From 2b2a51dccc04814b3e18d83e0f78b2b367dac308 Mon Sep 17 00:00:00 2001
From: OneDeadMachine <onedeadmachine@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:26:27 +0300
Subject: [PATCH 1/2] =?UTF-8?q?feat:=20deliver=20Pair=20Repair=20Wizard=20?=
 =?UTF-8?q?v3.1=20beta=20/=20=D0=B2=D1=8B=D0=BF=D1=83=D1=81=D1=82=D0=B8?=
 =?UTF-8?q?=D1=82=D1=8C=20=D0=BC=D0=B0=D1=81=D1=82=D0=B5=D1=80=20=D0=BF?=
 =?UTF-8?q?=D0=B0=D1=80=D0=BD=D0=BE=D0=B3=D0=BE=20=D1=80=D0=B5=D0=BC=D0=BE?=
 =?UTF-8?q?=D0=BD=D1=82=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RU: Добавлен рабочий WPF-мастер для доменного WinRM/Kerberos, live TLS pairing и подписанного offline-обмена. Реализованы общий диагностический план, host/client saga, явный abort, таймауты, точечные Firewall/SMB/RPC/Spooler/queue/ACL действия, интерактивный контекст доменного клиента, Credential Manager и физическая тестовая страница. Обновлены privacy/security/architecture, beta template и двуязычные руководства.

EN: Add a functional WPF wizard for domain WinRM/Kerberos, live TLS pairing, and signed offline exchange. Implement shared diagnostics, host/client saga, explicit aborts, timeouts, narrow Firewall/SMB/RPC/Spooler/queue/ACL actions, the domain client's interactive context, Credential Manager, and physical test-page verification. Update privacy/security/architecture, beta reporting, and bilingual guides.
---
 .github/ISSUE_TEMPLATE/beta-report.yml        |   4 +-
 CODE_SIGNING_POLICY.md                        |  15 +
 PRIVACY.md                                    |   2 +
 README.md                                     |   7 +-
 SECURITY.md                                   |   2 +
 docs/architecture.en.md                       |  16 +
 docs/architecture.md                          |  17 +
 docs/pair-repair.en.md                        |  39 ++
 docs/pair-repair.md                           |  39 ++
 docs/releases/v3.1.0-beta.1.md                |  31 +
 src/W-Fix.App/App.xaml.cs                     |  25 +
 src/W-Fix.App/MainWindow.xaml                 |   7 +-
 src/W-Fix.App/MainWindow.xaml.cs              |   7 +
 src/W-Fix.App/PairRepairWindow.xaml           | 213 +++++++
 src/W-Fix.App/PairRepairWindow.xaml.cs        |  67 +++
 .../ViewModels/PairRepairViewModel.cs         | 528 ++++++++++++++++++
 src/W-Fix.App/W-Fix.App.csproj                |   2 +-
 .../Abstractions/PairRepairContracts.cs       |   2 +
 src/W-Fix.Core/Models/PairRepairModels.cs     |   5 +-
 src/W-Fix.Core/Pairing/PairDiagnostics.cs     |  14 +
 .../Pairing/PairInventoryService.cs           |  19 +-
 .../Pairing/PairInvitationValidator.cs        |   3 +
 .../Pairing/PairProtocolSerializer.cs         |  22 +-
 src/W-Fix.Core/Pairing/PairRepairActions.cs   |  61 +-
 src/W-Fix.Core/Pairing/PairRepairExecutor.cs  |  11 +-
 src/W-Fix.Core/Pairing/PairRepairPlanner.cs   |   1 +
 .../Pairing/PairSessionActionDispatcher.cs    |  52 +-
 .../Pairing/TlsPairSessionTransport.cs        |  17 +-
 src/W-Fix.Core/W-Fix.Core.csproj              |   2 +-
 tests/W-Fix.Core.Tests/PairRepairCoreTests.cs |  50 +-
 30 files changed, 1239 insertions(+), 41 deletions(-)
 create mode 100644 docs/pair-repair.en.md
 create mode 100644 docs/pair-repair.md
 create mode 100644 docs/releases/v3.1.0-beta.1.md
 create mode 100644 src/W-Fix.App/PairRepairWindow.xaml
 create mode 100644 src/W-Fix.App/PairRepairWindow.xaml.cs
 create mode 100644 src/W-Fix.App/ViewModels/PairRepairViewModel.cs

diff --git a/.github/ISSUE_TEMPLATE/beta-report.yml b/.github/ISSUE_TEMPLATE/beta-report.yml
index d0aaacd..d12970e 100644
--- a/.github/ISSUE_TEMPLATE/beta-report.yml
+++ b/.github/ISSUE_TEMPLATE/beta-report.yml
@@ -13,7 +13,7 @@ body:
     id: version
     attributes:
       label: W-Fix version / Версия W-Fix
-      placeholder: v3.0.0-beta.1
+      placeholder: v3.1.0-beta.1
     validations:
       required: true
   - type: dropdown
@@ -35,6 +35,8 @@ body:
         - Local repair / Локальный ремонт
         - Active Directory domain
         - Workgroup / Одноранговая сеть
+        - Pair Repair live / Парный ремонт по сети
+        - Pair Repair offline / Парный ремонт через файлы
     validations:
       required: true
   - type: textarea
diff --git a/CODE_SIGNING_POLICY.md b/CODE_SIGNING_POLICY.md
index 3a82766..a9efb16 100644
--- a/CODE_SIGNING_POLICY.md
+++ b/CODE_SIGNING_POLICY.md
@@ -28,3 +28,18 @@ Free code signing provided by [SignPath.io](https://signpath.io/), certificate b
 Until SignPath approval, public beta releases remain explicitly marked unsigned and include SHA-256 checksums. For internal testing, a separately documented self-signed certificate may be trusted manually on managed test computers; it is never presented as publicly trusted.
 
 See also [Privacy Policy](PRIVACY.md) and [Security Policy](SECURITY.md).
+
+## One-time catalog key bootstrap / Первичная настройка ключа каталога
+
+Владелец релиза выполняет это локально один раз. Закрытый файл не коммитится и удаляется сразу после записи секрета:
+
+```powershell
+dotnet run --project tools/W-Fix.CatalogSigner -- generate private.pem public.pem
+Get-Content private.pem -Raw | gh secret set KNOWN_ISSUES_PRIVATE_KEY_PEM --repo OneDeadMachine-Dev/W-FIX
+Copy-Item public.pem src/W-Fix.Core/Catalog/known-issues-public.pem
+Remove-Item private.pem, public.pem -Force
+```
+
+После обновления публичного ключа требуется обычный PR и проверка `verify` на тестовой подписи. SignPath identifiers добавляются как repository variables, а `SIGNPATH_API_TOKEN` — только как Environment secret `release`. Окружение `release` требует ручного подтверждения владельца и принимает только теги `v*`.
+
+The release owner performs this once on a trusted local machine. The private file is never committed and is deleted immediately after the secret is stored. Updating the public key requires a normal PR and a test `verify` run. SignPath identifiers are repository variables; `SIGNPATH_API_TOKEN` is restricted to the `release` Environment secret. The `release` environment requires manual owner approval and accepts only `v*` tags.
diff --git a/PRIVACY.md b/PRIVACY.md
index 7f4c773..71defbf 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -10,6 +10,7 @@ W-Fix не содержит телеметрии, рекламы и автома
 - Альтернативные учётные данные сохраняются только после явного согласия в Windows Credential Manager. Пароли не записываются в конфигурацию, аргументы процессов, логи и отчёты.
 - При диагностике W-Fix может загрузить декларативный каталог известных проблем с официального GitHub Release проекта. Загруженный каталог проверяется цифровой подписью и не может содержать исполняемый код.
 - W-Fix не передаёт сведения третьим лицам, если пользователь сам не экспортировал и не отправил отчёт или support bundle.
+- Pair Repair обменивается данными только между двумя явно выбранными ПК. Приглашение и offline-снимок не содержат паролей; live-listener и временное правило Firewall удаляются после сессии.
 
 Сообщить о проблеме конфиденциальности можно через [Private vulnerability reporting](https://github.com/OneDeadMachine-Dev/W-FIX/security/advisories/new).
 
@@ -23,5 +24,6 @@ W-Fix contains no telemetry, advertising, or automatic report uploads. It operat
 - Alternate credentials are saved only with explicit consent in Windows Credential Manager. Passwords are never written to configuration, process arguments, logs, or reports.
 - During diagnostics W-Fix may download a declarative known-issues catalog from the project's official GitHub Release. The catalog is signature-verified and cannot contain executable code.
 - W-Fix sends no information to third parties unless the user explicitly exports and shares a report or support bundle.
+- Pair Repair exchanges data only between two explicitly selected PCs. Invitations and offline snapshots contain no passwords; the live listener and temporary Firewall rule are removed after the session.
 
 Report a privacy concern through [Private vulnerability reporting](https://github.com/OneDeadMachine-Dev/W-FIX/security/advisories/new).
diff --git a/README.md b/README.md
index 9dad730..f2cc9d3 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
 
 [![Platform](https://img.shields.io/badge/platform-Windows%2010%2F11-blue?logo=windows)](https://www.microsoft.com/windows)
 [![.NET](https://img.shields.io/badge/.NET-8.0-purple?logo=dotnet)](https://dotnet.microsoft.com/)
-[![Release](https://img.shields.io/badge/version-3.0.0--beta.1-blue)](https://github.com/OneDeadMachine-Dev/W-FIX/releases)
+[![Release](https://img.shields.io/badge/version-3.1.0--beta.1-blue)](https://github.com/OneDeadMachine-Dev/W-FIX/releases)
 [![License](https://img.shields.io/badge/license-MIT-orange)](LICENSE)
 [![Author](https://img.shields.io/badge/author-OneDeadMachine-red)](https://github.com/OneDeadMachine)
 
@@ -45,6 +45,7 @@
 
 ### Плюс:
 - 🌐 **Remote Repair Center v3** — несколько доменных ПК, preflight, инвентаризация, автоматический план, проверка и изолированный rollback
+- 🔗 **Pair Repair Wizard v3.1** — ремонт общего принтера между двумя ПК: TLS pairing, общий диагноз, двусторонний rollback и offline fallback
 - 🧠 **Диагностические правила** — вывод по наблюдаемым фактам, уверенность и официальный источник известной проблемы
 - 🔐 **Credential Manager** — альтернативная доменная учётная запись без пароля в конфигурации, CLI или логах
 - 📊 **Отчёты** — JSON/HTML для каждого запуска и обезличенный ZIP support bundle
@@ -70,6 +71,8 @@
 3. Запусти **Диагностику**, проверь факты и сформированный план.
 4. Подтверди пакетный ремонт. Сбой одной машины не останавливает остальные; обратимые шаги неуспешной цели откатываются.
 
+Если общий принтер подключён к другому ПК, открой **Pair Repair** на обеих машинах. Хост создаёт одноразовый `.wfixpair`, оба пользователя сверяют код, а клиент формирует и выполняет общий план. Подробная инструкция: [Pair Repair на русском](docs/pair-repair.md) / [English guide](docs/pair-repair.en.md).
+
 > ⚠️ Права администратора обязательны — фиксеры изменяют реестр и службы Windows.
 
 ---
@@ -111,6 +114,7 @@ W-Fix/
 │   │   ├── Remote/                # WinRM preflight и инвентаризация
 │   │   ├── Diagnostics/           # Evidence-based правила
 │   │   ├── Repair/                # Планировщик, legacy-адаптер и batch executor
+│   │   ├── Pairing/               # TLS pairing, SMB/RPC diagnostics и двухузловая saga
 │   │   ├── Catalog/               # Подписанный каталог Windows known issues
 │   │   ├── Fixers/               # 12 фиксеров (FixerBase → IFixer)
 │   │   ├── Services/
@@ -123,6 +127,7 @@ W-Fix/
 │   └── W-Fix.App/                # WPF UI (MVVM + CommunityToolkit)
 │       ├── ViewModels/
 │       ├── RemoteCenterWindow.xaml
+│       ├── PairRepairWindow.xaml
 │       ├── Views/
 │       └── Assets/icon.ico
 └── publish/W-Fix.exe             # Готовый портативный файл
diff --git a/SECURITY.md b/SECURITY.md
index ec3d991..db7eda1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -18,5 +18,7 @@ Include the W-Fix version, Windows version, expected and actual behavior, and mi
 
 - W-Fix требует административных прав, потому что изменяет службы, реестр, политики печати и драйверы.
 - Remote Center выполняет действия только на явно выбранных целях.
+- Pair Repair использует TLS 1.2+, временный ECDSA-ключ, pinning, одинаковый код и подтверждение на обоих ПК. По каналу разрешены только типизированные DTO и встроенные `pair.*` действия.
+- Pair listener не открывается на Public-профиле; SMB1 не поддерживается.
 - Загружаемый known-issues catalog декларативен, подписан ECDSA и ссылается только на встроенные действия.
 - Private keys, GitHub tokens and SignPath tokens must never be committed to the repository.
diff --git a/docs/architecture.en.md b/docs/architecture.en.md
index 0fab4ac..2d99485 100644
--- a/docs/architecture.en.md
+++ b/docs/architecture.en.md
@@ -23,3 +23,19 @@ short-lived `PSCredential`; it is never embedded in a PowerShell script, process
 The known-issues catalog is declarative. A valid ECDSA signature does not grant code execution: catalog entries can
 only reference action IDs compiled into W-Fix. Microsoft source URLs are restricted to `learn.microsoft.com` and
 `support.microsoft.com`.
+
+## Pair Repair v3.1 pipeline
+
+`IPairSessionTransport` creates a one-time TLS session with a temporary ECDSA P-256 certificate. The client checks
+the public-key pin from `.wfixpair`; both windows show the derived six-digit code, and application messages remain
+blocked until both users approve. The protocol accepts only versioned DTOs and built-in `pair.*` identifiers. It
+cannot carry PowerShell source or passwords.
+
+`IPairInventoryService` checks only the explicitly named peer. `IPairRepairExecutor` runs the shared plan as a
+two-node saga: remote host steps go through `PairAgentCommandLoop`, while client steps use the local dispatcher.
+Every mutation has a checkpoint. Failure, cancellation, timeout, or connection loss triggers reverse rollback and
+an explicit `abort`; `commit` is sent only after every verification passes.
+
+The host Firewall lease is scoped to the current executable, exact port, `LocalSubnet`, and Private/Domain profiles.
+Offline ECDSA-signed snapshots detect tampering, but each side repairs independently and therefore cannot offer
+cross-machine automatic rollback. A `HOST\\User` password is written directly to Windows Credential Manager.
diff --git a/docs/architecture.md b/docs/architecture.md
index b381ab4..3a38614 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -11,6 +11,7 @@
 - `W-Fix.Core.Diagnostics` — правила, формирующие находки только из наблюдаемых фактов.
 - `W-Fix.Core.Repair` — планирование, адаптер двенадцати v2-фиксеров и ограниченное пакетное выполнение.
 - `W-Fix.Core.Catalog` — встроенный и подписанный онлайн-каталог известных проблем Windows.
+- `W-Fix.Core.Pairing` — TLS-транспорт, подписанный offline-обмен, парная диагностика и двухузловая saga.
 
 UI не должен самостоятельно определять успешность системной команды. Источником истины является
 `PowerShellExecutionResult`, а итог многошагового фиксера вычисляется из результатов всех выполненных шагов.
@@ -95,6 +96,22 @@ PowerShell Remoting выполняет команды в сервисном ко
 Каталог известных проблем декларативен и не содержит скриптов. Даже корректно подписанная запись может выбрать
 только действие, уже скомпилированное и зарегистрированное в W-Fix.
 
+## Конвейер Pair Repair v3.1
+
+`IPairSessionTransport` создаёт одноразовую TLS-сессию с временным ECDSA P-256 сертификатом. Клиент проверяет
+pin публичного ключа из `.wfixpair`, оба окна показывают вычисленный шестизначный код, а прикладные сообщения
+разрешаются только после двух подтверждений. Протокол принимает только версионированные DTO и встроенные
+идентификаторы `pair.*`; строки PowerShell и пароли через него не передаются.
+
+`IPairInventoryService` проверяет только явно названного соседа. `IPairRepairExecutor` выполняет общий план как
+двухузловую saga: remote host-side шаги проходят через `PairAgentCommandLoop`, local client-side шаги выполняются
+локальным dispatcher. До каждого изменения создаётся checkpoint. Ошибка, отмена, timeout или потеря соединения
+вызывают обратный rollback и явный `abort`; `commit` отправляется только после повторной проверки всех шагов.
+
+На хосте действует временное Firewall-правило для текущего EXE, точного порта, `LocalSubnet` и Private/Domain.
+В offline-режиме ECDSA-подписанный снимок защищён от изменения, но обе стороны ремонтируются раздельно, поэтому
+общий автоматический rollback недоступен. Пароль `HOST\\User` сохраняется напрямую в Windows Credential Manager.
+
 ## Риски и подтверждения
 
 - `Reversible` — обычное подтверждение плана и обязательный снимок.
diff --git a/docs/pair-repair.en.md b/docs/pair-repair.en.md
new file mode 100644
index 0000000..66185ed
--- /dev/null
+++ b/docs/pair-repair.en.md
@@ -0,0 +1,39 @@
+# Pair Repair Wizard v3.1
+
+Pair Repair fixes a shared printer between two explicitly selected PCs. It is neither a network scanner nor a persistent agent: W-Fix checks only the named peer and removes its temporary listener after the PairRun.
+
+In a domain, Host and Client can be entered in one window. W-Fix uses the current Kerberos identity and existing WinRM transport. Queue connection and test-page operations run in the signed-in Client user's session through a temporary Task Scheduler job instead of the administrator service account's HKCU.
+
+## Live mode
+
+1. Run W-Fix as administrator on both PCs.
+2. On the PC physically hosting the printer, open **Pair Repair**, choose **Host**, and enter the client name and exact local printer name.
+3. Create and save a `.wfixpair` invitation. It expires after 15 minutes and is accepted once.
+4. Select **Wait for client**. On the other PC choose **Client** and open the invitation.
+5. Compare the six-digit code in both windows and approve on both PCs. Mutations remain disabled until dual approval succeeds.
+6. The client gathers both snapshots and displays evidence plus the shared repair plan. Expert actions are excluded by default.
+7. Execute the plan. Snapshots precede every mutation, verification determines success, and reversible steps roll back on both endpoints after a failure.
+8. Send a Windows test page and confirm the physical output.
+
+The live session uses TLS 1.2/1.3, a temporary ECDSA P-256 certificate, and public-key pinning. Its temporary Firewall rule is restricted to the current executable, exact port, Private/Domain profiles, and `LocalSubnet`. A listener is never opened on a Public profile.
+
+## Workgroup credentials
+
+When Windows requires authentication, the client can save an existing `HOST\User` credential scoped to that host. The password goes directly to Windows Credential Manager and is excluded from PairRun, invitations, support bundles, and W-Fix logs.
+
+W-Fix never synchronizes primary-user passwords. SMB1 cannot be enabled. Insecure guest, disabled SMB signing, and reduced RPC protection remain expert-only actions with separate warnings and rollback.
+
+## Offline fallback
+
+If the live port is blocked, export a signed snapshot on one side and import it on the other. Each PC runs only its local plan. The file contains no credentials, but cross-machine automatic rollback is unavailable in offline mode.
+
+## Collected diagnostics
+
+- Windows version, domain/workgroup, and network profile;
+- DNS for the selected peer, SMB 445, and RPC 135;
+- Function Discovery, Spooler, and narrow Firewall rules;
+- SMB signing, guest restrictions, and conflicting SMB sessions;
+- shared queue, ShareName, driver, Point and Print, and RPC policies;
+- PrintService/SMBClient errors without document names or content.
+
+PairRun reports are stored under `%ProgramData%\W-Fix\Runs\pair-<RunId>`.
diff --git a/docs/pair-repair.md b/docs/pair-repair.md
new file mode 100644
index 0000000..8aee156
--- /dev/null
+++ b/docs/pair-repair.md
@@ -0,0 +1,39 @@
+# Pair Repair Wizard v3.1
+
+Pair Repair устраняет проблемы общего принтера между двумя конкретными ПК. Это не сетевой сканер и не постоянный агент: W-Fix проверяет только указанного соседа и закрывает временный listener после PairRun.
+
+В домене можно указать Host и Client в одном окне: W-Fix использует текущую Kerberos-учётную запись и существующий WinRM-транспорт. Подключение очереди и тестовая страница выполняются во вошедшем интерактивном сеансе Client через временную Task Scheduler задачу, а не в сервисном HKCU администратора.
+
+## Live-режим
+
+1. Запустите W-Fix от администратора на обоих ПК.
+2. На ПК с физически подключённым принтером откройте **Pair Repair**, выберите **Хост**, укажите имя клиента и точное имя локального принтера.
+3. Создайте и сохраните приглашение `.wfixpair`. Оно действует 15 минут и используется один раз.
+4. Нажмите **Ждать подключение**. На клиенте выберите **Клиент** и откройте приглашение.
+5. Сверьте шестизначный код в обоих окнах и подтвердите его на обеих машинах. До двойного подтверждения изменения запрещены.
+6. Клиент соберёт снимки обеих сторон и покажет доказательства и общий план. Экспертные действия по умолчанию исключены.
+7. Запустите план. Снимки создаются до первого изменения; успех определяется повторной проверкой. При сбое обратимые шаги откатываются на обеих сторонах.
+8. Отправьте Windows test page и подтвердите физическую печать.
+
+Live-сессия использует TLS 1.2/1.3, временный ECDSA P-256 сертификат и pinning публичного ключа. Временное Firewall-правило ограничено текущим EXE, портом, профилями Private/Domain и `LocalSubnet`. На Public-профиле listener не открывается.
+
+## Workgroup и учётные данные
+
+Если Windows требует аутентификацию, на клиенте можно сохранить существующую `HOST\User` только для выбранного хоста. Пароль передаётся Windows Credential Manager напрямую и не попадает в PairRun, приглашение, support bundle или лог W-Fix.
+
+W-Fix не делает пароли основных пользователей одинаковыми. SMB1 не включается. Insecure guest, отключение SMB signing и ослабление RPC доступны только в экспертном режиме с отдельным предупреждением и rollback.
+
+## Offline fallback
+
+Если live-порт заблокирован, экспортируйте подписанный снимок первой стороны и импортируйте его на второй. Каждый ПК выполняет только собственную часть плана. Файл не содержит credentials, но общий автоматический rollback между двумя машинами в этом режиме невозможен.
+
+## Что диагностируется
+
+- версия Windows, домен/workgroup и сетевой профиль;
+- DNS выбранного соседа, SMB 445 и RPC 135;
+- Function Discovery, Spooler и точечные правила Firewall;
+- SMB signing, guest restrictions и конфликтующие SMB-сессии;
+- общая очередь, ShareName, драйвер, Point and Print и RPC policies;
+- события PrintService/SMBClient без имён и содержимого документов.
+
+Отчёты PairRun сохраняются в `%ProgramData%\W-Fix\Runs\pair-<RunId>`.
diff --git a/docs/releases/v3.1.0-beta.1.md b/docs/releases/v3.1.0-beta.1.md
new file mode 100644
index 0000000..28e6e8c
--- /dev/null
+++ b/docs/releases/v3.1.0-beta.1.md
@@ -0,0 +1,31 @@
+# W-Fix v3.1.0-beta.1
+
+## RU
+
+Первый публичный beta-выпуск Pair Repair Wizard.
+
+- рабочий мастер ролей Host/Client, приглашения, проверки, общего плана, выполнения и физической проверки;
+- live-канал TLS 1.2/1.3 с временным ECDSA-ключом, pinning и подтверждением одного кода на двух ПК;
+- временное Firewall-правило только для Private/Domain, `LocalSubnet`, текущего EXE и одного порта;
+- диагностика DNS, SMB, RPC, Function Discovery, Spooler, очереди, драйвера и политик Windows 10/11;
+- реальные repair actions и двухузловой rollback;
+- подписанный offline fallback без credentials;
+- точечная `HOST\User` запись в Windows Credential Manager;
+- SMB1 не поддерживается; ослабляющие безопасность действия остаются экспертными.
+
+Это beta: перед массовым применением проверьте Windows 10 → 11, Windows 11 → 10, домен и workgroup на лабораторных ПК.
+
+## EN
+
+The first public beta of Pair Repair Wizard.
+
+- functional Host/Client wizard covering invitation, checks, shared plan, execution, and physical verification;
+- TLS 1.2/1.3 live channel with a temporary ECDSA key, pinning, and matching-code approval on both PCs;
+- temporary Firewall rule scoped to Private/Domain, `LocalSubnet`, the current executable, and one port;
+- DNS, SMB, RPC, Function Discovery, Spooler, queue, driver, and Windows 10/11 policy diagnostics;
+- real repair actions with two-node rollback;
+- signed credential-free offline fallback;
+- host-scoped `HOST\User` entry in Windows Credential Manager;
+- SMB1 is unsupported; security-reducing changes remain expert-only.
+
+This is a beta. Validate Windows 10 → 11, Windows 11 → 10, domain, and workgroup scenarios on lab PCs before broad use.
diff --git a/src/W-Fix.App/App.xaml.cs b/src/W-Fix.App/App.xaml.cs
index 1879de3..124eca9 100644
--- a/src/W-Fix.App/App.xaml.cs
+++ b/src/W-Fix.App/App.xaml.cs
@@ -8,6 +8,7 @@
 using WFix.Core.Catalog;
 using WFix.Core.Diagnostics;
 using WFix.Core.Infrastructure;
+using WFix.Core.Pairing;
 using WFix.Core.Remote;
 using WFix.Core.Repair;
 using WFix.Core.Reporting;
@@ -60,6 +61,9 @@ protected override void OnStartup(StartupEventArgs e)
     public RemoteCenterWindow CreateRemoteCenterWindow() =>
         Services.GetRequiredService<RemoteCenterWindow>();
 
+    public PairRepairWindow CreatePairRepairWindow() =>
+        Services.GetRequiredService<PairRepairWindow>();
+
     protected override void OnExit(ExitEventArgs e)
     {
         Log.Information("W-Fix завершён");
@@ -76,6 +80,7 @@ private static IServiceProvider ConfigureServices()
         services.AddSingleton<ActiveDirectoryService>();
         services.AddSingleton<FixerRegistry>();
         services.AddSingleton<SystemStateBackupService>();
+        services.AddSingleton<InteractiveUserPowerShellService>();
 
         services.AddSingleton<ICredentialStore, WindowsCredentialStore>();
         services.AddSingleton<IRemoteSessionFactory, PowerShellRemoteSessionFactory>();
@@ -96,11 +101,31 @@ private static IServiceProvider ConfigureServices()
         services.AddSingleton<IDiagnosticService, DiagnosticService>();
         services.AddSingleton<IRepairExecutor, RepairExecutor>();
 
+        services.AddSingleton<IPairInvitationValidator, PairInvitationValidator>();
+        services.AddSingleton<IPairSessionTransport, TlsPairSessionTransport>();
+        services.AddSingleton<IPairFirewallLeaseService, WindowsPairFirewallLeaseService>();
+        services.AddSingleton<IPairFileService, PairFileService>();
+        services.AddSingleton<IPairInventoryService, PairInventoryService>();
+        services.AddSingleton<IPairDiagnosticRule, PairDiscoveryDiagnosticRule>();
+        services.AddSingleton<IPairDiagnosticRule, PairSmbDiagnosticRule>();
+        services.AddSingleton<IPairDiagnosticRule, PairRpcDiagnosticRule>();
+        services.AddSingleton<IPairDiagnosticRule, PairPrinterShareDiagnosticRule>();
+        services.AddSingleton<IPairDiagnosticRule, PairRpcCompatibilityDiagnosticRule>();
+        services.AddSingleton<IPairDiagnosticService, PairDiagnosticService>();
+        services.AddSingleton<IPairRepairPlanner, PairRepairPlanner>();
+        services.AddSingleton<IPairRepairActionRegistry, PairRepairActionRegistry>();
+        services.AddSingleton<IPairActionDispatcher, RegistryPairActionDispatcher>();
+        services.AddTransient<IPairAgentCommandLoop, PairAgentCommandLoop>();
+        services.AddSingleton<IPairRunReportService, PairRunReportService>();
+        services.AddSingleton<INetworkCredentialProvisioner, WindowsNetworkCredentialProvisioner>();
+
         services.AddSingleton<IUserPromptService, UserPromptService>();
         services.AddSingleton<MainWindowViewModel>();
         services.AddTransient<RemoteCenterViewModel>();
+        services.AddTransient<PairRepairViewModel>();
         services.AddSingleton<MainWindow>();
         services.AddTransient<RemoteCenterWindow>();
+        services.AddTransient<PairRepairWindow>();
 
         return services.BuildServiceProvider(new ServiceProviderOptions
         {
diff --git a/src/W-Fix.App/MainWindow.xaml b/src/W-Fix.App/MainWindow.xaml
index 0ff8354..2413a67 100644
--- a/src/W-Fix.App/MainWindow.xaml
+++ b/src/W-Fix.App/MainWindow.xaml
@@ -41,7 +41,7 @@
                     <TextBlock Text="W-Fix" FontSize="18" FontWeight="Bold" Foreground="#2D7FF9" VerticalAlignment="Center"/>
                     <TextBlock Text=" | Printer Troubleshooter" FontSize="13" Foreground="#6E7681" VerticalAlignment="Center"/>
                     <Border Background="#1F2937" CornerRadius="4" Padding="6,2" Margin="10,0,0,0" VerticalAlignment="Center">
-                        <TextBlock Text="v3.0 beta" FontSize="10" Foreground="#58A6FF" FontWeight="SemiBold"/>
+                        <TextBlock Text="v3.1 beta" FontSize="10" Foreground="#58A6FF" FontWeight="SemiBold"/>
                     </Border>
                 </StackPanel>
 
@@ -51,6 +51,9 @@
                     <Button Content="🌐 Remote Center" Click="OpenRemoteCenter_Click"
                             ToolTip="Пакетная диагностика и ремонт удалённых компьютеров"
                             Style="{StaticResource FixButton}" Padding="10,6" Margin="8,0,0,0"/>
+                    <Button Content="🔗 Pair Repair" Click="OpenPairRepair_Click"
+                            ToolTip="Ремонт общего принтера между двумя ПК"
+                            Style="{StaticResource FixButton}" Padding="10,6" Margin="8,0,0,0"/>
                     <Button Content="📝 Логи" Command="{Binding OpenLogsFolderCommand}" ToolTip="Открыть папку с текстовыми логами"
                             Style="{StaticResource FixButton}" Padding="10,6" Margin="8,0,0,0"/>
                     <Button Content="↩ Откат" Command="{Binding RestoreLastBackupCommand}"
@@ -410,7 +413,7 @@
                     <ColumnDefinition Width="*"/>
                 </Grid.ColumnDefinitions>
                 <TextBlock Grid.Column="0" Text="{Binding StatusText}" Foreground="#6E7681" VerticalAlignment="Center" FontSize="12"/>
-                <TextBlock Grid.Column="1" Text="© OneDeadMachine · v2.2" Foreground="#30363D" FontSize="10" VerticalAlignment="Center" HorizontalAlignment="Center"/>
+                <TextBlock Grid.Column="1" Text="© OneDeadMachine · v3.1 beta" Foreground="#30363D" FontSize="10" VerticalAlignment="Center" HorizontalAlignment="Center"/>
                 <StackPanel Grid.Column="2" Orientation="Horizontal" HorizontalAlignment="Right" VerticalAlignment="Center">
                     <TextBlock Text="{Binding Source={x:Static sys:Environment.MachineName}, StringFormat='Машина: {0}'}"
                                Foreground="#484F58" FontSize="11" Margin="0,0,12,0"/>
diff --git a/src/W-Fix.App/MainWindow.xaml.cs b/src/W-Fix.App/MainWindow.xaml.cs
index 3cdb7eb..8f0555f 100644
--- a/src/W-Fix.App/MainWindow.xaml.cs
+++ b/src/W-Fix.App/MainWindow.xaml.cs
@@ -18,6 +18,13 @@ private void OpenRemoteCenter_Click(object sender, RoutedEventArgs e)
         window.Show();
     }
 
+    private void OpenPairRepair_Click(object sender, RoutedEventArgs e)
+    {
+        var window = ((App)Application.Current).CreatePairRepairWindow();
+        window.Owner = this;
+        window.Show();
+    }
+
     private void ClearLog_Click(object sender, RoutedEventArgs e)
     {
         if (DataContext is ViewModels.MainWindowViewModel vm)
diff --git a/src/W-Fix.App/PairRepairWindow.xaml b/src/W-Fix.App/PairRepairWindow.xaml
new file mode 100644
index 0000000..cd7ac73
--- /dev/null
+++ b/src/W-Fix.App/PairRepairWindow.xaml
@@ -0,0 +1,213 @@
+<Window x:Class="WFix.App.PairRepairWindow"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:ui="http://schemas.modernwpf.com/2019"
+        xmlns:conv="clr-namespace:WFix.App.Converters"
+        ui:WindowHelper.UseModernWindowStyle="True"
+        Title="W-Fix — Pair Repair Wizard"
+        Width="1240" Height="820" MinWidth="980" MinHeight="650"
+        Background="#0D1117" FontFamily="Segoe UI" FontSize="13">
+    <Window.Resources>
+        <conv:BoolToVisibilityConverter x:Key="BoolVis"/>
+    </Window.Resources>
+    <Grid>
+        <Grid.RowDefinitions>
+            <RowDefinition Height="54"/>
+            <RowDefinition Height="*"/>
+            <RowDefinition Height="34"/>
+        </Grid.RowDefinitions>
+
+        <Border Grid.Row="0" Background="#161B22" BorderBrush="#30363D" BorderThickness="0,0,0,1" Padding="18,0">
+            <Grid>
+                <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                    <TextBlock Text="🔗" FontSize="23" Margin="0,0,9,0"/>
+                    <StackPanel>
+                        <TextBlock Text="Pair Repair Wizard" Foreground="#E6EDF3" FontWeight="Bold" FontSize="17"/>
+                        <TextBlock Text="Ремонт общего принтера между двумя ПК" Foreground="#8B949E" FontSize="11"/>
+                    </StackPanel>
+                </StackPanel>
+                <Border HorizontalAlignment="Right" VerticalAlignment="Center" Background="#0D2137" CornerRadius="5" Padding="10,5">
+                    <TextBlock Text="v3.1 beta · TLS + rollback" Foreground="#58A6FF" FontWeight="SemiBold"/>
+                </Border>
+            </Grid>
+        </Border>
+
+        <ScrollViewer Grid.Row="1" VerticalScrollBarVisibility="Auto">
+            <Grid Margin="10">
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="390"/>
+                    <ColumnDefinition Width="*"/>
+                </Grid.ColumnDefinitions>
+
+                <StackPanel Grid.Column="0">
+                    <Border Style="{StaticResource CardPanel}">
+                        <StackPanel>
+                            <TextBlock Text="1 · Роли и выбранная очередь" Foreground="#E6EDF3" FontWeight="Bold" FontSize="15"/>
+                            <TextBlock Text="Этот ПК" Foreground="#8B949E" Margin="0,12,0,4"/>
+                            <TextBlock Text="{Binding LocalComputerName}" Foreground="#58A6FF" FontWeight="SemiBold"/>
+                            <WrapPanel Margin="0,10,0,0">
+                                <Button Content="🖨 Этот ПК — хост" Command="{Binding UseHostRoleCommand}" Style="{StaticResource FixButton}" Margin="0,0,8,0"/>
+                                <Button Content="💻 Этот ПК — клиент" Command="{Binding UseClientRoleCommand}" Style="{StaticResource FixButton}"/>
+                            </WrapPanel>
+                            <TextBlock Text="{Binding RoleText, StringFormat='Выбрано: {0}'}" Foreground="#2ECC71" Margin="0,7,0,0"/>
+                            <TextBlock Text="Имя второго ПК" Foreground="#8B949E" Margin="0,12,0,4"/>
+                            <TextBox Text="{Binding PeerComputerName, UpdateSourceTrigger=PropertyChanged}" ui:ControlHelper.PlaceholderText="Например: OFFICE-PC02"/>
+                            <TextBlock Text="Локальный принтер на хосте" Foreground="#8B949E" Margin="0,10,0,4"/>
+                            <TextBox Text="{Binding PrinterName, UpdateSourceTrigger=PropertyChanged}" ui:ControlHelper.PlaceholderText="Точное имя Get-Printer"/>
+                            <TextBlock Text="ShareName (можно оставить пустым)" Foreground="#8B949E" Margin="0,10,0,4"/>
+                            <TextBox Text="{Binding ShareName, UpdateSourceTrigger=PropertyChanged}" ui:ControlHelper.PlaceholderText="WFixPrinter"/>
+                        </StackPanel>
+                    </Border>
+
+                    <Border Style="{StaticResource CardPanel}">
+                        <StackPanel>
+                            <TextBlock Text="Домен: WinRM / Kerberos" Foreground="#E6EDF3" FontWeight="Bold"/>
+                            <TextBlock Text="Один администратор управляет двумя доменными ПК. В поле «Имя второго ПК» выше укажите Client." TextWrapping="Wrap" Foreground="#8B949E" Margin="0,5,0,8"/>
+                            <TextBox Text="{Binding DomainHostComputerName, UpdateSourceTrigger=PropertyChanged}" ui:ControlHelper.PlaceholderText="Имя доменного Host"/>
+                            <Button Content="Проверить Host ↔ Client и построить план" Command="{Binding DiagnoseDomainPairCommand}" Style="{StaticResource FixButton}" Margin="0,6,0,0"/>
+                        </StackPanel>
+                    </Border>
+
+                    <Border Style="{StaticResource CardPanel}">
+                        <StackPanel>
+                            <TextBlock Text="2 · Безопасное соединение" Foreground="#E6EDF3" FontWeight="Bold" FontSize="15"/>
+                            <TextBlock Text="Хост" Foreground="#8B949E" Margin="0,10,0,4"/>
+                            <WrapPanel>
+                                <Button Content="Создать приглашение" Command="{Binding StartHostCommand}" Style="{StaticResource FixButton}" Margin="0,0,6,0"/>
+                                <Button Content="Сохранить .wfixpair" Click="ExportInvitation_Click" Style="{StaticResource FixButton}"/>
+                            </WrapPanel>
+                            <Button Content="Ждать подключение клиента" Command="{Binding WaitForPartnerCommand}" Style="{StaticResource FixButton}" Margin="0,6,0,0"/>
+                            <TextBlock Text="Клиент" Foreground="#8B949E" Margin="0,10,0,4"/>
+                            <Button Content="Открыть приглашение и подключиться" Click="ImportInvitation_Click" Style="{StaticResource FixButton}"/>
+                            <Border Background="#0D2137" BorderBrush="#2D7FF9" BorderThickness="1" CornerRadius="7" Margin="0,12,0,6" Padding="10">
+                                <StackPanel HorizontalAlignment="Center">
+                                    <TextBlock Text="Сверьте код на обоих ПК" Foreground="#8B949E" HorizontalAlignment="Center"/>
+                                    <TextBlock Text="{Binding ConfirmationCode}" Foreground="#58A6FF" FontFamily="Consolas" FontSize="30" FontWeight="Bold" HorizontalAlignment="Center"/>
+                                </StackPanel>
+                            </Border>
+                            <Button Content="Код совпадает — разрешить изменения" Command="{Binding ApproveCommand}" Background="#173A2A" Foreground="#3FB950" BorderBrush="#238636" Padding="12,8"/>
+                        </StackPanel>
+                    </Border>
+
+                    <Border Style="{StaticResource CardPanel}">
+                        <StackPanel>
+                            <TextBlock Text="Offline fallback" Foreground="#E6EDF3" FontWeight="Bold"/>
+                            <TextBlock Text="Если порт заблокирован: обмен подписанными снимками. Общего автоматического rollback между ПК нет." TextWrapping="Wrap" Foreground="#D29922" Margin="0,5,0,8"/>
+                            <WrapPanel>
+                                <Button Content="Экспорт снимка" Click="ExportOffline_Click" Style="{StaticResource FixButton}" Margin="0,0,6,0"/>
+                                <Button Content="Импорт снимка" Click="ImportOffline_Click" Style="{StaticResource FixButton}"/>
+                            </WrapPanel>
+                        </StackPanel>
+                    </Border>
+
+                    <Border Style="{StaticResource CardPanel}">
+                        <StackPanel>
+                            <TextBlock Text="Точечная SMB-учётная запись" Foreground="#E6EDF3" FontWeight="Bold"/>
+                            <TextBlock Text="Только на клиенте и только для выбранного хоста. Пароль хранит Windows Credential Manager." TextWrapping="Wrap" Foreground="#8B949E" Margin="0,5,0,8"/>
+                            <TextBox Text="{Binding NetworkCredentialUser}" ui:ControlHelper.PlaceholderText="HOST\User"/>
+                            <PasswordBox x:Name="NetworkPassword" Margin="0,6,0,0"/>
+                            <Button Content="Сохранить для хоста" Click="SaveNetworkCredential_Click" Style="{StaticResource FixButton}" Margin="0,6,0,0"/>
+                        </StackPanel>
+                    </Border>
+                </StackPanel>
+
+                <Grid Grid.Column="1" Margin="5,0,0,0">
+                    <Grid.RowDefinitions>
+                        <RowDefinition Height="Auto"/>
+                        <RowDefinition Height="Auto"/>
+                        <RowDefinition Height="*"/>
+                    </Grid.RowDefinitions>
+
+                    <Border Grid.Row="0" Style="{StaticResource CardPanel}">
+                        <Grid>
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="*"/>
+                                <ColumnDefinition Width="Auto"/>
+                            </Grid.ColumnDefinitions>
+                            <StackPanel>
+                                <TextBlock Text="3 · Причина и общий план" Foreground="#E6EDF3" FontWeight="Bold" FontSize="15"/>
+                                <TextBlock Text="План появляется на клиенте после двойного подтверждения либо после offline-импорта." Foreground="#8B949E" TextWrapping="Wrap" Margin="0,4,0,0"/>
+                            </StackPanel>
+                            <StackPanel Grid.Column="1" Orientation="Horizontal" VerticalAlignment="Center">
+                                <CheckBox Content="Экспертные действия" IsChecked="{Binding IncludeExpertActions}" Foreground="#D29922" VerticalAlignment="Center" Margin="0,0,8,0"/>
+                                <Button Content="Пересобрать план" Command="{Binding RebuildPlanCommand}" Style="{StaticResource FixButton}"/>
+                            </StackPanel>
+                        </Grid>
+                    </Border>
+
+                    <Grid Grid.Row="1">
+                        <Grid.ColumnDefinitions>
+                            <ColumnDefinition Width="*"/>
+                            <ColumnDefinition Width="*"/>
+                        </Grid.ColumnDefinitions>
+                        <Border Grid.Column="0" Style="{StaticResource CardPanel}">
+                            <StackPanel>
+                                <TextBlock Text="Найденные причины" Foreground="#E6EDF3" FontWeight="SemiBold" Margin="0,0,0,7"/>
+                                <ListBox ItemsSource="{Binding Findings}" MaxHeight="210" Background="Transparent" BorderThickness="0">
+                                    <ListBox.ItemTemplate>
+                                        <DataTemplate>
+                                            <Border Background="#161B22" CornerRadius="6" Padding="8" Margin="0,2">
+                                                <StackPanel>
+                                                    <TextBlock Text="{Binding Title}" Foreground="#D29922" FontWeight="SemiBold" TextWrapping="Wrap"/>
+                                                    <TextBlock Text="{Binding Description}" Foreground="#8B949E" FontSize="11" TextWrapping="Wrap" Margin="0,3,0,0"/>
+                                                </StackPanel>
+                                            </Border>
+                                        </DataTemplate>
+                                    </ListBox.ItemTemplate>
+                                </ListBox>
+                            </StackPanel>
+                        </Border>
+                        <Border Grid.Column="1" Style="{StaticResource CardPanel}">
+                            <StackPanel>
+                                <TextBlock Text="Действия" Foreground="#E6EDF3" FontWeight="SemiBold" Margin="0,0,0,7"/>
+                                <ListBox ItemsSource="{Binding Steps}" MaxHeight="210" Background="Transparent" BorderThickness="0">
+                                    <ListBox.ItemTemplate>
+                                        <DataTemplate>
+                                            <Border Background="#161B22" CornerRadius="6" Padding="8" Margin="0,2">
+                                                <StackPanel>
+                                                    <TextBlock Text="{Binding Title}" Foreground="#58A6FF" FontWeight="SemiBold" TextWrapping="Wrap"/>
+                                                    <TextBlock Text="{Binding Endpoint, StringFormat='Сторона: {0}'}" Foreground="#8B949E" FontSize="11"/>
+                                                </StackPanel>
+                                            </Border>
+                                        </DataTemplate>
+                                    </ListBox.ItemTemplate>
+                                </ListBox>
+                            </StackPanel>
+                        </Border>
+                    </Grid>
+
+                    <Border Grid.Row="2" Style="{StaticResource CardPanel}">
+                        <Grid>
+                            <Grid.RowDefinitions>
+                                <RowDefinition Height="Auto"/>
+                                <RowDefinition Height="*"/>
+                                <RowDefinition Height="Auto"/>
+                            </Grid.RowDefinitions>
+                            <Grid>
+                                <TextBlock Text="4 · Выполнение, rollback и физическая проверка" Foreground="#E6EDF3" FontWeight="Bold" FontSize="15"/>
+                                <ProgressBar IsIndeterminate="True" Height="3" VerticalAlignment="Bottom" Visibility="{Binding IsBusy, Converter={StaticResource BoolVis}}"/>
+                            </Grid>
+                            <ListBox Grid.Row="1" ItemsSource="{Binding Activity}" Background="#0D1117" BorderThickness="0" Margin="0,10,0,8" FontFamily="Consolas" Foreground="#C9D1D9">
+                                <ListBox.ItemTemplate>
+                                    <DataTemplate><TextBlock Text="{Binding}" TextWrapping="Wrap" Margin="5,2"/></DataTemplate>
+                                </ListBox.ItemTemplate>
+                            </ListBox>
+                            <WrapPanel Grid.Row="2">
+                                <Button Content="▶ Выполнить общий план" Command="{Binding ExecutePlanCommand}" Background="#173A2A" Foreground="#3FB950" BorderBrush="#238636" Padding="14,9" Margin="0,0,8,0"/>
+                                <Button Content="🧾 Печать тестовой страницы" Command="{Binding PrintTestPageCommand}" Style="{StaticResource FixButton}" Margin="0,0,8,0"/>
+                                <Button Content="Отмена" Command="{Binding CancelCommand}" Background="#3A1A1A" Foreground="#FF7B72" BorderBrush="#DA3633" Padding="12,8"/>
+                            </WrapPanel>
+                        </Grid>
+                    </Border>
+                </Grid>
+            </Grid>
+        </ScrollViewer>
+
+        <Border Grid.Row="2" Background="#161B22" BorderBrush="#30363D" BorderThickness="0,1,0,0" Padding="12,0">
+            <Grid>
+                <TextBlock Text="{Binding StatusText}" Foreground="#8B949E" VerticalAlignment="Center" TextTrimming="CharacterEllipsis"/>
+                <TextBlock Text="SMB1 запрещён · Public profile блокирует listener · пароли не журналируются" Foreground="#484F58" FontSize="11" HorizontalAlignment="Right" VerticalAlignment="Center"/>
+            </Grid>
+        </Border>
+    </Grid>
+</Window>
diff --git a/src/W-Fix.App/PairRepairWindow.xaml.cs b/src/W-Fix.App/PairRepairWindow.xaml.cs
new file mode 100644
index 0000000..db58aa1
--- /dev/null
+++ b/src/W-Fix.App/PairRepairWindow.xaml.cs
@@ -0,0 +1,67 @@
+using System.Windows;
+using Microsoft.Win32;
+using WFix.App.ViewModels;
+
+namespace WFix.App;
+
+public partial class PairRepairWindow : Window
+{
+    private readonly PairRepairViewModel _viewModel;
+
+    public PairRepairWindow(PairRepairViewModel viewModel)
+    {
+        _viewModel = viewModel;
+        InitializeComponent();
+        DataContext = viewModel;
+    }
+
+    private async void ExportInvitation_Click(object sender, RoutedEventArgs e)
+    {
+        var dialog = SaveDialog("W-Fix Pair invitation (*.wfixpair)|*.wfixpair", $"{Environment.MachineName}-{DateTime.Now:HHmm}.wfixpair");
+        if (dialog.ShowDialog(this) == true)
+            await ShowErrorsAsync(() => _viewModel.ExportInvitationAsync(dialog.FileName));
+    }
+
+    private async void ImportInvitation_Click(object sender, RoutedEventArgs e)
+    {
+        var dialog = OpenDialog("W-Fix Pair invitation (*.wfixpair)|*.wfixpair");
+        if (dialog.ShowDialog(this) == true)
+            await ShowErrorsAsync(() => _viewModel.ImportInvitationAsync(dialog.FileName));
+    }
+
+    private async void ExportOffline_Click(object sender, RoutedEventArgs e)
+    {
+        var dialog = SaveDialog("W-Fix signed snapshot (*.wfixpair)|*.wfixpair", $"{Environment.MachineName}-snapshot.wfixpair");
+        if (dialog.ShowDialog(this) == true)
+            await ShowErrorsAsync(() => _viewModel.ExportOfflineSnapshotAsync(dialog.FileName));
+    }
+
+    private async void ImportOffline_Click(object sender, RoutedEventArgs e)
+    {
+        var dialog = OpenDialog("W-Fix signed snapshot (*.wfixpair)|*.wfixpair");
+        if (dialog.ShowDialog(this) == true)
+            await ShowErrorsAsync(() => _viewModel.ImportOfflineSnapshotAsync(dialog.FileName));
+    }
+
+    private async void SaveNetworkCredential_Click(object sender, RoutedEventArgs e)
+    {
+        var password = NetworkPassword.Password;
+        NetworkPassword.Clear();
+        await ShowErrorsAsync(() => _viewModel.SaveNetworkCredentialAsync(password));
+    }
+
+    private async Task ShowErrorsAsync(Func<Task> operation)
+    {
+        try { await operation(); }
+        catch (Exception ex) { MessageBox.Show(this, ex.Message, "Pair Repair", MessageBoxButton.OK, MessageBoxImage.Warning); }
+    }
+
+    private static SaveFileDialog SaveDialog(string filter, string name) => new() { Filter = filter, FileName = name, AddExtension = true };
+    private static OpenFileDialog OpenDialog(string filter) => new() { Filter = filter, CheckFileExists = true };
+
+    protected override async void OnClosed(EventArgs e)
+    {
+        await _viewModel.DisposeAsync();
+        base.OnClosed(e);
+    }
+}
diff --git a/src/W-Fix.App/ViewModels/PairRepairViewModel.cs b/src/W-Fix.App/ViewModels/PairRepairViewModel.cs
new file mode 100644
index 0000000..d38dbed
--- /dev/null
+++ b/src/W-Fix.App/ViewModels/PairRepairViewModel.cs
@@ -0,0 +1,528 @@
+using System.Collections.ObjectModel;
+using System.Diagnostics;
+using System.IO;
+using System.Net;
+using System.Text;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using WFix.App.Services;
+using WFix.Core.Abstractions;
+using WFix.Core.Models;
+using WFix.Core.Pairing;
+using WFix.Core.Services;
+
+namespace WFix.App.ViewModels;
+
+public partial class PairRepairViewModel : ObservableObject, IAsyncDisposable
+{
+    private readonly IPairSessionTransport _transport;
+    private readonly IPairFirewallLeaseService _firewall;
+    private readonly IPairFileService _files;
+    private readonly IPairInventoryService _inventory;
+    private readonly IPairDiagnosticService _diagnostics;
+    private readonly IPairRepairPlanner _planner;
+    private readonly IPairActionDispatcher _localDispatcher;
+    private readonly IPairAgentCommandLoop _agentLoop;
+    private readonly IPairRunReportService _reports;
+    private readonly INetworkCredentialProvisioner _credentials;
+    private readonly IUserPromptService _prompts;
+    private readonly InteractiveUserPowerShellService _interactiveUserPowerShell;
+    private readonly CancellationTokenSource _lifetime = new();
+    private IPairHost? _host;
+    private IPairSession? _session;
+    private IAsyncDisposable? _firewallLease;
+    private Task? _agentTask;
+    private PairInvitation? _invitation;
+    private PairEndpointSnapshot? _hostSnapshot;
+    private PairEndpointSnapshot? _clientSnapshot;
+    private PairRepairPlan? _plan;
+    private IReadOnlyDictionary<PairEndpointRole, TargetDescriptor>? _executionTargets;
+    private bool _disposed;
+
+    public ObservableCollection<PairDiagnosticFinding> Findings { get; } = [];
+    public ObservableCollection<PairRepairStep> Steps { get; } = [];
+    public ObservableCollection<string> Activity { get; } = [];
+
+    [ObservableProperty] private PairEndpointRole _localRole = PairEndpointRole.Host;
+    [ObservableProperty] private PairTransportMode _transportMode = PairTransportMode.LiveLan;
+    [ObservableProperty] private string _peerComputerName = "";
+    [ObservableProperty] private string _domainHostComputerName = "";
+    [ObservableProperty] private string _printerName = "";
+    [ObservableProperty] private string _shareName = "";
+    [ObservableProperty] private string _confirmationCode = "------";
+    [ObservableProperty] private string _statusText = "Выберите роль этого ПК.";
+    [ObservableProperty] private bool _isBusy;
+    [ObservableProperty] private bool _isConnected;
+    [ObservableProperty] private bool _isApproved;
+    [ObservableProperty] private bool _includeExpertActions;
+    [ObservableProperty] private bool _physicalTestConfirmed;
+    [ObservableProperty] private string _networkCredentialUser = "";
+    [ObservableProperty] private PairRun? _lastRun;
+
+    public string LocalComputerName => Environment.MachineName;
+    public string RoleText => LocalRole == PairEndpointRole.Host ? "Хост принтера" : "Клиент";
+    public bool HasInvitation => _invitation is not null;
+    public bool HasPlan => _plan is { Steps.Count: > 0 };
+    public bool CanExecute => HasPlan && !IsBusy;
+
+    public PairRepairViewModel(
+        IPairSessionTransport transport,
+        IPairFirewallLeaseService firewall,
+        IPairFileService files,
+        IPairInventoryService inventory,
+        IPairDiagnosticService diagnostics,
+        IPairRepairPlanner planner,
+        IPairActionDispatcher localDispatcher,
+        IPairAgentCommandLoop agentLoop,
+        IPairRunReportService reports,
+        INetworkCredentialProvisioner credentials,
+        IUserPromptService prompts,
+        InteractiveUserPowerShellService interactiveUserPowerShell)
+    {
+        _transport = transport;
+        _firewall = firewall;
+        _files = files;
+        _inventory = inventory;
+        _diagnostics = diagnostics;
+        _planner = planner;
+        _localDispatcher = localDispatcher;
+        _agentLoop = agentLoop;
+        _reports = reports;
+        _credentials = credentials;
+        _prompts = prompts;
+        _interactiveUserPowerShell = interactiveUserPowerShell;
+        Activity.Add("W-Fix не включает SMB1 и не устанавливает одинаковые пароли пользователей.");
+    }
+
+    [RelayCommand]
+    private void UseHostRole()
+    {
+        EnsureNotConnected();
+        LocalRole = PairEndpointRole.Host;
+        StatusText = "Укажите имя клиентского ПК и локальный принтер.";
+        OnPropertyChanged(nameof(RoleText));
+    }
+
+    [RelayCommand]
+    private void UseClientRole()
+    {
+        EnsureNotConnected();
+        LocalRole = PairEndpointRole.Client;
+        StatusText = "Импортируйте приглашение хоста.";
+        OnPropertyChanged(nameof(RoleText));
+    }
+
+    [RelayCommand]
+    private async Task StartHostAsync()
+    {
+        EnsureRole(PairEndpointRole.Host);
+        RequirePeer();
+        if (string.IsNullOrWhiteSpace(PrinterName))
+            throw new InvalidOperationException("Укажите имя локального принтера на хосте.");
+        await RunBusyAsync(async cancellationToken =>
+        {
+            await DisposeConnectionAsync();
+            await _firewall.CleanupStaleAsync(cancellationToken);
+            _host = await _transport.StartHostAsync(new PairHostOptions
+            {
+                HostComputerName = Environment.MachineName,
+                PrinterName = PrinterName.Trim(),
+                ShareName = NullIfEmpty(ShareName),
+                ExpectedClientComputerName = PeerComputerName.Trim(),
+                InvitationLifetime = TimeSpan.FromMinutes(15)
+            }, cancellationToken);
+            try
+            {
+                _firewallLease = await _firewall.OpenAsync(
+                    _host.Invitation.SessionId,
+                    _host.Invitation.Port,
+                    Environment.ProcessPath ?? Process.GetCurrentProcess().MainModule!.FileName,
+                    cancellationToken);
+            }
+            catch
+            {
+                await _host.DisposeAsync();
+                _host = null;
+                throw;
+            }
+            _invitation = _host.Invitation;
+            ConfirmationCode = _invitation.ConfirmationCode;
+            TransportMode = PairTransportMode.LiveLan;
+            Activity.Add($"Приглашение создано до {_invitation.ExpiresAt.LocalDateTime:t}; порт {_invitation.Port}.");
+            StatusText = "Экспортируйте .wfixpair и нажмите «Ждать подключение».";
+            OnPropertyChanged(nameof(HasInvitation));
+        });
+    }
+
+    public async Task ExportInvitationAsync(string path)
+    {
+        if (_invitation is null) throw new InvalidOperationException("Сначала создайте приглашение.");
+        await _files.WriteInvitationAsync(path, _invitation, _lifetime.Token);
+        Activity.Add($"Приглашение сохранено: {Path.GetFileName(path)}");
+    }
+
+    [RelayCommand]
+    private async Task WaitForPartnerAsync()
+    {
+        EnsureRole(PairEndpointRole.Host);
+        if (_host is null) throw new InvalidOperationException("Сначала создайте приглашение.");
+        await RunBusyAsync(async cancellationToken =>
+        {
+            StatusText = "Ожидание клиента…";
+            _session = await _host.AcceptAsync(cancellationToken);
+            PeerComputerName = _session.PeerComputerName;
+            IsConnected = true;
+            ConfirmationCode = _session.ConfirmationCode;
+            StatusText = "Сверьте код на обоих ПК и подтвердите соединение.";
+            Activity.Add("TLS-соединение установлено; изменения пока запрещены.");
+        });
+    }
+
+    public async Task ImportInvitationAsync(string path)
+    {
+        EnsureRole(PairEndpointRole.Client);
+        await RunBusyAsync(async cancellationToken =>
+        {
+            await DisposeConnectionAsync();
+            _invitation = await _files.ReadInvitationAsync(path, cancellationToken);
+            PeerComputerName = _invitation.HostComputerName;
+            PrinterName = _invitation.PrinterName ?? "";
+            ShareName = _invitation.ShareName ?? "";
+            _session = await _transport.JoinAsync(_invitation, cancellationToken);
+            IsConnected = true;
+            ConfirmationCode = _session.ConfirmationCode;
+            TransportMode = PairTransportMode.LiveLan;
+            StatusText = "Сверьте код на обоих ПК и подтвердите соединение.";
+            Activity.Add("TLS-соединение установлено, pinning временного ECDSA-ключа пройден.");
+            OnPropertyChanged(nameof(HasInvitation));
+        });
+    }
+
+    [RelayCommand]
+    private async Task ApproveAsync()
+    {
+        if (_session is null || !IsConnected) throw new InvalidOperationException("Нет подключённой pairing-сессии.");
+        await RunBusyAsync(async cancellationToken =>
+        {
+            StatusText = "Ожидание подтверждения второго ПК…";
+            if (!await _session.ApproveAsync(true, cancellationToken))
+                throw new InvalidOperationException("Вторая сторона отклонила pairing-сессию.");
+            IsApproved = true;
+            Activity.Add("Одинаковый код подтверждён на обоих ПК.");
+            if (LocalRole == PairEndpointRole.Host)
+            {
+                _hostSnapshot = await _inventory.CaptureAsync(
+                    TargetDescriptor.Local(), PairEndpointRole.Host, PeerComputerName.Trim(),
+                    PrinterName.Trim(), NullIfEmpty(ShareName), cancellationToken);
+                await _session.SendAsync(PairMessageKind.Snapshot, _hostSnapshot, cancellationToken);
+                StatusText = "Хост готов. На клиенте можно запускать диагностику и ремонт.";
+                _agentTask = RunAgentAsync(_session, _lifetime.Token);
+            }
+            else
+            {
+                _clientSnapshot = await _inventory.CaptureAsync(
+                    TargetDescriptor.Local(), PairEndpointRole.Client, PeerComputerName.Trim(),
+                    null, NullIfEmpty(ShareName), cancellationToken);
+                _hostSnapshot = await _session.ReceiveAsync<PairEndpointSnapshot>(PairMessageKind.Snapshot, cancellationToken);
+                _executionTargets = LocalTargets();
+                await BuildPlanAsync(PairTransportMode.LiveLan, cancellationToken);
+            }
+        });
+    }
+
+    public async Task SaveNetworkCredentialAsync(string password)
+    {
+        EnsureRole(PairEndpointRole.Client);
+        var host = _invitation?.HostComputerName ?? PeerComputerName.Trim();
+        if (string.IsNullOrWhiteSpace(host) || string.IsNullOrWhiteSpace(NetworkCredentialUser) || string.IsNullOrEmpty(password))
+            throw new InvalidOperationException("Укажите хост, пользователя HOST\\User и пароль.");
+        await _credentials.SaveForHostAsync(host, new NetworkCredential(NetworkCredentialUser.Trim(), password), _lifetime.Token);
+        Activity.Add($"Windows network credential сохранён только для {host}.");
+        StatusText = "Учётная запись сохранена в Windows Credential Manager; пароль не попал в W-Fix.";
+    }
+
+    public async Task ExportOfflineSnapshotAsync(string path)
+    {
+        RequirePeer();
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var snapshot = await _inventory.CaptureAsync(
+                TargetDescriptor.Local(), LocalRole, PeerComputerName.Trim(),
+                NullIfEmpty(PrinterName), NullIfEmpty(ShareName), cancellationToken);
+            await _files.WriteOfflineSnapshotAsync(path, snapshot, cancellationToken);
+            Activity.Add($"Подписанный offline snapshot сохранён: {Path.GetFileName(path)}");
+            StatusText = "Передайте файл только второму выбранному ПК.";
+        });
+    }
+
+    public async Task ImportOfflineSnapshotAsync(string path)
+    {
+        RequirePeer();
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var peer = await _files.ReadOfflineSnapshotAsync(path, cancellationToken);
+            if (peer.Endpoint.Role == LocalRole)
+                throw new InvalidDataException("Импортирован снимок той же роли. Нужен снимок второго ПК.");
+            var local = await _inventory.CaptureAsync(
+                TargetDescriptor.Local(), LocalRole, peer.Endpoint.ComputerName,
+                NullIfEmpty(PrinterName), NullIfEmpty(ShareName), cancellationToken);
+            _hostSnapshot = LocalRole == PairEndpointRole.Host ? local : peer;
+            _clientSnapshot = LocalRole == PairEndpointRole.Client ? local : peer;
+            _executionTargets = LocalTargets();
+            TransportMode = PairTransportMode.Offline;
+            await BuildPlanAsync(PairTransportMode.Offline, cancellationToken);
+            StatusText = "Offline-план готов только для этого ПК; общий автоматический rollback невозможен.";
+        });
+    }
+
+    [RelayCommand]
+    private async Task DiagnoseDomainPairAsync()
+    {
+        var hostName = DomainHostComputerName.Trim();
+        var clientName = PeerComputerName.Trim();
+        if (string.IsNullOrWhiteSpace(hostName) || string.IsNullOrWhiteSpace(clientName))
+            throw new InvalidOperationException("Укажите имена доменных Host и Client.");
+        if (string.Equals(hostName, clientName, StringComparison.OrdinalIgnoreCase))
+            throw new InvalidOperationException("Host и Client должны быть разными компьютерами.");
+        if (string.IsNullOrWhiteSpace(PrinterName))
+            throw new InvalidOperationException("Укажите точное имя очереди на Host.");
+
+        await RunBusyAsync(async cancellationToken =>
+        {
+            var hostTarget = RemoteTarget(hostName);
+            var clientTarget = RemoteTarget(clientName);
+            var hostTask = _inventory.CaptureAsync(
+                hostTarget, PairEndpointRole.Host, clientName, PrinterName.Trim(), NullIfEmpty(ShareName), cancellationToken);
+            var clientTask = _inventory.CaptureAsync(
+                clientTarget, PairEndpointRole.Client, hostName, null, NullIfEmpty(ShareName), cancellationToken);
+            await Task.WhenAll(hostTask, clientTask);
+            _hostSnapshot = await hostTask;
+            _clientSnapshot = await clientTask;
+            _executionTargets = new Dictionary<PairEndpointRole, TargetDescriptor>
+            {
+                [PairEndpointRole.Host] = hostTarget,
+                [PairEndpointRole.Client] = clientTarget
+            };
+            TransportMode = PairTransportMode.DomainRemote;
+            await BuildPlanAsync(PairTransportMode.DomainRemote, cancellationToken);
+            Activity.Add($"Доменная инвентаризация: {hostName} ↔ {clientName} через WinRM/Kerberos.");
+        });
+    }
+
+    [RelayCommand]
+    private async Task RebuildPlanAsync()
+    {
+        if (_hostSnapshot is null || _clientSnapshot is null) throw new InvalidOperationException("Сначала соберите снимки обоих ПК.");
+        await RunBusyAsync(cancellationToken => BuildPlanAsync(TransportMode, cancellationToken));
+    }
+
+    [RelayCommand]
+    private async Task ExecutePlanAsync()
+    {
+        if (_plan is null || _plan.Steps.Count == 0) throw new InvalidOperationException("План ремонта пуст.");
+        if (_plan.RequiresAdditionalConfirmation && !_prompts.Confirm(
+                "План содержит необратимое или экспертное действие. Снимки будут созданы до изменений. Продолжить?",
+                "Pair Repair — повышенный риск", true))
+            return;
+        if (!_prompts.Confirm(
+                $"Будет выполнено действий: {_plan.Steps.Count}. Результат проверяется повторно, при сбое запускается rollback.",
+                "Запустить Pair Repair?"))
+            return;
+
+        await RunBusyAsync(async cancellationToken =>
+        {
+            IPairActionDispatcher dispatcher = _localDispatcher;
+            if (TransportMode == PairTransportMode.LiveLan)
+            {
+                EnsureRole(PairEndpointRole.Client);
+                dispatcher = new PairSessionActionDispatcher(
+                    _session ?? throw new InvalidOperationException("Live pairing-сессия закрыта."),
+                    PairEndpointRole.Host,
+                    _localDispatcher);
+            }
+            var executor = new PairRepairExecutor(dispatcher, _reports);
+            var targets = _executionTargets ?? throw new InvalidOperationException("Не определены цели PairRun.");
+            LastRun = await executor.ExecuteAsync(_plan, targets, cancellationToken: cancellationToken);
+            foreach (var step in LastRun.Steps)
+                Activity.Add($"{step.Endpoint}: {step.Summary} (verify={step.Verified}, rollback={step.RolledBack})");
+            StatusText = LastRun.Status == PairRunStatus.Succeeded
+                ? "Ремонт выполнен и подтверждён повторной диагностикой. Напечатайте тестовую страницу."
+                : $"Ремонт завершён со статусом {LastRun.Status}. Откройте отчёт для деталей.";
+        });
+    }
+
+    [RelayCommand]
+    private async Task PrintTestPageAsync()
+    {
+        var host = _invitation?.HostComputerName ?? _hostSnapshot?.Endpoint.ComputerName ?? PeerComputerName.Trim();
+        var share = _plan?.Steps.SelectMany(step => step.Parameters).FirstOrDefault(pair => pair.Key == "shareName").Value
+                    ?? _hostSnapshot?.PrinterShareName ?? NullIfEmpty(ShareName);
+        if (string.IsNullOrWhiteSpace(host) || string.IsNullOrWhiteSpace(share))
+            throw new InvalidOperationException("Не удалось определить имя общей очереди.");
+        var connection = $"\\\\{host}\\{share}";
+        if (TransportMode == PairTransportMode.DomainRemote)
+        {
+            var client = _executionTargets?[PairEndpointRole.Client].ConnectionName
+                         ?? throw new InvalidOperationException("Не определён доменный Client.");
+            var encoded = Convert.ToBase64String(Encoding.UTF8.GetBytes(connection));
+            var script = "$n=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encoded + "'));" +
+                         "Start-Process (Join-Path $env:SystemRoot 'System32\\rundll32.exe') -ArgumentList @('printui.dll,PrintUIEntry','/k','/n',$n) -Wait -NoNewWindow";
+            var result = await _interactiveUserPowerShell.RunRemoteAsync(client, script, _lifetime.Token, TimeSpan.FromMinutes(2));
+            if (!result.Success) throw new InvalidOperationException(result.Error ?? "Не удалось отправить тестовую страницу на доменном Client.");
+        }
+        else
+        {
+            var start = new ProcessStartInfo(Path.Combine(Environment.SystemDirectory, "rundll32.exe"))
+            {
+                UseShellExecute = false,
+                CreateNoWindow = true
+            };
+            start.ArgumentList.Add("printui.dll,PrintUIEntry");
+            start.ArgumentList.Add("/k");
+            start.ArgumentList.Add("/n");
+            start.ArgumentList.Add(connection);
+            using var process = Process.Start(start) ?? throw new InvalidOperationException("Не удалось запустить печать тестовой страницы.");
+            await process.WaitForExitAsync(_lifetime.Token);
+        }
+        PhysicalTestConfirmed = _prompts.Confirm("Тестовая страница физически напечаталась?", "Физическая проверка");
+        StatusText = PhysicalTestConfirmed
+            ? "Готово: очередь подключена, диагностика чистая, физическая печать подтверждена."
+            : "Windows отправила тестовую страницу, но физическая печать не подтверждена — требуется проверка устройства.";
+        Activity.Add($"Физическая проверка: {(PhysicalTestConfirmed ? "успешно" : "не подтверждена") }.");
+    }
+
+    [RelayCommand]
+    private void Cancel() => _lifetime.Cancel();
+
+    private async Task BuildPlanAsync(PairTransportMode mode, CancellationToken cancellationToken)
+    {
+        var host = _hostSnapshot ?? throw new InvalidOperationException("Нет снимка хоста.");
+        var client = _clientSnapshot ?? throw new InvalidOperationException("Нет снимка клиента.");
+        var findings = await _diagnostics.DiagnoseAsync(host, client, cancellationToken);
+        var fullPlan = _planner.CreatePlan(host, client, mode, findings, IncludeExpertActions);
+        _plan = mode == PairTransportMode.Offline ? LocalOnly(fullPlan, LocalRole) : fullPlan;
+        Findings.Clear();
+        foreach (var finding in findings) Findings.Add(finding);
+        Steps.Clear();
+        foreach (var step in _plan.Steps) Steps.Add(step);
+        StatusText = _plan.Steps.Count == 0
+            ? "Диагностика не нашла действий для выбранного режима."
+            : $"Найдено причин: {findings.Count}; действий в плане: {_plan.Steps.Count}.";
+        OnPropertyChanged(nameof(HasPlan));
+        OnPropertyChanged(nameof(CanExecute));
+    }
+
+    private static PairRepairPlan LocalOnly(PairRepairPlan plan, PairEndpointRole role)
+    {
+        var filtered = plan.Steps.Where(step => step.Endpoint == role).ToArray();
+        var normalized = filtered.Select((step, index) => step with
+        {
+            DependsOn = index == 0 ? [] : [filtered[index - 1].Id]
+        }).ToArray();
+        return plan with { Steps = normalized };
+    }
+
+    private static IReadOnlyDictionary<PairEndpointRole, TargetDescriptor> LocalTargets() =>
+        new Dictionary<PairEndpointRole, TargetDescriptor>
+        {
+            [PairEndpointRole.Host] = TargetDescriptor.Local(),
+            [PairEndpointRole.Client] = TargetDescriptor.Local()
+        };
+
+    private static TargetDescriptor RemoteTarget(string computerName) => new()
+    {
+        Id = computerName.ToUpperInvariant(),
+        ComputerName = computerName,
+        Source = TargetSource.Manual
+    };
+
+    private async Task RunAgentAsync(IPairSession session, CancellationToken cancellationToken)
+    {
+        try
+        {
+            await _agentLoop.RunAsync(session, cancellationToken);
+            StatusText = "Клиент завершил PairRun; host-side изменения подтверждены.";
+            Activity.Add("Host agent получил commit PairRun.");
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            Activity.Add("Host agent остановлен; незавершённые обратимые действия откатываются.");
+        }
+        catch (Exception ex)
+        {
+            StatusText = "Связь потеряна; host-side rollback выполнен для незавершённого плана.";
+            Activity.Add("Host agent: " + ex.Message);
+        }
+        finally
+        {
+            if (_firewallLease is not null)
+            {
+                await _firewallLease.DisposeAsync();
+                _firewallLease = null;
+            }
+        }
+    }
+
+    private async Task RunBusyAsync(Func<CancellationToken, Task> operation)
+    {
+        if (IsBusy) return;
+        IsBusy = true;
+        try
+        {
+            await operation(_lifetime.Token);
+        }
+        catch (OperationCanceledException)
+        {
+            StatusText = "Операция отменена; незавершённый обратимый план откатывается.";
+        }
+        catch (Exception ex)
+        {
+            StatusText = ex.Message;
+            Activity.Add("Ошибка: " + ex.Message);
+        }
+        finally
+        {
+            IsBusy = false;
+            OnPropertyChanged(nameof(CanExecute));
+        }
+    }
+
+    private async Task DisposeConnectionAsync()
+    {
+        if (_session is not null) { await _session.DisposeAsync(); _session = null; }
+        if (_firewallLease is not null) { await _firewallLease.DisposeAsync(); _firewallLease = null; }
+        if (_host is not null) { await _host.DisposeAsync(); _host = null; }
+        IsConnected = false;
+        IsApproved = false;
+    }
+
+    private void EnsureRole(PairEndpointRole role)
+    {
+        if (LocalRole != role) throw new InvalidOperationException($"Это действие предназначено для роли {role}.");
+    }
+
+    private void RequirePeer()
+    {
+        if (string.IsNullOrWhiteSpace(PeerComputerName)) throw new InvalidOperationException("Укажите имя второго ПК.");
+    }
+
+    private void EnsureNotConnected()
+    {
+        if (IsConnected) throw new InvalidOperationException("Нельзя менять роль во время активной сессии.");
+    }
+
+    private static string? NullIfEmpty(string? value) => string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        _lifetime.Cancel();
+        await DisposeConnectionAsync();
+        if (_agentTask is not null)
+        {
+            try { await _agentTask; } catch { }
+        }
+        _lifetime.Dispose();
+    }
+}
diff --git a/src/W-Fix.App/W-Fix.App.csproj b/src/W-Fix.App/W-Fix.App.csproj
index 87f49b9..f3be1a7 100644
--- a/src/W-Fix.App/W-Fix.App.csproj
+++ b/src/W-Fix.App/W-Fix.App.csproj
@@ -15,7 +15,7 @@
     <ApplicationIcon>Assets\icon.ico</ApplicationIcon>
 
     <!-- Metadata -->
-    <Version>3.0.0-beta.1</Version>
+    <Version>3.1.0-beta.1</Version>
     <Authors>OneDeadMachine</Authors>
     <Company>OneDeadMachine</Company>
     <Product>W-Fix — Printer Troubleshooter</Product>
diff --git a/src/W-Fix.Core/Abstractions/PairRepairContracts.cs b/src/W-Fix.Core/Abstractions/PairRepairContracts.cs
index e40fbd0..8b763a5 100644
--- a/src/W-Fix.Core/Abstractions/PairRepairContracts.cs
+++ b/src/W-Fix.Core/Abstractions/PairRepairContracts.cs
@@ -20,6 +20,7 @@ public interface IPairSession : IAsyncDisposable
 {
     PairInvitation Invitation { get; }
     PairEndpointRole LocalRole { get; }
+    string PeerComputerName { get; }
     PairSessionState State { get; }
     string ConfirmationCode { get; }
 
@@ -40,6 +41,7 @@ public sealed record PairHostOptions
     public IReadOnlyList<IPAddress>? ListenAddresses { get; init; }
     public string? PrinterName { get; init; }
     public string? ShareName { get; init; }
+    public string? ExpectedClientComputerName { get; init; }
     public TimeSpan InvitationLifetime { get; init; } = TimeSpan.FromMinutes(15);
 }
 
diff --git a/src/W-Fix.Core/Models/PairRepairModels.cs b/src/W-Fix.Core/Models/PairRepairModels.cs
index 18efe52..953a457 100644
--- a/src/W-Fix.Core/Models/PairRepairModels.cs
+++ b/src/W-Fix.Core/Models/PairRepairModels.cs
@@ -51,6 +51,7 @@ public sealed record PairInvitation
     public DateTimeOffset ExpiresAt { get; init; }
     public string? PrinterName { get; init; }
     public string? ShareName { get; init; }
+    public string? ExpectedClientComputerName { get; init; }
 }
 
 public sealed record PairOfflineBundle
@@ -95,6 +96,7 @@ public sealed record PairEndpointSnapshot
     public string? PrinterName { get; init; }
     public string? PrinterShareName { get; init; }
     public bool PrinterShared { get; init; }
+    public bool PrinterAllowsAuthenticatedUsersPrint { get; init; }
     public string? PrinterDriverName { get; init; }
     public string? PrinterDriverVersion { get; init; }
     public bool PrinterConnectionInstalled { get; init; }
@@ -224,7 +226,8 @@ public enum PairActionOperation
     Execute,
     Verify,
     Rollback,
-    Commit
+    Commit,
+    Abort
 }
 
 public sealed record PairActionRequest(string RequestId, PairActionOperation Operation, PairRepairStep Step);
diff --git a/src/W-Fix.Core/Pairing/PairDiagnostics.cs b/src/W-Fix.Core/Pairing/PairDiagnostics.cs
index b3c4698..0070cdd 100644
--- a/src/W-Fix.Core/Pairing/PairDiagnostics.cs
+++ b/src/W-Fix.Core/Pairing/PairDiagnostics.cs
@@ -161,6 +161,20 @@ public Task<IReadOnlyList<PairDiagnosticFinding>> EvaluateAsync(
                 RecommendedActionIds = ["pair.printer.share"]
             });
         }
+        if (!host.PrinterAllowsAuthenticatedUsersPrint)
+        {
+            findings.Add(new PairDiagnosticFinding
+            {
+                RuleId = "pair.printer.acl",
+                Title = "У общей очереди отсутствует право Print",
+                Description = "W-Fix добавит Authenticated Users только право печати, сохранив исходный PermissionSDDL для rollback.",
+                Severity = FindingSeverity.Error,
+                Confidence = 0.92,
+                AffectedEndpoints = [PairEndpointRole.Host],
+                Evidence = ["Printer ACL: Print for Everyone/Authenticated Users=False"],
+                RecommendedActionIds = ["pair.printer.grant-print"]
+            });
+        }
         if (!client.PrinterConnectionInstalled)
         {
             findings.Add(new PairDiagnosticFinding
diff --git a/src/W-Fix.Core/Pairing/PairInventoryService.cs b/src/W-Fix.Core/Pairing/PairInventoryService.cs
index abe7d93..38fc7e1 100644
--- a/src/W-Fix.Core/Pairing/PairInventoryService.cs
+++ b/src/W-Fix.Core/Pairing/PairInventoryService.cs
@@ -56,6 +56,7 @@ public async Task<PairEndpointSnapshot> CaptureAsync(
             PrinterName = dto.PrinterName,
             PrinterShareName = dto.PrinterShareName,
             PrinterShared = dto.PrinterShared,
+            PrinterAllowsAuthenticatedUsersPrint = dto.PrinterAllowsAuthenticatedUsersPrint,
             PrinterDriverName = dto.PrinterDriverName,
             PrinterDriverVersion = dto.PrinterDriverVersion,
             PrinterConnectionInstalled = dto.PrinterConnectionInstalled,
@@ -107,16 +108,30 @@ private static string BuildScript(PairEndpointRole role, string peerName, string
             $pointAndPrint = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name RestrictDriverInstallationToAdministrators -ErrorAction SilentlyContinue
             $printer = $null
             if ($role -eq 'Host') {
-                $printer = if ($requestedPrinter) { Get-Printer -Name $requestedPrinter -ErrorAction SilentlyContinue } else { Get-Printer -ErrorAction SilentlyContinue | Where-Object Shared | Select-Object -First 1 }
+                $printer = if ($requestedPrinter) { Get-Printer -Name $requestedPrinter -Full -ErrorAction SilentlyContinue } else { Get-Printer -Full -ErrorAction SilentlyContinue | Where-Object Shared | Select-Object -First 1 }
             } elseif ($requestedShare) {
                 $connectionName = '\\' + $peerName + '\' + $requestedShare
                 $printer = Get-Printer -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq $connectionName -or $_.ComputerName -eq $peerName -and $_.ShareName -eq $requestedShare } | Select-Object -First 1
             }
             $driverVersion = $null
+            $printerAllowsPrint = $false
             if ($null -ne $printer -and $printer.DriverName) {
                 $driver = Get-CimInstance Win32_PrinterDriver -ErrorAction SilentlyContinue | Where-Object Name -like ($printer.DriverName + '*') | Select-Object -First 1
                 $driverVersion = $driver.Version
             }
+            if ($null -ne $printer -and $printer.PermissionSDDL) {
+                try {
+                    $descriptor = [Security.AccessControl.RawSecurityDescriptor]::new([string]$printer.PermissionSDDL)
+                    $allowedSids = @(
+                        [Security.Principal.SecurityIdentifier]::new([Security.Principal.WellKnownSidType]::WorldSid, $null).Value,
+                        [Security.Principal.SecurityIdentifier]::new([Security.Principal.WellKnownSidType]::AuthenticatedUserSid, $null).Value
+                    )
+                    $printerAllowsPrint = @($descriptor.DiscretionaryAcl | Where-Object {
+                        $_.AceQualifier -eq [Security.AccessControl.AceQualifier]::AccessAllowed -and
+                        $allowedSids -contains $_.SecurityIdentifier.Value -and ($_.AccessMask -band 8) -ne 0
+                    }).Count -gt 0
+                } catch {}
+            }
             $events = @()
             foreach ($log in @('Microsoft-Windows-PrintService/Admin','Microsoft-Windows-SMBClient/Connectivity')) {
                 try {
@@ -151,6 +166,7 @@ private static string BuildScript(PairEndpointRole role, string peerName, string
                 PrinterName = $printer.Name
                 PrinterShareName = $printer.ShareName
                 PrinterShared = [bool]$printer.Shared
+                PrinterAllowsAuthenticatedUsersPrint = $printerAllowsPrint
                 PrinterDriverName = $printer.DriverName
                 PrinterDriverVersion = [string]$driverVersion
                 PrinterConnectionInstalled = ($role -eq 'Client') -and ($null -ne $printer)
@@ -187,6 +203,7 @@ private sealed record PairInventoryDto
         public string? PrinterName { get; init; }
         public string? PrinterShareName { get; init; }
         public bool PrinterShared { get; init; }
+        public bool PrinterAllowsAuthenticatedUsersPrint { get; init; }
         public string? PrinterDriverName { get; init; }
         public string? PrinterDriverVersion { get; init; }
         public bool PrinterConnectionInstalled { get; init; }
diff --git a/src/W-Fix.Core/Pairing/PairInvitationValidator.cs b/src/W-Fix.Core/Pairing/PairInvitationValidator.cs
index f29addf..bf7acc0 100644
--- a/src/W-Fix.Core/Pairing/PairInvitationValidator.cs
+++ b/src/W-Fix.Core/Pairing/PairInvitationValidator.cs
@@ -15,6 +15,9 @@ public void Validate(PairInvitation invitation, DateTimeOffset now)
             throw new InvalidDataException("Некорректный Pair Session ID.");
         if (string.IsNullOrWhiteSpace(invitation.HostComputerName) || invitation.HostComputerName.Length > 255)
             throw new InvalidDataException("В приглашении отсутствует корректное имя хоста.");
+        if (invitation.ExpectedClientComputerName is { Length: > 255 } ||
+            invitation.ExpectedClientComputerName is not null && string.IsNullOrWhiteSpace(invitation.ExpectedClientComputerName))
+            throw new InvalidDataException("В приглашении указано некорректное имя ожидаемого клиента.");
         if (invitation.Port is < IPEndPoint.MinPort or > IPEndPoint.MaxPort)
             throw new InvalidDataException("Некорректный TCP-порт pairing-сессии.");
         if (invitation.HostAddresses.Count is < 1 or > 16 || invitation.HostAddresses.Any(address => !IPAddress.TryParse(address, out _)))
diff --git a/src/W-Fix.Core/Pairing/PairProtocolSerializer.cs b/src/W-Fix.Core/Pairing/PairProtocolSerializer.cs
index 29d3dc8..23528d9 100644
--- a/src/W-Fix.Core/Pairing/PairProtocolSerializer.cs
+++ b/src/W-Fix.Core/Pairing/PairProtocolSerializer.cs
@@ -28,6 +28,10 @@ internal sealed class PairProtocolSerializer
         PropertyNameCaseInsensitive = false,
         MaxDepth = 32
     };
+    private static readonly HashSet<string> AllowedParameterNames = new(StringComparer.Ordinal)
+    {
+        "hostName", "printerName", "shareName"
+    };
 
     public byte[] Serialize<T>(PairMessageKind kind, T message)
     {
@@ -68,11 +72,21 @@ private static void ValidateMessage<T>(T message)
         ArgumentNullException.ThrowIfNull(message);
         if (message is PairActionRequest request)
         {
-            if (!request.Step.ActionId.StartsWith("pair.", StringComparison.Ordinal) || request.Step.ActionId.Length > 128)
-                throw new InvalidDataException("Через pairing-транспорт разрешены только встроенные действия pair.*.");
-            if (request.Step.Parameters.Count > 16 || request.Step.Parameters.Any(pair => pair.Key.Length > 64 || pair.Value.Length > 1024))
-                throw new InvalidDataException("Параметры pairing-действия превышают допустимые ограничения.");
+            if (!Guid.TryParseExact(request.RequestId, "N", out _) || !Enum.IsDefined(request.Operation))
+                throw new InvalidDataException("Некорректный pairing action request.");
+            ValidateStep(request.Step);
         }
+        if (message is PairRepairPlan plan)
+            foreach (var step in plan.Steps) ValidateStep(step);
+    }
+
+    private static void ValidateStep(PairRepairStep step)
+    {
+        if (!step.ActionId.StartsWith("pair.", StringComparison.Ordinal) || step.ActionId.Length > 128)
+            throw new InvalidDataException("Через pairing-транспорт разрешены только встроенные действия pair.*.");
+        if (step.Parameters.Count > AllowedParameterNames.Count || step.Parameters.Any(pair =>
+                !AllowedParameterNames.Contains(pair.Key) || pair.Value.Length > 1024))
+            throw new InvalidDataException("Pairing-действие содержит параметр вне allowlist.");
     }
 
     private sealed record Envelope(int Version, PairMessageKind Kind, JsonElement Payload);
diff --git a/src/W-Fix.Core/Pairing/PairRepairActions.cs b/src/W-Fix.Core/Pairing/PairRepairActions.cs
index 86c60b6..cf41d8d 100644
--- a/src/W-Fix.Core/Pairing/PairRepairActions.cs
+++ b/src/W-Fix.Core/Pairing/PairRepairActions.cs
@@ -1,6 +1,7 @@
 using System.Text;
 using WFix.Core.Abstractions;
 using WFix.Core.Models;
+using WFix.Core.Services;
 
 namespace WFix.Core.Pairing;
 
@@ -9,21 +10,24 @@ public sealed class PairRepairActionRegistry : IPairRepairActionRegistry
     private readonly IReadOnlyList<IPairRepairAction> _actions;
     private readonly IReadOnlyDictionary<string, IPairRepairAction> _byId;
 
-    public PairRepairActionRegistry(IRemoteSessionFactory sessionFactory)
+    public PairRepairActionRegistry(
+        IRemoteSessionFactory sessionFactory,
+        InteractiveUserPowerShellService interactiveUserPowerShell)
     {
         _actions =
         [
-            new BuiltInPairRepairAction("pair.discovery.services", "Запустить службы обнаружения", RepairRisk.Reversible, false, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.firewall.discovery", "Разрешить сетевое обнаружение", RepairRisk.Reversible, false, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.firewall.file-print", "Разрешить SMB/RPC печати", RepairRisk.Reversible, false, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.spooler.start", "Запустить диспетчер печати", RepairRisk.Reversible, false, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.smb.clear-conflict", "Закрыть конфликтующий SMB-сеанс", RepairRisk.Irreversible, false, false, sessionFactory),
-            new BuiltInPairRepairAction("pair.printer.share", "Опубликовать очередь", RepairRisk.Reversible, false, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.printer.connect", "Подключить общую очередь", RepairRisk.Reversible, false, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.rpc.named-pipes", "Включить RPC over Named Pipes", RepairRisk.Disruptive, true, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.rpc.disable-privacy", "Ослабить RPC privacy", RepairRisk.Disruptive, true, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.smb.insecure-guest", "Разрешить insecure guest", RepairRisk.Disruptive, true, true, sessionFactory),
-            new BuiltInPairRepairAction("pair.smb.disable-signing", "Отключить обязательную SMB-подпись", RepairRisk.Disruptive, true, true, sessionFactory)
+            new BuiltInPairRepairAction("pair.discovery.services", "Запустить службы обнаружения", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.firewall.discovery", "Разрешить сетевое обнаружение", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.firewall.file-print", "Разрешить SMB/RPC печати", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.spooler.start", "Запустить диспетчер печати", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.smb.clear-conflict", "Закрыть конфликтующий SMB-сеанс", RepairRisk.Irreversible, false, false, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.printer.share", "Опубликовать очередь", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.printer.grant-print", "Восстановить право Print", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.printer.connect", "Подключить общую очередь", RepairRisk.Reversible, false, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.rpc.named-pipes", "Включить RPC over Named Pipes", RepairRisk.Disruptive, true, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.rpc.disable-privacy", "Ослабить RPC privacy", RepairRisk.Disruptive, true, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.smb.insecure-guest", "Разрешить insecure guest", RepairRisk.Disruptive, true, true, sessionFactory, interactiveUserPowerShell),
+            new BuiltInPairRepairAction("pair.smb.disable-signing", "Отключить обязательную SMB-подпись", RepairRisk.Disruptive, true, true, sessionFactory, interactiveUserPowerShell)
         ];
         _byId = _actions.ToDictionary(action => action.Id, StringComparer.Ordinal);
     }
@@ -57,7 +61,8 @@ internal sealed class BuiltInPairRepairAction(
     RepairRisk risk,
     bool expertOnly,
     bool isIdempotent,
-    IRemoteSessionFactory sessionFactory) : IPairRepairAction
+    IRemoteSessionFactory sessionFactory,
+    InteractiveUserPowerShellService interactiveUserPowerShell) : IPairRepairAction
 {
     public string Id { get; } = id;
     public string Name { get; } = name;
@@ -161,6 +166,12 @@ private string BuildPrepareScript(PairActionContext context)
                 $printer=Get-Printer -Name $name
                 [ordered]@{Shared=[bool]$printer.Shared;ShareName=[string]$printer.ShareName} | ConvertTo-Json -Compress
                 """,
+            "pair.printer.grant-print" => $$"""
+                $ErrorActionPreference='Stop'
+                $name=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('{{Encode(Required(context, "printerName"))}}'))
+                $printer=Get-Printer -Name $name -Full
+                [ordered]@{PermissionSDDL=[string]$printer.PermissionSDDL} | ConvertTo-Json -Compress
+                """,
             "pair.printer.connect" => $$"""
                 $hostName=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('{{Encode(Required(context, "hostName"))}}'))
                 $share=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('{{Encode(Required(context, "shareName"))}}'))
@@ -217,6 +228,21 @@ private string BuildExecuteScript(PairActionContext context)
                 Set-Printer -Name $name -Shared $true -ShareName $share
                 'OK'
                 """,
+            "pair.printer.grant-print" => $$"""
+                $ErrorActionPreference='Stop'
+                $name=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('{{Encode(Required(context, "printerName"))}}'))
+                $printer=Get-Printer -Name $name -Full
+                $descriptor=[Security.AccessControl.RawSecurityDescriptor]::new([string]$printer.PermissionSDDL)
+                $sid=[Security.Principal.SecurityIdentifier]::new([Security.Principal.WellKnownSidType]::AuthenticatedUserSid,$null)
+                $exists=@($descriptor.DiscretionaryAcl | Where-Object { $_.AceQualifier -eq [Security.AccessControl.AceQualifier]::AccessAllowed -and $_.SecurityIdentifier -eq $sid -and ($_.AccessMask -band 8) -ne 0 }).Count -gt 0
+                if(-not $exists){
+                    $ace=[Security.AccessControl.CommonAce]::new([Security.AccessControl.AceFlags]::None,[Security.AccessControl.AceQualifier]::AccessAllowed,8,$sid,$false,$null)
+                    $descriptor.DiscretionaryAcl.InsertAce($descriptor.DiscretionaryAcl.Count,$ace)
+                    $newSddl=$descriptor.GetSddlForm([Security.AccessControl.AccessControlSections]::All)
+                    Set-Printer -Name $name -PermissionSDDL $newSddl
+                }
+                'OK'
+                """,
             "pair.printer.connect" => $$"""
                 $ErrorActionPreference='Stop'
                 $hostName=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('{{Encode(Required(context, "hostName"))}}'))
@@ -250,6 +276,7 @@ private string BuildVerifyScript(PairActionContext context)
             "pair.spooler.start" => "[bool]((Get-Service Spooler).Status -eq 'Running')",
             "pair.smb.clear-conflict" => "$h=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encodedHost + "')); [bool](@(Get-SmbMapping -ErrorAction SilentlyContinue | Where-Object RemotePath -Like ('\\\\'+$h+'\\*')).Count -eq 0)",
             "pair.printer.share" => "$n=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encodedPrinter + "'));$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encodedShare + "'));$p=Get-Printer -Name $n;[bool]($p.Shared -and $p.ShareName -eq $s)",
+            "pair.printer.grant-print" => "$n=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encodedPrinter + "'));$p=Get-Printer -Name $n -Full;$d=[Security.AccessControl.RawSecurityDescriptor]::new([string]$p.PermissionSDDL);$sid=[Security.Principal.SecurityIdentifier]::new([Security.Principal.WellKnownSidType]::AuthenticatedUserSid,$null);[bool](@($d.DiscretionaryAcl|Where-Object{$_.AceQualifier -eq [Security.AccessControl.AceQualifier]::AccessAllowed -and $_.SecurityIdentifier -eq $sid -and ($_.AccessMask -band 8) -ne 0}).Count -gt 0)",
             "pair.printer.connect" => "$h=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encodedHost + "'));$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + encodedShare + "'));[bool]($null -ne (Get-Printer -Name ('\\\\'+$h+'\\'+$s) -ErrorAction SilentlyContinue))",
             "pair.rpc.named-pipes" => context.Step.Endpoint == PairEndpointRole.Host
                 ? @"[bool](((Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC').RpcProtocols -band 2) -ne 0)"
@@ -272,7 +299,8 @@ private string BuildRollbackScript(PairActionContext context, string state)
             "pair.discovery.services" => load + "foreach($n in @('fdPHost','FDResPub')){$mode=$state.($n+'StartMode');$startup=if($mode -eq 'Auto'){'Automatic'}elseif($mode -eq 'Disabled'){'Disabled'}else{'Manual'};Set-Service $n -StartupType $startup;if($state.($n+'Status') -eq 'Running'){Start-Service $n}else{Stop-Service $n -Force -ErrorAction SilentlyContinue}};'OK'",
             "pair.firewall.discovery" or "pair.firewall.file-print" => load + "$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + Encode(rulePrefix) + "'));$existing=@($state.Existing);Get-NetFirewallRule -ErrorAction SilentlyContinue|Where-Object{$_.DisplayName -like ($p+'*') -and $_.DisplayName -notin $existing}|Remove-NetFirewallRule;'OK'",
             "pair.spooler.start" => load + "$startup=if($state.StartMode -eq 'Auto'){'Automatic'}elseif($state.StartMode -eq 'Disabled'){'Disabled'}else{'Manual'};Set-Service Spooler -StartupType $startup;if($state.Status -eq 'Running'){Start-Service Spooler}else{Stop-Service Spooler -Force};'OK'",
-            "pair.printer.share" => load + "$n=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + Encode(Required(context, "printerName")) + "'));Set-Printer -Name $n -Shared ([bool]$state.Shared) -ShareName ([string]$state.ShareName);'OK'",
+            "pair.printer.share" => load + "$n=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + Encode(Required(context, "printerName")) + "'));if([bool]$state.Shared){Set-Printer -Name $n -Shared $true -ShareName ([string]$state.ShareName)}else{Set-Printer -Name $n -Shared $false};'OK'",
+            "pair.printer.grant-print" => load + "$n=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('" + Encode(Required(context, "printerName")) + "'));Set-Printer -Name $n -PermissionSDDL ([string]$state.PermissionSDDL);'OK'",
             "pair.printer.connect" => load + "if(-not [bool]$state.Existed){Remove-Printer -Name ([string]$state.Connection) -ErrorAction SilentlyContinue};'OK'",
             "pair.rpc.named-pipes" => load + RestoreRegistryScript("HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\RPC", context.Step.Endpoint == PairEndpointRole.Host ? "RpcProtocols" : "RpcUseNamedPipeProtocol"),
             "pair.rpc.disable-privacy" => load + RestoreRegistryScript("HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Print", "RpcAuthnLevelPrivacyEnabled"),
@@ -306,6 +334,11 @@ private static string Required(PairActionContext context, string name) =>
 
     private async Task<RemoteCommandResult> RunAsync(TargetDescriptor target, string script, TimeSpan timeout, CancellationToken cancellationToken)
     {
+        if (Id == "pair.printer.connect" && target.Source != TargetSource.Local)
+        {
+            var result = await interactiveUserPowerShell.RunRemoteAsync(target.ConnectionName, script, cancellationToken, timeout);
+            return new RemoteCommandResult(result.Success, result.Output, result.Error, result.TimedOut);
+        }
         await using var session = await sessionFactory.CreateAsync(target, cancellationToken);
         return await session.ExecutePowerShellAsync(script, cancellationToken, timeout);
     }
diff --git a/src/W-Fix.Core/Pairing/PairRepairExecutor.cs b/src/W-Fix.Core/Pairing/PairRepairExecutor.cs
index a8c86a8..02162bc 100644
--- a/src/W-Fix.Core/Pairing/PairRepairExecutor.cs
+++ b/src/W-Fix.Core/Pairing/PairRepairExecutor.cs
@@ -74,7 +74,7 @@ public async Task<PairRun> ExecuteAsync(
         catch (OperationCanceledException)
         {
             var rolledBack = await RollbackAsync(completed, results, warnings);
-            var cancelled = Build(rolledBack ? PairRunStatus.RolledBack : PairRunStatus.RecoveryRequired);
+            var cancelled = Build(rolledBack ? PairRunStatus.Cancelled : PairRunStatus.RecoveryRequired);
             var persisted = await PersistAsync(cancelled, CancellationToken.None);
             if (rolledBack) DeleteJournal(journalPath);
             progress?.Report(persisted);
@@ -136,6 +136,15 @@ private async Task<bool> RollbackAsync(
                 warnings.Add($"Rollback '{item.Context.Step.Title}': {ex.Message}");
             }
         }
+        try
+        {
+            await dispatcher.CompleteAsync(false, CancellationToken.None);
+        }
+        catch (Exception ex)
+        {
+            allSucceeded = false;
+            warnings.Add($"Pair abort: {ex.Message}");
+        }
         return allSucceeded;
     }
 
diff --git a/src/W-Fix.Core/Pairing/PairRepairPlanner.cs b/src/W-Fix.Core/Pairing/PairRepairPlanner.cs
index 7c49138..b6b871f 100644
--- a/src/W-Fix.Core/Pairing/PairRepairPlanner.cs
+++ b/src/W-Fix.Core/Pairing/PairRepairPlanner.cs
@@ -14,6 +14,7 @@ public sealed class PairRepairPlanner : IPairRepairPlanner
             ["pair.spooler.start"] = new("Запустить диспетчер печати хоста", RepairRisk.Reversible, false, _ => [PairEndpointRole.Host]),
             ["pair.smb.clear-conflict"] = new("Закрыть конфликтующий SMB-сеанс", RepairRisk.Irreversible, false, _ => [PairEndpointRole.Client]),
             ["pair.printer.share"] = new("Опубликовать очередь хоста", RepairRisk.Reversible, false, _ => [PairEndpointRole.Host]),
+            ["pair.printer.grant-print"] = new("Восстановить право Print общей очереди", RepairRisk.Reversible, false, _ => [PairEndpointRole.Host]),
             ["pair.printer.connect"] = new("Подключить общую очередь", RepairRisk.Reversible, false, _ => [PairEndpointRole.Client]),
             ["pair.rpc.named-pipes"] = new("Включить совместимый RPC over Named Pipes", RepairRisk.Disruptive, true, _ => [PairEndpointRole.Host, PairEndpointRole.Client])
         };
diff --git a/src/W-Fix.Core/Pairing/PairSessionActionDispatcher.cs b/src/W-Fix.Core/Pairing/PairSessionActionDispatcher.cs
index 9f8dfe0..4de24ec 100644
--- a/src/W-Fix.Core/Pairing/PairSessionActionDispatcher.cs
+++ b/src/W-Fix.Core/Pairing/PairSessionActionDispatcher.cs
@@ -59,18 +59,18 @@ public async Task<PairActionResult> RollbackAsync(
 
     public async Task CompleteAsync(bool commit, CancellationToken cancellationToken = default)
     {
-        if (!commit) return;
         var step = new PairRepairStep
         {
-            Id = "pair-session-commit",
-            ActionId = "pair.session.commit",
+            Id = commit ? "pair-session-commit" : "pair-session-abort",
+            ActionId = commit ? "pair.session.commit" : "pair.session.abort",
             Endpoint = remoteEndpoint,
-            Title = "Commit PairRun"
+            Title = commit ? "Commit PairRun" : "Abort PairRun"
         };
-        var response = await InvokeRemoteAsync(Guid.NewGuid().ToString("N"), PairActionOperation.Commit, step, cancellationToken);
+        var operation = commit ? PairActionOperation.Commit : PairActionOperation.Abort;
+        var response = await InvokeRemoteAsync(Guid.NewGuid().ToString("N"), operation, step, cancellationToken);
         if (!response.Result.Success) throw new InvalidOperationException(response.Result.Summary);
         _requestIds.Clear();
-        await localDispatcher.CompleteAsync(true, cancellationToken);
+        await localDispatcher.CompleteAsync(commit, cancellationToken);
     }
 
     private async Task<PairActionResponse> InvokeRemoteAsync(
@@ -79,8 +79,21 @@ private async Task<PairActionResponse> InvokeRemoteAsync(
         PairRepairStep step,
         CancellationToken cancellationToken)
     {
-        await session.SendAsync(PairMessageKind.ActionRequest, new PairActionRequest(requestId, operation, step), cancellationToken);
-        var response = await session.ReceiveAsync<PairActionResponse>(PairMessageKind.ActionResult, cancellationToken);
+        var timeout = step.Timeout >= TimeSpan.FromSeconds(1) && step.Timeout <= TimeSpan.FromMinutes(10)
+            ? step.Timeout
+            : TimeSpan.FromSeconds(45);
+        using var timeoutCts = new CancellationTokenSource(timeout);
+        using var linked = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, timeoutCts.Token);
+        PairActionResponse response;
+        try
+        {
+            await session.SendAsync(PairMessageKind.ActionRequest, new PairActionRequest(requestId, operation, step), linked.Token);
+            response = await session.ReceiveAsync<PairActionResponse>(PairMessageKind.ActionResult, linked.Token);
+        }
+        catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested && timeoutCts.IsCancellationRequested)
+        {
+            throw new TimeoutException($"Pair action '{step.ActionId}' превысил таймаут {timeout}.");
+        }
         if (!string.Equals(response.RequestId, requestId, StringComparison.Ordinal))
             throw new InvalidDataException("Ответ pairing-агента не соответствует запросу.");
         return response;
@@ -113,6 +126,8 @@ public async Task RunAsync(IPairSession session, CancellationToken cancellationT
                 PairActionResult result;
                 try
                 {
+                    if (request.Step.Endpoint != PairEndpointRole.Host)
+                        throw new InvalidDataException("Pairing-агент хоста принимает только host-side действия.");
                     if (request.Operation == PairActionOperation.Commit)
                     {
                         prepared.Clear();
@@ -121,6 +136,27 @@ public async Task RunAsync(IPairSession session, CancellationToken cancellationT
                         await session.SendAsync(PairMessageKind.ActionResult, new PairActionResponse(request.RequestId, result), cancellationToken);
                         return;
                     }
+                    if (request.Operation == PairActionOperation.Abort)
+                    {
+                        var rollbackFailures = new List<string>();
+                        foreach (var item in prepared.Values.Reverse())
+                        {
+                            var rollback = await localDispatcher.RollbackAsync(item.Context, item.Checkpoint, CancellationToken.None);
+                            if (!rollback.Success) rollbackFailures.Add(rollback.Summary);
+                        }
+                        if (rollbackFailures.Count == 0) prepared.Clear();
+                        result = new PairActionResult
+                        {
+                            Success = rollbackFailures.Count == 0,
+                            Verified = rollbackFailures.Count == 0,
+                            Summary = rollbackFailures.Count == 0
+                                ? "Host-side PairRun aborted and rolled back."
+                                : "Host-side rollback incomplete: " + string.Join("; ", rollbackFailures)
+                        };
+                        await session.SendAsync(PairMessageKind.ActionResult, new PairActionResponse(request.RequestId, result), cancellationToken);
+                        committed = rollbackFailures.Count == 0;
+                        return;
+                    }
                     var context = new PairActionContext(TargetDescriptor.Local(), request.Step, runDirectory);
                     result = request.Operation switch
                     {
diff --git a/src/W-Fix.Core/Pairing/TlsPairSessionTransport.cs b/src/W-Fix.Core/Pairing/TlsPairSessionTransport.cs
index 0d3f9e0..e927c28 100644
--- a/src/W-Fix.Core/Pairing/TlsPairSessionTransport.cs
+++ b/src/W-Fix.Core/Pairing/TlsPairSessionTransport.cs
@@ -43,7 +43,8 @@ public Task<IPairHost> StartHostAsync(PairHostOptions options, CancellationToken
             CreatedAt = createdAt,
             ExpiresAt = createdAt + options.InvitationLifetime,
             PrinterName = options.PrinterName,
-            ShareName = options.ShareName
+            ShareName = options.ShareName,
+            ExpectedClientComputerName = options.ExpectedClientComputerName
         };
         validator.Validate(invitation, createdAt);
         return Task.FromResult<IPairHost>(new PairHost(listener, certificate, invitation));
@@ -52,6 +53,9 @@ public Task<IPairHost> StartHostAsync(PairHostOptions options, CancellationToken
     public async Task<IPairSession> JoinAsync(PairInvitation invitation, CancellationToken cancellationToken = default)
     {
         validator.Validate(invitation, DateTimeOffset.UtcNow);
+        if (!string.IsNullOrWhiteSpace(invitation.ExpectedClientComputerName) &&
+            !string.Equals(invitation.ExpectedClientComputerName, Environment.MachineName, StringComparison.OrdinalIgnoreCase))
+            throw new AuthenticationException($"Приглашение предназначено для ПК '{invitation.ExpectedClientComputerName}', а не для '{Environment.MachineName}'.");
         Exception? lastError = null;
         foreach (var addressText in invitation.HostAddresses)
         {
@@ -74,6 +78,9 @@ await ssl.AuthenticateAsClientAsync(new SslClientAuthenticationOptions
                 var hostHello = await session.ReceiveHandshakeAsync(cancellationToken);
                 if (!string.Equals(hostHello.SessionId, invitation.SessionId, StringComparison.Ordinal))
                     throw new AuthenticationException("Pair Session ID хоста не совпадает с приглашением.");
+                if (!string.Equals(hostHello.ComputerName, invitation.HostComputerName, StringComparison.OrdinalIgnoreCase))
+                    throw new AuthenticationException("Имя pairing-хоста не совпадает с приглашением.");
+                session.SetPeerComputerName(hostHello.ComputerName);
                 session.MarkAwaitingApproval();
                 return session;
             }
@@ -185,7 +192,11 @@ await ssl.AuthenticateAsServerAsync(new SslServerAuthenticationOptions
                 var clientHello = await session.ReceiveHandshakeAsync(expiry.Token);
                 if (!string.Equals(clientHello.SessionId, Invitation.SessionId, StringComparison.Ordinal))
                     throw new AuthenticationException("Pair Session ID клиента не совпадает с приглашением.");
-                await session.SendHandshakeAsync(new PairHello(Invitation.SessionId, Environment.MachineName), expiry.Token);
+                if (!string.IsNullOrWhiteSpace(Invitation.ExpectedClientComputerName) &&
+                    !string.Equals(clientHello.ComputerName, Invitation.ExpectedClientComputerName, StringComparison.OrdinalIgnoreCase))
+                    throw new AuthenticationException("К pairing-хосту подключился другой компьютер.");
+                session.SetPeerComputerName(clientHello.ComputerName);
+                await session.SendHandshakeAsync(new PairHello(Invitation.SessionId, Invitation.HostComputerName), expiry.Token);
                 session.MarkAwaitingApproval();
                 return session;
             }
@@ -216,6 +227,7 @@ private sealed class TlsPairSession(
 
         public PairInvitation Invitation { get; } = invitation;
         public PairEndpointRole LocalRole { get; } = localRole;
+        public string PeerComputerName { get; private set; } = "";
         public PairSessionState State { get; private set; } = PairSessionState.Connected;
         public string ConfirmationCode => Invitation.ConfirmationCode;
 
@@ -249,6 +261,7 @@ internal Task<PairHello> ReceiveHandshakeAsync(CancellationToken cancellationTok
             ReceiveCoreAsync<PairHello>(PairMessageKind.Hello, cancellationToken);
 
         internal void MarkAwaitingApproval() => State = PairSessionState.AwaitingApproval;
+        internal void SetPeerComputerName(string value) => PeerComputerName = value;
 
         private async Task SendCoreAsync<T>(PairMessageKind kind, T message, CancellationToken cancellationToken)
         {
diff --git a/src/W-Fix.Core/W-Fix.Core.csproj b/src/W-Fix.Core/W-Fix.Core.csproj
index 0106804..1de2909 100644
--- a/src/W-Fix.Core/W-Fix.Core.csproj
+++ b/src/W-Fix.Core/W-Fix.Core.csproj
@@ -8,7 +8,7 @@
     <PlatformTarget>x64</PlatformTarget>
 
     <!-- Metadata -->
-    <Version>3.0.0-beta.1</Version>
+    <Version>3.1.0-beta.1</Version>
     <Authors>OneDeadMachine</Authors>
     <Company>OneDeadMachine</Company>
     <Product>W-Fix Core</Product>
diff --git a/tests/W-Fix.Core.Tests/PairRepairCoreTests.cs b/tests/W-Fix.Core.Tests/PairRepairCoreTests.cs
index 3cb75a1..a893306 100644
--- a/tests/W-Fix.Core.Tests/PairRepairCoreTests.cs
+++ b/tests/W-Fix.Core.Tests/PairRepairCoreTests.cs
@@ -1,4 +1,5 @@
 using System.Net;
+using System.Security.Authentication;
 using System.Text.Json.Nodes;
 using WFix.Core.Abstractions;
 using WFix.Core.Models;
@@ -60,7 +61,7 @@ public void Serializer_round_trips_allowlisted_message()
     public void Serializer_rejects_non_pair_action()
     {
         var serializer = new PairProtocolSerializer();
-        var request = new PairActionRequest("r1", PairActionOperation.Execute, new PairRepairStep
+        var request = new PairActionRequest(Guid.NewGuid().ToString("N"), PairActionOperation.Execute, new PairRepairStep
         {
             Id = "s1",
             ActionId = "legacy:spooler",
@@ -184,6 +185,20 @@ public async Task Join_rejects_certificate_pin_mismatch()
         await Assert.ThrowsAnyAsync<Exception>(async () => await accept);
     }
 
+    [Fact]
+    public async Task Join_rejects_invitation_for_another_client()
+    {
+        var transport = new TlsPairSessionTransport(new PairInvitationValidator());
+        await using var host = await transport.StartHostAsync(new PairHostOptions
+        {
+            HostComputerName = "localhost",
+            ExpectedClientComputerName = "ANOTHER-PC",
+            ListenAddresses = [IPAddress.Loopback],
+            InvitationLifetime = TimeSpan.FromMinutes(2)
+        });
+        await Assert.ThrowsAsync<AuthenticationException>(() => transport.JoinAsync(host.Invitation));
+    }
+
     private static PairEndpointSnapshot Snapshot(PairEndpointRole role, string name) => new()
     {
         Endpoint = new PairEndpointDescriptor { Role = role, ComputerName = name, IsLocalAgent = true }
@@ -222,6 +237,7 @@ public async Task Diagnostics_build_secure_host_and_client_repair_plan()
 
         Assert.Contains(plan.Steps, step => step.ActionId == "pair.firewall.file-print" && step.Endpoint == PairEndpointRole.Host);
         Assert.Contains(plan.Steps, step => step.ActionId == "pair.printer.share" && step.Endpoint == PairEndpointRole.Host);
+        Assert.Contains(plan.Steps, step => step.ActionId == "pair.printer.grant-print" && step.Endpoint == PairEndpointRole.Host);
         Assert.Contains(plan.Steps, step => step.ActionId == "pair.printer.connect" && step.Endpoint == PairEndpointRole.Client);
         var shareStep = Assert.Single(plan.Steps, step => step.ActionId == "pair.printer.share");
         var connectStep = Assert.Single(plan.Steps, step => step.ActionId == "pair.printer.connect");
@@ -289,6 +305,29 @@ public async Task Verification_failure_rolls_back_both_endpoints_in_reverse_orde
         }
     }
 
+    [Fact]
+    public async Task Unexpected_action_exception_still_rolls_back_prepared_step()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "wfix-pair-tests", Guid.NewGuid().ToString("N"));
+        try
+        {
+            var dispatcher = new FakeDispatcher(failVerificationFor: "", throwExecutionFor: "s1");
+            var executor = new PairRepairExecutor(dispatcher, new PairRunReportService(root), root);
+            var targets = new Dictionary<PairEndpointRole, TargetDescriptor>
+            {
+                [PairEndpointRole.Host] = TargetDescriptor.Local(),
+                [PairEndpointRole.Client] = TargetDescriptor.Local()
+            };
+            var run = await executor.ExecuteAsync(Plan(), targets);
+            Assert.Equal(PairRunStatus.RolledBack, run.Status);
+            Assert.Equal(["s1"], dispatcher.RollbackOrder);
+        }
+        finally
+        {
+            if (Directory.Exists(root)) Directory.Delete(root, true);
+        }
+    }
+
     private static PairRepairPlan Plan() => new()
     {
         Id = Guid.NewGuid().ToString("N"),
@@ -302,15 +341,18 @@ public async Task Verification_failure_rolls_back_both_endpoints_in_reverse_orde
         ]
     };
 
-    private sealed class FakeDispatcher(string failVerificationFor) : IPairActionDispatcher
+    private sealed class FakeDispatcher(string failVerificationFor, string? throwExecutionFor = null) : IPairActionDispatcher
     {
         public List<string> RollbackOrder { get; } = [];
 
         public Task<PairActionCheckpoint> PrepareAsync(PairActionContext context, CancellationToken cancellationToken = default) =>
             Task.FromResult(new PairActionCheckpoint { ActionId = context.Step.ActionId, Endpoint = context.Step.Endpoint });
 
-        public Task<PairActionResult> ExecuteAsync(PairActionContext context, CancellationToken cancellationToken = default) =>
-            Task.FromResult(new PairActionResult { Success = true, Summary = "done" });
+        public Task<PairActionResult> ExecuteAsync(PairActionContext context, CancellationToken cancellationToken = default)
+        {
+            if (context.Step.Id == throwExecutionFor) throw new ApplicationException("unexpected failure");
+            return Task.FromResult(new PairActionResult { Success = true, Summary = "done" });
+        }
 
         public Task<bool> VerifyAsync(PairActionContext context, CancellationToken cancellationToken = default) =>
             Task.FromResult(context.Step.Id != failVerificationFor);

From 0aef532b7a5fbdb1603faed2c2c584dbcab16a14 Mon Sep 17 00:00:00 2001
From: OneDeadMachine <onedeadmachine@users.noreply.github.com>
Date: Fri, 14 Aug 2026 15:27:27 +0300
Subject: [PATCH 2/2] =?UTF-8?q?ci:=20publish=20beta=20artifact=20for=20tes?=
 =?UTF-8?q?ters=20/=20=D0=BF=D1=83=D0=B1=D0=BB=D0=B8=D0=BA=D0=BE=D0=B2?=
 =?UTF-8?q?=D0=B0=D1=82=D1=8C=20beta=20artifact=20=D0=B4=D0=BB=D1=8F=20?=
 =?UTF-8?q?=D1=82=D0=B5=D1=81=D1=82=D0=BE=D0=B2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RU: CI теперь выполняет portable single-file publish и хранит W-Fix.exe 14 дней для ручной проверки коллегами до релиза.

EN: CI now performs the portable single-file publish and retains W-Fix.exe for 14 days so colleagues can validate it before release.
---
 .github/workflows/ci.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0a2f6e..8ee265f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,3 +28,23 @@ jobs:
 
       - name: NuGet vulnerability report
         run: dotnet list W-Fix.sln package --vulnerable --include-transitive
+
+      - name: Publish portable win-x64 executable
+        run: >-
+          dotnet publish src/W-Fix.App/W-Fix.App.csproj
+          --configuration Release
+          --runtime win-x64
+          --self-contained true
+          --no-restore
+          -p:PublishSingleFile=true
+          -p:IncludeAllContentForSelfExtract=true
+          -p:EnableCompressionInSingleFile=true
+          -o artifacts/publish/win-x64
+
+      - name: Upload beta test artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: W-Fix-${{ github.sha }}-win-x64
+          path: artifacts/publish/win-x64/W-Fix.exe
+          if-no-files-found: error
+          retention-days: 14