Merge pull request 'docs(installer): put Phase 5 before the cutover, and flag Windows SCM as untested' (#95) from docs/installer-polish-before-cutover into main

Reviewed-on: #95

installer/PLAN.md

@@ -9,8 +9,21 @@ built](#phase-1--installer-core)), the sidecar half (binary, config, service, to
 unsupported-version path, the cached patch set — [Phase 3 as built](#phase-3--patch-tier-opt-in)),
 and the day-two commands `doctor`, `update` and `uninstall` ([Phase 4 as
 built](#phase-4--diagnostics-and-updates)). All four are on the `edge` branch, not `main`, so no
-half-capable binary is released. **The `edge → main` cutover is next**, and it now cuts a binary
+half-capable binary is released; the binary on `edge` now does everything `INSTALL.md` describes.
-that does everything `INSTALL.md` describes — Phase 5 is packaging polish, not capability.
+
+**Phase 5 comes before the cutover, not after it** (org lead, 2026-08-05). The earlier order — cut
+the release, then polish — would publish a first release that is immediately superseded, and the
+release layout is exactly what Phase 5 changes. So the `edge → main` cutover is now gated on two
+things:
+
+1. **Phase 5, packaging polish** (§5) — the last work before a first release, rather than the first
+   work after it.
+2. **The Windows SCM half being verified on a real host.** systemd registration has now been run for
+   real (see [Phase 2 as built](#phase-2--uo-link-install-and-service)), and doing it found a bug no
+   amount of unit testing had. `sc create`, the virtual service account, the failure actions and the
+   token-file ACL have **still never been executed** — that path needs one elevated Windows run, and
+   nothing should be released while the only untested code is the half that registers a service.
+
 This document is the design of record; it supersedes the informal overview it grew out of, which
 described a ServUO integration that does not match how `servuo-plugins` actually ships (see
 [Corrections](#corrections-to-the-original-overview)).
@@ -864,8 +877,20 @@ Windows host, since only half of `service.rs` compiles on either.
 ### Phase 5 — packaging polish
 
 `.deb` packaging, Windows MSI, arm64 cross build, and optional automated backup before upgrade.
-Deliberately last: v1 can register services directly (`sc create` / a written systemd unit) and ship
+Deliberately last *of the build phases*: v1 can register services directly (`sc create` / a written
-plain binaries. Nothing in Phases 1–4 should have to change to add these.
+systemd unit) and ship plain binaries. Nothing in Phases 1–4 should have to change to add these.
+
+**It now runs before the `edge → main` cutover rather than after it** (org lead, 2026-08-05). The
+original order assumed the cutover would cut a v1 and packaging would follow as a v1.x — but this
+phase changes the *release layout* (§3), so shipping first would mean a first release that is
+superseded by the next one, and operators who downloaded a bare binary being told to re-download a
+package. Deferring the cutover costs nothing: nothing is published from `edge`, and the guide's
+Appendix A is the supported path meanwhile.
+
+The two entry criteria for the cutover are therefore this phase and the outstanding **Windows SCM
+verification** (see the status header and [Phase 2 as built](#phase-2--uo-link-install-and-service)).
+The second is not busywork: running the systemd half for real found a bug that unit tests could not,
+and `sc create` remains the only code in the crate that has never executed.
 
 ---