--install-service/--remove-service on Windows no longer fail with 'Access is denied' from a normal shell: the process re-runs itself via ShellExecuteEx 'runas', waits for the elevated child and mirrors its exit code. The child gets --elevated-child and pauses for a keypress so its console output stays readable. Declining the prompt reports 'UAC prompt declined'.