update-windows

Four phases: inventory, apps, Windows Update, report. Two invariants shape every step. A machine-wide installer run from a non-elevated session raises its own UAC prompt, so twenty pending apps means twenty prompts; elevating one parent process once makes every installer inherit the token and costs one prompt. And nothing is rebooted, uninstalled, or silently skipped without the user saying so first.

Gate

Stop unless the host is Windows and winget --version answers. On a non-Windows host, or when winget is absent (Server SKUs, stripped images), say so and stop rather than falling back to a package manager the user did not ask for.

Running the snippets

Every snippet below is a PowerShell command containing no single quote, so any shell can pass it verbatim inside single quotes: