feat(packaging): the Store package declares what the NSIS scripts do

A test-signed install of the MSIX build, in the WindowsApps folder a Store
install uses, showed that every script-made piece of the NSIS model breaks
there, because each names the install folder and every update deletes it:
the firewall rules went stale, the PATH entries piled up pointing at deleted
folders, and the Startup-folder .vbs was refused ("Permission denied") right
after sign-in. The network capabilities the manifest declared covered
nothing: they make rules for sandboxed apps only, and a listener in the
package still got the Windows firewall prompt. The package's own startup
task was on by default, started the node whatever mode the Node page said,
and ran the console executable, whose window stopped the node when closed.

The package now declares what Windows then creates at install, carries
across updates and removes with the app, all without an administrator
prompt (each measured on the real install, through an update and a reboot):

- firewall rules for the node, in a custom manifest template, since only a
  package-level element can hold them;
- the startup task, off by default, running meshbay-nodew.exe, a new build
  of the daemon without a console;
- an execution alias for meshbay-node.exe, so the app adds no PATH entry.

The node's CLI switches the startup task (platform.startup_task, ctypes over
the WinRT ABI): Windows gives the package's identity to the executables in
it, not to a powershell.exe the app starts, which got "Element not found".
`meshbay-node autostart install | remove | status` therefore works in the
Store package from the app and a terminal alike; the app caches the answer,
since the Node page polls. Starting at boot stays the .exe installer's: the
Store package offers no service mode, and the CLI refuses `service install`
there. Process listings count both image names.

The Node page's status poll cleared the message of a refused action within
five seconds; the two errors are kept apart now (all Windows builds).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

11 files changed, 23 insertions, 6 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index f3c3b79..c512fe5 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -942,6 +942,7 @@ export default {
   'node.startup_mode_service': 'Als Hintergrunddienst (startet beim Booten)',
   'node.startup_mode_updating': 'Modus wird gewechselt — achten Sie auf eine Administrator-Eingabeaufforderung…',
   'node.startup_mode_service_unavailable_hint': 'Der Hintergrunddienst-Modus erfordert eine installierte Version. Führen Sie zum lokalen Testen "meshbay-node service install" in einer PowerShell mit Administratorrechten aus.',
+  'node.startup_mode_service_store_hint': 'Der Start beim Hochfahren, bevor sich jemand anmeldet, erfordert das MeshBay-Installationsprogramm (.exe) statt der Version aus dem Microsoft Store.',
   'node.not_operator': 'Ihr Node konnte nicht erreicht werden. Stellen Sie sicher, dass er läuft.',
   'node.offline': 'Node ist offline',
   'node.retry': 'Erneut versuchen',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 013a2a5..f5b3808 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -1041,6 +1041,7 @@ export default {
   'node.startup_mode_service': 'As a background service (starts at boot)',
   'node.startup_mode_updating': 'Switching mode — check for an administrator prompt…',
   'node.startup_mode_service_unavailable_hint': 'Background service mode needs an installed build. For local testing, run "meshbay-node service install" from an elevated PowerShell.',
+  'node.startup_mode_service_store_hint': 'Starting at boot, before anyone signs in, needs the MeshBay installer (.exe) rather than the Microsoft Store version.',
   'node.offline': 'Node is offline',
   'node.no_groups': 'No groups configured on this node.',
   'node.retry': 'Retry',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 284f454..6e152fb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -936,6 +936,7 @@ export default {
   'node.startup_mode_service': 'Como servicio en segundo plano (se inicia al arrancar)',
   'node.startup_mode_updating': 'Cambiando de modo — compruebe si aparece un aviso de administrador…',
   'node.startup_mode_service_unavailable_hint': 'El modo de servicio en segundo plano requiere una versión instalada. Para pruebas locales, ejecute "meshbay-node service install" desde una PowerShell con privilegios de administrador.',
+  'node.startup_mode_service_store_hint': 'Iniciar al arrancar, antes de que nadie inicie sesión, requiere el instalador de MeshBay (.exe) en lugar de la versión de Microsoft Store.',
   'node.not_operator': 'No se pudo contactar con su node. Asegúrese de que esté en ejecución.',
   'node.offline': 'Node sin conexión',
   'node.retry': 'Reintentar',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index 4554ffb..40c7501 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -939,6 +939,7 @@ export default {
   'node.startup_mode_service': 'Comme service en arrière-plan (démarre au boot)',
   'node.startup_mode_updating': 'Changement de mode — vérifiez une invite d\'administrateur…',
   'node.startup_mode_service_unavailable_hint': 'Le mode service en arrière-plan nécessite une version installée. Pour un test local, exécutez "meshbay-node service install" depuis un PowerShell administrateur.',
+  'node.startup_mode_service_store_hint': 'Démarrer au boot, avant toute ouverture de session, nécessite l\'installeur MeshBay (.exe) plutôt que la version du Microsoft Store.',
   'node.not_operator': 'Impossible de joindre votre node. Vérifiez qu\'il est en cours d\'exécution.',
   'node.offline': 'Node hors ligne',
   'node.retry': 'Réessayer',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index bc091e3..29a1f5d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -938,6 +938,7 @@ export default {
   'node.startup_mode_service': 'Come servizio in background (si avvia all\'avvio del sistema)',
   'node.startup_mode_updating': 'Cambio modalità — controlli se compare una richiesta di amministratore…',
   'node.startup_mode_service_unavailable_hint': 'La modalità servizio in background richiede una build installata. Per test locali, eseguire "meshbay-node service install" da un PowerShell con privilegi di amministratore.',
+  'node.startup_mode_service_store_hint': 'L\'avvio all\'accensione, prima che qualcuno acceda, richiede il programma di installazione di MeshBay (.exe) anziché la versione del Microsoft Store.',
   'node.not_operator': 'Impossibile raggiungere il suo node. Si assicuri che sia in esecuzione.',
   'node.offline': 'Node non in linea',
   'node.retry': 'Riprova',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 0522f4c..4cb4787 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -926,6 +926,7 @@ export default {
   'node.startup_mode_service': 'バックグラウンドサービスとして（起動時に開始）',
   'node.startup_mode_updating': 'モードを切り替え中 — 管理者の確認ダイアログをご確認ください…',
   'node.startup_mode_service_unavailable_hint': 'バックグラウンドサービスモードにはインストール済みのビルドが必要です。ローカルでテストする場合は、管理者権限の PowerShell で "meshbay-node service install" を実行してください。',
+  'node.startup_mode_service_store_hint': 'サインイン前の起動時に開始するには、Microsoft Store 版ではなく MeshBay インストーラー (.exe) が必要です。',
   'node.not_operator': 'node に接続できませんでした。node が実行中であることをご確認ください。',
   'node.offline': 'Node はオフラインです',
   'node.retry': '再試行',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index b258b04..926fadf 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -940,6 +940,7 @@ export default {
   'node.startup_mode_service': 'Als achtergrondservice (start bij het opstarten)',
   'node.startup_mode_updating': 'Modus wijzigen — let op een beheerdersprompt…',
   'node.startup_mode_service_unavailable_hint': 'Achtergrondservice-modus vereist een geïnstalleerde build. Voer voor lokaal testen "meshbay-node service install" uit vanuit een PowerShell met beheerdersrechten.',
+  'node.startup_mode_service_store_hint': 'Starten bij het opstarten, voordat iemand zich aanmeldt, vereist het MeshBay-installatieprogramma (.exe) in plaats van de Microsoft Store-versie.',
   'node.not_operator': 'Uw node is niet bereikbaar. Controleer of hij draait.',
   'node.offline': 'Node is offline',
   'node.retry': 'Opnieuw proberen',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index a750c2f..2f3a28c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -958,6 +958,7 @@ export default {
   'node.startup_mode_service': 'Jako usługa w tle (uruchamia się przy starcie systemu)',
   'node.startup_mode_updating': 'Zmiana trybu — proszę sprawdzić, czy pojawiło się okno uprawnień administratora…',
   'node.startup_mode_service_unavailable_hint': 'Tryb usługi w tle wymaga zainstalowanej wersji. Aby przetestować lokalnie, uruchom "meshbay-node service install" w PowerShell z uprawnieniami administratora.',
+  'node.startup_mode_service_store_hint': 'Uruchamianie przy starcie systemu, zanim ktokolwiek się zaloguje, wymaga instalatora MeshBay (.exe) zamiast wersji ze sklepu Microsoft Store.',
   'node.not_operator': 'Nie udało się połączyć z Pana/Pani node. Upewnij się, że działa.',
   'node.offline': 'Node jest niedostępny',
   'node.retry': 'Ponów',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index bd91cee..faacbf6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -937,6 +937,7 @@ export default {
   'node.startup_mode_service': 'Como serviço em segundo plano (inicia na inicialização)',
   'node.startup_mode_updating': 'Alternando modo — verifique se aparece um aviso de administrador…',
   'node.startup_mode_service_unavailable_hint': 'O modo de serviço em segundo plano requer uma versão instalada. Para testes locais, execute "meshbay-node service install" em um PowerShell com privilégios de administrador.',
+  'node.startup_mode_service_store_hint': 'Iniciar com o sistema, antes de qualquer login, exige o instalador do MeshBay (.exe) em vez da versão da Microsoft Store.',
   'node.not_operator': 'Não foi possível alcançar seu node. Verifique se ele está em execução.',
   'node.offline': 'Node está off-line',
   'node.retry': 'Tentar novamente',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index d7b0aeb..232a4ca 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -914,6 +914,7 @@ export default {
   'node.startup_mode_service': '作为后台服务（开机时启动）',
   'node.startup_mode_updating': '正在切换模式 — 请留意管理员权限提示…',
   'node.startup_mode_service_unavailable_hint': '后台服务模式需要已安装的版本。如需本地测试，请在具有管理员权限的 PowerShell 中运行 "meshbay-node service install"。',
+  'node.startup_mode_service_store_hint': '在任何人登录之前随系统启动，需要使用 MeshBay 安装程序 (.exe)，而不是 Microsoft Store 版本。',
   'node.not_operator': '无法连接到您的 node。请确保它正在运行。',
   'node.offline': 'Node 已离线',
   'node.retry': '重试',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/node-page.js b/packages/meshbay-hub/src/meshbay_hub/static/node-page.js
index 04f4abc..11cd07e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/node-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/node-page.js
@@ -25,15 +25,20 @@ export function pairedFrom(result) {
 function NodeServicePanel({ onChanged, token, username }) {
   const [info, setInfo] = useState(null);
   const [busy, setBusy] = useState('');
-  const [err, setErr] = useState('');
+  // Two errors, not one: the status poll below cleared the message of an
+  // action that had just been refused, within five seconds and often before
+  // it was read (found switching startup mode on a real Store install).
+  const [pollErr, setPollErr] = useState('');
+  const [actErr, setActErr] = useState('');
+  const err = actErr || pollErr;
 
   const refresh = useCallback(async () => {
     try {
       const r = await platform.node.service.status();
       setInfo(r);
-      setErr('');
+      setPollErr('');
     } catch (e) {
-      setErr(platform.bridgeMessage(e));
+      setPollErr(platform.bridgeMessage(e));
     }
   }, []);
 
@@ -46,13 +51,13 @@ function NodeServicePanel({ onChanged, token, username }) {
 
   const act = useCallback(async (name, fn) => {
     setBusy(name);
-    setErr('');
+    setActErr('');
     try {
       await fn();
       await refresh();
       if (onChanged) onChanged();
     } catch (e) {
-      setErr(platform.bridgeMessage(e));
+      setActErr(platform.bridgeMessage(e));
     } finally {
       setBusy('');
     }
@@ -162,7 +167,9 @@ function NodeServicePanel({ onChanged, token, username }) {
         ${busy === 'startupMode' && html`
           <p class="settings-hint">${t('node.startup_mode_updating')}</p>`}
         ${!info.canElevate && html`
-          <p class="settings-hint">${t('node.startup_mode_service_unavailable_hint')}</p>`}
+          <p class="settings-hint">${t(info.store
+            ? 'node.startup_mode_service_store_hint'
+            : 'node.startup_mode_service_unavailable_hint')}</p>`}
       `}
     </div>`;
 }