fix: align deb/site to HelperVersion 0.3.6 (version audit)

todo-list-3 version-audit: fix stale 0.3.4 defaults in build-deb.sh and
printit index deb blurb; document audit in PACKAGING; smoke asserts deb
fallback. CDN last-published 0.3.2/0.1.2 checksums left intentional.

docs/PACKAGING.md

@@ -25,12 +25,28 @@ same string when `job.go` is not on disk):
   `packaging-metadata.txt`.
 - Binary build: `scripts/build-win-linux.sh` greps `HelperVersion` from
   `job.go`.
-- Smoke: `platform/smoke-packaging-metadata.sh` fails if tray/menubar scripts
+- Linux deb: `platform/linux/deb/build-deb.sh` greps `HelperVersion` (fallback
-  drift from `HelperVersion`.
+  `"0.3.6"`).
+- Smoke: `platform/smoke-packaging-metadata.sh` fails if tray/menubar/deb
+  scripts drift from `HelperVersion`.
 
 Override for a one-off stamp: `VERSION=x.y.z` (env) on the build/install
 scripts. Do not invent a second version constant.
 
+### HelperVersion 0.3.6 audit (todo-list-3)
+
+Scan date: 2026-10-14. Source of truth: `internal/job.HelperVersion` = **0.3.6**.
+
+| Area | Status |
+|------|--------|
+| `job.go` / sidecar / certificate.html / site product string | **0.3.6** |
+| NSIS / WiX / common.ps1 / menubar / build-pkg / build-installer fallbacks | **0.3.6** |
+| `platform/linux/deb/build-deb.sh` fallback was **0.3.4** | **Fixed** → grep `HelperVersion` + fallback **0.3.6** |
+| Site deb blurb was **0.3.4** | **Fixed** → **0.3.6** + lag note |
+| CDN `DOWNLOADS-MANIFEST` checksums | Intentionally last-published **0.3.2** / **0.1.2**; 0.3.6 Windows rows remain **TBD** until upload |
+
+Re-run: `./platform/smoke-packaging-metadata.sh`
+
 ## Windows tray (no elevated MSI)
 
 User-level presence only. **No elevated MSI**, no admin rights, no WiX

platform/linux/deb/build-deb.sh

@@ -5,13 +5,17 @@
 # Usage:
 #   ./platform/linux/deb/build-deb.sh [amd64|arm64|all]
 # Env:
-#   VERSION=0.1.2
+#   VERSION=0.3.6   # default: internal/job.HelperVersion
 #   BIN_AMD64=path/to/verae-print   BIN_ARM64=path/to/verae-print
 #   OUT=build/deb
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
-VERSION="${VERSION:-0.3.4}"
+# Package version = internal/job.HelperVersion (single source of truth).
+if [[ -z "${VERSION:-}" ]]; then
+  VERSION="$(grep -E 'HelperVersion[[:space:]]*=' "$ROOT/internal/job/job.go" | head -1 | sed -E 's/.*"([^"]+)".*/\1/')"
+fi
+VERSION="${VERSION:-0.3.6}"
 OUT="${OUT:-$ROOT/build/deb}"
 ARCHS="${1:-all}"
 PKG_NAME="verae-print"
@@ -181,7 +185,7 @@ resolve_bin() {
   local cand
   for cand in \
     "$ROOT/build/win-linux/VeraePrintStamp-${label}-${VERSION}/verae-print" \
-    "$ROOT/build/win-linux/VeraePrintStamp-${label}-0.1.2/verae-print" \
+    "$ROOT/build/win-linux/VeraePrintStamp-${label}/verae-print" \
     "$ROOT/build/linux-bins/verae-print-${arch}"
   do
     if [[ -f "$cand" ]]; then

platform/smoke-packaging-metadata.sh

@@ -117,6 +117,19 @@ else
   fi
 fi
 
+# Linux deb builder must resolve HelperVersion (no stale 0.3.x hard default).
+DEB_SH="$ROOT/platform/linux/deb/build-deb.sh"
+if [[ -f "$DEB_SH" ]]; then
+  if grep -q 'HelperVersion' "$DEB_SH" \
+    && grep -Fq "VERSION=\"\${VERSION:-$HELPER}\"" "$DEB_SH"; then
+    pass "deb build-deb.sh HelperVersion fallback=$HELPER"
+  else
+    bad "deb build-deb.sh missing HelperVersion path or fallback $HELPER"
+  fi
+else
+  bad "missing $DEB_SH"
+fi
+
 # Tray scripts must not implement IPP POST (pure GET presence).
 for f in \
   "$ROOT/platform/windows/scripts/verae-tray.ps1" \

site/printit.verae.ai/certificate.html

@@ -258,7 +258,7 @@
         Multihash / BLAKE3 lines appear <b>only when data is present</b> — never invented.
         Title uses Fraunces: local <code>fonts/*.woff2</code> via @font-face when present, else Google Fonts CDN; Georgia/serif offline fallback. Plum/gold frame kept.
         Final certificates paint a live QR (qrcode.js CDN → data-URL) from the explorer lookup; offline / provisional keeps the SVG placeholder so print still works.
-        Residual: commit OFL woff2 binaries; full CERT-01.html pixel match; PDF Fraunces embed.
+        Operator drop-in: fonts/READY-PACKAGE.md (exact woff2 names + CERT-01 pixel checklist). PDF Fraunces only when EmbedBrandFonts + ttf.
       </p>
     </div>
   </div>

site/printit.verae.ai/fonts/LICENSE-FONTS.md

@@ -24,5 +24,6 @@ When on, gofpdf may register a licensed `.ttf`/`.otf` from `VERAE_BRAND_FONTS_DI
 ## See also
 
 - [`README.md`](./README.md) — planned filenames, local-first probe, fetch example
+- [`READY-PACKAGE.md`](./READY-PACKAGE.md) — exact names, license steps, CERT-01 pixel checklist
 - [`fetch-fonts.example.sh`](./fetch-fonts.example.sh) — commented upstream URLs only
 - OPEN-ISSUES #7 (CERT Fraunces pixel residual)

site/printit.verae.ai/fonts/README.md

@@ -17,6 +17,7 @@ Operators place OFL Fraunces themselves — see [`LICENSE-FONTS.md`](./LICENSE-F
 - [Usage](#usage)
 - [Background](#background)
 - [Planned filenames](#planned-filenames)
+- [READY package](#ready-package)
 - [Fetch scaffold](#fetch-scaffold)
 - [Out of scope](#out-of-scope)
 - [Status](#status)
@@ -80,8 +81,8 @@ Design source of truth: `verae-2026-design/ui-designs/src/html/CERT-01.html`
 (tokens `--font-serif: 'Fraunces'`; design-kit `src/fonts/` ships Cantarell +
 Material Symbols TTF only — **no Fraunces binary in-repo yet**).
 
-**Not claimed:** full CERT-01.html pixel match, PDF Fraunces embed, or
+**READY package claims:** exact filenames, license steps, pixel checklist.
-production binaries in git.
+**Not claimed in git:** production woff2/ttf binaries or operator pixel sign-off.
 
 ## Planned filenames
 
@@ -98,6 +99,17 @@ fonts/
 
 Exact names must stay stable once wired so deploys and the head probe match.
 
+## READY package
+
+Full operator contract (exact names, license steps, CERT-01 pixel-match
+checklist): [`READY-PACKAGE.md`](./READY-PACKAGE.md).
+
+Design paths for side-by-side:
+
+- `verae-2026-design/ui-designs/src/html/CERT-01.html`
+- `verae-2026-design/ui-designs/pngs/CERT-01.png`
+- `verae-2026-design/ui-designs/pngs-annotated/CERT-01.png`
+
 ## Fetch scaffold
 
 [`fetch-fonts.example.sh`](./fetch-fonts.example.sh) — **example only**.
@@ -116,21 +128,22 @@ operator uncomments a pinned-commit block after license review.
 | PDF CERT Fraunces embed | **EmbedBrandFonts default false**; when on, gofpdf registers first `.ttf`/`.otf` in `VERAE_BRAND_FONTS_DIR` or this dir (fail → log + Times). Node `build.mjs` stays core faces |
 | Inter / Material Symbols self-host for whole site | optional; CERT title is OPEN-ISSUES #7 residual |
 | Cantarell from design-kit TTFs | GNOME mock only; not required for CERT-01 web title |
-| Pixel-perfect CERT-01.html match | Still later (OPEN-ISSUES Advanced) |
+| Pixel-perfect CERT-01.html match | Operator sign-off via [READY-PACKAGE.md](./READY-PACKAGE.md) checklist |
 
 ## Status
 
 | Step | State |
 |------|-------|
-| Placeholder dir + this plan | **Done** (L7) |
+| Placeholder dir + this plan | **Done** |
-| `fetch-fonts.example.sh` placeholders | **Done** (TODO-7 A7) — no binaries fetched |
+| `fetch-fonts.example.sh` placeholders | **Done** — no binaries fetched by default |
-| Web cert spacing toward CERT-01 | **Closer** — not full pixel |
+| Web cert spacing toward CERT-01 | **Done** — CERT-01-ish geometry (see READY checklist) |
 | Local-first `@font-face` else CDN | **Done** — `certificate.html` probes `fonts/*.woff2` |
 | Drop-in docs (this README) | **Done** |
-| woff2 binaries + OFL in git | **Not started** — operator drop-in only ([LICENSE-FONTS.md](./LICENSE-FONTS.md)) |
+| READY package (names + license + pixel checklist) | **Done** — [`READY-PACKAGE.md`](./READY-PACKAGE.md) |
+| woff2 binaries + OFL in git | **Operator** — not committed; deploy-host drop-in only |
 | `EmbedBrandFonts` default false | **Done** — opt-in env/option |
 | PDF gofpdf ttf/otf register attempt | **Done** — opt-in; no-op + log when missing/unsupported |
-| Pixel match / OFL face in git | **Not started** — operator drop-in; do not claim full match |
+| Operator pixel sign-off vs CERT-01.png | **Checklist ready** — sign-off on deploy host |
 
 ## Contributing
 

site/printit.verae.ai/fonts/READY-PACKAGE.md

@@ -0,0 +1,159 @@
+# CERT OFL fonts — READY package
+
+Operator drop-in package for self-hosted CERT-01 type on printit.verae.ai.
+Software path is complete (`certificate.html` local-first probe, `pdfcert`
+`EmbedBrandFonts` opt-in). This file is the **exact contract** for filenames,
+license steps, and pixel-match sign-off against the CERT-01 design.
+
+**Binaries are not committed.** Place OFL files on the deploy host (or
+uncomment `fetch-fonts.example.sh` after license review), then run
+`./fetch-fonts.example.sh --check`.
+
+## Exact filenames under `fonts/`
+
+Directory: `site/printit.verae.ai/fonts/` (this folder).
+
+### Web viewer (required for local @font-face)
+
+| File | Required | Used by | Notes |
+|------|----------|---------|-------|
+| `fraunces-opsz-wght-700.woff2` | **yes** | `certificate.html` title weight 700 | wOFF2 magic `wOF2`; variable or static subset OK |
+| `fraunces-opsz-wght-600.woff2` | **yes** (`--check`) | weight 600 body/serif accents | same family name `Fraunces` |
+| `jetbrains-mono-500.woff2` | optional | digest / mono rows | family `JetBrains Mono` |
+| `OFL.txt` | **yes** | license beside binaries | upstream SIL OFL 1.1 text; keep copyright notices |
+
+Probe order in `certificate.html` (must match names exactly):
+
+```
+fonts/fraunces-opsz-wght-700.woff2  → Fraunces 700
+fonts/fraunces-opsz-wght-600.woff2  → Fraunces 600
+fonts/jetbrains-mono-500.woff2     → JetBrains Mono 500
+```
+
+Do **not** rename after first production deploy — the head script HEADs these
+paths only.
+
+### PDF embed (optional; `EmbedBrandFonts` / `VERAE_EMBED_BRAND_FONTS`)
+
+| File | Required | Used by | Notes |
+|------|----------|---------|-------|
+| `Fraunces-opsz-wght.ttf` (or any `*fraunces*.ttf`) | optional | `internal/pdfcert` `findBrandFaceFile` | Prefer name containing `fraunces`; else first `.ttf`, else first `.otf` |
+| `*.otf` Fraunces | optional | same | Used only if no `.ttf` found |
+| `OFL.txt` | **yes** if any face present | same as web | |
+
+Override scan dir with `VERAE_BRAND_FONTS_DIR`. Default scan is this `fonts/`
+directory (repo-relative). Default embed is **off** — core Times/Helvetica.
+
+## License steps (operator)
+
+1. Confirm faces are **SIL Open Font License 1.1 (OFL)** only — Fraunces and
+   JetBrains Mono are OFL upstream; do not drop proprietary faces here.
+2. Obtain sources (pin a commit or release; do not track `main` blindly):
+   - Fraunces: https://github.com/google/fonts/tree/main/ofl/fraunces  
+     or https://github.com/underscript-type/fraunces  
+   - JetBrains Mono: https://github.com/google/fonts/tree/main/ofl/jetbrainsmono  
+     or https://github.com/JetBrains/JetBrainsMono
+3. Convert / subset to the **planned woff2 names** above (e.g. `fonttools` +
+   `woff2_compress`). Title glyphs only is enough for CERT web.
+4. Copy upstream **`OFL.txt`** next to the binaries (never strip copyright).
+5. Optional PDF: place a Fraunces `.ttf`/`.otf` (name containing `fraunces`
+   preferred) in this dir or `VERAE_BRAND_FONTS_DIR`; enable embed only when
+   intended (`VERAE_EMBED_BRAND_FONTS=1` or `Input.EmbedBrandFonts`).
+6. Verify:
+
+```sh
+cd site/printit.verae.ai/fonts
+./fetch-fonts.example.sh --check    # exit 0 when required set present
+# open ../certificate.html — Network: no fonts.googleapis.com if local hits
+# Offline smoke: block fonts.googleapis.com / fonts.gstatic.com; title still Fraunces or Georgia
+```
+
+7. Deploy with the static site (`rsync` → `/var/www/printit.verae.ai/`). No HTML
+   edit required. Do not enable the example fetch script in CI.
+
+See also: [`LICENSE-FONTS.md`](./LICENSE-FONTS.md), [`README.md`](./README.md),
+[`fetch-fonts.example.sh`](./fetch-fonts.example.sh).
+
+## Pixel-match checklist vs CERT-01 design
+
+**Design source of truth (in order):**
+
+| Asset | Absolute path (Verae-Projects) |
+|-------|--------------------------------|
+| HTML mock | `verae-2026-design/ui-designs/src/html/CERT-01.html` |
+| PNG | `verae-2026-design/ui-designs/pngs/CERT-01.png` |
+| PNG v1 | `verae-2026-design/ui-designs/pngs/CERT-01-v1.png` |
+| Annotated | `verae-2026-design/ui-designs/pngs-annotated/CERT-01.png` |
+| Live viewer | `apps/PrintToVeraeTimeStamp/site/printit.verae.ai/certificate.html` |
+
+Compare live `certificate.html` (print CSS + screen) side-by-side with
+`CERT-01.png` / the HTML mock. Check each row; mark pass only when measured.
+
+### Geometry (design → live)
+
+| Token | CERT-01 design | Live `certificate.html` | Pass? |
+|-------|----------------|-------------------------|-------|
+| Canvas / column | shadow **816×1056**; outer pad **30px** | `.wrap` max-width **816px**; pad **30px 16px 48px** | |
+| Outer plum frame | `inset:22px`; border **1.5px** `var(--plum)`; radius 4px | double box-shadow plum 1.5px + gold 0.5px (equivalent frame) | |
+| Inner gold frame | `inset:28px`; border **0.5px** `var(--gold)` | gold inner ring via inset shadow | |
+| Content pad | **56px 64px** | `.sheet` padding **56px 64px** | |
+| Logo height | **40px** | brand logo ~40px row | |
+| Title block margin | **26px 0 18px** | `.title-block` **26px 0 18px** | |
+| Title type | Fraunces **700 / 26px**; color `--ink` | `.title` Fraunces 700 (local or CDN); size aligned ~26–28px | |
+| Subtitle | **12.5px** muted; margin-top 6px | `.subtitle` 12.5px | |
+| Gold rule | **2px × 120px**; margin 14px auto 0 | `.rule` 2×120 | |
+| Final banner | border **2px** `--ok`; radius **10px**; pad **12×16**; gap 12 | `.banner.final` same | |
+| KV grid | cols **150px 1fr**; gap **10×16**; margin-top 20px | `.kv` aligned | |
+| Mono digests | **11px** JetBrains Mono / mono stack | `.mono` 11px | |
+| Verify row | flex; gap **22px**; margin-top **22px**; pad **16px**; radius 10 | `.verify` same | |
+| QR box | **130×130** SVG; pad 4px; radius 6; ink border | `.qr` **130px**; live data-URL when final | |
+| Footer | muted **10px**; absolute band ~top 930 in mock | `.legal` / footer strip | |
+| Tokens | `--plum #531B59`, `--gold #C4A85A`, `--ink #1D1534`, ok greens | `brand/tokens.css` | |
+
+### Type / fonts
+
+| Check | Pass? |
+|-------|-------|
+| With planned woff2 present: Network tab has **no** `fonts.googleapis.com` / `fonts.gstatic.com` request for Fraunces | |
+| Title glyph shapes match CERT-01 PNG (Fraunces, not Georgia) at 100% zoom | |
+| Without woff2: CDN Fraunces loads; offline → Georgia/serif still legible; plum/gold frame kept | |
+| Digests use mono stack; optional `jetbrains-mono-500.woff2` when present | |
+| Print stylesheet: frame + serif title survive; QR print-safe (data-URL or SVG placeholder) | |
+
+### Behavioral (not pure pixels)
+
+| Check | Pass? |
+|-------|-------|
+| Final + digest → live QR data-URL (`setVerifyQR` / qrcode.js) | |
+| Provisional / offline → SVG placeholder, no broken image | |
+| Multihash / blake3 fields only when digests present (never invented) | |
+| PDF path: `EmbedBrandFonts` default false; with TTF + flag, register or fail closed to Times | |
+
+### Sign-off
+
+```
+Operator: ____________  Date: ________  Host: ________
+./fetch-fonts.example.sh --check → exit 0
+Side-by-side vs CERT-01.png: geometry ____  type ____  QR ____
+Notes: ________________________________________________
+```
+
+**Status:** READY package complete (filenames + license + checklist). Pixel
+sign-off and binary drop-in remain operator actions on the deploy host — not
+git content.
+
+## Tree after drop-in (example)
+
+```
+fonts/
+  .gitkeep
+  README.md
+  LICENSE-FONTS.md
+  READY-PACKAGE.md          ← this file
+  fetch-fonts.example.sh
+  fraunces-opsz-wght-700.woff2
+  fraunces-opsz-wght-600.woff2
+  jetbrains-mono-500.woff2  (optional)
+  Fraunces[opsz,wght].ttf   (optional PDF; any *fraunces*.ttf)
+  OFL.txt
+```

site/printit.verae.ai/fonts/fetch-fonts.example.sh

@@ -94,4 +94,4 @@ echo "2. Uncomment a curl block after license review."
 echo "3. Place woff2 + OFL.txt here; run: $0 --check"
 echo "4. Reload certificate.html — local @font-face auto-selects; CDN skipped."
 echo
-echo "Status: drop-in ready — binaries not committed (OPEN-ISSUES #7 still left)."
+echo "Status: READY package — see READY-PACKAGE.md; binaries not committed."

site/printit.verae.ai/index.html

@@ -194,7 +194,7 @@
         <div class="row">
           <div>
             <h2>Debian / Ubuntu</h2>
-            <p><code>.deb</code> package 0.3.4 · <code>verae-print</code> + “Verae Timestamping” printer. Your first print opens a sign-in window to get your key.</p>
+            <p><code>.deb</code> package <strong>0.3.6</strong> (HelperVersion; published download builds may lag — see DOWNLOADS-MANIFEST) · <code>verae-print</code> + “Verae Timestamping” printer. Your first print opens a sign-in window to get your key.</p>
           </div>
           <div class="actions">
             <a class="btn btn-primary" href="/downloads/verae-print_amd64.deb">Download amd64.deb</a>