docs: DOWNLOADS-MANIFEST 0.3.6 TBD + VM-DUAL-SHIP-CHECKLIST + CERT spacing

Manifest placeholders until signed upload; printable VM A/B/C sheet.
2026-10-14 00:20:58 -04:00 · 2026-10-14 00:20:58 -04:00 · 042342bd69
commit 042342bd69
parent dcee1918dc
8 changed files with 229 additions and 17 deletions
--- a/docs/COMMERCIAL-INSTALLER-BACKLOG.md
+++ b/docs/COMMERCIAL-INSTALLER-BACKLOG.md
@ -34,6 +34,8 @@ Repo now includes **authoring/docs scaffolds** for the two commercial gaps that
 | Site product string → **0.3.6**; manifest header notes HelperVersion vs last-published 0.3.2 | Do **not** claim Authenticode / notary / dual-ship / thin-NSIS complete |
 | [`.github/workflows/windows-msi.yml`](../.github/workflows/windows-msi.yml) unsigned MSI on `windows-latest` + artifact upload | Wire org secrets and enable sign step; publish signed assets to site |
 | [`ci-notarize.yml.example`](../platform/macos/menubar/ci-notarize.yml.example) menubar GHA/Forgejo sketch (unsigned default; secret names) | Promote example → live workflow; automate `build-menubar-app.sh` sign when `SIGNING_ENV` set |
+| **0.3.6 Windows NSIS+MSI placeholder rows** ([`DOWNLOADS-MANIFEST.txt`](../site/printit.verae.ai/DOWNLOADS-MANIFEST.txt) + [`DOWNLOADS-MANIFEST.md`](../site/printit.verae.ai/DOWNLOADS-MANIFEST.md); sha256 **TBD**) | Build/upload signed 0.3.6 blobs; replace TBD with real digests |
+| **Printable VM A/B/C sheet** [`VM-DUAL-SHIP-CHECKLIST.md`](../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) | Operator sign-off on clean VMs (C blocked until CAs uncommented) |

 **Still use for day-to-day presence (no WiX / no Apple certs):**  
 Windows `scripts/build-tray-startmenu.ps1` + `install-tray-startup.ps1`; macOS `verae-print menubar --install` / unsigned `build-menubar-app.sh`. Full product install remains NSIS (`installer-windows.nsi`) and macOS `pkg/build-pkg.sh`. Optional: `build-tray-msi.ps1` (WiX tip exit 0); `build-full-msi.ps1` (needs WiX; exit 1 if missing).
@ -69,6 +71,8 @@ Related but out of scope for “done” above (still backlog-adjacent): Linux `.
 | **WiX full elevated MSI** (StageFull driver) | [`Product-Full.wxs`](../platform/windows/wix/Product-Full.wxs) + [`scripts/build-full-msi.ps1`](../platform/windows/scripts/build-full-msi.ps1) | **Authoring + stage/light path** — MSI when WiX present; unsigned; printer CAs commented stubs; dual-ship NSIS |
 | **CI unsigned full MSI** | [`.github/workflows/windows-msi.yml`](../.github/workflows/windows-msi.yml) | **Live workflow** — WiX install → `build-full-msi.ps1` → unsigned artifact; sign step commented (secret names only) |
 | **Dual-ship runbook** | [`wix/DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md) | **Docs** — NSIS + MSI clean-VM matrix; CI artifact section; **thin-NSIS exit checklist** (A–E) |
+| **Printable VM checklist** | [`wix/VM-DUAL-SHIP-CHECKLIST.md`](../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) | **Docs** — tick boxes for shared pre-checks + VM A/B/C + side-by-side |
+| **0.3.6 download placeholders** | [`site/.../DOWNLOADS-MANIFEST.md`](../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) + `.txt` TBD rows | **Docs** — NSIS setup + full MSI filenames reserved; digests TBD until publish |
 | Shared version helper | [`platform/windows/scripts/common.ps1`](../platform/windows/scripts/common.ps1) `Get-VeraePackageVersion` | Aligns tray/full MSI/NSIS drivers with `HelperVersion` |
 | End-user Windows readme | [`platform/windows/README-WINDOWS.txt`](../platform/windows/README-WINDOWS.txt), [`README.txt`](../platform/windows/README.txt) | Documents NSIS flow; states **no elevated MSI** for tray |
 | Packaging policy doc | [PACKAGING.md](PACKAGING.md) | “**No elevated MSI**” for tray presence by design |
--- a/platform/windows/wix/DUAL-SHIP.md
+++ b/platform/windows/wix/DUAL-SHIP.md
@ -4,7 +4,7 @@

 **Do not** thin or deprecate NSIS until the **thin-NSIS exit criteria checklist** (below) is fully checked — clean-VM gates, live Authenticode, silent/fleet proof, and site cutover (see [COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md), [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md)).

-**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md).
+**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) (printable A/B/C) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md) · site [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) (0.3.6 TBD rows).

 ---

@ -55,6 +55,8 @@ Cross-host NSIS-only: `platform/windows/build-installer.sh` (needs prebuilt Wind

 ## Clean-VM matrix (minimum)

+**Printable tick sheet:** [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) (shared pre-checks + VM A/B/C steps + side-by-side table).
+
 Use two fresh Windows 10/11 **x64** VMs (or reset snapshots). Do **not** mix channels on one machine until Upgrade/ARP coexistence is explicitly tested.

 | VM | Install | Goal |
@ -248,6 +250,8 @@ Do **not** put PFX bytes or passwords in git. Do not upload the PFX as a workflo
 | Stage/light driver | [../scripts/build-full-msi.ps1](../scripts/build-full-msi.ps1) |
 | CI unsigned MSI workflow | [../../../.github/workflows/windows-msi.yml](../../../.github/workflows/windows-msi.yml) |
 | Silent properties | [SILENT_PROPS.md](SILENT_PROPS.md) |
+| Printable VM A/B/C checklist | [VM-DUAL-SHIP-CHECKLIST.md](VM-DUAL-SHIP-CHECKLIST.md) |
 | Sign/notary draft | [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md) |
 | Menubar CI notary example | [../../macos/menubar/ci-notarize.yml.example](../../macos/menubar/ci-notarize.yml.example) |
+| Site 0.3.6 placeholders | [DOWNLOADS-MANIFEST.md](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.md) · [DOWNLOADS-MANIFEST.txt](../../../site/printit.verae.ai/DOWNLOADS-MANIFEST.txt) |
 | Commercial backlog | [docs/COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md) |
--- a/platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md
+++ b/platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md
@ -0,0 +1,124 @@
+# VM dual-ship checklist (printable)
+
+Printable operator sheet for **clean-VM A / B / C** validation while NSIS remains primary and full MSI is dual-ship only. Narrative runbook: [DUAL-SHIP.md](DUAL-SHIP.md). Silent props: [SILENT_PROPS.md](SILENT_PROPS.md).
+
+**HelperVersion:** _____________ (expect **0.3.6** unless `VERSION=` override)  
+**NSIS artifact:** `VeraePrintStamp-windows-_____-_____-setup.exe`  
+**MSI artifact:** `VeraePrintStamp-windows-_____-_____.msi`  
+**Operator / date:** _____________ / _____________  
+**Snapshot IDs:** A _____________  B _____________  C _____________
+
+**Rules**
+
+- One channel per VM until Upgrade/ARP coexistence is an explicit test.
+- Hold / jobId is **not** evidence — receipt/CID only on stamp path.
+- Do **not** thin NSIS until [DUAL-SHIP.md](DUAL-SHIP.md) thin-NSIS exit A–D are all checked.
+- VM **C** stays **blocked** while printer deferred CAs are commented in `Product-Full.wxs`.
+
+---
+
+## Shared pre-checks (every VM)
+
+| # | Step | ☐ |
+|---|------|---|
+| 0.1 | Fresh Win10/11 x64 snapshot (or sysprep-clean); admin account available | ☐ |
+| 0.2 | No prior Verae Print Stamp under Program Files or ARP | ☐ |
+| 0.3 | Spooler running (`Get-Service Spooler`) | ☐ |
+| 0.4 | Note HelperVersion on artifact (NSIS version resource / MSI `ProductVersion`) = tree | ☐ |
+| 0.5 | Record SmartScreen / AV prompts (unsigned expected until Authenticode live) | ☐ |
+
+---
+
+## VM A — NSIS primary (baseline)
+
+**Install:** elevated `setup.exe` (GUI).
+
+| # | Step | Result / notes | ☐ |
+|---|------|----------------|---|
+| A.1 | Run setup.exe elevated; key wizard complete **or** skip per test plan | | ☐ |
+| A.2 | Confirm `Program Files\Verae\PrintStamp\bin\verae-print.exe` + helper | | ☐ |
+| A.3 | Confirm printers (IPP and/or Local Port) present | names: __________ | ☐ |
+| A.4 | Confirm scheduled task **Verae Print Helper** | principal: __________ | ☐ |
+| A.5 | Print one-page PDF → stamp path OK (receipt/CID; never jobId-only) | | ☐ |
+| A.6 | Start Menu: Setup signing key, Start print helper, Collect diagnostics | | ☐ |
+| A.7 | Uninstall via ARP; printers/task removed; reboot optional | | ☐ |
+
+**VM A sign-off:** pass / fail · log path: ___________________________ · initials: _____
+
+---
+
+## VM B — MSI files-only (safe today)
+
+**Install:** full MSI with printers skipped (CAs still commented — do not expect queues).
+
+```bat
+msiexec /i VeraePrintStamp-windows-amd64-0.3.6.msi /qn /norestart ^
+  VERAE_SKIP_KEY_SETUP=1 VERAE_SKIP_PRINTERS=1 VERAE_CHANNEL=zapier
+```
+
+UI install is fine for smoke; `/qn` proves fleet syntax.
+
+| # | Step | Result / notes | ☐ |
+|---|------|----------------|---|
+| B.1 | `msiexec` as above (or UI); exit code recorded | code: _____ | ☐ |
+| B.2 | Confirm InstallDir: `bin\`, `scripts\` (incl. `install-printer.ps1`), LICENSE, README | | ☐ |
+| B.3 | ARP entry: Publisher Verae; DisplayVersion = HelperVersion | | ☐ |
+| B.4 | Start Menu shortcuts resolve to helper / diag | | ☐ |
+| B.5 | Optional: elevated manual `scripts\install-printer.ps1 -InstallDir "…"` (script parity outside CA) | | ☐ |
+| B.6 | `msiexec /x {ProductCode} /qn` — files + Start Menu gone; no orphan `HKLM\Software\Verae\PrintStamp` | | ☐ |
+
+**Pass (files-only):** clean install/uninstall; version match; no reboot required; props accepted.  
+**Fail:** missing StageFull binaries at light time; UpgradeCode collision with tray MSI; unexpected elevation refuse.
+
+**VM B sign-off:** pass / fail · ProductCode: _____________ · initials: _____
+
+---
+
+## VM C — MSI printer CA (still left / blocked until CAs live)
+
+**Prerequisites:** uncomment + schedule deferred CAs in `Product-Full.wxs` (`InstallExecuteSequence` after `InstallFiles`); rebuild MSI.
+
+| # | Step | Result / notes | ☐ |
+|---|------|----------------|---|
+| C.0 | CAs scheduled; conditions `NOT Installed` + `VERAE_SKIP_PRINTERS<>"1"` (install); `REMOVE~="ALL"` (uninstall) | | ☐ |
+| C.1 | Default MSI install (or `VERAE_SKIP_PRINTERS=0`) elevated | | ☐ |
+| C.2 | Program Files layout matches VM A (`bin\`, `scripts\`, docs) | | ☐ |
+| C.3 | IPP loopback `127.0.0.1:8631` and/or Local Port names match NSIS | | ☐ |
+| C.4 | Scheduled task **Verae Print Helper** (same principal / trigger class as A) | | ☐ |
+| C.5 | Start Menu OK; one-page PDF stamp path (receipt/CID evidence) | | ☐ |
+| C.6 | `VERAE_SKIP_PRINTERS=1` skips CA; default installs printers | | ☐ |
+| C.7 | `msiexec /x` removes printers, task, files, Start Menu; no orphan HKLM | | ☐ |
+| C.8 | Repair / same-version upgrade smoke (`AllowSameVersionUpgrades`) | | ☐ |
+
+**Do not** mark dual-ship complete until VM C matches VM A on a clean image.
+
+**VM C sign-off:** pass / fail / **blocked (CAs commented)** · initials: _____
+
+---
+
+## Side-by-side comparison (tick when observed)
+
+| Check | NSIS (A) | MSI files (B) | MSI+CA (C) |
+|-------|:--------:|:-------------:|:----------:|
+| Version = HelperVersion | ☐ | ☐ | ☐ |
+| Program Files layout | ☐ | ☐ | ☐ |
+| Start Menu shortcuts | ☐ | ☐ | ☐ |
+| ARP uninstall clean | ☐ | ☐ | ☐ |
+| IPP + Local Port printers | ☐ | N/A | ☐ |
+| Scheduled task helper | ☐ | N/A | ☐ |
+| Key wizard / first-run key | ☐ | skip prop | ☐ |
+| `msiexec /qn` | N/A | ☐ | ☐ |
+| Authenticode (signtool) | ☐ still left | ☐ still left | ☐ still left |
+
+---
+
+## After the VMs (do not skip)
+
+| Gate | ☐ |
+|------|---|
+| Record logs + exit codes in release notes / dual-ship folder | ☐ |
+| Authenticode still left → SmartScreen warn is **not** promote-ready | ☐ |
+| Update site `DOWNLOADS-MANIFEST` digests only after upload (0.3.6 rows are TBD until then) | ☐ |
+| Thin-NSIS only when DUAL-SHIP exit checklist **A–D** all checked | ☐ |
+
+**Overall dual-ship gate:** open / closed · notes: _______________________________
--- a/site/printit.verae.ai/DOWNLOADS-MANIFEST.md
+++ b/site/printit.verae.ai/DOWNLOADS-MANIFEST.md
@ -0,0 +1,64 @@
+# Downloads manifest — printit.verae.ai
+
+Human-readable companion to [`DOWNLOADS-MANIFEST.txt`](DOWNLOADS-MANIFEST.txt) (SHA256SUMS-style lines for live CDN blobs).
+
+**HelperVersion (source of truth):** `internal/job.HelperVersion` = **0.3.6**  
+**Last-published CDN blobs:** mostly **0.3.2** (Windows amd64 NSIS / macOS / Linux) or **0.1.2** (Windows arm64, `.deb`, bare `.zip`).  
+**Rule:** do not replace a checksum line until the matching artifact is built, signed (when required), uploaded, and the digest verified. `TBD` is intentional — not a shipping claim.
+
+Related: [DUAL-SHIP.md](../../platform/windows/wix/DUAL-SHIP.md) · [VM-DUAL-SHIP-CHECKLIST.md](../../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md) · [COMMERCIAL-INSTALLER-BACKLOG.md](../../docs/COMMERCIAL-INSTALLER-BACKLOG.md).
+
+---
+
+## 0.3.6 — Windows dual-ship (planned; placeholders)
+
+| Artifact | Channel | Role | sha256 | Status |
+|----------|---------|------|--------|--------|
+| `VeraePrintStamp-windows-amd64-0.3.6-setup.exe` | NSIS | **Primary** full-product Windows install (until thin-NSIS exit A–D) | **TBD** | Not built/uploaded |
+| `VeraePrintStamp-windows-arm64-0.3.6-setup.exe` | NSIS | Full-product arm64 setup | **TBD** | Not built/uploaded |
+| `VeraePrintStamp-windows-amd64-0.3.6.msi` | Full MSI | Dual-ship / fleet path (`Product-Full` + `build-full-msi.ps1`) | **TBD** | CI may produce **unsigned** artifact only |
+| `VeraePrintStamp-windows-arm64-0.3.6.msi` | Full MSI | arm64 elevated MSI (when light path supports arch) | **TBD** | Not published |
+| `verae-print-windows-amd64-0.3.6.exe` | Bare helper | Optional companion (parity with 0.3.1/0.3.2 EXE rows) | **TBD** | Not required for dual-ship gate |
+
+**Do not** promote MSI as site primary download until Authenticode + VM C parity + thin-NSIS checklist. Unsigned CI MSI is for clean-VM B smoke only.
+
+### Placeholder lines (copy into `.txt` when ready to fill digests)
+
+```text
+TBD  VeraePrintStamp-windows-amd64-0.3.6-setup.exe
+TBD  VeraePrintStamp-windows-arm64-0.3.6-setup.exe
+TBD  VeraePrintStamp-windows-amd64-0.3.6.msi
+TBD  VeraePrintStamp-windows-arm64-0.3.6.msi
+TBD  verae-print-windows-amd64-0.3.6.exe
+```
+
+After upload:
+
+```bash
+# From the directory that holds the release blobs:
+shasum -a 256 VeraePrintStamp-windows-amd64-0.3.6-setup.exe \
+  VeraePrintStamp-windows-amd64-0.3.6.msi
+# Paste hex digests over TBD in DOWNLOADS-MANIFEST.txt (and this table).
+```
+
+---
+
+## Last-published (live checksums in `.txt`)
+
+| Series | Notes |
+|--------|--------|
+| Windows amd64 NSIS `*-0.3.2-setup.exe` | Live primary setup; sha256 in `.txt` |
+| Windows amd64 bare `verae-print-windows-amd64-0.3.2.exe` | Live companion EXE |
+| macOS `VeraePrintStamp-0.3.2.pkg` / `VeraePrintStamp-macos.pkg` | Live |
+| Linux amd64/arm64 `*-0.3.2.tar.gz` | Live |
+| Windows arm64 / `.deb` / `.zip` | Still **0.1.2** on CDN |
+
+Exact digests: see [`DOWNLOADS-MANIFEST.txt`](DOWNLOADS-MANIFEST.txt).
+
+---
+
+## Operator notes
+
+1. Site product string may say **0.3.6** while CDN still serves **0.3.2** — that lag is documented on `index.html` and here.
+2. Filling TBD without uploading the blob breaks mirror checks; always upload first, hash second, rewrite third.
+3. Dual-ship print checklist for clean VMs: [VM-DUAL-SHIP-CHECKLIST.md](../../platform/windows/wix/VM-DUAL-SHIP-CHECKLIST.md).
--- a/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt
+++ b/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt
@ -34,6 +34,18 @@ drwxr-xr-x 5 marchon marchon     4096 Oct  4 08:19 ..
 # Source of truth (in-tree): internal/job.HelperVersion = 0.3.6
 # Last-published download blobs below remain 0.3.2 (amd64/macOS/Linux) or 0.1.2 (Windows arm64, .deb, .zip).
 # Do not rewrite checksum lines until matching 0.3.6 artifacts are built and uploaded.
+#
+# --- 0.3.6 planned Windows dual-ship (placeholders; not yet on CDN) ---
+# Replace sha256 TBD with real digests only after build + upload. Do not link as primary until signed.
+# NSIS primary (until thin-NSIS exit checklist A–D in platform/windows/wix/DUAL-SHIP.md):
+TBD  VeraePrintStamp-windows-amd64-0.3.6-setup.exe
+TBD  VeraePrintStamp-windows-arm64-0.3.6-setup.exe
+# Full elevated MSI (dual-ship candidate; unsigned CI artifact until Authenticode live):
+TBD  VeraePrintStamp-windows-amd64-0.3.6.msi
+TBD  VeraePrintStamp-windows-arm64-0.3.6.msi
+# Optional companion EXE (parity with prior 0.3.x bare helper uploads):
+TBD  verae-print-windows-amd64-0.3.6.exe
+# See also DOWNLOADS-MANIFEST.md (human table) and VM-DUAL-SHIP-CHECKLIST.md.
 56cb72d8d65c5d2e1292b0a05f235ded0a267e66530229a53980887fc5de1b72  verae-print-windows-amd64-0.3.1.exe
 aa2e7f1843ccbd4d466c66e92a5460f0e3d499e6af0dcba2f93cbd49bc2012e5  verae-print-windows-amd64-0.3.2.exe
 079482b38ae3b49b268863209e309bb35072a3ec136f076f0ec5062d67a7c26e  verae-print_0.1.2_amd64.deb
--- a/site/printit.verae.ai/README.md
+++ b/site/printit.verae.ai/README.md
@ -7,6 +7,6 @@ Static site served by Caddy on 70.88.205.138 from `/var/www/printit.verae.ai`.
 - `queue.html` — PT-04 / PT-W4 job queue help page.
 - `img/`, `samples/` — screenshots and the sample receipt PDF used by the page.
 - `brand/` — tokens + logos (BrandingBook kit).
- `downloads/` is not in git (162 MB of release builds); see `DOWNLOADS-MANIFEST.txt` for the files and checksums that were live.
+- `downloads/` is not in git (162 MB of release builds); see `DOWNLOADS-MANIFEST.txt` for live checksums and `DOWNLOADS-MANIFEST.md` for the human table (incl. **0.3.6** Windows NSIS/MSI placeholders with sha256 **TBD**).

 Deploy: `rsync -a --exclude downloads site/printit.verae.ai/ marchon@70.88.205.138:/var/www/printit.verae.ai/` (back up `index.html` first).
--- a/site/printit.verae.ai/certificate.html
+++ b/site/printit.verae.ai/certificate.html
@ -21,8 +21,8 @@
    .btn.secondary{background:var(--card,#fff);color:var(--plum,#531B59);border-color:#CDBFD4}
    .btn.primary{background:var(--plum,#531B59);color:#fff}
    .btn.tonal{background:var(--plum-100,#EBD9EE);color:var(--plum-d,#3E1343);border:0}
-    /* CERT-01 paper ~816px content column (design mock) */
-    .wrap{max-width:816px;margin:0 auto;padding:24px 16px 48px}
+    /* CERT-01 paper ~816px content column (design mock canvas pad 30px) */
+    .wrap{max-width:816px;margin:0 auto;padding:30px 16px 48px}
    /* CERT-01 paper sheet — plum 1.5px outer + gold 0.5px inner (inset 22/28 mock) */
    .sheet{
      background:#fff;position:relative;border-radius:4px;
@ -40,10 +40,10 @@
    .logo-row img{height:40px;width:auto;display:block}
    .mark{width:40px;height:40px;border-radius:9px;background:linear-gradient(140deg,var(--plum,#531B59),var(--violet,#6B3FD6));display:grid;place-items:center;color:#fff;font-weight:800;font-size:13px;flex:none}
    .cert-meta{text-align:right;font-size:11px;color:var(--muted,#5E5470);line-height:1.45}
-    /* Title: Fraunces via Google Fonts CDN; Georgia/Times offline-ish fallback */
-    /* Design: font 700 26px serif; title block margin 26px 0 18px */
+    /* Title block: design margin 26px 0 18px (title + subtitle + gold rule) */
+    .title-block{margin:26px 0 18px;text-align:center}
    .title{
-      text-align:center;margin:26px 0 0;
+      text-align:center;margin:0;
      font-family:'Fraunces',var(--font-serif,Georgia,serif),Georgia,'Times New Roman',Times,serif;
      font-weight:700;font-size:clamp(22px,3.2vw,26px);line-height:1.25;letter-spacing:-0.01em;color:var(--ink,#1D1534);
    }
@ -51,7 +51,7 @@
    /* Gold rule under title — CERT-01 weight 2px × 120px */
    .rule{height:2px;background:var(--gold,#C4A85A);width:120px;margin:14px auto 0;border:0;border-radius:1px}
    .banner{
-      margin-top:18px;border:2px solid var(--ok,#0E6B3A);background:var(--ok-bg,#E3F5EA);
+      margin-top:0;border:2px solid var(--ok,#0E6B3A);background:var(--ok-bg,#E3F5EA);
      border-radius:10px;padding:12px 16px;display:flex;gap:12px;align-items:center;
    }
    .banner.provisional{border-color:var(--pend-bd,#D5DAE1);background:var(--pend-bg,#EEF0F3)}
@ -65,10 +65,11 @@
    .kv dt{color:var(--muted,#5E5470);font-weight:600;font-size:12px;padding-top:2px}
    .kv dd{margin:0;word-break:break-all;line-height:1.45}
    .mono{font-family:var(--font-mono),'JetBrains Mono',ui-monospace,SF Mono,Menlo,monospace;font-size:11px;letter-spacing:-0.01em}
-    .mh{display:inline-flex;align-items:flex-start;gap:4px;flex-wrap:wrap;background:var(--surface-2,#F4F1F8);border:1px solid var(--line,#E3DEF0);border-radius:6px;padding:4px 8px}
+    /* design .mh pad 2×6, radius-sm 6 */
+    .mh{display:inline-flex;align-items:flex-start;gap:4px;flex-wrap:wrap;background:var(--surface-2,#F4F1F8);border:1px solid var(--line,#E3DEF0);border-radius:6px;padding:2px 6px}
    .mh .pfx{color:var(--plum,#531B59);font-weight:600}
    .verify-box{
-      display:flex;gap:22px;align-items:flex-start;margin-top:22px;padding:16px;
+      display:flex;gap:22px;align-items:center;margin-top:22px;padding:16px;
      border:1px solid var(--line,#E3DEF0);border-radius:10px;background:var(--bg,#FBFAFD);
    }
    .qr{
@ -82,9 +83,10 @@
    .qr.has-qr{background:#fff}
    .qr.has-qr .qr-fallback{display:none}
    .verify-box ol{margin:6px 0 0 16px;padding:0;line-height:1.6;color:var(--ink-soft,#3B3250);font-size:12.5px}
+    .verify-box .verify-url{margin-top:6px}
    .verify-box a{color:var(--info,#3B2A8C);font-size:10px;word-break:break-all}
    .foot{
-      margin-top:28px;padding-top:14px;border-top:1px solid var(--line,#E3DEF0);
+      margin-top:32px;padding-top:0;border-top:0;
      font-size:10px;color:var(--muted,#5E5470);line-height:1.5;
    }
    .load{margin-top:18px;padding:14px 16px;background:var(--card,#fff);border:1px solid var(--line,#E3DEF0);border-radius:12px}
@ -141,9 +143,11 @@
        </div>
      </div>

+      <div class="title-block">
        <h1 class="title">Verae Timestamp Certificate</h1>
        <p class="subtitle">Proof that this exact document existed at the time below, recorded on the Verae Substrate blockchain</p>
        <hr class="rule"/>
+      </div>

      <div class="banner" id="banner" role="status">
        <div class="check" aria-hidden="true">✓</div>
@ -185,7 +189,7 @@
            <li>Compare the local file’s SHA-256 to the multihash below — file never uploaded.</li>
            <li>Only a <b>final</b> / already-registered receipt is evidence. Hold ids are not proof.</li>
          </ol>
-          <div style="margin-top:8px"><a id="verify-link" href="https://explorer.verae.ai/time" target="_blank" rel="noopener">https://explorer.verae.ai/time</a></div>
+          <div class="verify-url"><a id="verify-link" href="https://explorer.verae.ai/time" target="_blank" rel="noopener">https://explorer.verae.ai/time</a></div>
        </div>
      </div>

@ -206,7 +210,7 @@
        Multihash / BLAKE3 lines appear <b>only when data is present</b> — never invented.
        Title uses Fraunces (Google Fonts CDN) with Georgia/serif offline fallback; plum/gold frame kept.
        Final certificates paint a live QR (qrcode.js CDN → data-URL) from the explorer lookup; offline / provisional keeps the SVG placeholder so print still works.
-        Residual: full CERT-01.html self-hosted Fraunces/Cantarell pixel match (design-kit fonts).
+        Residual: self-hosted Fraunces/JetBrains woff2 + full CERT-01.html pixel / PDF embed.
      </p>
    </div>
  </div>
--- a/site/printit.verae.ai/fonts/README.md
+++ b/site/printit.verae.ai/fonts/README.md
@ -95,7 +95,7 @@ wired so deploys and cache busting stay simple.
 |------|-------|
 | Placeholder dir + this plan | **Done** (L7) |
 | `fetch-fonts.example.sh` placeholders | **Done** (TODO-7 A7) — no binaries fetched |
-| Web cert spacing toward CERT-01 | **Partial** (TODO-7 A7) — padding/rule/QR; not full pixel |
+| Web cert spacing toward CERT-01 | **Closer** (title-block 26/18, pad 56×64, rule 2×120, mh 2×6, verify center) — not full pixel |
 | woff2 binaries + LICENSE | Not started |
 | `@font-face` + drop CDN links | Not started |
 | Pixel match / PDF embed claim | Not started — do not claim |