[glenntosco]

Requested by Glenn · project thread

What changed and why

Assessment item 10. Stacks on #6 (print station), which stacks on #5. Merge in order; GitHub retargets each to main.

• MSI (packaging/msi, WiX Toolset v5 SDK project, build-time tool only, not in Rotula.sln): per-machine install to Program Files, Start menu shortcut, .rotula association (ASSOCIATE=0 turns it off), Apps & features metadata, fixed UpgradeCode {4B2C6076-5B82-411C-B751-EC4B70BEE9C6} with MajorUpgrade (same-version upgrades allowed, downgrades refused), no wizard. build-installer.ps1 builds it from the signed stage folder and signs/verifies it like the setup exe; an unsigned MSI is renamed -UNSIGNED. The Inno installer now accepts /ALLUSERS and /CURRENTUSER.
• Policies (Rotula.Files.Policy, HKLM\SOFTWARE\Policies\P4Software\Rotula, HKLM wins over HKCU, behind IPolicySource): Language and UpdateCheck (locked, shown greyed with "Managed by your organization"), DefaultPrinter (a suggestion), UserAddOns=0, McpPrinting=0, McpDatabase=0 (these can only switch things off). ADMX + en-US / es-ES ADML in packaging/policies.
• Opt-in update check (Help > Check for updates once a day): off by default, enabled by the user or by policy. At most one anonymous GET of the GitHub latest-release API per day (User-Agent Rotula, no version, no cookies, Windows proxy). SemVer compare, drafts/pre-releases ignored, release link built from the parsed version (never taken from the response). Non-modal notice; dismissing remembers that version. Never downloads or installs anything. CONTRIBUTING, decisions, SECURITY and the README privacy sections now state the rule precisely (owner-approved change to the old "no update checks" rule).
• winget: schema 1.10.0, Inno exe (user scope) + MSI (machine scope, elevationRequired, ProductCode + UpgradeCode), es-MX locale manifest; New-WingetManifest.ps1 takes -MsiPath and reads the ProductCode from the signed MSI. Submission steps in docs/releasing.md. Nothing submitted.
• Docs: new docs/deployment.md (Inno and msiexec switches, properties, uninstall, exit codes, Intune Win32 app + detection rules + ADMX ingestion, GPO, SCCM, policy reference), linked from both READMEs. 8 new strings in en + es. WiX listed in THIRD-PARTY-NOTICES as a build-only tool (MS-RL).

How it was tested

• DeploymentPolicyTests / AppUpdateCheckTests: SemVer compare, daily schedule, release parsing (drafts, pre-releases, bad answers, link not from the response), checker states, exact HTTP request shape (GET only, User-Agent and Accept only), policy reading and HKLM/HKCU precedence, ADMX/ADML checked against the registry names the code reads, MCP policy, view-model behaviour (locked language, forced update check, notice and dismissal, policy printer).
• Solution builds with 0 warnings; the 55 pure-logic tests also ran in a Linux scratch harness. App tests run on Windows CI.
• Not run anywhere yet: the WiX build and the PowerShell changes. They need a first run on the Windows release machine; ICE warnings or a WiX v5 syntax detail may surface.

Checklist

• Build passes; tests run on Windows CI
• New behavior has tests
• XML docs and "why" comments
• New text in both Strings.en.resx and Strings.es.resx
• Network: only the opt-in, anonymous update check (off by default, policy can force off); light theme only
• WiX (build-only, MS-RL) listed in THIRD-PARTY-NOTICES.md; nothing new is redistributed
• CHANGELOG.md updated
• Hygiene check passes

Notes

• Please check whether the WiX Open Source Maintenance Fee applies to P4 Software before the first MSI release.
• The MSI has no licence page: deploying it means the admin accepts LICENSE-THIRD-PARTY.txt for the users. Documented, and joins the existing lawyer-review note.
• The ADMX "supported on" text says "Rotula 0.4.0 or later", assuming the next version number.
• Intune OMA-URI enum values follow Microsoft's documented pattern but were not tried against a real tenant.

---

Generated by Claude Code