Symptoms

K2 Control Pack repair does not perform complete repair when installation account does not have access to K2 designer site though setup manager do not flag any warnings/errors.
 

Diagnoses

Repair of K2 Control Pack requires allowed access for K2 service account an K2 designer app pool accounts to K2 designer site when IIS authorization rules are configured for it.

This is required because controls exist on both the Designer and Runtime web applications, therefore the control pack needs to update both of those. The K2 Designer and K2 Runtime web applications could technically exist on separate servers and therefore would require a repair on both servers.

This access is required to ensure the caches and bundles get refreshed when controls are updated or new controls are registered.

Custom authorization rules configured post installation may prevent the automatic clean-up of the ControlType cache for a designer site. Most of production environments have locked down access to K2 Designer, which is best practice as normally you don't want to do development/design work in production. Unfortunately official K2 KB "How to restrict access to the K2 smartforms Designer using Internet Information Services (IIS)" which explains how to limit access to designer does not mention this requirement at the moment, and only explains that you have to allow access for K2 Designer Application Pool account when running SmartForms 1.0.2 or newer in the very end.
 

Resolution

When configuring IIS Authorization rules for K2 designer site always allow access for K2 service account and K2 Designer Application Pool account to avoid possible issues.