… at InstallInfo write time

Self-serve promotion flipped a manifest optional item's action to install,
so WriteInstallInfo never emitted its optional_installs record and the item
vanished from the software list (and from Featured) the moment a user
clicked Install. PromotedFromOptional now marks promoted/flipped items and
WriteInstallInfo always writes their optional record, with status tracking
the pending action (will-be-installed / will-be-removed) and reverting to
installed / not-installed when the action completes.

The toInstall/toUpdate/toUninstall lists are computed before the install
phase, so the post-session InstallInfo write described items installed
minutes earlier as still pending (installed: true + status:
will-be-installed for VLC). All branches now re-run CheckStatus at write
time and drop pending records whose action already completed.

IconImage is a plain property without change notification; assigning it
after the ObservableCollections were bound left already-rendered rows
iconless. Load icons into the source lists first, then assign.

Log viewer extracted to a shared LogViewerControl (tail, filter,
autoscroll). View Log now opens a flyout anchored to the button by
default; its pop-out button (and Ctrl+L) opens the standalone LogWindow.

LogWindow centered itself with hardcoded 2250x1500 math against a 900x600
window, so on shorter displays Y went negative and it opened above the
visible area. Both windows now center using actual window size offset by
the work area origin and clamped to non-negative coordinates; MainWindow
also caps its initial size to the work area.

…tive

Each MSC click >10s apart spawned its own managedsoftwareupdate process;
the second lost the instance lock and exited code 1, so queued self-serve
installs silently never ran. CimianWatcher now claims a run slot before
consuming a flag file: while a triggered process is alive, new/updated
flag files stay on disk (MSC keeps merging additional --item requests
into them) and are consumed on the first poll after the run exits.

MSC TriggerService no longer counts wait time against its 30s timeout
while a managedsoftwareupdate process is running — the unconsumed flag is
the queued request, not a dead service (it used to delete the queue and
throw).

engine: pending records for promoted self-serve items survive targeted
(--item) writes — a queued item outside the run's filter is still pending
and keeps its managed_installs record, so the Updates list no longer goes
blank after a partial run.

msc: standing self-serve subscriptions no longer render as eternal
'Install pending' on installed items (Software, item detail, My Items);
removal requests only show pending while the item is installed. My Items
also loads icons before binding.

It was registered transient: MainWindow held one instance, but every page
navigation constructed a fresh one via App.GetService — created AFTER the
operation-started event fired, so a newly navigated Updates page saw
IsInstalling=false and showed stale content while an install ran silently.
Each throwaway instance also left its service event subscriptions behind.
Shell state (progress overlay, badges, navigation requests) is app-wide;
register it once.

…cel, categories grid

Engine streams itemStatus messages over the status connection (new 'item'
field): pending -> downloading -> downloaded -> installing -> installed,
plus removing/removed/failed. The status TCP stream is now duplex — the
reporter runs a command read loop and the GUI's stop command cancels the
run gracefully before the next item (previously SendCommandAsync was a
silent no-op).

Updates page: the full-page takeover overlay is replaced by a compact
progress banner; the item list stays visible underneath with a live stage
indicator per row (spinner while downloading/installing/removing, glyph +
color for terminal states). View Log stays accessible during a run and
the banner has a Cancel button that clears a queued flag file and stops a
running session. Items the engine reports that aren't in the list yet get
synthetic rows so a fresh self-serve click shows progress immediately.
UpdatesViewModel is a singleton so navigation keeps mid-run stage state.
InstallableItem implements INotifyPropertyChanged for LiveStage only.

Categories page: rows become fixed-width wrapping grid cards.

…ly per-item pending stage; MSI uninstall idempotency

Streams a failure reason (parsed exit code, common MSI codes glossed) on the itemStatus pipe and writes problem_items into InstallInfo.yaml. Emits an early pending stage per targeted item so GUI rows show progress from t=0. Treats msiexec 1605/1614 (already-absent product) as idempotent removal success.

…ebug filter

Updates tab shows self-serve install-requested items and renders each problem's error inline on its row (orphans only in the standalone section). My Items shows Remove for installed items, Cancel for pending. Progress banner verb-aware (Removing vs Installing). Self-serve manifest raises RequestsChanged so a cancel clears Updates immediately. Log viewer hides DEBUG by default with a Show debug toggle, plus a Copy button. Adds tests/gui-harness for headless drive of the install/remove path.

When an item reaches installed/removed, its row lingers on the Updates page with the green check instead of vanishing the instant InstallInfo is rewritten. Excluded from the pending count and Install Now targets; cleared on explicit re-check or when navigating away from the page.

Engine:
- configurable --status-port (default 19847); MSC uses 19848 so the
  login-window CimianStatus listener can no longer collide with MSC
- emit terminal itemStatus for an already-satisfied --item so the GUI
  confirms instead of sitting empty

MSC:
- single "--item A B C" arg form; repeated --item flags crashed the
  engine's sequence option ("defined multiple times", exit 1) and
  stranded multi-item self-serve batches
- surface self-serve removals live (symmetric to installs) so Remove
  shows under Pending Removals immediately with real name/version/icon
- enrich synthetic live-progress rows from InstallInfo; reclassify a
  removal mis-filed under installs via the generic pending stage
- per-row progress for --item runs vs global banner for broad runs
- TriggerService waits for the engine process to exit and clears the
  running state, so a run that never signals completion can't leave
  the GUI stuck on Stop
- drop the modal install/removal error dialog; failures show inline on
  the row and under Problem Items

- ITriggerService: correct --item doc to single-flag form (--item A B)
- InstallerService: dispose registry base keys (handle leak on uninstall)
- UpdatesViewModel: guard async-void progress handler with try/catch
- Converters: cache ItemStageConverter brushes (avoid per-call alloc)
- MscHarness: emit single --item flag so multi-item runs don't exit 1

PowerShell renders Write-Error to stderr with a prefix (and Windows
PowerShell echoes the command, doubling the marker on the line) plus ANSI
color codes under pwsh. The start-anchored regex never matched a marker
emitted via stderr. Strip ANSI and walk to the last marker occurrence on
the line so stderr-emitted warnings are captured like stdout ones.

…shal