Release 0.8.0: Windows installer, twelve fixes from a real Server 2019 install, operator docs

CHANGELOG.md

@@ -10,7 +10,71 @@ ADR-007 and ADR-002.
 
 ## [Unreleased]
 
-### Added
+## [0.8.0] - 2026-08-05
+
+First release to carry the Windows installer. Everything below shipped after
+v0.7.0 was tagged, and a complete install was exercised end to end on Windows
+Server 2019 before this release was cut.
+
+### Fixed - installer, from a real Server 2019 install
+
+- `packaging` was imported by the plugin loader but declared nowhere. It reached
+  development and CI only as a dependency of pytest, so the whole suite passed
+  while a virtual environment built from `requirements.txt` alone - which is
+  exactly what the installer builds - could not import the application at all.
+  `tests/test_runtime_dependencies.py` now fails on any runtime import that is
+  not a declared dependency.
+- IIS returned 500.52 before the application was ever launched. `web.config`
+  declared `<allowedServerVariables>` for the X-Forwarded-For rule, and that
+  section ships `overrideModeDefault="Deny"`, so the whole file was rejected.
+  The installer now permits the single variable at server level instead of
+  unlocking the section for every site on the machine, and repairs a
+  `web.config` an earlier build had made unusable.
+- The config unlock ran before the application it unlocks existed, so the scoped
+  form could never succeed on a first install and every install silently fell
+  back to granting handler delegation server-wide.
+- The stage 5 smoke test discarded the status code and error page it had already
+  received, reporting "site did not return 200" for a fault IIS had named. It
+  now records both, plus the tail of the application log.
+- Database dumps were readable by every authenticated user: a directory created
+  under ProgramData inherits `Users:RX`, and the owner-only ACL was applied only
+  when the installer itself created it.
+- The uninstaller ran the 32-bit PowerShell, which cannot see IIS, so the site,
+  pool and application survived a "successful" uninstall pointing at a deleted
+  directory.
+- Uninstall matched applications by alias alone and would remove an unrelated
+  application of the same name under another site.
+- Wizard input reached a command line unchecked: unvalidated ports, a drive-root
+  path that escaped its own quote, and a password written as ANSI but read back
+  as UTF-8, which reported a correct non-ASCII password as wrong.
+- Plugin deregistration could never succeed - it omitted `--yes` against a
+  command that prompts - while the plugin directory was deleted regardless.
+- Preflight rows were drawn past the bottom of the panel and silently vanished;
+  the failures loop had no cap at all.
+
+### Changed - installer behaviour
+
+- "Is this a re-run of my install?" is answered from a durable install record
+  rather than inferred from the state of the machine. Nothing on a server says
+  who created its database tables, so a retry after a failed first install was
+  taken for an upgrade of a working system: it demanded a mandatory backup of a
+  database its own failed attempt had written, then refused to prune tables it
+  had created minutes earlier. During unfinished first provisioning the backup
+  is advisory and prune may force; on an established install both are unchanged.
+- The installer offers every bundled plugin, so one build serves any site
+  instead of one build per plugin profile.
+
+### Added - operator documentation and diagnostics
+
+- `docs/UPDATES-WINDOWS.md` - what operators should expect from future updates,
+  bug fixes and security releases, including downtime, what is preserved, and
+  the effect on other sites sharing the same IIS server.
+- `docs/RELEASING-WINDOWS.md` - how to build and release, and the two known gaps.
+- `deploy/windows/shopdb-diagnose.py` - collects what IIS answers, the config
+  lock state, the application logs and the ACLs in one pass, scrubbing secrets
+  before writing anything.
+
+### Added - the installer itself
 
 - Air-gapped Windows installer (`deploy/windows/installer/`). One `.exe` per
   site, built from that site's plugin profile, containing Python, the wheels,