only darling.json.bak-* files (#5649): move those files, not the install.
+# Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingBackupFileAdvice([string[]]$names) {
+    $shown = (@($names) | Select-Object -First 10) -join ', '
+    $more = if (@($names).Count -gt 10) { " and $(@($names).Count - 10) more" } else { '' }
+    return @"
+Every entry above is a darling.json.bak-* backup file in this folder: $shown$more.
+You do not need to move the install. Move just those files out of this folder, into a folder only
+Administrators can read, because a backup can hold the secrets that were in darling.json. Then run
+this command again.
+"@
+}
+
 # The refusal's advice (#5627): the numbered steps when the registered service runs from $folder itself, that is,
 # when its ImagePath folder ($registeredFolder, from Get-DarlingInstallRootFromService) is $folder, so this folder IS
 # the install being replaced; a fresh folder otherwise, including when no service is registered or its path cannot be
 # read. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
-function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder) {
+function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder, [array]$findings = @()) {
+    $backupNames = @(Get-DarlingBackupFileFindingNames $folder $findings)
+    if ($backupNames.Count -gt 0) { return Get-DarlingBackupFileAdvice $backupNames }
     if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { return Get-DarlingExistingInstallSteps $folder $serviceName }
     return Get-DarlingFreshFolderAdvice $folder
 }
@@ -1065,7 +1109,7 @@ if (-not $AcceptWritableExtraction) {
         # The service running from THIS folder means it is an existing install (#5627): its folder is what needs
         # replacing, so the refusal spells out how. A service registered elsewhere, or none, leaves nothing here to
         # keep, and the advice is a fresh folder.
-        $advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName)
+        $advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable
         Fail @"
 Ordinary users can already write to this install folder, before this script locks anything down:
 
@@ -1450,7 +1494,7 @@ else {
 # Set-Acl -Path can resolve to a same-named file in a sibling folder (a[bc]d to abd) and harden that instead.
 $hardened = @()
 $failed = @()
-foreach ($secretFile in @($configPath) + @(Get-ChildItem -LiteralPath $root -Filter 'darling.json.bak-*' -File -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName })) {
+foreach ($secretFile in @($configPath) + @(Get-ChildItem -LiteralPath $root -Filter (Get-DarlingServiceWrittenNames).BackupGlob -File -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName })) {
     try {
         $wk = [System.Security.Principal.WellKnownSidType]
         $systemSid      = New-Object System.Security.Principal.SecurityIdentifier($wk::LocalSystemSid, $null)
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 943b6112df..8e2532911e 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -308,15 +308,20 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
 # (what it creates, grants and keeps the service's ownership of) and by the pre-lock walk (where the service's own
 # account is trusted as owner and as a write grantee), so the two cannot drift apart. Directories are always
 # created and granted; KeyDirectories only on a bring-your-own PostgreSQL install (Get-DarlingExtraServiceWriteDirectories
-# returns them, and only then are they on the list). Files are matched by exact name in the install root only: darling.json,
-# and its backups, which the config-editing verbs name darling.json.bak-yyyyMMdd-HHmmss with an optional -N counter
-# (BackupPattern). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# returns them, and only then are they on the list). Files are matched in the install root only, and only files (a folder of the same name is not on the
+# list): darling.json, and every darling.json.bak-* file (BackupGlob, #5649). That is the glob the hardening covers: the
+# install-time pass in install-darling.ps1, the service's TryHardenConfigBackups and the CLI's backup enumeration all
+# take every darling.json.bak-* name, not only the darling.json.bak-yyyyMMdd-HHmmss(-N) names the config-editing verbs
+# write, so a backup an operator named by hand (darling.json.bak-before-edit) becomes service-owned at the next start
+# and must not read as a stranger's file. A backup is data the service reads and writes, never code that runs. This is
+# the ONE spelling of that glob in these scripts; DarlingConfigBackup.Glob in the service is the one in C#, and a test
+# pins the two to the same text. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingServiceWrittenNames {
     return [pscustomobject]@{
         Directories    = @('pg-runtime', 'pg-runtime-prev')
         KeyDirectories = @('darling-keys')
         Files          = @('darling.json')
-        BackupPattern  = '^darling\.json\.bak-[0-9]{8}-[0-9]{6}(-[0-9]+)?$'
+        BackupGlob     = 'darling.json.bak-*'
     }
 }
 
@@ -326,7 +331,7 @@ function Test-DarlingServiceWrittenFileName([string]$name) {
     foreach ($file in @($names.Files)) {
         if ($name -ieq $file) { return $true }
     }
-    return [bool]($name -match $names.BackupPattern)
+    return [bool]($name -like $names.BackupGlob)
 }
 
 # True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
@@ -346,7 +351,8 @@ function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [stri
     foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
         if ($segments[0] -ieq $directory) { return $true }
     }
-    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]))
+    # Files only (#5649): a folder that carries a listed name is not a file the service writes.
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and -not (Test-Path -LiteralPath $candidate -PathType Container))
 }
 
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
@@ -542,11 +548,49 @@ Then run install-darling.ps1 from there.
 "@
 }
 
+# The file names, when EVERY finding of a refusal is on a darling.json.bak-* file directly in $root (#5649): a grant
+# on it ("<account> on <path>") or its owner ("<path> (owned by <account>)"). Anything else among the findings, a
+# folder, a link, a file that is not a backup, a finding about a path that could not be read, returns nothing, and the
+# refusal keeps its install-replacement advice. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingBackupFileFindingNames([string]$root, [array]$findings) {
+    if (@($findings).Count -eq 0) { return @() }
+    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
+    catch { return @() }
+    $escaped = [regex]::Escape($rootText)
+    $names = @()
+    foreach ($finding in @($findings)) {
+        $m = [regex]::Match("$finding", "^.+ on (?<path>$escaped\\[^\\]+)$", 'IgnoreCase')
+        if (-not $m.Success) { $m = [regex]::Match("$finding", "^(?<path>$escaped\\[^\\]+) \(owned by .+\)$", 'IgnoreCase') }
+        if (-not $m.Success) { return @() }
+        $path = $m.Groups['path'].Value
+        $leaf = $path.Substring($rootText.Length + 1)
+        if (-not (Test-DarlingServiceWrittenFileName $leaf) -or $leaf -ieq 'darling.json') { return @() }
+        if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return @() }
+        if ($names -notcontains $leaf) { $names += $leaf }
+    }
+    return @($names)
+}
+
+# The advice for a refusal that lists only darling.json.bak-* files (#5649): move those files, not the install.
+# Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingBackupFileAdvice([string[]]$names) {
+    $shown = (@($names) | Select-Object -First 10) -join ', '
+    $more = if (@($names).Count -gt 10) { " and $(@($names).Count - 10) more" } else { '' }
+    return @"
+Every entry above is a darling.json.bak-* backup file in this folder: $shown$more.
+You do not need to move the install. Move just those files out of this folder, into a folder only
+Administrators can read, because a backup can hold the secrets that were in darling.json. Then run
+this command again.
+"@
+}
+
 # The refusal's advice (#5627): the numbered steps when the registered service runs from $folder itself, that is,
 # when its ImagePath folder ($registeredFolder, from Get-DarlingInstallRootFromService) is $folder, so this folder IS
 # the install being replaced; a fresh folder otherwise, including when no service is registered or its path cannot be
 # read. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
-function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder) {
+function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder, [array]$findings = @()) {
+    $backupNames = @(Get-DarlingBackupFileFindingNames $folder $findings)
+    if ($backupNames.Count -gt 0) { return Get-DarlingBackupFileAdvice $backupNames }
     if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { return Get-DarlingExistingInstallSteps $folder $serviceName }
     return Get-DarlingFreshFolderAdvice $folder
 }
@@ -1268,7 +1312,7 @@ function Test-DarlingManifestPathIsPreserved([string]$relativePath) {
     # the assertion that the manifest is what it claims to be, placed where being wrong costs a monitoring
     # host its configuration.
     if ($leaf.Equals('darling.json', [StringComparison]::OrdinalIgnoreCase)) { return $true }
-    if ($leaf.StartsWith('darling.json.bak-', [StringComparison]::OrdinalIgnoreCase)) { return $true }
+    if ($leaf -like (Get-DarlingServiceWrittenNames).BackupGlob) { return $true }
 
     # DPAPI credential blobs. LocalMachine-scoped with an entropy constant that ships in an open-source
     # repo, so READ access is the secret - but they are also not recoverable from anywhere else, and a
@@ -1826,7 +1870,7 @@ A tree installed before #4038 was writable by the accounts above for its whole l
 only copies over what this build ships. It does not check the rest, so other files in the tree can differ
 from what an earlier build shipped.
 
-$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName))
+$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable)
 
 If you accept the risk of upgrading this tree in place anyway, re-run with -AcceptWritableExtraction.
 

From acafd473d5bab1c286c31b8f5f2039b982e48f88 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:47:08 -0400
Subject: [PATCH 02/14] CHANGELOG: the upgrade and installer accept a
 hand-named darling.json.bak-* backup (#5649)

---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9e6b025ada..33ba22275e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,10 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 
 ## [Unreleased]
 
+### Fixed
+
+- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every `darling.json.bak-*` file in the install root, the same glob the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, and a file below the root still refuse. When a refusal lists only backup files, it now names them and says to move just those files to a folder only Administrators can read, then run the command again. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now read one glob per language.
+
 ## [3.10.0] - 2026-10-09
 
 Full entries: [docs/changelog/3.10.md](docs/changelog/3.10.md)
@@ -5197,3 +5201,4 @@ Full entries: [docs/changelog/3.0.md](docs/changelog/3.0.md)
 [#5636]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5636
 [#5637]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5637
 [#5628]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5628
+[#5659]: https://github.com/erikdarlingdata/PerformanceMonitor/pull/5659

From 155cc09f537c8445abd135b258ad31135bf47f67 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 11:26:37 -0400
Subject: [PATCH 03/14] Darling scripts: backups are matched by ordinal prefix,
 hard-linked backups are findings, the backup note keeps the standard advice
 (#5649)

---
 .../DarlingDeployStaleFileTests.cs            |   3 +-
 .../DarlingHardenFilesVerbTests.cs            |  58 ++++
 .../DarlingInstallLocationTests.cs            | 291 +++++++++++++++---
 .../DarlingCliCommands.cs                     |  10 +-
 .../DarlingConfigBackup.cs                    |  34 +-
 .../DarlingWorker.cs                          |   2 +-
 Darling/tools/install-darling.ps1             | 134 +++++---
 Darling/tools/upgrade-darling.ps1             | 134 +++++---
 8 files changed, 523 insertions(+), 143 deletions(-)

diff --git a/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs b/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs
index 8f20f54af3..2286baa5be 100644
--- a/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs
+++ b/Darling/Darling.Tests/DarlingDeployStaleFileTests.cs
@@ -619,7 +619,8 @@ public void TheInstallScript_FindsOlderConfigBackupsByLiteralPath()
     {
         var script = InstallScript;
 
-        Assert.Contains("Get-ChildItem -LiteralPath $root -Filter (Get-DarlingServiceWrittenNames).BackupGlob -File -ErrorAction SilentlyContinue", script, StringComparison.Ordinal);
+        Assert.Contains("Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue", script, StringComparison.Ordinal);
+        Assert.Contains("Get-DarlingServiceWrittenRootFiles $root -BackupsOnly", script, StringComparison.Ordinal);
         Assert.DoesNotContain("Get-ChildItem -Path $root", script, StringComparison.Ordinal);
     }
 
diff --git a/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs b/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs
index cd44bbbe26..331cedceef 100644
--- a/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs
+++ b/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs
@@ -223,6 +223,64 @@ public void TheResolver_HandlesTheUnqualifiedLocalSystemAlias()
         Assert.Contains("LocalSystem", body, StringComparison.Ordinal);
         Assert.Contains("WellKnownSidType.LocalSystemSid", body, StringComparison.Ordinal);
     }
+
+    /// <summary>
+    /// #5649: the verb hardens the backups of the config it was given, named the way the config verbs and the service's
+    /// start-up sweep name them (<c>prod.json.bak-x</c> for <c>prod.json</c>), not the default config's
+    /// <c>darling.json.bak-*</c> that may sit in the same folder for another install. The name test is ordinal and
+    /// ignores case whatever the culture (Turkish dotted and dotless I), and the service's own sweep lists the same files.
+    /// </summary>
+    [Fact]
+    public void TheVerb_HardensTheBackupsOfTheConfigItWasGiven_ByAnOrdinalNameTest()
+    {
+        var directory = Path.Combine(Path.GetTempPath(), "pm5649-cli-" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(directory);
+        var previous = System.Globalization.CultureInfo.CurrentCulture;
+        try
+        {
+            foreach (var name in new[]
+            {
+                "prod.json", "prod.json.bak-20260101-120000", "PROD.JSON.BAK-Upper", "prod.json.bak-before-edit",
+                "prod.json.bak", "prod.jsonx.bak-x", "darling.json", "darling.json.bak-other-install", "DARLING.JSON.BAK-Upper",
+            })
+            {
+                File.WriteAllText(Path.Combine(directory, name), "{}");
+            }
+
+            var expectedProd = new[] { "PROD.JSON.BAK-Upper", "prod.json.bak-20260101-120000", "prod.json.bak-before-edit" };
+            var expectedDefault = new[] { "DARLING.JSON.BAK-Upper", "darling.json.bak-other-install" };
+
+            foreach (var culture in new[] { "en-US", "tr-TR" })
+            {
+                System.Globalization.CultureInfo.CurrentCulture = new System.Globalization.CultureInfo(culture);
+
+                var prod = System.Linq.Enumerable.ToArray(System.Linq.Enumerable.OrderBy(
+                    System.Linq.Enumerable.Select(DarlingCliCommands.ConfigBackupFiles(directory, "prod.json"), Path.GetFileName), n => n, StringComparer.Ordinal));
+                Assert.Equal(expectedProd, prod);
+
+                var defaults = System.Linq.Enumerable.ToArray(System.Linq.Enumerable.OrderBy(
+                    System.Linq.Enumerable.Select(DarlingCliCommands.ConfigBackupFiles(directory, "darling.json"), Path.GetFileName), n => n, StringComparer.Ordinal));
+                Assert.Equal(expectedDefault, defaults);
+
+                var swept = System.Linq.Enumerable.ToArray(System.Linq.Enumerable.OrderBy(
+                    System.Linq.Enumerable.Select(DarlingConfigBackup.ListBackups(directory, "prod.json"), Path.GetFileName), n => n, StringComparer.Ordinal));
+                Assert.Equal(expectedProd, swept);
+
+                Assert.True(DarlingConfigBackup.IsBackupName("darling.json", "DARLING.JSON.BAK-X"), culture);
+                Assert.True(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak-x"), culture);
+                Assert.False(DarlingConfigBackup.IsBackupName("darling.json", "DARLİNG.JSON.BAK-X"), culture);
+                Assert.False(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak"), culture);
+                Assert.False(DarlingConfigBackup.IsBackupName("prod.json", "darling.json.bak-x"), culture);
+            }
+
+            Assert.Equal("darling.json.bak-", DarlingConfigBackup.Prefix);
+        }
+        finally
+        {
+            System.Globalization.CultureInfo.CurrentCulture = previous;
+            Directory.Delete(directory, recursive: true);
+        }
+    }
 }
 
 /// <summary>
diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index f223883cde..f9d4f82998 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -567,7 +567,7 @@ public void TheNarrowedLock_KeepsTheServiceOnItsConfig_AndHandsTheKeyFolderOverA
         Assert.Contains("return @((Get-DarlingServiceWrittenNames).KeyDirectories)", helper, StringComparison.Ordinal);
         Assert.Contains("(Get-DarlingServiceWrittenNames).Directories", lockText, StringComparison.Ordinal);
         Assert.Contains("$names.Files", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
-        Assert.Contains("$names.BackupGlob", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+        Assert.Contains("$names.BackupPrefix", ExtractFunction(InstallScript, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
         Assert.Contains("'darling-keys'", ExtractFunction(InstallScript, "Get-DarlingServiceWrittenNames"), StringComparison.Ordinal);
         Assert.Equal(PerformanceMonitor.Darling.Service.DarlingLogHashKeyFile.BringYourOwnDirectoryName, "darling-keys");
         Assert.DoesNotContain("(Split-Path -LiteralPath $configPath -Parent)", helper, StringComparison.Ordinal);
@@ -596,7 +596,7 @@ public void ThePreLockWritableExtractionCheck_ShipsIdenticallyInTheInstallAndUpg
         foreach (var name in new[]
         {
             "Get-DarlingServiceSids", "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName",
-            "Test-DarlingServiceWrittenPath", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
+            "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
             "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice",
             "Get-DarlingRefusalAdvice", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
         })
@@ -724,9 +724,9 @@ public void TheExistingInstallRefusal_GivesTheNumberedSteps_AndAFreshFolderKeeps
         Assert.DoesNotContain("Stop the", fresh, StringComparison.Ordinal);
 
         // Both scripts choose the steps by where the registered service runs from: no darling.json or pg-runtime test.
-        Assert.Contains("$advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable", InstallScript, StringComparison.Ordinal);
+        Assert.Contains("$advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName) $writableRecords", InstallScript, StringComparison.Ordinal);
         Assert.DoesNotContain("$existingInstall", InstallScript, StringComparison.Ordinal);
-        Assert.Contains("$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable)", upgrade, StringComparison.Ordinal);
+        Assert.Contains("$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName) $writableRecords)", upgrade, StringComparison.Ordinal);
         Assert.DoesNotContain("Get-DarlingExistingInstallSteps $InstallRoot", upgrade, StringComparison.Ordinal);
         Assert.DoesNotContain("Get-DarlingExistingInstallSteps $root", InstallScript, StringComparison.Ordinal);
         Assert.DoesNotContain("a fresh install into a folder only an administrator can write to", upgrade, StringComparison.Ordinal);
@@ -1015,6 +1015,7 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
             $root = 'C:\Program Files\PerformanceMonitorDarling'
+            $fileItem = [pscustomobject]@{ PSIsContainer = $false; LinkType = $null; Attributes = [IO.FileAttributes]::Normal }
             foreach ($name in @('darling.json', 'DARLING.JSON', 'darling.json.bak-20260101-120000', 'darling.json.bak-20260101-120000-2',
                                 'darling.json.bak-x.dll', 'darling.json.bak-20260101', 'darling.json.bak-before-edit', 'DARLING.JSON.BAK-Upper', 'darling.json.bak-', 'darling.json.bak', 'darling.jsonbak-x', 'xdarling.json.bak-x', 'darling.json.', 'xdarling.json')) {
                 'name:' + $name + '=' + (Test-DarlingServiceWrittenFileName $name)
@@ -1024,8 +1025,15 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
                 @('pg-runtime.\a.dll', @()), @('pg-runtime-x\a.dll', @()), @('pg-runtimeX', @()), @('pg-runtime\..\a.dll', @()), @('other\pg-runtime\a.dll', @()),
                 @('darling.json', @()), @('darling.json.bak-20260101-120000', @()), @('darling.json.bak-x.dll', @()), @('darling.json.bak-before-edit', @()), @('xdarling.json.bak-x', @()), @('darling.json.bak', @()), @('other\darling.json', @()), @('darling.json\x', @()),
                 @('darling-keys\log-hash.key', @()), @('darling-keys\log-hash.key', @('darling-keys')), @('darling-keys-x\a', @('darling-keys')), @('PerformanceMonitor.Darling.Service.exe', @()))) {
-                'path:' + $case[0] + '|' + @($case[1]).Count + '=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root $case[0]) @($case[1]))
+                'path:' + $case[0] + '|' + @($case[1]).Count + '=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root $case[0]) @($case[1]) $fileItem)
             }
+            # #5649: the files-only answer comes from the item the caller listed, never from the disk.
+            'item:folder=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() ([pscustomobject]@{ PSIsContainer = $true; LinkType = $null; Attributes = [IO.FileAttributes]::Directory }))
+            'item:hardLink=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() ([pscustomobject]@{ PSIsContainer = $false; LinkType = 'HardLink'; Attributes = [IO.FileAttributes]::Normal }))
+            'item:reparse=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() ([pscustomobject]@{ PSIsContainer = $false; LinkType = 'SymbolicLink'; Attributes = [IO.FileAttributes]::ReparsePoint }))
+            'item:none=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @())
+            'item:plainFile=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() $fileItem)
+            'item:directoryNeedsNoItem=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'pg-runtime\a.dll') @())
             'path:root=' + (Test-DarlingServiceWrittenPath $root $root @('darling-keys'))
             'path:outside=' + (Test-DarlingServiceWrittenPath $root 'C:\Program Files\PerformanceMonitorDarling-2\pg-runtime\a.dll' @())
             """);
@@ -1056,6 +1064,13 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
 
         Assert.Contains("path:root=False", answers);
         Assert.Contains("path:outside=False", answers);
+
+        Assert.Contains("item:plainFile=True", answers);
+        Assert.Contains("item:directoryNeedsNoItem=True", answers);
+        foreach (var no in new[] { "item:folder", "item:hardLink", "item:reparse", "item:none" })
+        {
+            Assert.Contains($"{no}=False", answers);
+        }
     }
 
     /// <summary>
@@ -1116,6 +1131,18 @@ function Reset-Extras {
                 Own 'other\darling.json.bak-nested' @($script:serviceSid)
                 Show 'nested' $registered "NT SERVICE\$serviceName"
                 Reset-Extras
+
+                # #5649: a backup-named file with a second name (a hard link to a file outside the root) is never one the
+                # service writes: it is reported as a finding of its own, and the service's grant and ownership on it
+                # are named like a stranger's.
+                $outside = "$($script:root)-outside.txt"
+                Set-Content -LiteralPath $outside -Value 'x'
+                New-Item -ItemType HardLink -Path "$($script:root)\darling.json.bak-linked" -Value $outside | Out-Null
+                'setup.hardLinkMade=' + ((Get-Item -LiteralPath "$($script:root)\darling.json.bak-linked").LinkType -eq 'HardLink')
+                Own 'darling.json.bak-linked' @($script:serviceSid)
+                Show 'hardLink' $registered "NT SERVICE\$serviceName"
+                Reset-Extras
+                Remove-Item -LiteralPath $outside -Force
             }
             finally {
                 Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
@@ -1143,18 +1170,28 @@ function Reset-Extras {
         Assert.Contains("folder.count=1", answers);
         Assert.Contains(answers, a => a.StartsWith("folder.text=", StringComparison.Ordinal)
             && a.Contains("<root>\\darling.json.bak-dir (owned by", StringComparison.Ordinal));
+
+        Assert.Contains("hardLink.count=3", answers);
+        Assert.Contains(answers, a => a.StartsWith("hardLink.text=", StringComparison.Ordinal)
+            && a.Contains("<root>\\darling.json.bak-linked (a hard link: this file has more than one name", StringComparison.Ordinal)
+            && a.Contains("on <root>\\darling.json.bak-linked", StringComparison.Ordinal)
+            && a.Contains("<root>\\darling.json.bak-linked (owned by", StringComparison.Ordinal));
     }
 
     /// <summary>
-    /// #5649: the refusal's advice. When EVERY entry is on a darling.json.bak-* file directly in the install folder,
-    /// it names the files and gives the one-file fix (move them to a folder only Administrators can read, then run the
-    /// command again), and says nothing about moving the install. Any other entry (another file, a folder, a link, a
-    /// path inside a folder, darling.json itself) keeps the old advice. Both scripts.
+    /// #5649: the refusal's advice. When EVERY finding is a grant or an owner on a darling.json.bak-* file directly in the
+    /// install folder, a note comes FIRST: it names the files, says a backup can hold the secrets that were in
+    /// darling.json and that the files can be moved to a folder only Administrators can read. The standard advice follows
+    /// it unchanged (the service owns the files it writes, so a backup that is a finding belongs to, or is writable by,
+    /// some other account, and the folder is replaced as usual). The decision is made from each finding's kind and path,
+    /// never its text: any other finding (another file, a folder, a link, a file with more than one name, a path inside
+    /// a folder, a path that could not be read or listed, darling.json itself, the folder) keeps the standard advice
+    /// alone, even beside a backup-named file whose name makes the text of other findings look like a backup's. Both scripts.
     /// </summary>
     [Theory]
     [InlineData("install-darling.ps1")]
     [InlineData("upgrade-darling.ps1")]
-    public void TheRefusalAdvice_NamesTheBackupFilesAndTheOneFileFix_OnlyWhenEveryEntryIsABackup(string scriptName)
+    public void TheRefusalAdvice_PutsTheBackupNoteAheadOfTheStandardAdvice_OnlyWhenEveryFindingIsABackup(string scriptName)
     {
         var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
         var probe = new StringBuilder();
@@ -1163,26 +1200,37 @@ public void TheRefusalAdvice_NamesTheBackupFilesAndTheOneFileFix_OnlyWhenEveryEn
             $ErrorActionPreference = 'Stop'
             $root = Join-Path $env:TEMP ('pm5649-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
             New-Item -ItemType Directory -Path "$root\other", "$root\darling.json.bak-dir" -Force | Out-Null
-            foreach ($n in @('darling.json.bak-before-edit', 'darling.json.bak-20260101-120000', 'notes.txt', 'darling.json', 'other\darling.json.bak-nested')) { Set-Content -LiteralPath "$root\$n" -Value '{}' }
+            foreach ($n in @('darling.json.bak-before-edit', 'darling.json.bak-20260101-120000', 'darling.json.bak-x', 'notes.txt', 'darling.json', 'other\darling.json.bak-nested')) { Set-Content -LiteralPath "$root\$n" -Value '{}' }
             $root = [System.IO.Path]::GetFullPath($root)
+            function F([string]$kind, [string]$path, [bool]$isFile = $true) { [pscustomobject]@{ Kind = $kind; Path = $path; Text = "$kind $path"; IsFile = $isFile } }
             function Show([string]$label, [array]$findings, [string]$registered) {
                 '@@' + $label
                 Get-DarlingRefusalAdvice $root 'PerformanceMonitor Darling' $registered $findings
             }
             try {
-                $all = @("BUILTIN\Users on $root\darling.json.bak-before-edit",
-                         "$root\darling.json.bak-before-edit (owned by CONTOSO\someone)",
-                         "BUILTIN\Users on $root\darling.json.bak-20260101-120000")
+                $all = @((F 'Grant' "$root\darling.json.bak-before-edit"), (F 'Owner' "$root\darling.json.bak-before-edit"), (F 'Grant' "$root\darling.json.bak-20260101-120000"))
                 Show 'backupsOnly' $all ''
                 Show 'backupsOnlyInstalledHere' $all $root
-                Show 'withOtherFile' ($all + "BUILTIN\Users on $root\notes.txt") ''
-                Show 'withFolder' ($all + "BUILTIN\Users on $root\darling.json.bak-dir") ''
-                Show 'withLink' ($all + "$root\darling.json.bak-before-edit (a junction or link)") ''
-                Show 'withNested' ($all + "BUILTIN\Users on $root\other\darling.json.bak-nested") ''
-                Show 'withConfig' ($all + "BUILTIN\Users on $root\darling.json") ''
-                Show 'withRoot' ($all + "BUILTIN\Users on $root") ''
-                Show 'withMissing' ($all + "BUILTIN\Users on $root\darling.json.bak-gone") ''
+                Show 'withOtherFile' ($all + (F 'Grant' "$root\notes.txt")) ''
+                Show 'withFolder' ($all + (F 'Grant' "$root\darling.json.bak-dir" $false)) ''
+                Show 'withLink' ($all + (F 'Link' "$root\darling.json.bak-before-edit")) ''
+                Show 'withHardLink' ($all + (F 'HardLink' "$root\darling.json.bak-before-edit")) ''
+                Show 'withNested' ($all + (F 'Grant' "$root\other\darling.json.bak-nested")) ''
+                Show 'withConfig' ($all + (F 'Grant' "$root\darling.json")) ''
+                Show 'withRoot' ($all + (F 'Grant' $root $false)) ''
+                Show 'withUnreadable' ($all + (F 'Unreadable' "$root\darling.json.bak-x")) ''
+                Show 'withUnlisted' ($all + (F 'Unlisted' "$root\darling.json.bak-x" $false)) ''
                 Show 'noFindings' @() ''
+                Show 'noFindingsInstalledHere' @() $root
+
+                # A real file called darling.json.bak-x, and findings whose rendered text would read as that file's:
+                # none of them is a grant or an owner on a file in the root, so none of them gets the note.
+                $x = "$root\darling.json.bak-x (owned by y)"
+                Show 'craftedLink' @((F 'Owner' "$root\darling.json.bak-x"), [pscustomobject]@{ Kind = 'Link'; Path = $x; Text = "$x (a junction or link)"; IsFile = $true }) ''
+                Show 'craftedNested' @((F 'Owner' "$root\darling.json.bak-x"), [pscustomobject]@{ Kind = 'Owner'; Path = "$x\evil.dll"; Text = "$x\evil.dll (owned by DOM\eve)"; IsFile = $true }) ''
+                Show 'craftedUnlisted' @((F 'Owner' "$root\darling.json.bak-x"), [pscustomobject]@{ Kind = 'Unlisted'; Path = $x; Text = "$x (its contents could not be listed: UnauthorizedAccessException)"; IsFile = $true }) ''
+                Show 'craftedUnreadable' @((F 'Owner' "$root\darling.json.bak-x"), [pscustomobject]@{ Kind = 'Unreadable'; Path = $x; Text = "$x (its permissions could not be read: Access is denied.)"; IsFile = $true }) ''
+                Show 'plainTextFindings' @("$root\darling.json.bak-x (owned by y)") ''
             }
             finally {
                 Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
@@ -1192,35 +1240,177 @@ function Show([string]$label, [array]$findings, [string]$registered) {
         var text = string.Join("\n", RunWindowsPowerShell(probe.ToString())).Replace("\r\n", "\n", StringComparison.Ordinal);
         string Section(string label) => System.Text.RegularExpressions.Regex.Match(text, "@@" + label + "\n(?<body>.*?)(?=\n@@|$)", System.Text.RegularExpressions.RegexOptions.Singleline).Groups["body"].Value;
 
-        foreach (var label in new[] { "backupsOnly", "backupsOnlyInstalledHere" })
+        const string Note = "Every entry above is a darling.json.bak-* backup file in this folder: darling.json.bak-before-edit, darling.json.bak-20260101-120000.";
+        foreach (var (label, standard) in new[] { ("backupsOnly", "noFindings"), ("backupsOnlyInstalledHere", "noFindingsInstalledHere") })
         {
             var advice = Section(label);
-            Assert.Contains("Every entry above is a darling.json.bak-* backup file in this folder: darling.json.bak-before-edit, darling.json.bak-20260101-120000.", advice, StringComparison.Ordinal);
-            Assert.Contains("You do not need to move the install. Move just those files out of this folder, into a folder only", advice, StringComparison.Ordinal);
-            Assert.Contains("Administrators can read, because a backup can hold the secrets that were in darling.json. Then run", advice, StringComparison.Ordinal);
-            Assert.Contains("this command again.", advice, StringComparison.Ordinal);
-            Assert.DoesNotContain("Do NOT try to repair", advice, StringComparison.Ordinal);
-            Assert.DoesNotContain("Stop the", advice, StringComparison.Ordinal);
-            Assert.DoesNotContain("Extract the zip", advice, StringComparison.Ordinal);
+            var standardAdvice = Section(standard).Trim();
+            Assert.False(string.IsNullOrWhiteSpace(standardAdvice));
+            Assert.StartsWith(Note, advice, StringComparison.Ordinal);
+            Assert.Contains("A backup can hold the secrets that were in darling.json.", advice, StringComparison.Ordinal);
+            Assert.Contains("These files can be moved out of this folder, into a", advice, StringComparison.Ordinal);
+            Assert.Contains("folder only Administrators can read.", advice, StringComparison.Ordinal);
+            Assert.Contains(standardAdvice, advice, StringComparison.Ordinal);
+            Assert.True(advice.IndexOf(Note, StringComparison.Ordinal) < advice.IndexOf(standardAdvice, StringComparison.Ordinal), "the note comes first");
+            Assert.DoesNotContain("You do not need to move the install", advice, StringComparison.Ordinal);
         }
 
-        foreach (var label in new[] { "withOtherFile", "withFolder", "withLink", "withNested", "withConfig", "withRoot", "withMissing", "noFindings" })
+        Assert.Contains("Do NOT try to repair this folder's permissions in place.", Section("backupsOnly"), StringComparison.Ordinal);
+        Assert.Contains("Stop the 'PerformanceMonitor Darling' service", Section("backupsOnlyInstalledHere"), StringComparison.Ordinal);
+
+        foreach (var label in new[] { "withOtherFile", "withFolder", "withLink", "withHardLink", "withNested", "withConfig", "withRoot", "withUnreadable", "withUnlisted",
+            "craftedLink", "craftedNested", "craftedUnlisted", "craftedUnreadable", "plainTextFindings", "noFindings" })
         {
             var advice = Section(label);
+            Assert.Equal(Section("noFindings").Trim(), advice.Trim());
             Assert.Contains("Do NOT try to repair this folder's permissions in place.", advice, StringComparison.Ordinal);
             Assert.DoesNotContain("backup file in this folder", advice, StringComparison.Ordinal);
-            Assert.DoesNotContain("You do not need to move the install", advice, StringComparison.Ordinal);
         }
     }
 
+    /// <summary>
+    /// #5649: the walk's own records feed the advice. A tree whose only findings are a grant on a root-level backup file
+    /// gets the note; the same tree with one more finding of another kind next to it (an owner below a folder, a junction,
+    /// a folder named like a backup, a hard-linked backup) does not. The walk reports each finding's kind and whether the
+    /// item it listed is a file, so no text is parsed and no second look at the disk happens.
+    /// </summary>
+    [Fact]
+    public void TheWalksRecords_DecideTheBackupNote_AndNoTextIsParsed()
+    {
+        var probe = ServiceOwnedTreeProbe();
+        probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingBackupFileFindingNames"));
+        probe.AppendLine("""
+            $usersSid = New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinUsersSid, $null)
+            function ShowRecords([string]$label) {
+                $sets = Get-DarlingPreLockTrustedSidsForRerun $serviceName $registered
+                $records = @(Get-UntrustedWriteGrantees $script:root $sets.Trusted -AsRecords -Recurse -ServiceSids $sets.ServiceSids -ServiceDirectories $script:serviceDirs)
+                $label + '.kinds=' + (($records | ForEach-Object { $_.Kind + ':' + $_.IsFile }) -join ',')
+                $label + '.names=' + (@(Get-DarlingBackupFileFindingNames $script:root $records) -join ',')
+                $label + '.texts=' + ((@(Get-UntrustedWriteGrantees $script:root $sets.Trusted -Recurse -ServiceSids $sets.ServiceSids -ServiceDirectories $script:serviceDirs)) -join ' ; ' -replace [regex]::Escape($script:root), '<root>')
+            }
+            $script:logon = "NT SERVICE\$serviceName"
+            function Get-DarlingServiceLogonName([string]$name) { return $script:logon }
+            $outside = "$($script:root)-outside.txt"
+            try {
+                Set-Content -LiteralPath "$($script:root)\darling.json.bak-before-edit" -Value '{}'
+                New-Item -ItemType Directory -Path "$($script:root)\darling.json.bak-dir" -Force | Out-Null
+                'setup.backupMade=' + (Test-Path -LiteralPath "$($script:root)\darling.json.bak-before-edit")
+
+                $script:fileGrants['darling.json.bak-before-edit'] = @($usersSid)
+                ShowRecords 'backupGrant'
+
+                $script:serviceOwned = @('other\tool.dll')
+                ShowRecords 'plusNestedOwner'
+                $script:serviceOwned = @()
+
+                $script:serviceOwned = @('darling.json.bak-dir')
+                ShowRecords 'plusFolder'
+                $script:serviceOwned = @()
+
+                & cmd.exe /c mklink /J "$($script:root)\linked-dir" "$($script:root)\other" | Out-Null
+                'setup.junctionMade=' + (Test-Path -LiteralPath "$($script:root)\linked-dir")
+                ShowRecords 'plusJunction'
+                & cmd.exe /c rmdir "$($script:root)\linked-dir" | Out-Null
+
+                Set-Content -LiteralPath $outside -Value 'x'
+                New-Item -ItemType HardLink -Path "$($script:root)\darling.json.bak-linked" -Value $outside | Out-Null
+                'setup.hardLinkMade=' + ((Get-Item -LiteralPath "$($script:root)\darling.json.bak-linked").LinkType -eq 'HardLink')
+                ShowRecords 'plusHardLink'
+            }
+            finally {
+                if (Test-Path -LiteralPath "$($script:root)\linked-dir") { & cmd.exe /c rmdir "$($script:root)\linked-dir" | Out-Null }
+                Remove-Item -LiteralPath $outside -Force -ErrorAction SilentlyContinue
+                Remove-Item -LiteralPath $script:root -Recurse -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunServiceOwnedTreeProbe(probe);
+
+        Assert.Contains("backupGrant.names=darling.json.bak-before-edit", answers);
+        Assert.Contains("backupGrant.kinds=Grant:True", answers);
+        foreach (var label in new[] { "plusNestedOwner", "plusFolder", "plusJunction", "plusHardLink" })
+        {
+            Assert.Contains($"{label}.names=", answers);
+            Assert.DoesNotContain($"{label}.names=darling.json.bak-before-edit", answers);
+        }
+
+        Assert.Contains(answers, a => a.StartsWith("plusNestedOwner.kinds=", StringComparison.Ordinal) && a.Contains("Grant:True", StringComparison.Ordinal) && a.Contains("Owner:True", StringComparison.Ordinal));
+        Assert.Contains(answers, a => a.StartsWith("plusFolder.kinds=", StringComparison.Ordinal) && a.Contains("Owner:False", StringComparison.Ordinal));
+        Assert.Contains(answers, a => a.StartsWith("plusJunction.kinds=", StringComparison.Ordinal) && a.Contains("Link:False", StringComparison.Ordinal));
+        Assert.Contains(answers, a => a.StartsWith("plusHardLink.kinds=", StringComparison.Ordinal) && a.Contains("HardLink:True", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// #5649: the root files the lock and the install pass act on. Only plain files with a name on the service-written
+    /// list; a hard-linked backup is left out (the service as owner, or a FullControl grant, would land on the other name
+    /// too), and so is a backup whose name differs only by case under Turkish culture rules ('I' and 'i' fold
+    /// differently there, so a culture-sensitive match would drop DARLING.JSON.BAK-B or keep a look-alike).
+    /// </summary>
+    [Fact]
+    public void TheServiceWrittenRootFiles_LeaveOutHardLinks_AndMatchTheBackupPrefixByOrdinalNameUnderAnyCulture()
+    {
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, InstallScript);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = Join-Path $env:TEMP ('pm5649-rf-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path "$root\darling.json.bak-dir" -Force | Out-Null
+            foreach ($n in @('darling.json', 'darling.json.bak-a', 'DARLING.JSON.BAK-B', 'notes.txt', 'darling.jsonx', 'darling.json.bak')) { Set-Content -LiteralPath "$root\$n" -Value '{}' }
+            New-Item -ItemType HardLink -Path "$root\darling.json.bak-linked" -Value "$root\notes.txt" | Out-Null
+            $outside = "$root-outside.txt"
+            Set-Content -LiteralPath $outside -Value 'x'
+            New-Item -ItemType HardLink -Path "$root\darling.json.bak-outside" -Value $outside | Out-Null
+            function Names($files) { (@($files | ForEach-Object { $_.Name } | Sort-Object { $_.ToLowerInvariant() }) -join ',') }
+            try {
+                'setup.hardLinksMade=' + ((Get-Item -LiteralPath "$root\darling.json.bak-linked").LinkType -eq 'HardLink' -and (Get-Item -LiteralPath "$root\darling.json.bak-outside").LinkType -eq 'HardLink')
+                'all=' + (Names (Get-DarlingServiceWrittenRootFiles $root))
+                'backups=' + (Names (Get-DarlingServiceWrittenRootFiles $root -BackupsOnly))
+
+                [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object System.Globalization.CultureInfo 'tr-TR'
+                'setup.turkishCultureTook=' + (-not ('DARLING.JSON.BAK-B' -like 'darling.json.bak-*'))
+                'tr.all=' + (Names (Get-DarlingServiceWrittenRootFiles $root))
+                'tr.backups=' + (Names (Get-DarlingServiceWrittenRootFiles $root -BackupsOnly))
+                foreach ($name in @('DARLING.JSON.BAK-X', 'darling.json.bak-x', 'Darling.Json.Bak-X', 'DARLING.JSON')) {
+                    'tr.name:' + $name + '=' + (Test-DarlingServiceWrittenFileName $name)
+                }
+                $lookAlike = 'DARL' + [char]0x130 + 'NG.JSON.BAK-X'
+                'tr.lookAlike=' + (Test-DarlingServiceWrittenFileName $lookAlike)
+                [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object System.Globalization.CultureInfo 'en-US'
+                'en.lookAlike=' + (Test-DarlingServiceWrittenFileName $lookAlike)
+            }
+            finally {
+                Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
+                Remove-Item -LiteralPath $outside -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
+
+        Assert.Contains("all=darling.json,darling.json.bak-a,DARLING.JSON.BAK-B", answers);
+        Assert.Contains("backups=darling.json.bak-a,DARLING.JSON.BAK-B", answers);
+        Assert.Contains("tr.all=darling.json,darling.json.bak-a,DARLING.JSON.BAK-B", answers);
+        Assert.Contains("tr.backups=darling.json.bak-a,DARLING.JSON.BAK-B", answers);
+        foreach (var name in new[] { "DARLING.JSON.BAK-X", "darling.json.bak-x", "Darling.Json.Bak-X", "DARLING.JSON" })
+        {
+            Assert.Contains($"tr.name:{name}=True", answers);
+        }
+
+        Assert.Contains("tr.lookAlike=False", answers);
+        Assert.Contains("en.lookAlike=False", answers);
+    }
+
     /// <summary>
     /// #5649: one definition of which files are a config backup, per language, and the two are the same text. In
-    /// PowerShell it is BackupGlob in the list both scripts share; the pre-lock walk, the install-time hardening and the
-    /// upgrade's manifest guard all read it. In C# it is DarlingConfigBackup, which TryHardenConfigBackups and the CLI's
-    /// permission check read. Nothing spells the glob a second time, and the stamped-name pattern is gone.
+    /// PowerShell it is BackupPrefix in the list both scripts share, tested with an ordinal, case-insensitive StartsWith
+    /// at every site (the pre-lock walk, the lock and the install-time hardening through Get-DarlingServiceWrittenRootFiles,
+    /// and the upgrade's manifest guard): -like and -Filter fold case by the current culture and, in Windows PowerShell
+    /// 5.1, match some look-alike characters, so they can disagree with the service. In C# it is DarlingConfigBackup,
+    /// which TryHardenConfigBackups and the CLI's permission check read, with the same ordinal test. Nothing spells the
+    /// name a second time, and the stamped-name pattern is gone.
     /// </summary>
     [Fact]
-    public void TheBackupGlob_HasOneDefinitionPerLanguage_AndTheSameText()
+    public void TheBackupPrefix_HasOneDefinitionPerLanguage_AndTheSameText()
     {
         var upgrade = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1"));
         var worker = ReadRepoFile(Path.Combine("Darling", "PerformanceMonitor.Darling.Service", "DarlingWorker.cs"));
@@ -1228,22 +1418,31 @@ public void TheBackupGlob_HasOneDefinitionPerLanguage_AndTheSameText()
 
         foreach (var script in new[] { InstallScript, upgrade })
         {
-            var glob = System.Text.RegularExpressions.Regex.Matches(ExtractFunction(script, "Get-DarlingServiceWrittenNames"), @"BackupGlob\s*=\s*'(?<g>[^']+)'");
-            Assert.Single(glob);
-            Assert.Equal(PerformanceMonitor.Darling.Service.DarlingConfigBackup.Glob, glob[0].Groups["g"].Value);
-            Assert.Contains("$name -like $names.BackupGlob", ExtractFunction(script, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+            var prefix = System.Text.RegularExpressions.Regex.Matches(ExtractFunction(script, "Get-DarlingServiceWrittenNames"), @"BackupPrefix\s*=\s*'(?<g>[^']+)'");
+            Assert.Single(prefix);
+            Assert.Equal(PerformanceMonitor.Darling.Service.DarlingConfigBackup.Prefix, prefix[0].Groups["g"].Value);
+            Assert.Contains("$name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)", ExtractFunction(script, "Test-DarlingServiceWrittenFileName"), StringComparison.Ordinal);
+            Assert.DoesNotContain("BackupGlob", script, StringComparison.Ordinal);
             Assert.DoesNotContain("BackupPattern", script, StringComparison.Ordinal);
+            Assert.DoesNotContain("-Filter (Get-DarlingServiceWrittenNames)", script, StringComparison.Ordinal);
             Assert.DoesNotContain("-Filter 'darling.json.bak-", script, StringComparison.Ordinal);
             Assert.DoesNotContain("StartsWith('darling.json.bak-'", script, StringComparison.Ordinal);
+            Assert.DoesNotContain("-like 'darling.json.bak-", script, StringComparison.Ordinal);
+
+            /* The lock's service-owned loop reads the helper (which drops hard links), and its walk does not trust a hard link as a secret file. */
+            var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
+            Assert.Contains("foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root))", lockText, StringComparison.Ordinal);
+            Assert.Contains("(Test-DarlingServiceWrittenFileName $target.Name) -and ($target.LinkType -ne 'HardLink')", lockText, StringComparison.Ordinal);
         }
 
-        Assert.Contains("-Filter (Get-DarlingServiceWrittenNames).BackupGlob -File", InstallScript, StringComparison.Ordinal);
-        Assert.Contains("$leaf -like (Get-DarlingServiceWrittenNames).BackupGlob", upgrade, StringComparison.Ordinal);
+        Assert.Contains("Get-DarlingServiceWrittenRootFiles $root -BackupsOnly", InstallScript, StringComparison.Ordinal);
+        Assert.Contains("$leaf.StartsWith((Get-DarlingServiceWrittenNames).BackupPrefix, [StringComparison]::OrdinalIgnoreCase)", upgrade, StringComparison.Ordinal);
 
+        Assert.Equal("darling.json.bak-", PerformanceMonitor.Darling.Service.DarlingConfigBackup.Prefix);
         Assert.Equal("darling.json.bak-*", PerformanceMonitor.Darling.Service.DarlingConfigBackup.Glob);
-        Assert.Contains("Path.GetFileName(configPath) + DarlingConfigBackup.GlobSuffix", worker, StringComparison.Ordinal);
+        Assert.Contains("DarlingConfigBackup.ListBackups(directory, Path.GetFileName(configPath))", worker, StringComparison.Ordinal);
         Assert.DoesNotContain("\".bak-*\"", worker, StringComparison.Ordinal);
-        Assert.Contains("SafeEnumerate(Path.GetDirectoryName(resolvedConfig), DarlingConfigBackup.Glob)", cli, StringComparison.Ordinal);
+        Assert.Contains("ConfigBackupFiles(Path.GetDirectoryName(resolvedConfig), Path.GetFileName(resolvedConfig))", cli, StringComparison.Ordinal);
         Assert.DoesNotContain("\"darling.json.bak-*\"", cli, StringComparison.Ordinal);
     }
 
@@ -2279,7 +2478,7 @@ public void TheWritableTreeCheck_RunsBeforeEitherScriptChangesAnything()
         AssertRunsFirst(
             InstallScript,
             "install-darling.ps1",
-            "$writable = @(Get-UntrustedWriteGrantees $root $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories",
+            "$writableRecords = @(Get-UntrustedWriteGrantees $root $preLockTrusted.Trusted -AsRecords -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories",
             new[]
             {
                 ("Invoke-InstallTreeLock $lockAccount -StopOnOpen", "the step 1b2 install-tree lock"),
@@ -2294,7 +2493,7 @@ public void TheWritableTreeCheck_RunsBeforeEitherScriptChangesAnything()
         AssertRunsFirst(
             ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1")),
             "upgrade-darling.ps1",
-            "$writable = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories",
+            "$writableRecords = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted.Trusted -AsRecords -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories",
             new[]
             {
                 ("$zipStagingFolder = New-DarlingProtectedStagingFolder", "creating the zip staging folder"),
@@ -2522,7 +2721,7 @@ there is no ACL to read and this probe never emits the line at all. */
     /// (the lock and the pre-lock walk both read them).</summary>
     private static void AppendServiceWrittenList(StringBuilder probe, string script)
     {
-        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Test-DarlingServiceWrittenPath" })
+        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles" })
         {
             probe.AppendLine(ExtractFunction(script, name));
         }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
index 25df180f06..352b8afa29 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
@@ -4122,7 +4122,7 @@ and the CLI verbs run as the operator and must still read the live config. Nothi
             new(resolvedConfig, AllowInteractive: true, IsDirectory: false, "the live config"),
         };
 
-        foreach (var backup in SafeEnumerate(Path.GetDirectoryName(resolvedConfig), DarlingConfigBackup.Glob))
+        foreach (var backup in ConfigBackupFiles(Path.GetDirectoryName(resolvedConfig), Path.GetFileName(resolvedConfig)))
         {
             targets.Add(new(backup, AllowInteractive: false, IsDirectory: false, "a config backup"));
         }
@@ -4336,6 +4336,14 @@ directory the service keeps from the operator entirely (darling-keys) keeps even
     /// (<see cref="DarlingPathContainment.IsStrictlyBelow"/>, #4004 review, round 3).</summary>
     internal static bool IsBelow(string directory, string path) => DarlingPathContainment.IsStrictlyBelow(directory, path);
 
+    /// <summary>The backups of the config file named <paramref name="configFileName"/> in <paramref name="directory"/>
+    /// (#5649): the files that start with that file's own name plus <c>.bak-</c> (<c>prod.json.bak-x</c> for
+    /// <c>prod.json</c>), which is what the config verbs write and what the service's start-up hardening takes, not the
+    /// default config's backups. The directory listing's pattern only narrows the list; the ordinal name test decides.</summary>
+    internal static IEnumerable<string> ConfigBackupFiles(string? directory, string configFileName) =>
+        SafeEnumerate(directory, configFileName + DarlingConfigBackup.GlobSuffix)
+            .Where(file => DarlingConfigBackup.IsBackupName(configFileName, Path.GetFileName(file)));
+
     /// <summary>Directory enumeration that treats an unreadable or missing folder as empty — this verb runs
     /// precisely when permissions are broken, so a throw here would defeat its purpose.</summary>
     private static IEnumerable<string> SafeEnumerate(string? directory, string pattern)
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
index f763a4ad1a..adcf84292c 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
@@ -6,6 +6,10 @@
  * Licensed under the MIT License. See LICENSE file in the project root for full license information.
  */
 
+using System;
+using System.IO;
+using System.Linq;
+
 namespace PerformanceMonitor.Darling.Service;
 
 /// <summary>
@@ -13,14 +17,36 @@ namespace PerformanceMonitor.Darling.Service;
 /// start-up hardening (<c>DarlingWorker.TryHardenConfigBackups</c>) and the CLI's permission check both take
 /// EVERY <c>darling.json.bak-*</c> file, not only the <c>darling.json.bak-yyyyMMdd-HHmmss</c> names the config
 /// verbs write, because a backup an operator named by hand holds the same secrets. The install and upgrade
-/// scripts spell the same glob once (<c>BackupGlob</c> in <c>Get-DarlingServiceWrittenNames</c>), and a test pins
-/// that spelling to <see cref="Glob"/> so the scripts' pre-lock check and this hardening cannot drift apart.
+/// scripts spell the same prefix once (<c>BackupPrefix</c> in <c>Get-DarlingServiceWrittenNames</c>) and test it with
+/// an ordinal, case-insensitive <c>StartsWith</c>; a test pins that spelling to <see cref="Prefix"/> so the scripts'
+/// pre-lock check and this hardening cannot drift apart. The search pattern handed to a directory listing only
+/// narrows the list: <see cref="IsBackupName"/> decides, so the two sides cannot read a name differently under
+/// another culture.
 /// </summary>
 internal static class DarlingConfigBackup
 {
+    /// <summary>The tail every backup name carries after the config file's own name.</summary>
+    public const string Tail = ".bak-";
+
     /// <summary>The tail every backup name carries after the config file's own name, as a search pattern.</summary>
-    public const string GlobSuffix = ".bak-*";
+    public const string GlobSuffix = Tail + "*";
+
+    /// <summary>The start of every backup name of the default <c>darling.json</c>.</summary>
+    public const string Prefix = "darling.json" + Tail;
 
     /// <summary>The search pattern for every backup of the default <c>darling.json</c>.</summary>
-    public const string Glob = "darling.json" + GlobSuffix;
+    public const string Glob = Prefix + "*";
+
+    /// <summary>Whether <paramref name="fileName"/> is a backup of the config file named <paramref name="configFileName"/>:
+    /// it starts with that name plus <see cref="Tail"/>, compared ordinally and ignoring case, as Windows compares names.</summary>
+    public static bool IsBackupName(string configFileName, string fileName) =>
+        fileName.StartsWith(configFileName + Tail, StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>The backups of the config file named <paramref name="configFileName"/> directly in
+    /// <paramref name="directory"/>: the directory listing's own pattern narrows the list, and <see cref="IsBackupName"/>
+    /// decides. Throws what the listing throws.</summary>
+    public static string[] ListBackups(string directory, string configFileName) =>
+        Directory.GetFiles(directory, configFileName + GlobSuffix)
+            .Where(file => IsBackupName(configFileName, Path.GetFileName(file)))
+            .ToArray();
 }
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
index bd2f62065a..62deb527e2 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingWorker.cs
@@ -2245,7 +2245,7 @@ internal static void TryHardenConfigBackups(string configPath, ILogger logger)
                 return;
             }
 
-            backups = Directory.GetFiles(directory, Path.GetFileName(configPath) + DarlingConfigBackup.GlobSuffix);
+            backups = DarlingConfigBackup.ListBackups(directory, Path.GetFileName(configPath));
         }
         catch (Exception ex)
         {
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index 1ea8e3021a..9d897e3c78 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -148,7 +148,11 @@ function Fail([string]$message) { Write-Host "ERROR: $message" -ForegroundColor
 # any other account: the lock gives the service read and execute on $path, so a write right there is not one
 # the lock put there. A caller that passes none (a source build, which the service never writes to) trusts
 # them nowhere.
-function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse, [array]$serviceSids = @(), [array]$serviceDirectories = @()) {
+#
+# The return is the finding TEXTS, or with -AsRecords one object per finding (Kind: Grant, Owner, Link, HardLink,
+# Unreadable or Unlisted; Path; Text, the same line the text form returns; IsFile, from the item the walk itself
+# listed) for the callers that decide something from what a finding IS, never from its text (#5649).
+function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse, [array]$serviceSids = @(), [array]$serviceDirectories = @(), [switch]$AsRecords) {
     $rights = [System.Security.AccessControl.FileSystemRights]
     $allow = [System.Security.AccessControl.AccessControlType]::Allow
     $sidType = [System.Security.Principal.SecurityIdentifier]
@@ -160,25 +164,31 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
         (New-Object System.Security.Principal.SecurityIdentifier($wk::CreatorGroupServerSid, $null)))
     $write = [int64]($rights::WriteData -bor $rights::AppendData -bor $rights::WriteAttributes -bor $rights::WriteExtendedAttributes -bor $rights::Delete -bor $rights::DeleteSubdirectoriesAndFiles -bor $rights::ChangePermissions -bor $rights::TakeOwnership) -bor 0x10000000 -bor 0x40000000
 
-    function Get-DarlingOneObjectWriteFindings([string]$itemPath, [bool]$includeInherited) {
+    function New-DarlingWriteFinding([string]$kind, [string]$findingPath, [string]$text, [bool]$isFile = $false) {
+        return [pscustomobject]@{ Kind = $kind; Path = $findingPath; Text = $text; IsFile = $isFile }
+    }
+    # $item is what the walk listed for $itemPath ($null for $path itself). The file-or-folder answer comes from it,
+    # never from a second look at the disk, so the check and the listing cannot disagree (#5649).
+    function Get-DarlingOneObjectWriteFindings([string]$itemPath, [bool]$includeInherited, $item = $null) {
+        $isFile = [bool]($null -ne $item -and -not $item.PSIsContainer)
         try { $acl = Get-Acl -LiteralPath $itemPath -ErrorAction Stop }
-        catch { return @("$itemPath (its permissions could not be read: $($_.Exception.Message))") }
+        catch { return @(New-DarlingWriteFinding 'Unreadable' $itemPath "$itemPath (its permissions could not be read: $($_.Exception.Message))" $isFile) }
         $ownerTrusted = $trusted
         $granteeTrusted = $trusted
         if (@($serviceSids).Count -gt 0) {
-            if (Test-DarlingServiceWrittenPath $path $itemPath $serviceDirectories) { $ownerTrusted = @($trusted) + @($serviceSids); $granteeTrusted = $ownerTrusted }
+            if (Test-DarlingServiceWrittenPath $path $itemPath $serviceDirectories $item) { $ownerTrusted = @($trusted) + @($serviceSids); $granteeTrusted = $ownerTrusted }
         }
         $bad = @($acl.GetAccessRules($true, $includeInherited, $sidType) | Where-Object {
             $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $granteeTrusted -notcontains $_.IdentityReference -and $inheritOnlyTemplates -notcontains $_.IdentityReference })
         $result = @($bad | ForEach-Object {
             $grantee = $_.IdentityReference
             $name = try { $grantee.Translate([System.Security.Principal.NTAccount]).Value } catch { $grantee.Value }
-            "$name on $itemPath"
+            New-DarlingWriteFinding 'Grant' $itemPath "$name on $itemPath" $isFile
         })
         $owner = $acl.GetOwner($sidType)
         if ($ownerTrusted -notcontains $owner) {
             $name = try { $owner.Translate([System.Security.Principal.NTAccount]).Value } catch { $owner.Value }
-            $result += "$itemPath (owned by $name)"
+            $result += New-DarlingWriteFinding 'Owner' $itemPath "$itemPath (owned by $name)" $isFile
         }
         return @($result)
     }
@@ -187,21 +197,31 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     if ($Recurse) {
         # -ErrorVariable, so a folder the walk cannot list is a finding of its own (#4043 round-2 review).
         # Skipped silently, nothing under it reached the checks above and the tree read as clean.
+        $rootFull = try { [IO.Path]::GetFullPath($path).TrimEnd('\') } catch { $path.TrimEnd('\') }
         foreach ($child in @(Get-ChildItem -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue -ErrorVariable listFailures)) {
             if ($child.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
-                $result += "$($child.FullName) (a junction or link)"
+                $result += New-DarlingWriteFinding 'Link' $child.FullName "$($child.FullName) (a junction or link)"
                 continue
             }
-            $result += Get-DarlingOneObjectWriteFindings $child.FullName $false
+            # A file with more than one name (a hard link) shares its permissions and its owner under every name, so
+            # one of them in the root with a name the service is trusted on would carry the other name's rights into
+            # the lock and the install pass (#5649). Reported like a link, for the root files the service writes.
+            if (-not $child.PSIsContainer -and $child.LinkType -eq 'HardLink' -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
+                $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
+            }
+            $result += Get-DarlingOneObjectWriteFindings $child.FullName $false $child
         }
         foreach ($failure in @($listFailures)) {
             $unlisted = if ($failure.TargetObject) { "$($failure.TargetObject)" } else { $path }
-            $result += "$unlisted (its contents could not be listed: $($failure.CategoryInfo.Reason))"
+            $result += New-DarlingWriteFinding 'Unlisted' $unlisted "$unlisted (its contents could not be listed: $($failure.CategoryInfo.Reason))"
         }
     }
     # Each finding once: a folder made under C:\ inherits BUILTIN\Users as two ACEs (one grants append, one
     # grants write), and without this every caller named that principal twice for the same path.
-    return @($result | Select-Object -Unique)
+    $seen = New-Object 'System.Collections.Generic.HashSet[string]'
+    $unique = @(foreach ($found in $result) { if ($seen.Add($found.Text)) { $found } })
+    if ($AsRecords) { return @($unique) }
+    return @($unique | ForEach-Object { $_.Text })
 }
 
 # Every SID that is a DIRECT member of BUILTIN\Administrators right now (round-1 review, #4043, M2): an
@@ -256,19 +276,23 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
 # account is trusted as owner and as a write grantee), so the two cannot drift apart. Directories are always
 # created and granted; KeyDirectories only on a bring-your-own PostgreSQL install (Get-DarlingExtraServiceWriteDirectories
 # returns them, and only then are they on the list). Files are matched in the install root only, and only files (a folder of the same name is not on the
-# list): darling.json, and every darling.json.bak-* file (BackupGlob, #5649). That is the glob the hardening covers: the
+# list): darling.json, and every file whose name starts with darling.json.bak- (BackupPrefix, #5649). That is the prefix the hardening covers: the
 # install-time pass in install-darling.ps1, the service's TryHardenConfigBackups and the CLI's backup enumeration all
 # take every darling.json.bak-* name, not only the darling.json.bak-yyyyMMdd-HHmmss(-N) names the config-editing verbs
 # write, so a backup an operator named by hand (darling.json.bak-before-edit) becomes service-owned at the next start
 # and must not read as a stranger's file. A backup is data the service reads and writes, never code that runs. This is
-# the ONE spelling of that glob in these scripts; DarlingConfigBackup.Glob in the service is the one in C#, and a test
-# pins the two to the same text. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# the ONE spelling of that prefix in these scripts, and every PowerShell site tests it with
+# StartsWith(prefix, OrdinalIgnoreCase): -like and -Filter fold case by the current culture (Turkish I) and, in Windows
+# PowerShell 5.1, match some look-alike characters, so they can disagree with the service. DarlingConfigBackup.Prefix
+# in the service is the one in C#, and a test pins the two to the same text. A file with more than one name (a hard
+# link) is never one the service writes: the root files this list covers come from Get-DarlingServiceWrittenRootFiles,
+# which leaves those out. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingServiceWrittenNames {
     return [pscustomobject]@{
         Directories    = @('pg-runtime', 'pg-runtime-prev')
         KeyDirectories = @('darling-keys')
         Files          = @('darling.json')
-        BackupGlob     = 'darling.json.bak-*'
+        BackupPrefix   = 'darling.json.bak-'
     }
 }
 
@@ -276,17 +300,33 @@ function Get-DarlingServiceWrittenNames {
 function Test-DarlingServiceWrittenFileName([string]$name) {
     $names = Get-DarlingServiceWrittenNames
     foreach ($file in @($names.Files)) {
-        if ($name -ieq $file) { return $true }
+        if ([string]::Equals($name, $file, [StringComparison]::OrdinalIgnoreCase)) { return $true }
     }
-    return [bool]($name -like $names.BackupGlob)
+    return [bool]$name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)
+}
+
+# The files directly in $root that the service writes (the names on the list above): the ones the lock makes the
+# service the owner of, and with -BackupsOnly the darling.json.bak-* ones the install pass hardens. A file with more
+# than one name (a hard link) and a file that is a link are left out, so neither gets the service as its owner or a
+# FullControl grant: those rights would land on the other names too (#5649). Hidden files are included. Kept
+# byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly) {
+    $names = Get-DarlingServiceWrittenNames
+    return @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object {
+        (Test-DarlingServiceWrittenFileName $_.Name) -and
+        (-not $BackupsOnly -or $_.Name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)) -and
+        $_.LinkType -ne 'HardLink' -and
+        -not ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) })
 }
 
 # True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
 # files directly in $root. $extraDirectories are the key folders Get-DarlingExtraServiceWriteDirectories returns
 # for this install, the same ones the lock is handed. The FIRST name below $root is compared exactly, and a name
 # Windows would fold into another ('pg-runtime.', a '..' step) matches nothing. The install root itself and every
-# other file or folder in it are not on the list.
-function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @()) {
+# other file or folder in it are not on the list. $item is what the caller's own walk listed for $candidate: a
+# listed file is trusted by name only when it is a plain file (not a folder, a link or a file with more than one
+# name), and with no item a root file is not trusted, so the answer never rests on a second look at the disk.
+function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @(), $item = $null) {
     try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
     catch { return $false }
     if (-not $candidate.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return $false }
@@ -298,8 +338,9 @@ function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [stri
     foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
         if ($segments[0] -ieq $directory) { return $true }
     }
-    # Files only (#5649): a folder that carries a listed name is not a file the service writes.
-    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and -not (Test-Path -LiteralPath $candidate -PathType Container))
+    # Files only (#5649): a folder that carries a listed name is not a file the service writes, and neither is a link or
+    # a file with more than one name. The answer comes from the item the walk listed.
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and $null -ne $item -and -not $item.PSIsContainer -and $item.LinkType -ne 'HardLink' -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint))
 }
 
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
@@ -495,51 +536,53 @@ Then run install-darling.ps1 from there.
 "@
 }
 
-# The file names, when EVERY finding of a refusal is on a darling.json.bak-* file directly in $root (#5649): a grant
-# on it ("<account> on <path>") or its owner ("<path> (owned by <account>)"). Anything else among the findings, a
-# folder, a link, a file that is not a backup, a finding about a path that could not be read, returns nothing, and the
-# refusal keeps its install-replacement advice. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# The file names, when EVERY finding of a refusal is on a darling.json.bak-* file directly in $root (#5649). $findings
+# are the records Get-UntrustedWriteGrantees returns with -AsRecords, and the decision is made from each record's Kind
+# and Path, never from its text: only a Grant or an Owner finding on a file (as the walk listed it) sitting directly in
+# $root with a backup name counts. Anything else among the findings, a folder, a link, a file with more than one
+# name, a file that is not a backup, a finding about a path that could not be read or listed, returns nothing, and
+# the refusal keeps its standard advice alone. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingBackupFileFindingNames([string]$root, [array]$findings) {
     if (@($findings).Count -eq 0) { return @() }
     try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
     catch { return @() }
-    $escaped = [regex]::Escape($rootText)
     $names = @()
     foreach ($finding in @($findings)) {
-        $m = [regex]::Match("$finding", "^.+ on (?<path>$escaped\\[^\\]+)$", 'IgnoreCase')
-        if (-not $m.Success) { $m = [regex]::Match("$finding", "^(?<path>$escaped\\[^\\]+) \(owned by .+\)$", 'IgnoreCase') }
-        if (-not $m.Success) { return @() }
-        $path = $m.Groups['path'].Value
+        if ($finding.Kind -ne 'Grant' -and $finding.Kind -ne 'Owner') { return @() }
+        if (-not $finding.IsFile) { return @() }
+        $path = "$($finding.Path)"
+        if (-not $path.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return @() }
         $leaf = $path.Substring($rootText.Length + 1)
-        if (-not (Test-DarlingServiceWrittenFileName $leaf) -or $leaf -ieq 'darling.json') { return @() }
-        if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return @() }
+        if ($leaf.Contains('\') -or -not (Test-DarlingServiceWrittenFileName $leaf) -or [string]::Equals($leaf, 'darling.json', [StringComparison]::OrdinalIgnoreCase)) { return @() }
         if ($names -notcontains $leaf) { $names += $leaf }
     }
     return @($names)
 }
 
-# The advice for a refusal that lists only darling.json.bak-* files (#5649): move those files, not the install.
-# Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# The note a refusal that lists only darling.json.bak-* files carries ahead of its standard advice (#5649). With the
+# service's own backups trusted, a file listed here belongs to, or is writable by, some other account. Kept
+# byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingBackupFileAdvice([string[]]$names) {
     $shown = (@($names) | Select-Object -First 10) -join ', '
     $more = if (@($names).Count -gt 10) { " and $(@($names).Count - 10) more" } else { '' }
     return @"
 Every entry above is a darling.json.bak-* backup file in this folder: $shown$more.
-You do not need to move the install. Move just those files out of this folder, into a folder only
-Administrators can read, because a backup can hold the secrets that were in darling.json. Then run
-this command again.
+A backup can hold the secrets that were in darling.json. These files can be moved out of this folder, into a
+folder only Administrators can read.
 "@
 }
 
 # The refusal's advice (#5627): the numbered steps when the registered service runs from $folder itself, that is,
 # when its ImagePath folder ($registeredFolder, from Get-DarlingInstallRootFromService) is $folder, so this folder IS
 # the install being replaced; a fresh folder otherwise, including when no service is registered or its path cannot be
-# read. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# read. When every finding is a backup file (Get-DarlingBackupFileFindingNames), the note on those files comes first
+# and the advice above follows it unchanged (#5649). $findings are the records from Get-UntrustedWriteGrantees
+# -AsRecords. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder, [array]$findings = @()) {
+    $default = if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { Get-DarlingExistingInstallSteps $folder $serviceName } else { Get-DarlingFreshFolderAdvice $folder }
     $backupNames = @(Get-DarlingBackupFileFindingNames $folder $findings)
-    if ($backupNames.Count -gt 0) { return Get-DarlingBackupFileAdvice $backupNames }
-    if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { return Get-DarlingExistingInstallSteps $folder $serviceName }
-    return Get-DarlingFreshFolderAdvice $folder
+    if ($backupNames.Count -gt 0) { return (Get-DarlingBackupFileAdvice $backupNames) + "`n`n" + $default }
+    return $default
 }
 
 # True when two paths name the same directory: separators trimmed, full paths compared without regard to case.
@@ -944,7 +987,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if ($LASTEXITCODE -ne 0) { $open += "$root (could not make Administrators the owner of everything below it; run elevated: $($output | Select-Object -First 1))" }
     $serviceWritePaths = @()
     if ($serviceSid) {
-        foreach ($secret in @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object { Test-DarlingServiceWrittenFileName $_.Name })) {
+        foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root)) {
             $null = & icacls.exe $secret.FullName /setowner "*$($serviceSid.Value)" /L /Q 2>&1
         }
         foreach ($dir in $serviceWriteDirectories) {
@@ -991,7 +1034,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         # darling.json and its backups: step 4b gives the service an explicit FullControl there (#1647) and the setowner
         # above makes it the owner, so the service is trusted on those files too. Without this the walk strips the
         # service's own grant from its config (the explicit-ACE branch below) and the service cannot start.
-        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name)
+        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name) -and ($target.LinkType -ne 'HardLink')
         if ($serviceSid -and ($path.TrimEnd('\') -ieq $root.TrimEnd('\') -or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }
         try { $acl = Get-Acl -LiteralPath $path -ErrorAction Stop }
         catch { $open += "$path (its permissions could not be read)"; continue }
@@ -1102,14 +1145,15 @@ if (-not $AcceptWritableExtraction) {
     # and refuses outright, with 1b2's own message, when that account cannot be read or resolved at all
     # (round-1 review, L3/L4), rather than silently mis-judging the walk below.
     $preLockTrusted = Get-DarlingPreLockTrustedSidsForRerun $serviceName $existing
-    $writable = @(Get-UntrustedWriteGrantees $root $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories @(Get-DarlingExtraServiceWriteDirectories $root $configPath))
+    $writableRecords = @(Get-UntrustedWriteGrantees $root $preLockTrusted.Trusted -AsRecords -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories @(Get-DarlingExtraServiceWriteDirectories $root $configPath))
+    $writable = @($writableRecords | ForEach-Object { $_.Text })
     if ($writable.Count -gt 0) {
         $lines = ($writable | Select-Object -First 20 | ForEach-Object { "  $_" }) -join "`n"
         $more = if ($writable.Count -gt 20) { "`n  ...and $($writable.Count - 20) more." } else { '' }
         # The service running from THIS folder means it is an existing install (#5627): its folder is what needs
         # replacing, so the refusal spells out how. A service registered elsewhere, or none, leaves nothing here to
         # keep, and the advice is a fresh folder.
-        $advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable
+        $advice = Get-DarlingRefusalAdvice $root $serviceName (Get-DarlingInstallRootFromService $serviceName) $writableRecords
         Fail @"
 Ordinary users can already write to this install folder, before this script locks anything down:
 
@@ -1494,7 +1538,7 @@ else {
 # Set-Acl -Path can resolve to a same-named file in a sibling folder (a[bc]d to abd) and harden that instead.
 $hardened = @()
 $failed = @()
-foreach ($secretFile in @($configPath) + @(Get-ChildItem -LiteralPath $root -Filter (Get-DarlingServiceWrittenNames).BackupGlob -File -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName })) {
+foreach ($secretFile in @($configPath) + @(Get-DarlingServiceWrittenRootFiles $root -BackupsOnly | ForEach-Object { $_.FullName })) {
     try {
         $wk = [System.Security.Principal.WellKnownSidType]
         $systemSid      = New-Object System.Security.Principal.SecurityIdentifier($wk::LocalSystemSid, $null)
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 8e2532911e..5f69b2f6de 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -201,7 +201,11 @@ function Note([string]$message) { Write-Host $message }
 # any other account: the lock gives the service read and execute on $path, so a write right there is not one
 # the lock put there. A caller that passes none (a source build, which the service never writes to) trusts
 # them nowhere.
-function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse, [array]$serviceSids = @(), [array]$serviceDirectories = @()) {
+#
+# The return is the finding TEXTS, or with -AsRecords one object per finding (Kind: Grant, Owner, Link, HardLink,
+# Unreadable or Unlisted; Path; Text, the same line the text form returns; IsFile, from the item the walk itself
+# listed) for the callers that decide something from what a finding IS, never from its text (#5649).
+function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Recurse, [array]$serviceSids = @(), [array]$serviceDirectories = @(), [switch]$AsRecords) {
     $rights = [System.Security.AccessControl.FileSystemRights]
     $allow = [System.Security.AccessControl.AccessControlType]::Allow
     $sidType = [System.Security.Principal.SecurityIdentifier]
@@ -213,25 +217,31 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
         (New-Object System.Security.Principal.SecurityIdentifier($wk::CreatorGroupServerSid, $null)))
     $write = [int64]($rights::WriteData -bor $rights::AppendData -bor $rights::WriteAttributes -bor $rights::WriteExtendedAttributes -bor $rights::Delete -bor $rights::DeleteSubdirectoriesAndFiles -bor $rights::ChangePermissions -bor $rights::TakeOwnership) -bor 0x10000000 -bor 0x40000000
 
-    function Get-DarlingOneObjectWriteFindings([string]$itemPath, [bool]$includeInherited) {
+    function New-DarlingWriteFinding([string]$kind, [string]$findingPath, [string]$text, [bool]$isFile = $false) {
+        return [pscustomobject]@{ Kind = $kind; Path = $findingPath; Text = $text; IsFile = $isFile }
+    }
+    # $item is what the walk listed for $itemPath ($null for $path itself). The file-or-folder answer comes from it,
+    # never from a second look at the disk, so the check and the listing cannot disagree (#5649).
+    function Get-DarlingOneObjectWriteFindings([string]$itemPath, [bool]$includeInherited, $item = $null) {
+        $isFile = [bool]($null -ne $item -and -not $item.PSIsContainer)
         try { $acl = Get-Acl -LiteralPath $itemPath -ErrorAction Stop }
-        catch { return @("$itemPath (its permissions could not be read: $($_.Exception.Message))") }
+        catch { return @(New-DarlingWriteFinding 'Unreadable' $itemPath "$itemPath (its permissions could not be read: $($_.Exception.Message))" $isFile) }
         $ownerTrusted = $trusted
         $granteeTrusted = $trusted
         if (@($serviceSids).Count -gt 0) {
-            if (Test-DarlingServiceWrittenPath $path $itemPath $serviceDirectories) { $ownerTrusted = @($trusted) + @($serviceSids); $granteeTrusted = $ownerTrusted }
+            if (Test-DarlingServiceWrittenPath $path $itemPath $serviceDirectories $item) { $ownerTrusted = @($trusted) + @($serviceSids); $granteeTrusted = $ownerTrusted }
         }
         $bad = @($acl.GetAccessRules($true, $includeInherited, $sidType) | Where-Object {
             $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $granteeTrusted -notcontains $_.IdentityReference -and $inheritOnlyTemplates -notcontains $_.IdentityReference })
         $result = @($bad | ForEach-Object {
             $grantee = $_.IdentityReference
             $name = try { $grantee.Translate([System.Security.Principal.NTAccount]).Value } catch { $grantee.Value }
-            "$name on $itemPath"
+            New-DarlingWriteFinding 'Grant' $itemPath "$name on $itemPath" $isFile
         })
         $owner = $acl.GetOwner($sidType)
         if ($ownerTrusted -notcontains $owner) {
             $name = try { $owner.Translate([System.Security.Principal.NTAccount]).Value } catch { $owner.Value }
-            $result += "$itemPath (owned by $name)"
+            $result += New-DarlingWriteFinding 'Owner' $itemPath "$itemPath (owned by $name)" $isFile
         }
         return @($result)
     }
@@ -240,21 +250,31 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     if ($Recurse) {
         # -ErrorVariable, so a folder the walk cannot list is a finding of its own (#4043 round-2 review).
         # Skipped silently, nothing under it reached the checks above and the tree read as clean.
+        $rootFull = try { [IO.Path]::GetFullPath($path).TrimEnd('\') } catch { $path.TrimEnd('\') }
         foreach ($child in @(Get-ChildItem -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue -ErrorVariable listFailures)) {
             if ($child.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
-                $result += "$($child.FullName) (a junction or link)"
+                $result += New-DarlingWriteFinding 'Link' $child.FullName "$($child.FullName) (a junction or link)"
                 continue
             }
-            $result += Get-DarlingOneObjectWriteFindings $child.FullName $false
+            # A file with more than one name (a hard link) shares its permissions and its owner under every name, so
+            # one of them in the root with a name the service is trusted on would carry the other name's rights into
+            # the lock and the install pass (#5649). Reported like a link, for the root files the service writes.
+            if (-not $child.PSIsContainer -and $child.LinkType -eq 'HardLink' -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
+                $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
+            }
+            $result += Get-DarlingOneObjectWriteFindings $child.FullName $false $child
         }
         foreach ($failure in @($listFailures)) {
             $unlisted = if ($failure.TargetObject) { "$($failure.TargetObject)" } else { $path }
-            $result += "$unlisted (its contents could not be listed: $($failure.CategoryInfo.Reason))"
+            $result += New-DarlingWriteFinding 'Unlisted' $unlisted "$unlisted (its contents could not be listed: $($failure.CategoryInfo.Reason))"
         }
     }
     # Each finding once: a folder made under C:\ inherits BUILTIN\Users as two ACEs (one grants append, one
     # grants write), and without this every caller named that principal twice for the same path.
-    return @($result | Select-Object -Unique)
+    $seen = New-Object 'System.Collections.Generic.HashSet[string]'
+    $unique = @(foreach ($found in $result) { if ($seen.Add($found.Text)) { $found } })
+    if ($AsRecords) { return @($unique) }
+    return @($unique | ForEach-Object { $_.Text })
 }
 
 # Every SID that is a DIRECT member of BUILTIN\Administrators right now (round-1 review, #4043, M2): an
@@ -309,19 +329,23 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
 # account is trusted as owner and as a write grantee), so the two cannot drift apart. Directories are always
 # created and granted; KeyDirectories only on a bring-your-own PostgreSQL install (Get-DarlingExtraServiceWriteDirectories
 # returns them, and only then are they on the list). Files are matched in the install root only, and only files (a folder of the same name is not on the
-# list): darling.json, and every darling.json.bak-* file (BackupGlob, #5649). That is the glob the hardening covers: the
+# list): darling.json, and every file whose name starts with darling.json.bak- (BackupPrefix, #5649). That is the prefix the hardening covers: the
 # install-time pass in install-darling.ps1, the service's TryHardenConfigBackups and the CLI's backup enumeration all
 # take every darling.json.bak-* name, not only the darling.json.bak-yyyyMMdd-HHmmss(-N) names the config-editing verbs
 # write, so a backup an operator named by hand (darling.json.bak-before-edit) becomes service-owned at the next start
 # and must not read as a stranger's file. A backup is data the service reads and writes, never code that runs. This is
-# the ONE spelling of that glob in these scripts; DarlingConfigBackup.Glob in the service is the one in C#, and a test
-# pins the two to the same text. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# the ONE spelling of that prefix in these scripts, and every PowerShell site tests it with
+# StartsWith(prefix, OrdinalIgnoreCase): -like and -Filter fold case by the current culture (Turkish I) and, in Windows
+# PowerShell 5.1, match some look-alike characters, so they can disagree with the service. DarlingConfigBackup.Prefix
+# in the service is the one in C#, and a test pins the two to the same text. A file with more than one name (a hard
+# link) is never one the service writes: the root files this list covers come from Get-DarlingServiceWrittenRootFiles,
+# which leaves those out. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingServiceWrittenNames {
     return [pscustomobject]@{
         Directories    = @('pg-runtime', 'pg-runtime-prev')
         KeyDirectories = @('darling-keys')
         Files          = @('darling.json')
-        BackupGlob     = 'darling.json.bak-*'
+        BackupPrefix   = 'darling.json.bak-'
     }
 }
 
@@ -329,17 +353,33 @@ function Get-DarlingServiceWrittenNames {
 function Test-DarlingServiceWrittenFileName([string]$name) {
     $names = Get-DarlingServiceWrittenNames
     foreach ($file in @($names.Files)) {
-        if ($name -ieq $file) { return $true }
+        if ([string]::Equals($name, $file, [StringComparison]::OrdinalIgnoreCase)) { return $true }
     }
-    return [bool]($name -like $names.BackupGlob)
+    return [bool]$name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)
+}
+
+# The files directly in $root that the service writes (the names on the list above): the ones the lock makes the
+# service the owner of, and with -BackupsOnly the darling.json.bak-* ones the install pass hardens. A file with more
+# than one name (a hard link) and a file that is a link are left out, so neither gets the service as its owner or a
+# FullControl grant: those rights would land on the other names too (#5649). Hidden files are included. Kept
+# byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly) {
+    $names = Get-DarlingServiceWrittenNames
+    return @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object {
+        (Test-DarlingServiceWrittenFileName $_.Name) -and
+        (-not $BackupsOnly -or $_.Name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)) -and
+        $_.LinkType -ne 'HardLink' -and
+        -not ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) })
 }
 
 # True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
 # files directly in $root. $extraDirectories are the key folders Get-DarlingExtraServiceWriteDirectories returns
 # for this install, the same ones the lock is handed. The FIRST name below $root is compared exactly, and a name
 # Windows would fold into another ('pg-runtime.', a '..' step) matches nothing. The install root itself and every
-# other file or folder in it are not on the list.
-function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @()) {
+# other file or folder in it are not on the list. $item is what the caller's own walk listed for $candidate: a
+# listed file is trusted by name only when it is a plain file (not a folder, a link or a file with more than one
+# name), and with no item a root file is not trusted, so the answer never rests on a second look at the disk.
+function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @(), $item = $null) {
     try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
     catch { return $false }
     if (-not $candidate.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return $false }
@@ -351,8 +391,9 @@ function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [stri
     foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
         if ($segments[0] -ieq $directory) { return $true }
     }
-    # Files only (#5649): a folder that carries a listed name is not a file the service writes.
-    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and -not (Test-Path -LiteralPath $candidate -PathType Container))
+    # Files only (#5649): a folder that carries a listed name is not a file the service writes, and neither is a link or
+    # a file with more than one name. The answer comes from the item the walk listed.
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and $null -ne $item -and -not $item.PSIsContainer -and $item.LinkType -ne 'HardLink' -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint))
 }
 
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
@@ -548,51 +589,53 @@ Then run install-darling.ps1 from there.
 "@
 }
 
-# The file names, when EVERY finding of a refusal is on a darling.json.bak-* file directly in $root (#5649): a grant
-# on it ("<account> on <path>") or its owner ("<path> (owned by <account>)"). Anything else among the findings, a
-# folder, a link, a file that is not a backup, a finding about a path that could not be read, returns nothing, and the
-# refusal keeps its install-replacement advice. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# The file names, when EVERY finding of a refusal is on a darling.json.bak-* file directly in $root (#5649). $findings
+# are the records Get-UntrustedWriteGrantees returns with -AsRecords, and the decision is made from each record's Kind
+# and Path, never from its text: only a Grant or an Owner finding on a file (as the walk listed it) sitting directly in
+# $root with a backup name counts. Anything else among the findings, a folder, a link, a file with more than one
+# name, a file that is not a backup, a finding about a path that could not be read or listed, returns nothing, and
+# the refusal keeps its standard advice alone. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingBackupFileFindingNames([string]$root, [array]$findings) {
     if (@($findings).Count -eq 0) { return @() }
     try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
     catch { return @() }
-    $escaped = [regex]::Escape($rootText)
     $names = @()
     foreach ($finding in @($findings)) {
-        $m = [regex]::Match("$finding", "^.+ on (?<path>$escaped\\[^\\]+)$", 'IgnoreCase')
-        if (-not $m.Success) { $m = [regex]::Match("$finding", "^(?<path>$escaped\\[^\\]+) \(owned by .+\)$", 'IgnoreCase') }
-        if (-not $m.Success) { return @() }
-        $path = $m.Groups['path'].Value
+        if ($finding.Kind -ne 'Grant' -and $finding.Kind -ne 'Owner') { return @() }
+        if (-not $finding.IsFile) { return @() }
+        $path = "$($finding.Path)"
+        if (-not $path.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return @() }
         $leaf = $path.Substring($rootText.Length + 1)
-        if (-not (Test-DarlingServiceWrittenFileName $leaf) -or $leaf -ieq 'darling.json') { return @() }
-        if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return @() }
+        if ($leaf.Contains('\') -or -not (Test-DarlingServiceWrittenFileName $leaf) -or [string]::Equals($leaf, 'darling.json', [StringComparison]::OrdinalIgnoreCase)) { return @() }
         if ($names -notcontains $leaf) { $names += $leaf }
     }
     return @($names)
 }
 
-# The advice for a refusal that lists only darling.json.bak-* files (#5649): move those files, not the install.
-# Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# The note a refusal that lists only darling.json.bak-* files carries ahead of its standard advice (#5649). With the
+# service's own backups trusted, a file listed here belongs to, or is writable by, some other account. Kept
+# byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingBackupFileAdvice([string[]]$names) {
     $shown = (@($names) | Select-Object -First 10) -join ', '
     $more = if (@($names).Count -gt 10) { " and $(@($names).Count - 10) more" } else { '' }
     return @"
 Every entry above is a darling.json.bak-* backup file in this folder: $shown$more.
-You do not need to move the install. Move just those files out of this folder, into a folder only
-Administrators can read, because a backup can hold the secrets that were in darling.json. Then run
-this command again.
+A backup can hold the secrets that were in darling.json. These files can be moved out of this folder, into a
+folder only Administrators can read.
 "@
 }
 
 # The refusal's advice (#5627): the numbered steps when the registered service runs from $folder itself, that is,
 # when its ImagePath folder ($registeredFolder, from Get-DarlingInstallRootFromService) is $folder, so this folder IS
 # the install being replaced; a fresh folder otherwise, including when no service is registered or its path cannot be
-# read. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# read. When every finding is a backup file (Get-DarlingBackupFileFindingNames), the note on those files comes first
+# and the advice above follows it unchanged (#5649). $findings are the records from Get-UntrustedWriteGrantees
+# -AsRecords. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingRefusalAdvice([string]$folder, [string]$serviceName, [string]$registeredFolder, [array]$findings = @()) {
+    $default = if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { Get-DarlingExistingInstallSteps $folder $serviceName } else { Get-DarlingFreshFolderAdvice $folder }
     $backupNames = @(Get-DarlingBackupFileFindingNames $folder $findings)
-    if ($backupNames.Count -gt 0) { return Get-DarlingBackupFileAdvice $backupNames }
-    if ($registeredFolder -and (Test-DarlingSamePath $registeredFolder $folder)) { return Get-DarlingExistingInstallSteps $folder $serviceName }
-    return Get-DarlingFreshFolderAdvice $folder
+    if ($backupNames.Count -gt 0) { return (Get-DarlingBackupFileAdvice $backupNames) + "`n`n" + $default }
+    return $default
 }
 
 # True when $candidate IS $parent or sits underneath it.
@@ -783,7 +826,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if ($LASTEXITCODE -ne 0) { $open += "$root (could not make Administrators the owner of everything below it; run elevated: $($output | Select-Object -First 1))" }
     $serviceWritePaths = @()
     if ($serviceSid) {
-        foreach ($secret in @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object { Test-DarlingServiceWrittenFileName $_.Name })) {
+        foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root)) {
             $null = & icacls.exe $secret.FullName /setowner "*$($serviceSid.Value)" /L /Q 2>&1
         }
         foreach ($dir in $serviceWriteDirectories) {
@@ -830,7 +873,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         # darling.json and its backups: step 4b gives the service an explicit FullControl there (#1647) and the setowner
         # above makes it the owner, so the service is trusted on those files too. Without this the walk strips the
         # service's own grant from its config (the explicit-ACE branch below) and the service cannot start.
-        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name)
+        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name) -and ($target.LinkType -ne 'HardLink')
         if ($serviceSid -and ($path.TrimEnd('\') -ieq $root.TrimEnd('\') -or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }
         try { $acl = Get-Acl -LiteralPath $path -ErrorAction Stop }
         catch { $open += "$path (its permissions could not be read)"; continue }
@@ -1312,7 +1355,7 @@ function Test-DarlingManifestPathIsPreserved([string]$relativePath) {
     # the assertion that the manifest is what it claims to be, placed where being wrong costs a monitoring
     # host its configuration.
     if ($leaf.Equals('darling.json', [StringComparison]::OrdinalIgnoreCase)) { return $true }
-    if ($leaf -like (Get-DarlingServiceWrittenNames).BackupGlob) { return $true }
+    if ($leaf.StartsWith((Get-DarlingServiceWrittenNames).BackupPrefix, [StringComparison]::OrdinalIgnoreCase)) { return $true }
 
     # DPAPI credential blobs. LocalMachine-scoped with an entropy constant that ships in an open-source
     # repo, so READ access is the secret - but they are also not recoverable from anywhere else, and a
@@ -1857,7 +1900,8 @@ $existingService = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
 $preLockTrusted = Get-DarlingPreLockTrustedSidsForRerun $serviceName $existingService
 $sourceTrusted = @(Get-DarlingPreLockTrustedSids)
 if (-not $AcceptWritableExtraction) {
-    $writable = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted.Trusted -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories @(Get-DarlingExtraServiceWriteDirectories $InstallRoot (Join-Path $InstallRoot $configName)))
+    $writableRecords = @(Get-UntrustedWriteGrantees $InstallRoot $preLockTrusted.Trusted -AsRecords -Recurse -ServiceSids $preLockTrusted.ServiceSids -ServiceDirectories @(Get-DarlingExtraServiceWriteDirectories $InstallRoot (Join-Path $InstallRoot $configName)))
+    $writable = @($writableRecords | ForEach-Object { $_.Text })
     if ($writable.Count -gt 0) {
         $lines = ($writable | Select-Object -First 20 | ForEach-Object { "  $_" }) -join "`n"
         $more = if ($writable.Count -gt 20) { "`n  ...and $($writable.Count - 20) more." } else { '' }
@@ -1870,7 +1914,7 @@ A tree installed before #4038 was writable by the accounts above for its whole l
 only copies over what this build ships. It does not check the rest, so other files in the tree can differ
 from what an earlier build shipped.
 
-$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName) $writable)
+$(Get-DarlingRefusalAdvice $InstallRoot $serviceName (Get-DarlingInstallRootFromService $serviceName) $writableRecords)
 
 If you accept the risk of upgrading this tree in place anyway, re-run with -AcceptWritableExtraction.
 

From 7a40dbafa698b235fec268ea1194858c68f0f8c8 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 11:31:34 -0400
Subject: [PATCH 04/14] CHANGELOG: describe the prefix match, the hard-link
 finding and the backup note (#5649)

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 33ba22275e..7cd3996ab5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,7 +23,7 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 
 ### Fixed
 
-- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every `darling.json.bak-*` file in the install root, the same glob the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, and a file below the root still refuse. When a refusal lists only backup files, it now names them and says to move just those files to a folder only Administrators can read, then run the command again. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now read one glob per language.
+- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check also covers the backups of the config it was given, not only `darling.json.bak-*`.
 
 ## [3.10.0] - 2026-10-09
 

From c022ad8dcb8a7674d875c6c77c1af2e2d5b90856 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 12:01:49 -0400
Subject: [PATCH 05/14] Count a file's names through an attribute-only handle,
 refuse a linked darling.json, report hard links in the lock's verify walk
 (#5649)

Windows PowerShell 5.1 leaves LinkType empty when a file cannot be opened for read, so a hard link held open with no read sharing read as an ordinary file. One shared helper now counts the names through a handle opened for attributes only, and a count that cannot be read is treated as more than one name. install-darling.ps1 refuses a darling.json with more than one name or a link before it hardens it. The lock's verify walk reports a hard-linked root file the service writes and leaves its permissions alone.
---
 .../DarlingInstallLocationTests.cs            | 284 +++++++++++++++++-
 Darling/tools/install-darling.ps1             |  96 +++++-
 Darling/tools/upgrade-darling.ps1             |  86 +++++-
 3 files changed, 447 insertions(+), 19 deletions(-)

diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index f9d4f82998..1f8085e362 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -596,7 +596,7 @@ public void ThePreLockWritableExtractionCheck_ShipsIdenticallyInTheInstallAndUpg
         foreach (var name in new[]
         {
             "Get-DarlingServiceSids", "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName",
-            "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
+            "Get-DarlingFileNameCount", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
             "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice",
             "Get-DarlingRefusalAdvice", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
         })
@@ -1014,7 +1014,12 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
-            $root = 'C:\Program Files\PerformanceMonitorDarling'
+            # Real files in a temp root: the files-only answer counts the file's names on disk (#5649), so a path that does not
+            # exist is never one the service is trusted on.
+            $root = Join-Path $env:TEMP ('pm5649-wp-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path $root -Force | Out-Null
+            foreach ($n in @('darling.json', 'darling.json.bak-20260101-120000', 'darling.json.bak-x.dll', 'darling.json.bak-before-edit', 'darling.json.bak-x', 'notes.txt')) { Set-Content -LiteralPath "$root\$n" -Value '{}' }
+            New-Item -ItemType HardLink -Path "$root\darling.json.bak-linked" -Value "$root\notes.txt" | Out-Null
             $fileItem = [pscustomobject]@{ PSIsContainer = $false; LinkType = $null; Attributes = [IO.FileAttributes]::Normal }
             foreach ($name in @('darling.json', 'DARLING.JSON', 'darling.json.bak-20260101-120000', 'darling.json.bak-20260101-120000-2',
                                 'darling.json.bak-x.dll', 'darling.json.bak-20260101', 'darling.json.bak-before-edit', 'DARLING.JSON.BAK-Upper', 'darling.json.bak-', 'darling.json.bak', 'darling.jsonbak-x', 'xdarling.json.bak-x', 'darling.json.', 'xdarling.json')) {
@@ -1029,13 +1034,15 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
             }
             # #5649: the files-only answer comes from the item the caller listed, never from the disk.
             'item:folder=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() ([pscustomobject]@{ PSIsContainer = $true; LinkType = $null; Attributes = [IO.FileAttributes]::Directory }))
-            'item:hardLink=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() ([pscustomobject]@{ PSIsContainer = $false; LinkType = 'HardLink'; Attributes = [IO.FileAttributes]::Normal }))
+            'item:hardLink=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-linked') @() $fileItem)
+            'item:missingFile=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-missing') @() $fileItem)
             'item:reparse=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() ([pscustomobject]@{ PSIsContainer = $false; LinkType = 'SymbolicLink'; Attributes = [IO.FileAttributes]::ReparsePoint }))
             'item:none=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @())
             'item:plainFile=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'darling.json.bak-x') @() $fileItem)
             'item:directoryNeedsNoItem=' + (Test-DarlingServiceWrittenPath $root (Join-Path $root 'pg-runtime\a.dll') @())
             'path:root=' + (Test-DarlingServiceWrittenPath $root $root @('darling-keys'))
-            'path:outside=' + (Test-DarlingServiceWrittenPath $root 'C:\Program Files\PerformanceMonitorDarling-2\pg-runtime\a.dll' @())
+            'path:outside=' + (Test-DarlingServiceWrittenPath $root "$root-2\pg-runtime\a.dll" @())
+            Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
             """);
 
         var answers = RunWindowsPowerShell(probe.ToString());
@@ -1067,7 +1074,7 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
 
         Assert.Contains("item:plainFile=True", answers);
         Assert.Contains("item:directoryNeedsNoItem=True", answers);
-        foreach (var no in new[] { "item:folder", "item:hardLink", "item:reparse", "item:none" })
+        foreach (var no in new[] { "item:folder", "item:hardLink", "item:missingFile", "item:reparse", "item:none" })
         {
             Assert.Contains($"{no}=False", answers);
         }
@@ -1432,7 +1439,8 @@ public void TheBackupPrefix_HasOneDefinitionPerLanguage_AndTheSameText()
             /* The lock's service-owned loop reads the helper (which drops hard links), and its walk does not trust a hard link as a secret file. */
             var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
             Assert.Contains("foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root))", lockText, StringComparison.Ordinal);
-            Assert.Contains("(Test-DarlingServiceWrittenFileName $target.Name) -and ($target.LinkType -ne 'HardLink')", lockText, StringComparison.Ordinal);
+            Assert.Contains("(Test-DarlingServiceWrittenFileName $target.Name) -and (Get-DarlingFileNameCount $path) -ne 1) {", lockText, StringComparison.Ordinal);
+            Assert.DoesNotContain("LinkType", lockText, StringComparison.Ordinal);
         }
 
         Assert.Contains("Get-DarlingServiceWrittenRootFiles $root -BackupsOnly", InstallScript, StringComparison.Ordinal);
@@ -1446,6 +1454,221 @@ public void TheBackupPrefix_HasOneDefinitionPerLanguage_AndTheSameText()
         Assert.DoesNotContain("\"darling.json.bak-*\"", cli, StringComparison.Ordinal);
     }
 
+    /// <summary>
+    /// #5649: the number of names a file has is read through a handle opened for attributes only, never from
+    /// <c>$item.LinkType</c>, which Windows PowerShell 5.1 leaves EMPTY when the file cannot be opened for read (a
+    /// process holds it with no read sharing). One helper, shared by the pre-lock walk, the service-written root files and
+    /// the path test: it returns 1 for a plain file, more for a hard link, and -1 when the count cannot be read, which every
+    /// caller treats as a hard link. The probe holds a hard link open with no sharing at all (the case that reads as no link
+    /// at 5.1) and the walk, the root-file list and the path test must each still see it. Run under Windows PowerShell
+    /// 5.1 and PowerShell 7, with both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheFileNameCount_IsOneForAPlainFile_AndSeesAHardLinkHeldOpenWithNoReadSharing(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = Join-Path $env:TEMP ('pm5649-nc-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            $outside = "$root-outside.txt"
+            $outsideHeld = "$root-outside-held.txt"
+            New-Item -ItemType Directory -Path "$root\sub" -Force | Out-Null
+            Set-Content -LiteralPath "$root\plain.txt" -Value 'x'
+            Set-Content -LiteralPath "$root\darling.json.bak-plain" -Value 'x'
+            Set-Content -LiteralPath $outside -Value 'x'
+            Set-Content -LiteralPath $outsideHeld -Value 'x'
+            New-Item -ItemType HardLink -Path "$root\darling.json.bak-linked" -Value $outside | Out-Null
+            New-Item -ItemType HardLink -Path "$root\darling.json.bak-held" -Value $outsideHeld | Out-Null
+            $held = $null
+            try {
+                'plain=' + (Get-DarlingFileNameCount "$root\plain.txt")
+                'linked=' + (Get-DarlingFileNameCount "$root\darling.json.bak-linked")
+                'folder=' + (Get-DarlingFileNameCount "$root\sub")
+                'missing=' + (Get-DarlingFileNameCount "$root\not-here.txt")
+
+                # Held open for read AND write with no sharing at all: nothing else can open it for read.
+                $held = [IO.File]::Open("$root\darling.json.bak-held", 'Open', 'ReadWrite', 'None')
+                'setup.heldOpenRefusesARead=' + $(try { $s = [IO.File]::Open("$root\darling.json.bak-held", 'Open', 'Read', 'ReadWrite'); $s.Dispose(); $false } catch { $true })
+                'heldLinkType=[' + $(try { (Get-Item -LiteralPath "$root\darling.json.bak-held" -Force -ErrorAction Stop).LinkType } catch { 'unreadable' }) + ']'
+                'held=' + (Get-DarlingFileNameCount "$root\darling.json.bak-held")
+                'heldRootFiles=' + (@(Get-DarlingServiceWrittenRootFiles $root | ForEach-Object { $_.Name } | Sort-Object) -join ',')
+                $heldItem = Get-Item -LiteralPath "$root\darling.json.bak-held" -Force
+                'heldTrustedPath=' + (Test-DarlingServiceWrittenPath $root "$root\darling.json.bak-held" @() $heldItem)
+                $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+                $records = @(Get-UntrustedWriteGrantees $root @($me) -Recurse -AsRecords)
+                foreach ($r in $records) { if ($r.Kind -eq 'HardLink') { 'walkHardLink=' + $r.Path.Substring($root.Length + 1) } }
+            }
+            finally {
+                if ($held) { $held.Dispose() }
+                Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
+                Remove-Item -LiteralPath $outside, $outsideHeld -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("plain=1", answers);
+        Assert.Contains("linked=2", answers);
+        Assert.Contains("folder=1", answers);
+        Assert.Contains("missing=-1", answers);
+        Assert.Contains("held=2", answers);
+        Assert.Contains("heldRootFiles=darling.json.bak-plain", answers);
+        Assert.Contains("heldTrustedPath=False", answers);
+        Assert.Contains("walkHardLink=darling.json.bak-held", answers);
+        Assert.Contains("walkHardLink=darling.json.bak-linked", answers);
+        Assert.DoesNotContain(answers, a => a.StartsWith("walkHardLink=darling.json.bak-plain", StringComparison.Ordinal));
+    }
+
+    /// <summary>
+    /// #5649: install step 4b hardens darling.json by name, so a darling.json with more than one name (a hard link) or one
+    /// that is a link would hand the service its ownership and FullControl on the other name too. The installer refuses
+    /// before that loop, with the fix named (an ordinary copy), even when the count cannot be read because another
+    /// process holds the file. The probe runs the refusal block as shipped, with Fail recording instead of exiting.
+    /// </summary>
+    [Fact]
+    public void TheInstaller_RefusesADarlingJsonWithMoreThanOneName_BeforeItHardensAnything()
+    {
+        var script = InstallScript;
+        var start = script.IndexOf("$configItem = Get-Item -LiteralPath $configPath", StringComparison.Ordinal);
+        var end = script.IndexOf("$hardened = @()", StringComparison.Ordinal);
+        Assert.True(start > 0 && end > start, "install-darling.ps1 no longer checks darling.json before the hardening loop");
+        var block = script.Substring(start, end - start);
+        Assert.True(script.IndexOf("foreach ($secretFile in @($configPath)", end, StringComparison.Ordinal) > end, "the hardening loop must follow the refusal");
+
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Get-DarlingFileNameCount"));
+        probe.AppendLine("function Fail([string]$message) { 'refused=' + $message; $script:didRefuse = $true }");
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = Join-Path $env:TEMP ('pm5649-cfg-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path $root -Force | Out-Null
+            $held = $null
+            try {
+                function RunCase([string]$label, [string]$configPath) {
+                    $script:didRefuse = $false
+            """);
+        probe.AppendLine(block);
+        probe.AppendLine("""
+                    $label + '.refused=' + $script:didRefuse
+                }
+                Set-Content -LiteralPath "$root\plain.json" -Value '{}'
+                RunCase 'plain' "$root\plain.json"
+
+                Set-Content -LiteralPath "$root-other.json" -Value '{}'
+                New-Item -ItemType HardLink -Path "$root\linked.json" -Value "$root-other.json" | Out-Null
+                RunCase 'hardLink' "$root\linked.json"
+
+                Set-Content -LiteralPath "$root-other-held.json" -Value '{}'
+                New-Item -ItemType HardLink -Path "$root\held.json" -Value "$root-other-held.json" | Out-Null
+                $held = [IO.File]::Open("$root\held.json", 'Open', 'ReadWrite', 'None')
+                RunCase 'heldHardLink' "$root\held.json"
+                $held.Dispose(); $held = $null
+
+                $linkMade = $false
+                try { New-Item -ItemType SymbolicLink -Path "$root\symlink.json" -Value "$root\plain.json" -ErrorAction Stop | Out-Null; $linkMade = $true } catch { }
+                'symlinkMade=' + $linkMade
+                if ($linkMade) { RunCase 'symlink' "$root\symlink.json" }
+            }
+            finally {
+                if ($held) { $held.Dispose() }
+                Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
+                Remove-Item -LiteralPath "$root-other.json", "$root-other-held.json" -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        var answers = RunWindowsPowerShell(probe.ToString());
+
+        Assert.Contains("plain.refused=False", answers);
+        Assert.Contains("hardLink.refused=True", answers);
+        Assert.Contains("heldHardLink.refused=True", answers);
+        if (answers.Contains("symlinkMade=True")) { Assert.Contains("symlink.refused=True", answers); }
+
+        var message = answers.Find(a => a.StartsWith("refused=", StringComparison.Ordinal))!;
+        Assert.Contains("linked.json", message, StringComparison.Ordinal);
+        Assert.Contains("copy it to a new file, delete the old darling.json, rename the copy to darling.json", message, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5649: the lock's verify walk reports a root file the service writes that has more than one name, and leaves it
+    /// alone, the way it does a junction. A reset (or stripping the grant) on a hard-linked backup with an untrusted
+    /// write grant would change the permissions of its other name too, and a reset hands that name to every local user.
+    /// The probe gives a hard-linked backup an explicit BUILTIN\Users write grant behind its own protection, runs the lock
+    /// and requires the grant to be untouched and the file named in what the lock returns.
+    /// </summary>
+    [Fact]
+    public void TheInstallTreeLock_ReportsAHardLinkedBackupWithAnUntrustedGrant_AndLeavesItsPermissionsAlone()
+    {
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, InstallScript);
+        probe.AppendLine(ExtractFunction(InstallScript, "Lock-DarlingInstallTree"));
+        probe.AppendLine(ConfirmProbeAclFunction);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = Join-Path ([IO.Path]::GetPathRoot([Environment]::SystemDirectory)) ('pm5649-lock-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            $outside = Join-Path $env:TEMP ("pm5649-lock-outside-" + [guid]::NewGuid().ToString("N").Substring(0, 8) + ".txt")
+            try {
+                New-Item -ItemType Directory -Path $root -Force | Out-Null
+                Set-Content -LiteralPath "$root\darling.json" -Value '{}'
+                Set-Content -LiteralPath $outside -Value 'x'
+                New-Item -ItemType HardLink -Path "$root\darling.json.bak-linked" -Value $outside | Out-Null
+                $wk = [System.Security.Principal.WellKnownSidType]
+                $sidType = [System.Security.Principal.SecurityIdentifier]
+                $users = New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinUsersSid, $null)
+                $system = New-Object System.Security.Principal.SecurityIdentifier($wk::LocalSystemSid, $null)
+                $admins = New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinAdministratorsSid, $null)
+                $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+                # icacls, not Set-Acl: Set-Acl on a hard link needs SeSecurityPrivilege here, which a developer shell lacks.
+                $null = & icacls.exe "$root\darling.json.bak-linked" /inheritance:d /grant "*$($users.Value):(M)" 2>&1
+                Confirm-ProbeAcl 'linkedAces' "$root\darling.json.bak-linked" $null @($users)
+                'setup.otherNameSharesTheAcl=' + (@((Get-Acl -LiteralPath $outside).GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+
+                $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                foreach ($path in @("$root\darling.json.bak-linked", $outside)) {
+                    $acl = Get-Acl -LiteralPath $path
+                    $leaf = Split-Path -Leaf $path
+                    $leaf + '.usersExplicit=' + (@($acl.GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+                    $leaf + '.protected=' + $acl.AreAccessRulesProtected
+                }
+            }
+            finally {
+                if (Test-Path -LiteralPath $root) {
+                    & icacls.exe $root /reset /T /C /Q 2>&1 | Out-Null
+                    Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue
+                }
+                if (Test-Path -LiteralPath $outside) {
+                    & icacls.exe $outside /reset /C /Q 2>&1 | Out-Null
+                    Remove-Item -LiteralPath $outside -Force -ErrorAction SilentlyContinue
+                }
+            }
+            """);
+
+        var answers = RunWindowsPowerShell(probe.ToString());
+        AssertProbeSetupTook(answers);
+
+        Assert.Contains(answers, a => a.StartsWith(@"open:\darling.json.bak-linked (a hard link: this file has more than one name", StringComparison.Ordinal));
+        Assert.Contains("darling.json.bak-linked.usersExplicit=True", answers);
+        Assert.Contains("darling.json.bak-linked.protected=True", answers);
+        Assert.Contains(answers, a => a.EndsWith(".txt.usersExplicit=True", StringComparison.Ordinal));
+    }
+
     private static void AppendStepFunctions(StringBuilder probe, string? script = null)
     {
         foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-PathIsAtOrUnder", "Test-DarlingSamePath", "Get-DarlingConfiguredPathsUnder", "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice", "Get-DarlingRefusalAdvice" })
@@ -1800,6 +2023,7 @@ public void ThePreLockWritableExtractionCheck_CatchesAnInheritedGrant_AndIsSilen
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
@@ -1891,6 +2115,7 @@ public void ThePreLockWritableExtractionCheck_IsSilentOnRealInheritOnlyTemplates
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
@@ -2005,6 +2230,7 @@ public void ThePreLockWritableExtractionCheck_TrustsTheAccountTheLockItselfGrant
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
@@ -2096,6 +2322,7 @@ function Get-Acl {
             }
             """);
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine("""
             $trusted = Get-DarlingPreLockTrustedSids
             $found = @(Get-UntrustedWriteGrantees 'C:\does-not-need-to-exist-for-this-probe' $trusted)
@@ -2141,6 +2368,7 @@ function Get-Acl {
             }
             """);
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine("""
             $usersAces = @((Get-Acl).GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]) | Where-Object { $_.IdentityReference -eq $script:usersSid })
             'usersAces=' + $usersAces.Count
@@ -2168,6 +2396,7 @@ public void ThePreLockWritableExtractionCheck_Recurses_AndCatchesAChildTheRootDo
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
@@ -2406,6 +2635,7 @@ public void ThePreLockWritableExtractionCheck_ReportsAFolderItCannotList_RatherT
         var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(script, "Get-UntrustedWriteGrantees"));
+        AppendServiceWrittenList(probe, script);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
             $root = Join-Path $env:TEMP ('pm4043-ma-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
@@ -2721,7 +2951,7 @@ there is no ACL to read and this probe never emits the line at all. */
     /// (the lock and the pre-lock walk both read them).</summary>
     private static void AppendServiceWrittenList(StringBuilder probe, string script)
     {
-        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles" })
+        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Get-DarlingFileNameCount", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles" })
         {
             probe.AppendLine(ExtractFunction(script, name));
         }
@@ -2796,6 +3026,46 @@ private static List<string> RunWindowsPowerShell(string script)
         }
     }
 
+    /// <summary>The same as <see cref="RunWindowsPowerShell"/> under PowerShell 7 (<c>pwsh</c>); null when it is not installed.</summary>
+    private static List<string>? RunPowerShell7(string script)
+    {
+        var path = Path.Combine(Path.GetTempPath(), $"darling-5649-{Guid.NewGuid():N}.ps1");
+        File.WriteAllText(path, script);
+        try
+        {
+            var startInfo = new ProcessStartInfo("pwsh", $"-NoProfile -File \"{path}\"")
+            {
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            };
+            Process? process;
+            try { process = Process.Start(startInfo); }
+            catch (System.ComponentModel.Win32Exception) { return null; }
+            Assert.NotNull(process);
+
+            var stdout = process!.StandardOutput.ReadToEnd();
+            var stderr = process.StandardError.ReadToEnd();
+            process.WaitForExit(60_000);
+
+            Assert.True(string.IsNullOrWhiteSpace(stderr), $"pwsh reported an error running the extracted function:\n{stderr}");
+
+            var lines = new List<string>();
+            foreach (var line in stdout.Split('\n'))
+            {
+                var trimmed = line.Trim();
+                if (trimmed.Length > 0) { lines.Add(trimmed); }
+            }
+
+            return lines;
+        }
+        finally
+        {
+            try { File.Delete(path); } catch (IOException) { /* best-effort */ }
+        }
+    }
+
     /// <summary>Returns the full <c>function NAME(...) { ... }</c> definition text from the script —
     /// signature included, so the extracted copy takes its parameters the way the shipped one does.</summary>
     private static string ExtractFunction(string script, string name)
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index 9d897e3c78..9ee22e3969 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -206,8 +206,16 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
             # A file with more than one name (a hard link) shares its permissions and its owner under every name, so
             # one of them in the root with a name the service is trusted on would carry the other name's rights into
             # the lock and the install pass (#5649). Reported like a link, for the root files the service writes.
-            if (-not $child.PSIsContainer -and $child.LinkType -eq 'HardLink' -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
-                $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
+            # The names are counted through Get-DarlingFileNameCount, never from LinkType, and a count that cannot be read is a
+            # hard link here too.
+            if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
+                $nameCount = Get-DarlingFileNameCount $child.FullName
+                if ($nameCount -gt 1) {
+                    $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
+                }
+                elseif ($nameCount -lt 1) {
+                    $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link, as far as can be told: the number of names this file has could not be read, and a file with more than one name has the same permissions under every one)" $true
+                }
             }
             $result += Get-DarlingOneObjectWriteFindings $child.FullName $false $child
         }
@@ -305,6 +313,65 @@ function Test-DarlingServiceWrittenFileName([string]$name) {
     return [bool]$name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)
 }
 
+# The number of names a file has (1 for an ordinary file, more for a hard link), read through a handle opened for
+# attributes only, with every sharing mode allowed and the file itself rather than anything it points to (the way
+# DarlingFileSecurity.HardenWithoutFollowingLinks reads it in the service). $item.LinkType is no substitute: Windows
+# PowerShell 5.1 leaves it empty when the file cannot be opened for read (another process holds it with no read
+# sharing, or this account is denied read), so a hard link read as no link at all. Returns -1 when the count cannot be
+# read, and every caller treats that as more than one name: a file whose names cannot be counted is never trusted, made
+# service-owned, granted anything or reset (#5649). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingFileNameCount([string]$path) {
+    try {
+        if (-not ('DarlingNativeFileNames' -as [type])) {
+            Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class DarlingNativeFileNames
+{
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FileTimeValue { public uint Low; public uint High; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleFileInformation
+    {
+        public uint FileAttributes;
+        public FileTimeValue CreationTime;
+        public FileTimeValue LastAccessTime;
+        public FileTimeValue LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
+
+    // FILE_READ_ATTRIBUTES; share read, write and delete; OPEN_EXISTING; FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS.
+    public static int CountNames(string path)
+    {
+        using (SafeFileHandle handle = CreateFileW(path, 0x80, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
+        {
+            ByHandleFileInformation information;
+            if (handle.IsInvalid || !GetFileInformationByHandle(handle, out information)) { return -1; }
+            return (int)information.NumberOfLinks;
+        }
+    }
+}
+'@
+        }
+        return [int][DarlingNativeFileNames]::CountNames($path)
+    }
+    catch { return -1 }
+}
+
 # The files directly in $root that the service writes (the names on the list above): the ones the lock makes the
 # service the owner of, and with -BackupsOnly the darling.json.bak-* ones the install pass hardens. A file with more
 # than one name (a hard link) and a file that is a link are left out, so neither gets the service as its owner or a
@@ -315,8 +382,8 @@ function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly)
     return @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object {
         (Test-DarlingServiceWrittenFileName $_.Name) -and
         (-not $BackupsOnly -or $_.Name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)) -and
-        $_.LinkType -ne 'HardLink' -and
-        -not ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) })
+        -not ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -and
+        (Get-DarlingFileNameCount $_.FullName) -eq 1 })
 }
 
 # True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
@@ -340,7 +407,7 @@ function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [stri
     }
     # Files only (#5649): a folder that carries a listed name is not a file the service writes, and neither is a link or
     # a file with more than one name. The answer comes from the item the walk listed.
-    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and $null -ne $item -and -not $item.PSIsContainer -and $item.LinkType -ne 'HardLink' -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint))
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and $null -ne $item -and -not $item.PSIsContainer -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -and (Get-DarlingFileNameCount $candidate) -eq 1)
 }
 
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
@@ -1026,6 +1093,13 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
             $open += "$path (a junction or link)"
             continue
         }
+        # A root file the service writes that has more than one name (a hard link, or one whose names cannot be counted) is
+        # reported and left alone, the way a junction is: resetting it or stripping a grant would change the permissions of
+        # its other names too, and a reset makes the other name readable by every local user (#5649).
+        if ((-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name) -and (Get-DarlingFileNameCount $path) -ne 1) {
+            $open += "$path (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one)"
+            continue
+        }
         # The service SID is trusted here only if $path is $root itself (its RX grant) or falls under one of
         # $serviceWritePaths (its Modify grant) - everywhere else its write grant is a stranger's, same as any
         # other untrusted account, even though the SID is the same one the tree hands its own real access to.
@@ -1034,7 +1108,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         # darling.json and its backups: step 4b gives the service an explicit FullControl there (#1647) and the setowner
         # above makes it the owner, so the service is trusted on those files too. Without this the walk strips the
         # service's own grant from its config (the explicit-ACE branch below) and the service cannot start.
-        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name) -and ($target.LinkType -ne 'HardLink')
+        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name)
         if ($serviceSid -and ($path.TrimEnd('\') -ieq $root.TrimEnd('\') -or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }
         try { $acl = Get-Acl -LiteralPath $path -ErrorAction Stop }
         catch { $open += "$path (its permissions could not be read)"; continue }
@@ -1536,6 +1610,16 @@ else {
 # Every path here is named with -LiteralPath (#4745). PowerShell reads [ and ] in a -Path value as wildcard
 # characters, so under an install folder named with either, -Path finds no .bak files at all, and Get-Acl or
 # Set-Acl -Path can resolve to a same-named file in a sibling folder (a[bc]d to abd) and harden that instead.
+# darling.json is hardened by name below, so it is checked here the way the backups are: a darling.json with more
+# than one name (a hard link) or one that is a link would take the service as its owner and a FullControl grant on
+# the OTHER name or the file it points to as well. Refused, not skipped: the service reads this file, so there is no
+# safe way to carry on with it (#5649). The names are counted through Get-DarlingFileNameCount, never from LinkType.
+$configItem = Get-Item -LiteralPath $configPath -Force -ErrorAction SilentlyContinue
+if ($null -ne $configItem -and (($configItem.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -or (Get-DarlingFileNameCount $configPath) -ne 1)) {
+    Fail ("$configPath has more than one name (it is a hard link), could not be checked, or is a link to another file, so its permissions cannot be set without also changing the other name or the file it points to. " +
+        "The service is installed but has not been started. Replace it with an ordinary copy: copy it to a new file, delete the old darling.json, rename the copy to darling.json, then run this script again.")
+}
+
 $hardened = @()
 $failed = @()
 foreach ($secretFile in @($configPath) + @(Get-DarlingServiceWrittenRootFiles $root -BackupsOnly | ForEach-Object { $_.FullName })) {
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 5f69b2f6de..b18b20e806 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -259,8 +259,16 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
             # A file with more than one name (a hard link) shares its permissions and its owner under every name, so
             # one of them in the root with a name the service is trusted on would carry the other name's rights into
             # the lock and the install pass (#5649). Reported like a link, for the root files the service writes.
-            if (-not $child.PSIsContainer -and $child.LinkType -eq 'HardLink' -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
-                $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
+            # The names are counted through Get-DarlingFileNameCount, never from LinkType, and a count that cannot be read is a
+            # hard link here too.
+            if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
+                $nameCount = Get-DarlingFileNameCount $child.FullName
+                if ($nameCount -gt 1) {
+                    $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
+                }
+                elseif ($nameCount -lt 1) {
+                    $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link, as far as can be told: the number of names this file has could not be read, and a file with more than one name has the same permissions under every one)" $true
+                }
             }
             $result += Get-DarlingOneObjectWriteFindings $child.FullName $false $child
         }
@@ -358,6 +366,65 @@ function Test-DarlingServiceWrittenFileName([string]$name) {
     return [bool]$name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)
 }
 
+# The number of names a file has (1 for an ordinary file, more for a hard link), read through a handle opened for
+# attributes only, with every sharing mode allowed and the file itself rather than anything it points to (the way
+# DarlingFileSecurity.HardenWithoutFollowingLinks reads it in the service). $item.LinkType is no substitute: Windows
+# PowerShell 5.1 leaves it empty when the file cannot be opened for read (another process holds it with no read
+# sharing, or this account is denied read), so a hard link read as no link at all. Returns -1 when the count cannot be
+# read, and every caller treats that as more than one name: a file whose names cannot be counted is never trusted, made
+# service-owned, granted anything or reset (#5649). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingFileNameCount([string]$path) {
+    try {
+        if (-not ('DarlingNativeFileNames' -as [type])) {
+            Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class DarlingNativeFileNames
+{
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FileTimeValue { public uint Low; public uint High; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleFileInformation
+    {
+        public uint FileAttributes;
+        public FileTimeValue CreationTime;
+        public FileTimeValue LastAccessTime;
+        public FileTimeValue LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
+
+    // FILE_READ_ATTRIBUTES; share read, write and delete; OPEN_EXISTING; FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS.
+    public static int CountNames(string path)
+    {
+        using (SafeFileHandle handle = CreateFileW(path, 0x80, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
+        {
+            ByHandleFileInformation information;
+            if (handle.IsInvalid || !GetFileInformationByHandle(handle, out information)) { return -1; }
+            return (int)information.NumberOfLinks;
+        }
+    }
+}
+'@
+        }
+        return [int][DarlingNativeFileNames]::CountNames($path)
+    }
+    catch { return -1 }
+}
+
 # The files directly in $root that the service writes (the names on the list above): the ones the lock makes the
 # service the owner of, and with -BackupsOnly the darling.json.bak-* ones the install pass hardens. A file with more
 # than one name (a hard link) and a file that is a link are left out, so neither gets the service as its owner or a
@@ -368,8 +435,8 @@ function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly)
     return @(Get-ChildItem -LiteralPath $root -Force -File -ErrorAction SilentlyContinue | Where-Object {
         (Test-DarlingServiceWrittenFileName $_.Name) -and
         (-not $BackupsOnly -or $_.Name.StartsWith($names.BackupPrefix, [StringComparison]::OrdinalIgnoreCase)) -and
-        $_.LinkType -ne 'HardLink' -and
-        -not ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) })
+        -not ($_.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -and
+        (Get-DarlingFileNameCount $_.FullName) -eq 1 })
 }
 
 # True when $candidate is a folder on the list above inside $root (or anything below it), or one of the listed
@@ -393,7 +460,7 @@ function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [stri
     }
     # Files only (#5649): a folder that carries a listed name is not a file the service writes, and neither is a link or
     # a file with more than one name. The answer comes from the item the walk listed.
-    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and $null -ne $item -and -not $item.PSIsContainer -and $item.LinkType -ne 'HardLink' -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint))
+    return [bool]($segments.Count -eq 1 -and (Test-DarlingServiceWrittenFileName $segments[0]) -and $null -ne $item -and -not $item.PSIsContainer -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -and (Get-DarlingFileNameCount $candidate) -eq 1)
 }
 
 # The trusted set for Get-UntrustedWriteGrantees BEFORE a service account exists to add to it (#4043):
@@ -865,6 +932,13 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
             $open += "$path (a junction or link)"
             continue
         }
+        # A root file the service writes that has more than one name (a hard link, or one whose names cannot be counted) is
+        # reported and left alone, the way a junction is: resetting it or stripping a grant would change the permissions of
+        # its other names too, and a reset makes the other name readable by every local user (#5649).
+        if ((-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name) -and (Get-DarlingFileNameCount $path) -ne 1) {
+            $open += "$path (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one)"
+            continue
+        }
         # The service SID is trusted here only if $path is $root itself (its RX grant) or falls under one of
         # $serviceWritePaths (its Modify grant) - everywhere else its write grant is a stranger's, same as any
         # other untrusted account, even though the SID is the same one the tree hands its own real access to.
@@ -873,7 +947,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         # darling.json and its backups: step 4b gives the service an explicit FullControl there (#1647) and the setowner
         # above makes it the owner, so the service is trusted on those files too. Without this the walk strips the
         # service's own grant from its config (the explicit-ACE branch below) and the service cannot start.
-        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name) -and ($target.LinkType -ne 'HardLink')
+        $isSecretFile = (-not $target.PSIsContainer) -and ([IO.Path]::GetDirectoryName($path).TrimEnd('\') -ieq $root.TrimEnd('\')) -and (Test-DarlingServiceWrittenFileName $target.Name)
         if ($serviceSid -and ($path.TrimEnd('\') -ieq $root.TrimEnd('\') -or $isServiceWritePath -or $isSecretFile)) { $trustedHere += $serviceSid }
         try { $acl = Get-Acl -LiteralPath $path -ErrorAction Stop }
         catch { $open += "$path (its permissions could not be read)"; continue }

From a029b0e649c6e5d8862996c2d6fa1aa3d491138a Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 12:24:37 -0400
Subject: [PATCH 06/14] Upgrade shapes: name the hand-named backup file apart
 from New-Base's switch (#5649)

PowerShell variable names ignore case, so inside New-Base the [bool]$handNamedBackup parameter hid the script's $HandNamedBackup file name: the leg wrote and then checked a file called True instead of darling.json.bak-before-edit. The file name is now $HandNamedBackupName.
---
 .github/scripts/darling-upgrade-shapes.ps1 | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/darling-upgrade-shapes.ps1 b/.github/scripts/darling-upgrade-shapes.ps1
index 5ac94c7671..10c1a9daa0 100644
--- a/.github/scripts/darling-upgrade-shapes.ps1
+++ b/.github/scripts/darling-upgrade-shapes.ps1
@@ -30,7 +30,7 @@ param(
 $ErrorActionPreference = 'Continue'
 $shape, $which = $Leg.Split('-')
 $svc = 'PerformanceMonitor Darling'
-$HandNamedBackup = 'darling.json.bak-before-edit'
+$HandNamedBackupName = 'darling.json.bak-before-edit'
 $work = 'C:\darling-shapes-work'
 $repo = if ($env:GITHUB_REPOSITORY) { $env:GITHUB_REPOSITORY } else { 'erikdarlingdata/PerformanceMonitor' }
 $tools = Join-Path $Workspace 'Darling\tools'
@@ -120,7 +120,7 @@ function New-Base([string]$version, [string]$root, [bool]$acceptWritable, [bool]
     # #5649: a backup the operator named by hand, put there before the base install so the release's own install
     # script and the service (both harden every darling.json.bak-* file) make it service-owned, the way a real one is
     # after a service start. The script under test must then accept it.
-    if ($handNamedBackup) { Set-Content -LiteralPath (Join-Path $root $HandNamedBackup) -Value $cfg }
+    if ($handNamedBackup) { Set-Content -LiteralPath (Join-Path $root $HandNamedBackupName) -Value $cfg }
     $script = Join-Path $root 'install-darling.ps1'
     $declared = @(Select-String -LiteralPath $script -Pattern '^\s*\[switch\]\$(\w+)' | ForEach-Object { $_.Matches[0].Groups[1].Value })
     $a = @(); foreach ($w in 'SkipPreflight', 'NoShortcuts') { if ($declared -contains $w) { $a += "-$w" } }
@@ -140,8 +140,8 @@ function New-Base([string]$version, [string]$root, [bool]$acceptWritable, [bool]
     if ($handNamedBackup) {
         # The shape only means something if the file really is the service's now. If the hardening did not make it so,
         # the leg is not testing the refusal it exists to prevent, so it fails here instead of passing for nothing.
-        $backup = Join-Path $root $HandNamedBackup
-        if (-not (Test-Path -LiteralPath $backup)) { Fail-Leg "the hand-named backup $HandNamedBackup is gone from $root after the base install" }
+        $backup = Join-Path $root $HandNamedBackupName
+        if (-not (Test-Path -LiteralPath $backup)) { Fail-Leg "the hand-named backup $HandNamedBackupName is gone from $root after the base install" }
         $owner = (Get-Acl -LiteralPath $backup).GetOwner([System.Security.Principal.SecurityIdentifier])
         $ownerName = try { $owner.Translate([System.Security.Principal.NTAccount]).Value } catch { '(untranslatable)' }
         Write-Host "owner of ${backup}: $ownerName"
@@ -255,7 +255,7 @@ switch ($Leg) {
         Expect-Success $r "$which-darling.ps1"
         if ($shape -eq 'U1') {
             # #5649: the service-owned hand-named backup does not refuse the run (Expect-Success above) and stays where it was.
-            if (-not (Test-Path -LiteralPath (Join-Path $root $HandNamedBackup))) { Fail-Leg "$which-darling.ps1 removed the hand-named backup $HandNamedBackup" }
+            if (-not (Test-Path -LiteralPath (Join-Path $root $HandNamedBackupName))) { Fail-Leg "$which-darling.ps1 removed the hand-named backup $HandNamedBackupName" }
         }
     }
     'U3-install' {

From 468afed234a8b77b808c5e21ccb94f538c2bb0e6 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:21:23 -0400
Subject: [PATCH 07/14] Install scripts: compare the install folder and every
 path in one long spelling (#5649)

On a GitHub Windows runner the temp folder is an 8.3 short path (C:\Users\RUNNER~1\...). Windows PowerShell 5.1 and
PowerShell 7 spell short names out differently in GetFullPath (5.1 leaves them when part of the path is missing or has a
'..' step), so a root typed one way and a path joined or listed the other compared unequal: the service-written path test
trusted none of the service's folders, and a hard link probe printed the wrong name.

- Get-DarlingCanonicalPath: one long, absolute spelling of a path (GetFullPath, then GetLongPathName on the part that exists,
  trailing backslash dropped). $null when nothing can be worked out; every caller then treats the path as not trusted.
- Get-DarlingSegmentsBelowRoot: the names from the root down to a candidate, both in that spelling, with the fold check
  (a '.' or '..' step, an empty name, a trailing dot or space) run on the candidate as handed in. Test-DarlingServiceWrittenPath
  and Get-DarlingBackupFileFindingNames use it.
- The walk, the lock and Get-DarlingExtraServiceWriteDirectories compare through the same helper; the lock puts its root in
  that spelling first and reports a path it cannot work out.
- Tests: a root in short form, short with a trailing backslash, and the long path in upper case, lower case and with a
  trailing backslash give the same walk, root-file, path-test, backup-name and key-folder answers in both scripts and both
  shells. The hard link probe printed a leaf by slicing at the typed root's length; it prints the file name instead.

Both scripts carry the same helpers and call sites.
---
 .../DarlingInstallLocationTests.cs            | 170 +++++++++++++++++-
 Darling/tools/install-darling.ps1             | 125 +++++++++++--
 Darling/tools/upgrade-darling.ps1             | 125 +++++++++++--
 3 files changed, 379 insertions(+), 41 deletions(-)

diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index 1f8085e362..b1fdd54f9d 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -596,7 +596,7 @@ public void ThePreLockWritableExtractionCheck_ShipsIdenticallyInTheInstallAndUpg
         foreach (var name in new[]
         {
             "Get-DarlingServiceSids", "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName",
-            "Get-DarlingFileNameCount", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
+            "Get-DarlingFileNameCount", "Get-DarlingCanonicalPath", "Get-DarlingSegmentsBelowRoot", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
             "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice",
             "Get-DarlingRefusalAdvice", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
         })
@@ -1473,6 +1473,7 @@ public void TheFileNameCount_IsOneForAPlainFile_AndSeesAHardLinkHeldOpenWithNoRe
         var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(script, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, script);
         AppendServiceWrittenList(probe, script);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
@@ -1503,7 +1504,7 @@ public void TheFileNameCount_IsOneForAPlainFile_AndSeesAHardLinkHeldOpenWithNoRe
                 'heldTrustedPath=' + (Test-DarlingServiceWrittenPath $root "$root\darling.json.bak-held" @() $heldItem)
                 $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
                 $records = @(Get-UntrustedWriteGrantees $root @($me) -Recurse -AsRecords)
-                foreach ($r in $records) { if ($r.Kind -eq 'HardLink') { 'walkHardLink=' + $r.Path.Substring($root.Length + 1) } }
+                foreach ($r in $records) { if ($r.Kind -eq 'HardLink') { 'walkHardLink=' + [IO.Path]::GetFileName($r.Path) } }
             }
             finally {
                 if ($held) { $held.Dispose() }
@@ -1675,6 +1676,8 @@ private static void AppendStepFunctions(StringBuilder probe, string? script = nu
         {
             probe.AppendLine(ExtractFunction(script ?? InstallScript, name));
         }
+
+        AppendPathHelpers(probe, script ?? InstallScript);
     }
 
     /// <summary>
@@ -1736,6 +1739,7 @@ private static StringBuilder ServiceOwnedTreeProbe()
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingServiceSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSidsForRerun"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
@@ -2023,6 +2027,7 @@ public void ThePreLockWritableExtractionCheck_CatchesAnInheritedGrant_AndIsSilen
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
@@ -2115,6 +2120,7 @@ public void ThePreLockWritableExtractionCheck_IsSilentOnRealInheritOnlyTemplates
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
@@ -2230,6 +2236,7 @@ public void ThePreLockWritableExtractionCheck_TrustsTheAccountTheLockItselfGrant
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Resolve-DarlingServiceAccountSid"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
@@ -2322,6 +2329,7 @@ function Get-Acl {
             }
             """);
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine("""
             $trusted = Get-DarlingPreLockTrustedSids
@@ -2368,6 +2376,7 @@ function Get-Acl {
             }
             """);
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine("""
             $usersAces = @((Get-Acl).GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]) | Where-Object { $_.IdentityReference -eq $script:usersSid })
@@ -2396,6 +2405,7 @@ public void ThePreLockWritableExtractionCheck_Recurses_AndCatchesAChildTheRootDo
     {
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(InstallScript, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, InstallScript);
         AppendServiceWrittenList(probe, InstallScript);
         probe.AppendLine(ExtractFunction(InstallScript, "Get-DarlingPreLockTrustedSids"));
         probe.AppendLine(ExtractFunction(InstallScript, "Get-LocalAdministratorsDirectMemberSids"));
@@ -2635,6 +2645,7 @@ public void ThePreLockWritableExtractionCheck_ReportsAFolderItCannotList_RatherT
         var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
         var probe = new StringBuilder();
         probe.AppendLine(ExtractFunction(script, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, script);
         AppendServiceWrittenList(probe, script);
         probe.AppendLine("""
             $ErrorActionPreference = 'Stop'
@@ -2947,11 +2958,164 @@ there is no ACL to read and this probe never emits the line at all. */
         Assert.Contains("jsonInteractive=Read, Synchronize", answers);
     }
 
+    /// <summary>
+    /// #5649, from the failed run of a GitHub Windows runner, where $env:TEMP is the 8.3 short form (C:\Users\RUNNER~1\...) and
+    /// everything listed under it comes back in the long form: a root typed one way and a path joined or listed the other
+    /// compared unequal, so the walk reported no hard link and the path test trusted none of the service's folders. The
+    /// scripts now put every root and every path in one long spelling (Get-DarlingCanonicalPath) before comparing. This test
+    /// gives the walk, the path test, the root-file list, the backup-name test and the key-folder test the same install
+    /// folder spelled as its short path, the short path with a trailing backslash, the long path in upper case, in lower
+    /// case and with a trailing backslash, and requires the same answers for each, on any machine that has 8.3 names. The
+    /// trust answers are exact: only the service's own folders and its two kinds of root file, nothing else.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheWalkAndThePathTests_AnswerTheSameForARootInShortFormWithATrailingBackslashOrInOtherCase(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, script);
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine(ExtractFunction(script, "Get-DarlingBackupFileFindingNames"));
+        probe.AppendLine(ExtractFunction(script, "Get-DarlingExtraServiceWriteDirectories"));
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $parent = Join-Path $env:TEMP ('pm5649-short-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            $outside = "$parent-outside.txt"
+            # CreateDirectory, not New-Item: Windows PowerShell 5.1's New-Item refuses a new folder chain whose parent is typed as a short path.
+            foreach ($made in @("$parent\install-root-with-a-long-name\pg-runtime", "$parent\install-root-with-a-long-name\other")) { [void][IO.Directory]::CreateDirectory($made) }
+            # The long spelling is what the listing returns for an existing folder; the short one comes from the file system.
+            $long = (Get-Item -LiteralPath "$parent\install-root-with-a-long-name" -Force).FullName
+            $short = ((cmd /c "for %I in (""$long"") do @echo %~sI") | Select-Object -First 1).Trim()
+            try {
+                if ($short.IndexOf('~') -lt 0 -or $short -ieq $long) { 'noShortNames=True'; return }
+                'shortForm=' + $short
+                'longForm=' + $long
+                Set-Content -LiteralPath "$long\darling.json" -Value '{ "postgres": { "managed": false } }'
+                Set-Content -LiteralPath "$long\darling.json.bak-plain" -Value 'x'
+                Set-Content -LiteralPath "$long\notes.txt" -Value 'x'
+                Set-Content -LiteralPath "$long\pg-runtime\a.dll" -Value 'x'
+                Set-Content -LiteralPath "$long\other\darling.json" -Value 'x'
+                Set-Content -LiteralPath $outside -Value 'x'
+                New-Item -ItemType HardLink -Path "$long\darling.json.bak-linked" -Value $outside | Out-Null
+                $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+                $plainItem = [pscustomobject]@{ PSIsContainer = $false; LinkType = $null; Attributes = [IO.FileAttributes]::Normal }
+                $forms = [ordered]@{ short = $short; shortSlash = $short + '\'; upper = $long.ToUpperInvariant(); lower = $long.ToLowerInvariant(); longSlash = $long + '\' }
+                foreach ($tag in $forms.Keys) {
+                    $form = $forms[$tag]
+                    $records = @(Get-UntrustedWriteGrantees $form @($me) -Recurse -AsRecords)
+                    'walk[' + $tag + ']=' + (@($records | Where-Object { $_.Kind -eq 'HardLink' } | ForEach-Object { [IO.Path]::GetFileName($_.Path) } | Sort-Object) -join ',')
+                    'rootFiles[' + $tag + ']=' + (@(Get-DarlingServiceWrittenRootFiles $form | ForEach-Object { $_.Name } | Sort-Object) -join ',')
+                    foreach ($name in @('pg-runtime', 'pg-runtime\a.dll', 'darling.json', 'darling.json.bak-plain', 'darling.json.bak-linked', 'notes.txt', 'other', 'other\darling.json', 'pg-runtime.\a.dll', 'pg-runtime\..\notes.txt')) {
+                        $onDisk = Join-Path $long $name
+                        $item = if (Test-Path -LiteralPath $onDisk -PathType Leaf) { Get-Item -LiteralPath $onDisk -Force } else { $plainItem }
+                        # The candidate is joined onto the root as the caller was handed it, and again onto the long spelling.
+                        'trust[' + $tag + ']' + $name + '=' + (Test-DarlingServiceWrittenPath $form (Join-Path $form $name) @() $item)
+                        'trustLongCandidate[' + $tag + ']' + $name + '=' + (Test-DarlingServiceWrittenPath $form (Join-Path $long $name) @() $item)
+                        'trustShortCandidate[' + $tag + ']' + $name + '=' + (Test-DarlingServiceWrittenPath $form (Join-Path $short $name) @() $item)
+                    }
+                    foreach ($spelling in @(@('long', $long), @('short', $short))) {
+                        $finding = [pscustomobject]@{ Kind = 'Grant'; IsFile = $true; Path = (Join-Path $spelling[1] 'darling.json.bak-plain') }
+                        $other = [pscustomobject]@{ Kind = 'Grant'; IsFile = $true; Path = (Join-Path $spelling[1] 'notes.txt') }
+                        'backupNames[' + $tag + '/' + $spelling[0] + ']=' + (@(Get-DarlingBackupFileFindingNames $form @($finding)) -join ',') + '|' + (@(Get-DarlingBackupFileFindingNames $form @($finding, $other)) -join ',')
+                    }
+                    'keyFolders[' + $tag + ']=' + (@(Get-DarlingExtraServiceWriteDirectories $form (Join-Path $form 'darling.json')) -join ',')
+                }
+                'canonicalShort=' + (Get-DarlingCanonicalPath $short)
+                'canonicalMissingTail=' + (Get-DarlingCanonicalPath "$short\not-there\deeper")
+                'canonicalNothing=[' + (Get-DarlingCanonicalPath '') + ']'
+            }
+            finally {
+                Remove-Item -LiteralPath $parent -Recurse -Force -ErrorAction SilentlyContinue
+                Remove-Item -LiteralPath $outside -Force -ErrorAction SilentlyContinue
+            }
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        if (answers.Contains("noShortNames=True"))
+        {
+            Assert.Skip("8.3 short names are not created on the volume the temp folder is on, so there is no short spelling to test.");
+            return;
+        }
+
+        var longForm = answers.Single(a => a.StartsWith("longForm=", StringComparison.Ordinal))["longForm=".Length..];
+        var shortForm = answers.Single(a => a.StartsWith("shortForm=", StringComparison.Ordinal))["shortForm=".Length..];
+        Assert.Contains("~", shortForm, StringComparison.Ordinal);
+        Assert.NotEqual(longForm, shortForm, StringComparer.OrdinalIgnoreCase);
+
+        var trusted = new[] { "pg-runtime", "pg-runtime\\a.dll", "darling.json", "darling.json.bak-plain" };
+        var untrusted = new[] { "darling.json.bak-linked", "notes.txt", "other", "other\\darling.json", "pg-runtime.\\a.dll", "pg-runtime\\..\\notes.txt" };
+        foreach (var tag in new[] { "short", "shortSlash", "upper", "lower", "longSlash" })
+        {
+            Assert.Contains($"walk[{tag}]=darling.json.bak-linked", answers);
+            Assert.Contains($"rootFiles[{tag}]=darling.json,darling.json.bak-plain", answers);
+            /* A finding on a backup alone is named, whichever spelling its path and the root come in; one beside a file that is not a backup is not. */
+            Assert.Contains($"backupNames[{tag}/long]=darling.json.bak-plain|", answers);
+            Assert.Contains($"backupNames[{tag}/short]=darling.json.bak-plain|", answers);
+            Assert.Contains($"keyFolders[{tag}]=darling-keys", answers);
+            foreach (var kind in new[] { "trust", "trustLongCandidate", "trustShortCandidate" })
+            {
+                foreach (var name in trusted) { Assert.Contains($"{kind}[{tag}]{name}=True", answers); }
+                foreach (var name in untrusted) { Assert.Contains($"{kind}[{tag}]{name}=False", answers); }
+            }
+        }
+
+        Assert.Contains($"canonicalShort={longForm}", answers, StringComparer.OrdinalIgnoreCase);
+        Assert.Contains($"canonicalMissingTail={longForm}\\not-there\\deeper", answers, StringComparer.OrdinalIgnoreCase);
+        Assert.Contains("canonicalNothing=[]", answers);
+    }
+
+    /// <summary>
+    /// #5649: the lock and the walk compare the install folder and every path under it in one spelling (the canonical long
+    /// one) and never through a bare GetFullPath, which spells short names out differently from one runtime to the next. A
+    /// path that cannot be worked out is reported or left untrusted, never passed. The behaviour is run by the test above;
+    /// this one pins that the lock, which needs an elevated account to run, goes through the same helper.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1")]
+    [InlineData("upgrade-darling.ps1")]
+    public void TheLockAndTheWalk_PutTheRootAndEveryPathInTheCanonicalLongSpellingBeforeComparing(string scriptName)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
+        Assert.Contains("$rootCanonical = Get-DarlingCanonicalPath $root", lockText, StringComparison.Ordinal);
+        Assert.Contains("$root = $rootCanonical", lockText, StringComparison.Ordinal);
+        Assert.Contains("$path = Get-DarlingCanonicalPath $target.FullName", lockText, StringComparison.Ordinal);
+        Assert.Contains("Get-DarlingCanonicalPath (Get-Item -LiteralPath $dirPath -Force).FullName", lockText, StringComparison.Ordinal);
+        Assert.Contains("$rootFull = Get-DarlingCanonicalPath $path", ExtractFunction(script, "Get-UntrustedWriteGrantees"), StringComparison.Ordinal);
+        foreach (var name in new[] { "Get-UntrustedWriteGrantees", "Lock-DarlingInstallTree", "Test-DarlingServiceWrittenPath", "Get-DarlingBackupFileFindingNames", "Get-DarlingExtraServiceWriteDirectories" })
+        {
+            Assert.DoesNotContain("GetFullPath", ExtractFunction(script, name), StringComparison.Ordinal);
+        }
+        Assert.Contains("Get-DarlingSegmentsBelowRoot $root $candidate", ExtractFunction(script, "Test-DarlingServiceWrittenPath"), StringComparison.Ordinal);
+    }
+
+    /// <summary>The two path helpers the walk, the lock and the path test call (#5649), the way the scripts define them.</summary>
+    private static void AppendPathHelpers(StringBuilder probe, string script)
+    {
+        probe.AppendLine(ExtractFunction(script, "Get-DarlingCanonicalPath"));
+        probe.AppendLine(ExtractFunction(script, "Get-DarlingSegmentsBelowRoot"));
+    }
+
     /// <summary>Adds the shared service-written list and its path test to a probe, the way the scripts define them
     /// (the lock and the pre-lock walk both read them).</summary>
     private static void AppendServiceWrittenList(StringBuilder probe, string script)
     {
-        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Get-DarlingFileNameCount", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles" })
+        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Get-DarlingFileNameCount", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Get-DarlingCanonicalPath", "Get-DarlingSegmentsBelowRoot" })
         {
             probe.AppendLine(ExtractFunction(script, name));
         }
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index 9ee22e3969..620ea6c48c 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -197,7 +197,10 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     if ($Recurse) {
         # -ErrorVariable, so a folder the walk cannot list is a finding of its own (#4043 round-2 review).
         # Skipped silently, nothing under it reached the checks above and the tree read as clean.
-        $rootFull = try { [IO.Path]::GetFullPath($path).TrimEnd('\') } catch { $path.TrimEnd('\') }
+        # Compared in one canonical long spelling (Get-DarlingCanonicalPath), so an install folder handed in as a short path
+        # (C:\PROGRA~1\...), with a trailing backslash or in other case is the same folder as the one the listing returns. A
+        # path that cannot be worked out is taken to be in the root, so the file is checked rather than passed over (#5649).
+        $rootFull = Get-DarlingCanonicalPath $path
         foreach ($child in @(Get-ChildItem -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue -ErrorVariable listFailures)) {
             if ($child.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
                 $result += New-DarlingWriteFinding 'Link' $child.FullName "$($child.FullName) (a junction or link)"
@@ -208,7 +211,8 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
             # the lock and the install pass (#5649). Reported like a link, for the root files the service writes.
             # The names are counted through Get-DarlingFileNameCount, never from LinkType, and a count that cannot be read is a
             # hard link here too.
-            if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
+            $childFull = if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name)) { Get-DarlingCanonicalPath $child.FullName } else { $null }
+            if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name) -and ($null -eq $rootFull -or $null -eq $childFull -or [IO.Path]::GetDirectoryName($childFull).TrimEnd('\') -ieq $rootFull.TrimEnd('\'))) {
                 $nameCount = Get-DarlingFileNameCount $child.FullName
                 if ($nameCount -gt 1) {
                     $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
@@ -372,6 +376,86 @@ public static class DarlingNativeFileNames
     catch { return -1 }
 }
 
+# One long, absolute spelling of a path, to compare paths by (#5649): GetFullPath's answer (separators, '.' and '..'
+# resolved) with every 8.3 short name in it (C:\PROGRA~1, C:\Users\RUNNER~1) spelled out and the trailing backslash dropped
+# (a drive root keeps it). GetFullPath alone is not enough: it spells short names out differently from one runtime to the
+# next (Windows PowerShell 5.1 leaves them when part of the path is missing or has a '..' step, PowerShell 7 spells out only
+# the part that exists), so a root typed one way and a path listed or joined the other compared unequal, which is how a root
+# under a GitHub Windows runner's temp folder (C:\Users\RUNNER~1\...) lost its hard links and its trusted folders. The part
+# of the path that exists is spelled out by GetLongPathName and a name below it that does not exist stays as typed. Returns
+# $null when no part of the path can be worked out, and every caller treats that as not trusted. Kept byte-identical in
+# install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingCanonicalPath([string]$path) {
+    if ([string]::IsNullOrWhiteSpace($path)) { return $null }
+    try {
+        $full = [IO.Path]::GetFullPath($path)
+        $trimmed = $full.TrimEnd('\')
+        if ($trimmed.Length -le 2) { return $full }
+        if ($trimmed.IndexOf('~') -lt 0) { return $trimmed }
+        if (-not ('DarlingNativePaths' -as [type])) {
+            Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class DarlingNativePaths
+{
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetLongPathNameW(string shortPath, StringBuilder longPath, uint bufferLength);
+
+    // The long spelling of a path that exists, or null.
+    public static string LongName(string path)
+    {
+        StringBuilder buffer = new StringBuilder(path.Length + 260);
+        uint length = GetLongPathNameW(path, buffer, (uint)buffer.Capacity);
+        if (length > buffer.Capacity)
+        {
+            buffer = new StringBuilder((int)length + 1);
+            length = GetLongPathNameW(path, buffer, (uint)buffer.Capacity);
+        }
+        if (length == 0 || length > buffer.Capacity) { return null; }
+        return buffer.ToString();
+    }
+}
+'@
+        }
+        $below = @()
+        $existing = $trimmed
+        while ($true) {
+            $long = [DarlingNativePaths]::LongName($existing)
+            if ($null -ne $long) { break }
+            $parent = [IO.Path]::GetDirectoryName($existing)
+            if ([string]::IsNullOrEmpty($parent)) { return $null }
+            $below = @([IO.Path]::GetFileName($existing)) + $below
+            $existing = $parent
+        }
+        return (@($long.TrimEnd('\')) + $below) -join '\'
+    }
+    catch { return $null }
+}
+
+# The names on the way from $root down to $candidate, as an array, or $null when $candidate is not below $root, is not an
+# absolute path, has a name on the way that Windows folds into another (a '.' or '..' step, an empty name, a trailing dot or
+# space) or either path cannot be worked out. Both paths go through Get-DarlingCanonicalPath, so a root typed as a short path
+# (C:\PROGRA~1\x), with a trailing backslash or in another case gives the same answer as its long spelling. The fold check
+# runs on the candidate as it was handed in, because that is the spelling Windows would resolve (GetFullPath folds the
+# names away). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingSegmentsBelowRoot([string]$root, [string]$candidate) {
+    if ([string]::IsNullOrWhiteSpace($candidate) -or $candidate -notmatch '^([A-Za-z]:[\\/]|\\\\)') { return $null }
+    $given = @($candidate.TrimEnd('\', '/') -split '[\\/]')
+    $first = if ($candidate.StartsWith('\\')) { 3 } else { 1 }
+    for ($i = $first; $i -lt $given.Count; $i++) {
+        $name = $given[$i]
+        if ($name -eq '' -or $name -eq '.' -or $name -eq '..' -or $name.EndsWith('.') -or $name.EndsWith(' ')) { return $null }
+    }
+    $rootText = Get-DarlingCanonicalPath $root
+    $candidateText = Get-DarlingCanonicalPath $candidate
+    if ($null -eq $rootText -or $null -eq $candidateText) { return $null }
+    $prefix = $rootText.TrimEnd('\') + '\'
+    if (-not $candidateText.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase) -or $candidateText.Length -eq $prefix.Length) { return $null }
+    return , @($candidateText.Substring($prefix.Length) -split '\\')
+}
+
 # The files directly in $root that the service writes (the names on the list above): the ones the lock makes the
 # service the owner of, and with -BackupsOnly the darling.json.bak-* ones the install pass hardens. A file with more
 # than one name (a hard link) and a file that is a link are left out, so neither gets the service as its owner or a
@@ -394,13 +478,8 @@ function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly)
 # listed file is trusted by name only when it is a plain file (not a folder, a link or a file with more than one
 # name), and with no item a root file is not trusted, so the answer never rests on a second look at the disk.
 function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @(), $item = $null) {
-    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
-    catch { return $false }
-    if (-not $candidate.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return $false }
-    $segments = @($candidate.Substring($rootText.Length + 1).TrimEnd('\') -split '\\')
-    foreach ($segment in $segments) {
-        if ($segment -eq '' -or $segment -eq '.' -or $segment -eq '..' -or $segment.EndsWith('.') -or $segment.EndsWith(' ')) { return $false }
-    }
+    $segments = Get-DarlingSegmentsBelowRoot $root $candidate
+    if ($null -eq $segments) { return $false }
     $names = Get-DarlingServiceWrittenNames
     foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
         if ($segments[0] -ieq $directory) { return $true }
@@ -611,16 +690,14 @@ Then run install-darling.ps1 from there.
 # the refusal keeps its standard advice alone. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingBackupFileFindingNames([string]$root, [array]$findings) {
     if (@($findings).Count -eq 0) { return @() }
-    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
-    catch { return @() }
     $names = @()
     foreach ($finding in @($findings)) {
         if ($finding.Kind -ne 'Grant' -and $finding.Kind -ne 'Owner') { return @() }
         if (-not $finding.IsFile) { return @() }
-        $path = "$($finding.Path)"
-        if (-not $path.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return @() }
-        $leaf = $path.Substring($rootText.Length + 1)
-        if ($leaf.Contains('\') -or -not (Test-DarlingServiceWrittenFileName $leaf) -or [string]::Equals($leaf, 'darling.json', [StringComparison]::OrdinalIgnoreCase)) { return @() }
+        $segments = Get-DarlingSegmentsBelowRoot $root "$($finding.Path)"
+        if ($null -eq $segments -or $segments.Count -ne 1) { return @() }
+        $leaf = $segments[0]
+        if (-not (Test-DarlingServiceWrittenFileName $leaf) -or [string]::Equals($leaf, 'darling.json', [StringComparison]::OrdinalIgnoreCase)) { return @() }
         if ($names -notcontains $leaf) { $names += $leaf }
     }
     return @($names)
@@ -979,8 +1056,9 @@ function Get-DarlingExtraServiceWriteDirectories([string]$root, [string]$configP
     # A NAME under the install root, not a path: Lock-DarlingInstallTree Join-Paths it onto the root, and Join-Path does not
     # treat a rooted child as rooted ('C:\a' + 'C:\a\b' = 'C:\a\C:\a\b'). A darling.json outside the root puts the key
     # folder outside the tree the lock covers, so it needs no grant from here.
-    $configDir = [System.IO.Path]::GetDirectoryName($configPath).TrimEnd('\')   # Split-Path -LiteralPath -Parent is ambiguous on PowerShell 5.1
-    if ($configDir -ine $root.TrimEnd('\')) { return @() }
+    $configDir = Get-DarlingCanonicalPath ([System.IO.Path]::GetDirectoryName($configPath))   # Split-Path -LiteralPath -Parent is ambiguous on PowerShell 5.1
+    $rootCanonical = Get-DarlingCanonicalPath $root
+    if ($null -eq $configDir -or $null -eq $rootCanonical -or $configDir.TrimEnd('\') -ine $rootCanonical.TrimEnd('\')) { return @() }
     return @((Get-DarlingServiceWrittenNames).KeyDirectories)
 }
 
@@ -990,6 +1068,12 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     # it. So this function judges icacls by its exit code and output, and reports an unreadable object rather
     # than throwing out of the whole lock. The preference is local to this function.
     $ErrorActionPreference = 'Continue'
+    # Every path below is compared with the listing's own spelling, which is the long one, so the root is put in that
+    # spelling first: handed in as a short path (C:\PROGRA~1\...), the root file the service owns would not be recognised as
+    # one directly in it and the service's own grant on it would be stripped (#5649). One that cannot be worked out is not locked.
+    $rootCanonical = Get-DarlingCanonicalPath $root
+    if ($null -eq $rootCanonical) { return @("$root (the full path of the install folder could not be worked out, so it was not locked)") }
+    $root = $rootCanonical
     if ((Get-Item -LiteralPath $root -Force -ErrorAction Stop).Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
         return @("$root (the install folder itself is a junction or link: run from the folder it points to)")
     }
@@ -1065,7 +1149,9 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
             }
             $grantOutput = & icacls.exe $dirPath /grant "*$($serviceSid.Value):(OI)(CI)M" 2>&1
             if ($LASTEXITCODE -ne 0) { $open += "$dirPath (icacls /grant Modify for the service failed: $($grantOutput -join ' '))"; continue }
-            $serviceWritePaths += (Get-Item -LiteralPath $dirPath -Force).FullName.TrimEnd('\')
+            $serviceWritePath = Get-DarlingCanonicalPath (Get-Item -LiteralPath $dirPath -Force).FullName
+            if ($null -eq $serviceWritePath) { $open += "$dirPath (its full path could not be worked out, so the service's grant on it cannot be trusted)"; continue }
+            $serviceWritePaths += $serviceWritePath.TrimEnd('\')
         }
     }
     # A write grant to the service SID is only trusted under one of $serviceWritePaths (path-prefix match,
@@ -1088,7 +1174,8 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if (-not (Get-Acl -LiteralPath $root).AreAccessRulesProtected) { $open += "$root (still inherits from its parent)" }
     $targets = @(Get-Item -LiteralPath $root -Force) + @(Get-ChildItem -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue)
     foreach ($target in $targets) {
-        $path = $target.FullName
+        $path = Get-DarlingCanonicalPath $target.FullName
+        if ($null -eq $path) { $open += "$($target.FullName) (its full path could not be worked out)"; continue }
         if ($path.TrimEnd('\') -ine $root.TrimEnd('\') -and ($target.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
             $open += "$path (a junction or link)"
             continue
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index b18b20e806..f743799abe 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -250,7 +250,10 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     if ($Recurse) {
         # -ErrorVariable, so a folder the walk cannot list is a finding of its own (#4043 round-2 review).
         # Skipped silently, nothing under it reached the checks above and the tree read as clean.
-        $rootFull = try { [IO.Path]::GetFullPath($path).TrimEnd('\') } catch { $path.TrimEnd('\') }
+        # Compared in one canonical long spelling (Get-DarlingCanonicalPath), so an install folder handed in as a short path
+        # (C:\PROGRA~1\...), with a trailing backslash or in other case is the same folder as the one the listing returns. A
+        # path that cannot be worked out is taken to be in the root, so the file is checked rather than passed over (#5649).
+        $rootFull = Get-DarlingCanonicalPath $path
         foreach ($child in @(Get-ChildItem -LiteralPath $path -Recurse -Force -ErrorAction SilentlyContinue -ErrorVariable listFailures)) {
             if ($child.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
                 $result += New-DarlingWriteFinding 'Link' $child.FullName "$($child.FullName) (a junction or link)"
@@ -261,7 +264,8 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
             # the lock and the install pass (#5649). Reported like a link, for the root files the service writes.
             # The names are counted through Get-DarlingFileNameCount, never from LinkType, and a count that cannot be read is a
             # hard link here too.
-            if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name) -and ([IO.Path]::GetDirectoryName($child.FullName).TrimEnd('\') -ieq $rootFull)) {
+            $childFull = if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name)) { Get-DarlingCanonicalPath $child.FullName } else { $null }
+            if (-not $child.PSIsContainer -and (Test-DarlingServiceWrittenFileName $child.Name) -and ($null -eq $rootFull -or $null -eq $childFull -or [IO.Path]::GetDirectoryName($childFull).TrimEnd('\') -ieq $rootFull.TrimEnd('\'))) {
                 $nameCount = Get-DarlingFileNameCount $child.FullName
                 if ($nameCount -gt 1) {
                     $result += New-DarlingWriteFinding 'HardLink' $child.FullName "$($child.FullName) (a hard link: this file has more than one name, and its permissions are the same under every one)" $true
@@ -425,6 +429,86 @@ public static class DarlingNativeFileNames
     catch { return -1 }
 }
 
+# One long, absolute spelling of a path, to compare paths by (#5649): GetFullPath's answer (separators, '.' and '..'
+# resolved) with every 8.3 short name in it (C:\PROGRA~1, C:\Users\RUNNER~1) spelled out and the trailing backslash dropped
+# (a drive root keeps it). GetFullPath alone is not enough: it spells short names out differently from one runtime to the
+# next (Windows PowerShell 5.1 leaves them when part of the path is missing or has a '..' step, PowerShell 7 spells out only
+# the part that exists), so a root typed one way and a path listed or joined the other compared unequal, which is how a root
+# under a GitHub Windows runner's temp folder (C:\Users\RUNNER~1\...) lost its hard links and its trusted folders. The part
+# of the path that exists is spelled out by GetLongPathName and a name below it that does not exist stays as typed. Returns
+# $null when no part of the path can be worked out, and every caller treats that as not trusted. Kept byte-identical in
+# install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingCanonicalPath([string]$path) {
+    if ([string]::IsNullOrWhiteSpace($path)) { return $null }
+    try {
+        $full = [IO.Path]::GetFullPath($path)
+        $trimmed = $full.TrimEnd('\')
+        if ($trimmed.Length -le 2) { return $full }
+        if ($trimmed.IndexOf('~') -lt 0) { return $trimmed }
+        if (-not ('DarlingNativePaths' -as [type])) {
+            Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class DarlingNativePaths
+{
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetLongPathNameW(string shortPath, StringBuilder longPath, uint bufferLength);
+
+    // The long spelling of a path that exists, or null.
+    public static string LongName(string path)
+    {
+        StringBuilder buffer = new StringBuilder(path.Length + 260);
+        uint length = GetLongPathNameW(path, buffer, (uint)buffer.Capacity);
+        if (length > buffer.Capacity)
+        {
+            buffer = new StringBuilder((int)length + 1);
+            length = GetLongPathNameW(path, buffer, (uint)buffer.Capacity);
+        }
+        if (length == 0 || length > buffer.Capacity) { return null; }
+        return buffer.ToString();
+    }
+}
+'@
+        }
+        $below = @()
+        $existing = $trimmed
+        while ($true) {
+            $long = [DarlingNativePaths]::LongName($existing)
+            if ($null -ne $long) { break }
+            $parent = [IO.Path]::GetDirectoryName($existing)
+            if ([string]::IsNullOrEmpty($parent)) { return $null }
+            $below = @([IO.Path]::GetFileName($existing)) + $below
+            $existing = $parent
+        }
+        return (@($long.TrimEnd('\')) + $below) -join '\'
+    }
+    catch { return $null }
+}
+
+# The names on the way from $root down to $candidate, as an array, or $null when $candidate is not below $root, is not an
+# absolute path, has a name on the way that Windows folds into another (a '.' or '..' step, an empty name, a trailing dot or
+# space) or either path cannot be worked out. Both paths go through Get-DarlingCanonicalPath, so a root typed as a short path
+# (C:\PROGRA~1\x), with a trailing backslash or in another case gives the same answer as its long spelling. The fold check
+# runs on the candidate as it was handed in, because that is the spelling Windows would resolve (GetFullPath folds the
+# names away). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+function Get-DarlingSegmentsBelowRoot([string]$root, [string]$candidate) {
+    if ([string]::IsNullOrWhiteSpace($candidate) -or $candidate -notmatch '^([A-Za-z]:[\\/]|\\\\)') { return $null }
+    $given = @($candidate.TrimEnd('\', '/') -split '[\\/]')
+    $first = if ($candidate.StartsWith('\\')) { 3 } else { 1 }
+    for ($i = $first; $i -lt $given.Count; $i++) {
+        $name = $given[$i]
+        if ($name -eq '' -or $name -eq '.' -or $name -eq '..' -or $name.EndsWith('.') -or $name.EndsWith(' ')) { return $null }
+    }
+    $rootText = Get-DarlingCanonicalPath $root
+    $candidateText = Get-DarlingCanonicalPath $candidate
+    if ($null -eq $rootText -or $null -eq $candidateText) { return $null }
+    $prefix = $rootText.TrimEnd('\') + '\'
+    if (-not $candidateText.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase) -or $candidateText.Length -eq $prefix.Length) { return $null }
+    return , @($candidateText.Substring($prefix.Length) -split '\\')
+}
+
 # The files directly in $root that the service writes (the names on the list above): the ones the lock makes the
 # service the owner of, and with -BackupsOnly the darling.json.bak-* ones the install pass hardens. A file with more
 # than one name (a hard link) and a file that is a link are left out, so neither gets the service as its owner or a
@@ -447,13 +531,8 @@ function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly)
 # listed file is trusted by name only when it is a plain file (not a folder, a link or a file with more than one
 # name), and with no item a root file is not trusted, so the answer never rests on a second look at the disk.
 function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @(), $item = $null) {
-    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
-    catch { return $false }
-    if (-not $candidate.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return $false }
-    $segments = @($candidate.Substring($rootText.Length + 1).TrimEnd('\') -split '\\')
-    foreach ($segment in $segments) {
-        if ($segment -eq '' -or $segment -eq '.' -or $segment -eq '..' -or $segment.EndsWith('.') -or $segment.EndsWith(' ')) { return $false }
-    }
+    $segments = Get-DarlingSegmentsBelowRoot $root $candidate
+    if ($null -eq $segments) { return $false }
     $names = Get-DarlingServiceWrittenNames
     foreach ($directory in (@($names.Directories) + @($extraDirectories | Where-Object { $_ }))) {
         if ($segments[0] -ieq $directory) { return $true }
@@ -664,16 +743,14 @@ Then run install-darling.ps1 from there.
 # the refusal keeps its standard advice alone. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingBackupFileFindingNames([string]$root, [array]$findings) {
     if (@($findings).Count -eq 0) { return @() }
-    try { $rootText = [IO.Path]::GetFullPath($root).TrimEnd('\') }
-    catch { return @() }
     $names = @()
     foreach ($finding in @($findings)) {
         if ($finding.Kind -ne 'Grant' -and $finding.Kind -ne 'Owner') { return @() }
         if (-not $finding.IsFile) { return @() }
-        $path = "$($finding.Path)"
-        if (-not $path.StartsWith($rootText + '\', [StringComparison]::OrdinalIgnoreCase)) { return @() }
-        $leaf = $path.Substring($rootText.Length + 1)
-        if ($leaf.Contains('\') -or -not (Test-DarlingServiceWrittenFileName $leaf) -or [string]::Equals($leaf, 'darling.json', [StringComparison]::OrdinalIgnoreCase)) { return @() }
+        $segments = Get-DarlingSegmentsBelowRoot $root "$($finding.Path)"
+        if ($null -eq $segments -or $segments.Count -ne 1) { return @() }
+        $leaf = $segments[0]
+        if (-not (Test-DarlingServiceWrittenFileName $leaf) -or [string]::Equals($leaf, 'darling.json', [StringComparison]::OrdinalIgnoreCase)) { return @() }
         if ($names -notcontains $leaf) { $names += $leaf }
     }
     return @($names)
@@ -818,8 +895,9 @@ function Get-DarlingExtraServiceWriteDirectories([string]$root, [string]$configP
     # A NAME under the install root, not a path: Lock-DarlingInstallTree Join-Paths it onto the root, and Join-Path does not
     # treat a rooted child as rooted ('C:\a' + 'C:\a\b' = 'C:\a\C:\a\b'). A darling.json outside the root puts the key
     # folder outside the tree the lock covers, so it needs no grant from here.
-    $configDir = [System.IO.Path]::GetDirectoryName($configPath).TrimEnd('\')   # Split-Path -LiteralPath -Parent is ambiguous on PowerShell 5.1
-    if ($configDir -ine $root.TrimEnd('\')) { return @() }
+    $configDir = Get-DarlingCanonicalPath ([System.IO.Path]::GetDirectoryName($configPath))   # Split-Path -LiteralPath -Parent is ambiguous on PowerShell 5.1
+    $rootCanonical = Get-DarlingCanonicalPath $root
+    if ($null -eq $configDir -or $null -eq $rootCanonical -or $configDir.TrimEnd('\') -ine $rootCanonical.TrimEnd('\')) { return @() }
     return @((Get-DarlingServiceWrittenNames).KeyDirectories)
 }
 
@@ -829,6 +907,12 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     # it. So this function judges icacls by its exit code and output, and reports an unreadable object rather
     # than throwing out of the whole lock. The preference is local to this function.
     $ErrorActionPreference = 'Continue'
+    # Every path below is compared with the listing's own spelling, which is the long one, so the root is put in that
+    # spelling first: handed in as a short path (C:\PROGRA~1\...), the root file the service owns would not be recognised as
+    # one directly in it and the service's own grant on it would be stripped (#5649). One that cannot be worked out is not locked.
+    $rootCanonical = Get-DarlingCanonicalPath $root
+    if ($null -eq $rootCanonical) { return @("$root (the full path of the install folder could not be worked out, so it was not locked)") }
+    $root = $rootCanonical
     if ((Get-Item -LiteralPath $root -Force -ErrorAction Stop).Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
         return @("$root (the install folder itself is a junction or link: run from the folder it points to)")
     }
@@ -904,7 +988,9 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
             }
             $grantOutput = & icacls.exe $dirPath /grant "*$($serviceSid.Value):(OI)(CI)M" 2>&1
             if ($LASTEXITCODE -ne 0) { $open += "$dirPath (icacls /grant Modify for the service failed: $($grantOutput -join ' '))"; continue }
-            $serviceWritePaths += (Get-Item -LiteralPath $dirPath -Force).FullName.TrimEnd('\')
+            $serviceWritePath = Get-DarlingCanonicalPath (Get-Item -LiteralPath $dirPath -Force).FullName
+            if ($null -eq $serviceWritePath) { $open += "$dirPath (its full path could not be worked out, so the service's grant on it cannot be trusted)"; continue }
+            $serviceWritePaths += $serviceWritePath.TrimEnd('\')
         }
     }
     # A write grant to the service SID is only trusted under one of $serviceWritePaths (path-prefix match,
@@ -927,7 +1013,8 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if (-not (Get-Acl -LiteralPath $root).AreAccessRulesProtected) { $open += "$root (still inherits from its parent)" }
     $targets = @(Get-Item -LiteralPath $root -Force) + @(Get-ChildItem -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue)
     foreach ($target in $targets) {
-        $path = $target.FullName
+        $path = Get-DarlingCanonicalPath $target.FullName
+        if ($null -eq $path) { $open += "$($target.FullName) (its full path could not be worked out)"; continue }
         if ($path.TrimEnd('\') -ine $root.TrimEnd('\') -and ($target.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
             $open += "$path (a junction or link)"
             continue

From c6eb6dc7f0530ad9efa74039775b1f32ee036f96 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:43:58 -0400
Subject: [PATCH 08/14] Install scripts and service: a name Windows folds is
 not a backup, and the walk's de-duplication ignores case (#5649)

Test-DarlingServiceWrittenFileName now answers false for a name that ends in a dot or a space, the
same answer Test-DarlingServiceWrittenPath already gave, so the pre-lock walk, the lock and the
install-time hardening agree about darling.json.bak-x. and darling.json.bak-x followed by a space.
DarlingConfigBackup.IsBackupName does the same, so the service sweep and the CLI check skip those names.

Get-UntrustedWriteGrantees de-duplicates its findings with an OrdinalIgnoreCase comparer, because
Windows compares paths without regard to case.

Tests run both scripts under Windows PowerShell 5.1 and PowerShell 7.
---
 CHANGELOG.md                                  |   2 +-
 .../DarlingHardenFilesVerbTests.cs            |  43 +++++++
 .../DarlingInstallLocationTests.cs            | 110 ++++++++++++++++++
 .../DarlingConfigBackup.cs                    |   5 +-
 Darling/tools/install-darling.ps1             |   9 +-
 Darling/tools/upgrade-darling.ps1             |   9 +-
 6 files changed, 172 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e32b2e35c..b6a3b7045a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,7 +27,7 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 
 ### Fixed
 
-- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check also covers the backups of the config it was given, not only `darling.json.bak-*`.
+- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
 
 ## [3.10.0] - 2026-10-09
 
diff --git a/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs b/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs
index 331cedceef..1e2ae62612 100644
--- a/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs
+++ b/Darling/Darling.Tests/DarlingHardenFilesVerbTests.cs
@@ -549,4 +549,47 @@ private static void MakeJunction(string link, string target)
         process.StandardError.ReadToEnd();
         process.WaitForExit();
     }
+
+    /// <summary>
+    /// #5649: a name Windows folds into another (a trailing dot or a trailing space) is never a backup, the same answer the
+    /// install and upgrade scripts give (<c>Test-DarlingServiceWrittenFileName</c>): it resolves to a DIFFERENT file, so the
+    /// service must not harden it or the CLI list it as the config's backup. The files are made through a <c>\\?\</c> path,
+    /// the only way to create such a name, and both listings (the CLI's and the service's start-up sweep) skip them while the
+    /// plain backup name still counts.
+    /// </summary>
+    [Fact]
+    public void TheBackupNameTest_RefusesANameWindowsFolds_InTheNameTestAndBothListings()
+    {
+        Assert.True(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak-x"));
+        Assert.False(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak-x."));
+        Assert.False(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak-x "));
+        Assert.False(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak-x.. "));
+        Assert.False(DarlingConfigBackup.IsBackupName("darling.json", "darling.json.bak-."));
+        Assert.False(DarlingConfigBackup.IsBackupName("prod.json", "prod.json.bak-x."));
+
+        var directory = Path.Combine(Path.GetTempPath(), "pm5649-fold-" + Guid.NewGuid().ToString("N")[..8]);
+        Directory.CreateDirectory(directory);
+        try
+        {
+            File.WriteAllText(Path.Combine(directory, "darling.json.bak-x"), "{}");
+            foreach (var folded in new[] { "darling.json.bak-y.", "darling.json.bak-y " })
+            {
+                File.WriteAllText(@"\\?\" + Path.Combine(directory, folded), "{}");
+            }
+
+            var cli = System.Linq.Enumerable.ToArray(System.Linq.Enumerable.Select(DarlingCliCommands.ConfigBackupFiles(directory, "darling.json"), Path.GetFileName));
+            var sweep = System.Linq.Enumerable.ToArray(System.Linq.Enumerable.Select(DarlingConfigBackup.ListBackups(directory, "darling.json"), Path.GetFileName));
+            Assert.Equal(new[] { "darling.json.bak-x" }, cli);
+            Assert.Equal(new[] { "darling.json.bak-x" }, sweep);
+        }
+        finally
+        {
+            foreach (var folded in new[] { "darling.json.bak-y.", "darling.json.bak-y " })
+            {
+                try { File.Delete(@"\\?\" + Path.Combine(directory, folded)); } catch (IOException) { }
+            }
+
+            Directory.Delete(directory, recursive: true);
+        }
+    }
 }
diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index b1fdd54f9d..5d4d0e07f7 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -1080,6 +1080,116 @@ public void TheServiceWrittenList_MatchesOnlyTheNamesTheServiceWrites()
         }
     }
 
+    /// <summary>
+    /// #5649: a name Windows folds into another (a trailing dot or a trailing space) is not on the service-written list,
+    /// whatever its start: it resolves to a DIFFERENT file, and the path test has always refused it. The name test and the
+    /// path test must give the same answer for it, so the lock and the install pass never act on a file the pre-lock walk
+    /// declined to trust. The plain backup name keeps matching. Run under Windows PowerShell 5.1 and PowerShell 7, with
+    /// both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheServiceWrittenFileName_RefusesANameWindowsFolds_AndTheNameAndPathTestsAgree(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Get-UntrustedWriteGrantees"));
+        AppendPathHelpers(probe, script);
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $root = Join-Path $env:TEMP ('pm5649-fold-' + [guid]::NewGuid().ToString('N').Substring(0, 8))
+            New-Item -ItemType Directory -Path $root -Force | Out-Null
+            Set-Content -LiteralPath "$root\darling.json.bak-x" -Value 'x'
+            'setup.backupFileMade=' + (Test-Path -LiteralPath "$root\darling.json.bak-x")
+            $fileItem = [pscustomobject]@{ PSIsContainer = $false; LinkType = $null; Attributes = [IO.FileAttributes]::Normal }
+            try {
+                foreach ($name in @('darling.json.bak-x', 'DARLING.JSON.BAK-X', 'darling.json.bak-x.', 'darling.json.bak-x ', 'darling.json.bak-x..', 'darling.json.bak-x. ', 'darling.json.bak-.', 'darling.json.bak- ', '')) {
+                    'name:[' + $name + ']=' + (Test-DarlingServiceWrittenFileName $name)
+                    if ($name -ne '') { 'path:[' + $name + ']=' + (Test-DarlingServiceWrittenPath $root ($root + '\' + $name) @() $fileItem) }
+                }
+            }
+            finally { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue }
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("name:[darling.json.bak-x]=True", answers);
+        Assert.Contains("name:[DARLING.JSON.BAK-X]=True", answers);
+        Assert.Contains("path:[darling.json.bak-x]=True", answers);
+        foreach (var folded in new[] { "darling.json.bak-x.", "darling.json.bak-x ", "darling.json.bak-x..", "darling.json.bak-x. ", "darling.json.bak-.", "darling.json.bak- " })
+        {
+            Assert.Contains($"name:[{folded}]=False", answers);
+            Assert.Contains($"path:[{folded}]=False", answers);
+        }
+
+        Assert.Contains("name:[]=False", answers);
+    }
+
+    /// <summary>
+    /// #5649: the pre-lock walk names each finding once, and Windows paths are compared without regard to case, so the same
+    /// path spelled in two cases is one finding too. The probe runs the two de-duplication lines exactly as the script
+    /// ships them over findings whose text differs only in case, under both shells (the way a comparer is passed to
+    /// <c>New-Object</c> is the part most likely to differ between them).
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheWalksDeDuplication_TreatsTheSamePathInTwoCasesAsOneFinding(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var seenLine = ExtractLine(script, "$seen = New-Object 'System.Collections.Generic.HashSet[string]'");
+        var uniqueLine = ExtractLine(script, "$unique = @(foreach ($found in $result)");
+        Assert.Contains("OrdinalIgnoreCase", seenLine, StringComparison.Ordinal);
+
+        var probe = new StringBuilder();
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $result = @(
+                [pscustomobject]@{ Kind = 'Grant'; Path = 'C:\Pm\Folder'; Text = 'BUILTIN\Users on C:\Pm\Folder'; IsFile = $false },
+                [pscustomobject]@{ Kind = 'Grant'; Path = 'c:\pm\folder'; Text = 'BUILTIN\Users on c:\pm\folder'; IsFile = $false },
+                [pscustomobject]@{ Kind = 'Grant'; Path = 'C:\Pm\Folder'; Text = 'BUILTIN\Users on C:\Pm\Folder'; IsFile = $false },
+                [pscustomobject]@{ Kind = 'Grant'; Path = 'C:\Pm\Other'; Text = 'BUILTIN\Users on C:\Pm\Other'; IsFile = $false })
+            """);
+        probe.AppendLine(seenLine);
+        probe.AppendLine(uniqueLine);
+        probe.AppendLine("""
+            'unique=' + @($unique).Count
+            'first=' + $unique[0].Text
+            'second=' + $unique[1].Text
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        Assert.Contains("unique=2", answers);
+        Assert.Contains(@"first=BUILTIN\Users on C:\Pm\Folder", answers);
+        Assert.Contains(@"second=BUILTIN\Users on C:\Pm\Other", answers);
+    }
+
     /// <summary>
     /// #5649: the pre-lock walk trusts the service account (as grantee and as owner) on EVERY file in the install root
     /// whose name starts with darling.json.bak-, the glob the hardening covers, so a backup an operator named by hand
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
index adcf84292c..0a52cedbca 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
@@ -38,8 +38,11 @@ internal static class DarlingConfigBackup
     public const string Glob = Prefix + "*";
 
     /// <summary>Whether <paramref name="fileName"/> is a backup of the config file named <paramref name="configFileName"/>:
-    /// it starts with that name plus <see cref="Tail"/>, compared ordinally and ignoring case, as Windows compares names.</summary>
+    /// it starts with that name plus <see cref="Tail"/>, compared ordinally and ignoring case, as Windows compares names.
+    /// A name ending in a dot or a space is never a backup: Windows folds that tail away, so the name resolves to a
+    /// DIFFERENT file, and the install and upgrade scripts' <c>Test-DarlingServiceWrittenFileName</c> refuses it the same way.</summary>
     public static bool IsBackupName(string configFileName, string fileName) =>
+        !fileName.EndsWith('.') && !fileName.EndsWith(' ') &&
         fileName.StartsWith(configFileName + Tail, StringComparison.OrdinalIgnoreCase);
 
     /// <summary>The backups of the config file named <paramref name="configFileName"/> directly in
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index 620ea6c48c..ae5e132ae8 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -230,7 +230,8 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     }
     # Each finding once: a folder made under C:\ inherits BUILTIN\Users as two ACEs (one grants append, one
     # grants write), and without this every caller named that principal twice for the same path.
-    $seen = New-Object 'System.Collections.Generic.HashSet[string]'
+    # Compared without regard to case, the way Windows compares paths: the same path spelled in two cases is one finding.
+    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
     $unique = @(foreach ($found in $result) { if ($seen.Add($found.Text)) { $found } })
     if ($AsRecords) { return @($unique) }
     return @($unique | ForEach-Object { $_.Text })
@@ -298,7 +299,8 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
 # PowerShell 5.1, match some look-alike characters, so they can disagree with the service. DarlingConfigBackup.Prefix
 # in the service is the one in C#, and a test pins the two to the same text. A file with more than one name (a hard
 # link) is never one the service writes: the root files this list covers come from Get-DarlingServiceWrittenRootFiles,
-# which leaves those out. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# which leaves those out. Nor is a name ending in a dot or a space, which Windows folds into another name (the path test
+# refuses those too, and the service's backup test does the same). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingServiceWrittenNames {
     return [pscustomobject]@{
         Directories    = @('pg-runtime', 'pg-runtime-prev')
@@ -311,6 +313,9 @@ function Get-DarlingServiceWrittenNames {
 # True when a file NAME is one of the root files on the list above.
 function Test-DarlingServiceWrittenFileName([string]$name) {
     $names = Get-DarlingServiceWrittenNames
+    # A name Windows folds into another (a trailing dot or space) is not one the service wrote: it resolves to a DIFFERENT
+    # file, and Test-DarlingServiceWrittenPath already refuses it, so the two answer the same (#5649).
+    if ([string]::IsNullOrEmpty($name) -or $name.EndsWith('.') -or $name.EndsWith(' ')) { return $false }
     foreach ($file in @($names.Files)) {
         if ([string]::Equals($name, $file, [StringComparison]::OrdinalIgnoreCase)) { return $true }
     }
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index f743799abe..6827ad9327 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -283,7 +283,8 @@ function Get-UntrustedWriteGrantees([string]$path, [array]$trusted, [switch]$Rec
     }
     # Each finding once: a folder made under C:\ inherits BUILTIN\Users as two ACEs (one grants append, one
     # grants write), and without this every caller named that principal twice for the same path.
-    $seen = New-Object 'System.Collections.Generic.HashSet[string]'
+    # Compared without regard to case, the way Windows compares paths: the same path spelled in two cases is one finding.
+    $seen = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase)
     $unique = @(foreach ($found in $result) { if ($seen.Add($found.Text)) { $found } })
     if ($AsRecords) { return @($unique) }
     return @($unique | ForEach-Object { $_.Text })
@@ -351,7 +352,8 @@ function Resolve-DarlingServiceAccountSid([string]$account) {
 # PowerShell 5.1, match some look-alike characters, so they can disagree with the service. DarlingConfigBackup.Prefix
 # in the service is the one in C#, and a test pins the two to the same text. A file with more than one name (a hard
 # link) is never one the service writes: the root files this list covers come from Get-DarlingServiceWrittenRootFiles,
-# which leaves those out. Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
+# which leaves those out. Nor is a name ending in a dot or a space, which Windows folds into another name (the path test
+# refuses those too, and the service's backup test does the same). Kept byte-identical in install-darling.ps1 and upgrade-darling.ps1.
 function Get-DarlingServiceWrittenNames {
     return [pscustomobject]@{
         Directories    = @('pg-runtime', 'pg-runtime-prev')
@@ -364,6 +366,9 @@ function Get-DarlingServiceWrittenNames {
 # True when a file NAME is one of the root files on the list above.
 function Test-DarlingServiceWrittenFileName([string]$name) {
     $names = Get-DarlingServiceWrittenNames
+    # A name Windows folds into another (a trailing dot or space) is not one the service wrote: it resolves to a DIFFERENT
+    # file, and Test-DarlingServiceWrittenPath already refuses it, so the two answer the same (#5649).
+    if ([string]::IsNullOrEmpty($name) -or $name.EndsWith('.') -or $name.EndsWith(' ')) { return $false }
     foreach ($file in @($names.Files)) {
         if ([string]::Equals($name, $file, [StringComparison]::OrdinalIgnoreCase)) { return $true }
     }

From 75d192f9c33527c38b455dd28a213ebd675d0556 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:39:37 -0400
Subject: [PATCH 09/14] Backup trust: writer builds the name from
 DarlingConfigBackup, lock leaves hard-linked files alone, UNC server name is
 checked (#5649)

- DarlingConfigBackup.BackupPath builds the backup name (config path, Tail, stamp, optional -N); the CLI writer calls it
  instead of spelling .bak- by hand. The unused Glob constant is removed. The written names are unchanged and pinned.
- Lock-DarlingInstallTree: any file with more than one name (or whose names cannot be counted) that would have its
  permissions changed is reported as open and left untouched, wherever it is in the tree.
- Get-DarlingSegmentsBelowRoot checks every name after the leading double backslash of a UNC path.
- Comment in Test-DarlingServiceWrittenPath now says the name count is a live read.
- Shape check header and workflow comment: U2 and U3 are U1 without the backup file.
---
 .github/scripts/darling-upgrade-shapes.ps1    |   4 +-
 .github/workflows/darling-upgrade-shapes.yml  |   4 +-
 .../DarlingInstallLocationTests.cs            | 150 +++++++++++++++++-
 .../DarlingCliCommands.cs                     |   9 +-
 .../DarlingConfigBackup.cs                    |   9 +-
 Darling/tools/install-darling.ps1             |  13 +-
 Darling/tools/upgrade-darling.ps1             |  13 +-
 7 files changed, 187 insertions(+), 15 deletions(-)

diff --git a/.github/scripts/darling-upgrade-shapes.ps1 b/.github/scripts/darling-upgrade-shapes.ps1
index 10c1a9daa0..0cb9b400d9 100644
--- a/.github/scripts/darling-upgrade-shapes.ps1
+++ b/.github/scripts/darling-upgrade-shapes.ps1
@@ -15,8 +15,8 @@
     U1  current release in C:\Program Files\PerformanceMonitorDarling, service stopped.      must PASS
         The folder also holds a hand-named darling.json.bak-before-edit, service-owned after the
         base install and its service start (#5649); it must not refuse either script.
-    U2  as U1, service logon changed to a non-default local account and started once on it.  must PASS
-    U3  as U1, service deleted. install-darling.ps1 must PASS; upgrade-darling.ps1 has no
+    U2  as U1 without the backup file, service logon changed to a non-default local account and started once on it.  must PASS
+    U3  as U1 without the backup file, service deleted. install-darling.ps1 must PASS; upgrade-darling.ps1 has no
         service to upgrade and must say so, without listing the product's own files.
     U4  pre-3.9 release in C:\PerformanceMonitorDarling. install-darling.ps1 must REFUSE, list only the
         folder's own write entry, and print the move steps.
diff --git a/.github/workflows/darling-upgrade-shapes.yml b/.github/workflows/darling-upgrade-shapes.yml
index f5531ff9a1..2fb1120af3 100644
--- a/.github/workflows/darling-upgrade-shapes.yml
+++ b/.github/workflows/darling-upgrade-shapes.yml
@@ -6,8 +6,8 @@ name: Darling upgrade shapes
 # under test:
 #   U1  the current release in C:\Program Files\PerformanceMonitorDarling                  must pass
 #       (with a hand-named darling.json.bak-before-edit in the folder, service-owned, #5649)
-#   U2  as U1, the service logon changed to a non-default local account and run once on it must pass
-#   U3  as U1, the service deleted: install passes, upgrade says there is no service        see the leg's expectation
+#   U2  as U1 without the backup file, the service logon changed to a non-default local account and run once on it must pass
+#   U3  as U1 without the backup file, the service deleted: install passes, upgrade says there is no service        see the leg's expectation
 #   U4  a release before 3.9 in C:\PerformanceMonitorDarling: install refuses, names only
 #       the folder's own write entry, and prints the move steps
 # U1, U2 and U3 run both install-darling.ps1 and upgrade-darling.ps1 as separate legs; U4 runs install-darling.ps1.
diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index 5d4d0e07f7..bd216d5bf9 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -1557,7 +1557,15 @@ public void TheBackupPrefix_HasOneDefinitionPerLanguage_AndTheSameText()
         Assert.Contains("$leaf.StartsWith((Get-DarlingServiceWrittenNames).BackupPrefix, [StringComparison]::OrdinalIgnoreCase)", upgrade, StringComparison.Ordinal);
 
         Assert.Equal("darling.json.bak-", PerformanceMonitor.Darling.Service.DarlingConfigBackup.Prefix);
-        Assert.Equal("darling.json.bak-*", PerformanceMonitor.Darling.Service.DarlingConfigBackup.Glob);
+        Assert.Equal(".bak-*", PerformanceMonitor.Darling.Service.DarlingConfigBackup.GlobSuffix);
+        /* The writer builds the name through the class, and the names it writes are byte-for-byte what they were. */
+        Assert.Equal("/x/darling.json.bak-20260101-120000", PerformanceMonitor.Darling.Service.DarlingConfigBackup.BackupPath("/x/darling.json", "20260101-120000"));
+        Assert.Equal("/x/darling.json.bak-20260101-120000-2", PerformanceMonitor.Darling.Service.DarlingConfigBackup.BackupPath("/x/darling.json", "20260101-120000", 2));
+        Assert.Equal("/x/prod.json.bak-20260101-120000-13", PerformanceMonitor.Darling.Service.DarlingConfigBackup.BackupPath("/x/prod.json", "20260101-120000", 13));
+        Assert.Contains("DarlingConfigBackup.BackupPath(resolvedPath, stamp)", cli, StringComparison.Ordinal);
+        Assert.Contains("DarlingConfigBackup.BackupPath(resolvedPath, stamp, suffix)", cli, StringComparison.Ordinal);
+        Assert.DoesNotContain("\".bak-\"", cli, StringComparison.Ordinal);
+        Assert.DoesNotContain(".bak-{", cli, StringComparison.Ordinal);
         Assert.Contains("DarlingConfigBackup.ListBackups(directory, Path.GetFileName(configPath))", worker, StringComparison.Ordinal);
         Assert.DoesNotContain("\".bak-*\"", worker, StringComparison.Ordinal);
         Assert.Contains("ConfigBackupFiles(Path.GetDirectoryName(resolvedConfig), Path.GetFileName(resolvedConfig))", cli, StringComparison.Ordinal);
@@ -1780,6 +1788,146 @@ public void TheInstallTreeLock_ReportsAHardLinkedBackupWithAnUntrustedGrant_AndL
         Assert.Contains(answers, a => a.EndsWith(".txt.usersExplicit=True", StringComparison.Ordinal));
     }
 
+    /// <summary>
+    /// #5649: the lock never writes to a file that has more than one name, wherever it is in the tree. The earlier arm
+    /// above covers the root files the service writes; any other hard-linked file (a shipped file, one in a sub-folder, a
+    /// backup-named file that is not directly in the root) reached the reset, which puts the tree's inherited entries on the
+    /// file's other name as well. The probe gives four hard-linked files an explicit BUILTIN\Users write grant behind
+    /// their own protection and a plain file the same, runs the lock, and requires the linked ones to keep the grant, to
+    /// be named in what the lock returns and to leave their other name's grant as it was, while the plain file is still
+    /// reset. Run under Windows PowerShell 5.1 and PowerShell 7, with both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheInstallTreeLock_ReportsAnyHardLinkedFileWithAnUntrustedGrant_AndLeavesItsPermissionsAlone(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine(ExtractFunction(script, "Lock-DarlingInstallTree"));
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $stamp = [guid]::NewGuid().ToString('N').Substring(0, 8)
+            $root = Join-Path ([IO.Path]::GetPathRoot([Environment]::SystemDirectory)) ('pm5649-lockall-' + $stamp)
+            $outsideDir = Join-Path $env:TEMP ('pm5649-lockall-outside-' + $stamp)
+            try {
+                New-Item -ItemType Directory -Path $root -Force | Out-Null
+                New-Item -ItemType Directory -Path "$root\sub" -Force | Out-Null
+                New-Item -ItemType Directory -Path $outsideDir -Force | Out-Null
+                Set-Content -LiteralPath "$root\darling.json" -Value '{}'
+                Set-Content -LiteralPath "$root\plain.dll" -Value 'x'
+                $wk = [System.Security.Principal.WellKnownSidType]
+                $sidType = [System.Security.Principal.SecurityIdentifier]
+                $users = New-Object System.Security.Principal.SecurityIdentifier($wk::BuiltinUsersSid, $null)
+                $linked = [ordered]@{ 'vendor.dll' = "$root\vendor.dll"; 'inner.dll' = "$root\sub\inner.dll"; 'darling.json.bak-deep' = "$root\sub\darling.json.bak-deep"; 'darling.json.bak-hand' = "$root\sub\darling.json.bak-hand" }
+                foreach ($leaf in $linked.Keys) {
+                    $other = Join-Path $outsideDir $leaf
+                    Set-Content -LiteralPath $other -Value 'x'
+                    New-Item -ItemType HardLink -Path $linked[$leaf] -Value $other | Out-Null
+                    # icacls, not Set-Acl: Set-Acl on a hard link needs SeSecurityPrivilege here, which a developer shell lacks.
+                    $null = & icacls.exe $linked[$leaf] /inheritance:d /grant "*$($users.Value):(M)" 2>&1
+                    'setup.' + $leaf + '.sharedAce=' + (@((Get-Acl -LiteralPath $other).GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+                }
+                $null = & icacls.exe "$root\plain.dll" /inheritance:d /grant "*$($users.Value):(M)" 2>&1
+                'setup.plain.ace=' + (@((Get-Acl -LiteralPath "$root\plain.dll").GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+
+                $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                foreach ($leaf in $linked.Keys) {
+                    foreach ($path in @($linked[$leaf], (Join-Path $outsideDir $leaf))) {
+                        $acl = Get-Acl -LiteralPath $path
+                        $leaf + '.' + ($path.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) + '.usersExplicit=' + (@($acl.GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+                    }
+                }
+                'plain.usersExplicit=' + (@((Get-Acl -LiteralPath "$root\plain.dll").GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+            }
+            finally {
+                foreach ($dir in @($root, $outsideDir)) {
+                    if (Test-Path -LiteralPath $dir) {
+                        & icacls.exe $dir /reset /T /C /Q 2>&1 | Out-Null
+                        Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
+                    }
+                }
+            }
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        AssertProbeSetupTook(answers);
+        foreach (var leaf in new[] { "vendor.dll", "inner.dll", "darling.json.bak-deep", "darling.json.bak-hand" })
+        {
+            Assert.Contains(answers, a => a.StartsWith("open:\\", StringComparison.Ordinal) && a.Contains(leaf + " (a hard link: this file has more than one name", StringComparison.Ordinal));
+            Assert.Contains($"{leaf}.True.usersExplicit=True", answers);
+            Assert.Contains($"{leaf}.False.usersExplicit=True", answers);
+        }
+
+        Assert.Contains("plain.usersExplicit=False", answers);
+    }
+
+    /// <summary>
+    /// #5649: every name after the leading double backslash of a UNC path is checked for a name Windows folds into another,
+    /// the server and share names included (the check used to start at the share). Run under Windows PowerShell 5.1 and
+    /// PowerShell 7, with both scripts. A name with a trailing dot or space anywhere on the way gives $null; a normal path
+    /// below a UNC root still gives its names.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheSegmentsBelowRoot_ChecksEveryNameOfAUncPath_TheServerAndShareToo(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        AppendPathHelpers(probe, script);
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            function Show([string]$label, $value) { $label + '=[' + $(if ($null -eq $value) { '$null' } else { @($value) -join '|' }) + ']' }
+            Show 'unc.normal' (Get-DarlingSegmentsBelowRoot '\\srv\share\Install' '\\srv\share\Install\sub\darling.json')
+            Show 'unc.serverDot' (Get-DarlingSegmentsBelowRoot '\\srv.\share\Install' '\\srv.\share\Install\darling.json')
+            Show 'unc.serverSpace' (Get-DarlingSegmentsBelowRoot '\\srv \share\Install' '\\srv \share\Install\darling.json')
+            Show 'unc.shareDot' (Get-DarlingSegmentsBelowRoot '\\srv\share.\Install' '\\srv\share.\Install\darling.json')
+            Show 'unc.emptyServer' (Get-DarlingSegmentsBelowRoot '\\srv\share\Install' '\\\share\Install\darling.json')
+            Show 'unc.leafDot' (Get-DarlingSegmentsBelowRoot '\\srv\share\Install' '\\srv\share\Install\darling.json.')
+            Show 'unc.dotDot' (Get-DarlingSegmentsBelowRoot '\\srv\share\Install' '\\srv\share\Install\..\darling.json')
+            Show 'drive.normal' (Get-DarlingSegmentsBelowRoot 'C:\Install' 'C:\Install\sub\darling.json')
+            Show 'drive.dot' (Get-DarlingSegmentsBelowRoot 'C:\Install' 'C:\Install.\darling.json')
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        Assert.Contains("unc.normal=[sub|darling.json]", answers);
+        Assert.Contains("unc.serverDot=[$null]", answers);
+        Assert.Contains("unc.serverSpace=[$null]", answers);
+        Assert.Contains("unc.shareDot=[$null]", answers);
+        Assert.Contains("unc.emptyServer=[$null]", answers);
+        Assert.Contains("unc.leafDot=[$null]", answers);
+        Assert.Contains("unc.dotDot=[$null]", answers);
+        Assert.Contains("drive.normal=[sub|darling.json]", answers);
+        Assert.Contains("drive.dot=[$null]", answers);
+    }
+
     private static void AppendStepFunctions(StringBuilder probe, string? script = null)
     {
         foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-PathIsAtOrUnder", "Test-DarlingSamePath", "Get-DarlingConfiguredPathsUnder", "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice", "Get-DarlingRefusalAdvice" })
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
index 352b8afa29..3ad1e35ced 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingCliCommands.cs
@@ -3216,10 +3216,10 @@ internal static async Task<bool> WriteWithBackupAsync(
         try
         {
             var stamp = DateTime.Now.ToString("yyyyMMdd-HHmmss", CultureInfo.InvariantCulture);
-            var backupPath = resolvedPath + ".bak-" + stamp;
+            var backupPath = DarlingConfigBackup.BackupPath(resolvedPath, stamp);
             for (var suffix = 2; File.Exists(backupPath); suffix++)
             {
-                backupPath = $"{resolvedPath}.bak-{stamp}-{suffix}";
+                backupPath = DarlingConfigBackup.BackupPath(resolvedPath, stamp, suffix);
             }
 
             File.Copy(resolvedPath, backupPath, overwrite: false);
@@ -3255,8 +3255,9 @@ internal static async Task<bool> WriteWithBackupAsync(
     /// <b>LocalMachine</b> blobs with an entropy constant that ships in an open-source repo, so READ access
     /// IS the secret. The live config grants INTERACTIVE read because things genuinely read it as the
     /// interactive operator — the Viewer (<c>ViewerSettings.TryLoad</c>) and the CLI verbs. <b>Nothing reads
-    /// a backup.</b> The only references to the <c>.bak-</c> name in non-test code are the two lines above
-    /// that CONSTRUCT it, and restoring one is a hand operation that already requires elevation, because
+    /// a backup.</b> The service builds the name in <c>DarlingConfigBackup.BackupPath</c> and lists
+    /// it in <c>DarlingConfigBackup.ListBackups</c> (the start-up hardening and the CLI permission check); it only ever
+    /// hardens a backup, never reads one. Restoring one is a hand operation that already requires elevation, because
     /// writing <c>darling.json</c> does — INTERACTIVE only ever had Read here, never Write. So the grant
     /// bought nothing and cost a second copy of every secret, readable by any interactively-logged-on user.</para>
     ///
diff --git a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
index 0a52cedbca..cb55522595 100644
--- a/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
+++ b/Darling/PerformanceMonitor.Darling.Service/DarlingConfigBackup.cs
@@ -34,8 +34,13 @@ internal static class DarlingConfigBackup
     /// <summary>The start of every backup name of the default <c>darling.json</c>.</summary>
     public const string Prefix = "darling.json" + Tail;
 
-    /// <summary>The search pattern for every backup of the default <c>darling.json</c>.</summary>
-    public const string Glob = Prefix + "*";
+    /// <summary>The name the config verbs give the backup they write beside <paramref name="configPath"/>: the config path, then
+    /// <see cref="Tail"/>, then <paramref name="stamp"/>, and <c>-N</c> after the stamp when <paramref name="suffix"/> is 2 or more
+    /// (the stamp has one-second resolution, so a second edit in the same second takes the next free number).
+    /// The writer builds its name here, so <see cref="Tail"/> is the one spelling for both the name that is written and the
+    /// names <see cref="IsBackupName"/> reads back.</summary>
+    public static string BackupPath(string configPath, string stamp, int suffix = 1) =>
+        suffix <= 1 ? configPath + Tail + stamp : configPath + Tail + stamp + "-" + suffix.ToString(System.Globalization.CultureInfo.InvariantCulture);
 
     /// <summary>Whether <paramref name="fileName"/> is a backup of the config file named <paramref name="configFileName"/>:
     /// it starts with that name plus <see cref="Tail"/>, compared ordinally and ignoring case, as Windows compares names.
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index bf47f7b861..dd1288f2e2 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -449,7 +449,7 @@ public static class DarlingNativePaths
 function Get-DarlingSegmentsBelowRoot([string]$root, [string]$candidate) {
     if ([string]::IsNullOrWhiteSpace($candidate) -or $candidate -notmatch '^([A-Za-z]:[\\/]|\\\\)') { return $null }
     $given = @($candidate.TrimEnd('\', '/') -split '[\\/]')
-    $first = if ($candidate.StartsWith('\\')) { 3 } else { 1 }
+    $first = if ($candidate.StartsWith('\\')) { 2 } else { 1 }
     for ($i = $first; $i -lt $given.Count; $i++) {
         $name = $given[$i]
         if ($name -eq '' -or $name -eq '.' -or $name -eq '..' -or $name.EndsWith('.') -or $name.EndsWith(' ')) { return $null }
@@ -482,7 +482,9 @@ function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly)
 # Windows would fold into another ('pg-runtime.', a '..' step) matches nothing. The install root itself and every
 # other file or folder in it are not on the list. $item is what the caller's own walk listed for $candidate: a
 # listed file is trusted by name only when it is a plain file (not a folder, a link or a file with more than one
-# name), and with no item a root file is not trusted, so the answer never rests on a second look at the disk.
+# name), and with no item a root file is not trusted. Whether it is a file or a folder and whether it is a link are read from
+# $item, the item the walk listed; the number of names is read live, because Get-DarlingFileNameCount opens the file (for
+# attributes only) each time it is called.
 function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @(), $item = $null) {
     $segments = Get-DarlingSegmentsBelowRoot $root $candidate
     if ($null -eq $segments) { return $false }
@@ -1208,6 +1210,13 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         $explicit = @($acl.GetAccessRules($true, $false, $sidType) | Where-Object {
             $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $trustedHere -notcontains $_.IdentityReference })
         if ($explicit.Count -gt 0) {
+            # Any file that has more than one name (a hard link anywhere in the tree, not only a backup), or whose names cannot be
+            # counted, is reported and left as it is: /remove:g and /reset write to the one set of permissions all its names share,
+            # and a reset would put the tree's inherited entries on the other name (#5649). Directories have one name.
+            if ((-not $target.PSIsContainer) -and (Get-DarlingFileNameCount $path) -ne 1) {
+                $open += "$path (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one; its permissions were not changed)"
+                continue
+            }
             if ($isSecretFile) {
                 foreach ($rule in $explicit) { $null = & icacls.exe $path /remove:g "*$($rule.IdentityReference.Value)" /L /Q 2>&1 }
             }
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 6827ad9327..0f84cf3fc2 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -501,7 +501,7 @@ public static class DarlingNativePaths
 function Get-DarlingSegmentsBelowRoot([string]$root, [string]$candidate) {
     if ([string]::IsNullOrWhiteSpace($candidate) -or $candidate -notmatch '^([A-Za-z]:[\\/]|\\\\)') { return $null }
     $given = @($candidate.TrimEnd('\', '/') -split '[\\/]')
-    $first = if ($candidate.StartsWith('\\')) { 3 } else { 1 }
+    $first = if ($candidate.StartsWith('\\')) { 2 } else { 1 }
     for ($i = $first; $i -lt $given.Count; $i++) {
         $name = $given[$i]
         if ($name -eq '' -or $name -eq '.' -or $name -eq '..' -or $name.EndsWith('.') -or $name.EndsWith(' ')) { return $null }
@@ -534,7 +534,9 @@ function Get-DarlingServiceWrittenRootFiles([string]$root, [switch]$BackupsOnly)
 # Windows would fold into another ('pg-runtime.', a '..' step) matches nothing. The install root itself and every
 # other file or folder in it are not on the list. $item is what the caller's own walk listed for $candidate: a
 # listed file is trusted by name only when it is a plain file (not a folder, a link or a file with more than one
-# name), and with no item a root file is not trusted, so the answer never rests on a second look at the disk.
+# name), and with no item a root file is not trusted. Whether it is a file or a folder and whether it is a link are read from
+# $item, the item the walk listed; the number of names is read live, because Get-DarlingFileNameCount opens the file (for
+# attributes only) each time it is called.
 function Test-DarlingServiceWrittenPath([string]$root, [string]$candidate, [string[]]$extraDirectories = @(), $item = $null) {
     $segments = Get-DarlingSegmentsBelowRoot $root $candidate
     if ($null -eq $segments) { return $false }
@@ -1046,6 +1048,13 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         $explicit = @($acl.GetAccessRules($true, $false, $sidType) | Where-Object {
             $_.AccessControlType -eq $allow -and (([int64]$_.FileSystemRights) -band $write) -ne 0 -and $trustedHere -notcontains $_.IdentityReference })
         if ($explicit.Count -gt 0) {
+            # Any file that has more than one name (a hard link anywhere in the tree, not only a backup), or whose names cannot be
+            # counted, is reported and left as it is: /remove:g and /reset write to the one set of permissions all its names share,
+            # and a reset would put the tree's inherited entries on the other name (#5649). Directories have one name.
+            if ((-not $target.PSIsContainer) -and (Get-DarlingFileNameCount $path) -ne 1) {
+                $open += "$path (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one; its permissions were not changed)"
+                continue
+            }
             if ($isSecretFile) {
                 foreach ($rule in $explicit) { $null = & icacls.exe $path /remove:g "*$($rule.IdentityReference.Value)" /L /Q 2>&1 }
             }

From 677cebe44497f6cbf1d12b431a7b38632c03c29d Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:41:51 -0400
Subject: [PATCH 10/14] CHANGELOG: the lock leaves any file with more than one
 name alone (#5649)

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da31505e15..4c5649ebcd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,7 +28,7 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 ### Fixed
 
 - **The Darling viewer's Manage Servers window now shows the service's version, once, instead of its own version on every server row** ([#5668]) - the grid's Installed Version column filled every row with the viewer's own version, so an old viewer talking to a newer service read as up to date. The service now writes its product version and process start time to the store when it starts (a new table, `config.service_version`, one row per service host, store schema V174, created by the first start after the upgrade), and Manage Servers shows it once above the grid beside the viewer's own version: one line per service host when more than one service writes to the store. A store with no row yet, or without the table, reads `unknown (older than 3.11)`. A write that fails at start logs a warning, and the service tries it again on every sweep until it succeeds. The Installed Version column is removed. The line is display only and shows no warning.
-- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
+- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. The lock also leaves any other file with more than one name alone, wherever it is in the install tree, and lists it as still open instead of resetting its permissions, because that would change the permissions of the file's other name too. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
 
 ## [3.10.0] - 2026-10-09
 

From 3bf715a85bfe3b7a544119cfd318fae07951fcfc Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 15:09:37 -0400
Subject: [PATCH 11/14] Install scripts: the lock sets the owner one object at
 a time and leaves a file with more than one name alone (#5677)

---
 .../DarlingInstallLocationTests.cs            | 201 +++++++++++++++++-
 Darling/tools/install-darling.ps1             | 151 ++++++++++++-
 Darling/tools/upgrade-darling.ps1             | 151 ++++++++++++-
 3 files changed, 495 insertions(+), 8 deletions(-)

diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index bd216d5bf9..f7a2d847c9 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -596,7 +596,7 @@ public void ThePreLockWritableExtractionCheck_ShipsIdenticallyInTheInstallAndUpg
         foreach (var name in new[]
         {
             "Get-DarlingServiceSids", "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName",
-            "Get-DarlingFileNameCount", "Get-DarlingCanonicalPath", "Get-DarlingSegmentsBelowRoot", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
+            "Get-DarlingFileNameCount", "Initialize-DarlingNativeOwner", "Get-DarlingCanonicalPath", "Get-DarlingSegmentsBelowRoot", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Test-PathIsAtOrUnder", "Get-DarlingConfiguredPathsUnder",
             "Get-DarlingNewFolderPhrase", "Get-DarlingExistingInstallSteps", "Get-DarlingFreshFolderAdvice",
             "Get-DarlingRefusalAdvice", "Get-DarlingBackupFileFindingNames", "Get-DarlingBackupFileAdvice", "Test-DarlingSamePath", "Get-DarlingInstallRootFromService",
         })
@@ -1876,6 +1876,203 @@ public void TheInstallTreeLock_ReportsAnyHardLinkedFileWithAnUntrustedGrant_AndL
         Assert.Contains("plain.usersExplicit=False", answers);
     }
 
+    /// <summary>
+    /// #5677: the lock's owner step sets the owner one object at a time, in process, on the handle the name count is read from,
+    /// and never with one <c>icacls /setowner ... /T</c> over the tree (which would change the owner of every name of a file
+    /// that has more than one). Pins the shape in both scripts: the lock calls <c>SetOwner</c>, has no <c>/T</c> owner call,
+    /// turns the two privileges on and off around the step, skips what the owner step listed, and the native class opens the
+    /// object itself (not what a link points to), reads the count from that handle and sets the owner on it.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1")]
+    [InlineData("upgrade-darling.ps1")]
+    public void TheInstallTreeLockOwnerStep_SetsTheOwnerPerObjectOnTheCountedHandle_AndHasNoSubtreeCall(string scriptName)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
+        Assert.DoesNotContain("/setowner \"*$($adminsSid.Value)\"", lockText, StringComparison.Ordinal);
+        Assert.DoesNotContain("$adminsSid.Value)\" /T", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::SetPrivileges($true)", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::SetPrivileges($false)", lockText, StringComparison.Ordinal);
+        Assert.Contains("if ($skipped.ContainsKey($target.FullName)) { continue }", lockText, StringComparison.Ordinal);
+        /* A link is acted on itself and never walked into. */
+        Assert.Contains("($attributes -band 0x400) -eq 0", lockText, StringComparison.Ordinal);
+
+        var native = ExtractFunction(script, "Initialize-DarlingNativeOwner");
+        Assert.Contains("CreateFileW(path, 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero)", native, StringComparison.Ordinal);
+        Assert.Contains("if (information.NumberOfLinks != 1) { return 1; }", native, StringComparison.Ordinal);
+        Assert.Contains("SetSecurityInfo(handle, 1, 1, ownerSid, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero)", native, StringComparison.Ordinal);
+        Assert.DoesNotContain("/setowner /T", script.Replace("\r\n", "\n"), StringComparison.Ordinal);
+        Assert.DoesNotContain("/setowner *S-1-5-32-544 /T", script, StringComparison.Ordinal);
+    }
+
+    /// <summary>
+    /// #5677: the owner step on its own, run on a small tree with the current account's SID as the owner to set (so it works
+    /// without elevation). A plain file and a folder take the new owner and report 0; a file with a second name outside the tree
+    /// reports 1 with a count of 2, keeps its owner under both names; a junction reports its attributes and is not followed
+    /// (the folder it points to keeps its owner). Run under Windows PowerShell 5.1 and PowerShell 7, with both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheNativeOwnerStep_SetsAPlainFileAndAFolder_AndLeavesAHardLinkedFileAlone(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Initialize-DarlingNativeOwner"));
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $stamp = [guid]::NewGuid().ToString('N').Substring(0, 8)
+            $root = Join-Path $env:TEMP ('pm5677-native-' + $stamp)
+            $outsideDir = Join-Path $env:TEMP ('pm5677-native-outside-' + $stamp)
+            $sidType = [System.Security.Principal.SecurityIdentifier]
+            $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+            $mine = New-Object byte[] $me.BinaryLength
+            $me.GetBinaryForm($mine, 0)
+            function Get-OwnerValue([string]$p) { return (Get-Acl -LiteralPath $p).GetOwner($sidType).Value }
+            try {
+                New-Item -ItemType Directory -Path "$root\sub", "$root\target", $outsideDir -Force | Out-Null
+                Set-Content -LiteralPath "$root\plain.txt" -Value 'x'
+                Set-Content -LiteralPath "$outsideDir\linked.txt" -Value 'x'
+                New-Item -ItemType HardLink -Path "$root\sub\linked.txt" -Value "$outsideDir\linked.txt" | Out-Null
+                & cmd.exe /c mklink /J "$root\junction" "$root\target" | Out-Null
+                'setup.linkMade=' + ((Get-Item -LiteralPath "$root\sub\linked.txt").LinkType -eq 'HardLink')
+                'setup.junctionMade=' + ((((Get-Item -LiteralPath "$root\junction" -Force).Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0))
+                $linkedBefore = Get-OwnerValue "$outsideDir\linked.txt"
+                $targetBefore = Get-OwnerValue "$root\target"
+                Initialize-DarlingNativeOwner
+                foreach ($name in @('plain.txt', 'sub', 'sub\linked.txt', 'junction')) {
+                    $detail = 0
+                    $attributes = [uint32]0
+                    $result = [DarlingNativeOwner]::SetOwner("$root\$name", $mine, [ref]$detail, [ref]$attributes)
+                    'result.' + $name + '=' + $result + ',' + $detail + ',' + (($attributes -band 0x400) -ne 0)
+                }
+                'owner.plain=' + ((Get-OwnerValue "$root\plain.txt") -eq $me.Value)
+                'owner.folder=' + ((Get-OwnerValue "$root\sub") -eq $me.Value)
+                'owner.linkedInside=' + ((Get-OwnerValue "$root\sub\linked.txt") -eq $linkedBefore)
+                'owner.linkedOutside=' + ((Get-OwnerValue "$outsideDir\linked.txt") -eq $linkedBefore)
+                'owner.junctionTarget=' + ((Get-OwnerValue "$root\target") -eq $targetBefore)
+            }
+            finally {
+                foreach ($dir in @($root, $outsideDir)) {
+                    if (Test-Path -LiteralPath $dir) {
+                        if (Test-Path -LiteralPath "$dir\junction") { & cmd.exe /c rmdir "$dir\junction" | Out-Null }
+                        Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
+                    }
+                }
+            }
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("result.plain.txt=0,1,False", answers);
+        Assert.Contains("result.sub=0,1,False", answers);
+        Assert.Contains("result.sub\\linked.txt=1,2,False", answers);
+        Assert.Contains("result.junction=0,1,True", answers);
+        Assert.Contains("owner.plain=True", answers);
+        Assert.Contains("owner.folder=True", answers);
+        Assert.Contains("owner.linkedInside=True", answers);
+        Assert.Contains("owner.linkedOutside=True", answers);
+        Assert.Contains("owner.junctionTarget=True", answers);
+    }
+
+    /// <summary>
+    /// #5677: the lock's owner step leaves a file with more than one name alone. The tree holds a plain file, a folder, a file
+    /// inside it and a file whose second name is outside the tree, all owned by the current account first. After the lock (the
+    /// service account is one that needs no account lookup) the linked file keeps that owner under BOTH names and is listed as
+    /// open exactly once, while the plain file, the folder and the root are owned by Administrators. Setting an owner of
+    /// Administrators needs an elevated token (CI's runner is one); a filtered token reports the root as needing an elevated
+    /// session and changes no owner. Run under Windows PowerShell 5.1 and PowerShell 7, with both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheInstallTreeLock_GivesAdministratorsTheOwnerOfPlainFilesAndFolders_AndLeavesAHardLinkedFilesOwner(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine(ExtractFunction(script, "Lock-DarlingInstallTree"));
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $stamp = [guid]::NewGuid().ToString('N').Substring(0, 8)
+            $root = Join-Path $env:TEMP ('pm5677-owner-' + $stamp)
+            $outsideDir = Join-Path $env:TEMP ('pm5677-owner-outside-' + $stamp)
+            $sidType = [System.Security.Principal.SecurityIdentifier]
+            $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+            $admins = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinAdministratorsSid, $null)
+            function Get-OwnerValue([string]$p) { return (Get-Acl -LiteralPath $p).GetOwner($sidType).Value }
+            try {
+                New-Item -ItemType Directory -Path "$root\sub", $outsideDir -Force | Out-Null
+                Set-Content -LiteralPath "$root\plain.dll" -Value 'x'
+                Set-Content -LiteralPath "$root\sub\inner.dll" -Value 'x'
+                Set-Content -LiteralPath "$outsideDir\linked.dll" -Value 'x'
+                New-Item -ItemType HardLink -Path "$root\sub\linked.dll" -Value "$outsideDir\linked.dll" | Out-Null
+                foreach ($p in @("$root\sub", "$root\plain.dll", "$root\sub\inner.dll", "$root\sub\linked.dll")) { $null = & icacls.exe $p /setowner "*$($me.Value)" /L /Q 2>&1 }
+                'setup.ownersSet=' + ((@("$root\sub", "$root\plain.dll", "$root\sub\inner.dll", "$root\sub\linked.dll", "$outsideDir\linked.dll") | Where-Object { (Get-OwnerValue $_) -ne $me.Value }).Count -eq 0)
+                'elevated=' + ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+
+                $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                'linkedListed=' + @($open | Where-Object { $_ -like '*linked.dll*' }).Count
+                'owner.linkedInside=' + ((Get-OwnerValue "$root\sub\linked.dll") -eq $me.Value)
+                'owner.linkedOutside=' + ((Get-OwnerValue "$outsideDir\linked.dll") -eq $me.Value)
+                foreach ($leaf in @('', '\sub', '\plain.dll', '\sub\inner.dll')) { 'adminOwner[' + $leaf + ']=' + ((Get-OwnerValue ($root + $leaf)) -eq $admins.Value) }
+            }
+            finally {
+                foreach ($dir in @($root, $outsideDir)) {
+                    if (Test-Path -LiteralPath $dir) {
+                        & icacls.exe $dir /reset /T /C /Q 2>&1 | Out-Null
+                        Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
+                    }
+                }
+            }
+            """);
+
+        List<string>? answers;
+        if (shell == "pwsh")
+        {
+            answers = RunPowerShell7(probe.ToString());
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); return; }
+        }
+        else
+        {
+            answers = RunWindowsPowerShell(probe.ToString());
+        }
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("owner.linkedInside=True", answers);
+        Assert.Contains("owner.linkedOutside=True", answers);
+        if (answers.Contains("elevated=True"))
+        {
+            Assert.Contains("linkedListed=1", answers);
+            Assert.Contains(answers, a => a.StartsWith("open:\\sub\\linked.dll (a hard link: this file has more than one name", StringComparison.Ordinal));
+            foreach (var leaf in new[] { "", "\\sub", "\\plain.dll", "\\sub\\inner.dll" })
+            {
+                Assert.Contains($"adminOwner[{leaf}]=True", answers);
+            }
+        }
+        else
+        {
+            Assert.Contains(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("run elevated", StringComparison.Ordinal));
+        }
+    }
+
     /// <summary>
     /// #5649: every name after the leading double backslash of a UNC path is checked for a name Windows folds into another,
     /// the server and share names included (the check used to start at the share). Run under Windows PowerShell 5.1 and
@@ -3373,7 +3570,7 @@ private static void AppendPathHelpers(StringBuilder probe, string script)
     /// (the lock and the pre-lock walk both read them).</summary>
     private static void AppendServiceWrittenList(StringBuilder probe, string script)
     {
-        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Get-DarlingFileNameCount", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Get-DarlingCanonicalPath", "Get-DarlingSegmentsBelowRoot" })
+        foreach (var name in new[] { "Get-DarlingServiceWrittenNames", "Test-DarlingServiceWrittenFileName", "Test-PathIsAtOrUnder", "Get-DarlingFileNameCount", "Initialize-DarlingNativeOwner", "Test-DarlingServiceWrittenPath", "Get-DarlingServiceWrittenRootFiles", "Get-DarlingCanonicalPath", "Get-DarlingSegmentsBelowRoot" })
         {
             probe.AppendLine(ExtractFunction(script, name));
         }
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index dd1288f2e2..e5294fa656 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -382,6 +382,115 @@ public static class DarlingNativeFileNames
     catch { return -1 }
 }
 
+# Sets the owner of one file or folder to the SID given, only when it has exactly one name, on the SAME handle the name count
+# is read from (#5677): the handle is opened for attributes and WRITE_OWNER with every sharing mode allowed and the object
+# itself rather than anything it points to (FILE_FLAG_OPEN_REPARSE_POINT, the way Get-DarlingFileNameCount opens), the link
+# count is read from it, and only a count of exactly 1 is followed by SetSecurityInfo on that handle for the owner alone. A
+# file with more than one name (a hard link) shares one owner under every name, so one whose count is not 1 is never touched.
+# SetOwner returns 0 when the owner was set; 1 when the count is not 1 (detail is the count); 2 when it could not be opened and
+# 3 when the count could not be read (detail is the Win32 error); 4 when the owner could not be set (detail is the error).
+# attributes is the object's attribute bits as read from the handle, so a caller can tell a folder from a link without
+# opening it again. SetPrivileges turns SeTakeOwnershipPrivilege and SeRestorePrivilege on or off for this process's token (the
+# two icacls /setowner turns on for itself) and returns false if either could not be changed. Kept byte-identical in
+# install-darling.ps1 and upgrade-darling.ps1.
+function Initialize-DarlingNativeOwner {
+    if ('DarlingNativeOwner' -as [type]) { return }
+    Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class DarlingNativeOwner
+{
+    [StructLayout(LayoutKind.Sequential, Pack = 4)]
+    private struct TokenPrivilege { public uint Count; public long Luid; public uint Attributes; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FileTimeValue { public uint Low; public uint High; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleFileInformation
+    {
+        public uint FileAttributes;
+        public FileTimeValue CreationTime;
+        public FileTimeValue LastAccessTime;
+        public FileTimeValue LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint SetSecurityInfo(SafeFileHandle handle, int objectType, uint securityInfo, byte[] owner, IntPtr group, IntPtr dacl, IntPtr sacl);
+
+    [DllImport("kernel32.dll")]
+    private static extern IntPtr GetCurrentProcess();
+
+    [DllImport("kernel32.dll")]
+    private static extern bool CloseHandle(IntPtr handle);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern bool OpenProcessToken(IntPtr process, uint access, out IntPtr token);
+
+    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool LookupPrivilegeValueW(string systemName, string name, out long luid);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern bool AdjustTokenPrivileges(IntPtr token, bool disableAll, ref TokenPrivilege state, uint length, IntPtr previous, IntPtr returned);
+
+    // TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; SE_PRIVILEGE_ENABLED is 2. A privilege the token does not hold is reported as an error.
+    public static bool SetPrivileges(bool on)
+    {
+        IntPtr token;
+        if (!OpenProcessToken(GetCurrentProcess(), 0x28, out token)) { return false; }
+        try
+        {
+            bool all = true;
+            foreach (string name in new string[] { "SeTakeOwnershipPrivilege", "SeRestorePrivilege" })
+            {
+                TokenPrivilege state = new TokenPrivilege();
+                state.Count = 1;
+                state.Attributes = on ? 2u : 0u;
+                if (!LookupPrivilegeValueW(null, name, out state.Luid)) { all = false; continue; }
+                if (!AdjustTokenPrivileges(token, false, ref state, 0, IntPtr.Zero, IntPtr.Zero) || Marshal.GetLastWin32Error() != 0) { all = false; }
+            }
+            return all;
+        }
+        finally { CloseHandle(token); }
+    }
+
+    // FILE_READ_ATTRIBUTES | WRITE_OWNER; share read, write and delete; OPEN_EXISTING;
+    // FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS. SE_FILE_OBJECT is 1, OWNER_SECURITY_INFORMATION is 1.
+    public static int SetOwner(string path, byte[] ownerSid, out int detail, out uint attributes)
+    {
+        detail = 0;
+        attributes = 0;
+        using (SafeFileHandle handle = CreateFileW(path, 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
+        {
+            if (handle.IsInvalid) { detail = Marshal.GetLastWin32Error(); return 2; }
+            ByHandleFileInformation information;
+            if (!GetFileInformationByHandle(handle, out information)) { detail = Marshal.GetLastWin32Error(); return 3; }
+            attributes = information.FileAttributes;
+            detail = (int)information.NumberOfLinks;
+            if (information.NumberOfLinks != 1) { return 1; }
+            uint error = SetSecurityInfo(handle, 1, 1, ownerSid, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
+            if (error != 0) { detail = (int)error; return 4; }
+            return 0;
+        }
+    }
+}
+'@
+}
+
 # One long, absolute spelling of a path, to compare paths by (#5649): GetFullPath's answer (separators, '.' and '..'
 # resolved) with every 8.3 short name in it (C:\PROGRA~1, C:\Users\RUNNER~1) spelled out and the trailing backslash dropped
 # (a drive root keeps it). GetFullPath alone is not enough: it spells short names out differently from one runtime to the
@@ -1142,8 +1251,43 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         $output = & icacls.exe $root @step 2>&1
         if ($LASTEXITCODE -ne 0) { return @("$root (icacls $($step -join ' ') failed: $($output -join ' '))") }
     }
-    $output = & icacls.exe $root /setowner "*$($adminsSid.Value)" /T /C /L /Q 2>&1
-    if ($LASTEXITCODE -ne 0) { $open += "$root (could not make Administrators the owner of everything below it; run elevated: $($output | Select-Object -First 1))" }
+    # The owner step (#5677). The tree is walked here and the owner of each object is set one at a time, in this process, on the
+    # handle its name count is read from (see Initialize-DarlingNativeOwner): a file whose count is not exactly 1, or cannot be
+    # read, keeps its owner, because a file with more than one name (a hard link) has one owner that every name shares, some of
+    # them outside this folder. Such a file, and one whose owner cannot be set, is listed as open here and put in $skipped so the
+    # walk below leaves it out (it is listed once). The walk does not follow a junction or link: the link itself is the object,
+    # and nothing below it is listed. The two privileges are turned on for the step and off again after it; without them (not
+    # elevated) the step is not run and the root is reported.
+    $skipped = @{}
+    $ownerBytes = New-Object byte[] $adminsSid.BinaryLength
+    $adminsSid.GetBinaryForm($ownerBytes, 0)
+    $ownerReady = $false
+    try {
+        Initialize-DarlingNativeOwner
+        $ownerReady = [DarlingNativeOwner]::SetPrivileges($true)
+        if (-not $ownerReady) { $open += "$root (could not make Administrators the owner of everything below it; run elevated)" }
+        else {
+            $pending = New-Object System.Collections.Stack
+            $pending.Push($root)
+            while ($pending.Count -gt 0) {
+                $ownPath = [string]$pending.Pop()
+                $detail = 0
+                $attributes = [uint32]0
+                $result = [DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)
+                if ($result -ne 0) {
+                    $skipped[$ownPath] = $true
+                    if ($result -eq 4) { $open += "$ownPath (its owner could not be set, error $detail)" }
+                    else { $open += "$ownPath (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one; its owner and permissions were not changed)" }
+                }
+                if (($attributes -band 0x10) -ne 0 -and ($attributes -band 0x400) -eq 0) {
+                    try { foreach ($kid in @(Get-ChildItem -LiteralPath $ownPath -Force -ErrorAction Stop)) { $pending.Push($kid.FullName) } }
+                    catch { $open += "$ownPath (its contents could not be listed, so nothing below it was given an owner: $($_.Exception.Message))" }
+                }
+            }
+        }
+    }
+    catch { $open += "$root (could not make Administrators the owner of everything below it: $($_.Exception.Message))" }
+    finally { try { $null = [DarlingNativeOwner]::SetPrivileges($false) } catch { } }
     $serviceWritePaths = @()
     if ($serviceSid) {
         foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root)) {
@@ -1182,6 +1326,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if (-not (Get-Acl -LiteralPath $root).AreAccessRulesProtected) { $open += "$root (still inherits from its parent)" }
     $targets = @(Get-Item -LiteralPath $root -Force) + @(Get-ChildItem -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue)
     foreach ($target in $targets) {
+        if ($skipped.ContainsKey($target.FullName)) { continue }
         $path = Get-DarlingCanonicalPath $target.FullName
         if ($null -eq $path) { $open += "$($target.FullName) (its full path could not be worked out)"; continue }
         if ($path.TrimEnd('\') -ine $root.TrimEnd('\') -and ($target.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
@@ -1271,7 +1416,7 @@ function Invoke-InstallTreeLock([string]$account, [switch]$StopOnOpen) {
     Write-Host "    icacls `"$root`" /inheritance:d" -ForegroundColor Yellow
     Write-Host "    icacls `"$root`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4" -ForegroundColor Yellow
     Write-Host "    icacls `"$root`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"$grantTo`:(OI)(CI)RX`"" -ForegroundColor Yellow
-    Write-Host "    icacls `"$root`" /setowner *S-1-5-32-544 /T /C /L" -ForegroundColor Yellow
+    Write-Host '    (then run this script again from an elevated prompt: it makes Administrators the owner of each path itself, and lists a file with more than one name)' -ForegroundColor Yellow
     Write-Host '  A path listed as owned by an account, or BELOW the folder, needs its own fix: icacls "<path>" /setowner' -ForegroundColor Red
     Write-Host '  *S-1-5-32-544 /L, then icacls "<path>" /reset /T /C. Remove any junction or link it names.' -ForegroundColor Red
     Write-Host ''
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 0f84cf3fc2..4a55dbf13c 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -434,6 +434,115 @@ public static class DarlingNativeFileNames
     catch { return -1 }
 }
 
+# Sets the owner of one file or folder to the SID given, only when it has exactly one name, on the SAME handle the name count
+# is read from (#5677): the handle is opened for attributes and WRITE_OWNER with every sharing mode allowed and the object
+# itself rather than anything it points to (FILE_FLAG_OPEN_REPARSE_POINT, the way Get-DarlingFileNameCount opens), the link
+# count is read from it, and only a count of exactly 1 is followed by SetSecurityInfo on that handle for the owner alone. A
+# file with more than one name (a hard link) shares one owner under every name, so one whose count is not 1 is never touched.
+# SetOwner returns 0 when the owner was set; 1 when the count is not 1 (detail is the count); 2 when it could not be opened and
+# 3 when the count could not be read (detail is the Win32 error); 4 when the owner could not be set (detail is the error).
+# attributes is the object's attribute bits as read from the handle, so a caller can tell a folder from a link without
+# opening it again. SetPrivileges turns SeTakeOwnershipPrivilege and SeRestorePrivilege on or off for this process's token (the
+# two icacls /setowner turns on for itself) and returns false if either could not be changed. Kept byte-identical in
+# install-darling.ps1 and upgrade-darling.ps1.
+function Initialize-DarlingNativeOwner {
+    if ('DarlingNativeOwner' -as [type]) { return }
+    Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public static class DarlingNativeOwner
+{
+    [StructLayout(LayoutKind.Sequential, Pack = 4)]
+    private struct TokenPrivilege { public uint Count; public long Luid; public uint Attributes; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FileTimeValue { public uint Low; public uint High; }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleFileInformation
+    {
+        public uint FileAttributes;
+        public FileTimeValue CreationTime;
+        public FileTimeValue LastAccessTime;
+        public FileTimeValue LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint SetSecurityInfo(SafeFileHandle handle, int objectType, uint securityInfo, byte[] owner, IntPtr group, IntPtr dacl, IntPtr sacl);
+
+    [DllImport("kernel32.dll")]
+    private static extern IntPtr GetCurrentProcess();
+
+    [DllImport("kernel32.dll")]
+    private static extern bool CloseHandle(IntPtr handle);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern bool OpenProcessToken(IntPtr process, uint access, out IntPtr token);
+
+    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern bool LookupPrivilegeValueW(string systemName, string name, out long luid);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern bool AdjustTokenPrivileges(IntPtr token, bool disableAll, ref TokenPrivilege state, uint length, IntPtr previous, IntPtr returned);
+
+    // TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; SE_PRIVILEGE_ENABLED is 2. A privilege the token does not hold is reported as an error.
+    public static bool SetPrivileges(bool on)
+    {
+        IntPtr token;
+        if (!OpenProcessToken(GetCurrentProcess(), 0x28, out token)) { return false; }
+        try
+        {
+            bool all = true;
+            foreach (string name in new string[] { "SeTakeOwnershipPrivilege", "SeRestorePrivilege" })
+            {
+                TokenPrivilege state = new TokenPrivilege();
+                state.Count = 1;
+                state.Attributes = on ? 2u : 0u;
+                if (!LookupPrivilegeValueW(null, name, out state.Luid)) { all = false; continue; }
+                if (!AdjustTokenPrivileges(token, false, ref state, 0, IntPtr.Zero, IntPtr.Zero) || Marshal.GetLastWin32Error() != 0) { all = false; }
+            }
+            return all;
+        }
+        finally { CloseHandle(token); }
+    }
+
+    // FILE_READ_ATTRIBUTES | WRITE_OWNER; share read, write and delete; OPEN_EXISTING;
+    // FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS. SE_FILE_OBJECT is 1, OWNER_SECURITY_INFORMATION is 1.
+    public static int SetOwner(string path, byte[] ownerSid, out int detail, out uint attributes)
+    {
+        detail = 0;
+        attributes = 0;
+        using (SafeFileHandle handle = CreateFileW(path, 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
+        {
+            if (handle.IsInvalid) { detail = Marshal.GetLastWin32Error(); return 2; }
+            ByHandleFileInformation information;
+            if (!GetFileInformationByHandle(handle, out information)) { detail = Marshal.GetLastWin32Error(); return 3; }
+            attributes = information.FileAttributes;
+            detail = (int)information.NumberOfLinks;
+            if (information.NumberOfLinks != 1) { return 1; }
+            uint error = SetSecurityInfo(handle, 1, 1, ownerSid, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
+            if (error != 0) { detail = (int)error; return 4; }
+            return 0;
+        }
+    }
+}
+'@
+}
+
 # One long, absolute spelling of a path, to compare paths by (#5649): GetFullPath's answer (separators, '.' and '..'
 # resolved) with every 8.3 short name in it (C:\PROGRA~1, C:\Users\RUNNER~1) spelled out and the trailing backslash dropped
 # (a drive root keeps it). GetFullPath alone is not enough: it spells short names out differently from one runtime to the
@@ -980,8 +1089,43 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         $output = & icacls.exe $root @step 2>&1
         if ($LASTEXITCODE -ne 0) { return @("$root (icacls $($step -join ' ') failed: $($output -join ' '))") }
     }
-    $output = & icacls.exe $root /setowner "*$($adminsSid.Value)" /T /C /L /Q 2>&1
-    if ($LASTEXITCODE -ne 0) { $open += "$root (could not make Administrators the owner of everything below it; run elevated: $($output | Select-Object -First 1))" }
+    # The owner step (#5677). The tree is walked here and the owner of each object is set one at a time, in this process, on the
+    # handle its name count is read from (see Initialize-DarlingNativeOwner): a file whose count is not exactly 1, or cannot be
+    # read, keeps its owner, because a file with more than one name (a hard link) has one owner that every name shares, some of
+    # them outside this folder. Such a file, and one whose owner cannot be set, is listed as open here and put in $skipped so the
+    # walk below leaves it out (it is listed once). The walk does not follow a junction or link: the link itself is the object,
+    # and nothing below it is listed. The two privileges are turned on for the step and off again after it; without them (not
+    # elevated) the step is not run and the root is reported.
+    $skipped = @{}
+    $ownerBytes = New-Object byte[] $adminsSid.BinaryLength
+    $adminsSid.GetBinaryForm($ownerBytes, 0)
+    $ownerReady = $false
+    try {
+        Initialize-DarlingNativeOwner
+        $ownerReady = [DarlingNativeOwner]::SetPrivileges($true)
+        if (-not $ownerReady) { $open += "$root (could not make Administrators the owner of everything below it; run elevated)" }
+        else {
+            $pending = New-Object System.Collections.Stack
+            $pending.Push($root)
+            while ($pending.Count -gt 0) {
+                $ownPath = [string]$pending.Pop()
+                $detail = 0
+                $attributes = [uint32]0
+                $result = [DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)
+                if ($result -ne 0) {
+                    $skipped[$ownPath] = $true
+                    if ($result -eq 4) { $open += "$ownPath (its owner could not be set, error $detail)" }
+                    else { $open += "$ownPath (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one; its owner and permissions were not changed)" }
+                }
+                if (($attributes -band 0x10) -ne 0 -and ($attributes -band 0x400) -eq 0) {
+                    try { foreach ($kid in @(Get-ChildItem -LiteralPath $ownPath -Force -ErrorAction Stop)) { $pending.Push($kid.FullName) } }
+                    catch { $open += "$ownPath (its contents could not be listed, so nothing below it was given an owner: $($_.Exception.Message))" }
+                }
+            }
+        }
+    }
+    catch { $open += "$root (could not make Administrators the owner of everything below it: $($_.Exception.Message))" }
+    finally { try { $null = [DarlingNativeOwner]::SetPrivileges($false) } catch { } }
     $serviceWritePaths = @()
     if ($serviceSid) {
         foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root)) {
@@ -1020,6 +1164,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if (-not (Get-Acl -LiteralPath $root).AreAccessRulesProtected) { $open += "$root (still inherits from its parent)" }
     $targets = @(Get-Item -LiteralPath $root -Force) + @(Get-ChildItem -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue)
     foreach ($target in $targets) {
+        if ($skipped.ContainsKey($target.FullName)) { continue }
         $path = Get-DarlingCanonicalPath $target.FullName
         if ($null -eq $path) { $open += "$($target.FullName) (its full path could not be worked out)"; continue }
         if ($path.TrimEnd('\') -ine $root.TrimEnd('\') -and ($target.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
@@ -2415,7 +2560,7 @@ function Invoke-UpgradeTreeLock([string]$when) {
         Good "Install folder locked ${when}: only SYSTEM and Administrators can change what runs from $InstallRoot; $logonAccount can write only its runtime folders."
         return
     }
-    Warn ("Ordinary users can still change {0} path(s) in the install folder, and the service runs from there as {1}, so anyone who can replace a binary can run code as that account. First: {2}. Fix from an elevated prompt with: icacls `"{3}`" /inheritance:d, then icacls `"{3}`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4, then icacls `"{3}`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"{1}:(OI)(CI)RX`", then icacls `"{3}`" /setowner *S-1-5-32-544 /T /C /L. A path listed as owned by an account, or below the folder, needs its own fix: icacls `"<path>`" /setowner *S-1-5-32-544 /L, then icacls `"<path>`" /reset /T /C. Remove any junction or link it names." -f $open.Count, $logonAccount, (($open | Select-Object -First 5) -join ', '), $InstallRoot)
+    Warn ("Ordinary users can still change {0} path(s) in the install folder, and the service runs from there as {1}, so anyone who can replace a binary can run code as that account. First: {2}. Fix from an elevated prompt with: icacls `"{3}`" /inheritance:d, then icacls `"{3}`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4, then icacls `"{3}`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"{1}:(OI)(CI)RX`", then run this script again from an elevated prompt (it makes Administrators the owner of each path itself, and lists a file with more than one name). A path listed as owned by an account, or below the folder, needs its own fix: icacls `"<path>`" /setowner *S-1-5-32-544 /L, then icacls `"<path>`" /reset /T /C. Remove any junction or link it names." -f $open.Count, $logonAccount, (($open | Select-Object -First 5) -join ', '), $InstallRoot)
 }
 
 Invoke-UpgradeTreeLock 'before the backup and the copy'

From 838c7a98b676cd4681c169bf1bd42e03d9dc1d27 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 15:17:37 -0400
Subject: [PATCH 12/14] CHANGELOG and upgrade comment: the lock leaves a file
 with more than one name its owner (#5677)

---
 CHANGELOG.md                      | 2 +-
 Darling/tools/upgrade-darling.ps1 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c5649ebcd..9a08790769 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,7 +28,7 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 ### Fixed
 
 - **The Darling viewer's Manage Servers window now shows the service's version, once, instead of its own version on every server row** ([#5668]) - the grid's Installed Version column filled every row with the viewer's own version, so an old viewer talking to a newer service read as up to date. The service now writes its product version and process start time to the store when it starts (a new table, `config.service_version`, one row per service host, store schema V174, created by the first start after the upgrade), and Manage Servers shows it once above the grid beside the viewer's own version: one line per service host when more than one service writes to the store. A store with no row yet, or without the table, reads `unknown (older than 3.11)`. A write that fails at start logs a warning, and the service tries it again on every sweep until it succeeds. The Installed Version column is removed. The line is display only and shows no warning.
-- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. The lock also leaves any other file with more than one name alone, wherever it is in the install tree, and lists it as still open instead of resetting its permissions, because that would change the permissions of the file's other name too. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
+- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. The lock also leaves any other file with more than one name alone, wherever it is in the install tree, and lists it as still open instead of changing its owner or resetting its permissions, because either would change the file's other name too. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
 
 ## [3.10.0] - 2026-10-09
 
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index 4a55dbf13c..dad9b6d936 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -2194,7 +2194,7 @@ function Protect-DarlingStagingFolder([string]$path) {
 
 # A fresh, empty, protected folder under the machine temp directory for H1's zip staging copy. Elevation is
 # assumed (this script requires it), so setting Administrators as owner needs no extra privilege - the same
-# fact Lock-DarlingInstallTree's own /setowner already relies on.
+# fact Lock-DarlingInstallTree's own owner step already relies on.
 function New-DarlingProtectedStagingFolder {
     $path = Join-Path $env:TEMP ('darling-upgrade-staging-' + [guid]::NewGuid().ToString('N'))
     New-Item -ItemType Directory -Path $path -Force | Out-Null

From 094a5714f96c672ed23711cb59b1ec5c30bde5d5 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:00:06 -0400
Subject: [PATCH 13/14] The lock's owner step stays inside the install folder
 and reports each outcome in its own words (#5677)

The owner step opens the root once without sharing delete or rename, reads its real path from that handle, and sets an owner only on an object whose own real path is the root or below it. A name ending in a dot or a space is listed and not acted on, extended-length paths are used so Windows does not fold such a name, the skip set compares names exactly, and an object whose owner could not be set is still fixed and checked by the permission walk. The step uses SeTakeOwnershipPrivilege and SeBackupPrivilege and puts the previous state back. The printed advice names the privileges, gives a hard-linked path its own line and drops the tree-wide reset.
---
 CHANGELOG.md                                  |   2 +-
 .../DarlingInstallLocationTests.cs            | 430 +++++++++++++++++-
 Darling/tools/install-darling.ps1             | 216 +++++++--
 Darling/tools/upgrade-darling.ps1             | 216 +++++++--
 4 files changed, 766 insertions(+), 98 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 615c2f3b3b..0c3270702f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,7 @@ Releases before 3.0.0 are not archived: those entries carry no prose to move.
 
 - **The Darling viewer's Manage Servers window now shows the service's version, once, instead of its own version on every server row** ([#5668]) - the grid's Installed Version column filled every row with the viewer's own version, so an old viewer talking to a newer service read as up to date. The service now writes its product version and process start time to the store when it starts (a new table, `config.service_version`, one row per service host, store schema V174, created by the first start after the upgrade), and Manage Servers shows it once above the grid beside the viewer's own version: one line per service host when more than one service writes to the store. A store with no row yet, or without the table, reads `unknown (older than 3.11)`. A write that fails at start logs a warning, and the service tries it again on every sweep until it succeeds. The Installed Version column is removed. The line is display only and shows no warning.
 - **A collector that recovered no longer stays at WARNING** ([#5665]) - the 7-day failure rate gave WARNING above 20% errors and a later success never cleared it, so a new target with 2 errors in its first 8 runs stayed WARNING until its tenth run. The rate now counts only once the window holds 10 runs, or fewer when a collector runs so rarely that a full 7-day window holds fewer (7 for a daily collector, so a daily collector that failed 6 days of 7 and succeeded today stays WARNING), and a collector whose newest 3 runs in a row succeeded is HEALTHY with a note "recovered: the last 3 runs succeeded; last failure <time> UTC" in the Note column of Lite and the Darling viewer, in a Recovered column of the Darling web dashboard, and as note_summary (recovered_note on the shorter rows) in the MCP get_collection_health read. The note appears only on a row the recovery rule moved to HEALTHY, never on one that another rule bands WARNING or STOPPED. A collector that alternates between failing and succeeding stays WARNING, a collector with few runs whose latest run failed stays WARNING, and the staleness, abandon-rate and lost-databases rules are unchanged. The fleet overview card and the Darling viewer's Overview cards agree: when a collector's failure rate alone would band it WARNING, the roll-up reads that collector's newest 3 runs in one follow-up statement (none when no collector needs it), so a recovered collector reads HEALTHY on the fleet card as on its own tab and an alternating one stays WARNING.
-- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. The lock also leaves any other file with more than one name alone, wherever it is in the install tree, and lists it as still open instead of changing its owner or resetting its permissions, because either would change the file's other name too. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
+- **The upgrade and installer accept a hand-named `darling.json.bak-*` backup in the install folder** ([#5659]) - In 3.10.0 the check that runs before the lock refused an install folder holding a backup such as `darling.json.bak-before-edit`, because the service owns every `darling.json.bak-*` file after a start and the check trusted it only on the stamped names the CLI writes. The refusal said the folder was writable by ordinary users and told the operator to move the whole install. The check now trusts the service account on every file in the install root whose name starts with `darling.json.bak-`, the same prefix the hardening uses, and nowhere else. Any other grantee on such a file, the service on another file, a folder with that name, a link, a file with more than one name (a hard link) and a file below the root still refuse. A backup-named hard link is now reported as a finding of its own, and the lock and the install pass leave it alone, so it never gets the service as owner. The lock also leaves any other file with more than one name alone, wherever it is in the install tree, and lists it as still open instead of changing its owner or resetting its permissions, because either would change the file's other name too. That owner step opens the install folder once and changes an owner only on an object whose real path it confirms is inside that folder, lists a name that ends in a dot or a space instead of acting on it, and turns on SeTakeOwnershipPrivilege and SeBackupPrivilege for itself and puts them back as it found them. When a refusal lists only backup files, it now starts with a note that names them, says they can hold the secrets that were in darling.json and can be moved to a folder only Administrators can read, and then gives the usual advice unchanged. The check, the install-time hardening, the upgrade's manifest guard, the service sweep and the CLI check now match one prefix per language by ordinal, case-insensitive name, so a Turkish-locale host reads the names the way the service does. The CLI permission check now lists the backups of the config it was given (`prod.json.bak-*` for `prod.json`) instead of always `darling.json.bak-*`. A name that ends in a dot or a space is not treated as a backup by the check, the install-time hardening, the service sweep or the CLI check, because Windows resolves such a name to a different file.
 
 ## [3.10.0] - 2026-10-09
 
diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index f7a2d847c9..df61976b1c 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -1880,7 +1880,7 @@ public void TheInstallTreeLock_ReportsAnyHardLinkedFileWithAnUntrustedGrant_AndL
     /// #5677: the lock's owner step sets the owner one object at a time, in process, on the handle the name count is read from,
     /// and never with one <c>icacls /setowner ... /T</c> over the tree (which would change the owner of every name of a file
     /// that has more than one). Pins the shape in both scripts: the lock calls <c>SetOwner</c>, has no <c>/T</c> owner call,
-    /// turns the two privileges on and off around the step, skips what the owner step listed, and the native class opens the
+    /// turns the two privileges on and puts them back around the step, holds the root open for the walk, skips what the owner step listed, and the native class opens the
     /// object itself (not what a link points to), reads the count from that handle and sets the owner on it.
     /// </summary>
     [Theory]
@@ -1893,14 +1893,24 @@ public void TheInstallTreeLockOwnerStep_SetsTheOwnerPerObjectOnTheCountedHandle_
         Assert.DoesNotContain("/setowner \"*$($adminsSid.Value)\"", lockText, StringComparison.Ordinal);
         Assert.DoesNotContain("$adminsSid.Value)\" /T", lockText, StringComparison.Ordinal);
         Assert.Contains("[DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)", lockText, StringComparison.Ordinal);
-        Assert.Contains("[DarlingNativeOwner]::SetPrivileges($true)", lockText, StringComparison.Ordinal);
-        Assert.Contains("[DarlingNativeOwner]::SetPrivileges($false)", lockText, StringComparison.Ordinal);
-        Assert.Contains("if ($skipped.ContainsKey($target.FullName)) { continue }", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::EnablePrivileges()", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::RestorePrivileges()", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::OpenRoot($root, [ref]$rootError)", lockText, StringComparison.Ordinal);
+        Assert.Contains("[DarlingNativeOwner]::CloseRoot()", lockText, StringComparison.Ordinal);
+        Assert.Contains("$skipped = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)", lockText, StringComparison.Ordinal);
+        Assert.Contains("if ($skipped.Contains($target.FullName)) { continue }", lockText, StringComparison.Ordinal);
+        Assert.DoesNotContain("ContainsKey", lockText, StringComparison.Ordinal);
+        Assert.DoesNotContain("SeRestorePrivilege", lockText, StringComparison.Ordinal);
         /* A link is acted on itself and never walked into. */
         Assert.Contains("($attributes -band 0x400) -eq 0", lockText, StringComparison.Ordinal);
 
         var native = ExtractFunction(script, "Initialize-DarlingNativeOwner");
-        Assert.Contains("CreateFileW(path, 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero)", native, StringComparison.Ordinal);
+        Assert.Contains("CreateFileW(ExtendedPath(path), 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero)", native, StringComparison.Ordinal);
+        Assert.Contains("CreateFileW(ExtendedPath(root), 0x80, 3, IntPtr.Zero, 3, 0x02000000, IntPtr.Zero)", native, StringComparison.Ordinal);
+        Assert.Contains("GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 1)", native, StringComparison.Ordinal);
+        Assert.Contains("\"SeTakeOwnershipPrivilege\", \"SeBackupPrivilege\"", native, StringComparison.Ordinal);
+        Assert.DoesNotContain("SeRestorePrivilege", native, StringComparison.Ordinal);
+        Assert.Contains("string.Equals(real, root, StringComparison.Ordinal)", native, StringComparison.Ordinal);
         Assert.Contains("if (information.NumberOfLinks != 1) { return 1; }", native, StringComparison.Ordinal);
         Assert.Contains("SetSecurityInfo(handle, 1, 1, ownerSid, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero)", native, StringComparison.Ordinal);
         Assert.DoesNotContain("/setowner /T", script.Replace("\r\n", "\n"), StringComparison.Ordinal);
@@ -1944,6 +1954,8 @@ public void TheNativeOwnerStep_SetsAPlainFileAndAFolder_AndLeavesAHardLinkedFile
                 $linkedBefore = Get-OwnerValue "$outsideDir\linked.txt"
                 $targetBefore = Get-OwnerValue "$root\target"
                 Initialize-DarlingNativeOwner
+                $rootError = 0
+                'setup.rootOpened=' + [DarlingNativeOwner]::OpenRoot($root, [ref]$rootError)
                 foreach ($name in @('plain.txt', 'sub', 'sub\linked.txt', 'junction')) {
                     $detail = 0
                     $attributes = [uint32]0
@@ -1957,6 +1969,7 @@ public void TheNativeOwnerStep_SetsAPlainFileAndAFolder_AndLeavesAHardLinkedFile
                 'owner.junctionTarget=' + ((Get-OwnerValue "$root\target") -eq $targetBefore)
             }
             finally {
+                try { [DarlingNativeOwner]::CloseRoot() } catch { }
                 foreach ($dir in @($root, $outsideDir)) {
                     if (Test-Path -LiteralPath $dir) {
                         if (Test-Path -LiteralPath "$dir\junction") { & cmd.exe /c rmdir "$dir\junction" | Out-Null }
@@ -2061,7 +2074,7 @@ public void TheInstallTreeLock_GivesAdministratorsTheOwnerOfPlainFilesAndFolders
         if (answers.Contains("elevated=True"))
         {
             Assert.Contains("linkedListed=1", answers);
-            Assert.Contains(answers, a => a.StartsWith("open:\\sub\\linked.dll (a hard link: this file has more than one name", StringComparison.Ordinal));
+            Assert.Contains(answers, a => a.StartsWith("open:\\sub\\linked.dll (has 2 names (a hard link)", StringComparison.Ordinal));
             foreach (var leaf in new[] { "", "\\sub", "\\plain.dll", "\\sub\\inner.dll" })
             {
                 Assert.Contains($"adminOwner[{leaf}]=True", answers);
@@ -2069,10 +2082,413 @@ public void TheInstallTreeLock_GivesAdministratorsTheOwnerOfPlainFilesAndFolders
         }
         else
         {
-            Assert.Contains(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("run elevated", StringComparison.Ordinal));
+            Assert.Contains(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv)", StringComparison.Ordinal));
         }
     }
 
+    /// <summary>Runs a probe in the shell a theory case names, skipping the case when PowerShell 7 is not installed.</summary>
+    private static List<string> RunProbeInShell(string shell, string probe)
+    {
+        if (shell == "pwsh")
+        {
+            var answers = RunPowerShell7(probe);
+            if (answers is null) { Assert.Skip("PowerShell 7 (pwsh) is not installed on this machine."); }
+            return answers ?? new List<string>();
+        }
+
+        return RunWindowsPowerShell(probe);
+    }
+
+    /// <summary>
+    /// The shared head of the #5677 owner-step probes: the temp folders, the current account's SID as the owner to set (so the
+    /// native step works without elevation), an owner reader and a cleaner that closes the root handle, removes any junction
+    /// first and deletes through a <c>\\?\</c> path so a name ending in a dot goes too.
+    /// </summary>
+    private const string OwnerStepProbeHead = """
+        $ErrorActionPreference = 'Stop'
+        $stamp = [guid]::NewGuid().ToString('N').Substring(0, 8)
+        $root = Join-Path $env:TEMP ('pm5677-step-' + $stamp)
+        $outsideDir = Join-Path $env:TEMP ('pm5677-step-outside-' + $stamp)
+        $sidType = [System.Security.Principal.SecurityIdentifier]
+        $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+        $mine = New-Object byte[] $me.BinaryLength
+        $me.GetBinaryForm($mine, 0)
+        $elevated = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+        'elevated=' + $elevated
+        function Get-OwnerValue([string]$p) { return (Get-Acl -LiteralPath $p).GetOwner($sidType).Value }
+        function Remove-ProbeDirectory([string]$dir) {
+            if (-not (Test-Path -LiteralPath $dir)) { return }
+            foreach ($link in @(Get-ChildItem -LiteralPath $dir -Force -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Attributes -band [IO.FileAttributes]::ReparsePoint })) { & cmd.exe /c rmdir "$($link.FullName)" | Out-Null }
+            & icacls.exe $dir /reset /T /C /L /Q 2>&1 | Out-Null
+            & cmd.exe /c rd /s /q "\\?\$dir" 2>&1 | Out-Null
+        }
+        function Get-StepResult([string]$p) {
+            $detail = 0
+            $attributes = [uint32]0
+            $result = [DarlingNativeOwner]::SetOwner($p, $mine, [ref]$detail, [ref]$attributes)
+            return "$result,$detail"
+        }
+        """;
+
+    /// <summary>
+    /// #5677: the owner step changes only what is inside the root it was given. The root is opened once and its real path read
+    /// from that handle; an object reached through a name in the tree whose real path is elsewhere (here a folder replaced by a
+    /// junction to an outside folder that holds a file) gets result 5 and its owner is not set, so nothing needs to be timed.
+    /// The junction itself is a name in the tree and gets its own owner (result 0). A path that no longer exists is result 2 (error 2), an owner the system refuses is result 4, and with no root open every
+    /// path is result 5. The root itself, a plain file, a folder and a differently-cased spelling of the root are inside.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheNativeOwnerStep_ChangesNothingOutsideTheRoot_AndGivesEveryOtherOutcomeItsOwnResult(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Initialize-DarlingNativeOwner"));
+        probe.AppendLine(OwnerStepProbeHead);
+        probe.AppendLine("""
+            try {
+                New-Item -ItemType Directory -Path "$root\sub", $outsideDir -Force | Out-Null
+                Set-Content -LiteralPath "$root\plain.txt" -Value 'x'
+                Set-Content -LiteralPath "$outsideDir\file" -Value 'x'
+                & cmd.exe /c mklink /J "$root\a" $outsideDir | Out-Null
+                'setup.junctionMade=' + ((((Get-Item -LiteralPath "$root\a" -Force).Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0))
+                'setup.reachable=' + (Test-Path -LiteralPath "$root\a\file")
+                $outsideBefore = Get-OwnerValue "$outsideDir\file"
+                Initialize-DarlingNativeOwner
+                $rootError = 0
+                'setup.rootOpened=' + [DarlingNativeOwner]::OpenRoot($root, [ref]$rootError)
+                'result.throughJunction=' + (Get-StepResult "$root\a\file")
+                'result.junctionItself=' + (Get-StepResult "$root\a")
+                'result.plain=' + (Get-StepResult "$root\plain.txt")
+                'result.folder=' + (Get-StepResult "$root\sub")
+                'result.root=' + (Get-StepResult $root)
+                'result.deleted=' + (Get-StepResult "$root\sub\deleted.txt")
+                'result.upperCaseSpelling=' + (Get-StepResult ($root.ToUpperInvariant() + '\sub'))
+                $detail = 0
+                $attributes = [uint32]0
+                $refused = [DarlingNativeOwner]::SetOwner("$root\plain.txt", [byte[]](1, 2, 0, 0, 0, 0, 0, 5, 99, 134, 1, 0, 17, 34, 51, 68), [ref]$detail, [ref]$attributes)
+                'result.refusedOwner=' + $refused + ',' + ($detail -ne 0)
+                'owner.outsideFile=' + ((Get-OwnerValue "$outsideDir\file") -eq $outsideBefore)
+                [DarlingNativeOwner]::CloseRoot()
+                'result.noRootOpen=' + (Get-StepResult "$root\plain.txt")
+            }
+            finally {
+                try { [DarlingNativeOwner]::CloseRoot() } catch { }
+                foreach ($dir in @($root, $outsideDir)) { Remove-ProbeDirectory $dir }
+            }
+            """);
+
+        var answers = RunProbeInShell(shell, probe.ToString());
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("result.throughJunction=5,0", answers);
+        Assert.Contains("result.junctionItself=0,1", answers);
+        Assert.Contains("result.plain=0,1", answers);
+        Assert.Contains("result.folder=0,1", answers);
+        Assert.Contains("result.root=0,1", answers);
+        Assert.Contains("result.deleted=2,2", answers);
+        Assert.Contains("result.upperCaseSpelling=0,1", answers);
+        Assert.Contains("result.refusedOwner=4,True", answers);
+        Assert.Contains("owner.outsideFile=True", answers);
+        Assert.Contains("result.noRootOpen=5,0", answers);
+    }
+
+    /// <summary>
+    /// #5677: a name that ends in a dot is opened as that name. The folder holds <c>dn.</c> (one name) and <c>dn</c> (a hard link
+    /// with a second name outside), both made through <c>\\?\</c> paths. Without the extended spelling Windows drops the dot and
+    /// the step would open <c>dn</c> twice.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheNativeOwnerStep_OpensANameEndingInADot_AsThatName_NotAsTheNameWithoutIt(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Initialize-DarlingNativeOwner"));
+        probe.AppendLine(OwnerStepProbeHead);
+        probe.AppendLine("""
+            try {
+                New-Item -ItemType Directory -Path $root, $outsideDir -Force | Out-Null
+                Set-Content -LiteralPath "$outsideDir\twin" -Value 'x'
+                [IO.File]::WriteAllText("\\?\$root\dn.", 'x')
+                New-Item -ItemType HardLink -Path "\\?\$root\dn" -Value "$outsideDir\twin" | Out-Null
+                'setup.bothNamesListed=' + ((((@(Get-ChildItem -LiteralPath $root -Force | ForEach-Object Name) | Sort-Object) -join '|')) -eq 'dn|dn.')
+                Initialize-DarlingNativeOwner
+                $rootError = 0
+                'setup.rootOpened=' + [DarlingNativeOwner]::OpenRoot($root, [ref]$rootError)
+                'result.dotName=' + (Get-StepResult "$root\dn.")
+                'result.plainName=' + (Get-StepResult "$root\dn")
+            }
+            finally {
+                try { [DarlingNativeOwner]::CloseRoot() } catch { }
+                foreach ($dir in @($root, $outsideDir)) { Remove-ProbeDirectory $dir }
+            }
+            """);
+
+        var answers = RunProbeInShell(shell, probe.ToString());
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("result.dotName=0,1", answers);
+        Assert.Contains("result.plainName=1,2", answers);
+    }
+
+    /// <summary>
+    /// #5677: the privileges the step turns on are put back as they were. The two lines <c>whoami /priv</c> prints for them are
+    /// the same before the step and after it (an elevated token has both and has them off; one that is not elevated has neither,
+    /// so turning them on reports false and nothing changes).
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheNativeOwnerStep_PutsThePrivilegesBackAsItFoundThem(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        probe.AppendLine(ExtractFunction(script, "Initialize-DarlingNativeOwner"));
+        probe.AppendLine("""
+            $ErrorActionPreference = 'Stop'
+            $elevated = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+            'elevated=' + $elevated
+            function Get-PrivilegeLines { return (@(& "$env:SystemRoot\System32\whoami.exe" /priv) | Where-Object { $_ -match 'SeTakeOwnershipPrivilege|SeBackupPrivilege' } | ForEach-Object { ($_ -replace '\s+', ' ').Trim() }) -join ';' }
+            Initialize-DarlingNativeOwner
+            $before = Get-PrivilegeLines
+            $enabled = [DarlingNativeOwner]::EnablePrivileges()
+            $during = Get-PrivilegeLines
+            $restored = [DarlingNativeOwner]::RestorePrivileges()
+            $after = Get-PrivilegeLines
+            'enabled=' + $enabled
+            'duringDiffers=' + ($during -ne $before)
+            'restored=' + $restored
+            'afterSameAsBefore=' + ($after -eq $before)
+            $again = [DarlingNativeOwner]::EnablePrivileges()
+            $null = [DarlingNativeOwner]::RestorePrivileges()
+            'twiceSameAsBefore=' + ((Get-PrivilegeLines) -eq $before)
+            """);
+
+        var answers = RunProbeInShell(shell, probe.ToString());
+
+        Assert.Contains("restored=True", answers);
+        Assert.Contains("afterSameAsBefore=True", answers);
+        Assert.Contains("twiceSameAsBefore=True", answers);
+        if (answers.Contains("elevated=True"))
+        {
+            Assert.Contains("enabled=True", answers);
+            Assert.Contains("duringDiffers=True", answers);
+        }
+        else
+        {
+            Assert.Contains("enabled=False", answers);
+        }
+    }
+
+    /// <summary>
+    /// #5677: the lock over a tree that holds a folder replaced by a junction to an outside folder, and a name ending in a dot
+    /// next to the same name without it. The outside file keeps its owner, the junction is listed, and the dot name is listed as
+    /// open and not given an owner (the plain name beside it is). The owner step needs the two privileges, which only an
+    /// elevated token holds; a token without them lists the root with the privilege names and changes no owner.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheInstallTreeLock_LeavesAnOutsideFolderAlone_AndListsANameEndingInADotWithoutActingOnIt(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine(ExtractFunction(script, "Lock-DarlingInstallTree"));
+        probe.AppendLine(OwnerStepProbeHead);
+        probe.AppendLine("""
+            $admins = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinAdministratorsSid, $null)
+            try {
+                New-Item -ItemType Directory -Path $root, $outsideDir -Force | Out-Null
+                Set-Content -LiteralPath "$outsideDir\file" -Value 'x'
+                Set-Content -LiteralPath "$root\dn" -Value 'x'
+                [IO.File]::WriteAllText("\\?\$root\dn.", 'x')
+                & cmd.exe /c mklink /J "$root\a" $outsideDir | Out-Null
+                foreach ($p in @("$outsideDir\file", "$root\dn")) { $null = & icacls.exe $p /setowner "*$($me.Value)" /L /Q 2>&1 }
+                'setup.bothNamesListed=' + ((((@(Get-ChildItem -LiteralPath $root -Force | ForEach-Object Name) | Sort-Object) -join '|')) -eq 'a|dn|dn.')
+                'setup.ownersSet=' + ((Get-OwnerValue "$outsideDir\file") -eq $me.Value)
+                $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                'owner.outsideFile=' + ((Get-OwnerValue "$outsideDir\file") -eq $me.Value)
+                'adminOwner[dn]=' + ((Get-OwnerValue "$root\dn") -eq $admins.Value)
+                'adminOwner[dn.]=' + ((Get-OwnerValue "\\?\$root\dn.") -eq $admins.Value)
+            }
+            finally { foreach ($dir in @($root, $outsideDir)) { Remove-ProbeDirectory $dir } }
+            """);
+
+        var answers = RunProbeInShell(shell, probe.ToString());
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("owner.outsideFile=True", answers);
+        Assert.Contains("adminOwner[dn.]=False", answers);
+        Assert.Contains(answers, a => a.StartsWith("open:\\a (a junction or link)", StringComparison.Ordinal));
+        if (answers.Contains("elevated=True"))
+        {
+            Assert.Contains("adminOwner[dn]=True", answers);
+            Assert.Contains(answers, a => a.StartsWith("open:\\dn. (its name ends in a dot or a space", StringComparison.Ordinal));
+        }
+        else
+        {
+            Assert.Contains("adminOwner[dn]=False", answers);
+            Assert.Contains(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv); a policy may have removed them from Administrators", StringComparison.Ordinal));
+        }
+    }
+
+    /// <summary>
+    /// #5677: an object whose owner could not be set (result 4, the count was 1) is listed with that reason but is NOT put in
+    /// the skip set, so the permission walk still removes its explicit write grant for ordinary users and checks it, as it did
+    /// before the owner step existed. The probe replaces the privilege call with <c>$true</c> so the owner step runs on a token
+    /// without elevation: setting Administrators as owner is then refused (result 4); on an elevated token it succeeds, and the
+    /// grant is removed either way.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheInstallTreeLock_StillFixesAndChecksAnObjectWhoseOwnerCouldNotBeSet(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
+        var privilegeCall = "$ownerReady = [DarlingNativeOwner]::EnablePrivileges()";
+        Assert.Contains(privilegeCall, lockText, StringComparison.Ordinal);
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine(lockText.Replace(privilegeCall, "$ownerReady = $true", StringComparison.Ordinal));
+        probe.AppendLine(OwnerStepProbeHead);
+        probe.AppendLine("""
+            $users = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinUsersSid, $null)
+            function Test-UsersExplicit([string]$p) { return @((Get-Acl -LiteralPath $p).GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0 }
+            try {
+                New-Item -ItemType Directory -Path "$root\sub" -Force | Out-Null
+                Set-Content -LiteralPath "$root\sub\f.dll" -Value 'x'
+                foreach ($p in @("$root\sub", "$root\sub\f.dll")) { $null = & icacls.exe $p /setowner "*$($me.Value)" /L /Q 2>&1 }
+                $null = & icacls.exe "$root\sub\f.dll" /grant "*S-1-5-32-545:(W)" /Q 2>&1
+                'setup.grantMade=' + (Test-UsersExplicit "$root\sub\f.dll")
+                $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                'usersExplicitAfter=' + (Test-UsersExplicit "$root\sub\f.dll")
+            }
+            finally { foreach ($dir in @($root, $outsideDir)) { Remove-ProbeDirectory $dir } }
+            """);
+
+        var answers = RunProbeInShell(shell, probe.ToString());
+
+        AssertProbeSetupTook(answers);
+        Assert.Contains("usersExplicitAfter=False", answers);
+        if (!answers.Contains("elevated=True"))
+        {
+            Assert.Contains(answers, a => a.StartsWith("open:\\sub\\f.dll (its owner could not be set, error ", StringComparison.Ordinal));
+            Assert.DoesNotContain(answers, a => a.StartsWith("open:\\sub\\f.dll (has ", StringComparison.Ordinal));
+        }
+    }
+
+    /// <summary>
+    /// #5677: the skip set compares names exactly. In a folder that has the per-folder case-sensitive flag, <c>a.dll</c> (a hard
+    /// link, listed by the owner step and left alone) and <c>A.DLL</c> (a plain file) are two objects: the permission walk leaves
+    /// the first with its explicit grant and still removes the second's. Needs <c>fsutil file setCaseSensitiveInfo</c>, which
+    /// needs an elevated token and a file system that supports it; the case is skipped, with that reason, where it cannot be set
+    /// up. The privilege call is replaced as in the test above.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1", "powershell.exe")]
+    [InlineData("upgrade-darling.ps1", "powershell.exe")]
+    [InlineData("install-darling.ps1", "pwsh")]
+    [InlineData("upgrade-darling.ps1", "pwsh")]
+    public void TheInstallTreeLock_TreatsTwoNamesThatDifferOnlyInCaseAsTwoObjects(string scriptName, string shell)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName));
+        var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
+        var privilegeCall = "$ownerReady = [DarlingNativeOwner]::EnablePrivileges()";
+        var probe = new StringBuilder();
+        AppendServiceWrittenList(probe, script);
+        probe.AppendLine(lockText.Replace(privilegeCall, "$ownerReady = $true", StringComparison.Ordinal));
+        probe.AppendLine(OwnerStepProbeHead);
+        probe.AppendLine("""
+            $users = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinUsersSid, $null)
+            function Test-UsersExplicit([string]$p) { return @((Get-Acl -LiteralPath $p).GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0 }
+            try {
+                New-Item -ItemType Directory -Path "$root\cs", $outsideDir -Force | Out-Null
+                $null = & fsutil.exe file setCaseSensitiveInfo "$root\cs" enable 2>&1
+                'caseSensitive=' + ($LASTEXITCODE -eq 0)
+                if ($LASTEXITCODE -eq 0) {
+                    Set-Content -LiteralPath "$outsideDir\twin" -Value 'x'
+                    New-Item -ItemType HardLink -Path "$root\cs\a.dll" -Value "$outsideDir\twin" | Out-Null
+                    Set-Content -LiteralPath "$root\cs\A.DLL" -Value 'x'
+                    'twoObjects=' + (@(Get-ChildItem -LiteralPath "$root\cs" -Force).Count -eq 2)
+                    foreach ($p in @("$root\cs", "$root\cs\A.DLL", "$root\cs\a.dll")) { $null = & icacls.exe $p /setowner "*$($me.Value)" /L /Q 2>&1 }
+                    foreach ($p in @("$root\cs\A.DLL", "$root\cs\a.dll")) { $null = & icacls.exe $p /grant "*S-1-5-32-545:(W)" /Q 2>&1 }
+                    'setup.grantsMade=' + ((Test-UsersExplicit "$root\cs\A.DLL") -and (Test-UsersExplicit "$root\cs\a.dll"))
+                    $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
+                    'hardLinkListed=' + (@($open | Where-Object { $_ -like '*\cs\a.dll (has 2 names*' }).Count -eq 1)
+                    'upperKeepsGrant=' + (Test-UsersExplicit "$root\cs\a.dll")
+                    'upperFixed=' + (-not (Test-UsersExplicit "$root\cs\A.DLL"))
+                }
+            }
+            finally { foreach ($dir in @($root, $outsideDir)) { Remove-ProbeDirectory $dir } }
+            """);
+
+        var answers = RunProbeInShell(shell, probe.ToString());
+
+        if (!answers.Contains("caseSensitive=True")) { Assert.Skip("this machine cannot set the per-folder case-sensitive flag (fsutil file setCaseSensitiveInfo needs an elevated token and a supporting file system)."); return; }
+        if (!answers.Contains("twoObjects=True")) { Assert.Skip("this machine's case-sensitive folder did not keep two names that differ only in case."); return; }
+        AssertProbeSetupTook(answers);
+        Assert.Contains("hardLinkListed=True", answers);
+        Assert.Contains("upperKeepsGrant=True", answers);
+        Assert.Contains("upperFixed=True", answers);
+    }
+
+    /// <summary>
+    /// #5677: the by-hand advice both scripts print. A privilege failure names the two privileges and says how to check them
+    /// (never "run elevated": both scripts already require it); a path marked as a hard link gets its own line (delete the name,
+    /// or extract the file again, and no icacls on it); the per-path commands are said to be only for paths not marked as a hard
+    /// link; and the per-path reset has no /T. The lock and the native class are the same text in both scripts.
+    /// </summary>
+    [Theory]
+    [InlineData("install-darling.ps1")]
+    [InlineData("upgrade-darling.ps1")]
+    public void TheOwnerStepAdvice_NamesThePrivileges_GivesHardLinksTheirOwnLine_AndDropsTheTreeWideReset(string scriptName)
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", scriptName)).Replace("\r\n", "\n");
+        var lockText = ExtractFunction(script, "Lock-DarlingInstallTree");
+        Assert.Contains("this elevated session does not hold SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv); a policy may have removed them from Administrators", lockText, StringComparison.Ordinal);
+        Assert.DoesNotContain("run elevated", lockText, StringComparison.Ordinal);
+        Assert.Contains("has $detail names (a hard link): its permissions are the same under every one, so its owner and permissions were not changed", lockText, StringComparison.Ordinal);
+        Assert.Contains("could not be opened, error $detail$belowNote", lockText, StringComparison.Ordinal);
+        Assert.Contains("its names could not be counted, error $detail$belowNote", lockText, StringComparison.Ordinal);
+        Assert.Contains("its owner could not be set, error $detail\"", lockText, StringComparison.Ordinal);
+        Assert.Contains("its path resolved outside the install folder, so its owner was not changed$belowNote", lockText, StringComparison.Ordinal);
+        Assert.Contains("; nothing below it was given an owner or checked", lockText, StringComparison.Ordinal);
+        Assert.Contains("if ($result -ne 4 -and -not $isRoot) { $null = $skipped.Add($ownPath) }", lockText, StringComparison.Ordinal);
+
+        Assert.DoesNotContain("/reset /T", script, StringComparison.Ordinal);
+        Assert.DoesNotContain("from an elevated prompt: it makes", script, StringComparison.Ordinal);
+        Assert.Contains("these two commands are only for paths not marked as a hard link", script, StringComparison.Ordinal);
+        Assert.Contains("/reset /C. Remove any junction or link it names.", script, StringComparison.Ordinal);
+        Assert.Contains("delete this name if it is not part of the install, or extract the file again if it is", script, StringComparison.Ordinal);
+        Assert.Contains("o not run icacls on it", script, StringComparison.Ordinal);
+    }
+
+    /// <summary>#5677: the upgrade's staging-folder comment no longer says the lock's owner step needs no privilege.</summary>
+    [Fact]
+    public void TheUpgradeStagingFolderComment_SaysTheOwnerStepTurnsItsPrivilegesOnItself()
+    {
+        var script = ReadRepoFile(Path.Combine("Darling", "tools", "upgrade-darling.ps1")).Replace("\r\n", "\n");
+        Assert.DoesNotContain("already relies on", script, StringComparison.Ordinal);
+        Assert.Contains("owner step, which changes objects this process did not create, turns on\n# SeTakeOwnershipPrivilege and SeBackupPrivilege itself.", script, StringComparison.Ordinal);
+    }
+
     /// <summary>
     /// #5649: every name after the leading double backslash of a UNC path is checked for a name Windows folds into another,
     /// the server and share names included (the check used to start at the share). Run under Windows PowerShell 5.1 and
diff --git a/Darling/tools/install-darling.ps1 b/Darling/tools/install-darling.ps1
index e5294fa656..9885fc5778 100644
--- a/Darling/tools/install-darling.ps1
+++ b/Darling/tools/install-darling.ps1
@@ -382,22 +382,29 @@ public static class DarlingNativeFileNames
     catch { return -1 }
 }
 
-# Sets the owner of one file or folder to the SID given, only when it has exactly one name, on the SAME handle the name count
-# is read from (#5677): the handle is opened for attributes and WRITE_OWNER with every sharing mode allowed and the object
-# itself rather than anything it points to (FILE_FLAG_OPEN_REPARSE_POINT, the way Get-DarlingFileNameCount opens), the link
-# count is read from it, and only a count of exactly 1 is followed by SetSecurityInfo on that handle for the owner alone. A
-# file with more than one name (a hard link) shares one owner under every name, so one whose count is not 1 is never touched.
-# SetOwner returns 0 when the owner was set; 1 when the count is not 1 (detail is the count); 2 when it could not be opened and
-# 3 when the count could not be read (detail is the Win32 error); 4 when the owner could not be set (detail is the error).
-# attributes is the object's attribute bits as read from the handle, so a caller can tell a folder from a link without
-# opening it again. SetPrivileges turns SeTakeOwnershipPrivilege and SeRestorePrivilege on or off for this process's token (the
-# two icacls /setowner turns on for itself) and returns false if either could not be changed. Kept byte-identical in
-# install-darling.ps1 and upgrade-darling.ps1.
+# Sets the owner of one file or folder to the SID given, only when it has exactly one name and is inside the tree being locked
+# (#5677). OpenRoot opens the tree's root folder once, without sharing delete or rename, and keeps that handle open until
+# CloseRoot, so no folder above the root can be replaced while the walk runs; the root's real path is read from that handle
+# (GetFinalPathNameByHandleW, normalized, by volume GUID). SetOwner opens the object itself rather than anything it points to
+# (FILE_FLAG_OPEN_REPARSE_POINT, the way Get-DarlingFileNameCount opens) through a \\?\ path, so a name ending in a dot or a space
+# is not folded into another, reads the opened handle's real path and sets nothing unless that is the root's path or begins with
+# it and a backslash (ordinal, case-sensitive: both come from the file system), reads the link count from the same handle, and
+# only a count of exactly 1 is followed by SetSecurityInfo on that handle for the owner alone. A file with more than one name (a
+# hard link) shares one owner under every name, so one whose count is not 1 is never touched. SetOwner returns 0 when the owner
+# was set; 1 when the count is not 1 (detail is the count); 2 when it could not be opened and 3 when the count could not be read
+# (detail is the Win32 error); 4 when the owner could not be set (detail is the error); 5 when the opened object is not inside
+# the root, or no root is open, or its real path could not be read (nothing was changed). attributes is the object's attribute
+# bits as read from the handle, so a caller can tell a folder from a link without opening it again. EnablePrivileges turns on
+# SeTakeOwnershipPrivilege and SeBackupPrivilege (backup semantics let an object that denies Administrators read access open)
+# for this process's token, keeps what AdjustTokenPrivileges reports as their previous state and returns false if either could
+# not be turned on; RestorePrivileges puts back exactly that previous state. Kept byte-identical in install-darling.ps1 and
+# upgrade-darling.ps1.
 function Initialize-DarlingNativeOwner {
     if ('DarlingNativeOwner' -as [type]) { return }
     Add-Type -TypeDefinition @'
 using System;
 using System.Runtime.InteropServices;
+using System.Text;
 using Microsoft.Win32.SafeHandles;
 
 public static class DarlingNativeOwner
@@ -423,9 +430,16 @@ public static class DarlingNativeOwner
         public uint FileIndexLow;
     }
 
+    private static SafeFileHandle rootHandle;
+    private static string rootPath;
+    private static TokenPrivilege[] previousStates = new TokenPrivilege[0];
+
     [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
     private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
 
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle file, StringBuilder path, uint length, uint flags);
+
     [DllImport("kernel32.dll", SetLastError = true)]
     private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
 
@@ -444,39 +458,122 @@ public static class DarlingNativeOwner
     [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
     private static extern bool LookupPrivilegeValueW(string systemName, string name, out long luid);
 
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern bool AdjustTokenPrivileges(IntPtr token, bool disableAll, ref TokenPrivilege state, uint length, out TokenPrivilege previous, out uint returned);
+
     [DllImport("advapi32.dll", SetLastError = true)]
     private static extern bool AdjustTokenPrivileges(IntPtr token, bool disableAll, ref TokenPrivilege state, uint length, IntPtr previous, IntPtr returned);
 
-    // TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; SE_PRIVILEGE_ENABLED is 2. A privilege the token does not hold is reported as an error.
-    public static bool SetPrivileges(bool on)
+    // TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; SE_PRIVILEGE_ENABLED is 2. A privilege the token does not hold is reported as an
+    // error. A privilege that was already on changes nothing, so its previous state comes back empty and is not touched again.
+    public static bool EnablePrivileges()
     {
         IntPtr token;
         if (!OpenProcessToken(GetCurrentProcess(), 0x28, out token)) { return false; }
         try
         {
             bool all = true;
-            foreach (string name in new string[] { "SeTakeOwnershipPrivilege", "SeRestorePrivilege" })
+            System.Collections.Generic.List<TokenPrivilege> saved = new System.Collections.Generic.List<TokenPrivilege>();
+            foreach (string name in new string[] { "SeTakeOwnershipPrivilege", "SeBackupPrivilege" })
             {
                 TokenPrivilege state = new TokenPrivilege();
                 state.Count = 1;
-                state.Attributes = on ? 2u : 0u;
+                state.Attributes = 2u;
                 if (!LookupPrivilegeValueW(null, name, out state.Luid)) { all = false; continue; }
+                TokenPrivilege previous;
+                uint returned;
+                if (!AdjustTokenPrivileges(token, false, ref state, (uint)Marshal.SizeOf(typeof(TokenPrivilege)), out previous, out returned) || Marshal.GetLastWin32Error() != 0) { all = false; }
+                else if (previous.Count > 0) { saved.Add(previous); }
+            }
+            previousStates = saved.ToArray();
+            return all;
+        }
+        finally { CloseHandle(token); }
+    }
+
+    public static bool RestorePrivileges()
+    {
+        IntPtr token;
+        if (!OpenProcessToken(GetCurrentProcess(), 0x28, out token)) { return false; }
+        try
+        {
+            bool all = true;
+            foreach (TokenPrivilege previous in previousStates)
+            {
+                TokenPrivilege state = previous;
                 if (!AdjustTokenPrivileges(token, false, ref state, 0, IntPtr.Zero, IntPtr.Zero) || Marshal.GetLastWin32Error() != 0) { all = false; }
             }
+            previousStates = new TokenPrivilege[0];
             return all;
         }
         finally { CloseHandle(token); }
     }
 
+    // The \\?\ spelling of an absolute path (\\?\UNC\ for a UNC path), which Windows does not trim or fold.
+    private static string ExtendedPath(string path)
+    {
+        if (path.StartsWith(@"\\?\", StringComparison.Ordinal)) { return path; }
+        if (path.StartsWith(@"\\", StringComparison.Ordinal)) { return @"\\?\UNC\" + path.Substring(2); }
+        return @"\\?\" + path;
+    }
+
+    // FILE_NAME_NORMALIZED (0) | VOLUME_NAME_GUID (1). Null when the path could not be read.
+    private static string RealPath(SafeFileHandle handle, out int error)
+    {
+        error = 0;
+        StringBuilder buffer = new StringBuilder(1024);
+        uint length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 1);
+        if (length >= buffer.Capacity)
+        {
+            buffer = new StringBuilder((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 1);
+        }
+        if (length == 0 || length >= buffer.Capacity)
+        {
+            error = Marshal.GetLastWin32Error();
+            if (error == 0) { error = 122; }
+            return null;
+        }
+        return buffer.ToString();
+    }
+
+    // FILE_READ_ATTRIBUTES; share read and write but not delete; OPEN_EXISTING; FILE_FLAG_BACKUP_SEMANTICS.
+    public static bool OpenRoot(string root, out int detail)
+    {
+        CloseRoot();
+        detail = 0;
+        SafeFileHandle handle = CreateFileW(ExtendedPath(root), 0x80, 3, IntPtr.Zero, 3, 0x02000000, IntPtr.Zero);
+        if (handle.IsInvalid) { detail = Marshal.GetLastWin32Error(); handle.Dispose(); return false; }
+        int error;
+        string real = RealPath(handle, out error);
+        if (real == null) { detail = error; handle.Dispose(); return false; }
+        rootHandle = handle;
+        rootPath = real;
+        return true;
+    }
+
+    public static void CloseRoot()
+    {
+        if (rootHandle != null) { rootHandle.Dispose(); }
+        rootHandle = null;
+        rootPath = null;
+    }
+
     // FILE_READ_ATTRIBUTES | WRITE_OWNER; share read, write and delete; OPEN_EXISTING;
     // FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS. SE_FILE_OBJECT is 1, OWNER_SECURITY_INFORMATION is 1.
     public static int SetOwner(string path, byte[] ownerSid, out int detail, out uint attributes)
     {
         detail = 0;
         attributes = 0;
-        using (SafeFileHandle handle = CreateFileW(path, 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
+        using (SafeFileHandle handle = CreateFileW(ExtendedPath(path), 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
         {
             if (handle.IsInvalid) { detail = Marshal.GetLastWin32Error(); return 2; }
+            int pathError;
+            string real = RealPath(handle, out pathError);
+            string root = rootPath;
+            if (real == null || root == null) { detail = pathError; return 5; }
+            string prefix = root.EndsWith(@"\", StringComparison.Ordinal) ? root : root + @"\";
+            if (!string.Equals(real, root, StringComparison.Ordinal) && !real.StartsWith(prefix, StringComparison.Ordinal)) { return 5; }
             ByHandleFileInformation information;
             if (!GetFileInformationByHandle(handle, out information)) { detail = Marshal.GetLastWin32Error(); return 3; }
             attributes = information.FileAttributes;
@@ -1252,42 +1349,70 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         if ($LASTEXITCODE -ne 0) { return @("$root (icacls $($step -join ' ') failed: $($output -join ' '))") }
     }
     # The owner step (#5677). The tree is walked here and the owner of each object is set one at a time, in this process, on the
-    # handle its name count is read from (see Initialize-DarlingNativeOwner): a file whose count is not exactly 1, or cannot be
-    # read, keeps its owner, because a file with more than one name (a hard link) has one owner that every name shares, some of
-    # them outside this folder. Such a file, and one whose owner cannot be set, is listed as open here and put in $skipped so the
-    # walk below leaves it out (it is listed once). The walk does not follow a junction or link: the link itself is the object,
-    # and nothing below it is listed. The two privileges are turned on for the step and off again after it; without them (not
-    # elevated) the step is not run and the root is reported.
-    $skipped = @{}
+    # handle its name count is read from (see Initialize-DarlingNativeOwner). The root is opened once, without sharing delete or
+    # rename, and kept open for the whole walk; each object's real path is read from its own handle and an object that is not
+    # the root or below it is left alone (result 5), so a folder swapped for a junction while the walk runs cannot send it
+    # outside the tree. A file whose count is not exactly 1, or cannot be read, keeps its owner, because a file with more than one
+    # name (a hard link) has one owner that every name shares, some of them outside this folder. A name ending in a dot or a
+    # space is listed and not acted on (Windows would open a different name). Each such object is listed as open here and put in
+    # $skipped so the walk below leaves it out (it is listed once), except the root and an object whose owner could not be set:
+    # the walk below still fixes and checks those. $skipped compares by ordinal, so two names that differ only in case (a
+    # case-sensitive folder) stay two. The walk does not follow a junction or link: the link itself is the object, and nothing
+    # below it is listed. The two privileges are turned on for the step and put back as they were after it; without them (the
+    # session does not hold them) the step is not run and the root is reported.
+    $skipped = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
     $ownerBytes = New-Object byte[] $adminsSid.BinaryLength
     $adminsSid.GetBinaryForm($ownerBytes, 0)
     $ownerReady = $false
     try {
         Initialize-DarlingNativeOwner
-        $ownerReady = [DarlingNativeOwner]::SetPrivileges($true)
-        if (-not $ownerReady) { $open += "$root (could not make Administrators the owner of everything below it; run elevated)" }
+        $ownerReady = [DarlingNativeOwner]::EnablePrivileges()
+        if (-not $ownerReady) { $open += "$root (could not make Administrators the owner of everything below it: this elevated session does not hold SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv); a policy may have removed them from Administrators)" }
         else {
-            $pending = New-Object System.Collections.Stack
-            $pending.Push($root)
-            while ($pending.Count -gt 0) {
-                $ownPath = [string]$pending.Pop()
-                $detail = 0
-                $attributes = [uint32]0
-                $result = [DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)
-                if ($result -ne 0) {
-                    $skipped[$ownPath] = $true
-                    if ($result -eq 4) { $open += "$ownPath (its owner could not be set, error $detail)" }
-                    else { $open += "$ownPath (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one; its owner and permissions were not changed)" }
-                }
-                if (($attributes -band 0x10) -ne 0 -and ($attributes -band 0x400) -eq 0) {
-                    try { foreach ($kid in @(Get-ChildItem -LiteralPath $ownPath -Force -ErrorAction Stop)) { $pending.Push($kid.FullName) } }
-                    catch { $open += "$ownPath (its contents could not be listed, so nothing below it was given an owner: $($_.Exception.Message))" }
+            $rootError = 0
+            if (-not [DarlingNativeOwner]::OpenRoot($root, [ref]$rootError)) { $open += "$root (could not make Administrators the owner of everything below it: the folder could not be pinned and its real path read, error $rootError)" }
+            else {
+                $pending = New-Object System.Collections.Stack
+                $pending.Push((Get-Item -LiteralPath $root -Force))
+                $atRoot = $true
+                while ($pending.Count -gt 0) {
+                    $item = $pending.Pop()
+                    $ownPath = [string]$item.FullName
+                    $isRoot = $atRoot
+                    $atRoot = $false
+                    $belowNote = if ($item.PSIsContainer) { '; nothing below it was given an owner or checked' } else { '' }
+                    if ((-not $isRoot) -and ($ownPath.EndsWith('.') -or $ownPath.EndsWith(' '))) {
+                        $null = $skipped.Add($ownPath)
+                        $open += "$ownPath (its name ends in a dot or a space, which Windows folds into another name, so it was not given an owner or checked$belowNote)"
+                        continue
+                    }
+                    $detail = 0
+                    $attributes = [uint32]0
+                    $result = [DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)
+                    if ($result -ne 0) {
+                        $why = switch ($result) {
+                            1 { "has $detail names (a hard link): its permissions are the same under every one, so its owner and permissions were not changed" }
+                            2 { "could not be opened, error $detail$belowNote" }
+                            3 { "its names could not be counted, error $detail$belowNote" }
+                            4 { "its owner could not be set, error $detail" }
+                            default { "its path resolved outside the install folder, so its owner was not changed$belowNote" }
+                        }
+                        if ($result -ne 4 -and -not $isRoot) { $null = $skipped.Add($ownPath) }
+                        $open += "$ownPath ($why)"
+                    }
+                    if (($attributes -band 0x10) -ne 0 -and ($attributes -band 0x400) -eq 0) {
+                        try { foreach ($kid in @(Get-ChildItem -LiteralPath $ownPath -Force -ErrorAction Stop)) { $pending.Push($kid) } }
+                        catch { $open += "$ownPath (its contents could not be listed, so nothing below it was given an owner: $($_.Exception.Message))" }
+                    }
                 }
             }
         }
     }
     catch { $open += "$root (could not make Administrators the owner of everything below it: $($_.Exception.Message))" }
-    finally { try { $null = [DarlingNativeOwner]::SetPrivileges($false) } catch { } }
+    finally {
+        try { [DarlingNativeOwner]::CloseRoot() } catch { }
+        try { $null = [DarlingNativeOwner]::RestorePrivileges() } catch { }
+    }
     $serviceWritePaths = @()
     if ($serviceSid) {
         foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root)) {
@@ -1326,7 +1451,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if (-not (Get-Acl -LiteralPath $root).AreAccessRulesProtected) { $open += "$root (still inherits from its parent)" }
     $targets = @(Get-Item -LiteralPath $root -Force) + @(Get-ChildItem -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue)
     foreach ($target in $targets) {
-        if ($skipped.ContainsKey($target.FullName)) { continue }
+        if ($skipped.Contains($target.FullName)) { continue }
         $path = Get-DarlingCanonicalPath $target.FullName
         if ($null -eq $path) { $open += "$($target.FullName) (its full path could not be worked out)"; continue }
         if ($path.TrimEnd('\') -ine $root.TrimEnd('\') -and ($target.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
@@ -1416,9 +1541,10 @@ function Invoke-InstallTreeLock([string]$account, [switch]$StopOnOpen) {
     Write-Host "    icacls `"$root`" /inheritance:d" -ForegroundColor Yellow
     Write-Host "    icacls `"$root`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4" -ForegroundColor Yellow
     Write-Host "    icacls `"$root`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"$grantTo`:(OI)(CI)RX`"" -ForegroundColor Yellow
-    Write-Host '    (then run this script again from an elevated prompt: it makes Administrators the owner of each path itself, and lists a file with more than one name)' -ForegroundColor Yellow
-    Write-Host '  A path listed as owned by an account, or BELOW the folder, needs its own fix: icacls "<path>" /setowner' -ForegroundColor Red
-    Write-Host '  *S-1-5-32-544 /L, then icacls "<path>" /reset /T /C. Remove any junction or link it names.' -ForegroundColor Red
+    Write-Host '    (then run this script again: it makes Administrators the owner of each path itself, and lists a file with more than one name)' -ForegroundColor Yellow
+    Write-Host '  A path marked as a hard link (a file with more than one name): delete this name if it is not part of the install, or extract the file again if it is. Do not run icacls on it.' -ForegroundColor Red
+    Write-Host '  Any other path listed as owned by an account, or BELOW the folder, needs its own fix; these two commands are only for paths not marked as a hard link: icacls "<path>" /setowner' -ForegroundColor Red
+    Write-Host '  *S-1-5-32-544 /L, then icacls "<path>" /reset /C. Remove any junction or link it names.' -ForegroundColor Red
     Write-Host ''
     if ($StopOnOpen) {
         Fail 'Stopped before running anything from a folder ordinary users can still change. Fix the paths above, or extract the zip into a fresh folder, then re-run this script.'
diff --git a/Darling/tools/upgrade-darling.ps1 b/Darling/tools/upgrade-darling.ps1
index dad9b6d936..770fa25026 100644
--- a/Darling/tools/upgrade-darling.ps1
+++ b/Darling/tools/upgrade-darling.ps1
@@ -434,22 +434,29 @@ public static class DarlingNativeFileNames
     catch { return -1 }
 }
 
-# Sets the owner of one file or folder to the SID given, only when it has exactly one name, on the SAME handle the name count
-# is read from (#5677): the handle is opened for attributes and WRITE_OWNER with every sharing mode allowed and the object
-# itself rather than anything it points to (FILE_FLAG_OPEN_REPARSE_POINT, the way Get-DarlingFileNameCount opens), the link
-# count is read from it, and only a count of exactly 1 is followed by SetSecurityInfo on that handle for the owner alone. A
-# file with more than one name (a hard link) shares one owner under every name, so one whose count is not 1 is never touched.
-# SetOwner returns 0 when the owner was set; 1 when the count is not 1 (detail is the count); 2 when it could not be opened and
-# 3 when the count could not be read (detail is the Win32 error); 4 when the owner could not be set (detail is the error).
-# attributes is the object's attribute bits as read from the handle, so a caller can tell a folder from a link without
-# opening it again. SetPrivileges turns SeTakeOwnershipPrivilege and SeRestorePrivilege on or off for this process's token (the
-# two icacls /setowner turns on for itself) and returns false if either could not be changed. Kept byte-identical in
-# install-darling.ps1 and upgrade-darling.ps1.
+# Sets the owner of one file or folder to the SID given, only when it has exactly one name and is inside the tree being locked
+# (#5677). OpenRoot opens the tree's root folder once, without sharing delete or rename, and keeps that handle open until
+# CloseRoot, so no folder above the root can be replaced while the walk runs; the root's real path is read from that handle
+# (GetFinalPathNameByHandleW, normalized, by volume GUID). SetOwner opens the object itself rather than anything it points to
+# (FILE_FLAG_OPEN_REPARSE_POINT, the way Get-DarlingFileNameCount opens) through a \\?\ path, so a name ending in a dot or a space
+# is not folded into another, reads the opened handle's real path and sets nothing unless that is the root's path or begins with
+# it and a backslash (ordinal, case-sensitive: both come from the file system), reads the link count from the same handle, and
+# only a count of exactly 1 is followed by SetSecurityInfo on that handle for the owner alone. A file with more than one name (a
+# hard link) shares one owner under every name, so one whose count is not 1 is never touched. SetOwner returns 0 when the owner
+# was set; 1 when the count is not 1 (detail is the count); 2 when it could not be opened and 3 when the count could not be read
+# (detail is the Win32 error); 4 when the owner could not be set (detail is the error); 5 when the opened object is not inside
+# the root, or no root is open, or its real path could not be read (nothing was changed). attributes is the object's attribute
+# bits as read from the handle, so a caller can tell a folder from a link without opening it again. EnablePrivileges turns on
+# SeTakeOwnershipPrivilege and SeBackupPrivilege (backup semantics let an object that denies Administrators read access open)
+# for this process's token, keeps what AdjustTokenPrivileges reports as their previous state and returns false if either could
+# not be turned on; RestorePrivileges puts back exactly that previous state. Kept byte-identical in install-darling.ps1 and
+# upgrade-darling.ps1.
 function Initialize-DarlingNativeOwner {
     if ('DarlingNativeOwner' -as [type]) { return }
     Add-Type -TypeDefinition @'
 using System;
 using System.Runtime.InteropServices;
+using System.Text;
 using Microsoft.Win32.SafeHandles;
 
 public static class DarlingNativeOwner
@@ -475,9 +482,16 @@ public static class DarlingNativeOwner
         public uint FileIndexLow;
     }
 
+    private static SafeFileHandle rootHandle;
+    private static string rootPath;
+    private static TokenPrivilege[] previousStates = new TokenPrivilege[0];
+
     [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
     private static extern SafeFileHandle CreateFileW(string fileName, uint desiredAccess, uint shareMode, IntPtr securityAttributes, uint creationDisposition, uint flagsAndAttributes, IntPtr templateFile);
 
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetFinalPathNameByHandleW(SafeFileHandle file, StringBuilder path, uint length, uint flags);
+
     [DllImport("kernel32.dll", SetLastError = true)]
     private static extern bool GetFileInformationByHandle(SafeFileHandle file, out ByHandleFileInformation information);
 
@@ -496,39 +510,122 @@ public static class DarlingNativeOwner
     [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
     private static extern bool LookupPrivilegeValueW(string systemName, string name, out long luid);
 
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern bool AdjustTokenPrivileges(IntPtr token, bool disableAll, ref TokenPrivilege state, uint length, out TokenPrivilege previous, out uint returned);
+
     [DllImport("advapi32.dll", SetLastError = true)]
     private static extern bool AdjustTokenPrivileges(IntPtr token, bool disableAll, ref TokenPrivilege state, uint length, IntPtr previous, IntPtr returned);
 
-    // TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; SE_PRIVILEGE_ENABLED is 2. A privilege the token does not hold is reported as an error.
-    public static bool SetPrivileges(bool on)
+    // TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; SE_PRIVILEGE_ENABLED is 2. A privilege the token does not hold is reported as an
+    // error. A privilege that was already on changes nothing, so its previous state comes back empty and is not touched again.
+    public static bool EnablePrivileges()
     {
         IntPtr token;
         if (!OpenProcessToken(GetCurrentProcess(), 0x28, out token)) { return false; }
         try
         {
             bool all = true;
-            foreach (string name in new string[] { "SeTakeOwnershipPrivilege", "SeRestorePrivilege" })
+            System.Collections.Generic.List<TokenPrivilege> saved = new System.Collections.Generic.List<TokenPrivilege>();
+            foreach (string name in new string[] { "SeTakeOwnershipPrivilege", "SeBackupPrivilege" })
             {
                 TokenPrivilege state = new TokenPrivilege();
                 state.Count = 1;
-                state.Attributes = on ? 2u : 0u;
+                state.Attributes = 2u;
                 if (!LookupPrivilegeValueW(null, name, out state.Luid)) { all = false; continue; }
+                TokenPrivilege previous;
+                uint returned;
+                if (!AdjustTokenPrivileges(token, false, ref state, (uint)Marshal.SizeOf(typeof(TokenPrivilege)), out previous, out returned) || Marshal.GetLastWin32Error() != 0) { all = false; }
+                else if (previous.Count > 0) { saved.Add(previous); }
+            }
+            previousStates = saved.ToArray();
+            return all;
+        }
+        finally { CloseHandle(token); }
+    }
+
+    public static bool RestorePrivileges()
+    {
+        IntPtr token;
+        if (!OpenProcessToken(GetCurrentProcess(), 0x28, out token)) { return false; }
+        try
+        {
+            bool all = true;
+            foreach (TokenPrivilege previous in previousStates)
+            {
+                TokenPrivilege state = previous;
                 if (!AdjustTokenPrivileges(token, false, ref state, 0, IntPtr.Zero, IntPtr.Zero) || Marshal.GetLastWin32Error() != 0) { all = false; }
             }
+            previousStates = new TokenPrivilege[0];
             return all;
         }
         finally { CloseHandle(token); }
     }
 
+    // The \\?\ spelling of an absolute path (\\?\UNC\ for a UNC path), which Windows does not trim or fold.
+    private static string ExtendedPath(string path)
+    {
+        if (path.StartsWith(@"\\?\", StringComparison.Ordinal)) { return path; }
+        if (path.StartsWith(@"\\", StringComparison.Ordinal)) { return @"\\?\UNC\" + path.Substring(2); }
+        return @"\\?\" + path;
+    }
+
+    // FILE_NAME_NORMALIZED (0) | VOLUME_NAME_GUID (1). Null when the path could not be read.
+    private static string RealPath(SafeFileHandle handle, out int error)
+    {
+        error = 0;
+        StringBuilder buffer = new StringBuilder(1024);
+        uint length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 1);
+        if (length >= buffer.Capacity)
+        {
+            buffer = new StringBuilder((int)length + 1);
+            length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 1);
+        }
+        if (length == 0 || length >= buffer.Capacity)
+        {
+            error = Marshal.GetLastWin32Error();
+            if (error == 0) { error = 122; }
+            return null;
+        }
+        return buffer.ToString();
+    }
+
+    // FILE_READ_ATTRIBUTES; share read and write but not delete; OPEN_EXISTING; FILE_FLAG_BACKUP_SEMANTICS.
+    public static bool OpenRoot(string root, out int detail)
+    {
+        CloseRoot();
+        detail = 0;
+        SafeFileHandle handle = CreateFileW(ExtendedPath(root), 0x80, 3, IntPtr.Zero, 3, 0x02000000, IntPtr.Zero);
+        if (handle.IsInvalid) { detail = Marshal.GetLastWin32Error(); handle.Dispose(); return false; }
+        int error;
+        string real = RealPath(handle, out error);
+        if (real == null) { detail = error; handle.Dispose(); return false; }
+        rootHandle = handle;
+        rootPath = real;
+        return true;
+    }
+
+    public static void CloseRoot()
+    {
+        if (rootHandle != null) { rootHandle.Dispose(); }
+        rootHandle = null;
+        rootPath = null;
+    }
+
     // FILE_READ_ATTRIBUTES | WRITE_OWNER; share read, write and delete; OPEN_EXISTING;
     // FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS. SE_FILE_OBJECT is 1, OWNER_SECURITY_INFORMATION is 1.
     public static int SetOwner(string path, byte[] ownerSid, out int detail, out uint attributes)
     {
         detail = 0;
         attributes = 0;
-        using (SafeFileHandle handle = CreateFileW(path, 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
+        using (SafeFileHandle handle = CreateFileW(ExtendedPath(path), 0x80 | 0x00080000, 7, IntPtr.Zero, 3, 0x00200000 | 0x02000000, IntPtr.Zero))
         {
             if (handle.IsInvalid) { detail = Marshal.GetLastWin32Error(); return 2; }
+            int pathError;
+            string real = RealPath(handle, out pathError);
+            string root = rootPath;
+            if (real == null || root == null) { detail = pathError; return 5; }
+            string prefix = root.EndsWith(@"\", StringComparison.Ordinal) ? root : root + @"\";
+            if (!string.Equals(real, root, StringComparison.Ordinal) && !real.StartsWith(prefix, StringComparison.Ordinal)) { return 5; }
             ByHandleFileInformation information;
             if (!GetFileInformationByHandle(handle, out information)) { detail = Marshal.GetLastWin32Error(); return 3; }
             attributes = information.FileAttributes;
@@ -1090,42 +1187,70 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
         if ($LASTEXITCODE -ne 0) { return @("$root (icacls $($step -join ' ') failed: $($output -join ' '))") }
     }
     # The owner step (#5677). The tree is walked here and the owner of each object is set one at a time, in this process, on the
-    # handle its name count is read from (see Initialize-DarlingNativeOwner): a file whose count is not exactly 1, or cannot be
-    # read, keeps its owner, because a file with more than one name (a hard link) has one owner that every name shares, some of
-    # them outside this folder. Such a file, and one whose owner cannot be set, is listed as open here and put in $skipped so the
-    # walk below leaves it out (it is listed once). The walk does not follow a junction or link: the link itself is the object,
-    # and nothing below it is listed. The two privileges are turned on for the step and off again after it; without them (not
-    # elevated) the step is not run and the root is reported.
-    $skipped = @{}
+    # handle its name count is read from (see Initialize-DarlingNativeOwner). The root is opened once, without sharing delete or
+    # rename, and kept open for the whole walk; each object's real path is read from its own handle and an object that is not
+    # the root or below it is left alone (result 5), so a folder swapped for a junction while the walk runs cannot send it
+    # outside the tree. A file whose count is not exactly 1, or cannot be read, keeps its owner, because a file with more than one
+    # name (a hard link) has one owner that every name shares, some of them outside this folder. A name ending in a dot or a
+    # space is listed and not acted on (Windows would open a different name). Each such object is listed as open here and put in
+    # $skipped so the walk below leaves it out (it is listed once), except the root and an object whose owner could not be set:
+    # the walk below still fixes and checks those. $skipped compares by ordinal, so two names that differ only in case (a
+    # case-sensitive folder) stay two. The walk does not follow a junction or link: the link itself is the object, and nothing
+    # below it is listed. The two privileges are turned on for the step and put back as they were after it; without them (the
+    # session does not hold them) the step is not run and the root is reported.
+    $skipped = New-Object 'System.Collections.Generic.HashSet[string]' ([StringComparer]::Ordinal)
     $ownerBytes = New-Object byte[] $adminsSid.BinaryLength
     $adminsSid.GetBinaryForm($ownerBytes, 0)
     $ownerReady = $false
     try {
         Initialize-DarlingNativeOwner
-        $ownerReady = [DarlingNativeOwner]::SetPrivileges($true)
-        if (-not $ownerReady) { $open += "$root (could not make Administrators the owner of everything below it; run elevated)" }
+        $ownerReady = [DarlingNativeOwner]::EnablePrivileges()
+        if (-not $ownerReady) { $open += "$root (could not make Administrators the owner of everything below it: this elevated session does not hold SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv); a policy may have removed them from Administrators)" }
         else {
-            $pending = New-Object System.Collections.Stack
-            $pending.Push($root)
-            while ($pending.Count -gt 0) {
-                $ownPath = [string]$pending.Pop()
-                $detail = 0
-                $attributes = [uint32]0
-                $result = [DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)
-                if ($result -ne 0) {
-                    $skipped[$ownPath] = $true
-                    if ($result -eq 4) { $open += "$ownPath (its owner could not be set, error $detail)" }
-                    else { $open += "$ownPath (a hard link: this file has more than one name, or its names could not be counted, and its permissions are the same under every one; its owner and permissions were not changed)" }
-                }
-                if (($attributes -band 0x10) -ne 0 -and ($attributes -band 0x400) -eq 0) {
-                    try { foreach ($kid in @(Get-ChildItem -LiteralPath $ownPath -Force -ErrorAction Stop)) { $pending.Push($kid.FullName) } }
-                    catch { $open += "$ownPath (its contents could not be listed, so nothing below it was given an owner: $($_.Exception.Message))" }
+            $rootError = 0
+            if (-not [DarlingNativeOwner]::OpenRoot($root, [ref]$rootError)) { $open += "$root (could not make Administrators the owner of everything below it: the folder could not be pinned and its real path read, error $rootError)" }
+            else {
+                $pending = New-Object System.Collections.Stack
+                $pending.Push((Get-Item -LiteralPath $root -Force))
+                $atRoot = $true
+                while ($pending.Count -gt 0) {
+                    $item = $pending.Pop()
+                    $ownPath = [string]$item.FullName
+                    $isRoot = $atRoot
+                    $atRoot = $false
+                    $belowNote = if ($item.PSIsContainer) { '; nothing below it was given an owner or checked' } else { '' }
+                    if ((-not $isRoot) -and ($ownPath.EndsWith('.') -or $ownPath.EndsWith(' '))) {
+                        $null = $skipped.Add($ownPath)
+                        $open += "$ownPath (its name ends in a dot or a space, which Windows folds into another name, so it was not given an owner or checked$belowNote)"
+                        continue
+                    }
+                    $detail = 0
+                    $attributes = [uint32]0
+                    $result = [DarlingNativeOwner]::SetOwner($ownPath, $ownerBytes, [ref]$detail, [ref]$attributes)
+                    if ($result -ne 0) {
+                        $why = switch ($result) {
+                            1 { "has $detail names (a hard link): its permissions are the same under every one, so its owner and permissions were not changed" }
+                            2 { "could not be opened, error $detail$belowNote" }
+                            3 { "its names could not be counted, error $detail$belowNote" }
+                            4 { "its owner could not be set, error $detail" }
+                            default { "its path resolved outside the install folder, so its owner was not changed$belowNote" }
+                        }
+                        if ($result -ne 4 -and -not $isRoot) { $null = $skipped.Add($ownPath) }
+                        $open += "$ownPath ($why)"
+                    }
+                    if (($attributes -band 0x10) -ne 0 -and ($attributes -band 0x400) -eq 0) {
+                        try { foreach ($kid in @(Get-ChildItem -LiteralPath $ownPath -Force -ErrorAction Stop)) { $pending.Push($kid) } }
+                        catch { $open += "$ownPath (its contents could not be listed, so nothing below it was given an owner: $($_.Exception.Message))" }
+                    }
                 }
             }
         }
     }
     catch { $open += "$root (could not make Administrators the owner of everything below it: $($_.Exception.Message))" }
-    finally { try { $null = [DarlingNativeOwner]::SetPrivileges($false) } catch { } }
+    finally {
+        try { [DarlingNativeOwner]::CloseRoot() } catch { }
+        try { $null = [DarlingNativeOwner]::RestorePrivileges() } catch { }
+    }
     $serviceWritePaths = @()
     if ($serviceSid) {
         foreach ($secret in @(Get-DarlingServiceWrittenRootFiles $root)) {
@@ -1164,7 +1289,7 @@ function Lock-DarlingInstallTree([string]$root, [string]$serviceAccount, [string
     if (-not (Get-Acl -LiteralPath $root).AreAccessRulesProtected) { $open += "$root (still inherits from its parent)" }
     $targets = @(Get-Item -LiteralPath $root -Force) + @(Get-ChildItem -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue)
     foreach ($target in $targets) {
-        if ($skipped.ContainsKey($target.FullName)) { continue }
+        if ($skipped.Contains($target.FullName)) { continue }
         $path = Get-DarlingCanonicalPath $target.FullName
         if ($null -eq $path) { $open += "$($target.FullName) (its full path could not be worked out)"; continue }
         if ($path.TrimEnd('\') -ine $root.TrimEnd('\') -and ($target.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
@@ -2193,8 +2318,9 @@ function Protect-DarlingStagingFolder([string]$path) {
 }
 
 # A fresh, empty, protected folder under the machine temp directory for H1's zip staging copy. Elevation is
-# assumed (this script requires it), so setting Administrators as owner needs no extra privilege - the same
-# fact Lock-DarlingInstallTree's own owner step already relies on.
+# assumed (this script requires it), so setting Administrators as owner of this new folder needs no extra privilege.
+# Lock-DarlingInstallTree's owner step, which changes objects this process did not create, turns on
+# SeTakeOwnershipPrivilege and SeBackupPrivilege itself.
 function New-DarlingProtectedStagingFolder {
     $path = Join-Path $env:TEMP ('darling-upgrade-staging-' + [guid]::NewGuid().ToString('N'))
     New-Item -ItemType Directory -Path $path -Force | Out-Null
@@ -2560,7 +2686,7 @@ function Invoke-UpgradeTreeLock([string]$when) {
         Good "Install folder locked ${when}: only SYSTEM and Administrators can change what runs from $InstallRoot; $logonAccount can write only its runtime folders."
         return
     }
-    Warn ("Ordinary users can still change {0} path(s) in the install folder, and the service runs from there as {1}, so anyone who can replace a binary can run code as that account. First: {2}. Fix from an elevated prompt with: icacls `"{3}`" /inheritance:d, then icacls `"{3}`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4, then icacls `"{3}`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"{1}:(OI)(CI)RX`", then run this script again from an elevated prompt (it makes Administrators the owner of each path itself, and lists a file with more than one name). A path listed as owned by an account, or below the folder, needs its own fix: icacls `"<path>`" /setowner *S-1-5-32-544 /L, then icacls `"<path>`" /reset /T /C. Remove any junction or link it names." -f $open.Count, $logonAccount, (($open | Select-Object -First 5) -join ', '), $InstallRoot)
+    Warn ("Ordinary users can still change {0} path(s) in the install folder, and the service runs from there as {1}, so anyone who can replace a binary can run code as that account. First: {2}. Fix from an elevated prompt with: icacls `"{3}`" /inheritance:d, then icacls `"{3}`" /remove:g *S-1-5-11 *S-1-5-32-545 *S-1-1-0 *S-1-5-4, then icacls `"{3}`" /grant `"*S-1-5-32-545:(OI)(CI)RX`" /grant:r `"{1}:(OI)(CI)RX`", then run this script again (it makes Administrators the owner of each path itself, and lists a file with more than one name). A path marked as a hard link (a file with more than one name): delete this name if it is not part of the install, or extract the file again if it is, and do not run icacls on it. Any other path listed as owned by an account, or below the folder, needs its own fix; these two commands are only for paths not marked as a hard link: icacls `"<path>`" /setowner *S-1-5-32-544 /L, then icacls `"<path>`" /reset /C. Remove any junction or link it names." -f $open.Count, $logonAccount, (($open | Select-Object -First 5) -join ', '), $InstallRoot)
 }
 
 Invoke-UpgradeTreeLock 'before the backup and the copy'

From 7f78864f17998fbc4fd6e9364a93f7a0a7641e1c Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:39:55 -0400
Subject: [PATCH 14/14] The lock tests match what an elevated session reports
 and print every answer when one fails (#5677)

Three groups of lock tests failed only on an elevated runner:

- The hard-link tests expected the permission walk's wording. An elevated session runs the owner step first, which
  lists the file in its own words and leaves it out of the walk. The tests now expect the owner step's text when the
  session is elevated, the walk's text otherwise, and require the file to be listed exactly once.
- The owner test filtered the lock's lines by the probe's root, which is the 8.3 short form under a runner's temp
  folder, while the lock lists the long form, so no line matched. The probe now takes the long form of its root.
- The dot-name test never gave dn. an owner. A file made by an elevated administrator starts owned by
  Administrators, so the check that the lock left dn. alone could not pass. The probe now sets the current account as
  its owner through a \\?\ path and checks that it took.

A failed assertion on a probe's answers now prints every answer instead of the first five.
---
 .../DarlingInstallLocationTests.cs            | 99 ++++++++++++++-----
 1 file changed, 73 insertions(+), 26 deletions(-)

diff --git a/Darling/Darling.Tests/DarlingInstallLocationTests.cs b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
index df61976b1c..a491a02fc3 100644
--- a/Darling/Darling.Tests/DarlingInstallLocationTests.cs
+++ b/Darling/Darling.Tests/DarlingInstallLocationTests.cs
@@ -1757,6 +1757,7 @@ public void TheInstallTreeLock_ReportsAHardLinkedBackupWithAnUntrustedGrant_AndL
                 $null = & icacls.exe "$root\darling.json.bak-linked" /inheritance:d /grant "*$($users.Value):(M)" 2>&1
                 Confirm-ProbeAcl 'linkedAces' "$root\darling.json.bak-linked" $null @($users)
                 'setup.otherNameSharesTheAcl=' + (@((Get-Acl -LiteralPath $outside).GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+                'elevated=' + ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 
                 $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
                 foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
@@ -1782,10 +1783,17 @@ public void TheInstallTreeLock_ReportsAHardLinkedBackupWithAnUntrustedGrant_AndL
         var answers = RunWindowsPowerShell(probe.ToString());
         AssertProbeSetupTook(answers);
 
-        Assert.Contains(answers, a => a.StartsWith(@"open:\darling.json.bak-linked (a hard link: this file has more than one name", StringComparison.Ordinal));
-        Assert.Contains("darling.json.bak-linked.usersExplicit=True", answers);
-        Assert.Contains("darling.json.bak-linked.protected=True", answers);
-        Assert.Contains(answers, a => a.EndsWith(".txt.usersExplicit=True", StringComparison.Ordinal));
+        /* The text depends on which step reports the file. An elevated session runs the owner step first: it counts the names on
+           the handle, lists the file in its own words and leaves it out of the permission walk. Without elevation the owner step
+           does not run and the permission walk lists it (the root-file arm, in the walk's words). Either way it is listed once. */
+        var linkedText = answers.Contains("elevated=True")
+            ? @"open:\darling.json.bak-linked (has 2 names (a hard link): its permissions are the same under every one"
+            : @"open:\darling.json.bak-linked (a hard link: this file has more than one name";
+        AssertAnswer(answers, a => a.StartsWith(linkedText, StringComparison.Ordinal), "that starts with '" + linkedText + "'");
+        AssertAnswerCount(answers, a => a.StartsWith(@"open:\darling.json.bak-linked", StringComparison.Ordinal), 1, "that list darling.json.bak-linked");
+        AssertAnswer(answers, "darling.json.bak-linked.usersExplicit=True");
+        AssertAnswer(answers, "darling.json.bak-linked.protected=True");
+        AssertAnswer(answers, a => a.EndsWith(".txt.usersExplicit=True", StringComparison.Ordinal), "that ends with '.txt.usersExplicit=True' (the other name keeps the grant)");
     }
 
     /// <summary>
@@ -1833,6 +1841,7 @@ public void TheInstallTreeLock_ReportsAnyHardLinkedFileWithAnUntrustedGrant_AndL
                 }
                 $null = & icacls.exe "$root\plain.dll" /inheritance:d /grant "*$($users.Value):(M)" 2>&1
                 'setup.plain.ace=' + (@((Get-Acl -LiteralPath "$root\plain.dll").GetAccessRules($true, $false, $sidType) | Where-Object { $_.IdentityReference -eq $users }).Count -gt 0)
+                'elevated=' + ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 
                 $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
                 foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
@@ -1866,14 +1875,20 @@ public void TheInstallTreeLock_ReportsAnyHardLinkedFileWithAnUntrustedGrant_AndL
         }
 
         AssertProbeSetupTook(answers);
+        /* An elevated session runs the owner step first, which lists a file with more than one name in its own words and keeps it
+           out of the permission walk; without elevation the permission walk lists it. Either way it is listed once. */
+        var linkedText = answers.Contains("elevated=True")
+            ? " (has 2 names (a hard link): its permissions are the same under every one"
+            : " (a hard link: this file has more than one name";
         foreach (var leaf in new[] { "vendor.dll", "inner.dll", "darling.json.bak-deep", "darling.json.bak-hand" })
         {
-            Assert.Contains(answers, a => a.StartsWith("open:\\", StringComparison.Ordinal) && a.Contains(leaf + " (a hard link: this file has more than one name", StringComparison.Ordinal));
-            Assert.Contains($"{leaf}.True.usersExplicit=True", answers);
-            Assert.Contains($"{leaf}.False.usersExplicit=True", answers);
+            AssertAnswer(answers, a => a.StartsWith("open:\\", StringComparison.Ordinal) && a.Contains("\\" + leaf + linkedText, StringComparison.Ordinal), "that starts with 'open:\\' and holds '\\" + leaf + linkedText + "'");
+            AssertAnswerCount(answers, a => a.StartsWith("open:\\", StringComparison.Ordinal) && a.Contains("\\" + leaf + " (", StringComparison.Ordinal), 1, "that list " + leaf);
+            AssertAnswer(answers, $"{leaf}.True.usersExplicit=True");
+            AssertAnswer(answers, $"{leaf}.False.usersExplicit=True");
         }
 
-        Assert.Contains("plain.usersExplicit=False", answers);
+        AssertAnswer(answers, "plain.usersExplicit=False");
     }
 
     /// <summary>
@@ -2032,6 +2047,9 @@ public void TheInstallTreeLock_GivesAdministratorsTheOwnerOfPlainFilesAndFolders
             function Get-OwnerValue([string]$p) { return (Get-Acl -LiteralPath $p).GetOwner($sidType).Value }
             try {
                 New-Item -ItemType Directory -Path "$root\sub", $outsideDir -Force | Out-Null
+                # The lock works in the long spelling of the root and lists every path in it, while $env:TEMP is the 8.3 short form on a
+                # CI runner (C:\Users\RUNNER~1\...), which would make the open: filter below drop every line the lock returned.
+                $root = Get-DarlingCanonicalPath $root
                 Set-Content -LiteralPath "$root\plain.dll" -Value 'x'
                 Set-Content -LiteralPath "$root\sub\inner.dll" -Value 'x'
                 Set-Content -LiteralPath "$outsideDir\linked.dll" -Value 'x'
@@ -2041,7 +2059,7 @@ public void TheInstallTreeLock_GivesAdministratorsTheOwnerOfPlainFilesAndFolders
                 'elevated=' + ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 
                 $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
-                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } else { 'openElsewhere:' + $line } }
                 'linkedListed=' + @($open | Where-Object { $_ -like '*linked.dll*' }).Count
                 'owner.linkedInside=' + ((Get-OwnerValue "$root\sub\linked.dll") -eq $me.Value)
                 'owner.linkedOutside=' + ((Get-OwnerValue "$outsideDir\linked.dll") -eq $me.Value)
@@ -2069,20 +2087,20 @@ public void TheInstallTreeLock_GivesAdministratorsTheOwnerOfPlainFilesAndFolders
         }
 
         AssertProbeSetupTook(answers);
-        Assert.Contains("owner.linkedInside=True", answers);
-        Assert.Contains("owner.linkedOutside=True", answers);
+        AssertAnswer(answers, "owner.linkedInside=True");
+        AssertAnswer(answers, "owner.linkedOutside=True");
         if (answers.Contains("elevated=True"))
         {
-            Assert.Contains("linkedListed=1", answers);
-            Assert.Contains(answers, a => a.StartsWith("open:\\sub\\linked.dll (has 2 names (a hard link)", StringComparison.Ordinal));
+            AssertAnswer(answers, "linkedListed=1");
+            AssertAnswer(answers, a => a.StartsWith("open:\\sub\\linked.dll (has 2 names (a hard link)", StringComparison.Ordinal), "that starts with 'open:\\sub\\linked.dll (has 2 names (a hard link)'");
             foreach (var leaf in new[] { "", "\\sub", "\\plain.dll", "\\sub\\inner.dll" })
             {
-                Assert.Contains($"adminOwner[{leaf}]=True", answers);
+                AssertAnswer(answers, $"adminOwner[{leaf}]=True");
             }
         }
         else
         {
-            Assert.Contains(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv)", StringComparison.Ordinal));
+            AssertAnswer(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv)", StringComparison.Ordinal), "that starts with 'open:' and names SeTakeOwnershipPrivilege and SeBackupPrivilege");
         }
     }
 
@@ -2311,18 +2329,25 @@ public void TheInstallTreeLock_LeavesAnOutsideFolderAlone_AndListsANameEndingInA
             $admins = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinAdministratorsSid, $null)
             try {
                 New-Item -ItemType Directory -Path $root, $outsideDir -Force | Out-Null
+                # The lock works in the long spelling of the root and lists every path in it, while $env:TEMP is the 8.3 short form on a
+                # CI runner (C:\Users\RUNNER~1\...), which would make the open: filter below drop every line the lock returned.
+                $root = Get-DarlingCanonicalPath $root
                 Set-Content -LiteralPath "$outsideDir\file" -Value 'x'
                 Set-Content -LiteralPath "$root\dn" -Value 'x'
                 [IO.File]::WriteAllText("\\?\$root\dn.", 'x')
                 & cmd.exe /c mklink /J "$root\a" $outsideDir | Out-Null
-                foreach ($p in @("$outsideDir\file", "$root\dn")) { $null = & icacls.exe $p /setowner "*$($me.Value)" /L /Q 2>&1 }
+                # Every file this probe checks is given the current account as its owner first. A file made by an elevated administrator
+                # is owned by Administrators from the start, so without this the check that the lock left dn. alone would pass or fail on
+                # who created it. dn. is reached with a \\?\ path, which Windows does not fold into dn (icacls and Get-Acl both honour it).
+                foreach ($p in @("$outsideDir\file", "$root\dn", "\\?\$root\dn.")) { $null = & icacls.exe $p /setowner "*$($me.Value)" /L /Q 2>&1 }
                 'setup.bothNamesListed=' + ((((@(Get-ChildItem -LiteralPath $root -Force | ForEach-Object Name) | Sort-Object) -join '|')) -eq 'a|dn|dn.')
-                'setup.ownersSet=' + ((Get-OwnerValue "$outsideDir\file") -eq $me.Value)
+                'setup.ownersSet=' + (((Get-OwnerValue "$outsideDir\file") -eq $me.Value) -and ((Get-OwnerValue "$root\dn") -eq $me.Value) -and ((Get-OwnerValue "\\?\$root\dn.") -eq $me.Value))
                 $open = @(Lock-DarlingInstallTree $root 'NT SERVICE\TrustedInstaller')
-                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } }
+                foreach ($line in $open) { if ($line.StartsWith($root, [StringComparison]::OrdinalIgnoreCase)) { 'open:' + $line.Substring($root.Length) } else { 'openElsewhere:' + $line } }
                 'owner.outsideFile=' + ((Get-OwnerValue "$outsideDir\file") -eq $me.Value)
                 'adminOwner[dn]=' + ((Get-OwnerValue "$root\dn") -eq $admins.Value)
                 'adminOwner[dn.]=' + ((Get-OwnerValue "\\?\$root\dn.") -eq $admins.Value)
+                'ownerNow[dn]=' + (Get-OwnerValue "$root\dn") + ' ownerNow[dn.]=' + (Get-OwnerValue "\\?\$root\dn.") + ' me=' + $me.Value + ' admins=' + $admins.Value
             }
             finally { foreach ($dir in @($root, $outsideDir)) { Remove-ProbeDirectory $dir } }
             """);
@@ -2330,18 +2355,18 @@ public void TheInstallTreeLock_LeavesAnOutsideFolderAlone_AndListsANameEndingInA
         var answers = RunProbeInShell(shell, probe.ToString());
 
         AssertProbeSetupTook(answers);
-        Assert.Contains("owner.outsideFile=True", answers);
-        Assert.Contains("adminOwner[dn.]=False", answers);
-        Assert.Contains(answers, a => a.StartsWith("open:\\a (a junction or link)", StringComparison.Ordinal));
+        AssertAnswer(answers, "owner.outsideFile=True");
+        AssertAnswer(answers, "adminOwner[dn.]=False");
+        AssertAnswer(answers, a => a.StartsWith("open:\\a (a junction or link)", StringComparison.Ordinal), "that starts with 'open:\\a (a junction or link)'");
         if (answers.Contains("elevated=True"))
         {
-            Assert.Contains("adminOwner[dn]=True", answers);
-            Assert.Contains(answers, a => a.StartsWith("open:\\dn. (its name ends in a dot or a space", StringComparison.Ordinal));
+            AssertAnswer(answers, "adminOwner[dn]=True");
+            AssertAnswer(answers, a => a.StartsWith("open:\\dn. (its name ends in a dot or a space", StringComparison.Ordinal), "that starts with 'open:\\dn. (its name ends in a dot or a space'");
         }
         else
         {
-            Assert.Contains("adminOwner[dn]=False", answers);
-            Assert.Contains(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv); a policy may have removed them from Administrators", StringComparison.Ordinal));
+            AssertAnswer(answers, "adminOwner[dn]=False");
+            AssertAnswer(answers, a => a.StartsWith("open:", StringComparison.Ordinal) && a.Contains("SeTakeOwnershipPrivilege and SeBackupPrivilege (see whoami /priv); a policy may have removed them from Administrators", StringComparison.Ordinal), "that starts with 'open:' and names SeTakeOwnershipPrivilege and SeBackupPrivilege");
         }
     }
 
@@ -2569,7 +2594,29 @@ private static void AssertProbeSetupTook(IReadOnlyCollection<string> answers)
         var setup = answers.Where(l => l.StartsWith("setup.", StringComparison.Ordinal)).ToList();
         Assert.True(setup.Count > 0, "the probe printed no setup.* marker, so nothing shows its owner or ACE setup took:\n" + string.Join("\n", answers));
         var failed = setup.Where(l => !l.EndsWith("=True", StringComparison.Ordinal)).ToList();
-        Assert.True(failed.Count == 0, "the probe's own setup did not take (a test-environment problem, not a product result): " + string.Join(", ", failed));
+        Assert.True(failed.Count == 0, "the probe's own setup did not take (a test-environment problem, not a product result): " + string.Join(", ", failed) + "\nevery answer:\n" + string.Join("\n", answers));
+    }
+
+    /// <summary>
+    /// A probe answer is required, and a failure prints every answer the probe gave (xunit's own message shows the first five and
+    /// cuts the rest), so a failed CI run shows the whole list.
+    /// </summary>
+    private static void AssertAnswer(IReadOnlyCollection<string> answers, string exact)
+    {
+        Assert.True(answers.Contains(exact), $"expected the answer '{exact}'; every answer:\n" + string.Join("\n", answers));
+    }
+
+    /// <summary>The same for an answer found by a predicate; <paramref name="expected"/> says what it looks for.</summary>
+    private static void AssertAnswer(IReadOnlyCollection<string> answers, Func<string, bool> match, string expected)
+    {
+        Assert.True(answers.Any(match), $"expected an answer {expected}; every answer:\n" + string.Join("\n", answers));
+    }
+
+    /// <summary>The count of answers a predicate matches must be exactly <paramref name="count"/>; a failure prints every answer.</summary>
+    private static void AssertAnswerCount(IReadOnlyCollection<string> answers, Func<string, bool> match, int count, string what)
+    {
+        var found = answers.Count(match);
+        Assert.True(found == count, $"expected {count} answer(s) {what}, found {found}; every answer:\n" + string.Join("\n", answers));
     }
 
     /// <summary>