As a followup, there were some lessons here to be learned.
One thing that seemed to have been happening was rather subtle:
Begin by setting up your package with the “wrong” coinstaller (checked in this case). Attempt an install, and it fails. But file copy occurs first, so the coinstaller is already in its proper place.
Now swap in the right one, and try to install again. The “wrong” coinstaller is already in use when the attempt to overwrite it is made [I believe this is a different manifestation of the KMDF 1.1 coinstaller issue mentioned in the release notes, but I haven’t had time to verify that yet], so the “right” one sits in a temporary file, ready to replace it on the next reboot.
But the wrong coinstaller is still being used, the installation fails, and you are never asked to reboot. You can repeat this cycle until you either remove the “wrong” coinstaller from the machine manually or (more cruelly subtle) reboot when the “right” one is waiting to replace it. In the latter case, you will then be able to use the “wrong” coinstaller, but see your device install.
We focused on end-user scenarios in testing versioning, and not a lot on scenarios related to the checked coinstaller, since it is only for devs, assuming they were sophisticated enough to understand the issues on their own. But this one- I could easily see myself doing the exact same things, and coming to the exact same conclusions.
When I get time (a bit scarce these days), I will verify whether this also happens with 1.5 (I expect it to also be a problem with 1.0, as it stands), and whether the flagging workaround takes care of this. Logic tells me the answers are probably “No” and “Yes”.
There is no risk to consumers from this behavior [since they can never use the checked coinstaller, and it is not for redistribution], but it’s not something (IMO) that should have got past us. At the very least [again IMO] we should have provided better guidance on what to do if you do inadvertently use the wrong one.