Consolidate WinGet release documentation

README.md

@@ -18,7 +18,7 @@
 
 **Recommended: download the portable ZIP** from [GitHub Releases](https://github.com/harder/wingetscout/releases). It includes `wingetscout.exe` and the companion files needed for the full WinGet COM experience. No .NET runtime or installer is required.
 
-A WinGet community package is being prepared as `Harder.WinGetScout`. Use the release ZIP until the [community submission](https://github.com/harder/wingetscout/blob/main/docs/winget-submission.md) is accepted.
+A WinGet community package has been submitted as `Harder.WinGetScout`. Use the release ZIP until the [community submission](https://github.com/microsoft/winget-pkgs/pull/451328) is accepted.
 
 After that package is accepted, `winget install -e --id Harder.WinGetScout` will install the ZIP into WinGet's managed portable directory and add `wingetscout` to your user `PATH`. Open a **new terminal** to use the command from any folder. The WinGet manifest already requests this behavior; it does not require a separate installer or manual PATH editing. WinGet verifies the downloaded ZIP hash, but it does not sign the executable. See [signing and distribution](https://github.com/harder/wingetscout/blob/main/docs/signing-and-distribution.md).
 

docs/architecture.md

@@ -93,6 +93,6 @@ lock files cover the normal app, the MSIX Identity variant, and tests.
 `.github/workflows/ci.yml` builds and tests, while
 `.github/workflows/release.yml` publishes x64 and ARM64 assets,
 checksums, and attestations. The portable ZIP keeps the COM companion
-files together. See the [WinGet submission runbook](winget-submission.md)
+files together. See [release and WinGet updates](signing-and-distribution.md#releases-and-winget-updates)
 for the community package workflow and the [website guide](website.md)
 for the documentation site.

docs/index.md

@@ -7,7 +7,6 @@ Start with the [README](../README.md) for installation and a quick tour, or
 | --- | --- |
 | [Usage](usage.md) | Navigation, package actions, saved sets, and update checks |
 | [Architecture](architecture.md) | Backend, UI, workflow, Native AOT, and release code |
-| [Signing and distribution](signing-and-distribution.md) | Portable and MSIX release plan and signing |
-| [WinGet submission](winget-submission.md) | Community package manifest generation and validation |
+| [Signing and distribution](signing-and-distribution.md) | Releases, WinGet manifest updates, and portable/MSIX signing |
 | [Directory submissions](directory-submissions.md) | Other listing and package directory submissions |
 | [Website](website.md) | Building the site and refreshing its screenshots |

docs/signing-and-distribution.md

@@ -8,6 +8,41 @@ WinGet verifies the ZIP against `InstallerSha256`, extracts it into a managed po
 
 Signed **MSIX** is a later distribution option. It supplies Windows package identity for the out-of-process WinGet COM backend and needs a certificate trusted by the target PC. Its Native AOT build also ships `Microsoft.Management.Deployment.winmd` so WinRT can resolve the projected types; identity alone is insufficient. The release workflow builds and signs MSIX only when all signing settings below exist. At present it signs the MSIX package, **not** the portable ZIP's executable. The build modes and activation check are documented in the [README](../README.md#backends-and-capabilities).
 
+## Releases and WinGet updates
+
+GitHub releases can ship while a WinGet submission is under review. Bump
+`WinGetScout.csproj` to a new version, merge it into `main`, and push a matching
+`v<version>` tag on that commit. The release workflow checks the version and
+main ancestry, stages and verifies all assets, and publishes the release.
+Keep published assets immutable: an existing WinGet manifest's URLs and hashes
+must continue to identify the same bytes. Publish a new version for fixes.
+
+For stable releases, the workflow downloads the published ZIPs back and saves
+their three-file WinGet manifest set as the `winget-manifests-<version>` workflow
+artifact. To regenerate and validate that set locally:
+
+```powershell
+$version = '1.0.2' # substitute an already published release
+pwsh ./packaging/prepare-winget-submission.ps1 -Version $version
+```
+
+The helper requires `gh`, a GitHub login, and `winget`. Test installation in
+Windows Sandbox using the published ZIPs. After installation, open a new terminal
+so it sees the updated user `PATH`, and use `Get-Command wingetscout` to verify the
+command alias resolves to the installed package. Run `wingetscout --smoke`,
+`wingetscout --comdiag`, and test uninstall. For a local-manifest install before catalog acceptance,
+uninstall with `winget uninstall --manifest <manifest-directory>`; the final
+community package ID may not yet resolve. See Microsoft's
+[submission and Sandbox validation instructions](https://learn.microsoft.com/en-us/windows/package-manager/package/repository).
+
+Keep the package ID `Harder.WinGetScout`. Each WinGet PR contains only one
+version's three YAML files under `manifests/h/Harder/WinGetScout/<version>/`.
+If the initial package PR is still open, the recommended approach for shipping
+the newest build first is to update that PR's branch with the new manifest set,
+remove the previously proposed version's files, and update its title and test
+notes. Validation must run again. If the earlier version has already merged,
+submit the new version in a separate PR and retain the accepted version's files.
+
 ## Get a publicly trusted signature for MSIX
 
 The workflow is wired to [Azure Artifact Signing](https://learn.microsoft.com/en-us/azure/artifact-signing/quickstart), previously called Azure Trusted Signing. Its Basic tier currently costs about US$10 per month; check [Microsoft's current pricing](https://learn.microsoft.com/en-us/azure/artifact-signing/how-to-change-sku) before creating an account. Public Trust is available to individual developers in the US and Canada, and to organizations in Microsoft's listed regions. For individual validation, the Azure billing account must be **Individual**, and its legal name and address must match the government ID used for verification.