3GT DIRECTORY 0.1.0 — WINDOWS 11 PRO WEEKEND TRIAL

The current production PC has not been changed by development.
This is a pilot package: Windows service, kiosk, update, and power-cycle tests
must be performed on the actual PC before declaring it production-ready.

1. PREPARE
   Record the current Windows account, automatic-login method, PyroSign startup
   shortcut/tasks, browser profile, portrait resolution, and TV input/power settings.
   Keep a working administrator login and console access available.
   Preserve the existing PyroSign installation and configuration.
   Assigned Access must be tested at the physical console (or a remote tool that
   controls that console). An RDP session cannot validate the kiosk session.

2. INSTALL PLAYER WITHOUT CHANGING THE CURRENT KIOSK
   Extract the entire ZIP to a local folder; do not run it inside the ZIP viewer.
   Open https://sign.3gt.us on an owner's computer, sign in, then choose
   Screens > Connect a screen. Name it, for example, "900 — Main lobby".
   Double-click Install.cmd and approve the administrator prompt.
   Enter the pairing code when asked. It is valid for 15 minutes, once only.
   The package is not code-signed; use only the package from sign.3gt.us and
   compare its SHA-256 to the published SHA256SUMS.txt. Do not disable antivirus.

   Setup installs:
     C:\Program Files\3GT Directory\directory.exe and scripts
     C:\ProgramData\3GTDirectory\player.json (private credential)
     C:\ProgramData\3GTDirectory\cache.json (last saved display)
     Windows service "3GTDirectory", automatic start, running as LocalService

   No Node, Python, or other runtime is needed. No inbound firewall opening.
   This step does not change Windows sign-in, PyroSign, display rotation, or power.
   Open http://127.0.0.1:8765/display.html locally to inspect the saved display.

3. VERIFY CONTENT AND SYNC
   Check all 36 tenants against the source list; shared suites are intentional.
   Confirm the title, time zone, date, weather for Bloomington ZIP 55420, and fit.
   In the owner website edit one row and select Save draft: the player must stay
   unchanged. Select Publish changes: it should update within five minutes.
   Restore the prior version from Publish history, then publish it again.
   Confirm Screens shows the downloaded revision and an active renderer.

4. VERIFY OFFLINE RECOVERY
   After the first sync, disconnect internet (not HDMI).
   Refresh the display. Restart the 3GTDirectory service. Reboot Windows and
   reopen the local display. The last tenant directory and local clock must work.
   Weather hides when its hourly forecast expires; this is intentional.
   Reconnect internet and confirm the latest published revision arrives.

5. ACTIVATE WINDOWS KIOSK DURING THE MAINTENANCE WINDOW
   Fully patch Windows first. The script requires Windows 11 24H2 build
   26100.7840 or later and the matching maintenance-window policy definitions.
   Use an elevated Windows PowerShell:

     & 'C:\Program Files\3GT Directory\Set-Kiosk.ps1'

   Existing Assigned Access, Shell Launcher, automatic login, or managed update
   policies cause a clear stop before changes. In particular, an existing
   PyroSign auto-login may need a documented migration before this step can run.
   The script preserves the prior power scheme and exact policy values.
   It creates a dedicated automatic-sign-in kiosk account through Assigned Access.
   It configures the TV page in Edge full-screen, local renderer recovery, no
   browser welcome/recommendation pages, no AC sleep/display timeout, and a daily
   Windows Update maintenance window from 01:00 to 06:00 (PC local time).
   Edge automatic update checks are suppressed from 07:00 to 23:00.
   The owned kiosk browser refreshes once at about 04:30 to adopt Edge updates.
   Security updates remain enabled. Updates begun overnight can overrun the window.

   The script does not reboot. Restart manually when ready and verify automatic
   sign-in and a full-screen directory with no desktop/browser chrome.
   Make sure the Windows time zone is Central and the display is still portrait.

6. ACCEPTANCE TESTS BEFORE BUSINESS HOURS
   [ ] Reboot with internet connected; sign returns with no intervention.
   [ ] Reboot with internet disconnected; saved sign returns.
   [ ] Stop/restart the player service; visible content remains or recovers.
   [ ] Close the owned kiosk browser; Assigned Access restarts it.
   [ ] Kill/hang the owned renderer in a controlled test; the watchdog recovers it
       after its two-minute grace period (at most one restart per five minutes).
   [ ] Install an available Windows/Edge update overnight and reboot; verify no
       welcome tab, browser sign-in prompt, new desktop, or notification overlay.
   [ ] Turn the TV off/on; verify HDMI reconnect and portrait output.
   [ ] Cut/restore power safely; verify BIOS "restore after AC loss" and TV behavior.
   [ ] Let the display run through a full business day and check it remotely.
   [ ] Confirm your remote support tool can reach the console without leaving the
       PC locked, signed out, or in an RDP session. The owner uses the website only.

   The website heartbeat cannot prove the physical TV is on. TV firmware/HDMI and
   Windows device-policy behavior must be checked on this hardware.

7. ROLLBACK TO PYROSIGN
   Use Ctrl+Alt+Del to leave the kiosk and sign in with the administrator account.
   In elevated PowerShell:

     & 'C:\Program Files\3GT Directory\Set-Kiosk.ps1' -Restore

   Restart, sign into the previous account, and restore its documented PyroSign
   startup/automatic-login method if it was migrated manually.
   The restore script removes only this app's kiosk/watchdog and restores its
   saved browser/update policy values and previous active power scheme.
   It stops rather than overwrites a newer, unrelated Assigned Access profile.

   To remove the background player service as well:
     & 'C:\Program Files\3GT Directory\Uninstall-Player.ps1'

   Saved data and scripts are retained for recovery. Disconnect the screen in
   the website to revoke its credential. Do not share player.json or setup keys.

TROUBLESHOOTING
   Service: Get-Service 3GTDirectory
   Local health: http://127.0.0.1:8765/healthz
   Log: C:\ProgramData\3GTDirectory\player.log
   Previous run: player.log.previous
   Kiosk result: C:\ProgramData\3GTDirectory\kiosk-result.json
   Rollback: C:\ProgramData\3GTDirectory\kiosk-backup.clixml
   Windows logs: Microsoft-Windows-AssignedAccess and DeviceManagement events.

Ordinary owner edits never require Remote Desktop or signing in to this PC.
