r468 / r469 的 preview.msix 是未签名的打包检查文件。Windows 无法验证发布者，会显示 0x800B010A。未签名包不能通过导入 CER 安装。r481 正在准备，测试签名尚待恢复，目前不能视为已签名交付或正式商店包。
Boundless-Flow-0.5.0-r480-windows-x64-setup.exe 和目录 target/windows-installers/r480/ 是旧版示例，不表示 r481 已交付。NSIS 文件若未代码签名，Windows 仍可能提示未知发布者；下面的证书步骤只用于带签名的测试 MSIX。只有收到带签名的 MSIX 和配套 CER 后，才适用下面的侧载步骤。旧版目录示例为 target/microsoft-store/v0.5.0/r480-local-test/；实际源目录和文件名以收到的交付为准。证书和安装包应放在同一个文件夹中，模型与显卡驱动需另外准备。
先按配套交付记录核对包签名与 CER 是否匹配。只有复用 r470 附带的同一证书、证书仍有效且此前已受信任时，才无需重复导入。确认愿意信任后再执行以下步骤。
Boundless-Flow-Local-Test.cer，点击“安装证书”。Cert:\LocalMachine\TrustedPeople。不要选择“受信任的根证书颁发机构”。这是测试证书，尚未获得公开受信任的发布者身份。公开证书不包含私钥；签名私钥不会放进安装包，也与音频水印密钥无关。
核验通过后，双击实际交付的签名包，再点击“安装”。Boundless-Flow-v0.5.0-r480-cuda-x64-local-test-signed.msix 仅为旧版文件名示例，文件名本身不能证明已签名。不要点击旧的 preview.msix；若收到的包未签名，请等待签名交付。若已签名包仍显示证书错误，检查上一步是否导入到本地计算机 → 受信任的人，而非当前用户或其他证书存储。
如果出现依赖错误，请记录完整错误码。此打包配置声明需要 Microsoft.VCLibs.140.00.UWPDesktop x64、版本不低于 14.0.30704.0；实际依赖以交付包声明为准。证书修复不等于依赖已安装；本流程不会自动下载依赖。
安装成功后，从开始菜单打开 Boundless Flow Preview，在“配置引导 → 本地模型库”登记自己的模型。桌面程序与 CPU/CUDA 组件及其版本，以安装目录附带的文件清单为准。NVIDIA CUDA 能否运行取决于模型、显存及驱动。
收到签名包、配套 CER 和脚本后，在安装文件夹打开 PowerShell，运行以下命令只检查文件哈希和签名证书，不改变系统设置：
.\Install-TestCertificate.ps1
核对后若决定用脚本信任证书，使用管理员 PowerShell，并明确输入 TRUST：
.\Install-TestCertificate.ps1 -TrustCertificate
脚本只导入公开证书到“本地计算机 → 受信任的人”，不导入私钥、不写根证书存储、不修改执行策略，也不自动安装应用。如果系统策略阻止运行脚本，使用上面的图形界面步骤即可。
见安装目录 SHA256SUMS / See the adjacent SHA256SUMS2f6b0ce5aea75e8321b73e5d58535fbfda949881cdb0bd678fc964311fcd4855上列指纹和有效期只适用于同一张 r470/r475 测试证书。新证书必须按配套交付记录核对；旧指纹不能证明 r481 已签名。
请核对实际安装目录附带的版本和 SHA256SUMS，并使用默认只检查脚本核验文件哈希与公开证书匹配。本文的步骤不会替你信任证书或安装应用；是否安装成功，需要以当前电脑上的 Windows 安装结果确认。候选测试签名包不是正式商店包，测试签名不代表微软认证。
测试证书只用于本机侧载验收。取得 Partner Center 的正式产品身份后，需要按正式身份重新打包并提交认证。向 Microsoft Store 提交 MSIX/AppX 不要求购买 CA 证书或提供 PFX；微软会重新签名通过认证的包，普通购买者不需要导入测试证书。这与直接在商店外安装 MSIX 不同，后者仍需应用签名和本机信任。商店不会替 MSI/EXE 重签，这类提交需要自己的有效 Authenticode 签名。参见微软提交与签名说明。当前预览包仍需正式身份、声明及实际运行核验，不代表已满足上架条件。
r481 is in preparation; test signing is pending restoration. It is not a signed delivery or a formal Store package. Use these sideloading steps only after receiving a signed MSIX and its matching CER.
The r468/r469 preview.msix files were unsigned packaging previews. Windows cannot validate their publisher and may show 0x800B010A. Importing a CER cannot make an unsigned MSIX installable.
target/windows-installers/r480/ is an example, not confirmation that r481 has been delivered. Use the directory and filenames in your actual delivery. An unsigned NSIS file may show an unknown-publisher warning. The certificate steps below apply only to a signed test MSIX.target/microsoft-store/v0.5.0/r480-local-test/ is an example. Use your actual delivery directory and first verify that the package signature matches the accompanying CER and delivery record. Only if you choose to trust that certificate, double-click Boundless-Flow-Local-Test.cer → Install Certificate → Local Machine → Place all certificates in the following store → Trusted People. Approve the Windows administrator prompt. The store is Cert:\LocalMachine\TrustedPeople. Do not choose Trusted Root Certification Authorities.Boundless-Flow-v0.5.0-r480-cuda-x64-local-test-signed.msix is an earlier filename example; its name does not prove it is signed. If your package is unsigned, wait for a signed delivery. If a signed package still fails certificate validation, confirm that the public CER was imported into Local Machine / Trusted People, rather than Current User. For a dependency error, record the full error code. This packaging configuration declares x64 Microsoft.VCLibs.140.00.UWPDesktop version 14.0.30704.0 or later; check your delivered package for its actual requirements. This process does not download dependencies automatically.If your signed delivery includes the matching CER and helper, run .\Install-TestCertificate.ps1 for a read-only check. If you then choose to trust the public test certificate, use Administrator PowerShell, run .\Install-TestCertificate.ps1 -TrustCertificate, and type TRUST. The script does not install private keys, modify Trusted Root or execution policies, or install the app. If scripts are blocked, use the graphical certificate wizard.
Earlier package version example: 1.5.480.0. Check your actual delivery record and adjacent SHA256SUMS for its version and hashes. The hash and expiry above apply only to the same r470/r475 test certificate. Check a new certificate against its accompanying delivery record; the old hash does not prove that r481 is signed. If the exact same r470 certificate is already trusted and still valid, you do not need to import it again. The private signing key is retained separately, never distributed, and is unrelated to audio watermark keys.
Check the adjacent SHA256SUMS and run the default read-only helper to verify file hashes and public certificate matching. These instructions do not trust the certificate or install the app on your behalf. Confirm installation from the Windows result on your own computer. A signed test candidate is not a formal Store package or proof of Microsoft certification.
This certificate is for local sideload testing only. A Store release requires the real Partner Center product identity, matching package declarations and certification. Submitting an MSIX/AppX to Microsoft Store does not require purchasing a CA certificate or providing a PFX: Microsoft re-signs accepted packages, so customers do not need this test certificate. Direct MSIX distribution outside the Store still needs signing and local trust. Microsoft does not re-sign MSI/EXE submissions; those need your own valid Authenticode signature. See Microsoft's submission and signing guide. The current preview has not thereby become Store-ready.