Windows Installer build (g3.11)

Native payload is built from this source tree with build.py --portable --flutter --skip-portable-pack --hwcodec --vram. The matching dependency source archive accompanies the release.

The installer authoring is build-msi.py, Product.wxs and SetupBootstrap.cs. Place these scripts under <workspace>/work/client and the brand image under <workspace>/work/addressbook/static/g3-login-art.png, matching the script paths. Adjust BUILD to your native build directory. Download the official WiX 3.14.1 binaries from github.com/wixtoolset/wix3/releases/tag/wix3141rtm into work/client/wix3141/bin. Corresponding WiX source and license are in this installer source directory.

Run build-msi.py after building/signing the payload. Sign both MSI packages with your own code-signing identity, then run build-setup-launchers.py to bind their SHA256 digests into the visible compatibility launchers. Compile using the .NET Framework 4.x C# compiler; sign those executables afterwards. Our certificate private key is not part of the source distribution. sign-g3.ps1 must be adapted to your own certificate thumbprint.

MSI files use native ServiceInstall/ServiceControl, Registry, CopyFile and WiX native FirewallException actions. CloseApplication sends scoped close/end-session messages to this client only; it does not forcibly terminate arbitrary processes. No cmd/PowerShell/netsh/sc/reg installation scripts are invoked. TCP/UDP program-bound inbound exceptions are retained. Existing profiles and passwords are not owned/deleted by MSI. The EnrollmentSource registry value allows the same signed customer MSI, renamed with its scoped code, to open customer enrollment.

Manual launchers display a visible branded form and download a version-pinned MSI only after the user chooses Install. New native clients prefer MSI updates. Old native clients receive the compatibility EXE. A silent install via msiexec /qn is intended only for authorized managed deployment; the public manual setup never selects /qn.
