diff --git a/.github/workflows/build-client.yml b/.github/workflows/build-client.yml
index 2a71a56..34b8c2b 100644
--- a/.github/workflows/build-client.yml
+++ b/.github/workflows/build-client.yml
@@ -336,6 +336,39 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # 临时诊断：rustup 写 C:\Users\admin\.rustup\tmp 被拒（os error 5），但同一个
+      # 账户在交互式会话里写得进去 —— 先让 job 自己说清楚"我是谁、哪种完整性级别、
+      # 哪些目录写得进去"。查完这一段就删。
+      - name: 诊断（临时，查完删）
+        shell: pwsh
+        run: |
+          "whoami          = $(whoami)"
+          "integrity       = $((whoami /groups | Select-String -Pattern 'Mandatory Label') -join ' ')"
+          "USERPROFILE     = $env:USERPROFILE"
+          "HOME            = $env:HOME"
+          "TEMP / TMP      = [$env:TEMP] / [$env:TMP]"
+          "TMPDIR          = [$env:TMPDIR]"
+          "RUSTUP_HOME     = [$env:RUSTUP_HOME]   CARGO_HOME = [$env:CARGO_HOME]"
+          "user-level TEMP = $([Environment]::GetEnvironmentVariable('TEMP','User'))"
+          $targets = @(
+            "$env:USERPROFILE\.rustup\tmp",
+            "$env:USERPROFILE\.cargo",
+            "$env:USERPROFILE\.cargo\registry",
+            'C:\Users\admin\runner\windows',
+            'C:\Users\admin\runner\windows\cache',
+            (Join-Path (Split-Path -Parent $env:GITHUB_WORKSPACE) 'ci-probe')
+          )
+          foreach ($p in $targets) {
+            $verdict = 'OK'
+            try {
+              New-Item -ItemType Directory -Force -Path $p -ErrorAction Stop | Out-Null
+              $f = Join-Path $p 'probe.txt'
+              Set-Content -Path $f -Value 'x' -ErrorAction Stop
+              Remove-Item $f -Force -ErrorAction SilentlyContinue
+            } catch { $verdict = "FAIL: $($_.Exception.Message)" }
+            "{0,-46} {1}" -f $verdict, $p
+          }
+
       # 宿主模式的 Windows runner 上，PATH 里的 `bash` 是 C:\Windows\System32\bash.exe
       # —— WSL 的启动器，而 WSL 在 runner 账户下起不来，报 E_ACCESSDENIED（日志里是
       # 一串 GBK 被当 UTF-8 解出来的乱码 + https://github.com/microsoft/WSL/issues）。