# msi — design
> **Class:** `design` · **Function axis:** `f10` (INSTALL-2, Windows). States only the shape we ship.
## Stable component GUIDs
`msi::guid_v5(namespace, component_id) -> String` (`msi.rs:244`) mints a deterministic UUID-v5
(SHA-1, namespaced) — the same component id always yields the same GUID, which is what MSI upgrade
stability requires. It lowercases the key and sets the version-5 + RFC-4122 variant bits. It ports
`tools/build.pl`'s logic and carries a self-contained SHA-1 (`msi.rs:291`, since `sha2` has no
SHA-1). `component_guid(id)` (`msi.rs:259`) applies it under the fixed `GUID_NAMESPACE`
(`msi.rs:15`).
## The Windows service definition
`WindowsServiceSpec` (`msi.rs:27`) — `account` (e.g. `LocalSystem`), `start` (`ServiceStart` =
`Auto | Manual | Disabled`, `msi.rs:19`), `delayed` (delayed-auto), `env_block`.
`WindowsComponentSpec` (`msi.rs:43`) — `name, display_name, version, upgrade_code, install_dir,
service, files` (`WixFile`, `msi.rs:36`) — the product to build.
## Rendering WiX sources
`msi::render_wxs(spec) -> String` (`msi.rs:58`) renders a real WiX v4 `Product.wxs`: each file gets
a stable component GUID via `guid_v5`, the service is registered from the `WindowsServiceSpec`. It
is **pure** — testable without Wine or podman.
## Building the MSI
`WixBuilder { image }` (`msi.rs:145`) builds MSIs with WiX v4 under Wine in podman — **runtime**
-gated on podman presence, not a cargo feature. `podman_argv(workdir, wxs, out)` (`msi.rs:159`) is
the exact pure argv; `podman_available()` (`msi.rs:179`); `build(spec, out)` (`msi.rs:192`) stages
files + renders the WXS for real, then bails **honestly** if podman/the image is absent
(`msi.rs:211`) — it never fakes an MSI.
## Contract (inject-assert tests)
`guid_v5_is_deterministic_and_well_formed` (`msi.rs:355`),
`sha1_matches_known_vector` (`msi.rs:373`),
`render_wxs_emits_real_wix_sources` (`msi.rs:403`),
`podman_build_invocation_is_correct` (`msi.rs:430`),
`build_pipeline_is_real_and_honest_without_podman` (`msi.rs:446`).