docs: DUAL-SHIP runbook + deferred CA stubs in Product-Full.wxs

NSIS+MSI validation matrix; site version 0.3.6 string; no Authenticode claim.
2026-10-13 23:56:39 -04:00 · 2026-10-13 23:56:39 -04:00 · 1e0152c7af
commit 1e0152c7af
parent 7768562517
7 changed files with 249 additions and 27 deletions
--- a/docs/COMMERCIAL-INSTALLER-BACKLOG.md
+++ b/docs/COMMERCIAL-INSTALLER-BACKLOG.md
@ -16,19 +16,20 @@ Repo now includes **authoring/docs scaffolds** for the two commercial gaps that
 |----------|------|------------|----------------|
 | **WiX tray presence MSI skeleton** | [`platform/windows/wix/`](../platform/windows/wix/) — `VeraeTrayShortcuts.wxs`, `VeraeTrayShortcutsFragment.wxs`, [`README.md`](../platform/windows/wix/README.md); driver [`scripts/build-tray-msi.ps1`](../platform/windows/scripts/build-tray-msi.ps1) | Non-elevated **per-user** WiX v3 product + shortcut fragment: stages `verae-tray.ps1`, Start Menu `Programs\Verae\Verae Tray.lnk`, Startup `Verae Tray.lnk`. **ProductVersion** wired from `Get-VeraePackageVersion` → `internal/job.HelperVersion` (or `VERSION=` / `-Version`). `build-tray-msi.ps1` runs **candle/light** when present; otherwise prints WiX install tip (exit 0). | Full elevated commercial MSI (printers, Program Files, Authenticode, NSIS parity, CI-signed MSI in `dist/`). No MSI binary without the WiX toolset on the build host. |
 | **Menubar notarize checklist** | [`platform/macos/menubar/NOTARIZE-CHECKLIST.md`](../platform/macos/menubar/NOTARIZE-CHECKLIST.md) | Operator step list: unsigned build → codesign hardened runtime → `ditto` zip → `notarytool` (keychain profile **or** API key placeholders) → staple → `spctl`. No secrets. | Automated sign/notarize in `build-menubar-app.sh`, stapled `.app.zip`/DMG release, or CI keychain import. |
-| **Full elevated MSI (StageFull + light)** | [`Product-Full.wxs`](../platform/windows/wix/Product-Full.wxs) + [`scripts/build-full-msi.ps1`](../platform/windows/scripts/build-full-msi.ps1) (+ outline, [`SILENT_PROPS.md`](../platform/windows/wix/SILENT_PROPS.md), [`CI-SIGN-NOTARY.md`](../platform/windows/wix/CI-SIGN-NOTARY.md)) | Elevated WiX v3 product: perMachine, Feature/ComponentGroups for **bin** (`verae-print.exe` required), **scripts**, **docs**, Start Menu; silent public props; distinct UpgradeCode. `build-full-msi.ps1` creates `StageFull/{bin,scripts}`, copies or Go-builds EXEs, copies scripts/LICENSE/README, stamps **ProductVersion** from `Get-VeraePackageVersion`, runs candle/light → `VeraePrintStamp-windows-<arch>-<version>.msi`. WiX missing → **exit 1** + clear tip. Version defaults on build-windows / build-pkg / NSIS / build-installer aligned to HelperVersion. | **Not** Authenticode-signed; printer deferred CAs still commented; properties not yet honored by scheduled CAs; not Intune-proven; NSIS still primary full install; no live sign/notary CI. |
+| **Full elevated MSI (StageFull + light)** | [`Product-Full.wxs`](../platform/windows/wix/Product-Full.wxs) + [`scripts/build-full-msi.ps1`](../platform/windows/scripts/build-full-msi.ps1) (+ outline, [`SILENT_PROPS.md`](../platform/windows/wix/SILENT_PROPS.md), [`CI-SIGN-NOTARY.md`](../platform/windows/wix/CI-SIGN-NOTARY.md), [`DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md)) | Elevated WiX v3 product: perMachine, Feature/ComponentGroups for **bin** (`verae-print.exe` required), **scripts**, **docs**, Start Menu; silent public props; distinct UpgradeCode. `build-full-msi.ps1` creates `StageFull/{bin,scripts}`, copies or Go-builds EXEs, copies scripts/LICENSE/README, stamps **ProductVersion** from `Get-VeraePackageVersion`, runs candle/light → `VeraePrintStamp-windows-*-<version>.msi`. WiX missing → **exit 1** + clear tip. Version defaults on build-windows / build-pkg / NSIS / build-installer aligned to HelperVersion. Commented deferred CA + `InstallExecuteSequence` stubs for `install-printer.ps1` (no binaries required). Dual-ship runbook documents NSIS vs MSI clean-VM gates. | **Not** Authenticode-signed; printer CAs still **commented** (not scheduled/tested); properties not yet honored by live CAs; not Intune-proven; NSIS still primary full install; no live sign/notary CI. |

 ### Issue 1 — what landed vs still open

 | Done (advanced) | Still left (Issue 1 commercial) |
 |-----------------|----------------------------------|
-| `Product-Full.wxs` File components match StageFull; candle/light-ready | Printer deferred CA parity with NSIS (schedule + test) |
-| `build-full-msi.ps1` StageFull + ProductVersion + exit codes | Live CI: signtool / Trusted Signing on MSI + EXEs |
+| `Product-Full.wxs` File components match StageFull; candle/light-ready | **Uncomment + test** printer deferred CAs on clean VM (DUAL-SHIP VM C); parity with NSIS |
+| `build-full-msi.ps1` StageFull + ProductVersion + exit codes | Live CI: signtool / Trusted Signing on MSI + EXEs (**not shipped**) |
 | `CI-SIGN-NOTARY.md` GHA/Forgejo draft (secret **names** only) | Live notarytool staple on macOS runners; clean-VM Gatekeeper proof |
-| `SILENT_PROPS.md` msiexec one-liner + exit codes for full MSI | Properties honored by scheduled CAs (config write, skip printers/key) |
-| HelperVersion path on build-windows / build-pkg / NSIS / build-installer / full MSI | Dual-ship validation then thin NSIS; Intune silent smoke |
-| | macOS menubar automated notarize (checklist exists; script default still unsigned) |
-| | Do **not** claim Authenticode / notary shipped |
+| `SILENT_PROPS.md` msiexec one-liner + exit codes for full MSI | Properties honored by **scheduled** CAs (config write, skip printers/key) |
+| HelperVersion path on build-windows / build-pkg / NSIS / build-installer / full MSI | Dual-ship **clean-VM validation** then thin NSIS; Intune silent smoke |
+| Commented CA + `InstallExecuteSequence` stubs (`install-printer` schedule) | Publish 0.3.6 download blobs + refresh `DOWNLOADS-MANIFEST` checksums |
+| [`DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md) NSIS+MSI side-by-side runbook | macOS menubar automated notarize (checklist exists; script default still unsigned) |
+| Site product string → **0.3.6**; manifest header notes HelperVersion vs last-published 0.3.2 | Do **not** claim Authenticode / notary / dual-ship complete |

 **Still use for day-to-day presence (no WiX / no Apple certs):**  
 Windows `scripts/build-tray-startmenu.ps1` + `install-tray-startup.ps1`; macOS `verae-print menubar --install` / unsigned `build-menubar-app.sh`. Full product install remains NSIS (`installer-windows.nsi`) and macOS `pkg/build-pkg.sh`. Optional: `build-tray-msi.ps1` (WiX tip exit 0); `build-full-msi.ps1` (needs WiX; exit 1 if missing).
@ -61,7 +62,8 @@ Related but out of scope for “done” above (still backlog-adjacent): Linux `.
 | Startup-folder tray install | [`platform/windows/scripts/install-tray-startup.ps1`](../platform/windows/scripts/install-tray-startup.ps1) | **Not** MSI; no elevation |
 | WiX-free Start Menu stub | [`platform/windows/scripts/build-tray-startmenu.ps1`](../platform/windows/scripts/build-tray-startmenu.ps1) | Explicitly “future MSI can supersede” |
 | **WiX tray presence skeleton** (per-user, non-elevated) | [`platform/windows/wix/`](../platform/windows/wix/) + [`scripts/build-tray-msi.ps1`](../platform/windows/scripts/build-tray-msi.ps1) | **Scaffold shipped** — ProductVersion ← HelperVersion; candle/light when present, else WiX tip; not full product MSI |
-| **WiX full elevated MSI** (StageFull driver) | [`Product-Full.wxs`](../platform/windows/wix/Product-Full.wxs) + [`scripts/build-full-msi.ps1`](../platform/windows/scripts/build-full-msi.ps1) | **Authoring + stage/light path** — MSI when WiX present; unsigned; printer CAs deferred; dual-ship NSIS |
+| **WiX full elevated MSI** (StageFull driver) | [`Product-Full.wxs`](../platform/windows/wix/Product-Full.wxs) + [`scripts/build-full-msi.ps1`](../platform/windows/scripts/build-full-msi.ps1) | **Authoring + stage/light path** — MSI when WiX present; unsigned; printer CAs commented stubs; dual-ship NSIS |
+| **Dual-ship runbook** | [`wix/DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md) | **Docs** — NSIS + MSI clean-VM matrix; thin-NSIS exit criteria |
 | Shared version helper | [`platform/windows/scripts/common.ps1`](../platform/windows/scripts/common.ps1) `Get-VeraePackageVersion` | Aligns tray/full MSI/NSIS drivers with `HelperVersion` |
 | End-user Windows readme | [`platform/windows/README-WINDOWS.txt`](../platform/windows/README-WINDOWS.txt), [`README.txt`](../platform/windows/README.txt) | Documents NSIS flow; states **no elevated MSI** for tray |
 | Packaging policy doc | [PACKAGING.md](PACKAGING.md) | “**No elevated MSI**” for tray presence by design |
@ -81,18 +83,19 @@ NSIS product already covers much of the *install experience* (files under Progra
 | **Upgrade / repair / ARP metadata** | Clean major-upgrade, Add/Remove Programs | WiX `UpgradeCode` present; migrate ARP fully from NSIS `UNINST_KEY` after dual-ship |
 | **Custom actions parity with NSIS** | Printers, scheduled helper, per-user key | Port `install-printer.ps1`, helper registration into deferred/impersonated CAs (stubs commented in Product-Full) |
 | **Per-user vs per-machine story** | Tray is user-level today; MSI is typically machine | Machine full MSI + optional per-user tray MSI (both authored; product decision open) |
-| **Version drift in build scripts** | **Largely fixed** — HelperVersion path on build-windows, build-full-msi, build-pkg, build-installer, NSIS fallbacks **0.3.6** | Keep smoke failing on new hard-coded older defaults; site `DOWNLOADS-MANIFEST` still lists old 0.3.2 artifacts |
+| **Version drift in build scripts** | **Largely fixed** — HelperVersion path on build-windows, build-full-msi, build-pkg, build-installer, NSIS fallbacks **0.3.6**; site index product string **0.3.6** | Keep smoke failing on new hard-coded older defaults; `DOWNLOADS-MANIFEST` still checksums **last-published 0.3.2** blobs until release upload |
 | **CI job that builds + signs MSI** | Reproducible release | Windows runner: go test/build → WiX → signtool → upload + checksums (**not live**) |
 | **MSIX / Print Support App** (later) | Modern print path in original spec | Explicitly **deferred** unless enterprise asks; not blocking first MSI |

 ### Windows backlog order (suggested)

 1. ~~Freeze install surface / WiX file components + StageFull driver~~ (**done**: outline + Product-Full + `build-full-msi.ps1`).
-2. Schedule + test printer/helper deferred CAs; dual-ship NSIS until MSI install path is validated on a clean VM.
-3. Authenticode on binaries + MSI (**not shipped** — draft in `CI-SIGN-NOTARY.md` only).
-4. Honor silent props in CAs + Intune sample command line proof.
-5. Keep version defaults on `HelperVersion`; extend smoke to fail on new drift (site manifest still historical).
-6. Deprecate or thin NSIS once MSI is the primary download (keep NSIS only if needed for offline GUI key wizard parity).
+2. ~~Dual-ship runbook + commented printer CA schedule stubs~~ (**done**: [`DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md); Product-Full commented `InstallExecuteSequence`).
+3. **Uncomment** + test printer/helper deferred CAs on clean VM (DUAL-SHIP VM C); keep NSIS primary until parity.
+4. Authenticode on binaries + MSI (**not shipped** — draft in `CI-SIGN-NOTARY.md` only).
+5. Honor silent props in live CAs + Intune sample command line proof.
+6. Publish 0.3.6 artifacts; refresh site `DOWNLOADS-MANIFEST` checksums; keep smoke on HelperVersion drift.
+7. Deprecate or thin NSIS once MSI is the primary download (exit criteria in DUAL-SHIP.md).

 ---

@ -161,7 +164,8 @@ NSIS product already covers much of the *install experience* (files under Progra
 | Windows tray / Startup / Start Menu (user) | Yes | Yes for **presence**; not enterprise MSI |
 | Windows NSIS `setup.exe` | Yes | **Partial** — full GUI install; needs Authenticode + version align; not MSI |
 | Windows **MSI** (WiX) tray presence skeleton | **Yes** (`.wxs` + `build-tray-msi.ps1`; ProductVersion ← HelperVersion) | **No** — scaffold only; MSI only when candle/light installed; not full product MSI |
-| Windows **MSI** full product (files + ARP) | **Yes authoring** (`Product-Full.wxs` + `build-full-msi.ps1` StageFull → light) | **No commercial** — unsigned; printer CAs deferred; NSIS still primary |
+| Windows **MSI** full product (files + ARP) | **Yes authoring** (`Product-Full.wxs` + `build-full-msi.ps1` StageFull → light; CA schedule stubs commented) | **No commercial** — unsigned; printer CAs not live; NSIS still primary |
+| Dual-ship NSIS↔MSI runbook | **Yes** ([`DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md)) | **Docs only** — clean-VM validation + thin-NSIS still left |
 | Windows Authenticode pipeline | **Draft doc** (`wix/CI-SIGN-NOTARY.md`) | **No** — no live signtool job (**do not claim shipped**) |
 | macOS menu bar LaunchAgent | Yes | Yes (dev/ops) |
 | macOS unsigned menubar `.app` | Yes | **No** (Gatekeeper) |
@ -178,6 +182,7 @@ NSIS product already covers much of the *install experience* (files under Progra
 - [`platform/windows/`](../platform/windows/) — NSIS + tray scripts
 - [`platform/windows/wix/`](../platform/windows/wix/) + [`build-tray-msi.ps1`](../platform/windows/scripts/build-tray-msi.ps1) — per-user tray MSI skeleton; ProductVersion ← HelperVersion
 - [`platform/windows/wix/Product-Full.wxs`](../platform/windows/wix/Product-Full.wxs) + [`build-full-msi.ps1`](../platform/windows/scripts/build-full-msi.ps1) — elevated full MSI StageFull + candle/light
+- [`platform/windows/wix/DUAL-SHIP.md`](../platform/windows/wix/DUAL-SHIP.md) — NSIS + MSI side-by-side validation runbook
 - [`platform/windows/wix/CI-SIGN-NOTARY.md`](../platform/windows/wix/CI-SIGN-NOTARY.md) — CI Authenticode + notarytool sketch (**draft only**)
 - [`platform/windows/wix/SILENT_PROPS.md`](../platform/windows/wix/SILENT_PROPS.md) — msiexec `/qn` property contract
 - [`platform/macos/pkg/`](../platform/macos/pkg/) — commercial `.pkg` build
--- a/platform/windows/wix/DUAL-SHIP.md
+++ b/platform/windows/wix/DUAL-SHIP.md
@ -0,0 +1,179 @@
+# Dual-ship runbook — NSIS + full MSI (side-by-side)
+
+**Status:** operator validation while NSIS remains the **primary** full-product Windows download and the elevated MSI (`Product-Full.wxs` + `build-full-msi.ps1`) is **unsigned** and not yet CA-complete.
+
+**Do not** thin or deprecate NSIS until this runbook’s clean-VM gates pass and Authenticode is live (see [COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md), [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md)).
+
+**Related:** [Product-Full.wxs](Product-Full.wxs) · [SILENT_PROPS.md](SILENT_PROPS.md) · [../installer-windows.nsi](../installer-windows.nsi) · [PACKAGING.md](../../../docs/PACKAGING.md).
+
+---
+
+## Why dual-ship
+
+| Channel | Role today | Gap vs commercial |
+|---------|------------|-------------------|
+| **NSIS** `VeraePrintStamp-windows-*-setup.exe` | Primary GUI install (printers, helper task, key wizard, ARP) | Not MSI; Authenticode still open |
+| **Full MSI** `VeraePrintStamp-windows-*-<ver>.msi` | Fleet path authoring (`msiexec /qn` props) | Printer deferred CAs **commented**; unsigned; not Intune-proven |
+| **Tray MSI** `VeraeTray-*-peruser.msi` | Optional non-elevated presence only | Not full product; distinct UpgradeCode |
+
+Dual-ship means **both** NSIS and full MSI may be built from the same `HelperVersion` tree and validated on separate clean VMs **without** uninstalling the other channel’s install mid-test (use two VMs or one channel per VM).
+
+---
+
+## Version rule
+
+- Source of truth: `internal/job.HelperVersion` (currently **0.3.6**).
+- NSIS, `build-full-msi.ps1`, and site product strings must stamp that value (or explicit `VERSION=`).
+- Site `DOWNLOADS-MANIFEST.txt` may still list **last-published** artifact filenames (historical checksums). Do not rewrite checksum lines until new binaries are published.
+
+---
+
+## Build both artifacts (same tree)
+
+From repo root on a **Windows** host with Go + NSIS + WiX v3 (`candle`/`light`) on PATH:
+
+```powershell
+# 1) Native binaries + NSIS setup.exe
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\build-windows.ps1
+
+# 2) Elevated full MSI (StageFull → candle/light)
+powershell -NoProfile -ExecutionPolicy Bypass -File platform\windows\scripts\build-full-msi.ps1
+```
+
+Expected outputs (names vary by arch):
+
+| Artifact | Typical path |
+|----------|----------------|
+| NSIS setup | `dist/` or build output `VeraePrintStamp-windows-amd64-<ver>-setup.exe` |
+| Full MSI | `platform/windows/wix/out/VeraePrintStamp-windows-amd64-<ver>.msi` |
+
+If WiX is missing, `build-full-msi.ps1` **exits 1** with an install tip — dual-ship **fails closed** for the MSI leg (do not claim MSI ready).
+
+Cross-host NSIS-only: `platform/windows/build-installer.sh` (needs prebuilt Windows binaries).
+
+---
+
+## Clean-VM matrix (minimum)
+
+Use two fresh Windows 10/11 **x64** VMs (or reset snapshots). Do **not** mix channels on one machine until Upgrade/ARP coexistence is explicitly tested.
+
+| VM | Install | Goal |
+|----|---------|------|
+| **A — NSIS primary** | setup.exe (GUI) | Baseline product parity |
+| **B — MSI files-only** | MSI with `VERAE_SKIP_PRINTERS=1` | File + ARP path without deferred printer CA |
+| **C — MSI printers** (when CAs uncommented) | MSI default / `VERAE_SKIP_PRINTERS=0` | Printer + helper parity with NSIS |
+
+Until printer CAs are scheduled and tested, treat **VM C as blocked**; dual-ship gate for “MSI can replace NSIS” stays **open**.
+
+### Shared pre-checks
+
+1. Snapshot or sysprep-clean OS; admin account available.
+2. Note `HelperVersion` on both artifacts (NSIS version resource / MSI `ProductVersion`).
+3. No prior Verae Print Stamp under Program Files or ARP.
+4. Spooler running (`Get-Service Spooler`).
+
+---
+
+## VM A — NSIS validation
+
+```text
+1. Run setup.exe elevated; complete key wizard or skip per test plan.
+2. Confirm Program Files\Verae\PrintStamp\bin\verae-print.exe + helper.
+3. Confirm printers (IPP and/or Local Port) and scheduled task "Verae Print Helper".
+4. Print a one-page PDF → stamp path succeeds (or hold id only — never treat jobId as evidence).
+5. Start Menu: Setup signing key, Start print helper, Collect diagnostics.
+6. Uninstall via ARP; confirm printers/task removed; reboot optional.
+```
+
+Record: install log path, printer names, task principal, any SmartScreen blocks (unsigned expected).
+
+---
+
+## VM B — MSI files-only (safe today)
+
+Printer deferred CAs are **commented** in `Product-Full.wxs`. Validate payload + silent props without expecting queues:
+
+```bat
+msiexec /i VeraePrintStamp-windows-amd64-0.3.6.msi /qn /norestart ^
+  VERAE_SKIP_KEY_SETUP=1 VERAE_SKIP_PRINTERS=1 VERAE_CHANNEL=zapier
+```
+
+Interactive UI install is fine for smoke; `/qn` proves fleet syntax ([SILENT_PROPS.md](SILENT_PROPS.md)).
+
+```text
+1. msiexec as above (or UI).
+2. Confirm InstallDir files: bin\, scripts\ (incl. install-printer.ps1), LICENSE, README.
+3. Confirm ARP entry (Publisher Verae, DisplayVersion = HelperVersion).
+4. Confirm Start Menu shortcuts resolve to helper / diag (may fail if helper missing — fail the build).
+5. Optional: elevated manual run of scripts\install-printer.ps1 -InstallDir "…" to prove script parity outside MSI CA.
+6. msiexec /x {ProductCode} /qn — files and Start Menu removed; no orphan HKLM Software\Verae\PrintStamp if components clean.
+```
+
+**Pass criteria (files-only):** light-built MSI installs/uninstalls cleanly; version matches; no reboot required; props accepted (even if not yet honored by CAs).
+
+**Fail:** missing StageFull binaries at light time; wrong UpgradeCode collision with tray MSI; elevation refused unexpectedly.
+
+---
+
+## VM C — MSI printer CA (still left)
+
+When uncommenting CAs in `Product-Full.wxs`:
+
+1. Schedule stubs (see commented `InstallExecuteSequence` in Product-Full) after `InstallFiles`.
+2. Conditions: `NOT Installed` and `VERAE_SKIP_PRINTERS<>"1"` for install; `REMOVE~="ALL"` for uninstall.
+3. Deferred elevated: `install-printer.ps1 -InstallDir "[INSTALLFOLDER]"`; rollback/uninstall → `uninstall-printer.ps1`.
+4. Re-run dual-ship **A vs C** parity: same printers, same helper task name, same IPP loopback `127.0.0.1:8631`.
+5. Silent: `VERAE_SKIP_PRINTERS=1` must skip CA; default must install printers.
+
+Do **not** mark dual-ship complete until VM C matches VM A on a clean image.
+
+---
+
+## Side-by-side comparison checklist
+
+| Check | NSIS (A) | MSI files (B) | MSI+CA (C) |
+|-------|----------|---------------|------------|
+| Version = HelperVersion | ☐ | ☐ | ☐ |
+| Program Files layout | ☐ | ☐ | ☐ |
+| Start Menu shortcuts | ☐ | ☐ | ☐ |
+| ARP uninstall clean | ☐ | ☐ | ☐ |
+| IPP + Local Port printers | ☐ | N/A (skip) | ☐ |
+| Scheduled task helper | ☐ | N/A (skip) | ☐ |
+| Key wizard / first-run key | ☐ | skip prop | ☐ / first-run |
+| `msiexec /qn` | N/A | ☐ | ☐ |
+| Authenticode (signtool) | ☐ still left | ☐ still left | ☐ still left |
+
+---
+
+## Coexistence / upgrade notes
+
+- Full MSI **UpgradeCode** `F8B2A4C6-…` must stay distinct from tray `A7C3E91B-…`.
+- NSIS uses its own `UNINST_KEY`; long-term migrate ARP to MSI only after dual-ship pass — avoid dual ARP entries for the “same” product on one machine in production.
+- Do not install tray per-user MSI and full MSI as substitutes for each other; tray is presence-only.
+- MajorUpgrade on full MSI: same-version upgrades allowed (`AllowSameVersionUpgrades=yes`); test repair after dual-ship CA enablement.
+
+---
+
+## Exit: when to thin NSIS
+
+Thin or demote NSIS to “key-wizard offline only” only when **all** are true:
+
+1. VM C printer/helper parity signed off.
+2. Live Authenticode on EXE + MSI (CI secrets; never in git).
+3. Silent props honored by scheduled CAs; Intune/SCCM one-liner documented with real exit codes.
+4. Site primary Windows download points at MSI; NSIS linked as alternate if kept.
+5. OPEN-ISSUES Issue 1 “Still left” no longer lists dual-ship/thin NSIS.
+
+Until then: **ship NSIS as primary**; MSI is dual-ship candidate only.
+
+---
+
+## Quick links
+
+| Doc | Path |
+|-----|------|
+| Full MSI authoring | [Product-Full.wxs](Product-Full.wxs) |
+| Stage/light driver | [../scripts/build-full-msi.ps1](../scripts/build-full-msi.ps1) |
+| Silent properties | [SILENT_PROPS.md](SILENT_PROPS.md) |
+| Sign/notary draft | [CI-SIGN-NOTARY.md](CI-SIGN-NOTARY.md) |
+| Commercial backlog | [docs/COMMERCIAL-INSTALLER-BACKLOG.md](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md) |
--- a/platform/windows/wix/Product-Full.wxs
+++ b/platform/windows/wix/Product-Full.wxs
@ -4,7 +4,8 @@

  Status: candle/light-ready authoring. File Sources match StageFull layout
  produced by platform/windows/scripts/build-full-msi.ps1.
-  NOT commercial-ready: no Authenticode, printer CAs commented, dual-ship NSIS.
+  NOT commercial-ready: no Authenticode, printer CAs commented, dual-ship NSIS
+  (see DUAL-SHIP.md).

  Scope (wired File components; CAs still stubs):
    - perMachine / elevated → ProgramFiles64\Verae\PrintStamp
@ -13,7 +14,7 @@
    - LICENSE.txt + README-WINDOWS.txt
    - Start Menu shortcuts (non-advertised + HKLM keypath)
    - Public silent props (SILENT_PROPS.md)
-    - Printer CA stubs commented (deferred)
+    - Printer CA + InstallExecuteSequence stubs commented (no binaries required)

  Not this package:
    - Tray presence → VeraeTrayShortcuts.wxs (per-user, non-elevated)
@ -133,18 +134,48 @@
    </Feature>

    <!--
-      CustomAction placeholders (NSIS parity) — NOT scheduled yet.
-      Uncomment + schedule in InstallExecuteSequence when binaries stage cleanly.
-      Conditions: NOT Installed; VERAE_SKIP_PRINTERS&lt;&gt;"1"; REMOVE~="ALL".
+      CustomAction placeholders (NSIS parity) — commented so candle/light need no
+      live CA binaries. File components already stage install-printer.ps1.
+      Uncomment defs + InstallExecuteSequence together after StageFull smoke
+      (see DUAL-SHIP.md VM C). Conditions use XML entities in real attributes.

+      Schedule intent:
+        CA_StopHelper          before InstallFiles (upgrade/repair)
+        CA_InstallPrinters     after  InstallFiles (NOT Installed AND skip<>1)
+        CA_InstallPrintersRollback  paired rollback
+        CA_UninstallPrinters   before RemoveFiles when REMOVE~="ALL"
+
+    <CustomAction Id="CA_StopHelper"
+        Directory="System64Folder"
+        ExeCommand="cmd.exe /c schtasks /End /TN &quot;Verae Print Helper&quot; &amp; taskkill /F /IM verae-printhelper.exe /T"
+        Execute="deferred" Impersonate="no" Return="ignore" />
    <CustomAction Id="CA_InstallPrinters"
        Directory="INSTALLFOLDER"
        ExeCommand="powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File &quot;[INSTALLFOLDER]scripts\install-printer.ps1&quot; -InstallDir &quot;[INSTALLFOLDER]&quot;"
        Execute="deferred" Impersonate="no" Return="check" />
+    <CustomAction Id="CA_InstallPrintersRollback"
+        Directory="INSTALLFOLDER"
+        ExeCommand="powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File &quot;[INSTALLFOLDER]scripts\uninstall-printer.ps1&quot;"
+        Execute="rollback" Impersonate="no" Return="ignore" />
    <CustomAction Id="CA_UninstallPrinters"
        Directory="INSTALLFOLDER"
        ExeCommand="powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File &quot;[INSTALLFOLDER]scripts\uninstall-printer.ps1&quot;"
        Execute="deferred" Impersonate="no" Return="ignore" />
+
+    <InstallExecuteSequence>
+      <Custom Action="CA_StopHelper" Before="InstallFiles">
+        Installed OR UPGRADINGPRODUCTCODE
+      </Custom>
+      <Custom Action="CA_InstallPrinters" After="InstallFiles">
+        NOT Installed AND VERAE_SKIP_PRINTERS&lt;&gt;"1"
+      </Custom>
+      <Custom Action="CA_InstallPrintersRollback" After="CA_InstallPrinters">
+        NOT Installed AND VERAE_SKIP_PRINTERS&lt;&gt;"1"
+      </Custom>
+      <Custom Action="CA_UninstallPrinters" Before="RemoveFiles">
+        REMOVE~="ALL"
+      </Custom>
+    </InstallExecuteSequence>
    -->
  </Product>

--- a/platform/windows/wix/Product-Full.wxs.outline
+++ b/platform/windows/wix/Product-Full.wxs.outline
@ -1,11 +1,12 @@
 # Product-Full.wxs.outline — full elevated Print Stamp MSI (scaffold)

-**Status:** outline + [`Product-Full.wxs`](Product-Full.wxs) + driver [`../scripts/build-full-msi.ps1`](../scripts/build-full-msi.ps1) (stages StageFull, candle/light when WiX present). **Not** commercial-ready (no Authenticode, printer CAs deferred, dual-ship NSIS).
+**Status:** outline + [`Product-Full.wxs`](Product-Full.wxs) + driver [`../scripts/build-full-msi.ps1`](../scripts/build-full-msi.ps1) (stages StageFull, candle/light when WiX present). **Not** commercial-ready (no Authenticode, printer CAs **commented** stubs with schedule, dual-ship NSIS).
 **Parity target:** [`../installer-windows.nsi`](../installer-windows.nsi) (elevated full product).
 **Not this package:** tray-only skeleton [`VeraeTrayShortcuts.wxs`](VeraeTrayShortcuts.wxs) (per-user, non-elevated).
 **Version:** `ProductVersion` ← `Get-VeraePackageVersion` → `internal/job.HelperVersion` (or `VERSION=`).
 **Backlog:** [`docs/COMMERCIAL-INSTALLER-BACKLOG.md`](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md).
 **Silent props:** [`SILENT_PROPS.md`](SILENT_PROPS.md).
+**Dual-ship:** [`DUAL-SHIP.md`](DUAL-SHIP.md).

 ---

--- a/platform/windows/wix/README.md
+++ b/platform/windows/wix/README.md
@ -6,10 +6,10 @@ WiX v3 authoring for (1) non-elevated **tray presence** MSI and (2) elevated
 **full Print Stamp** MSI (`Product-Full.wxs` + `build-full-msi.ps1`).

 Neither package is **commercial-ready** yet (no Authenticode; full MSI printer
-CAs still deferred). Day-to-day tray without WiX:
+CAs still commented stubs). Day-to-day tray without WiX:
 [`../scripts/build-tray-startmenu.ps1`](../scripts/build-tray-startmenu.ps1).
 Full product GUI install remains NSIS (`../installer-windows.nsi`) until dual-ship
-validation. Commercial gaps:
+validation ([DUAL-SHIP.md](DUAL-SHIP.md)). Commercial gaps:
 [`docs/COMMERCIAL-INSTALLER-BACKLOG.md`](../../../docs/COMMERCIAL-INSTALLER-BACKLOG.md).

 ## Install
@ -154,7 +154,9 @@ The script:

 Without WiX: StageFull is still prepared when binaries can be obtained, then the
 script exits **1** with the WiX install tip. Use NSIS (`build-windows.ps1`) for
-day-to-day full product. **Not** Authenticode-signed; printer CAs not scheduled.
+day-to-day full product. **Not** Authenticode-signed; printer CAs remain
+**commented** stubs (see `Product-Full.wxs`). Side-by-side NSIS+MSI validation:
+[DUAL-SHIP.md](DUAL-SHIP.md).

 ### Files in this folder

@ -162,8 +164,9 @@ day-to-day full product. **Not** Authenticode-signed; printer CAs not scheduled.
 |------|------|
 | `VeraeTrayShortcuts.wxs` | Per-user tray Product + file components (`ProductVersion`) |
 | `VeraeTrayShortcutsFragment.wxs` | Start Menu + Startup shortcut fragment |
-| `Product-Full.wxs` | Elevated full product (bin/scripts/docs/Start Menu + silent props) |
+| `Product-Full.wxs` | Elevated full product (bin/scripts/docs/Start Menu + silent props; CA schedule commented) |
 | `Product-Full.wxs.outline` | Full MSI checklist / staging layout |
+| `DUAL-SHIP.md` | NSIS + full MSI clean-VM dual-ship runbook |
 | `SILENT_PROPS.md` | Public msiexec `/qn` property contract |
 | `CI-SIGN-NOTARY.md` | Draft Authenticode + notarytool secret **names** only |
 | `README.md` | This file |
--- a/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt
+++ b/site/printit.verae.ai/DOWNLOADS-MANIFEST.txt
@ -30,7 +30,10 @@ drwxr-xr-x 5 marchon marchon     4096 Oct  4 08:19 ..
 -rw-r--r-- 1 marchon marchon  2865633 Oct  3 00:04 VeraePrintStamp-windows-arm64.zip
 -rw-r--r-- 1 marchon marchon  9198592 Oct  3 14:45 verae-print-windows-amd64-0.3.1.exe
 -rw-r--r-- 1 marchon marchon  9216512 Oct  3 15:36 verae-print-windows-amd64-0.3.2.exe
-# Verae Print Stamp — printit.verae.ai (latest: 0.3.2 for Windows amd64, macOS, Linux; Windows arm64, .deb and .zip are 0.1.2)
+# Verae Print Stamp — printit.verae.ai
+# Source of truth (in-tree): internal/job.HelperVersion = 0.3.6
+# Last-published download blobs below remain 0.3.2 (amd64/macOS/Linux) or 0.1.2 (Windows arm64, .deb, .zip).
+# Do not rewrite checksum lines until matching 0.3.6 artifacts are built and uploaded.
 56cb72d8d65c5d2e1292b0a05f235ded0a267e66530229a53980887fc5de1b72  verae-print-windows-amd64-0.3.1.exe
 aa2e7f1843ccbd4d466c66e92a5460f0e3d499e6af0dcba2f93cbd49bc2012e5  verae-print-windows-amd64-0.3.2.exe
 079482b38ae3b49b268863209e309bb35072a3ec136f076f0ec5062d67a7c26e  verae-print_0.1.2_amd64.deb
--- a/site/printit.verae.ai/index.html
+++ b/site/printit.verae.ai/index.html
@ -166,7 +166,7 @@

    <section class="card" aria-labelledby="dl-heading">
      <h2 id="dl-heading" style="margin:0 0 0.25rem; font-size:1.15rem;">Downloads</h2>
-      <p style="margin:0; color:var(--muted); font-size:0.92rem;">Version <strong>0.3.2</strong></p>
+      <p style="margin:0; color:var(--muted); font-size:0.92rem;">Product version <strong>0.3.6</strong> <span style="opacity:0.85">(HelperVersion; published download builds may lag — see DOWNLOADS-MANIFEST)</span></p>

      <div class="downloads">
        <div class="row">