feat(scanner): validate elevated live automation

docs/DECISIONS.md

@@ -15,6 +15,7 @@ This document contains Architecture Decision Records.
 | ADR-007 | Measure OCR accuracy with a labeled eval harness before reworking the scanner | Accepted | 2026-07-05 |
 | ADR-008 | Replace the PowerShell input/capture helper with a C# sidecar | Accepted | 2026-07-05 |
 | ADR-009 | Resolution-anchored layout profiles and OCR preprocessing over color detection | Accepted | 2026-07-05 |
+| ADR-010 | Elevated dev runner and bounded live automation probes | Accepted | 2026-07-07 |
 
 ## ADR-001: Build A Local Electron App First
 
@@ -235,3 +236,53 @@ validated against the ADR-007 eval harness.
   insufficient.
 - Non-16:9 or non-borderless setups are explicitly unsupported for the auto
   scanner; the app should detect and warn rather than silently misread.
+
+## ADR-010: Elevated Dev Runner And Bounded Live Automation Probes
+
+### Status
+
+Accepted
+
+### Context
+
+Automatic grid scanning needs read-only mouse movement, click, and wheel input
+to reach the focused Genshin window. A lower-integrity app can fail to deliver
+input to an elevated or protected target because of Windows UIPI/integrity
+boundaries. During live testing, `npm run dev:admin` originally printed that a
+new Administrator window was started, but the elevated PowerShell received no
+arguments, so the intended dev process did not reliably start.
+
+The project also needed a smaller live validation path than a full inventory
+scan. A full scan is too risky as the first proof of input delivery because it
+can click many tiles before a bad coordinate, focus issue, or blocked input is
+understood.
+
+### Decision
+
+Keep automatic scan input automation read-only and require an elevated runtime
+when Windows reports that automation would otherwise be blocked. Replace the
+old `dev-admin.cmd` entry with `scripts/dev-admin.ps1`, quote the elevated
+PowerShell arguments explicitly, and log elevated startup to
+`outputs/admin-start/admin-dev.log`.
+
+Add dev-only HTTP checks:
+
+- `/automation/probe-click?index=N` or `?row=R&col=C` performs one safe
+  inventory selection click and verifies whether the detail panel changed.
+- `/scanner/start?limit=N` sends a temporary scan-limit payload to the renderer,
+  so live auto-scan validation can start with two items instead of the UI
+  default.
+
+Document the workflow in [AUTOMATION_LIVE_SCAN.md](AUTOMATION_LIVE_SCAN.md).
+
+### Consequences
+
+- The user still has to approve Windows UAC manually; the app must not try to
+  click the Secure Desktop prompt.
+- We can distinguish input delivery from OCR/parser quality with a one-click
+  probe before running any broader scan.
+- Live validation now has a low-risk path: check elevation and Genshin
+  detection, run a single probe click, then run a bounded `limit=2` scan.
+- The implementation remains inside the allowed safety boundary: no memory
+  reads, hooks, injection, game-file modification, deleting, feeding, enhancing,
+  locking/unlocking, or spending resources.