Pass the app's log level into the elevated run

client/internal/daemonaddr/identity.go

@@ -4,11 +4,14 @@ import "strings"
 
 // CarriesIdentity reports whether the control channel at addr conveys the
 // connecting process's identity to the daemon. A Unix socket carries peer
-// credentials and a named pipe carries the client's token; loopback TCP carries
-// neither, so on such an address the daemon cannot authorize a privileged
-// operation for anybody. A client uses this to tell whether becoming privileged
-// would get it anywhere: on an identity-less address it would not, and the only
-// way forward is to move the daemon onto one that carries identity.
+// credentials and a named pipe carries the client's token. Nothing else does, TCP
+// included, and there the daemon can authorize a privileged operation for nobody
+// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
+// Windows daemon on the address it served before it had a pipe.
+//
+// A client uses this to tell whether becoming privileged would get it anywhere.
+// It answers from the scheme and nothing else, so an address it does not
+// recognise counts as carrying no identity.
 func CarriesIdentity(addr string) bool {
 	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
 }