You must install .net 3.5.
It isn't required for AppController, but you do need it for the patch. Without it, KB2887822 starts and just disappears.
To discover this hidden requirement, you can enable command line debugging on the patch.
msiexec.exe /p (path_to_patch) /l*v (path_to_log)
This will run and fail, but you'll now have a log. Fire up your favorite text editor and open the log. Do a search for "Value 3" (which, by the way, will appear a few lines after every error in an installation log) and you should see something like this:
MSI (s) (40:00) [15:05:06:499]: Hello, I'm your 64bit Elevated custom action server.
SFXCA: Extracting custom action to temporary directory: C:\Windows\Installer\MSI6EF4.tmp-\
SFXCA: Failed to get requested CLR info. Error code 0x80131700
SFXCA: Ensure that the proper version of the .NET Framework is installed, or that there is a matching supportedRuntime element in CustomAction.config. If you are binding to .NET 4 or greater add useLegacyV2RuntimeActivationPolicy=true to the
CustomAction FixArpRegistryKeyPermissions returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (40:7C) [15:05:06:530]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (40:7C) [15:05:06:530]: User policy value 'DisableRollback' is 0
MSI (s) (40:7C) [15:05:06:530]: Machine policy value 'DisableRollback' is 0
Action ended 15:05:06: InstallFinalize. Return value 3.
I had .net 4.5 installed, so it was obvious that I needed .net 3.5.
Very poor design that the installer didn't require it, but the patch did, and neither gave me an error when it wasn't there.
Once installed, I was able to apply the patch and continue my upgrade.