diff --git a/.cargo/config.toml b/.cargo/config.toml
index f691dd8afef..6580c3c4ffc 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,5 +1,5 @@
 [target.x86_64-pc-windows-msvc]
-rustflags = ["-Ctarget-feature=+crt-static"]
+rustflags = ["-Ctarget-feature=+crt-static", "-Clink-arg=/Brepro"]
 [target.i686-pc-windows-msvc]
 rustflags = ["-C", "target-feature=+crt-static", "-C", "link-args=/NODEFAULTLIB:MSVCRT"]
 [target.aarch64-pc-windows-msvc]
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000000..971311b1709
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,86 @@
+# Deny by default: Git ignore rules do not apply to Docker build contexts.
+# Keep company environment files, keys, databases, packages and build caches out
+# of both the final image and intermediate layers sent to the build daemon.
+**
+!LICENCE
+!product/
+product/**
+!product/Cargo.toml
+!product/Cargo.lock
+!product/protocol/
+product/protocol/**
+!product/protocol/Cargo.toml
+!product/protocol/src/
+product/protocol/src/**
+!product/protocol/src/lib.rs
+!product/protocol/src/installation.rs
+!product/agent/
+product/agent/**
+!product/agent/Cargo.toml
+!product/agent/src/
+product/agent/src/**
+!product/agent/src/lib.rs
+!product/agent/src/main.rs
+!product/agent/src/payload.rs
+!product/agent/src/reporting.rs
+!product/agent/src/technician.rs
+!product/agent/src/technician_runtime.rs
+!product/agent/src/update.rs
+!product/agent/src/verifier_process.rs
+!product/management/
+product/management/**
+!product/management/Cargo.toml
+!product/management/src/
+product/management/src/**
+!product/management/src/main.rs
+!product/management/src/service.rs
+!product/management/src/installation_reporting.rs
+!product/management/src/network.rs
+!product/management/src/network_probe.rs
+!product/management/src/backup.rs
+!product/management/src/backup_stream.rs
+!product/management/src/windows.rs
+!product/management/src/components.rs
+!product/management/src/tests.rs
+!product/management/src/schema.sql
+!product/management/web/
+product/management/web/**
+!product/management/web/index.html
+!product/management/web/app.js
+!product/management/web/style.css
+!product/worker/
+product/worker/**
+!product/worker/Cargo.toml
+!product/worker/src/
+product/worker/src/**
+!product/worker/src/main.rs
+!product/worker/src/configuration.rs
+!product/worker/src/windows.rs
+!branding/
+branding/**
+!branding/swan-support-mark.svg
+!deployment/
+deployment/**
+!deployment/windows/
+deployment/windows/**
+!deployment/windows/Install-Company.ps1
+!deployment/windows/Install-SwanRemoteSupport.cmd
+!deployment/windows/Open-Technician.ps1
+!deployment/windows/Uninstall-Technician.ps1
+!deployment/windows/Verify-MsiRegistration.ps1
+!deployment/windows/Verify-Package.ps1
+!deployment/windows/Get-MsiIdentity.ps1
+!deployment/windows/Get-MsiInstallMode.ps1
+!deployment/windows/Get-WindowsCompatibility.ps1
+!deployment/windows/Restore-ReleaseMsi.ps1
+!deployment/windows/Restore-CustomerExe.ps1
+!deployment/windows/Restore-Configuration.ps1
+!deployment/windows/Restart-Configuration.ps1
+!deployment/windows/Restart-CustomerUi.ps1
+!deployment/windows/Run-SetupUiTask.ps1
+!deployment/windows/Remove-Configuration.ps1
+!deployment/windows/Update-RecoveryTask.ps1
+!deployment/windows/Update-UninstallCancellation.ps1
+!deployment/windows/Commit-Uninstall.ps1
+!deployment/windows/Prepare-CustomerDirectory.ps1
+!deployment/windows/Read-WorkerConfiguration.ps1
diff --git a/.gitattributes b/.gitattributes
index 176a458f94e..3847e581db9 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,7 @@
 * text=auto
+deployment/transport/** text eol=lf
+deployment/windows/flutter-engine* text eol=lf
+deployment/windows/fixtures/flutter-sdk-3.24.5/** text eol=lf
+deployment/windows/Build-FlutterEngine.ps1 text eol=lf
+deployment/windows/Install-FlutterEngineToolchain.ps1 text eol=lf
+.github/workflows/swan-flutter-engine.yml text eol=lf
diff --git a/.github/workflows/aom-repro-diagnostic.yml b/.github/workflows/aom-repro-diagnostic.yml
new file mode 100644
index 00000000000..f707e2c45c0
--- /dev/null
+++ b/.github/workflows/aom-repro-diagnostic.yml
@@ -0,0 +1,41 @@
+name: Diagnose pinned AV1 object reproducibility
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  aom:
+    runs-on: windows-2022
+    strategy:
+      fail-fast: false
+      matrix:
+        replica: [first-runner, independent-runner]
+    timeout-minutes: 45
+    env:
+      VCPKG_COMMIT_ID: 120deac3062162151622ca4860575a33844ba10b
+      VCPKG_DEFAULT_HOST_TRIPLET: x64-windows-static
+      VCPKG_BINARY_SOURCES: clear
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2
+        with:
+          vcpkgDirectory: C:\vcpkg
+          vcpkgGitCommitId: 120deac3062162151622ca4860575a33844ba10b
+          doNotCache: true
+      - name: Build pinned AV1 and repeatedly compile its original source unit
+        shell: pwsh
+        run: |
+          ./deployment/windows/Diagnose-AomObject.ps1 -WorkDirectory (Join-Path $env:RUNNER_TEMP 'swan-aom-object-diagnostic') -RepeatCompiles 24
+      - name: Preserve raw objects and effective compiler inputs
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: aom-object-diagnostic-${{ matrix.replica }}-UNSIGNED-TEST
+          path: ${{ runner.temp }}/swan-aom-object-diagnostic/evidence/**
+          if-no-files-found: warn
+          retention-days: 90
diff --git a/.github/workflows/bridge.yml b/.github/workflows/bridge.yml
index a7b74fa55a1..75990969844 100644
--- a/.github/workflows/bridge.yml
+++ b/.github/workflows/bridge.yml
@@ -4,11 +4,16 @@ name: Build flutter-rust-bridge
 
 on:
   workflow_call:
+    inputs:
+      include_windows_arm64:
+        description: Also generate the upstream Flutter 3.44 Windows ARM64 bridge
+        type: boolean
+        default: true
 
 env:
   CARGO_EXPAND_VERSION: "1.0.95"
   FLUTTER_RUST_BRIDGE_VERSION: "1.80.1"
-  RUST_VERSION: "1.75" # https://github.com/rustdesk/rustdesk/discussions/7503
+  RUST_VERSION: "1.90.0"
 
 jobs:
   generate_bridge:
@@ -16,23 +21,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        job:
-          # Default bridge for every platform still on Flutter 3.24.5 (generated with 3.22.3).
-          - {
-              target: x86_64-unknown-linux-gnu,
-              os: ubuntu-22.04,
-              extra-build-args: "",
-              flutter-version: "3.22.3",
-              artifact-name: "bridge-artifact",
-            }
-          # Dedicated bridge for the Windows arm64 build (Flutter 3.44); runs in parallel.
-          - {
-              target: x86_64-unknown-linux-gnu,
-              os: ubuntu-22.04,
-              extra-build-args: "",
-              flutter-version: "3.44.0",
-              artifact-name: "bridge-artifact-flutter-3.44",
-            }
+        # The Swan x64 release uses only the default bridge. Upstream callers
+        # retain both SDK-specific bridge jobs unless they explicitly opt out.
+        job: ${{ fromJSON(inputs.include_windows_arm64 && '[{"target":"x86_64-unknown-linux-gnu","os":"ubuntu-22.04","extra-build-args":"","flutter-version":"3.22.3","artifact-name":"bridge-artifact"},{"target":"x86_64-unknown-linux-gnu","os":"ubuntu-22.04","extra-build-args":"","flutter-version":"3.44.0","artifact-name":"bridge-artifact-flutter-3.44"}]' || '[{"target":"x86_64-unknown-linux-gnu","os":"ubuntu-22.04","extra-build-args":"","flutter-version":"3.22.3","artifact-name":"bridge-artifact"}]') }}
     steps:
       - name: Checkout source code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -114,3 +105,12 @@ jobs:
             ./flutter/lib/generated_bridge.freezed.dart
             ./flutter/macos/Runner/bridge_generated.h
             ./flutter/ios/Runner/bridge_generated.h
+
+      # Review and commit dependency resolution before native --locked builds.
+      # Never overwrite a checked-out lockfile from this artifact during builds.
+      - name: Export resolved dependency lock for review
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.job.artifact-name }}-resolved-lock
+          path: ./Cargo.lock
+          if-no-files-found: error
diff --git a/.github/workflows/check-service-bootstrap.yml b/.github/workflows/check-service-bootstrap.yml
new file mode 100644
index 00000000000..bfb0c108428
--- /dev/null
+++ b/.github/workflows/check-service-bootstrap.yml
@@ -0,0 +1,41 @@
+name: Check Windows service bootstrap
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/check-service-bootstrap.yml
+      - flutter/windows/runner/service_bootstrap.*
+      - deployment/windows/service-bootstrap-tests/**
+      - deployment/windows/test_service_bootstrap.ps1
+permissions:
+  contents: read
+jobs:
+  scm-loader:
+    runs-on: windows-2022
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Compile isolated service fixtures
+        shell: pwsh
+        run: |
+          cmake -S deployment/windows/service-bootstrap-tests -B bootstrap-build -A x64
+          if ($LASTEXITCODE) { throw 'CMake configuration failed' }
+          cmake --build bootstrap-build --config Release
+          if ($LASTEXITCODE) { throw 'Fixture build failed' }
+      - name: Exercise real service manager and loader boundary
+        shell: pwsh
+        run: |
+          ./deployment/windows/test_service_bootstrap.ps1 -BuildDirectory bootstrap-build/Release -OutputDirectory "$env:RUNNER_TEMP/bootstrap-results"
+      - name: Collect fixture source, unsigned binaries and receipts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-service-bootstrap-unsigned-fixtures
+          path: |
+            bootstrap-build/Release/*.exe
+            bootstrap-build/Release/*.dll
+            deployment/windows/test_service_bootstrap.ps1
+            deployment/windows/service-bootstrap-tests/
+            flutter/windows/runner/service_bootstrap.*
+            ${{ runner.temp }}/bootstrap-results/**
+          if-no-files-found: error
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 173eda9f456..96b2e8e65a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,10 @@ on:
       - "appimage/**"
       - "flatpak/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}
+
 jobs:
   # ensure_cargo_fmt:
   #   name: Ensure 'cargo fmt' has been run
diff --git a/.github/workflows/company-product.yml b/.github/workflows/company-product.yml
new file mode 100644
index 00000000000..0558057230a
--- /dev/null
+++ b/.github/workflows/company-product.yml
@@ -0,0 +1,294 @@
+name: Company product components
+on:
+  workflow_dispatch:
+    inputs:
+      technician_msi_only:
+        description: Test the pinned unsigned technician MSI on a disposable Windows runner
+        type: boolean
+        default: false
+      technician_msi_os:
+        description: Disposable Windows runner for the MSI lifecycle test
+        type: choice
+        options: [windows-2022, windows-2025]
+        default: windows-2022
+  push:
+    paths: ['product/**', 'deployment/**', 'libs/portable/build.rs', 'libs/portable/resource_order.rs', '.cargo/config.toml', '.dockerignore', '.github/workflows/company-product.yml']
+  pull_request:
+    paths: ['product/**', 'deployment/**', 'libs/portable/build.rs', 'libs/portable/resource_order.rs', '.cargo/config.toml', '.dockerignore', '.github/workflows/company-product.yml']
+permissions:
+  contents: read
+  actions: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}
+jobs:
+  maintained-windows-transport:
+    if: github.event_name != 'workflow_dispatch' || !inputs.technician_msi_only
+    uses: ./.github/workflows/swan-transport.yml
+    with:
+      windows_only: true
+
+  verify:
+    needs: maintained-windows-transport
+    if: github.event_name != 'workflow_dispatch' || !inputs.technician_msi_only
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, windows-2022]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Install pinned Rust
+        run: rustup toolchain install 1.90.0 --profile minimal
+      - name: Reject randomized portable resource metadata ordering
+        shell: bash
+        run: |
+          rustc +1.90.0 --edition 2021 --test libs/portable/resource_order.rs -o "$RUNNER_TEMP/portable-resource-tests.exe"
+          "$RUNNER_TEMP/portable-resource-tests.exe"
+      - name: Preserve company component source inputs
+        shell: bash
+        run: |
+          python -m unittest discover -s deployment/windows -p test_build_source.py
+          python -m unittest discover -s deployment/windows -p test_customer_msi.py
+          python -m pip install --disable-pip-version-check brotli==1.1.0
+          python -m unittest discover -s deployment/windows -p test_customer_exe.py
+          mkdir -p component-artifacts
+          python deployment/windows/archive-build-source.py . component-artifacts/CompanyComponents-source.zip --components-only
+      - name: Check customer EXE native output handling in Windows PowerShell
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_customer_exe_native_output.ps1 -PythonExe (Get-Command python -CommandType Application).Source
+          if ($LASTEXITCODE -ne 0) { throw 'Customer EXE native-output regression failed.' }
+      - name: Reject mismatched maintained Windows binaries and corresponding source
+        shell: bash
+        run: python -m unittest discover -s deployment/transport -p test_windows_components.py
+      - name: Verify real bounded SYSTEM setup UI task broker
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_setup_ui_broker.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Explicit setup UI SYSTEM broker checks failed.' }
+      - name: Test security and management
+        run: cargo +1.90.0 test --manifest-path product/Cargo.toml --workspace --locked
+      - name: Verify real HTTPS update streaming and interrupted download recovery
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          ./deployment/windows/test_update_download.ps1 -OutputDirectory "${{ runner.temp }}/swan-update-download-test"
+          Copy-Item -LiteralPath "${{ runner.temp }}/swan-update-download-test/verified.json" -Destination component-artifacts/update-download-https.json
+      - name: Restore an incompressible backup above the former 512 MiB limit
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          set -o pipefail
+          cargo +1.90.0 test --manifest-path product/Cargo.toml --locked -p swan-management backup::stream::tests::backup_above_previous_limit_preserves_incompressible_artifact -- --exact --ignored 2>&1 | tee component-artifacts/large-backup-tests.log
+          grep -F 'test result: ok. 1 passed; 0 failed;' component-artifacts/large-backup-tests.log
+      - name: Verify installation status escaping and sign-out isolation
+        run: node deployment/web/test-installation-status.js
+      - name: Verify first-run branding and policy form contracts
+        run: node deployment/web/test-company-setup.js
+      - name: Verify bounded pinned archive retries and integrity rejection
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_pinned_archive.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Pinned download retry and integrity checks failed.' }
+      - name: Build components
+        run: cargo +1.90.0 build --manifest-path product/Cargo.toml --workspace --release --locked
+      - name: Verify compiled standalone network checker trust and isolation
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_network_probe.ps1 -ManagementExecutable ./product/target/release/swan-management.exe -OutputDirectory "${{ runner.temp }}/swan-network-probe-test"
+          if ($LASTEXITCODE -ne 0) { throw 'Compiled network checker checks failed.' }
+          Copy-Item -LiteralPath "${{ runner.temp }}/swan-network-probe-test/verified.json" -Destination component-artifacts/network-probe-https.json
+      - name: Verify compiled worker private configuration and registry downgrade rejection
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+            powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_worker_configuration.ps1 -WorkerExecutable ./product/target/release/swan-worker.exe -ResultPath ./component-artifacts/worker-private-configuration.json
+      - name: Verify the real backup CLI above 512 MiB with bounded address space
+        if: runner.os == 'Linux'
+        run: python3 deployment/linux/test_backup_memory.py product/target/release/swan-management component-artifacts/large-backup-cli.json
+      - name: Verify compiled management creates fresh private server state
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_server_directory.ps1 -ManagementExe ./product/target/release/swan-management.exe
+          if ($LASTEXITCODE -ne 0) { throw 'Compiled server directory checks failed.' }
+      - name: Verify company server removal ownership and data preservation
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          ./deployment/windows/test_server_removal_plan.ps1
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_server_removal_plan.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Windows PowerShell removal-plan checks failed.' }
+      - name: Verify technician offline launcher and package rejection
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_technician_launcher.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Windows PowerShell technician launcher checks failed.' }
+      - name: Verify uninstall commit and rollback preservation
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_uninstall_commit.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Uninstall commit checks failed.' }
+      - name: Verify customer EXE uninstall completion
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_customer_exe_uninstall.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Customer EXE uninstall completion checks failed.' }
+      - name: Verify private customer state creation and unsafe-state rejection
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_customer_directory.ps1 -RequireAdministratorCases
+          if ($LASTEXITCODE -ne 0) { throw 'Customer state directory checks failed.' }
+      - name: Verify company setup entry point and trust rejection
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_company_setup_entrypoint.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Company setup entry-point checks failed.' }
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_msi_install_mode.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'MSI version preflight checks failed.' }
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_company_watch_recovery.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Company configuration watcher recovery checks failed.' }
+          powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ./deployment/windows/test_update_recovery_task.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Update recovery task ownership and lifecycle checks failed.' }
+      - name: Render the Windows setup wizard without installation
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          powershell.exe -NoProfile -NonInteractive -STA -ExecutionPolicy Bypass -File ./deployment/windows/Setup-Server.ps1 -RenderPreview "$env:RUNNER_TEMP/server-setup-preview.png"
+          if ($LASTEXITCODE -ne 0) { throw 'Server setup preview failed.' }
+      - name: Restore maintained Windows transport and corresponding source
+        if: runner.os == 'Windows'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: swan-transport-candidate-windows-2022
+          path: ${{ runner.temp }}/server-maintained-transport
+
+      - name: Verify unsigned server setup reproducibility with pinned compiler
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $pins = Get-Content deployment/windows/server-components.json -Raw | ConvertFrom-Json
+          $compiler = Get-Content deployment/windows/server-compiler.json -Raw | ConvertFrom-Json
+          $references = Get-Content deployment/windows/server-references.json -Raw | ConvertFrom-Json
+          $https = Join-Path $env:RUNNER_TEMP 'server-repro-https.zip'
+          $toolset = Join-Path $env:RUNNER_TEMP 'server-repro-roslyn.nupkg'
+          $framework = Join-Path $env:RUNNER_TEMP 'server-repro-framework.nupkg'
+          $powershell = Join-Path $env:RUNNER_TEMP 'server-repro-powershell.nupkg'
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $pins.https.url -Sha256 $pins.https.sha256 -Output $https | Out-Null
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $compiler.url -Sha256 $compiler.sha256 -Output $toolset | Out-Null
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $references.framework.url -Sha256 $references.framework.sha256 -Output $framework | Out-Null
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $references.powershell.url -Sha256 $references.powershell.sha256 -Output $powershell | Out-Null
+          $components = Join-Path $env:RUNNER_TEMP 'server-repro-components'
+          ./deployment/windows/Prepare-ServerComponents.ps1 -TransportDirectory (Join-Path $env:RUNNER_TEMP 'server-maintained-transport') -HttpsPackage $https -OutputDirectory $components
+          $evidence = Join-Path $env:RUNNER_TEMP 'server-repro-evidence'
+          ./deployment/windows/test_server_setup_reproducibility.ps1 -ManagementExecutable product/target/release/swan-management.exe -ComponentsDirectory $components -CompilerPackage $toolset -FrameworkReferencesPackage $framework -PowerShellReferencesPackage $powershell -WorkDirectory $evidence
+          Copy-Item -LiteralPath (Join-Path $evidence 'result.json') -Destination component-artifacts/server-setup-repro.json
+          Copy-Item -LiteralPath (Join-Path $evidence 'packaged-preview.png') -Destination component-artifacts/server-setup-packaged-preview.png
+
+      - name: Record unsigned component hashes and build provenance
+        shell: bash
+        run: |
+          python - <<'PY'
+          import hashlib, json, os, pathlib, shutil, subprocess
+          root = pathlib.Path('component-artifacts')
+          suffix = '.exe' if os.name == 'nt' else ''
+          hashes = {}
+          for name in ('swan-management', 'swan-agent', 'swan-worker'):
+              source = pathlib.Path('product/target/release') / (name + suffix)
+              destination = root / source.name
+              shutil.copyfile(source, destination)
+              hashes[destination.name] = hashlib.sha256(destination.read_bytes()).hexdigest()
+          hashes['CompanyComponents-source.zip'] = hashlib.sha256((root / 'CompanyComponents-source.zip').read_bytes()).hexdigest()
+          record = {'schema': 1, 'source': os.environ['GITHUB_SHA'], 'repository': os.environ['GITHUB_REPOSITORY'],
+                    'rustc': subprocess.check_output(['rustc', '+1.90.0', '-Vv'], text=True),
+                    'unsigned_test_inputs': True, 'production_approved': False, 'sha256': hashes}
+          (root / 'SOURCE.json').write_text(json.dumps(record, indent=2), encoding='utf-8')
+          PY
+      - name: Upload unsigned company component test inputs and corresponding source
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: CompanyComponents-${{ matrix.os }}-UNSIGNED-TEST
+          path: component-artifacts/
+          if-no-files-found: error
+  linux-deployment:
+    if: github.event_name != 'workflow_dispatch' || !inputs.technician_msi_only
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Verify bounded pinned image pulls without retrying unknown download state
+        run: python3 -m unittest discover -s deployment/linux -p test_pinned_images.py
+      - name: Verify private files cannot enter the Docker build context
+        run: python3 deployment/linux/test_build_context.py
+      - name: Build the company management image
+        run: docker build --file deployment/linux/Dockerfile --tag swan-management:test .
+      - name: Exercise fresh company setup and persistence in the deployment image
+        run: python3 deployment/linux/test_container_startup.py swan-management:test
+      - name: Rehearse pinned HTTPS and transport components with an isolated test CA
+        run: python3 deployment/linux/test_container_stack.py swan-management:test
+      - name: Build maintained transport from pinned public source with corresponding source
+        run: docker build --file deployment/transport/Dockerfile --tag swan-transport:maintained-test .
+      - name: Preserve maintained Linux transport binaries and exact patched source
+        run: python3 deployment/linux/export_transport_candidate.py transport-artifacts
+      - name: Rehearse maintained transport with HTTPS, enrollment and complete backup recovery
+        run: python3 deployment/linux/test_container_stack.py swan-management:test --maintained-transport
+      - name: Retain unsigned Linux transport candidate and source
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: MaintainedTransport-Linux-x64-UNSIGNED-TEST
+          path: transport-artifacts/
+          if-no-files-found: error
+  technician-msi-lifecycle:
+    if: github.event_name == 'workflow_dispatch' && inputs.technician_msi_only
+    runs-on: ${{ inputs.technician_msi_os || 'windows-2022' }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Verify the pinned completed unsigned build
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
+        with:
+          script: |
+            const run = await github.rest.actions.getWorkflowRun({owner: context.repo.owner, repo: context.repo.repo, run_id: 37110881152});
+            if (run.data.conclusion !== 'success' || run.data.head_sha !== 'c7d118c4b655d401c14fd95672ae2aff3b5ed679') {
+              throw new Error('Pinned native build provenance failed');
+            }
+      - name: Download the pinned unsigned build inputs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: SwanRemoteSupport-1.5.0-x64-unsigned
+          run-id: 37110881152
+          github-token: ${{ github.token }}
+          path: artifacts
+      - name: Verify payload hashes before MSI execution
+        shell: pwsh
+        run: |
+          $expected = @{}
+          foreach ($line in Get-Content artifacts/SHA256SUMS.txt) {
+            if ($line -match '^([a-f0-9]{64})\s+\*?(.+)$') {
+              if ($expected.ContainsKey($Matches[2])) { throw 'Duplicate artifact checksum.' }
+              $expected[$Matches[2]] = $Matches[1]
+            }
+          }
+          # This older build's checksum list covers installers only. Pin its
+          # agent hash from the independently verified GitHub artifact archive.
+          $expected['swan-agent.exe'] = 'c54da22a3d70f337d8a28ffb940549dbedfa303503a552b92d30b5a536d2ce26'
+          foreach ($name in @('SwanRemoteSupport-1.5.0-technician-x64-unsigned.msi','SwanRemoteSupport-1.5.0-technician-x64-unsigned.exe','swan-agent.exe')) {
+            if (-not $expected.ContainsKey($name) -or (Get-FileHash -LiteralPath (Join-Path artifacts $name) -Algorithm SHA256).Hash.ToLowerInvariant() -ne $expected[$name]) { throw 'Pinned MSI payload checksum failed.' }
+          }
+      - name: Test unsigned MSI install repair and uninstall
+        shell: pwsh
+        run: ./deployment/windows/test_technician_msi_lifecycle.ps1 -Package artifacts/SwanRemoteSupport-1.5.0-technician-x64-unsigned.msi -TechnicianExecutable artifacts/SwanRemoteSupport-1.5.0-technician-x64-unsigned.exe -AgentExecutable artifacts/swan-agent.exe
+      - name: Preserve MSI lifecycle evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: technician-msi-lifecycle-${{ inputs.technician_msi_os || 'windows-2022' }}
+          if-no-files-found: ignore
+          path: ${{ runner.temp }}/swan-msi-lifecycle-*/**
diff --git a/.github/workflows/compare-native-builds.yml b/.github/workflows/compare-native-builds.yml
new file mode 100644
index 00000000000..dfd4803e673
--- /dev/null
+++ b/.github/workflows/compare-native-builds.yml
@@ -0,0 +1,97 @@
+name: Compare independent native build artifacts
+
+on:
+  push:
+    paths:
+      - .github/workflows/compare-native-builds.yml
+      - deployment/windows/compare-native-builds.py
+      - deployment/windows/test_native_build_comparison.py
+  pull_request:
+    paths:
+      - .github/workflows/compare-native-builds.yml
+      - deployment/windows/compare-native-builds.py
+      - deployment/windows/test_native_build_comparison.py
+  workflow_dispatch:
+    inputs:
+      first_run:
+        description: First successful native workflow run ID
+        required: true
+        type: string
+      second_run:
+        description: Independent successful native workflow run ID
+        required: true
+        type: string
+      source:
+        description: Exact public 40-character source commit shared by both runs
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  tests:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Verify comparison trust boundaries
+        run: python3 -m unittest discover -s deployment/windows -p test_native_build_comparison.py
+
+  compare:
+    if: github.event_name == 'workflow_dispatch'
+    needs: tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out comparison tools
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Validate independent build identities
+        env:
+          FIRST_RUN: ${{ inputs.first_run }}
+          SECOND_RUN: ${{ inputs.second_run }}
+          SOURCE_COMMIT: ${{ inputs.source }}
+        run: |
+          python3 - <<'PY'
+          import os, re
+          first, second = os.environ['FIRST_RUN'], os.environ['SECOND_RUN']
+          if not all(re.fullmatch(r'[1-9][0-9]*', n) for n in (first, second)) or first == second:
+              raise SystemExit('Two different positive native run IDs are required')
+          if not re.fullmatch(r'[0-9a-f]{40}', os.environ['SOURCE_COMMIT']):
+              raise SystemExit('An exact public source commit is required')
+          PY
+
+      - name: Check out exact public source and pinned submodules
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ inputs.source }}
+          path: source-proof
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Verify original archives and compare every shipping output
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          FIRST_RUN: ${{ inputs.first_run }}
+          SECOND_RUN: ${{ inputs.second_run }}
+          SOURCE_COMMIT: ${{ inputs.source }}
+        run: |
+          python3 deployment/windows/compare-native-builds.py \
+            --first-run "$FIRST_RUN" --second-run "$SECOND_RUN" \
+            --source "$SOURCE_COMMIT" --checkout source-proof \
+            --work comparison-inputs --output evidence/native-build-comparison.json
+
+      - name: Preserve comparison report even when original binaries differ
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-comparison-${{ inputs.first_run }}-${{ inputs.second_run }}
+          path: evidence/native-build-comparison.json
+          if-no-files-found: warn
+          retention-days: 90
diff --git a/.github/workflows/flutter-build.yml b/.github/workflows/flutter-build.yml
index 2491789e6a4..898ab07ff0e 100644
--- a/.github/workflows/flutter-build.yml
+++ b/.github/workflows/flutter-build.yml
@@ -19,8 +19,8 @@ on:
 
 env:
   SCITER_RUST_VERSION: "1.75" # https://github.com/rustdesk/rustdesk/discussions/7503, also 1.78 has ABI change which causes our sciter version not working, https://blog.rust-lang.org/2024/03/30/i128-layout-update.html
-  RUST_VERSION: "1.75" # sciter failed on m1 with 1.78 because of https://blog.rust-lang.org/2024/03/30/i128-layout-update.html
-  MAC_RUST_VERSION: "1.81" # 1.81 is requred for macos, because of https://github.com/yury/cidre requires 1.81
+  RUST_VERSION: "1.90.0" # Matches the managed product's pinned minimum toolchain.
+  MAC_RUST_VERSION: "1.90.0"
   CARGO_NDK_VERSION: "3.1.2"
   SCITER_ARMV7_CMAKE_VERSION: "3.29.7"
   SCITER_NASM_DEBVERSION: "2.15.05-1"
@@ -209,7 +209,7 @@ jobs:
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
-          toolchain: ${{ env.SCITER_RUST_VERSION }}
+          toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.job.target }}
           components: "rustfmt"
 
@@ -415,7 +415,8 @@ jobs:
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
-          toolchain: nightly-2023-10-13-${{ matrix.job.target }} # must use nightly here, because of abi_thiscall feature required
+          # Run the host compiler and cross-compile for the matrix target below.
+          toolchain: nightly-2023-10-13 # abi_thiscall requires nightly
           targets: ${{ matrix.job.target }}
           components: "rustfmt"
 
diff --git a/.github/workflows/flutter-ci.yml b/.github/workflows/flutter-ci.yml
index a64dd11972a..d37bae20c1e 100644
--- a/.github/workflows/flutter-ci.yml
+++ b/.github/workflows/flutter-ci.yml
@@ -17,6 +17,10 @@ on:
       - "appimage/**"
       - "flatpak/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}
+
 jobs:
   run-ci:
     uses: ./.github/workflows/flutter-build.yml
diff --git a/.github/workflows/msvc-determinism.yml b/.github/workflows/msvc-determinism.yml
new file mode 100644
index 00000000000..69192df200a
--- /dev/null
+++ b/.github/workflows/msvc-determinism.yml
@@ -0,0 +1,38 @@
+name: Diagnose MSVC callback reproducibility
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/msvc-determinism.yml
+      - deployment/windows/test_msvc_determinism.ps1
+      - deployment/windows/patch-flutter-client-wrapper.py
+      - deployment/windows/test_flutter_client_wrapper.py
+      - deployment/windows/emit-flutter-reply-fixture.py
+      - deployment/windows/fixtures/flutter_reply_handler.cpp.in
+permissions:
+  contents: read
+jobs:
+  fixture:
+    runs-on: windows-2022
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+      - name: Compare actual callback and RTTI bytes across build directories
+        shell: pwsh
+        run: |
+          python3 -m unittest discover -s deployment/windows -p test_flutter_client_wrapper.py
+          if ($LASTEXITCODE) { throw 'Client-wrapper source trust regressions failed.' }
+          ./deployment/windows/test_msvc_determinism.ps1 -WorkDirectory (Join-Path $env:RUNNER_TEMP 'swan-msvc-repro-fixture')
+      - name: Retain original fixture outputs and diagnostics
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: msvc-callback-reproducibility-UNSIGNED-TEST
+          path: |
+            ${{ runner.temp }}/swan-msvc-repro-fixture/report.json
+            ${{ runner.temp }}/swan-msvc-repro-fixture/*.log
+            ${{ runner.temp }}/swan-msvc-repro-fixture/*.arguments.json
+            ${{ runner.temp }}/swan-msvc-repro-fixture/*.exe
+          if-no-files-found: warn
diff --git a/.github/workflows/portable-install-wait.yml b/.github/workflows/portable-install-wait.yml
new file mode 100644
index 00000000000..65a0a17094c
--- /dev/null
+++ b/.github/workflows/portable-install-wait.yml
@@ -0,0 +1,41 @@
+name: Portable installer wait regression
+on:
+  push:
+    paths: ['libs/portable/src/install_wait.rs', 'libs/portable/src/runtime_cache.rs', '.github/workflows/portable-install-wait.yml']
+  pull_request:
+    paths: ['libs/portable/src/install_wait.rs', 'libs/portable/src/runtime_cache.rs', '.github/workflows/portable-install-wait.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  verify:
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, windows-2022]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Install pinned Rust
+        run: rustup toolchain install 1.90.0 --profile minimal
+      - name: Test actual child exit and wait in standalone and embedded module contexts
+        shell: bash
+        run: |
+          python - <<'PY'
+          import json, os, pathlib, subprocess
+          source = pathlib.Path('libs/portable/src/install_wait.rs').resolve()
+          work = pathlib.Path(os.environ['RUNNER_TEMP']) / 'portable-install-wait'
+          work.mkdir()
+          wrapper = work / 'embedded.rs'
+          wrapper.write_text('#[path = ' + json.dumps(source.as_posix()) + ']\nmod install_wait;\n', encoding='utf-8')
+          for context, input_file, prefix in [('standalone', source, 'tests::'), ('embedded', wrapper, 'install_wait::tests::')]:
+              executable = work / (context + '.exe')
+              subprocess.run(['rustc', '+1.90.0', '--edition', '2021', '--test', str(input_file), '-o', str(executable)], check=True)
+              names = subprocess.check_output([str(executable), '--list'], text=True)
+              assert prefix + 'child_fixture: test' in names
+              subprocess.run([str(executable)], check=True)
+          PY
+      - name: Test payload cache isolation while the previous runtime file is held open
+        shell: bash
+        run: |
+          rustc +1.90.0 --edition 2021 --test libs/portable/src/runtime_cache.rs -o portable-cache-tests.exe
+          ./portable-cache-tests.exe
diff --git a/.github/workflows/swan-flutter-engine.yml b/.github/workflows/swan-flutter-engine.yml
new file mode 100644
index 00000000000..f59f4ce9e89
--- /dev/null
+++ b/.github/workflows/swan-flutter-engine.yml
@@ -0,0 +1,55 @@
+name: Rebuild patched Windows Flutter engine from pinned source
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/swan-flutter-engine.yml
+      - deployment/windows/Build-FlutterEngine.ps1
+      - deployment/windows/flutter-engine-source.py
+      - deployment/windows/flutter-engine-windows.patch
+      - deployment/windows/flutter-engine.lock.json
+      - deployment/windows/flutter-engine-buildroot.patch
+      - deployment/windows/Install-FlutterEngineToolchain.ps1
+      - deployment/windows/test_flutter_engine_source.py
+permissions:
+  contents: read
+concurrency:
+  group: swan-engine-source-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  source-engine:
+    runs-on: windows-2022
+    timeout-minutes: 180
+    steps:
+      - name: Keep reviewed engine recipe bytes unchanged
+        shell: pwsh
+        run: git config --global core.autocrlf false
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Test source and toolchain provenance guards
+        shell: pwsh
+        run: python -m unittest discover -s deployment/windows -p test_flutter_engine_source.py
+      - name: Install the compatible pinned Microsoft C++ toolset
+        shell: pwsh
+        run: ./deployment/windows/Install-FlutterEngineToolchain.ps1
+      - name: Build source reconstruction candidate
+        shell: pwsh
+        run: ./deployment/windows/Build-FlutterEngine.ps1 -BuildRoot C:\SwanEngineSourceBuild
+      - name: Publish candidate and exact source evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: swan-flutter-engine-source-built-${{ github.sha }}
+          path: C:\SwanEngineSourceBuild\artifacts\*
+          if-no-files-found: error
+      - name: Preserve build diagnostics on failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: swan-flutter-engine-diagnostics-${{ github.sha }}
+          path: |
+            C:\SwanEngineSourceBuild\toolchain.json
+            C:\SwanEngineSourceBuild\dependency-revisions.txt
+            C:\SwanEngineSourceBuild\ninja-commands.txt
+            C:\SwanEngineSourceBuild\link-response.txt
+          if-no-files-found: warn
diff --git a/.github/workflows/swan-transport.yml b/.github/workflows/swan-transport.yml
new file mode 100644
index 00000000000..e072bf02442
--- /dev/null
+++ b/.github/workflows/swan-transport.yml
@@ -0,0 +1,75 @@
+name: Verify and build candidate Swan transport
+on:
+  workflow_call:
+    inputs:
+      windows_only:
+        type: boolean
+        default: false
+  workflow_dispatch:
+  pull_request:
+    paths: ['deployment/transport/**', '.github/workflows/swan-transport.yml']
+permissions:
+  contents: read
+concurrency:
+  group: swan-transport-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: false
+jobs:
+  transport:
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.windows_only && '["windows-2022"]' || '["windows-2022","ubuntu-24.04"]') }}
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Checkout pinned public transport source and submodule
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: rustdesk/rustdesk-server
+          ref: 9bae9f2f39d92c4b4ba2e28e089da5071897b22e
+          submodules: recursive
+          path: transport-source
+          persist-credentials: false
+      - name: Install pinned Rust
+        run: rustup toolchain install 1.90.0 --profile minimal
+      - name: Install Linux build dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libssl-dev libsodium-dev
+      - name: Add regression to clean pinned source
+        run: python deployment/transport/prepare_source.py transport-source tests
+      - name: Reproduce Windows failure and verify IPv4 and IPv6 controls
+        run: python deployment/transport/check_baseline.py transport-source
+      - name: Apply reviewed destination normalization
+        run: python deployment/transport/prepare_source.py transport-source fix
+      - name: Verify actual shared UDP message and raw send paths
+        run: python deployment/transport/check_baseline.py transport-source fixed
+      - name: Preserve exact public build inputs
+        run: python deployment/transport/archive_source.py transport-source transport-artifacts/transport-build-source.zip
+      - name: Build candidate rendezvous and relay executables
+        working-directory: transport-source
+        run: cargo +1.90.0 build --release --locked --bin hbbs --bin hbbr
+      - name: Retain regression evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: transport-regression-${{ matrix.os }}
+          path: transport-source/swan-evidence/**
+          if-no-files-found: ignore
+      - name: Retain unsigned candidate and source
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: swan-transport-candidate-${{ matrix.os }}
+          path: |
+            transport-source/target/release/hbbs
+            transport-source/target/release/hbbs.exe
+            transport-source/target/release/hbbr
+            transport-source/target/release/hbbr.exe
+            transport-source/SWAN-SOURCE.json
+            transport-artifacts/transport-build-source.zip
+          if-no-files-found: error
diff --git a/.github/workflows/swan-windows-build.yml b/.github/workflows/swan-windows-build.yml
index 2a2af7ebdcb..dccf7068c75 100644
--- a/.github/workflows/swan-windows-build.yml
+++ b/.github/workflows/swan-windows-build.yml
@@ -2,21 +2,39 @@ name: Build Swan Remote Support for Windows x64
 
 on:
   workflow_dispatch:
+    inputs:
+      engine:
+        description: Experimental source engine requires a new matching app bundle and lab qualification
+        type: choice
+        default: reviewed-upstream
+        options:
+          - reviewed-upstream
+          - source-candidate-9f97ef0
+          - source-candidate-05d5369
 
 permissions:
   contents: read
+  actions: read
 
 env:
-  RUST_VERSION: "1.75"
+  RUST_VERSION: "1.90.0"
   LLVM_VERSION: "15.0.6"
   FLUTTER_VERSION: "3.24.5"
+  FLUTTER_ENGINE_SHA256: "ec8cabf36ee4ff24c8d98de25b00e70781eb03876265aee84d0fe554a110036e"
   VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
-  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-  VERSION: "1.4.9"
+  VCPKG_BINARY_SOURCES: "clear"
+  VERSION: "1.5.23"
 
 jobs:
+  maintained-transport:
+    uses: ./.github/workflows/swan-transport.yml
+    with:
+      windows_only: true
+
   generate-bridge:
     uses: ./.github/workflows/bridge.yml
+    with:
+      include_windows_arm64: false
 
   build-topmost-window:
     uses: ./.github/workflows/third-party-RustDeskTempTopMostWindow.yml
@@ -29,16 +47,10 @@ jobs:
 
   build-windows-x64:
     name: Swan Remote Support x64
-    needs: [generate-bridge, build-topmost-window]
+    needs: [generate-bridge, build-topmost-window, maintained-transport]
     runs-on: windows-2022
     env:
       SWAN_BUILD: "1"
-      # Public Tailscale routing/trust defaults. Never put a private server key,
-      # unattended password, token, or signing credential in this section.
-      RENDEZVOUS_SERVER: "100.82.236.84"
-      RELAY_SERVER: "100.82.236.84"
-      RS_PUB_KEY: "I0s1JvqJ19WDNKBLFY+FC5HekcOqNWPpH+6xGmKUQLI="
-      API_SERVER: ""
     steps:
       - name: Export GitHub Actions cache environment variables
         uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
@@ -52,34 +64,27 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Validate public server configuration
+      - name: Verify application and installer versions agree
+        env:
+          SWAN_ENGINE_SELECTION: ${{ inputs.engine }}
         shell: pwsh
         run: |
-          if ([string]::IsNullOrWhiteSpace($env:RENDEZVOUS_SERVER)) {
-            throw "Set the RENDEZVOUS_SERVER repository Actions variable to the public hbbs hostname."
-          }
-          if ($env:RENDEZVOUS_SERVER -match "^https?://") {
-            throw "RENDEZVOUS_SERVER must be a hostname or host:port, without http:// or https://."
-          }
-          if ([string]::IsNullOrWhiteSpace($env:RS_PUB_KEY)) {
-            throw "Set the RS_PUB_KEY repository Actions variable to the contents of id_ed25519.pub."
-          }
-          try {
-            $decodedKey = [Convert]::FromBase64String($env:RS_PUB_KEY)
-          } catch {
-            throw "RS_PUB_KEY is not valid Base64: $($_.Exception.Message)"
-          }
-          if ($decodedKey.Length -ne 32) {
-            throw "RS_PUB_KEY must decode to a 32-byte Ed25519 public key; received $($decodedKey.Length) bytes."
+          if ($env:SWAN_ENGINE_SELECTION -cnotin @('reviewed-upstream','source-candidate-9f97ef0','source-candidate-05d5369')) {
+            throw 'Unknown engine selection; use an explicitly pinned candidate.'
           }
-          if (-not [string]::IsNullOrWhiteSpace($env:API_SERVER)) {
-            $apiUri = $null
-            if (-not [Uri]::TryCreate($env:API_SERVER, [UriKind]::Absolute, [ref]$apiUri) -or
-                $apiUri.Scheme -ne "https") {
-              throw "API_SERVER must be an absolute HTTPS URL when supplied."
-            }
+          $sourceVersion = [regex]::Match((Get-Content Cargo.toml -Raw), '(?m)^version = "([0-9]+\.[0-9]+\.[0-9]+)"').Groups[1].Value
+          $packerVersion = [regex]::Match((Get-Content libs/portable/Cargo.toml -Raw), '(?m)^version = "([0-9]+\.[0-9]+\.[0-9]+)"').Groups[1].Value
+          $flutterVersion = [regex]::Match((Get-Content flutter/pubspec.yaml -Raw), '(?m)^version: ([0-9]+\.[0-9]+\.[0-9]+)\+[0-9]+').Groups[1].Value
+          if (-not $sourceVersion -or $sourceVersion -cne $env:VERSION -or $packerVersion -cne $sourceVersion -or $flutterVersion -cne $sourceVersion) {
+            throw 'Application, portable packer, Flutter and installer artifact versions must agree.'
           }
-          Write-Output "Public Swan server configuration passed structural validation."
+
+      - name: Set reproducible UTC application build date from public source
+        shell: pwsh
+        run: |
+          $epoch = (git show -s --format=%ct HEAD).Trim()
+          if ($LASTEXITCODE -ne 0 -or $epoch -cnotmatch '^[0-9]+$') { throw 'Source commit timestamp is unavailable.' }
+          Add-Content -LiteralPath $env:GITHUB_ENV -Value ('SOURCE_DATE_EPOCH='+$epoch)
 
       - name: Restore Flutter bridge files
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -92,21 +97,56 @@ jobs:
         with:
           version: "${{ env.LLVM_VERSION }}"
 
-      - name: Install Flutter
-        uses: subosito/flutter-action@2783a3f08e1baf891508463f8c6653c258246225 # v2.12.0
-        with:
-          channel: stable
-          flutter-version: "${{ env.FLUTTER_VERSION }}"
-          architecture: x64
+      - name: Install hash-pinned Flutter SDK
+        shell: pwsh
+        run: |
+          python -m unittest discover -s deployment/windows -p test_pinned_flutter_sdk.py
+          if ($LASTEXITCODE -ne 0) { throw 'Pinned SDK rejection tests failed.' }
+          ./deployment/windows/install-pinned-flutter.ps1 -Destination (Join-Path $env:RUNNER_TEMP 'swan-flutter-sdk') -ExpectedVersion $env:FLUTTER_VERSION
+          New-Item -ItemType Directory -Path artifacts -Force | Out-Null
+          Copy-Item -LiteralPath (Join-Path $env:RUNNER_TEMP 'swan-flutter-sdk/sdk-identity.json') -Destination artifacts/flutter-sdk-identity.json
 
       - name: Replace Flutter engine with RustDesk Windows engine
+        if: inputs.engine == 'reviewed-upstream'
         shell: pwsh
         run: |
           flutter doctor -v
           flutter precache --windows
           Invoke-WebRequest -Uri https://github.com/rustdesk/engine/releases/download/main/windows-x64-release.zip -OutFile windows-x64-release.zip
+          if ((Get-FileHash windows-x64-release.zip -Algorithm SHA256).Hash -ne $env:FLUTTER_ENGINE_SHA256) {
+            throw 'Pinned Flutter engine hash mismatch. Review the upstream artifact before changing this pin.'
+          }
           Expand-Archive -Path windows-x64-release.zip -DestinationPath windows-x64-release
-          Move-Item -Path windows-x64-release\* -Destination C:\hostedtoolcache\windows\flutter\stable-${{ env.FLUTTER_VERSION }}-x64\bin\cache\artifacts\engine\windows-x64-release\ -Force
+          Move-Item -Path windows-x64-release\* -Destination (Join-Path $env:FLUTTER_ROOT 'bin/cache/artifacts/engine/windows-x64-release') -Force
+
+      - name: Download the exact experimental source-engine build
+        if: inputs.engine == 'source-candidate-9f97ef0'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: swan-flutter-engine-source-built-9f97ef0053d822bcf5cf3f5f03bf5dc571247d16
+          run-id: 39716739857
+          github-token: ${{ github.token }}
+          path: ./artifacts/engine-source
+
+      - name: Download the independently reproduced experimental source engine
+        if: inputs.engine == 'source-candidate-05d5369'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: swan-flutter-engine-source-built-05d5369c04804b9a9b2dc06df0cb85b0efe6f274
+          run-id: 39753153773
+          github-token: ${{ github.token }}
+          path: ./artifacts/engine-source
+
+      - name: Select experimental engine with the matching SDK snapshot compiler
+        if: inputs.engine == 'source-candidate-9f97ef0' || inputs.engine == 'source-candidate-05d5369'
+        env:
+          SWAN_ENGINE_CANDIDATE: ${{ inputs.engine }}
+        shell: pwsh
+        run: |
+          flutter doctor -v
+          flutter precache --windows
+          python -m unittest discover -s deployment/windows -p test_engine_candidate.py
+          python deployment/windows/select-engine-candidate.py --candidate artifacts/engine-source --sdk "$env:FLUTTER_ROOT" --receipt artifacts/engine-selection.json --source-candidate "$env:SWAN_ENGINE_CANDIDATE"
 
       - name: Patch Flutter 3.24 dropdown support
         shell: bash
@@ -115,6 +155,15 @@ jobs:
           cd "$(dirname "$(dirname "$(which flutter)")")"
           git apply flutter_3.24.4_dropdown_menu_enableFilter.diff
 
+      - name: Pin the named Flutter client-wrapper reply callable
+        shell: pwsh
+        run: |
+          python3 -m unittest discover -s deployment/windows -p test_flutter_client_wrapper.py
+          if ($LASTEXITCODE -ne 0) { throw 'Flutter reply-wrapper source trust regressions failed.' }
+          New-Item -ItemType Directory -Path artifacts -Force | Out-Null
+          python3 deployment/windows/patch-flutter-client-wrapper.py --sdk "$env:FLUTTER_ROOT" --receipt artifacts/flutter-client-wrapper-repro.json
+          if ($LASTEXITCODE -ne 0) { throw 'Reviewed Flutter reply-wrapper source patch failed.' }
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
@@ -122,17 +171,19 @@ jobs:
           targets: x86_64-pc-windows-msvc
           components: rustfmt
 
-      - name: Cache Rust build
-        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-        with:
-          prefix-key: windows-2022-swan-x64
-
       - name: Set up pinned vcpkg
         uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
         with:
           vcpkgDirectory: C:\vcpkg
           vcpkgGitCommitId: "${{ env.VCPKG_COMMIT_ID }}"
-          doNotCache: false
+          doNotCache: true
+
+      - name: Require fresh endpoint and native-library outputs
+        shell: pwsh
+        run: |
+          if ((Test-Path target) -or (Test-Path (Join-Path $env:VCPKG_ROOT 'installed/x64-windows-static/lib/aom.lib'))) {
+            throw 'Release verification requires a fresh runner without restored compiled endpoint or AV1 outputs.'
+          }
 
       - name: Install native dependencies
         env:
@@ -146,18 +197,171 @@ jobs:
             exit 1
           fi
 
+      - name: Preserve exact public build inputs including generated bridge source
+        shell: pwsh
+        run: |
+          python3 -m unittest discover -s deployment/windows -p test_build_source.py
+          if ($LASTEXITCODE -ne 0) { throw 'Corresponding source archive checks failed.' }
+          New-Item -ItemType Directory -Path artifacts -Force | Out-Null
+          python3 deployment/windows/archive-build-source.py . artifacts/SwanRemoteSupport-build-source.zip
+          if ($LASTEXITCODE -ne 0) { throw 'Exact build input archive failed.' }
+
+      - name: Retain actual AV1 object and static-library inputs before linking
+        shell: pwsh
+        run: |
+          ./deployment/windows/Capture-NativeAomInputs.ps1 -OutputDirectory artifacts/native-aom-inputs
+
+      - name: Record exact default MSVC compiler library and header inputs
+        shell: pwsh
+        run: |
+          ./deployment/windows/Record-MsvcToolchain.ps1 -Output artifacts/native-msvc-toolchain.json
+
       - name: Build branded client
         shell: pwsh
         run: |
           python3 .\build.py --portable --flutter --skip-portable-pack --hwcodec --vram
+          if ($LASTEXITCODE -ne 0) { throw 'Native or Flutter application build failed.' }
+          $capture = Get-Content artifacts/native-aom-inputs/capture.json -Raw | ConvertFrom-Json
+          $installedLibraryHash = (Get-FileHash -LiteralPath $capture.installed_library_path).Hash.ToLowerInvariant()
+          if ($installedLibraryHash -cne $capture.files.'aom.lib'.sha256) { throw 'AV1 library changed during endpoint compilation.' }
+          $rustLibrary = Get-FileHash target/release/librustdesk.dll
+          $bundleLibrary = Get-FileHash flutter/build/windows/x64/runner/Release/librustdesk.dll
+          if ($rustLibrary.Hash -cne $bundleLibrary.Hash) { throw 'Bundled native DLL differs from the original compiled Rust DLL.' }
+          @{compiled_native_dll_sha256=$rustLibrary.Hash.ToLowerInvariant();bundled_native_dll_sha256=$bundleLibrary.Hash.ToLowerInvariant();static_library_unchanged=$true;shipping_bytes_rewritten=$false} | ConvertTo-Json | Set-Content artifacts/native-aom-inputs/endpoint-link-provenance.json -Encoding UTF8
           Move-Item .\flutter\build\windows\x64\runner\Release .\swan-client
 
-      - name: Add signed topmost-window helper
+      - name: Preserve native input diagnosis when endpoint compilation fails
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: native-aom-inputs-failed-native-build
+          path: artifacts/native-aom-inputs/**
+          if-no-files-found: warn
+
+      - name: Keep pending customer approvals visible during reconnects
+        shell: pwsh
+        working-directory: flutter
+        run: |
+          flutter test --reporter expanded test/approval_window_auto_hide_test.dart test/company_window_title_test.dart 2>&1 | Tee-Object -FilePath ../artifacts/native-customer-approval-window-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Customer approval-window regression failed.' }
+          if ((Get-Content ../artifacts/native-customer-approval-window-tests.log -Raw) -notmatch 'All tests passed!') { throw 'Expected customer approval tests did not complete.' }
+
+      - name: Verify signed display branding preserves internal identity
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" managed::branding_tests::signed_display_names_do_not_change_identity_or_authorize_expired_policy -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-branding-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Signed company display branding regression failed.' }
+          if ((Get-Content artifacts/native-managed-branding-tests.log -Raw) -notmatch '1 passed; 0 failed') { throw 'Expected signed company branding test did not execute.' }
+
+      - name: Reject unsigned legacy management policy in managed editions
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" hbbs_http::sync::managed_sync_tests::managed_sync_rejects_legacy_endpoint_and_unsigned_options -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-sync-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed legacy-sync regression failed.' }
+          if ((Get-Content artifacts/native-managed-sync-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed legacy-sync test did not run.' }
+
+      - name: Reject upstream updater entry points in managed editions
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" updater::managed_update_tests::managed_edition_rejects_every_legacy_update_entry_point -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-updater-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed updater isolation regression failed.' }
+          if ((Get-Content artifacts/native-managed-updater-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed updater isolation test did not run.' }
+
+      - name: Reject incoming capture helpers in the technician edition
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" server::portable_service::client::edition_tests::outgoing_only_refuses_capture_helper_before_runtime_initialization -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-technician-helper-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Technician incoming-helper isolation regression failed.' }
+          if ((Get-Content artifacts/native-technician-helper-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected technician helper test did not run.' }
+
+      - name: Reject indefinitely blocked file-transfer writes
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" client::io_loop::transfer_write_tests:: -- --nocapture 2>&1 | Tee-Object -FilePath artifacts/native-transfer-write-timeout-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'File-transfer write timeout regression failed.' }
+          if ((Get-Content artifacts/native-transfer-write-timeout-tests.log -Raw) -notmatch 'test result: ok\. 3 passed; 0 failed;') { throw 'Expected all three transfer write tests to run.' }
+
+      - name: Verify hardened DLL search supports delayed application libraries
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" platform::windows::dll_search_tests::hardened_search_loads_application_dlls_but_rejects_cwd_and_path -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-dll-search-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Hardened application DLL search regression failed.' }
+          if ((Get-Content artifacts/native-dll-search-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected real Windows DLL-search test did not run.' }
+
+      - name: Verify desktop launcher and plugin reproducibility metadata
+        shell: pwsh
+        run: |
+          python3 -m unittest discover -s deployment/windows -p test_reproducible_pe.py
+          if ($LASTEXITCODE -ne 0) { throw 'PE metadata verifier tests failed.' }
+          $targets = @((Get-Item swan-client/rustdesk.exe)) + @(Get-ChildItem swan-client -Filter '*_plugin.dll' -File)
+          if ($targets.Count -lt 2) { throw 'Expected the desktop launcher and native Flutter plugins.' }
+          $records = @()
+          foreach ($target in $targets) {
+            $record = python3 deployment/windows/verify-reproducible-pe.py $target.FullName
+            if ($LASTEXITCODE -ne 0) { throw ('Native desktop link metadata is not reproducible: '+$target.Name) }
+            $records += @{name=$target.Name;metadata=($record | ConvertFrom-Json)}
+          }
+          $records | ConvertTo-Json -Depth 5 | Set-Content artifacts/native-desktop-pe-metadata.json
+
+      - name: Verify service launcher defers desktop DLL loading
+        shell: pwsh
+        run: |
+          python3 -m unittest discover -s deployment/windows -p test_service_imports.py
+          if ($LASTEXITCODE -ne 0) { throw 'Service import verifier tests failed.' }
+          $record = python3 deployment/windows/verify-service-imports.py swan-client/rustdesk.exe --bundle swan-client
+          if ($LASTEXITCODE -ne 0) { throw 'Service launcher eagerly loads desktop DLLs.' }
+          $record | Set-Content artifacts/native-service-imports.json
+
+      - name: Verify deterministic managed application build metadata
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" build_metadata::tests:: 2>&1 | Tee-Object -FilePath artifacts/native-build-metadata-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed build metadata regressions failed.' }
+          if ((Get-Content artifacts/native-build-metadata-tests.log -Raw) -notmatch 'test result: ok\. 3 passed; 0 failed;') { throw 'Expected managed build metadata tests did not run.' }
+
+      - name: Reject system-control packets from view-only managed sessions
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" server::connection::test::managed_view_only_packets_cannot_change_system_control -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-control-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed view-only control regression failed.' }
+          if ((Get-Content artifacts/native-managed-control-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed control test did not run.' }
+
+      - name: Reject paused support and authorization reuse after resume
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" managed::pause_tests::pause_denies_claims_and_resume_cannot_revive_old_authorization -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-pause-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed support pause regression failed.' }
+          if ((Get-Content artifacts/native-managed-pause-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed support pause test did not run.' }
+
+      - name: Reject authorization retries and inherited audit destinations
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" client::managed_retry_tests::authorization_closure_never_retries_but_network_fallback_remains -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-retry-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed authorization retry regression failed.' }
+          if ((Get-Content artifacts/native-managed-retry-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed authorization retry test did not run.' }
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" common::tests::managed_edition_never_derives_legacy_audit_targets -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-audit-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed legacy audit regression failed.' }
+          if ((Get-Content artifacts/native-managed-audit-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed legacy audit test did not run.' }
+
+      - name: Reject cross-target and stale-login file-transfer handles
+        shell: pwsh
+        run: |
+          cargo test --release --lib --features "flutter,swan_custom,hwcodec,vram" managed::subsession_tests::file_transfer_handle_is_bound_to_target_company_and_current_login -- --exact 2>&1 | Tee-Object -FilePath artifacts/native-managed-subsession-tests.log
+          if ($LASTEXITCODE -ne 0) { throw 'Managed file-transfer handle regression failed.' }
+          if ((Get-Content artifacts/native-managed-subsession-tests.log -Raw) -notmatch 'test result: ok\. 1 passed; 0 failed;') { throw 'Expected managed file-transfer handle test did not run.' }
+
+      - name: Add pinned topmost-window helper
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: topmostwindow-artifacts-x64
           path: ./swan-client
 
+      - name: Retain helper corresponding source and exact build metadata
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: topmostwindow-source-x64
+          path: ./artifacts/topmost-source
+
       - name: Build self-extracting installer
         shell: bash
         run: |
@@ -170,29 +374,189 @@ jobs:
           sed -i '/dpiAware/d' res/manifest.xml
           pushd ./libs/portable
           pip3 install -r requirements.txt
+          python3 -m unittest discover -s . -p test_generate.py
+          rustc --edition 2021 --test resource_order.rs -o resource-order-tests.exe
+          ./resource-order-tests.exe
           python3 ./generate.py -f ../../swan-client/ -o . -e ../../swan-client/rustdesk.exe
+          cargo test --locked --release
           popd
           mkdir -p ./artifacts
           # The portable packer opens RustDesk's one-page installer when the
           # filename ends in "install.exe".
           mv ./target/release/rustdesk-portable-packer.exe ./artifacts/SwanRemoteSupport-${{ env.VERSION }}-x64-unsigned-install.exe
+          # Both editions use unchanged project binaries. A pinned technician
+          # bootstrap selects its authenticated outgoing-only interface. The
+          # technician filename launches the portable app instead of customer setup.
+          cp ./artifacts/SwanRemoteSupport-${{ env.VERSION }}-x64-unsigned-install.exe ./artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.exe
           pushd ./artifacts
           sha256sum SwanRemoteSupport-*.exe | tee SHA256SUMS.txt
           popd
 
-      - name: Add express installation helpers
+      - name: Generate unsigned installed payload manifests
+        shell: pwsh
+        run: |
+          python3 -m unittest discover -s deployment/windows -p test_payload_manifest.py
+          python3 -m unittest discover -s deployment/windows -p test_customer_msi.py
+          python3 -m unittest discover -s deployment/windows -p test_customer_exe.py
+          & "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_customer_exe_native_output.ps1 -PythonExe (Get-Command python3 -CommandType Application).Source
+          if ($LASTEXITCODE -ne 0) { throw 'Customer EXE native-output regression failed.' }
+          & "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_company_setup_entrypoint.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Company setup entry-point checks failed.' }
+          & "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_msi_install_mode.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'MSI version preflight checks failed.' }
+          & "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_company_watch_recovery.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Company configuration watcher recovery checks failed.' }
+          & "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_msi_service_guard.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Customer MSI recovery service guard checks failed.' }
+          & "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File deployment/windows/test_update_recovery_task.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Update recovery task ownership checks failed.' }
+          rustc --edition 2021 --test libs/portable/src/install_wait.rs -o portable-install-wait-tests.exe
+          if ($LASTEXITCODE -ne 0) { throw 'Portable installer wait tests did not compile.' }
+          ./portable-install-wait-tests.exe
+          if ($LASTEXITCODE -ne 0) { throw 'Portable installer completion tests failed.' }
+          rustc --edition 2021 --test libs/portable/src/runtime_cache.rs -o portable-runtime-cache-tests.exe
+          if ($LASTEXITCODE -ne 0) { throw 'Portable runtime cache tests did not compile.' }
+          ./portable-runtime-cache-tests.exe
+          if ($LASTEXITCODE -ne 0) { throw 'Portable runtime cache isolation tests failed.' }
+          python3 deployment/windows/generate-payload-manifest.py --edition customer --source swan-client --output artifacts/customer-installed-files.unsigned.json
+          python3 deployment/windows/generate-payload-manifest.py --edition technician --source artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.exe --output artifacts/technician-installed-files.unsigned.json
+
+      - name: Build company management and distribution components
+        shell: pwsh
+        run: |
+          cargo test --manifest-path product/Cargo.toml --locked -p swan-agent update::tests::powershell_verifier_does_not_inherit_background_priority -- --exact
+          if ($LASTEXITCODE -ne 0) { throw 'Windows trust-helper scheduling regression failed.' }
+          cargo build --manifest-path product/Cargo.toml --workspace --release --locked
+          Copy-Item product/target/release/swan-*.exe artifacts/
+          Copy-Item deployment/windows/Install-Company.ps1,deployment/windows/Open-Technician.ps1,deployment/windows/Uninstall-Technician.ps1,deployment/windows/Verify-Package.ps1,deployment/windows/Get-WindowsCompatibility.ps1 artifacts/
+          Copy-Item deployment/windows/Install-Worker.ps1,deployment/windows/Uninstall-Worker.ps1,deployment/windows/Read-WorkerConfiguration.ps1,deployment/windows/Migrate-WorkerCredential.ps1,deployment/windows/Prepare-CustomerDirectory.ps1 artifacts/
+          Copy-Item LICENCE artifacts/
+
+      - name: Build unsigned customer and technician MSIs with pinned WiX
+        id: package-clients
+        shell: pwsh
+        run: |
+          $toolPackage = Join-Path $env:RUNNER_TEMP 'wix-cli-x64-5.0.2.msi'
+          Invoke-WebRequest -Uri https://github.com/wixtoolset/wix/releases/download/v5.0.2/wix-cli-x64.msi -OutFile $toolPackage
+          $toolDirectory = Join-Path $env:RUNNER_TEMP 'swan-wix-5.0.2'
+          $wix = ./deployment/windows/Expand-WixBuildTools.ps1 -Package $toolPackage -OutputDirectory $toolDirectory -SevenZip 'C:/Program Files/7-Zip/7z.exe'
+          $output = 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.msi'
+          ./deployment/windows/Build-TechnicianMsi.ps1 -WixExe $wix -TechnicianExe 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.exe' -AgentExe artifacts/swan-agent.exe -Version '${{ env.VERSION }}' -Output $output -UnsignedTest -SourceDateEpoch $env:SOURCE_DATE_EPOCH
+          $hash = (Get-FileHash -LiteralPath $output -Algorithm SHA256).Hash.ToLowerInvariant()
+          Add-Content artifacts/SHA256SUMS.txt ($hash+'  '+[IO.Path]::GetFileName($output))
+          $customerOutput = 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-customer-x64-unsigned.msi'
+          ./deployment/windows/Build-CustomerMsi.ps1 -WixExe $wix -SourceDirectory swan-client -AgentExe artifacts/swan-agent.exe -Version '${{ env.VERSION }}' -Output $customerOutput -UnsignedTest -SourceDateEpoch $env:SOURCE_DATE_EPOCH
+          $customerHash = (Get-FileHash -LiteralPath $customerOutput -Algorithm SHA256).Hash.ToLowerInvariant()
+          Add-Content artifacts/SHA256SUMS.txt ($customerHash+'  '+[IO.Path]::GetFileName($customerOutput))
+          $sourceHash = (Get-FileHash -LiteralPath artifacts/SwanRemoteSupport-build-source.zip -Algorithm SHA256).Hash.ToLowerInvariant()
+          Add-Content artifacts/SHA256SUMS.txt ($sourceHash+'  SwanRemoteSupport-build-source.zip')
+
+      - name: Verify MSI input staging and deterministic metadata guards
+        shell: powershell
+        run: |
+          ./deployment/windows/test_msi_staging.ps1 -WorkDirectory (Join-Path $env:RUNNER_TEMP 'swan-msi-staging-check')
+          $raw = 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.msi.raw-unsigned.msi'
+          ./deployment/windows/test_msi_metadata.ps1 -FirstMsi $raw -SecondMsi $raw -WorkDirectory (Join-Path $env:RUNNER_TEMP 'swan-msi-metadata-check') -SourceDateEpoch $env:SOURCE_DATE_EPOCH
+
+      - name: Verify unsigned technician MSI installation repair and uninstall
+        shell: pwsh
+        run: |
+          ./deployment/windows/test_technician_msi_lifecycle.ps1 -Package 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.msi' -TechnicianExecutable 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.exe' -AgentExecutable artifacts/swan-agent.exe
+
+      - name: Verify customer MSI starts a headless native service
         shell: pwsh
         run: |
-          Copy-Item .\scripts\Install-SwanRemoteSupport.ps1 .\artifacts\
-          Copy-Item .\scripts\Install-SwanRemoteSupport.cmd .\artifacts\
-          Copy-Item .\scripts\Install-SwanRemoteSupport-UNSIGNED-TEST.cmd .\artifacts\
-          Copy-Item .\scripts\Run-Swan-Technician-UNSIGNED-TEST.cmd .\artifacts\
-          Copy-Item .\scripts\Enable-SwanUnattendedAccess.ps1 .\artifacts\
-          Copy-Item .\scripts\Disable-SwanUnattendedAccess.ps1 .\artifacts\
-          Copy-Item .\docs\CUSTOMER_INSTALL.md .\artifacts\
-          Copy-Item .\docs\UNSIGNED_SPARE_LAPTOP_TEST.md .\artifacts\
-          Copy-Item .\docs\PRIVACY.md .\artifacts\
-          Copy-Item .\docs\SOURCE_AND_LICENSE.md .\artifacts\
+          ./deployment/windows/test_customer_service_startup.ps1 -Package 'artifacts/SwanRemoteSupport-${{ env.VERSION }}-customer-x64-unsigned.msi' -CustomerExecutable swan-client/rustdesk.exe
+
+      - name: Preserve technician MSI lifecycle evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: technician-msi-lifecycle
+          if-no-files-found: ignore
+          path: |
+            ${{ runner.temp }}/swan-msi-lifecycle-*/**
+            ${{ runner.temp }}/swan-customer-service-*/**
+            ${{ runner.temp }}/swan-msi-staging-check/result.json
+            ${{ runner.temp }}/swan-msi-metadata-check/result.json
+
+      - name: Retain completed client inputs before independent server packaging
+        if: always() && steps.package-clients.conclusion == 'success'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SwanRemoteSupport-${{ env.VERSION }}-client-inputs-x64-UNSIGNED-TEST
+          if-no-files-found: error
+          path: |
+            artifacts/SwanRemoteSupport-*.exe
+            artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.msi
+            artifacts/SwanRemoteSupport-${{ env.VERSION }}-customer-x64-unsigned.msi
+            artifacts/SwanRemoteSupport-build-source.zip
+            artifacts/*.msi.build.json
+            artifacts/*.msi.installed-files.json
+            artifacts/SHA256SUMS.txt
+            artifacts/swan-*.exe
+            artifacts/*-installed-files.unsigned.json
+            artifacts/topmost-source/**
+            artifacts/engine-source/**
+            artifacts/engine-selection.json
+            artifacts/native-desktop-pe-metadata.json
+            artifacts/native-service-imports.json
+            artifacts/native-dll-search-tests.log
+            artifacts/native-transfer-write-timeout-tests.log
+            artifacts/native-customer-approval-window-tests.log
+            artifacts/native-managed-branding-tests.log
+            artifacts/native-msvc-toolchain.json
+            artifacts/native-aom-inputs/**
+            artifacts/flutter-sdk-identity.json
+            artifacts/flutter-client-wrapper-repro.json
+            artifacts/native-managed-updater-tests.log
+            artifacts/native-managed-pause-tests.log
+            artifacts/native-managed-subsession-tests.log
+            artifacts/Install-Company.ps1
+            artifacts/Install-Worker.ps1
+            artifacts/Read-WorkerConfiguration.ps1
+            artifacts/Migrate-WorkerCredential.ps1
+            artifacts/Prepare-CustomerDirectory.ps1
+            artifacts/Uninstall-Worker.ps1
+            artifacts/Open-Technician.ps1
+            artifacts/Uninstall-Technician.ps1
+            artifacts/Verify-Package.ps1
+            artifacts/Get-WindowsCompatibility.ps1
+            artifacts/LICENCE
+
+      - name: Restore maintained Windows transport and corresponding source
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: swan-transport-candidate-windows-2022
+          path: ${{ runner.temp }}/swan-maintained-transport
+
+      - name: Build unsigned company server setup with pinned components
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $pins = Get-Content deployment/windows/server-components.json -Raw | ConvertFrom-Json
+          $https = Join-Path $env:RUNNER_TEMP 'swan-server-https.zip'
+          ./deployment/windows/test_pinned_archive.ps1
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $pins.https.url -Sha256 $pins.https.sha256 -Output $https | Out-Null
+          $components = Join-Path $env:RUNNER_TEMP 'swan-server-components'
+          ./deployment/windows/Prepare-ServerComponents.ps1 -TransportDirectory (Join-Path $env:RUNNER_TEMP 'swan-maintained-transport') -HttpsPackage $https -OutputDirectory $components
+          $compilerPin = Get-Content deployment/windows/server-compiler.json -Raw | ConvertFrom-Json
+          $references = Get-Content deployment/windows/server-references.json -Raw | ConvertFrom-Json
+          $compilerPackage = Join-Path $env:RUNNER_TEMP 'swan-server-roslyn-4.12.0.nupkg'
+          $frameworkPackage = Join-Path $env:RUNNER_TEMP 'swan-server-framework-references.nupkg'
+          $powershellPackage = Join-Path $env:RUNNER_TEMP 'swan-server-powershell-references.nupkg'
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $compilerPin.url -Sha256 $compilerPin.sha256 -Output $compilerPackage | Out-Null
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $references.framework.url -Sha256 $references.framework.sha256 -Output $frameworkPackage | Out-Null
+          ./deployment/windows/Get-PinnedArchive.ps1 -Uri $references.powershell.url -Sha256 $references.powershell.sha256 -Output $powershellPackage | Out-Null
+          $setup = ./deployment/windows/Build-ServerSetup.ps1 -ManagementExecutable artifacts/swan-management.exe -ComponentsDirectory $components -CompilerPackage $compilerPackage -FrameworkReferencesPackage $frameworkPackage -PowerShellReferencesPackage $powershellPackage -OutputDirectory artifacts/server-setup -UnsignedTest
+          $reproEvidence = Join-Path $env:RUNNER_TEMP 'swan-server-setup-repro'
+          ./deployment/windows/test_server_setup_reproducibility.ps1 -ManagementExecutable artifacts/swan-management.exe -ComponentsDirectory $components -CompilerPackage $compilerPackage -FrameworkReferencesPackage $frameworkPackage -PowerShellReferencesPackage $powershellPackage -WorkDirectory $reproEvidence
+          Copy-Item -LiteralPath (Join-Path $reproEvidence 'result.json') -Destination artifacts/server-setup-repro.json
+          Copy-Item -LiteralPath (Join-Path $reproEvidence 'packaged-preview.png') -Destination artifacts/server-setup-packaged-preview.png
+          $hash = (Get-FileHash -LiteralPath $setup -Algorithm SHA256).Hash.ToLowerInvariant()
+          Copy-Item -LiteralPath $setup -Destination artifacts/SwanServerSetup-UNSIGNED-TEST.exe
+          Copy-Item -LiteralPath artifacts/server-setup/SOURCE.json -Destination artifacts/SwanServerSetup-SOURCE.json
+          Add-Content artifacts/SHA256SUMS.txt ($hash+'  SwanServerSetup-UNSIGNED-TEST.exe')
 
       - name: Upload unsigned installer and checksum
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -201,14 +565,40 @@ jobs:
           if-no-files-found: error
           path: |
             artifacts/SwanRemoteSupport-${{ env.VERSION }}-x64-unsigned-install.exe
+            artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.exe
+            artifacts/SwanRemoteSupport-${{ env.VERSION }}-technician-x64-unsigned.msi
+            artifacts/SwanRemoteSupport-${{ env.VERSION }}-customer-x64-unsigned.msi
+            artifacts/SwanServerSetup-UNSIGNED-TEST.exe
+            artifacts/SwanServerSetup-SOURCE.json
+            artifacts/server-setup-repro.json
+            artifacts/server-setup-packaged-preview.png
+            artifacts/SwanRemoteSupport-build-source.zip
+            artifacts/topmost-source/**
+            artifacts/engine-source/**
+            artifacts/engine-selection.json
+            artifacts/native-desktop-pe-metadata.json
+            artifacts/native-service-imports.json
+            artifacts/native-dll-search-tests.log
+            artifacts/native-transfer-write-timeout-tests.log
+            artifacts/native-customer-approval-window-tests.log
+            artifacts/native-managed-branding-tests.log
+            artifacts/native-msvc-toolchain.json
+            artifacts/native-aom-inputs/**
+            artifacts/*.msi.build.json
+            artifacts/flutter-sdk-identity.json
+            artifacts/flutter-client-wrapper-repro.json
+            artifacts/*.msi.installed-files.json
             artifacts/SHA256SUMS.txt
-            artifacts/Install-SwanRemoteSupport.ps1
-            artifacts/Install-SwanRemoteSupport.cmd
-            artifacts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd
-            artifacts/Run-Swan-Technician-UNSIGNED-TEST.cmd
-            artifacts/Enable-SwanUnattendedAccess.ps1
-            artifacts/Disable-SwanUnattendedAccess.ps1
-            artifacts/CUSTOMER_INSTALL.md
-            artifacts/UNSIGNED_SPARE_LAPTOP_TEST.md
-            artifacts/PRIVACY.md
-            artifacts/SOURCE_AND_LICENSE.md
+            artifacts/swan-*.exe
+            artifacts/Install-Company.ps1
+            artifacts/Install-Worker.ps1
+            artifacts/Read-WorkerConfiguration.ps1
+            artifacts/Migrate-WorkerCredential.ps1
+            artifacts/Prepare-CustomerDirectory.ps1
+            artifacts/Uninstall-Worker.ps1
+            artifacts/Open-Technician.ps1
+            artifacts/Uninstall-Technician.ps1
+            artifacts/Verify-Package.ps1
+            artifacts/Get-WindowsCompatibility.ps1
+            artifacts/*-installed-files.unsigned.json
+            artifacts/LICENCE
diff --git a/.github/workflows/third-party-RustDeskTempTopMostWindow.yml b/.github/workflows/third-party-RustDeskTempTopMostWindow.yml
index 05c8731d5e5..422483217c3 100644
--- a/.github/workflows/third-party-RustDeskTempTopMostWindow.yml
+++ b/.github/workflows/third-party-RustDeskTempTopMostWindow.yml
@@ -1,6 +1,27 @@
 name: build RustDeskTempTopMostWindow
 
 on:
+  workflow_dispatch:
+    inputs:
+      upload-artifact:
+        type: boolean
+        default: true
+      target:
+        type: choice
+        options: [windows-2022]
+        default: windows-2022
+      configuration:
+        type: choice
+        options: [Release]
+        default: Release
+      platform:
+        type: choice
+        options: [x64]
+        default: x64
+      target_version:
+        type: choice
+        options: [Windows10]
+        default: Windows10
   workflow_call:
     inputs:
         upload-artifact:
@@ -27,6 +48,9 @@ on:
             type: string
             default: 'Windows10'
 
+permissions:
+  contents: read
+
 env:
   project_path: WindowInjection/WindowInjection.vcxproj
 
@@ -37,19 +61,59 @@ jobs:
         fail-fast: false
     env:
       build_output_dir: RustDeskTempTopMostWindow/WindowInjection/${{ inputs.platform }}/${{ inputs.configuration }}
+      CL: ${{ inputs.configuration == 'Release' && inputs.platform == 'x64' && '/Brepro' || '' }}
+      _LINK_: ${{ inputs.configuration == 'Release' && inputs.platform == 'x64' && '/Brepro /INCREMENTAL:NO /PDBALTPATH:%_PDB%' || '' }}
     steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Add MSBuild to PATH
         uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
 
       - name: Download the source code
         run: |
-          git clone https://github.com/rustdesk-org/RustDeskTempTopMostWindow RustDeskTempTopMostWindow
+          git init RustDeskTempTopMostWindow
+          git -C RustDeskTempTopMostWindow remote add origin https://github.com/rustdesk-org/RustDeskTempTopMostWindow
+          git -C RustDeskTempTopMostWindow fetch --depth=1 origin ecd8d6a139eee76845ea66423fb739af450fda90
+          git -C RustDeskTempTopMostWindow checkout --detach FETCH_HEAD
 
       - name: Build the project
         run: |
           cd RustDeskTempTopMostWindow && git checkout ecd8d6a139eee76845ea66423fb739af450fda90
           msbuild ${{ env.project_path }} -p:Configuration=${{ inputs.configuration }} -p:Platform=${{ inputs.platform }} /p:TargetVersion=${{ inputs.target_version }}
 
+      - name: Verify release metadata and retain exact public helper source
+        if: inputs.configuration == 'Release' && inputs.platform == 'x64'
+        shell: pwsh
+        run: |
+          python -m unittest discover -s deployment/windows -p test_reproducible_pe.py
+          if ($LASTEXITCODE -ne 0) { throw 'PE metadata guard tests failed.' }
+          $dll = Join-Path $env:build_output_dir 'WindowInjection.dll'
+          $verification = & python deployment/windows/verify-reproducible-pe.py $dll --dll
+          if ($LASTEXITCODE -ne 0) { throw 'Helper lacks reproducible release metadata.' }
+          $metadata = $verification | ConvertFrom-Json
+          $revision = (& git -C RustDeskTempTopMostWindow rev-parse HEAD).Trim()
+          if ($LASTEXITCODE -ne 0 -or $revision -cne 'ecd8d6a139eee76845ea66423fb739af450fda90') { throw 'Helper source pin changed.' }
+          git -C RustDeskTempTopMostWindow diff --quiet HEAD
+          if ($LASTEXITCODE -ne 0) { throw 'Helper tracked source changed.' }
+          New-Item -ItemType Directory -Path helper-source | Out-Null
+          $archive = [IO.Path]::GetFullPath('helper-source/WindowInjection-original-source.zip')
+          git -C RustDeskTempTopMostWindow archive --format=zip --output=$archive HEAD
+          if ($LASTEXITCODE -ne 0) { throw 'Pinned helper source export failed.' }
+          Copy-Item .github/workflows/third-party-RustDeskTempTopMostWindow.yml helper-source/build-workflow.yml
+          Copy-Item deployment/windows/verify-reproducible-pe.py,deployment/windows/test_reproducible_pe.py helper-source/
+          $record = @{schema=1;repository='https://github.com/rustdesk-org/RustDeskTempTopMostWindow';source_revision=$revision;workflow_repository=$env:GITHUB_REPOSITORY;workflow_source_revision=$env:GITHUB_SHA;workflow_run=$env:GITHUB_RUN_ID;platform='x64';configuration='Release';compiler_flags=$env:CL;linker_flags=$env:_LINK_;runner_image=$env:ImageOS;runner_image_version=$env:ImageVersion;binary=$metadata;source_files=@{};independent_rebuild_verified=$false;runtime_qualified=$false;production_approved=$false}
+          foreach ($file in Get-ChildItem -LiteralPath helper-source -File) { $record.source_files[$file.Name]=(Get-FileHash -LiteralPath $file.FullName).Hash.ToLowerInvariant() }
+          $record | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath helper-source/WindowInjection-SOURCE.json -Encoding utf8
+
+      - name: Archive helper corresponding source separately from installed payload
+        if: inputs.configuration == 'Release' && inputs.platform == 'x64' && inputs.upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: topmostwindow-source-${{ inputs.platform }}
+          path: helper-source/
+          if-no-files-found: error
+
       - name: Archive build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.upload-artifact }}
diff --git a/.gitignore b/.gitignore
index a7b63b966da..277006457d4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,3 +65,10 @@ flutter/web/
 
 # Working activity log required by the repository's AI-agent rules.
 docs/AI_CHANGELOG.md
+
+# Company server and build outputs. Runtime credentials never belong in Git.
+product/target/
+swan-data/
+deployment/linux/company.env
+*.swan-backup
+deployment/windows/local-test.env
diff --git a/Cargo.lock b/Cargo.lock
index 57177174db5..c7645f065e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "ab_glyph"
@@ -633,6 +633,58 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa 1.0.11",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json 1.0.118",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "backtrace"
 version = "0.3.73"
@@ -990,7 +1042,7 @@ dependencies = [
 [[package]]
 name = "cacao"
 version = "0.4.0-beta2"
-source = "git+https://github.com/clslaid/cacao?branch=feat/set-file-urls#05e1536b0b43aaae308ec72c0eed703e875b7b95"
+source = "git+https://github.com/clslaid/cacao?branch=feat%2Fset-file-urls#05e1536b0b43aaae308ec72c0eed703e875b7b95"
 dependencies = [
  "bitmask-enum",
  "block2 0.2.0-alpha.6",
@@ -1905,6 +1957,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "cpufeatures",
  "curve25519-dalek-derive",
+ "digest",
  "fiat-crypto",
  "rustc_version",
  "subtle",
@@ -2329,7 +2382,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412"
 dependencies = [
- "libloading 0.7.4",
+ "libloading 0.8.4",
 ]
 
 [[package]]
@@ -2530,6 +2583,31 @@ dependencies = [
  "signature 1.6.4",
 ]
 
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature 2.2.0",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519 2.2.3",
+ "rand_core 0.6.4",
+ "serde 1.0.228",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "either"
 version = "1.13.0"
@@ -2694,7 +2772,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2820,7 +2898,7 @@ dependencies = [
 [[package]]
 name = "filedescriptor"
 version = "0.8.2"
-source = "git+https://github.com/rustdesk-org/wezterm?branch=rustdesk/pty_based_0.8.1#80174f8009f41565f0fa8c66dab90d4f9211ae16"
+source = "git+https://github.com/rustdesk-org/wezterm?branch=rustdesk%2Fpty_based_0.8.1#80174f8009f41565f0fa8c66dab90d4f9211ae16"
 dependencies = [
  "libc",
  "thiserror 1.0.61",
@@ -3019,6 +3097,16 @@ dependencies = [
  "time 0.1.45",
 ]
 
+[[package]]
+name = "fs2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
+dependencies = [
+ "libc",
+ "winapi 0.3.9",
+]
+
 [[package]]
 name = "fsevent"
 version = "2.1.2"
@@ -3943,6 +4031,12 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
 [[package]]
 name = "humantime"
 version = "2.1.0"
@@ -3975,6 +4069,7 @@ dependencies = [
  "http",
  "http-body",
  "httparse",
+ "httpdate",
  "itoa 1.0.11",
  "pin-project-lite",
  "pin-utils",
@@ -4494,7 +4589,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e310b3a6b5907f99202fcdb4960ff45b93735d7c7d96b760fcff8db2dc0e103d"
 dependencies = [
  "cfg-if 1.0.0",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -4717,6 +4812,12 @@ version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
 
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -4796,6 +4897,12 @@ dependencies = [
  "objc",
 ]
 
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -5963,7 +6070,7 @@ dependencies = [
 [[package]]
 name = "pam-sys"
 version = "1.0.0-alpha4"
-source = "git+https://github.com/rustdesk-org/pam-sys?branch=fix/v1.0.0-alpha4_gnuc_va_list#3337c9bb9a9c68d7497ec8c93cad2368c26091b7"
+source = "git+https://github.com/rustdesk-org/pam-sys?branch=fix%2Fv1.0.0-alpha4_gnuc_va_list#3337c9bb9a9c68d7497ec8c93cad2368c26091b7"
 dependencies = [
  "bindgen 0.59.2",
  "libc",
@@ -6369,7 +6476,7 @@ checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
 [[package]]
 name = "portable-pty"
 version = "0.8.1"
-source = "git+https://github.com/rustdesk-org/wezterm?branch=rustdesk/pty_based_0.8.1#80174f8009f41565f0fa8c66dab90d4f9211ae16"
+source = "git+https://github.com/rustdesk-org/wezterm?branch=rustdesk%2Fpty_based_0.8.1#80174f8009f41565f0fa8c66dab90d4f9211ae16"
 dependencies = [
  "anyhow",
  "bitflags 1.3.2",
@@ -7249,7 +7356,7 @@ dependencies = [
 
 [[package]]
 name = "rustdesk"
-version = "1.4.9"
+version = "1.5.23"
 dependencies = [
  "android-wakelock",
  "android_logger",
@@ -7334,6 +7441,7 @@ dependencies = [
  "shutdown_hooks",
  "softbuffer",
  "stunclient",
+ "swan-agent",
  "sys-locale",
  "system_shutdown",
  "tao",
@@ -7362,7 +7470,7 @@ dependencies = [
 
 [[package]]
 name = "rustdesk-portable-packer"
-version = "1.4.9"
+version = "1.5.23"
 dependencies = [
  "brotli",
  "dirs 5.0.1",
@@ -7434,7 +7542,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7491,7 +7599,7 @@ dependencies = [
  "security-framework 3.5.1",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7747,6 +7855,17 @@ dependencies = [
  "serde 1.0.228",
 ]
 
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa 1.0.11",
+ "serde 1.0.228",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.19"
@@ -8071,7 +8190,7 @@ version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e26be3acb6c2d9a7aac28482586a7856436af4cfe7100031d219de2d2ecb0028"
 dependencies = [
- "ed25519",
+ "ed25519 1.5.3",
  "libc",
  "libsodium-sys",
  "serde 1.0.228",
@@ -8263,6 +8382,41 @@ version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "swan-agent"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "fs2",
+ "hex",
+ "rand 0.8.5",
+ "reqwest",
+ "serde 1.0.228",
+ "serde_json 1.0.118",
+ "sha2",
+ "swan-protocol",
+ "tokio",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "swan-protocol"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "hex",
+ "rand 0.8.5",
+ "serde 1.0.228",
+ "serde_json 1.0.118",
+ "sha2",
+ "url",
+]
+
 [[package]]
 name = "syn"
 version = "0.15.44"
@@ -8545,7 +8699,7 @@ dependencies = [
 [[package]]
 name = "tfc"
 version = "0.7.0"
-source = "git+https://github.com/rustdesk-org/The-Fat-Controller?branch=history/rebase_upstream_20240722#78bb80a8e596e4c14ae57c8448f5fca75f91f2b0"
+source = "git+https://github.com/rustdesk-org/The-Fat-Controller?branch=history%2Frebase_upstream_20240722#78bb80a8e596e4c14ae57c8448f5fca75f91f2b0"
 dependencies = [
  "anyhow",
  "core-graphics 0.23.2",
@@ -8921,6 +9075,7 @@ dependencies = [
  "tokio",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -10868,7 +11023,7 @@ dependencies = [
 [[package]]
 name = "x11-clipboard"
 version = "0.8.1"
-source = "git+https://github.com/clslaid/x11-clipboard?branch=feat/store-batch#5fc2e73bc01ada3681159b34cf3ea8f0d14cd904"
+source = "git+https://github.com/clslaid/x11-clipboard?branch=feat%2Fstore-batch#5fc2e73bc01ada3681159b34cf3ea8f0d14cd904"
 dependencies = [
  "x11rb 0.12.0",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 509d2e07efa..f7589ccc615 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "rustdesk"
-version = "1.4.9"
+version = "1.5.23"
 authors = ["rustdesk <info@rustdesk.com>"]
 edition = "2021"
 build= "build.rs"
 description = "RustDesk Remote Desktop"
 default-run = "rustdesk"
-rust-version = "1.75"
+rust-version = "1.90"
 
 [lib]
 name = "librustdesk"
@@ -31,7 +31,7 @@ hwcodec = ["scrap/hwcodec"]
 vram = ["scrap/vram"]
 mediacodec = ["scrap/mediacodec"]
 plugin_framework = []
-swan_custom = []
+swan_custom = ["dep:swan-agent"]
 linux-pkg-config = ["magnum-opus/linux-pkg-config", "scrap/linux-pkg-config"]
 unix-file-copy-paste = [
     "dep:x11-clipboard",
@@ -45,6 +45,7 @@ screencapturekit = ["cpal/screencapturekit"]
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
+swan-agent = { path = "product/agent", optional = true }
 async-trait = "0.1"
 scrap = { path = "libs/scrap", features = ["wayland"] }
 hbb_common = { path = "libs/hbb_common" }
@@ -117,6 +118,7 @@ winapi = { version = "0.3", features = [
     "cfgmgr32",
     "ioapiset",
     "winspool",
+    "winsvc",
 ] }
 windows = { version = "0.61", features = [
     "Win32",
@@ -203,7 +205,7 @@ android-wakelock = { git = "https://github.com/rustdesk-org/android-wakelock" }
 
 [workspace]
 members = ["libs/scrap", "libs/hbb_common", "libs/enigo", "libs/clipboard", "libs/virtual_display", "libs/virtual_display/dylib", "libs/portable", "libs/remote_printer"]
-exclude = ["vdi/host", "examples/custom_plugin"]
+exclude = ["vdi/host", "examples/custom_plugin", "product", "product/agent", "product/protocol", "product/management", "product/worker"]
 
 # Patch libxdo-sys to use a stub implementation that doesn't require libxdo
 # This allows building and running on systems without libxdo installed (e.g., Wayland-only)
diff --git a/README.md b/README.md
index 93062e5e1de..1c8ecc9d2af 100644
--- a/README.md
+++ b/README.md
@@ -9,11 +9,11 @@
 </p>
 
 > [!IMPORTANT]
-> This branch contains the **Swan Remote Support** managed client maintained by Swan Computing. It is pinned to RustDesk `1.4.9`, uses Swan branding, embeds the public Swan server routing/trust defaults, provides an express consented-unattended installation, and hides the customer-facing ID/password after setup. Customer release is blocked until the public-source, privacy, Tailnet-policy, testing, and trusted code-signing gates pass. Start with the [Swan build/deployment guide](docs/SWAN_CUSTOM_BUILD.md), [Tailscale deployment](docs/TAILSCALE_DEPLOYMENT.md), [code-signing policy](docs/CODE_SIGNING_POLICY.md), [privacy statement](docs/PRIVACY.md), and [source/licensing notes](docs/SOURCE_AND_LICENSE.md).
+> **Swan Remote Support** is evolving into a configurable AGPL product that each company hosts independently. Its server manages branding, enrollment, technician authorization and approved updates; customer and technician apps use signed company configuration. Start with the [company product build/deployment guide](product/README.md) and [acceptance report](docs/ACCEPTANCE.md). This is a development branch, not a production release. Native sessions, installers, recovery and the complete Windows matrix still require verification. The original Swan/Tailscale deployment is preserved at tag `swan-single-company-baseline-1.4.9`.
 
-Continuing on the live server? Use the evidence-first [server continuation prompt](docs/SERVER_CONTINUATION_PROMPT.md).
+Maintaining the preserved Swan/Tailscale deployment? Use its historical [server continuation prompt](docs/SERVER_CONTINUATION_PROMPT.md).
 
-**[Code signing policy](docs/CODE_SIGNING_POLICY.md):** Free code signing provided by [SignPath.io](https://about.signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
+**[Code signing policy](docs/CODE_SIGNING_POLICY.md):** Production publication requires an approved signing provider, valid signatures and completed release checks. No signing approval or free signing of arbitrary company builds is assumed.
 
 > [!Caution]
 > **Misuse Disclaimer:** <br>
diff --git a/SECURITY.md b/SECURITY.md
index 8430238277f..5097ff14f79 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -12,10 +12,11 @@ Include the affected version/commit, Windows version, reproducible steps, impact
 
 ## Deployment security boundaries
 
-- The server address and Ed25519 public key embedded in the client are public values.
-- The RustDesk server private key, customer unattended passwords, Tailscale enrollment credentials, and signing keys are secrets and must never enter source control.
-- Tailscale tag policy limits network reachability but does not replace the unique Swan password or customer authorization.
-- RustDesk Server OSS does not provide a Swan technician identity/MFA authorization layer. Anyone who obtains a device ID and its password can attempt access from an allowed network device.
+- Company HTTPS addresses and public trust keys are public bootstrap information. Private transport/configuration keys, worker credentials, account secrets, device identities, signing keys and backups must stay outside source control and public downloads.
+- Managed editions require company enrollment, technician authorization and short-lived device-bound grants enforced by the receiving device. UI restrictions or network reachability alone are insufficient. See the acceptance record for verified behavior and outstanding gates.
+- Each company hosts its own infrastructure. The preserved single-company baseline has different historical password and Tailscale boundaries; do not treat its network restrictions as managed authorization.
+- Earlier development Windows worker installers stored credentials in service registry environment settings. Server 2016 testing found additional app-container read permissions. Revoke affected worker registrations, stop legacy workers and remove those registry secrets before replacement. Current development source requires protected private-file configuration for service mode; Server 2016 lab migration, standard-user read denial, package generation and reboot checks passed. The complete Windows matrix and production release qualification remain required.
+- Before restoring a backup, reconcile revoked worker registrations: an old database can restore their credential hashes. Do not expose the restored deployment until legacy registrations have been revoked again.
 - Never ask a customer to disable antivirus, SmartScreen, Windows Firewall, or MFA to install this software.
 
 See [Code-signing policy](docs/CODE_SIGNING_POLICY.md), [Privacy](docs/PRIVACY.md), and [Tailscale deployment](docs/TAILSCALE_DEPLOYMENT.md).
diff --git a/branding/swan-support-mark.svg b/branding/swan-support-mark.svg
new file mode 100644
index 00000000000..c2062f576a4
--- /dev/null
+++ b/branding/swan-support-mark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128"><path fill="#007F82" d="M54 8h20l4 14 13 6 13-6 14 14-6 13 6 13 14 4v20l-14 4-6 13 6 13-14 14-13-6-13 6-4 14H54l-4-14-13-6-13 6-14-14 6-13-6-13L0 86V66l14-4 6-13-6-13 14-14 13 6 13-6z" transform="translate(7 0) scale(.88)"/><path fill="#fff" d="M31 81c20 9 46 8 59-9-8 3-18 1-25-4 5-7 11-12 10-20-1-10-13-13-20-6 8-2 12 2 9 8-4 7-14 13-16 20-6 0-12 3-17 11z"/><circle fill="#fff" cx="91" cy="31" r="8"/><circle fill="#fff" cx="104" cy="52" r="6"/><path fill="none" stroke="#fff" stroke-width="3" d="m85 37 15 11"/></svg>
diff --git a/build.rs b/build.rs
index bf38b320a51..24ddcd49048 100644
--- a/build.rs
+++ b/build.rs
@@ -77,42 +77,33 @@ fn install_android_deps() {
     println!("cargo:rustc-link-lib=OpenSLES");
 }
 
-fn validate_swan_build_environment() {
-    if std::env::var_os("CARGO_FEATURE_SWAN_CUSTOM").is_none() {
-        return;
-    }
+#[path = "src/build_metadata.rs"]
+mod build_metadata;
 
-    // These are public routing/trust values, not credentials. Environment
-    // variables can override them for a test build, while ordinary Swan
-    // builds remain zero-configuration and pinned to the private Tailscale
-    // deployment.
-    const DEFAULT_RENDEZVOUS_SERVER: &str = "100.82.236.84";
-    const DEFAULT_RELAY_SERVER: &str = "100.82.236.84";
-    const DEFAULT_RS_PUB_KEY: &str = "I0s1JvqJ19WDNKBLFY+FC5HekcOqNWPpH+6xGmKUQLI=";
-
-    for (variable, default_value) in [
-        ("RENDEZVOUS_SERVER", DEFAULT_RENDEZVOUS_SERVER),
-        ("RELAY_SERVER", DEFAULT_RELAY_SERVER),
-        ("RS_PUB_KEY", DEFAULT_RS_PUB_KEY),
-    ] {
-        println!("cargo:rerun-if-env-changed={variable}");
-        let value = std::env::var(variable)
-            .ok()
-            .filter(|value| !value.trim().is_empty())
-            .unwrap_or_else(|| default_value.to_owned());
-        println!("cargo:rustc-env={variable}={value}");
+fn generate_version() -> Result<(), Box<dyn std::error::Error>> {
+    println!("cargo:rerun-if-env-changed=SWAN_BUILD");
+    println!("cargo:rerun-if-env-changed=SOURCE_DATE_EPOCH");
+    println!("cargo:rerun-if-changed=Cargo.toml");
+    println!("cargo:rerun-if-changed=src/build_metadata.rs");
+    if std::env::var_os("CARGO_FEATURE_SWAN_CUSTOM").is_some()
+        || std::env::var("SWAN_BUILD").as_deref() == Ok("1")
+    {
+        let epoch = std::env::var("SOURCE_DATE_EPOCH")?;
+        let version = std::env::var("CARGO_PKG_VERSION")?;
+        let metadata = build_metadata::render_version(&version, &epoch)
+            .map_err(|message| std::io::Error::new(std::io::ErrorKind::InvalidInput, message))?;
+        std::fs::write("src/version.rs", metadata)?;
+    } else {
+        hbb_common::gen_version();
     }
-
-    println!("cargo:rerun-if-env-changed=API_SERVER");
-    println!(
-        "cargo:rustc-env=API_SERVER={}",
-        std::env::var("API_SERVER").unwrap_or_default()
-    );
+    Ok(())
 }
 
 fn main() {
-    validate_swan_build_environment();
-    hbb_common::gen_version();
+    if let Err(error) = generate_version() {
+        eprintln!("Cannot generate application build metadata: {error}");
+        std::process::exit(1);
+    }
     install_android_deps();
     #[cfg(all(windows, feature = "inline"))]
     build_manifest();
diff --git a/deployment/linux/07bb8d0-component-reproduction.json b/deployment/linux/07bb8d0-component-reproduction.json
new file mode 100644
index 00000000000..d4be8ac7379
--- /dev/null
+++ b/deployment/linux/07bb8d0-component-reproduction.json
@@ -0,0 +1,67 @@
+{
+  "utc": "2026-10-28T09:10:41.827281+00:00",
+  "project_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "independent_pr_merge": "1ba02cc849fcf55fbbc68d2757f56b35d9e783d0",
+  "project_trees_identical": true,
+  "builds": [
+    {
+      "run_id": 40647659405,
+      "artifact": 12797593547,
+      "digest": "sha256:0dbf6abc6ff30442cef41049a83bfc446d9a49d3a7716c9949c654338a35eb64",
+      "bytes": 9561318,
+      "expected_packaging_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+      "public_source_files_verified": 221,
+      "declared_text_checkout_conversions": [],
+      "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+      "files": {
+        "swan-management": "89bd490871eeedbec72fb7c53491762ee1cb776af7f0dfeb77ba40301c97d5ab",
+        "swan-agent": "cb3624bc9f29e9520d47c3bb591fea9dfb3e37105b72ca3a77b5f548b2f42c66",
+        "swan-worker": "e2be24f49dc930423926b84ee4fccdd16d2e2ad0c00999b6b864de2e055bb23e",
+        "CompanyComponents-source.zip": "6c17b840cc0daf8714b2e53b40630c57ea430973064bc177dcf6ba44e1c177cf"
+      },
+      "executables_run": false
+    },
+    {
+      "run_id": 40647664923,
+      "artifact": 12798243526,
+      "digest": "sha256:0b6458ae74d8ba278f6fa0ed99ea48a9f4647a9a2c96d5ce15e10ed0c5e7d00d",
+      "bytes": 9561317,
+      "expected_packaging_source": "1ba02cc849fcf55fbbc68d2757f56b35d9e783d0",
+      "public_source_files_verified": 221,
+      "declared_text_checkout_conversions": [],
+      "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+      "files": {
+        "swan-management": "89bd490871eeedbec72fb7c53491762ee1cb776af7f0dfeb77ba40301c97d5ab",
+        "swan-agent": "cb3624bc9f29e9520d47c3bb591fea9dfb3e37105b72ca3a77b5f548b2f42c66",
+        "swan-worker": "e2be24f49dc930423926b84ee4fccdd16d2e2ad0c00999b6b864de2e055bb23e",
+        "CompanyComponents-source.zip": "285a0ff41456e2d60d4fa894bf84acb6bf8db5c7c856d3057b605f37516e8b1e"
+      },
+      "executables_run": false
+    }
+  ],
+  "original_linux_binaries": {
+    "swan-management": {
+      "identical": true,
+      "first_sha256": "89bd490871eeedbec72fb7c53491762ee1cb776af7f0dfeb77ba40301c97d5ab",
+      "second_sha256": "89bd490871eeedbec72fb7c53491762ee1cb776af7f0dfeb77ba40301c97d5ab",
+      "normalized": false
+    },
+    "swan-agent": {
+      "identical": true,
+      "first_sha256": "cb3624bc9f29e9520d47c3bb591fea9dfb3e37105b72ca3a77b5f548b2f42c66",
+      "second_sha256": "cb3624bc9f29e9520d47c3bb591fea9dfb3e37105b72ca3a77b5f548b2f42c66",
+      "normalized": false
+    },
+    "swan-worker": {
+      "identical": true,
+      "first_sha256": "e2be24f49dc930423926b84ee4fccdd16d2e2ad0c00999b6b864de2e055bb23e",
+      "second_sha256": "e2be24f49dc930423926b84ee4fccdd16d2e2ad0c00999b6b864de2e055bb23e",
+      "normalized": false
+    }
+  },
+  "all_original_binaries_identical": true,
+  "exact_public_sources_verified": true,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_publication": false
+}
diff --git a/deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json b/deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json
new file mode 100644
index 00000000000..acc7680e084
--- /dev/null
+++ b/deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json
@@ -0,0 +1,96 @@
+{
+  "recorded_utc": "2026-10-28T21:21:32.338938+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "transport_recipe_source": "650361413543baf7ef150f5960544154ec77ddeb",
+  "transport_image": "sha256:3e879d6f3954ff2bc750ab02cdea43e05894e75cd4f8d288c411450d2fae93ca",
+  "both_running_transport_container_images_verified": true,
+  "receiver_relay_request_utc": "2026-10-28T21:12:47.567975+00:00",
+  "matching_relay_pair_utc": "2026-10-28T21:12:47.125530+00:00",
+  "native_video_service_utc": "2026-10-28T21:13:04.192738+00:00",
+  "matching_receiver_and_maintained_relay_connection_id_verified": true,
+  "real_native_live_desktop_after_customer_accept": true,
+  "remote_pointer_changed_customer_server_manager_to_local_server": true,
+  "receiving_viewer_independently_showed_changed_page": true,
+  "claimed_attended_grant_with_subsequent_lease_renewal": true,
+  "technician_native_payload": {
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "flutter_and_rust_libraries_loaded": true,
+    "native_child_process_running": true,
+    "version": "1.5.7",
+    "utc": "2026-10-28T21:15:36.6770984Z",
+    "native_process_count": 1,
+    "no_new_application_crash_event": true,
+    "source_payload_hashes": {
+      "rustdesk.exe": "00db5cea227670af716d8dac88b7cb9fd5c86dab15f1dbfbed3c91a040733985",
+      "librustdesk.dll": "a79de5449074eb4d463eb72706015e70d5ec9f04f4c009a42336efa9adf45da4",
+      "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204"
+    },
+    "gui_mfa_and_inventory_observed_separately": false,
+    "remote_session_qualified": false
+  },
+  "customer_pause": {
+    "consent_revision": 0,
+    "version": "1.5.7",
+    "closed_grant_renewal_status": 403,
+    "profile_revision": 14,
+    "sequence": 9,
+    "utc": "2026-10-28T21:20:24.5173317Z",
+    "service_pid": 1196,
+    "support_paused": true,
+    "same_service_process_and_watch_running": true,
+    "new_msi_events": 0,
+    "shipping_verifier_passed": true,
+    "standard_account_test": false,
+    "unattended_consent_off": true,
+    "original_claimed_grant_closed": true,
+    "closed_grant_retains_historical_lease_timestamp": true
+  },
+  "customer_resume": {
+    "consent_revision": 0,
+    "version": "1.5.7",
+    "closed_grant_renewal_status": 403,
+    "profile_revision": 14,
+    "sequence": 9,
+    "utc": "2026-10-28T21:20:54.1280944Z",
+    "service_pid": 1196,
+    "support_paused": false,
+    "same_service_process_and_watch_running": true,
+    "new_msi_events": 0,
+    "shipping_verifier_passed": true,
+    "standard_account_test": false,
+    "unattended_consent_off": true,
+    "original_claimed_grant_closed": true,
+    "closed_grant_retains_historical_lease_timestamp": true,
+    "identity_credential_and_trust_preserved_across_resume": true
+  },
+  "gui_findings": {
+    "incoming_prompt_used_legacy_peer_display_name": true,
+    "observed_peer_display_name": "Administrator",
+    "authenticated_technician_display_name_on_customer_prompt_not_qualified": true
+  },
+  "original_private_log_sha256": {
+    "receiver-native.private.log": "f9e50f9af32660b2ed735e30c18561b9950f360a58fc92c00db1080b83448d84",
+    "hbbr.private.log": "bd8e6a526eb2977323dedbd6e53b79e0b794af44d99845318a40b3e9be527637"
+  },
+  "limits": [
+    "Loopback company endpoints and separate NAT lab VMs; no public Internet or direct-transport qualification.",
+    "Customer controls used owned Administrator desktop; no ordinary-account active-session termination claim.",
+    "No real clipboard, file transfer, remote UAC, multiple monitors or authorization-outage expiry qualification from this test.",
+    "No production signing or complete Windows compatibility qualification."
+  ],
+  "native_technician_mfa_and_inventory": {
+    "actual_installed_company_branding_and_https_origin_observed": true,
+    "native_username_password_totp_login_observed": true,
+    "independent_server_login_audit_matches": true,
+    "visible_approved_device_count": 5,
+    "technician_os": "Windows Server 2019 x64 17763.3650",
+    "customer_os": "Windows Server 2016 x64 14393",
+    "owned_administrator_desktops": true,
+    "ordinary_account_active_session_test": false
+  },
+  "verification_correction": {
+    "initial_checker_incorrectly_required_zero_historical_lease_timestamp": true,
+    "failure_preserved_privately": true,
+    "closed_flag_and_actual_renewal_403_verified_instead": true
+  }
+}
diff --git a/deployment/linux/Caddyfile b/deployment/linux/Caddyfile
new file mode 100644
index 00000000000..0ebc4c5d703
--- /dev/null
+++ b/deployment/linux/Caddyfile
@@ -0,0 +1,7 @@
+{$SWAN_HOST} {
+    reverse_proxy management:8080
+    header Strict-Transport-Security "max-age=31536000"
+    request_body {
+        max_size 512MB
+    }
+}
diff --git a/deployment/linux/Dockerfile b/deployment/linux/Dockerfile
new file mode 100644
index 00000000000..2d676a1632b
--- /dev/null
+++ b/deployment/linux/Dockerfile
@@ -0,0 +1,18 @@
+FROM rust:1.90.0-bookworm@sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f AS builder
+ARG CARGO_BUILD_JOBS=2
+ENV CARGO_BUILD_JOBS=${CARGO_BUILD_JOBS}
+WORKDIR /source
+COPY product ./product
+COPY branding ./branding
+COPY deployment ./deployment
+COPY LICENCE ./LICENCE
+RUN cargo build --manifest-path product/Cargo.toml --locked --release -p swan-management
+
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+RUN useradd --system --uid 10001 --create-home swan && mkdir -p /var/lib/swan && chown swan:swan /var/lib/swan
+COPY --from=builder /source/product/target/release/swan-management /usr/local/bin/swan-management
+USER swan
+ENV SWAN_DATA_DIR=/var/lib/swan SWAN_LISTEN=0.0.0.0:8080 SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+EXPOSE 8080
+ENTRYPOINT ["swan-management"]
diff --git a/deployment/linux/Dockerfile.dockerignore b/deployment/linux/Dockerfile.dockerignore
new file mode 100644
index 00000000000..971311b1709
--- /dev/null
+++ b/deployment/linux/Dockerfile.dockerignore
@@ -0,0 +1,86 @@
+# Deny by default: Git ignore rules do not apply to Docker build contexts.
+# Keep company environment files, keys, databases, packages and build caches out
+# of both the final image and intermediate layers sent to the build daemon.
+**
+!LICENCE
+!product/
+product/**
+!product/Cargo.toml
+!product/Cargo.lock
+!product/protocol/
+product/protocol/**
+!product/protocol/Cargo.toml
+!product/protocol/src/
+product/protocol/src/**
+!product/protocol/src/lib.rs
+!product/protocol/src/installation.rs
+!product/agent/
+product/agent/**
+!product/agent/Cargo.toml
+!product/agent/src/
+product/agent/src/**
+!product/agent/src/lib.rs
+!product/agent/src/main.rs
+!product/agent/src/payload.rs
+!product/agent/src/reporting.rs
+!product/agent/src/technician.rs
+!product/agent/src/technician_runtime.rs
+!product/agent/src/update.rs
+!product/agent/src/verifier_process.rs
+!product/management/
+product/management/**
+!product/management/Cargo.toml
+!product/management/src/
+product/management/src/**
+!product/management/src/main.rs
+!product/management/src/service.rs
+!product/management/src/installation_reporting.rs
+!product/management/src/network.rs
+!product/management/src/network_probe.rs
+!product/management/src/backup.rs
+!product/management/src/backup_stream.rs
+!product/management/src/windows.rs
+!product/management/src/components.rs
+!product/management/src/tests.rs
+!product/management/src/schema.sql
+!product/management/web/
+product/management/web/**
+!product/management/web/index.html
+!product/management/web/app.js
+!product/management/web/style.css
+!product/worker/
+product/worker/**
+!product/worker/Cargo.toml
+!product/worker/src/
+product/worker/src/**
+!product/worker/src/main.rs
+!product/worker/src/configuration.rs
+!product/worker/src/windows.rs
+!branding/
+branding/**
+!branding/swan-support-mark.svg
+!deployment/
+deployment/**
+!deployment/windows/
+deployment/windows/**
+!deployment/windows/Install-Company.ps1
+!deployment/windows/Install-SwanRemoteSupport.cmd
+!deployment/windows/Open-Technician.ps1
+!deployment/windows/Uninstall-Technician.ps1
+!deployment/windows/Verify-MsiRegistration.ps1
+!deployment/windows/Verify-Package.ps1
+!deployment/windows/Get-MsiIdentity.ps1
+!deployment/windows/Get-MsiInstallMode.ps1
+!deployment/windows/Get-WindowsCompatibility.ps1
+!deployment/windows/Restore-ReleaseMsi.ps1
+!deployment/windows/Restore-CustomerExe.ps1
+!deployment/windows/Restore-Configuration.ps1
+!deployment/windows/Restart-Configuration.ps1
+!deployment/windows/Restart-CustomerUi.ps1
+!deployment/windows/Run-SetupUiTask.ps1
+!deployment/windows/Remove-Configuration.ps1
+!deployment/windows/Update-RecoveryTask.ps1
+!deployment/windows/Update-UninstallCancellation.ps1
+!deployment/windows/Commit-Uninstall.ps1
+!deployment/windows/Prepare-CustomerDirectory.ps1
+!deployment/windows/Read-WorkerConfiguration.ps1
diff --git a/deployment/linux/README.md b/deployment/linux/README.md
new file mode 100644
index 00000000000..1b0ce0c52a2
--- /dev/null
+++ b/deployment/linux/README.md
@@ -0,0 +1,113 @@
+# Company Linux deployment
+
+Each company operates its own management, rendezvous and relay services. The
+project does not supply hosting. These deployment files still require the
+release checks in [ACCEPTANCE.md](../../docs/ACCEPTANCE.md); intended Windows
+compatibility and production signing are not verified claims.
+
+From this directory, copy `company.env.example` to `company.env`, set the
+company's public hostname and trusted project release verification public key,
+then run:
+
+```sh
+docker compose --env-file company.env up -d --build
+```
+
+The company supplies DNS, inbound TCP 80/443 for HTTPS provisioning, TCP
+21115/21116/21117 and UDP 21116 for native transport. Office hosting may need
+port forwarding or a separately reachable company relay under CGNAT. Setup
+diagnostics run from the company server and do not prove external connectivity.
+Do not alter an existing production deployment to rehearse these instructions.
+
+Open `https://YOUR_COMPANY_HOSTNAME` for the first-run administration wizard.
+Retrieve the one-time setup token privately on the company server:
+
+```sh
+docker compose --env-file company.env exec management cat /var/lib/swan/setup-token.txt
+```
+
+Keep the token out of shared logs and issues. Enter the company identity,
+branding, HTTPS and transport addresses, administrator credentials and an
+authenticator code in the wizard. The transport public key can be read from
+`/root/id_ed25519.pub` in the `hbbs` container; the corresponding private key
+must remain on the company server. Endpoints receive public bootstrap
+configuration and require company approval after enrollment. A Linux server
+also needs a company-controlled Windows worker for Windows installation bundles.
+
+Management runs as UID 10001 with a read-only root filesystem and private
+persistent storage. Docker's SIGTERM requests a graceful shutdown. Preserve
+all management, transport and Caddy volumes. Follow [SERVER_BACKUP.md](../../docs/SERVER_BACKUP.md)
+for encrypted database, configuration, transport and full TLS storage backup
+and restore; backing up only the management volume is insufficient.
+
+## Build and deployment checks
+
+The management image builds with two Cargo jobs by default to limit simultaneous
+compiler memory use. Larger build hosts can override `CARGO_BUILD_JOBS` as a
+Docker build argument. This setting applies only to the builder stage.
+
+The root and management Dockerfile both carry matching deny-by-default context
+rules, including explicit child exclusions for older Docker engines. They admit
+the named Cargo manifests, source, embedded scripts and branding assets while
+excluding local environment files, keys, databases, installers and caches from
+the build daemon and intermediate layers. Add newly required public build
+inputs explicitly when changing the embedded source.
+
+The Rust builder, Debian runtime, Caddy HTTPS proxy and RustDesk transport images
+are pinned by manifest digest.
+Update those digests deliberately and rerun these checks when applying base-image
+security updates. The runtime copies its public certificate trust bundle from
+the pinned builder, rather than installing packages from live repositories.
+Rustls reads that bundle through `SSL_CERT_FILE`; HTTPS certificate verification
+remains enabled. An isolated offline rebuild of the exact `8cfdd8f` source,
+using the pinned builder with a verified-empty target directory, produced the
+same management executable SHA-256 as its original release build. Docker target
+volumes must use `volume-nocopy`; otherwise Docker populates them with compiled
+files from the builder image and the check reuses artifacts. This establishes
+that Linux management binary comparison only. OCI image timestamps, other
+components and native Windows builds still require separate reproducibility
+checks; ordinary deployment tests do not establish them.
+
+From the repository root, with a working Linux Docker engine and OpenSSL:
+
+```sh
+python3 deployment/linux/test_build_context.py
+docker build --file deployment/linux/Dockerfile --tag swan-management:test .
+python3 deployment/linux/test_container_startup.py swan-management:test
+python3 deployment/linux/test_container_stack.py swan-management:test
+```
+
+The context test uses tracked public source and synthetic canaries, never local
+credentials. The container test uses uniquely named disposable storage and a
+loopback-only listener. It checks fresh setup, MFA and replay denial, required
+device approval, policy denial, graceful shutdown and persisted company/device
+identity. It also uses the real CLI for encrypted management backup and a second
+volume for restore, checking wrong-password rejection before writes, retained
+branding/policy/enrollment/consent, private key permissions, MFA replay denial
+and revocation. Passphrases enter the CLI through stdin and stay out of arguments
+and Docker container metadata. The test removes only its own containers and
+volumes. Management-only restore does not prove transport or TLS-volume recovery.
+These are actual Docker checks, but are not evidence for public
+HTTPS, transport sessions, worker-generated installations, certificate renewal
+or the Windows compatibility matrix.
+
+The component-stack test runs the pinned Caddy and RustDesk images on a private
+Docker network with loopback-only published ports. It adds an internal test
+issuer to a disposable copy of the proxy recipe, disables trust-store
+installation, and verifies HTTPS using that CA explicitly. Default system trust
+must reject the connection. It verifies real signed profiles, tamper/wrong-key
+rejection, setup, MFA/enrollment/logout and retained company/transport trust
+after restart. Native NAT-test replies prove local rendezvous protocol readiness;
+they do not demonstrate NAT traversal or an authorized remote desktop session.
+The test also stops the components, exports management, actual transport keys
+and database, private deployment settings and Caddy storage into one encrypted
+archive, then restores into separate volumes. A wrong password must fail before
+creating restore files. Replacement services must retain the original HTTPS
+CA, signed company profile, transport identity, enrollment and consent. MFA
+replay, logged-out credentials and revoked device access remain denied; revoking
+a device in the replacement must leave the original deployment unchanged.
+Private keys remain inside volumes and the backup passphrase enters through
+stdin. Empty storage directories need not appear in the archive; every original
+TLS file must match the recovered copy.
+Public ACME, UDP and external direct/relay sessions remain separate gates.
+The company-product CI runs all three checks.
diff --git a/deployment/linux/automatic-branding-sync-evidence.json b/deployment/linux/automatic-branding-sync-evidence.json
new file mode 100644
index 00000000000..8d74d452694
--- /dev/null
+++ b/deployment/linux/automatic-branding-sync-evidence.json
@@ -0,0 +1,17 @@
+{
+  "signed_profile_revision": 2,
+  "signature_independently_verified_against_original_pin": true,
+  "automatic_customer_watcher_sync": true,
+  "explicit_sync_command_used": false,
+  "installer_rebuilt_or_reinstalled": false,
+  "device_identity_preserved": true,
+  "company_identity_preserved": true,
+  "consent_preserved": true,
+  "software_release_sequence_preserved": true,
+  "customer_service_running": true,
+  "original_proof_sha256": "3e3ac64f208723835ae6ac5a6a32761362b6177bac8b6e91905c2e91002e071f",
+  "native_visible_ui_or_offline_behavior_qualified": false,
+  "date": "2026-10-26",
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "scope": "Installed Server2019 customer configuration watcher synchronized a newly signed company branding revision without an explicit sync command or reinstall. Native visible UI, offline operation, restart and upgrade persistence remain separate."
+}
diff --git a/deployment/linux/company-full-backup-restore-evidence.json b/deployment/linux/company-full-backup-restore-evidence.json
new file mode 100644
index 00000000000..a20d4c88182
--- /dev/null
+++ b/deployment/linux/company-full-backup-restore-evidence.json
@@ -0,0 +1,34 @@
+{
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "customer_bootstrap_unchanged": true,
+  "company_identity_and_branding_preserved": true,
+  "restored_signed_profile_original_pin_verified": true,
+  "encrypted_archive": {
+    "sha256": "d9440d79d10287bcf2650888bef0f394123c1e915c0c8daf21f368a96cf2e709",
+    "bytes": 62837628,
+    "passphrase_stored_separately": true
+  },
+  "limitations": [
+    "Initial HTTPS verification through an internal-only Docker network timed out. The original attempt and restored storage were retained; a separate ordinary Docker bridge with loopback-only HTTPS passed without changing TLS trust or restored data.",
+    "Transport startup and exact restored keys/storage were checked. No native desktop session, public NAT traversal or Internet certificate renewal was exercised.",
+    "The existing Windows customer credential was read privately on that guest and used for a device-status API check against the restored endpoint; its configured server and credential were not changed.",
+    "This qualifies the independent Linux lab recovery path. Full Windows company-server recovery remains separate."
+  ],
+  "proxy_and_deployment_settings_match": true,
+  "wrong_password_rejected_before_writes": true,
+  "private_plaintext_keys_copied_to_host": false,
+  "restored_https_original_root_and_hostname_validated": true,
+  "complete_tls_file_tree_matches": true,
+  "both_original_download_links_and_hashes_work": true,
+  "restored_administrator_mfa_login": true,
+  "full_product_acceptance": false,
+  "original_company_endpoints_unchanged": true,
+  "recovery_clone_stopped": true,
+  "transport_key_pair_matches": true,
+  "both_installer_artifact_files_match": true,
+  "existing_windows_customer_credential_authenticates": true,
+  "restored_transport_components_running": true,
+  "logout_revocation_after_restore": true,
+  "date": "2026-10-26",
+  "device_identity_approval_and_consent_preserved": true
+}
diff --git a/deployment/linux/company-worker-bundle-evidence.json b/deployment/linux/company-worker-bundle-evidence.json
new file mode 100644
index 00000000000..5ff02965c18
--- /dev/null
+++ b/deployment/linux/company-worker-bundle-evidence.json
@@ -0,0 +1,43 @@
+{
+  "worker_signed_sha256": "9a3b67ee8a90944c7443d3cfa00a4ac921ddbb44ab98f0f9670ed23aa7cba84a",
+  "full_product_acceptance": false,
+  "worker_unsigned_current_source_byte_identity_verified": true,
+  "independent_linux_company": true,
+  "production_signing": false,
+  "test_channel_only": true,
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "editions": [
+    {
+      "signed_payload_hashes_verified": true,
+      "seven_source_texts_exact": true,
+      "download_status": 200,
+      "anonymous_status": 200,
+      "edition": "customer",
+      "bundle_sha256": "f276b6e74adf33ce990684cfb505803211fcc9dc67185d2f28160bcdb0a6f84c",
+      "bytes": 32508760,
+      "profile_and_release_signatures_verified": true,
+      "public_bootstrap_only": true,
+      "tamper_rejection_verified": true
+    },
+    {
+      "signed_payload_hashes_verified": true,
+      "seven_source_texts_exact": true,
+      "download_status": 200,
+      "anonymous_status": 401,
+      "edition": "technician",
+      "bundle_sha256": "21ae1dcf0239debfd096cfed652e09be50196f7c25d3ecd90755b992d5f9a4ec",
+      "bytes": 30301818,
+      "profile_and_release_signatures_verified": true,
+      "public_bootstrap_only": true,
+      "tamper_rejection_verified": true
+    }
+  ],
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "limitations": [
+    "Lab-signed Server2019-only test releases; no production signing or public Internet reachability claimed.",
+    "Completed bundle generation and download checks do not establish customer installation, enrollment, native sessions, automatic rollout or the remaining OS matrix."
+  ],
+  "worker_os": "Windows Server 2019 x64 build 17763.3650",
+  "updates_paused": true,
+  "date": "2026-10-26"
+}
diff --git a/deployment/linux/company.env.example b/deployment/linux/company.env.example
new file mode 100644
index 00000000000..19a28689294
--- /dev/null
+++ b/deployment/linux/company.env.example
@@ -0,0 +1,3 @@
+SWAN_HOST=support.example.com
+# Public key only. Never place the project signing private key on a company server.
+SWAN_RELEASE_PUBLIC_KEY=REPLACE_WITH_PROJECT_RELEASE_PUBLIC_KEY
diff --git a/deployment/linux/compose.maintained-transport.yaml b/deployment/linux/compose.maintained-transport.yaml
new file mode 100644
index 00000000000..ba965600309
--- /dev/null
+++ b/deployment/linux/compose.maintained-transport.yaml
@@ -0,0 +1,13 @@
+# Explicit candidate deployment; never run against existing company volumes
+# without the documented backup and migration procedure.
+services:
+  hbbs:
+    image: swan-transport:maintained-test
+    build:
+      context: ../..
+      dockerfile: deployment/transport/Dockerfile
+  hbbr:
+    image: swan-transport:maintained-test
+    build:
+      context: ../..
+      dockerfile: deployment/transport/Dockerfile
diff --git a/deployment/linux/compose.yaml b/deployment/linux/compose.yaml
new file mode 100644
index 00000000000..7a61919d8f7
--- /dev/null
+++ b/deployment/linux/compose.yaml
@@ -0,0 +1,48 @@
+name: swan-company-server
+services:
+  management:
+    build:
+      context: ../..
+      dockerfile: deployment/linux/Dockerfile
+    restart: unless-stopped
+    environment:
+      SWAN_RELEASE_PUBLIC_KEY: ${SWAN_RELEASE_PUBLIC_KEY:?Set the trusted project release public key}
+    volumes:
+      - management-data:/var/lib/swan
+    networks: [management]
+    security_opt: [no-new-privileges:true]
+    read_only: true
+    tmpfs: [/tmp]
+  https:
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    restart: unless-stopped
+    environment:
+      SWAN_HOST: ${SWAN_HOST:?Set the public company server hostname}
+    ports: ["80:80", "443:443", "443:443/udp"]
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    networks: [management]
+  hbbs:
+    image: rustdesk/rustdesk-server:1.1.15@sha256:10818ec05b179039c6660f4d8e74b303f0db2858bbad2b18e24992ea22d54cd6
+    command: ["hbbs", "-r", "${SWAN_HOST}:21117", "-k", "_"]
+    restart: unless-stopped
+    ports: ["21115:21115", "21116:21116", "21116:21116/udp"]
+    volumes: ["transport-data:/root"]
+    networks: [transport]
+  hbbr:
+    image: rustdesk/rustdesk-server:1.1.15@sha256:10818ec05b179039c6660f4d8e74b303f0db2858bbad2b18e24992ea22d54cd6
+    command: ["hbbr", "-k", "_"]
+    restart: unless-stopped
+    ports: ["21117:21117"]
+    volumes: ["transport-data:/root"]
+    networks: [transport]
+networks:
+  management:
+  transport:
+volumes:
+  management-data:
+  transport-data:
+  caddy-data:
+  caddy-config:
diff --git a/deployment/linux/customer-offline-controls-evidence.json b/deployment/linux/customer-offline-controls-evidence.json
new file mode 100644
index 00000000000..3fbee9796df
--- /dev/null
+++ b/deployment/linux/customer-offline-controls-evidence.json
@@ -0,0 +1,31 @@
+{
+  "os": "Windows Server2019 x64 build 17763.3650",
+  "installed_hash_and_signature_valid_after_resume": true,
+  "customer_window_initially_not_responding": true,
+  "customer_window_later_responsive_while_offline": true,
+  "full_product_acceptance": false,
+  "management_offline_started_utc": "2026-10-26T19:51:37.281183Z",
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "resume_control_restored_customer_service": true,
+  "stop_control_changed_to_resume": true,
+  "device_identity_preserved": true,
+  "profile_revision_after_resume": 2,
+  "guest_free_memory_mib_at_observation": 444,
+  "customer_service_absent_after_stop": true,
+  "company_identity_preserved": true,
+  "management_restored_utc": "2026-10-26T21:56:44.1364+02:00",
+  "consent_preserved": true,
+  "worker_preserved_during_stop": true,
+  "limitations": [
+    "The customer window initially became unresponsive, then recovered. Support-control state changes were delayed. Root cause and acceptable latency remain unresolved.",
+    "This was a 2GiB disposable guest with 444MiB free at the recorded observation. Resource pressure is a hypothesis, not an established cause.",
+    "No active remote session was running. Immediate session termination, standard-user controls, offline authorization denial and complete restart/upgrade behavior are not qualified.",
+    "The original Linux management container restarted automatically and retained its identity and branding revision. This is a service-restart check, not encrypted backup/restore."
+  ],
+  "guest_process_health_observation_utc": "2026-10-26T19:55:27.9961828Z",
+  "cached_updated_branding_visible": true,
+  "date": "2026-10-26",
+  "native_customer_started_during_offline_window": true,
+  "release_sequence_after_resume": 1,
+  "original_resume_record_sha256": "76ab1f00db976dbf252d1f18ac247858231548e8372608b45b50f8a5dbab660c"
+}
diff --git a/deployment/linux/export_transport_candidate.py b/deployment/linux/export_transport_candidate.py
new file mode 100644
index 00000000000..540f722e0f0
--- /dev/null
+++ b/deployment/linux/export_transport_candidate.py
@@ -0,0 +1,69 @@
+"""Retain public candidate binaries and their exact source from the tested image."""
+import hashlib
+import json
+from pathlib import Path, PurePosixPath
+import subprocess
+import sys
+import zipfile
+
+from test_container_stack import ROOT, maintained_transport_image
+from test_container_startup import docker
+
+
+def main():
+    if len(sys.argv) != 2:
+        raise SystemExit("Expected a new candidate artifact directory")
+    output = Path(sys.argv[1]).resolve()
+    if output.exists():
+        raise SystemExit("Candidate artifact directory already exists")
+    image = maintained_transport_image()
+    revision = subprocess.check_output(["git", "-C", str(ROOT), "rev-parse", "HEAD"], text=True).strip()
+    output.mkdir(parents=True)
+    container = docker("create", "--network", "none", image)
+    # No candidate executable runs during extraction. Remove only this owned,
+    # stopped extraction container; failed output remains available for diagnosis.
+    try:
+        files = {"hbbs": "/usr/local/bin/hbbs", "hbbr": "/usr/local/bin/hbbr"}
+        files.update({name: "/usr/share/doc/swan-transport/" + name for name in
+                      ["SWAN-SOURCE.json", "transport-build-source.zip", "LICENCE"]})
+        for name, remote in files.items():
+            docker("cp", container + ":" + remote, str(output / name))
+            path = output / name
+            if path.is_symlink() or not path.is_file() or not 0 < path.stat().st_size <= 128 * 1024**2:
+                raise RuntimeError("Unexpected candidate artifact")
+        for name in ["hbbs", "hbbr"]:
+            with (output / name).open("rb") as binary:
+                header = binary.read(20)
+            if header[:6] != b"\x7fELF\x02\x01" or header[18:20] != b"\x3e\x00":
+                raise RuntimeError("Expected Linux x86-64 transport executable")
+        receipt = json.loads((output / "SWAN-SOURCE.json").read_text())
+        with zipfile.ZipFile(output / "transport-build-source.zip") as archive:
+            entries = archive.infolist()
+            if len(entries) != len({entry.filename for entry in entries}) or sum(entry.file_size for entry in entries) > 64 * 1024**2:
+                raise RuntimeError("Duplicate or oversized transport source")
+            for entry in entries:
+                path = PurePosixPath(entry.filename)
+                if path.is_absolute() or ".." in path.parts or "\\" in entry.filename or entry.is_dir():
+                    raise RuntimeError("Unsafe transport source archive entry")
+            if archive.testzip() is not None:
+                raise RuntimeError("Transport source CRC mismatch")
+            if json.loads(archive.read("rustdesk-server/SWAN-SOURCE.json")) != receipt:
+                raise RuntimeError("Source archive and executable image receipts differ")
+            udp = archive.read("rustdesk-server/libs/hbb_common/src/udp.rs").replace(b"\r\n", b"\n")
+            if hashlib.sha256(udp).hexdigest() != receipt["patched_udp_sha256"]:
+                raise RuntimeError("Archived source lacks the reviewed UDP patch")
+        manifest = {"schema": 1, "candidate_only": True, "production_approved": False,
+                    "repository": "https://github.com/rijff24/SwanRemoteSupport", "image_id": image,
+                    "packaging_revision": revision, "transport_recipe_revision": receipt["project_revision"],
+                    "dockerfile_sha256": hashlib.sha256((ROOT / "deployment/transport/Dockerfile").read_bytes()).hexdigest(),
+                    "files": {name: {"sha256": hashlib.sha256((output / name).read_bytes()).hexdigest(),
+                                     "bytes": (output / name).stat().st_size} for name in files},
+                    "scope": "Public unsigned Linux candidate build inputs and outputs; not binary reproducibility or release approval"}
+        (output / "SOURCE.json").write_text(json.dumps(manifest, indent=2), encoding="utf-8")
+        print("Retained Linux x86-64 candidate binaries, reviewed patched source, receipt and license.")
+    finally:
+        docker("rm", container)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/linux/fresh-company-lab-evidence.json b/deployment/linux/fresh-company-lab-evidence.json
new file mode 100644
index 00000000000..ff917958bfe
--- /dev/null
+++ b/deployment/linux/fresh-company-lab-evidence.json
@@ -0,0 +1,30 @@
+{
+  "date": "2026-10-26",
+  "source_revision": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "tracked_source_archive_sha256": "af80b7e34db21d642907bdc30b17d884f7617dbe0387bbb3d5a051b3c20d831e",
+  "management_image_build_exit": 0,
+  "cargo_build_jobs": 2,
+  "fresh_independent_company": true,
+  "existing_company_keys_copied": false,
+  "host_published_ports_loopback_only": true,
+  "verified": {
+    "https_certificate_and_hostname": true,
+    "host_default_trust_rejects_lab_ca": true,
+    "signed_profile_and_custom_branding": true,
+    "administrator_totp_login": true,
+    "invalid_totp_rejected": true,
+    "totp_replay_rejected": true,
+    "fresh_inventory_empty": true,
+    "anonymous_inventory_denied": true,
+    "protected_worker_registration": true,
+    "anonymous_worker_inventory_denied": true,
+    "logged_out_token_denied": true
+  },
+  "limitations": [
+    "An internal lab HTTPS issuer was trusted explicitly by the test connection only. Public ACME and Internet reachability remain untested.",
+    "New lab-only accounts, company keys and release issuer are isolated from the preserved existing company. Private inputs stay outside Git.",
+    "This verifies the Linux stack and management API; Windows server setup and full Windows restore remain separate requirements.",
+    "A Windows worker has not yet consumed the new credential. Company package generation, native enrollment, sessions and automatic rollout remain unqualified for this company."
+  ],
+  "full_product_acceptance": false
+}
diff --git a/deployment/linux/generated-customer-enrollment-evidence.json b/deployment/linux/generated-customer-enrollment-evidence.json
new file mode 100644
index 00000000000..94b2d3b874e
--- /dev/null
+++ b/deployment/linux/generated-customer-enrollment-evidence.json
@@ -0,0 +1,26 @@
+{
+  "downloaded_generated_bundle": true,
+  "guest_install_command_exit": 0,
+  "company_identity_matches": true,
+  "device_identity_matches_server": true,
+  "server_approval_state": "pending",
+  "grant_before_approval_status": 403,
+  "customer_service_running": true,
+  "worker_service_preserved": true,
+  "unattended_consent": false,
+  "pending_install_absent": true,
+  "profile_revision": 1,
+  "release_sequence": 1,
+  "manual_address_edit": false,
+  "tailscale_required": false,
+  "guest_proof_sha256": "46e3d7b4c4d8c8d9c82d01277d205f4c55074bfa03c8ff40292b1e6ee61f3372",
+  "native_session_qualified": false,
+  "date": "2026-10-26",
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "os": "Windows Server 2019 x64 build 17763.3650",
+  "limitations": [
+    "Lab CA installed only on the disposable guest; no public Internet or production signing claim.",
+    "Installation invoked the generated company script from an administrator session with explicit lab company confirmation; customer UAC and standard-user technician behavior remain separate.",
+    "Pre-approval grant denial is a management API check; receiving native protocol enforcement, approved sessions, public direct/relay connectivity and updates remain open."
+  ]
+}
diff --git a/deployment/linux/generated-technician-setup-evidence.json b/deployment/linux/generated-technician-setup-evidence.json
new file mode 100644
index 00000000000..78b4b718ff9
--- /dev/null
+++ b/deployment/linux/generated-technician-setup-evidence.json
@@ -0,0 +1,17 @@
+{
+  "release_sequence": 2,
+  "current_branding_received": true,
+  "native_session_tested": false,
+  "company_identity_matches": true,
+  "no_device_token_in_technician_state": true,
+  "edition": "technician",
+  "installed_signature_valid": true,
+  "pending_install_absent": true,
+  "technician_login_tested": false,
+  "standard_user_qualified": false,
+  "profile_revision": 2,
+  "date": "2026-10-26",
+  "scope": "Generated company technician bundle installed per-user in owned administrator profile on Server2019. This is not standard-user installation or a technician login/session test.",
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "private_original_record_sha256": "7f0fc56ba8655b1b54757c449122c032b0c83c512dfa0ca238d90ac3f3d58876"
+}
diff --git a/deployment/linux/installed-profile-key-rotation-evidence.json b/deployment/linux/installed-profile-key-rotation-evidence.json
new file mode 100644
index 00000000000..65f3915845d
--- /dev/null
+++ b/deployment/linux/installed-profile-key-rotation-evidence.json
@@ -0,0 +1,103 @@
+{
+  "schema": 1,
+  "observed_utc": "2026-10-26T21:23:15.229005+00:00",
+  "environment": "Independent Linux company, loopback HTTPS with owned Server 2019 Desktop endpoint",
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "installed_application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "before_profile_revision": 3,
+  "prepared_profile_revision": 4,
+  "activated_profile_revision": 5,
+  "both_editions_cached_old_key_signed_transition_before_activation": true,
+  "both_installed_editions_automatically_adopted_new_key": true,
+  "manual_agent_sync_used_for_installed_editions": false,
+  "customer_unattended_consent_remained_revoked": true,
+  "customer_consent_revision": 2,
+  "software_release_sequences_preserved": {
+    "customer": 1,
+    "technician": 2
+  },
+  "missed_transition_shipping_agent_rejected_new_signature": true,
+  "missed_transition_cached_state_byte_identical": true,
+  "negative_harness_note": "PowerShell stopped on expected native signature error; a separate read-only inspection verified unchanged cached state without rerunning sync.",
+  "pre_rotation_encrypted_backup": {
+    "utc": "2026-10-26T21:16:35.635462+00:00",
+    "bytes": 62837995,
+    "sha256": "5c8830582da1f56e6c58c0f02a5a556146b3aadb678d082f89e988bd874ed11d",
+    "separate_passphrase": true
+  },
+  "worker_pin_updated_by_operator_from_trusted_transition": true,
+  "old_both_bundle_links_returned_404": true,
+  "replacement_test_bundles": "Both worker jobs completed; downloaded and independently verified",
+  "production_signing": false,
+  "limitations": [
+    "No active desktop session during rotation; native session termination unqualified",
+    "Only owned Server 2019 endpoint; broader Windows matrix remains open",
+    "Loopback lab HTTPS does not qualify public Internet deployment",
+    "No interrupted activation recovery; restored native transport/session behavior remains unqualified"
+  ],
+  "replacement_bundle_verification": [
+    {
+      "edition": "customer",
+      "bundle_sha256": "89e7d0989d00a97bad4ae4560ca7a24c70e9ce3ebba30ca6f918dcdfa0461dd7",
+      "bytes": 32508756,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "bundle_sha256": "2cda243b34fb5647eba32851784df6ca90f18cef5963f128fa4cdf533703f4f1",
+      "bytes": 30301813,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "post_rotation_encrypted_backup": {
+    "utc": "2026-10-26T21:29:37.159260+00:00",
+    "bytes": 125642740,
+    "sha256": "934ed759b19a6fe364c51fe8eaf33f86dda9620122aa26cf918f7828dd95aa0d",
+    "separate_passphrase": true
+  },
+  "rotated_company_restore": {
+    "utc": "2026-10-26T21:30:48.244867+00:00",
+    "restored_https_original_ca_and_hostname": true,
+    "restored_active_signing_key_from_database": true,
+    "legacy_seed_unchanged": true,
+    "profile_revision": 5,
+    "administrator_mfa": true,
+    "device_approval_identity_and_revoked_consent_preserved": true,
+    "replacement_downloads": [
+      {
+        "edition": "customer",
+        "bundle_sha256": "89e7d0989d00a97bad4ae4560ca7a24c70e9ce3ebba30ca6f918dcdfa0461dd7"
+      },
+      {
+        "edition": "technician",
+        "bundle_sha256": "2cda243b34fb5647eba32851784df6ca90f18cef5963f128fa4cdf533703f4f1"
+      }
+    ],
+    "old_downloads_still_withdrawn": true,
+    "no_native_transport_started": true,
+    "native_session_qualified": false
+  },
+  "restored_existing_device_credential": {
+    "company_and_device_identity_match": true,
+    "approval_state": "approved",
+    "existing_customer_credential_authenticated_to_restored_server": true,
+    "utc": "2026-10-26T21:31:15.5723682Z",
+    "original_https_trust_used": true,
+    "credential_value_disclosed": false,
+    "native_session_tested": false,
+    "customer_bootstrap_and_credential_unchanged": true
+  },
+  "recovery_services_stopped": true
+}
diff --git a/deployment/linux/maintained-transport-and-current-restore-20261028.json b/deployment/linux/maintained-transport-and-current-restore-20261028.json
new file mode 100644
index 00000000000..a93a8204704
--- /dev/null
+++ b/deployment/linux/maintained-transport-and-current-restore-20261028.json
@@ -0,0 +1,144 @@
+{
+  "evidence_date": "2026-10-28",
+  "project_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "transport_recipe": "650361413543baf7ef150f5960544154ec77ddeb",
+  "upstream_transport": "9bae9f2f39d92c4b4ba2e28e089da5071897b22e",
+  "shared_source": "83419b6549636ee39dacef7776c473f5802e08d6",
+  "source_verification": {
+    "artifact": 12798079841,
+    "run_id": 40647659405,
+    "original_public_git_blobs_verified": 132,
+    "reviewed_patched_udp_verified": true,
+    "exact_public_recipe_files_verified": 6,
+    "artifact_hashes_verified": true,
+    "elf_linux_x64_verified": true
+  },
+  "independent_compilation": {
+    "workflow_runs": [
+      40647659405,
+      40647664923
+    ],
+    "independent_jobs": {
+      "40647659405": {
+        "job_id": 122680134783,
+        "name": "linux-deployment",
+        "required_steps_passed": [
+          "Build maintained transport from pinned public source with corresponding source",
+          "Preserve maintained Linux transport binaries and exact patched source",
+          "Rehearse maintained transport with HTTPS, enrollment and complete backup recovery"
+        ]
+      },
+      "40647664923": {
+        "job_id": 122680152595,
+        "name": "linux-deployment",
+        "required_steps_passed": [
+          "Build maintained transport from pinned public source with corresponding source",
+          "Preserve maintained Linux transport binaries and exact patched source",
+          "Rehearse maintained transport with HTTPS, enrollment and complete backup recovery"
+        ]
+      }
+    },
+    "independent_pr_merge": "1ba02cc849fcf55fbbc68d2757f56b35d9e783d0",
+    "project_trees_identical": true,
+    "public_tree": "40d789382280e6577f4f2615ce73ff9cbd9289ef",
+    "source_archive_entries_identical": 140,
+    "original_elf_binaries": {
+      "hbbs": {
+        "sha256": "6bacfa973533248aa24c2917469149d3e08246140f5423160a6da521c3dd018a",
+        "bytes": 9543512,
+        "original_bytes_identical": true,
+        "normalized": false
+      },
+      "hbbr": {
+        "sha256": "132ab0c989a110a3335220d1afbbdf022afa559cf9bec23b8419f473d04388a3",
+        "bytes": 3269592,
+        "original_bytes_identical": true,
+        "normalized": false
+      }
+    },
+    "oci_images_or_zip_metadata_identical_not_claimed": true
+  },
+  "isolated_runtime": {
+    "verified_public_executable_hashes": true,
+    "embedded_exact_source_verified": true,
+    "private_key_file_mode": "600",
+    "private_key_directory_mode": "700",
+    "host_ports_published": false,
+    "new_isolated_keys_only": true,
+    "private_key_exported": false,
+    "original_company_container_ids_unchanged": true,
+    "original_company_healthy": true
+  },
+  "current_full_backup": {
+    "bytes": 439647643,
+    "sha256": "61e947aee5cedbcc73b4fd50cc68446dc8eb76c99d15653fdf1a34eba9eb5e76",
+    "installer_artifact_count": 14,
+    "installer_artifact_bytes": 439582017,
+    "profile_revision": 14,
+    "separate_passphrase": true
+  },
+  "independent_restore": {
+    "restored_https_original_ca_and_hostname": true,
+    "restored_active_signing_key_from_database": true,
+    "legacy_seed_unchanged": true,
+    "profile_revision": 14,
+    "administrator_mfa": true,
+    "device_approval_identity_and_revoked_consent_preserved": true,
+    "all_four_device_records_preserved": true,
+    "all_fourteen_installer_artifacts_readable_by_service_uid": true,
+    "current_proxy_configuration_and_complete_tls_match": true,
+    "current_bundle_downloads": [
+      {
+        "edition": "customer",
+        "authenticated": false,
+        "status": 200,
+        "hash_matched": true
+      },
+      {
+        "edition": "customer",
+        "authenticated": true,
+        "status": 200,
+        "hash_matched": true
+      },
+      {
+        "edition": "technician",
+        "authenticated": false,
+        "status": 401,
+        "hash_matched": false
+      },
+      {
+        "edition": "technician",
+        "authenticated": true,
+        "status": 200,
+        "hash_matched": true
+      }
+    ],
+    "release_approvals_match_backup": true,
+    "failed_152_downloads_still_withdrawn": true,
+    "no_native_transport_started": true
+  },
+  "owned_lab_migration": {
+    "candidate_image": "sha256:3e879d6f3954ff2bc750ab02cdea43e05894e75cd4f8d288c411450d2fae93ca",
+    "full_restore_and_current_downloads_verified": true,
+    "original_company_vm_or_host_rustdesk_changed": false,
+    "only_owned_fresh_linux_lab": true,
+    "private_keys_copied_to_host": false,
+    "original_and_restored_private_public_keys_unchanged": true,
+    "profile_transport_pin_matches": true,
+    "management_https_container_ids_unchanged": true,
+    "devices_consent_and_release_approvals_unchanged": true,
+    "existing_company_healthy": true,
+    "candidate_transport_active_in_owned_lab": true,
+    "native_direct_relay_and_udp_qualification_pending": true
+  },
+  "tcp_startup_only_not_native_session_proof": true,
+  "machine_configuration_or_credentials_in_receipt": false,
+  "normal_production_compose_pins_changed": false,
+  "production_publication": false,
+  "remaining": [
+    "Actual authorized native direct and relay sessions through this maintained Linux transport.",
+    "Negative receiving-device authorization tests on both transports.",
+    "Public Internet reachability, NAT traversal and CGNAT qualification.",
+    "Production release approval and signing."
+  ]
+}
diff --git a/deployment/linux/native-technician-interface-evidence.json b/deployment/linux/native-technician-interface-evidence.json
new file mode 100644
index 00000000000..c709a4c7ca6
--- /dev/null
+++ b/deployment/linux/native-technician-interface-evidence.json
@@ -0,0 +1,21 @@
+{
+  "os": "Windows Server 2019 x64 build 17763.3650",
+  "generated_technician_bundle_installed": true,
+  "original_verified_launcher_used": true,
+  "actual_desktop_session": 1,
+  "company_branding_visible": true,
+  "updated_signed_branding_visible": true,
+  "company_https_origin_visible": true,
+  "username_password_and_totp_entered_only_in_native_form": true,
+  "gui_mfa_sign_in_succeeded": true,
+  "authorized_device_and_group_visible": true,
+  "session_history_visible": true,
+  "independent_server_login_audit_matches": true,
+  "same_machine_customer_and_technician": true,
+  "native_remote_session_exercised": false,
+  "standard_user_install_qualified": false,
+  "full_product_acceptance": false,
+  "date": "2026-10-26",
+  "gui_sign_out_clears_inventory_and_secret_fields": true,
+  "scope": "Original verified technician launcher on owned administrator console. Company branding, MFA form sign-in, authorized device/group, history and sign-out observed in the real Flutter interface. Same-machine endpoint; no remote desktop session or standard-user installation claimed."
+}
diff --git a/deployment/linux/native-unattended-consent-evidence.json b/deployment/linux/native-unattended-consent-evidence.json
new file mode 100644
index 00000000000..2259037fdf6
--- /dev/null
+++ b/deployment/linux/native-unattended-consent-evidence.json
@@ -0,0 +1,29 @@
+{
+  "native_confirmation_identifies_company_and_signin_screen_access": true,
+  "native_revocation_persisted_locally": true,
+  "server_consent_false_after_revoke": true,
+  "company_policy_allows_unattended": true,
+  "subsequent_unattended_grant_status": 403,
+  "signed_policy_revision": 3,
+  "customer_service_remains_running": true,
+  "local_consent_revision_after_optin": 1,
+  "date": "2026-10-26",
+  "grant_signature_and_identity_bindings_verified": true,
+  "device_initially_requires_customer_approval": true,
+  "limitations": [
+    "These native GUI consent operations were performed in the owned administrator desktop. Standard-user consent controls remain separate.",
+    "The signed unattended grant was never claimed by a receiving native device and had expired before the final closure inspection. No active-session or unexpired-lease termination is qualified.",
+    "Company policy and device consent, identity-bound grant issuance and subsequent management denial were tested. Actual unattended desktop, reboot/logon-screen access, UAC and public transport remain separate requirements."
+  ],
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "prior_unused_grant_closed_and_lease_cleared": true,
+  "full_product_acceptance": false,
+  "consent_revision_increases_on_revoke": true,
+  "prior_grant_still_time_valid_at_final_check": false,
+  "unattended_grant_before_device_consent_status": 403,
+  "os": "Windows Server2019 x64 build 17763.3650",
+  "software_release_sequence_preserved": true,
+  "server_records_device_consent": true,
+  "authorized_unattended_grant_after_consent_status": 200,
+  "native_explicit_optin_persisted": true
+}
diff --git a/deployment/linux/pre-153-company-backup-restore-evidence.json b/deployment/linux/pre-153-company-backup-restore-evidence.json
new file mode 100644
index 00000000000..23c4ea214a8
--- /dev/null
+++ b/deployment/linux/pre-153-company-backup-restore-evidence.json
@@ -0,0 +1,109 @@
+{
+  "schema": 1,
+  "observed_utc": "2026-10-27T07:55:08.505526+00:00",
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "purpose": "Fresh Linux company recovery checkpoint before 1.5.3 runtime qualification",
+  "backup": {
+    "bytes": 251256558,
+    "sha256": "3bb8ebefd8d1e838dcafed89383414e27d5ec2366515cba127c1e26000ff09ae",
+    "encrypted": true,
+    "passphrase_stored_separately": true,
+    "includes": [
+      "management database and configuration",
+      "company trust keys",
+      "transport keys",
+      "HTTPS storage",
+      "deployment environment",
+      "generated installer artifacts"
+    ]
+  },
+  "preconditions": {
+    "no_claimed_live_session": true,
+    "no_queued_or_running_installer_job": true,
+    "failed_152_releases_unapproved": true
+  },
+  "restore": {
+    "utc": "2026-10-27T07:53:57.615325+00:00",
+    "restored_https_original_ca_and_hostname": true,
+    "restored_active_signing_key_from_database": true,
+    "legacy_seed_unchanged": true,
+    "profile_revision": 5,
+    "administrator_mfa": true,
+    "device_approval_identity_and_revoked_consent_preserved": true,
+    "withdrawn_downloads": [
+      {
+        "edition": "customer",
+        "withdrawn_download_status": 404
+      },
+      {
+        "edition": "technician",
+        "withdrawn_download_status": 404
+      }
+    ],
+    "both_device_records_preserved": true,
+    "release_approvals_match_backup": true,
+    "failed_152_downloads_still_withdrawn": true,
+    "no_native_transport_started": true,
+    "native_session_qualified": false
+  },
+  "after": {
+    "utc": "2026-10-27T07:55:08.505526+00:00",
+    "recovery_containers": {
+      "management": "exited",
+      "https": "exited"
+    },
+    "original_https_healthy": true,
+    "original_signed_profile_current": true,
+    "profile_revision": 5,
+    "updates_paused": true,
+    "original_company_volumes_not_replaced": true
+  },
+  "source_receipts": {
+    "pre-loaderfix153-backup-start.json": "9570b70a86c68b85f7a2b9441bd9ef75be0104e612c7314611d8aadbbb1a70a0",
+    "pre-loaderfix153-backup-completed.json": "273771adfb5f96ffd14e686375739fc998fbeaa5775d9b8855712233e2fe5650",
+    "loaderfix153-restore-verified.json": "ecce3beff8d0eb9967fd20bca81162adc32057b8b53afe48dd859efd13b05b36",
+    "loaderfix153-restore-stopped.json": "9b8cb17e7e861bb3ae7857ef8ba17532f5c1e0d1b7a1b4d9607e090250c06417",
+    "loaderfix153-restore-independent-stop-health.json": "baf298f6840770067250820cc7e31f6dfbd9be1dc37a38b7b35cbd5b0ef7bfc0",
+    "pre153-restored-customer-credential-bounded-result.json": "38448d1398e347e695c3833dc622f0aac2adfbb4ace666597f35411c90b11683",
+    "post-recovery-win10-restored-native-token-verified.json": "556b438e0424c1c0c489e5737b70ff3b6689ffd6c401b1498e4f5677e96454fb",
+    "post-recovery-win10-restored-native-token-clone-stopped.json": "5215e28a5f5677dbac844ce4880f0025c9c79f7e7a012d5a66d2d4ac3c7edc0b"
+  },
+  "limits": [
+    "Isolated Linux company restore only; does not qualify the separate Windows server restore path.",
+    "Restored transport was not started; no native connection to the clone was attempted.",
+    "No 1.5.3 binaries installed or automatic-update recovery exercised by this test.",
+    "Lab signing and private HTTPS trust do not establish production signing or public Internet reachability."
+  ],
+  "production_publication": false,
+  "installed_customer_credential_reuse": {
+    "utc": "2026-10-27T08:12:54.478715+00:00",
+    "server2019_existing_customer_credential_restore": {
+      "company_and_device_identity_match": true,
+      "approval_state": "approved",
+      "existing_customer_credential_authenticated_to_restored_server": true,
+      "utc": "2026-10-27T07:59:07.0361530Z",
+      "original_https_trust_used": true,
+      "credential_value_disclosed": false,
+      "native_session_tested": false,
+      "customer_bootstrap_and_credential_unchanged": true,
+      "endpoint_os": "Windows Server 2019"
+    },
+    "windows10_result": "Not tested: SSH timed out; subsequent trace authenticated but session command startup stalled. Guest normal shutdown requested, not forced.",
+    "recovery_containers_independently_confirmed_stopped": true,
+    "private_credentials_exported": false,
+    "both_customer_credentials_verified": false,
+    "native_session_tested": false
+  },
+  "windows10_credential_after_normal_recovery": {
+    "company_and_device_identity_match": true,
+    "approval_state": "approved",
+    "existing_customer_credential_authenticated_to_restored_server": true,
+    "utc": "2026-10-27T08:17:30.6749819Z",
+    "original_https_trust_used": true,
+    "credential_value_disclosed": false,
+    "native_session_tested": false,
+    "customer_bootstrap_and_credential_unchanged": true
+  },
+  "both_installed_customer_credentials_authenticated_after_restore": true,
+  "normal_power_cycle_not_full_kernel_restart": true
+}
diff --git a/deployment/linux/shipping-agent-cached-policy-negative-evidence.json b/deployment/linux/shipping-agent-cached-policy-negative-evidence.json
new file mode 100644
index 00000000000..d875968ea77
--- /dev/null
+++ b/deployment/linux/shipping-agent-cached-policy-negative-evidence.json
@@ -0,0 +1,72 @@
+{
+  "schema": 1,
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "shipping_agent_sha256": "c7bfac26344a8f46aa2238b631e3be25785eaaeb5fd721cbf844c438be4d6206",
+  "environment": "Owned Server 2019 Desktop lab endpoint",
+  "command": "verify-bootstrap with process-local SWAN_STATE_DIR and isolated public-only state copies",
+  "network_used": false,
+  "existing_installed_state_modified": false,
+  "cached_validation": {
+    "utc": "2026-10-26T21:26:20.2022527Z",
+    "shipping_agent_sha256": "c7bfac26344a8f46aa2238b631e3be25785eaaeb5fd721cbf844c438be4d6206",
+    "cases": [
+      {
+        "accepted": true,
+        "case": "valid-control",
+        "error": "",
+        "state_unchanged": true,
+        "exit_code": 0
+      },
+      {
+        "accepted": false,
+        "case": "tampered-payload",
+        "error": "Error: Invalid signature\n\nCaused by:\n    0: signature error: Verification equation was not satisfied\n    1: Verification equation was not satisfied",
+        "state_unchanged": true,
+        "exit_code": 1
+      },
+      {
+        "accepted": false,
+        "case": "wrong-company",
+        "error": "Error: Wrong company or schema",
+        "state_unchanged": true,
+        "exit_code": 1
+      },
+      {
+        "accepted": false,
+        "case": "older-revision",
+        "error": "Error: Replayed profile",
+        "state_unchanged": true,
+        "exit_code": 1
+      }
+    ],
+    "network_not_used": true
+  },
+  "expiration_validation": {
+    "installed_company_state_unchanged": true,
+    "utc": "2026-10-26T21:27:29.1362011Z",
+    "cases": [
+      {
+        "accepted": true,
+        "case": "signed-valid-control",
+        "error": "",
+        "state_unchanged": true,
+        "exit_code": 0
+      },
+      {
+        "accepted": false,
+        "case": "signed-expired",
+        "error": "Error: Expired or future profile",
+        "state_unchanged": true,
+        "exit_code": 1
+      }
+    ],
+    "fresh_disposable_fixture_issuer_only": true,
+    "network_not_used": true
+  },
+  "expiration_issuer": "Fresh disposable test key; private key never persisted or transferred; valid and expired controls signed by the same fixture issuer",
+  "limitations": [
+    "Does not prove incoming hostile HTTPS profile rejection",
+    "Does not prove session receiver authorization or live session termination",
+    "Does not qualify non-administrator execution or other Windows versions"
+  ]
+}
diff --git a/deployment/linux/technician-authorization-evidence.json b/deployment/linux/technician-authorization-evidence.json
new file mode 100644
index 00000000000..e1dcf359597
--- /dev/null
+++ b/deployment/linux/technician-authorization-evidence.json
@@ -0,0 +1,18 @@
+{
+  "actual_native_enrolled_device_approved": true,
+  "technician_totp_logins": 2,
+  "assigned_technician_inventory_contains_device": true,
+  "unassigned_technician_inventory_empty": true,
+  "unassigned_grant_status": 403,
+  "technician_admin_worker_creation_status": 401,
+  "unattended_without_consent_status": 403,
+  "authorized_attended_grant_signature_verified": true,
+  "grant_company_device_technician_proof_and_expiry_verified": true,
+  "group_revocation_denies_inventory_and_new_grants": true,
+  "authorized_group_access_restored": true,
+  "resumed_test_sessions_logged_out": true,
+  "first_attempt_unused_tokens_expire_normally": true,
+  "native_protocol_session_or_lease_qualified": false,
+  "date": "2026-10-26",
+  "scope": "Management API authorization against the device enrolled by the generated native customer installer. No receiving native session or lease was exercised."
+}
diff --git a/deployment/linux/test_backup_memory.py b/deployment/linux/test_backup_memory.py
new file mode 100644
index 00000000000..4921e249302
--- /dev/null
+++ b/deployment/linux/test_backup_memory.py
@@ -0,0 +1,170 @@
+"""Run the real backup/restore CLI above its former cap with a bounded address space.
+
+Uses generated, disposable company state only. Never accepts a live data path.
+"""
+import hashlib
+import json
+import os
+from pathlib import Path
+import resource
+import secrets
+import shutil
+import signal
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+
+
+def main():
+    binary = Path(sys.argv[1]).resolve(strict=True)
+    output = Path(sys.argv[2])
+    assert not output.exists(), "Preserve the existing qualification receipt"
+    memory_limit = 512 * 1024**2
+    chunk_size = 1024**2
+    assert shutil.disk_usage(tempfile.gettempdir()).free >= 4 * 1024**3
+
+    def bound_memory():
+        resource.setrlimit(resource.RLIMIT_AS, (memory_limit, memory_limit))
+
+    def bound_file_size():
+        bound_memory()
+        # Exercise a real write error without exhausting the runner's disk.
+        # Keep SIGXFSZ ignored across exec so the CLI can run its error cleanup.
+        signal.signal(signal.SIGXFSZ, signal.SIG_IGN)
+        resource.setrlimit(resource.RLIMIT_FSIZE, (2 * chunk_size, 2 * chunk_size))
+
+    with tempfile.TemporaryDirectory(prefix="swan-backup-memory-") as temporary:
+        root = Path(temporary)
+        data = root / "company"
+        data.mkdir(mode=0o700)
+        with sqlite3.connect(data / "management.sqlite3") as db:
+            db.executescript("CREATE TABLE identity(value TEXT); INSERT INTO identity VALUES('generated company fixture');")
+        key = secrets.token_bytes(32)
+        (data / "profile-key.hex").write_text(key.hex(), encoding="ascii")
+        (data / "setup-token.txt").write_text(secrets.token_urlsafe(32), encoding="ascii")
+        artifacts = data / "artifacts"
+        artifacts.mkdir(mode=0o700)
+        name = str(uuid.uuid4()) + ".zip"
+        expected = hashlib.sha256()
+        with (artifacts / name).open("xb") as file:
+            for _ in range(513):
+                chunk = secrets.token_bytes(chunk_size)
+                file.write(chunk)
+                expected.update(chunk)
+        environment = os.environ.copy()
+        environment.update(SWAN_DATA_DIR=str(data), SWAN_BACKUP_PASSPHRASE=secrets.token_urlsafe(48))
+        backup = root / "company.swan-backup"
+        target = root / "restored"
+
+        def run(arguments):
+            result = subprocess.run([str(binary), *arguments], env=environment,
+                                    capture_output=True, timeout=600, preexec_fn=bound_memory)
+            # Do not echo potentially sensitive command output or environment.
+            assert result.returncode == 0, "Memory-limited management CLI failed (exit %s)" % result.returncode
+
+        run(["backup", str(backup), "--installer-artifacts-directory", str(artifacts)])
+        assert backup.stat().st_size > 512 * 1024**2
+        with backup.open("rb") as file:
+            assert file.read(7) == b"SWANBK2"
+        environment["SWAN_DATA_DIR"] = str(target)
+        run(["restore", str(backup)])
+        actual = hashlib.sha256()
+        received = target / "artifacts" / name
+        assert received.stat().st_size == 513 * chunk_size
+        with received.open("rb") as file:
+            while chunk := file.read(chunk_size):
+                actual.update(chunk)
+        assert actual.digest() == expected.digest()
+        assert (target / "profile-key.hex").read_text(encoding="ascii") == key.hex()
+        assert (target / "setup-token.txt").read_bytes() == (data / "setup-token.txt").read_bytes()
+        with sqlite3.connect(target / "management.sqlite3") as db:
+            assert db.execute("PRAGMA quick_check").fetchone()[0] == "ok"
+            assert db.execute("SELECT value FROM identity").fetchone()[0] == "generated company fixture"
+        assert target.stat().st_mode & 0o777 == 0o700
+        assert (target / "profile-key.hex").stat().st_mode & 0o777 == 0o600
+        assert not list(root.glob(".swan-backup-*"))
+        assert not list(data.glob(".swan-backup-*"))
+
+        environment["SWAN_DATA_DIR"] = str(data)
+        failed_export = root / "write-failure.swan-backup"
+        failed = subprocess.run([str(binary), "backup", str(failed_export),
+                                 "--installer-artifacts-directory", str(artifacts)],
+                                env=environment, capture_output=True, timeout=60,
+                                preexec_fn=bound_file_size, restore_signals=False)
+        assert failed.returncode > 0, "Write-limit failure must return an ordinary CLI error"
+        assert not failed_export.exists()
+        assert not list(data.glob(".swan-backup-*"))
+        assert not list(data.glob("backup-*.sqlite3"))
+
+        interrupted_target = root / "interrupted-restore"
+        environment["SWAN_DATA_DIR"] = str(interrupted_target)
+        child = subprocess.Popen([str(binary), "restore", str(backup)], env=environment,
+                                 stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                                 preexec_fn=bound_memory)
+        # Wait for authenticated plaintext to reach private staging, rather than
+        # killing an arbitrary startup phase or claiming a simulated interruption.
+        try:
+            deadline = time.monotonic() + 60
+            while True:
+                staged = list(root.glob(".swan-backup-*/archive.zip"))
+                if any(path.stat().st_size >= chunk_size for path in staged):
+                    assert child.poll() is None, "Restore finished before the interruption"
+                    child.kill()
+                    break
+                assert child.poll() is None, "Restore exited before a staged block was observed"
+                assert time.monotonic() < deadline, "No authenticated restore block observed"
+                time.sleep(0.01)
+            child.communicate(timeout=30)
+            assert child.returncode == -signal.SIGKILL
+        finally:
+            if child.poll() is None:
+                child.kill()
+                child.communicate(timeout=30)
+        assert not interrupted_target.exists(), "Interrupted contents must not be published"
+        remnants = list(root.glob(".swan-backup-*"))
+        assert remnants, "A forced stop must actually leave the observed private staging"
+        for directory in remnants:
+            assert directory.is_dir() and not directory.is_symlink()
+            assert directory.stat().st_mode & 0o777 == 0o700
+            for file in directory.rglob("*"):
+                assert not file.is_symlink()
+                if file.is_file():
+                    assert file.stat().st_mode & 0o777 == 0o600
+        run(["restore", str(backup)])
+        retried = hashlib.sha256()
+        with (interrupted_target / "artifacts" / name).open("rb") as file:
+            while chunk := file.read(chunk_size):
+                retried.update(chunk)
+        assert retried.digest() == expected.digest()
+        assert (interrupted_target / "profile-key.hex").read_text(encoding="ascii") == key.hex()
+        assert set(root.glob(".swan-backup-*")) == set(remnants), "Retry must not erase other operations' private staging"
+        # Only this test's observed remnants, under its own private disposable root.
+        for directory in remnants:
+            assert directory.resolve().parent == root.resolve()
+            assert directory.name.startswith(".swan-backup-") and not directory.is_symlink()
+            shutil.rmtree(directory)
+        receipt = {"actual_management_cli": True, "format": "SWANBK2",
+                   "maximum_virtual_address_space_bytes_per_cli_process": memory_limit,
+                   "incompressible_artifact_bytes": received.stat().st_size,
+                   "encrypted_backup_bytes": backup.stat().st_size,
+                   "artifact_sha256_preserved": actual.hexdigest(),
+                   "identity_keys_and_setup_token_preserved": True,
+                   "sqlite_integrity_passed": True, "private_unix_permissions_passed": True,
+                   "write_size_failure_rejected_and_cleaned": True,
+                   "restore_sigkill_after_authenticated_staging": True,
+                   "interrupted_restore_target_unpublished": True,
+                   "retry_preserved_artifact_hash_and_identity": True,
+                   "forced_stop_remnants_private_and_preserved_until_explicit_fixture_cleanup": True,
+                   "temporary_archive_cleanup_passed": True, "production_qualification": False}
+    output.parent.mkdir(parents=True, exist_ok=True)
+    with output.open("x", encoding="utf-8") as file:
+        json.dump(receipt, file, indent=2)
+    print("Real backup and restore passed above 512 MiB under a 512 MiB address-space cap.")
+    print("Write-error cleanup and forced restore interruption/retry passed on generated fixture data.")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/linux/test_build_context.py b/deployment/linux/test_build_context.py
new file mode 100644
index 00000000000..7880a062ad0
--- /dev/null
+++ b/deployment/linux/test_build_context.py
@@ -0,0 +1,95 @@
+"""Check the shipped ignore rules with Docker, using public source and canaries.
+
+No local environment files, Git credentials or runtime data are copied into the
+fixture. The scratch exporter runs no commands and downloads no base image.
+"""
+import pathlib
+import re
+import shutil
+import subprocess
+import tempfile
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+CANARIES = (
+    ".env",
+    ".git/config",
+    "deployment/linux/company.env",
+    "deployment/windows/local-test.env",
+    "deployment/windows/custom-company.ps1",
+    "product/management/src/local-test.env",
+    "product/management/src/company-private.rs",
+    "product/worker/src/worker.json",
+    "product/worker/src/worker.private.json",
+    "deployment/windows/worker.private.json",
+    "product/target/stale-build.exe",
+    "branding/company-private.key",
+    "swan-data/profile-key.hex",
+    "swan-data/management.sqlite3",
+)
+
+
+def prepare_fixture(context):
+    tracked = subprocess.check_output(
+        ["git", "ls-files", "-z", "product", "deployment", "branding", "LICENCE"],
+        cwd=ROOT,
+    ).decode("utf-8").split("\0")
+    required = {"LICENCE"}
+    sources = []
+    for relative in filter(None, tracked):
+        source = ROOT / relative
+        if source.is_symlink() or not source.is_file():
+            raise RuntimeError("Build fixture requires regular tracked source files")
+        destination = context / relative
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(source, destination)
+        if relative.startswith("product/"):
+            if source.suffix == ".rs":
+                sources.append(source)
+                required.add(relative)
+            elif source.name in ("Cargo.toml", "Cargo.lock"):
+                required.add(relative)
+    for source in sources:
+        for embedded in re.findall(r'include_(?:str|bytes)!\(\s*"([^"]+)"', source.read_text(encoding="utf-8")):
+            relative = (source.parent / embedded).resolve().relative_to(ROOT).as_posix()
+            if not (context / relative).is_file():
+                raise RuntimeError("Embedded build input is not tracked public source: " + relative)
+            required.add(relative)
+    for relative in CANARIES:
+        destination = context / relative
+        if destination.exists():
+            raise RuntimeError("Canary would overwrite tracked source")
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        destination.write_text("Swan build context exclusion canary; no actual credentials.\n", encoding="utf-8")
+    return required
+
+
+def main():
+    with tempfile.TemporaryDirectory(prefix="swan-docker-context-") as temporary:
+        lab = pathlib.Path(temporary)
+        context = lab / "context"
+        context.mkdir()
+        required = prepare_fixture(context)
+        rules = ROOT / "deployment/linux/Dockerfile.dockerignore"
+        if (ROOT / ".dockerignore").read_text(encoding="utf-8") != rules.read_text(encoding="utf-8"):
+            raise RuntimeError("Root and Dockerfile-specific context exclusions must agree")
+        shutil.copyfile(ROOT / ".dockerignore", context / ".dockerignore")
+        probe = context / "probe.Dockerfile"
+        probe.write_text("FROM scratch\nCOPY . /\n", encoding="utf-8")
+        shutil.copyfile(rules, pathlib.Path(str(probe) + ".dockerignore"))
+        output = lab / "export"
+        subprocess.run(
+            ["docker", "build", "--file", str(probe), "--output", "type=local,dest=" + str(output), str(context)],
+            check=True,
+            timeout=300,
+        )
+        actual = {path.relative_to(output).as_posix() for path in output.rglob("*") if path.is_file()}
+        missing = required - actual
+        unexpected = actual - required
+        if missing or unexpected:
+            raise RuntimeError("Docker context mismatch; missing=" + repr(sorted(missing)) + "; unexpected=" + repr(sorted(unexpected)))
+        print("Docker exported every required input and excluded all configuration/key/cache canaries (" + str(len(actual)) + " public files).")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/linux/test_container_stack.py b/deployment/linux/test_container_stack.py
new file mode 100644
index 00000000000..5829a1da08f
--- /dev/null
+++ b/deployment/linux/test_container_stack.py
@@ -0,0 +1,509 @@
+"""Rehearse pinned company components with isolated loopback HTTPS.
+
+An internal test CA replaces public ACME only in the disposable proxy config.
+No system trust store is changed. TCP startup is not native remote-session,
+UDP traversal, public reachability or production certificate-renewal evidence.
+"""
+import base64
+import argparse
+import json
+import ipaddress
+import pathlib
+import re
+import secrets
+import socket
+import ssl
+import subprocess
+import tempfile
+import time
+import urllib.error
+import urllib.request
+import uuid
+
+from test_container_startup import authenticator, docker, secret_command
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+
+
+def complete_backup(image, prefix, volumes, lab, proxy_image, transport_image, context, https_port,
+                    signed, status, administrator, enrolled, login, secret):
+    """Export stopped components and authenticate a restore into a fresh volume.
+
+    Private keys stay inside Docker volumes; the passphrase travels over stdin.
+    Restart replacement services using the original HTTPS and transport trust.
+    """
+    management, transport, tls, _ = volumes
+    restored = prefix + "-archive-restore"
+    docker("volume", "create", restored)
+    replacement_volumes = []
+    replacement_containers = []
+    network = prefix + "-recovered"
+    network_created = False
+    password = secrets.token_hex(32)
+    common = ["run", "--rm", "-i", "--user", "0", "--read-only", "--network", "none",
+              "--tmpfs", "/tmp", "--security-opt", "no-new-privileges:true"]
+    read_password = "IFS= read -r SWAN_BACKUP_PASSPHRASE; export SWAN_BACKUP_PASSPHRASE; "
+    try:
+        # Distinct exports exercise the same stopped, read-only transport/TLS
+        # sources repeatedly. A failed export is not retried or overwritten.
+        for filename in ["complete.swanbackup", "export-check-1.swanbackup", "export-check-2.swanbackup"]:
+            secret_command(common + ["--mount", "type=volume,src=" + management + ",dst=/var/lib/swan",
+                "--mount", "type=volume,src=" + transport + ",dst=/transport,readonly",
+                "--mount", "type=volume,src=" + tls + ",dst=/tls,readonly",
+                "--mount", "type=bind,src=" + str(lab / "local-test.env") + ",dst=/local-test.env,readonly",
+                "--entrypoint", "sh", image, "-ec", read_password +
+                "exec swan-management backup /var/lib/swan/" + filename + " --transport-directory /transport --tls-directory /tls --deployment-env /local-test.env"], password)
+        restore = common + ["--mount", "type=volume,src=" + management + ",dst=/input,readonly",
+            "--mount", "type=volume,src=" + restored + ",dst=/var/lib/swan",
+            "--env", "SWAN_DATA_DIR=/var/lib/swan/restored", "--entrypoint", "sh", image, "-ec",
+            read_password + "exec swan-management restore /input/complete.swanbackup"]
+        secret_command(restore, secrets.token_hex(32), expected_success=False)
+        docker(*common[:2], "--user", "0", "--network", "none", "--read-only",
+               "--mount", "type=volume,src=" + restored + ",dst=/restored,readonly",
+               "--entrypoint", "sh", image, "-ec", "test ! -e /restored/restored")
+        secret_command(restore, password)
+        # Compare actual private artifacts without returning their contents.
+        docker("run", "--rm", "--user", "0", "--read-only", "--network", "none",
+            "--mount", "type=volume,src=" + restored + ",dst=/restore,readonly",
+            "--mount", "type=volume,src=" + transport + ",dst=/transport,readonly",
+            "--mount", "type=volume,src=" + tls + ",dst=/tls,readonly",
+            "--mount", "type=bind,src=" + str(lab / "local-test.env") + ",dst=/local-test.env,readonly",
+            "--entrypoint", "sh", image, "-ec",
+            "test -s /restore/restored/management.sqlite3 || { echo missing-database >&2; exit 1; }; "
+            "cmp -s /transport/id_ed25519 /restore/restored/transport-id_ed25519 || { echo private-key-mismatch >&2; exit 1; }; "
+            "cmp -s /transport/id_ed25519.pub /restore/restored/transport-id_ed25519.pub || { echo public-key-mismatch >&2; exit 1; }; "
+            "cmp -s /local-test.env /restore/restored/deployment.env || { echo environment-mismatch >&2; exit 1; }; "
+            "find /tls -type f -exec sh -ec 'for file do relative=${file#/tls/}; cmp -s \"$file\" \"/restore/restored/tls-storage/$relative\" || exit 1; done' sh {} +; test $(find /tls -type f | wc -l) = $(find /restore/restored/tls-storage -type f | wc -l); "
+            "test $(stat -c %a /restore/restored) = 700 || { echo directory-mode >&2; exit 1; }; "
+            "test $(stat -c %a /restore/restored/transport-id_ed25519) = 600 || { echo key-mode >&2; exit 1; }")
+        for role in ["transport", "tls", "proxy"]:
+            volume = prefix + "-recovered-" + role
+            docker("volume", "create", volume)
+            replacement_volumes.append(volume)
+        recovered_transport, recovered_tls, recovered_proxy = replacement_volumes
+        docker("run", "--rm", "--user", "0", "--read-only", "--network", "none",
+            "--mount", "type=volume,src=" + restored + ",dst=/restore",
+            "--mount", "type=volume,src=" + recovered_transport + ",dst=/transport",
+            "--mount", "type=volume,src=" + recovered_tls + ",dst=/tls",
+            "--entrypoint", "sh", image, "-ec",
+            "cp /restore/restored/transport-id_ed25519 /transport/id_ed25519; "
+            "cp /restore/restored/transport-id_ed25519.pub /transport/id_ed25519.pub; "
+            "if test -f /restore/restored/transport-db.sqlite3; then cp /restore/restored/transport-db.sqlite3 /transport/db_v2.sqlite3; fi; "
+            "chmod 700 /transport /tls; chmod 600 /transport/*; "
+            "cp -a /restore/restored/tls-storage/. /tls/; "
+            "chown swan:swan /restore/restored /restore/restored/management.sqlite3 /restore/restored/profile-key.hex /restore/restored/setup-token.txt")
+        docker("network", "create", network)
+        network_created = True
+        names = {role: network + "-" + role for role in ["management", "hbbs", "hbbr", "https"]}
+        docker("create", "--name", names["management"], "--network", network, "--network-alias", "management",
+               "--read-only", "--tmpfs", "/tmp", "--security-opt", "no-new-privileges:true",
+               "--mount", "type=volume,src=" + restored + ",dst=/var/lib/swan",
+               "--env", "SWAN_DATA_DIR=/var/lib/swan/restored", image)
+        replacement_containers.append(names["management"])
+        for role, services, command in [("hbbs", ["21115", "21116"], ["hbbs", "-r", "hbbr:21117", "-k", "_"]),
+                                         ("hbbr", ["21117"], ["hbbr", "-k", "_"])]:
+            arguments = ["create", "--name", names[role], "--network", network, "--network-alias", role,
+                         "--mount", "type=volume,src=" + recovered_transport + ",dst=/root"]
+            for service in services:
+                arguments += ["--publish", "127.0.0.1::" + service + "/tcp"]
+            docker(*arguments, transport_image, *command)
+            replacement_containers.append(names[role])
+        docker("create", "--name", names["https"], "--network", network, "--read-only", "--tmpfs", "/tmp",
+               "--security-opt", "no-new-privileges:true", "--env", "SWAN_HOST=localhost",
+               "--mount", "type=bind,src=" + str(lab / "Caddyfile") + ",dst=/etc/caddy/Caddyfile,readonly",
+               "--mount", "type=volume,src=" + recovered_tls + ",dst=/data",
+               "--mount", "type=volume,src=" + recovered_proxy + ",dst=/config",
+               "--publish", "127.0.0.1:" + str(https_port) + ":443/tcp", proxy_image)
+        replacement_containers.append(names["https"])
+        for role in ["management", "hbbs", "hbbr", "https"]:
+            docker("start", names[role])
+        endpoint = Endpoint(names["https"], context)
+        endpoint.ready()
+        recovered = verify_profile(endpoint.request("/api/v1/profile"), status["profile_public_key"], lab)
+        for key in signed:
+            if key not in ["issued_at", "expires_at"] and recovered[key] != signed[key]:
+                raise RuntimeError("Replacement changed trusted company profile")
+        public_file(names["hbbs"], "/root/id_ed25519.pub", lab / "recovered-transport.pub")
+        if (lab / "recovered-transport.pub").read_bytes() != (lab / "transport.pub").read_bytes():
+            raise RuntimeError("Replacement changed transport identity")
+        for service in ["21115/tcp", "21116/tcp"]:
+            container_nat_probe(names["hbbs"], service)
+        with socket.create_connection(("127.0.0.1", port(names["hbbr"], "21117/tcp")), timeout=5):
+            pass
+        endpoint.request("/api/v1/devices", token=administrator, expected=401)
+        endpoint.request("/api/v1/login", "POST", body=login, expected=401)
+        deadline = time.monotonic() + 65
+        while authenticator(secret, 1) == login["totp_code"]:
+            if time.monotonic() >= deadline:
+                raise RuntimeError("No fresh MFA code available for replacement")
+            time.sleep(0.2)
+        fresh_login = dict(login, totp_code=authenticator(secret, 1))
+        token = endpoint.request("/api/v1/login", "POST", body=fresh_login)["token"]
+        endpoint.request("/api/v1/login", "POST", body=fresh_login, expected=401)
+        inventory = endpoint.request("/api/v1/devices", token=token)
+        if len(inventory) != 1 or inventory[0]["id"] != enrolled["device_id"] or inventory[0]["state"] != "pending" or inventory[0]["unattended"]:
+            raise RuntimeError("Replacement lost enrollment or customer consent")
+        endpoint.request("/api/v1/devices/" + enrolled["device_id"] + "/state", "PUT", token,
+                         {"state": "revoked", "group": "recovery-test"})
+        endpoint.request("/api/v1/device/consent", "PUT", enrolled["device_token"],
+                         {"unattended": True, "revision": 1}, expected=401)
+        endpoint.request("/api/v1/logout", "POST", token)
+        endpoint.request("/api/v1/devices", token=token, expected=401)
+    finally:
+        for name in reversed(replacement_containers):
+            docker("rm", "--force", name)
+        if network_created:
+            docker("network", "rm", network)
+        for volume in reversed(replacement_volumes):
+            docker("volume", "rm", volume)
+        docker("volume", "rm", restored)
+
+
+def pinned_images():
+    compose = (ROOT / "deployment/linux/compose.yaml").read_text(encoding="utf-8")
+    images = re.findall(r"^\s+image:\s+(\S+)\s*$", compose, re.MULTILINE)
+    proxies = [value for value in images if value.startswith("caddy:")]
+    transport = json.loads((ROOT / "deployment/transport-source.json").read_text(encoding="utf-8"))["image"]
+    if len(proxies) != 1 or re.fullmatch(r"caddy:[0-9.]+@sha256:[0-9a-f]{64}", proxies[0]) is None:
+        raise RuntimeError("HTTPS proxy must use one pinned manifest")
+    if re.fullmatch(r"rustdesk/rustdesk-server:[0-9.]+@sha256:[0-9a-f]{64}", transport) is None or images.count(transport) != 2:
+        raise RuntimeError("Both transport components must match the source manifest")
+    return proxies[0], transport
+
+
+def ensure_pinned_image(image):
+    # Finish public downloads before creating any private company resources.
+    # Retry only a completed pull's explicit temporary HTTP error, never a
+    # timeout whose daemon-side download state has not been established.
+    if re.fullmatch(r"[A-Za-z0-9./:_-]+@sha256:[0-9a-f]{64}", image) is None:
+        raise RuntimeError("An immutable public image digest is required")
+    inspected = subprocess.run(["docker", "image", "inspect", image], capture_output=True, text=True, timeout=30)
+    if inspected.returncode == 0:
+        return
+    temporary = ("500 internal server error", "502 bad gateway", "503 service unavailable",
+                 "504 gateway timeout", "429 too many requests", "toomanyrequests:")
+    for attempt in range(3):
+        result = subprocess.run(["docker", "pull", image], capture_output=True, text=True, timeout=180)
+        if result.returncode == 0:
+            return
+        detail = (result.stdout + result.stderr).lower()
+        if not any(label in detail for label in temporary) or attempt == 2:
+            raise RuntimeError("Pinned public image pull failed; no company resources were created")
+        print("Pinned image pull returned a temporary registry HTTP error; retrying the same digest.")
+        time.sleep(2 * (attempt + 1))
+
+
+def maintained_transport_image():
+    # Resolve once, then run the immutable image ID throughout the rehearsal.
+    # A mutable tag must not select different transport builds during restore.
+    image = docker("image", "inspect", "--format", "{{.Id}}", "swan-transport:maintained-test")
+    if re.fullmatch(r"sha256:[0-9a-f]{64}", image) is None:
+        raise RuntimeError("Maintained transport image identity missing")
+    receipt = json.loads(docker("run", "--rm", "--network", "none", "--read-only",
+        "--entrypoint", "cat", image, "/usr/share/doc/swan-transport/SWAN-SOURCE.json"))
+    expected = json.loads((ROOT / "deployment/transport/source.json").read_text(encoding="utf-8"))
+    if (receipt.get("upstream") != expected or receipt.get("stage") != "fix"
+            or receipt.get("project_revision") != "650361413543baf7ef150f5960544154ec77ddeb"
+            or receipt.get("patched_udp_sha256") != expected["patches"][-1]["after_sha256"]
+            or receipt.get("unsigned_test") is not True):
+        raise RuntimeError("Maintained transport recipe or source provenance differs")
+    return image
+
+
+def port(name, service):
+    mapping = docker("port", name, service)
+    if re.fullmatch(r"127\.0\.0\.1:[0-9]+", mapping) is None:
+        raise RuntimeError("Stack test endpoint must be restricted to loopback")
+    return int(mapping.rsplit(":", 1)[1])
+
+
+def public_file(name, remote, destination):
+    deadline = time.monotonic() + 60
+    while time.monotonic() < deadline:
+        result = subprocess.run(["docker", "cp", name + ":" + remote, str(destination)], capture_output=True, timeout=10)
+        if result.returncode == 0 and destination.is_file():
+            return
+        time.sleep(0.2)
+    raise RuntimeError("Component did not publish its public trust file")
+
+
+def container_nat_probe(name, service):
+    # Docker's loopback publisher may present a loopback peer to hbbs, whose
+    # NAT-test port interprets that peer as an administrative text connection.
+    # Probe the owned bridge endpoint; published host sockets are checked apart.
+    address = docker("inspect", "--format", "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}", name)
+    parsed = ipaddress.ip_address(address)
+    if not parsed.is_private or parsed.is_loopback or parsed.is_unspecified:
+        raise RuntimeError("NAT probe requires a disposable private bridge endpoint")
+    if service not in ["21115/tcp", "21116/tcp"]:
+        raise RuntimeError("Unexpected NAT-test port")
+    try:
+        deadline = time.monotonic() + 30
+        while True:
+            try:
+                nat_probe(int(service.split("/")[0]), address)
+                break
+            except ConnectionRefusedError:
+                # Published proxy sockets and the public-key file can become
+                # ready before hbbs binds its own listener. Wait on the same
+                # owned container; malformed replies are never retried.
+                if time.monotonic() >= deadline:
+                    raise
+                time.sleep(0.2)
+    except OSError as error:
+        # Preserve startup evidence before the fixture removes its containers.
+        # hbbs output contains its public transport identity, not management
+        # credentials; never collect environment/configuration or private files.
+        state = docker("inspect", "--format", "{{json .State}}", name)
+        logs = docker("logs", "--tail", "30", name)
+        raise RuntimeError("Owned hbbs NAT probe failed on " + service + "; state=" + state + "; log=" + logs) from error
+
+
+def nat_probe(listener, host="127.0.0.1"):
+    # TestNatRequest field 20, serial=0, from hbb_common/protos/rendezvous.proto.
+    # The one-byte length header follows hbb_common/src/bytes_codec.rs.
+    def exact(connection, size):
+        result = bytearray()
+        while len(result) < size:
+            part = connection.recv(size - len(result))
+            if not part:
+                raise RuntimeError("NAT probe connection closed before a response")
+            result.extend(part)
+        return bytes(result)
+
+    def integer(data, offset):
+        value = 0
+        for shift in range(0, 35, 7):
+            if offset >= len(data):
+                break
+            byte = data[offset]
+            offset += 1
+            value |= (byte & 127) << shift
+            if byte < 128:
+                return value, offset
+        raise RuntimeError("Invalid NAT response integer")
+
+    with socket.create_connection((host, listener), timeout=5) as connection:
+        connection.sendall(b"\x0c\xa2\x01\x00")
+        for _ in range(3):
+            first = exact(connection, 1)
+            header = first + exact(connection, first[0] & 3)
+            length = int.from_bytes(header, "little") >> 2
+            if length > 65536:
+                raise RuntimeError("NAT response exceeds probe limit")
+            frame = exact(connection, length)
+            if frame.startswith(b"\xca\x01"):
+                continue  # Native NAT discovery also skips KeyExchange.
+            if not frame.startswith(b"\xaa\x01"):
+                raise RuntimeError("Rendezvous did not return TestNatResponse")
+            size, start = integer(frame, 2)
+            if start + size != len(frame) or frame[start:start + 1] != b"\x08":
+                raise RuntimeError("Invalid NAT response payload")
+            observed, _ = integer(frame, start + 1)
+            if not 0 < observed <= 65535:
+                raise RuntimeError("NAT probe did not report a peer port")
+            return
+    raise RuntimeError("NAT probe did not receive its protocol response")
+
+
+class Endpoint:
+    def __init__(self, proxy, context):
+        self.base = "https://localhost:" + str(port(proxy, "443/tcp"))
+        self.context = context
+
+    def ready(self):
+        deadline = time.monotonic() + 30
+        while time.monotonic() < deadline:
+            try:
+                if self.request("/health") == {"status": "ok", "product": "Swan Remote Support"}:
+                    return
+            except (OSError, RuntimeError):
+                pass
+            time.sleep(0.2)
+        raise RuntimeError("HTTPS proxy did not reach healthy management")
+
+    def request(self, endpoint, method="GET", token=None, body=None, expected=200):
+        headers = {"Content-Type": "application/json"}
+        if token is not None:
+            headers["Authorization"] = "Bearer " + token
+        data = None if body is None else json.dumps(body).encode("utf-8")
+        query = urllib.request.Request(self.base + endpoint, data=data, headers=headers, method=method)
+        try:
+            response = urllib.request.urlopen(query, context=self.context, timeout=10)
+        except urllib.error.HTTPError as error:
+            response = error
+        with response:
+            if response.status != expected or response.headers.get("Cache-Control") != "no-store":
+                raise RuntimeError("Unexpected HTTPS response for " + endpoint)
+            if response.headers.get("Strict-Transport-Security") != "max-age=31536000":
+                raise RuntimeError("Proxy lost the shipped HTTPS policy")
+            content = response.read(2 * 1024 * 1024)
+            return json.loads(content) if "application/json" in response.headers.get("Content-Type", "") else content.decode("utf-8")
+
+
+def verify_profile(envelope, public_key, directory):
+    payload = base64.b64decode(envelope["payload"], validate=True)
+    signature = base64.b64decode(envelope["signature"], validate=True)
+    key = base64.b64decode(public_key, validate=True)
+    if len(key) != 32 or len(signature) != 64:
+        raise RuntimeError("Invalid profile signing identity")
+    key_file, data_file, signature_file = [directory / name for name in ["public.der", "profile.json", "signature.bin"]]
+    key_file.write_bytes(bytes.fromhex("302a300506032b6570032100") + key)
+    data_file.write_bytes(payload)
+    signature_file.write_bytes(signature)
+    arguments = ["openssl", "pkeyutl", "-verify", "-rawin", "-pubin", "-keyform", "DER", "-inkey", str(key_file), "-in", str(data_file), "-sigfile", str(signature_file)]
+    if subprocess.run(arguments, capture_output=True).returncode != 0:
+        raise RuntimeError("Actual company profile signature failed")
+    data_file.write_bytes(payload + b" ")
+    if subprocess.run(arguments, capture_output=True).returncode == 0:
+        raise RuntimeError("Tampered company profile was accepted")
+    data_file.write_bytes(payload)
+    key_file.write_bytes(bytes.fromhex("302a300506032b6570032100") + bytes([key[0] ^ 1]) + key[1:])
+    if subprocess.run(arguments, capture_output=True).returncode == 0:
+        raise RuntimeError("Wrong company signing key was accepted")
+    return json.loads(payload)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("image", nargs="?", default="swan-management:test")
+    parser.add_argument("--maintained-transport", action="store_true")
+    arguments = parser.parse_args()
+    image = arguments.image
+    proxy_image, transport_image = pinned_images()
+    if arguments.maintained_transport:
+        transport_image = maintained_transport_image()
+    else:
+        ensure_pinned_image(transport_image)
+    ensure_pinned_image(proxy_image)
+    prefix = "swan-stack-test-" + uuid.uuid4().hex
+    names = {role: prefix + "-" + role for role in ["management", "https", "hbbs", "hbbr"]}
+    volumes = []
+    containers = []
+    network_created = False
+    try:
+        with tempfile.TemporaryDirectory(prefix="swan-stack-config-") as temporary:
+            lab = pathlib.Path(temporary)
+            original = (ROOT / "deployment/linux/Caddyfile").read_text(encoding="utf-8")
+            if original.count("reverse_proxy management:8080") != 1:
+                raise RuntimeError("Recheck the test override against the proxy recipe")
+            config = lab / "Caddyfile"
+            config.write_text("{\n    skip_install_trust\n}\n" + original.replace("reverse_proxy management:8080", "tls internal\n    reverse_proxy management:8080"), encoding="utf-8")
+            (lab / "local-test.env").write_text("SWAN_HOST=localhost\nSWAN_MANAGEMENT_IMAGE=" + image + "\n", encoding="utf-8")
+            docker("network", "create", prefix)
+            network_created = True
+            for role in ["management", "transport", "tls", "proxy-config"]:
+                volume = prefix + "-" + role + "-data"
+                docker("volume", "create", volume)
+                volumes.append(volume)
+            management_data, transport_data, tls_data, proxy_data = volumes
+            docker("create", "--name", names["management"], "--network", prefix, "--network-alias", "management",
+                   "--read-only", "--tmpfs", "/tmp", "--security-opt", "no-new-privileges:true",
+                   "--mount", "type=volume,src=" + management_data + ",dst=/var/lib/swan", image)
+            containers.append(names["management"])
+            docker("create", "--name", names["hbbs"], "--network", prefix, "--network-alias", "hbbs",
+                   "--mount", "type=volume,src=" + transport_data + ",dst=/root",
+                   "--publish", "127.0.0.1::21115/tcp", "--publish", "127.0.0.1::21116/tcp",
+                   transport_image, "hbbs", "-r", "hbbr:21117", "-k", "_")
+            containers.append(names["hbbs"])
+            docker("create", "--name", names["hbbr"], "--network", prefix, "--network-alias", "hbbr",
+                   "--mount", "type=volume,src=" + transport_data + ",dst=/root",
+                   "--publish", "127.0.0.1::21117/tcp", transport_image, "hbbr", "-k", "_")
+            containers.append(names["hbbr"])
+            with socket.socket() as available:
+                available.bind(("127.0.0.1", 0))
+                https_port = available.getsockname()[1]
+            with (lab / "local-test.env").open("a", encoding="utf-8") as environment:
+                environment.write("SWAN_HTTPS_TEST_PORT=" + str(https_port) + "\n")
+            docker("create", "--name", names["https"], "--network", prefix, "--read-only", "--tmpfs", "/tmp",
+                   "--security-opt", "no-new-privileges:true", "--env", "SWAN_HOST=localhost",
+                   "--mount", "type=bind,src=" + str(config) + ",dst=/etc/caddy/Caddyfile,readonly",
+                   "--mount", "type=volume,src=" + tls_data + ",dst=/data",
+                   "--mount", "type=volume,src=" + proxy_data + ",dst=/config",
+                   "--publish", "127.0.0.1:" + str(https_port) + ":443/tcp", proxy_image)
+            containers.append(names["https"])
+            docker("start", names["management"])
+            docker("start", names["hbbs"])
+            transport_public = lab / "transport.pub"
+            public_file(names["hbbs"], "/root/id_ed25519.pub", transport_public)
+            transport_key = transport_public.read_text().strip()
+            if len(base64.b64decode(transport_key, validate=True)) != 32:
+                raise RuntimeError("Transport did not generate a valid public identity")
+            docker("start", names["hbbr"])
+            docker("start", names["https"])
+            authority = lab / "root.crt"
+            public_file(names["https"], "/data/caddy/pki/authorities/local/root.crt", authority)
+            context = ssl.create_default_context(cafile=str(authority))
+            endpoint = Endpoint(names["https"], context)
+            endpoint.ready()
+            try:
+                urllib.request.urlopen(endpoint.base + "/health", timeout=10)
+            except urllib.error.URLError as error:
+                if not isinstance(error.reason, ssl.SSLCertVerificationError):
+                    raise RuntimeError("Expected actual untrusted-certificate rejection") from error
+            else:
+                raise RuntimeError("Lab issuer unexpectedly entered system trust")
+            for role, service in [("hbbs", "21115/tcp"), ("hbbs", "21116/tcp"), ("hbbr", "21117/tcp")]:
+                with socket.create_connection(("127.0.0.1", port(names[role], service)), timeout=5):
+                    pass
+            for service in ["21115/tcp", "21116/tcp"]:
+                container_nat_probe(names["hbbs"], service)
+            status = endpoint.request("/api/v1/status")
+            branding = endpoint.request("/api/v1/default-branding")
+            branding["display_name"] = "HTTPS Stack Test Company"
+            secret = secrets.token_bytes(20)
+            password = secrets.token_hex(24)
+            profile = {"schema": 1, "company_id": "setup", "revision": 1, "issued_at": int(time.time()), "expires_at": int(time.time()) + 3600,
+                       "management_url": endpoint.base, "rendezvous": "hbbs:21116", "relay": "hbbr:21117", "transport_public_key": transport_key,
+                       "customer": branding, "technician": branding, "allow_unattended": False, "updates_paused": True, "rollout_percent": 0,
+                       "maintenance_start_utc": 0, "maintenance_end_utc": 0, "update_channel": "test", "next_profile_public_key": None}
+            setup_token = docker("exec", names["management"], "cat", "/var/lib/swan/setup-token.txt")
+            company = endpoint.request("/api/v1/setup", "POST", setup_token,
+                                       {"profile": profile, "username": "stack-admin", "password": password, "totp_secret": base64.b32encode(secret).decode("ascii"), "totp_code": authenticator(secret)})
+            login = {"username": "stack-admin", "password": password, "totp_code": authenticator(secret, 1)}
+            administrator = endpoint.request("/api/v1/login", "POST", body=login)["token"]
+            endpoint.request("/api/v1/login", "POST", body=login, expected=401)
+            signed = verify_profile(endpoint.request("/api/v1/profile"), status["profile_public_key"], lab)
+            if signed["company_id"] != company["company_id"] or signed["transport_public_key"] != transport_key or signed["customer"]["display_name"] != branding["display_name"]:
+                raise RuntimeError("Signed HTTPS profile lost company or transport identity")
+            enrolled = endpoint.request("/api/v1/enroll", "POST", body={"name": "HTTPS test device", "rustdesk_id": "123456789", "unattended_consent": False})
+            if enrolled["state"] != "pending":
+                raise RuntimeError("HTTPS enrollment bypassed approval")
+            endpoint.request("/api/v1/device/consent", "PUT", enrolled["device_token"], {"unattended": True, "revision": 1}, expected=401)
+            endpoint.request("/api/v1/logout", "POST", administrator)
+            endpoint.request("/api/v1/devices", token=administrator, expected=401)
+            for role in ["https", "management", "hbbs", "hbbr"]:
+                docker("stop", "--time", "10", names[role])
+            complete_backup(image, prefix, volumes, lab, proxy_image, transport_image, context, https_port,
+                            signed, status, administrator, enrolled, login, secret)
+            for role in ["management", "hbbs", "hbbr", "https"]:
+                docker("start", names[role])
+            endpoint = Endpoint(names["https"], context)
+            endpoint.ready()
+            restored = verify_profile(endpoint.request("/api/v1/profile"), status["profile_public_key"], lab)
+            after_public = lab / "transport-after.pub"
+            public_file(names["hbbs"], "/root/id_ed25519.pub", after_public)
+            if after_public.read_bytes() != transport_public.read_bytes() or restored["company_id"] != company["company_id"] or restored["management_url"] != endpoint.base:
+                raise RuntimeError("Stack restart changed company or transport trust")
+            endpoint.request("/api/v1/devices", token=administrator, expected=401)
+            for service in ["21115/tcp", "21116/tcp"]:
+                container_nat_probe(names["hbbs"], service)
+            original_login = dict(login, totp_code=authenticator(secret, 1))
+            original_token = endpoint.request("/api/v1/login", "POST", body=original_login)["token"]
+            original_inventory = endpoint.request("/api/v1/devices", token=original_token)
+            if len(original_inventory) != 1 or original_inventory[0]["id"] != enrolled["device_id"] or original_inventory[0]["state"] != "pending":
+                raise RuntimeError("Replacement revocation mutated original deployment")
+            endpoint.request("/api/v1/logout", "POST", original_token)
+            print("PASS: pinned HTTPS/rendezvous/relay startup, local native NAT-test responses, explicit CA validation and untrusted rejection, actual profile signatures, MFA/enrollment/logout over HTTPS, complete encrypted archive recovery and replacement startup with original trust. Native sessions, UDP traversal, public ACME and external reachability remain unverified.")
+    finally:
+        for name in reversed(containers):
+            docker("rm", "--force", name)
+        for volume in reversed(volumes):
+            docker("volume", "rm", volume)
+        if network_created:
+            docker("network", "rm", prefix)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/linux/test_container_startup.py b/deployment/linux/test_container_startup.py
new file mode 100644
index 00000000000..4e097bd70d9
--- /dev/null
+++ b/deployment/linux/test_container_startup.py
@@ -0,0 +1,266 @@
+"""Exercise the real management image with fresh, disposable company storage.
+
+Loopback HTTP is used only inside this CI lab. This checks container deployment
+and persistence, not public HTTPS, RustDesk transport or native endpoint sessions.
+Credentials stay in memory and are never printed or passed as command arguments.
+"""
+import base64
+import hashlib
+import hmac
+import json
+import re
+import secrets
+import struct
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+import uuid
+
+
+def docker(*arguments):
+    return subprocess.check_output(["docker", *arguments], text=True, timeout=90).strip()
+
+
+def authenticator(secret, offset=0):
+    counter = int(time.time()) // 30 + offset
+    digest = hmac.new(secret, struct.pack(">Q", counter), hashlib.sha1).digest()
+    start = digest[-1] & 15
+    value = struct.unpack(">I", digest[start:start + 4])[0] & 0x7FFFFFFF
+    return str(value % 1000000).zfill(6)
+
+
+def request(base, endpoint, method="GET", token=None, body=None, expected=200):
+    headers = {"Content-Type": "application/json"}
+    if token is not None:
+        headers["Authorization"] = "Bearer " + token
+    data = None if body is None else json.dumps(body).encode("utf-8")
+    query = urllib.request.Request(base + endpoint, data=data, headers=headers, method=method)
+    try:
+        response = urllib.request.urlopen(query, timeout=10)
+    except urllib.error.HTTPError as error:
+        response = error
+    with response:
+        if response.status != expected:
+            raise RuntimeError("Unexpected HTTP status for " + endpoint + ": " + str(response.status))
+        raw = response.read(1024 * 1024)
+        if response.headers.get("Cache-Control") != "no-store":
+            raise RuntimeError("Management responses must not be cached")
+        return json.loads(raw) if "application/json" in response.headers.get("Content-Type", "") else raw.decode("utf-8")
+
+
+def ready(base):
+    deadline = time.monotonic() + 30
+    while time.monotonic() < deadline:
+        try:
+            result = request(base, "/health")
+            if result == {"status": "ok", "product": "Swan Remote Support"}:
+                return
+        except (OSError, RuntimeError):
+            time.sleep(0.2)
+    raise RuntimeError("Management container did not become healthy")
+
+
+def container_base(name):
+    port = docker("port", name, "8080/tcp")
+    if re.fullmatch(r"127\.0\.0\.1:[0-9]+", port) is None:
+        raise RuntimeError("Lab container was not restricted to loopback")
+    return "http://" + port
+
+
+def secret_command(arguments, passphrase, expected_success=True):
+    # Supply only stdin, never a password in Docker arguments or container metadata.
+    result = subprocess.run(["docker", *arguments], input=passphrase + "\n",
+                            capture_output=True, text=True, timeout=90)
+    if (result.returncode == 0) != expected_success:
+        # Report only known error categories, never captured output: diagnostics
+        # can contain local paths, deployment settings or Docker arguments.
+        categories = {
+            "management_open": "Open management database for backup",
+            "management_snapshot": "Snapshot management database for backup",
+            "transport_open": "Open transport database for backup",
+            "transport_snapshot": "Snapshot transport database for backup",
+            "sqlite_readonly": "attempt to write a readonly database",
+            "sqlite_open": "unable to open database file",
+            "sqlite_locked": "database is locked",
+            "sqlite_io": "disk I/O error",
+            "readonly_filesystem": "Read-only file system",
+            "sqlite_malformed": "database disk image is malformed",
+            "permission": "Permission denied",
+            "missing_file": "No such file or directory",
+            "tls_path": "Unsupported TLS storage path",
+            "backup_exists": "Refusing to overwrite an existing backup",
+            "authentication": "Backup password incorrect or backup modified",
+        }
+        matched = [name for name, text in categories.items() if text.casefold() in result.stderr.casefold()]
+        codes = re.findall(r"(?:Error code |os error )(\d+)", result.stderr)
+        raise RuntimeError("Unexpected encrypted backup/restore command result; exit=" +
+                           str(result.returncode) + "; categories=" + repr(matched) + "; codes=" + repr(codes))
+    if not expected_success and "Backup password incorrect or backup modified" not in result.stderr:
+        raise RuntimeError("Restore failed before demonstrating backup authentication rejection")
+
+
+def restore_management(image, original, source_volume, status, administrator, enrolled, login_body, secret):
+    name = "swan-restore-test-" + uuid.uuid4().hex
+    helper = name + "-helper"
+    volume = name + "-data"
+    created_volume = False
+    created_container = False
+    try:
+        before = request(container_base(original), "/api/v1/profile")
+        passphrase = secrets.token_hex(32)
+        shell = "IFS= read -r SWAN_BACKUP_PASSPHRASE; export SWAN_BACKUP_PASSPHRASE; exec swan-management "
+        secret_command(["exec", "-i", original, "sh", "-ec",
+                        shell + "backup /var/lib/swan/rehearsal.swanbackup"], passphrase)
+        docker("exec", original, "sh", "-ec",
+               'test "$(stat -c %a /var/lib/swan/rehearsal.swanbackup)" = 600; '
+               'test "$(head -c 7 /var/lib/swan/rehearsal.swanbackup)" = SWANBK2')
+        docker("volume", "create", volume)
+        created_volume = True
+        restore = ["run", "--rm", "--name", helper, "-i", "--read-only", "--network", "none",
+                   "--tmpfs", "/tmp", "--security-opt", "no-new-privileges:true",
+                   "--mount", "type=volume,src=" + source_volume + ",dst=/input,readonly",
+                   "--mount", "type=volume,src=" + volume + ",dst=/var/lib/swan",
+                   "--env", "SWAN_DATA_DIR=/var/lib/swan/restored", "--entrypoint", "sh", image,
+                   "-ec", shell + "restore /input/rehearsal.swanbackup"]
+        secret_command(restore, secrets.token_hex(32), expected_success=False)
+        docker("run", "--rm", "--name", helper, "--read-only", "--network", "none",
+               "--mount", "type=volume,src=" + volume + ",dst=/var/lib/swan", "--entrypoint", "sh",
+               image, "-ec", "test ! -e /var/lib/swan/restored")
+        secret_command(restore, passphrase)
+        docker("create", "--name", name, "--read-only", "--tmpfs", "/tmp",
+               "--security-opt", "no-new-privileges:true", "--mount", "type=volume,src=" + volume + ",dst=/var/lib/swan",
+               "--env", "SWAN_DATA_DIR=/var/lib/swan/restored", "--publish", "127.0.0.1::8080", image)
+        created_container = True
+        docker("start", name)
+        base = container_base(name)
+        ready(base)
+        if request(base, "/api/v1/status") != status:
+            raise RuntimeError("Restored company trust or configuration state changed")
+        after = request(base, "/api/v1/profile")
+        prior_profile = json.loads(base64.b64decode(before["payload"], validate=True))
+        restored_profile = json.loads(base64.b64decode(after["payload"], validate=True))
+        for profile in [prior_profile, restored_profile]:
+            profile.pop("issued_at")
+            profile.pop("expires_at")
+        if restored_profile != prior_profile:
+            raise RuntimeError("Restore changed company branding or policy")
+        inventory = request(base, "/api/v1/devices", token=administrator)
+        if len(inventory) != 1 or inventory[0]["id"] != enrolled["device_id"] or inventory[0]["state"] != "approved" or inventory[0]["unattended"] is not False:
+            raise RuntimeError("Restore lost enrollment, approval or consent")
+        docker("exec", name, "sh", "-ec",
+               'test "$(id -u)" = 10001; test "$(stat -c %a /var/lib/swan/restored)" = 700; '
+               'test "$(stat -c %a /var/lib/swan/restored/profile-key.hex)" = 600; '
+               'test "$(stat -c %a /var/lib/swan/restored/setup-token.txt)" = 600')
+        request(base, "/api/v1/login", "POST", body=login_body, expected=401)
+        deadline = time.monotonic() + 65
+        while authenticator(secret, 1) == login_body["totp_code"]:
+            if time.monotonic() >= deadline:
+                raise RuntimeError("No fresh authenticator code available for restore verification")
+            time.sleep(0.2)
+        restored_login = dict(login_body, totp_code=authenticator(secret, 1))
+        token = request(base, "/api/v1/login", "POST", body=restored_login)["token"]
+        request(base, "/api/v1/login", "POST", body=restored_login, expected=401)
+        request(base, "/api/v1/devices/" + enrolled["device_id"] + "/state", "PUT", token, {"state": "revoked", "group": "container-test"})
+        request(base, "/api/v1/device/consent", "PUT", enrolled["device_token"], {"unattended": False, "revision": 1}, expected=401)
+        original_inventory = request(container_base(original), "/api/v1/devices", token=administrator)
+        if len(original_inventory) != 1 or original_inventory[0]["state"] != "approved":
+            raise RuntimeError("Restored deployment mutated the original company volume")
+        request(base, "/api/v1/logout", "POST", token)
+        request(base, "/api/v1/logout", "POST", administrator)
+        request(base, "/api/v1/devices", token=administrator, expected=401)
+        print("PASS: encrypted management backup, wrong-password rejection without writes, restored company/device/consent identity, private keys, MFA/replay and revocation. Transport and TLS backup remain separate tests.")
+    finally:
+        if docker("ps", "-aq", "--filter", "name=^/" + helper + "$"):
+            docker("rm", "--force", helper)
+        if created_container:
+            docker("rm", "--force", name)
+        if created_volume:
+            docker("volume", "rm", volume)
+
+
+def main():
+    image = sys.argv[1] if len(sys.argv) == 2 else "swan-management:test"
+    name = "swan-company-test-" + uuid.uuid4().hex
+    volume = name + "-data"
+    created = False
+    started = False
+    try:
+        docker("volume", "create", volume)
+        created = True
+        docker("create", "--name", name, "--read-only", "--tmpfs", "/tmp",
+               "--security-opt", "no-new-privileges:true", "--mount", "type=volume,src=" + volume + ",dst=/var/lib/swan",
+               "--publish", "127.0.0.1::8080", image)
+        started = True
+        docker("start", name)
+        base = container_base(name)
+        ready(base)
+        if docker("exec", name, "id", "-u") != "10001":
+            raise RuntimeError("Management container must run as the service account")
+        docker("exec", name, "sh", "-ec",
+               'test "$SSL_CERT_FILE" = /etc/ssl/certs/ca-certificates.crt; '
+               'test -s "$SSL_CERT_FILE"; test -r "$SSL_CERT_FILE"; '
+               'test "$(stat -c %a /var/lib/swan)" = 700; '
+               'test "$(stat -c %a /var/lib/swan/profile-key.hex)" = 600; '
+               'test "$(stat -c %a /var/lib/swan/setup-token.txt)" = 600; '
+               'test -f /var/lib/swan/management.sqlite3')
+        status = request(base, "/api/v1/status")
+        if status["configured"] is not False or len(base64.b64decode(status["profile_public_key"], validate=True)) != 32:
+            raise RuntimeError("Expected a fresh company with its own public trust key")
+        if "Swan Remote Support" not in request(base, "/"):
+            raise RuntimeError("Administration assets were not embedded in the image")
+        request(base, "/api/v1/devices", expected=401)
+        branding = request(base, "/api/v1/default-branding")
+        branding["display_name"] = "Container Test Company"
+        secret = secrets.token_bytes(20)
+        password = secrets.token_hex(24)
+        # A known public RFC 8032 test key; no signing private key is supplied.
+        transport_key = base64.b64encode(bytes.fromhex("d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a")).decode("ascii")
+        profile = {"schema": 1, "company_id": "setup", "revision": 1, "issued_at": int(time.time()),
+                   "expires_at": int(time.time()) + 3600, "management_url": "https://support.example.com",
+                   "rendezvous": "support.example.com:21116", "relay": "support.example.com:21117",
+                   "transport_public_key": transport_key, "customer": branding, "technician": branding,
+                   "allow_unattended": False, "updates_paused": True, "rollout_percent": 0,
+                   "maintenance_start_utc": 0, "maintenance_end_utc": 0, "update_channel": "test",
+                   "next_profile_public_key": None}
+        setup_token = docker("exec", name, "cat", "/var/lib/swan/setup-token.txt")
+        company = request(base, "/api/v1/setup", "POST", setup_token,
+                          {"profile": profile, "username": "container-admin", "password": password,
+                           "totp_secret": base64.b32encode(secret).decode("ascii"), "totp_code": authenticator(secret)})
+        login_body = {"username": "container-admin", "password": password, "totp_code": "invalid"}
+        request(base, "/api/v1/login", "POST", body=login_body, expected=401)
+        login_body["totp_code"] = authenticator(secret, 1)
+        administrator = request(base, "/api/v1/login", "POST", body=login_body)["token"]
+        request(base, "/api/v1/login", "POST", body=login_body, expected=401)
+        enrolled = request(base, "/api/v1/enroll", "POST", body={"name": "Container test device", "rustdesk_id": "987654321", "unattended_consent": False})
+        if enrolled["state"] != "pending" or enrolled["company_id"] != company["company_id"]:
+            raise RuntimeError("Fresh enrollment must require company approval")
+        request(base, "/api/v1/device/consent", "PUT", enrolled["device_token"], {"unattended": True, "revision": 1}, expected=401)
+        request(base, "/api/v1/devices/" + enrolled["device_id"] + "/state", "PUT", administrator, {"state": "approved", "group": "container-test"})
+        request(base, "/api/v1/device/consent", "PUT", enrolled["device_token"], {"unattended": True, "revision": 1}, expected=403)
+        docker("stop", "--time", "10", name)
+        if docker("inspect", "--format", "{{.State.ExitCode}}", name) != "0":
+            raise RuntimeError("Management did not shut down cleanly on Docker SIGTERM")
+        docker("start", name)
+        base = container_base(name)
+        ready(base)
+        after = request(base, "/api/v1/status")
+        if after["configured"] is not True or after["profile_public_key"] != status["profile_public_key"]:
+            raise RuntimeError("Container restart changed company identity")
+        inventory = request(base, "/api/v1/devices", token=administrator)
+        if len(inventory) != 1 or inventory[0]["id"] != enrolled["device_id"] or inventory[0]["state"] != "approved" or inventory[0]["unattended"] is not False:
+            raise RuntimeError("Container restart lost device, permission or consent state")
+        restore_management(image, name, volume, after, administrator, enrolled, login_body, secret)
+        request(base, "/api/v1/logout", "POST", administrator)
+        request(base, "/api/v1/devices", token=administrator, expected=401)
+        print("PASS: non-root/read-only container startup, private storage, company setup, MFA/replay denial, enrollment approval and restart persistence. HTTPS and native transport remain separate tests.")
+    finally:
+        if started:
+            docker("rm", "--force", name)
+        if created:
+            docker("volume", "rm", volume)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/linux/test_pinned_images.py b/deployment/linux/test_pinned_images.py
new file mode 100644
index 00000000000..86f60fa251b
--- /dev/null
+++ b/deployment/linux/test_pinned_images.py
@@ -0,0 +1,56 @@
+"""Bounded public-image pull policy; Docker/network calls are mocked here."""
+import subprocess
+import unittest
+from unittest.mock import patch
+import test_container_stack as stack
+
+
+class PinnedImageTests(unittest.TestCase):
+    image = "example.test/fixture:1@sha256:" + "a" * 64
+
+    def result(self, status, error=""):
+        return subprocess.CompletedProcess([], status, stdout="", stderr=error)
+
+    def test_cached_digest_needs_no_download(self):
+        with patch.object(stack.subprocess, "run", return_value=self.result(0)) as run:
+            stack.ensure_pinned_image(self.image)
+            self.assertEqual(run.call_count, 1)
+
+    def test_temporary_completed_http_failure_retries_identical_pin(self):
+        with patch.object(stack.subprocess, "run", side_effect=[self.result(1), self.result(1, "received unexpected HTTP status: 500 Internal Server Error"), self.result(0)]) as run, patch.object(stack.time, "sleep") as sleep:
+            stack.ensure_pinned_image(self.image)
+            self.assertEqual(run.call_count, 3)
+            self.assertEqual(run.call_args_list[1].args[0], run.call_args_list[2].args[0])
+            sleep.assert_called_once_with(2)
+
+    def test_retries_are_bounded(self):
+        with patch.object(stack.subprocess, "run", return_value=self.result(1, "503 Service Unavailable")) as run, patch.object(stack.time, "sleep") as sleep:
+            with self.assertRaises(RuntimeError):
+                stack.ensure_pinned_image(self.image)
+            self.assertEqual(run.call_count, 4)
+            self.assertEqual(sleep.call_count, 2)
+
+    def test_authentication_and_missing_pin_fail_without_retry(self):
+        for detail in ("unauthorized: authentication required", "manifest unknown"):
+            with patch.object(stack.subprocess, "run", side_effect=[self.result(1), self.result(1, detail)]) as run, patch.object(stack.time, "sleep") as sleep:
+                with self.assertRaises(RuntimeError):
+                    stack.ensure_pinned_image(self.image)
+                self.assertEqual(run.call_count, 2)
+                sleep.assert_not_called()
+
+    def test_timeout_never_starts_another_potentially_live_download(self):
+        with patch.object(stack.subprocess, "run", side_effect=[self.result(1), subprocess.TimeoutExpired("docker", 180)]) as run, patch.object(stack.time, "sleep") as sleep:
+            with self.assertRaises(subprocess.TimeoutExpired):
+                stack.ensure_pinned_image(self.image)
+            self.assertEqual(run.call_count, 2)
+            sleep.assert_not_called()
+
+    def test_mutable_tag_rejected_before_docker(self):
+        with patch.object(stack.subprocess, "run") as run:
+            with self.assertRaises(RuntimeError):
+                stack.ensure_pinned_image("example.test/fixture:latest")
+            run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/transport-source.json b/deployment/transport-source.json
new file mode 100644
index 00000000000..4fbdfa1f293
--- /dev/null
+++ b/deployment/transport-source.json
@@ -0,0 +1,7 @@
+{
+  "repository": "https://github.com/rustdesk/rustdesk-server",
+  "tag": "1.1.15",
+  "commit": "9bae9f2f39d92c4b4ba2e28e089da5071897b22e",
+  "image": "rustdesk/rustdesk-server:1.1.15@sha256:10818ec05b179039c6660f4d8e74b303f0db2858bbad2b18e24992ea22d54cd6",
+  "authorization_boundary": "Company authorization is enforced by the managed receiving app on every transport, including direct connections. Upstream transport registration itself is not an authenticated company enrollment API."
+}
diff --git a/deployment/transport/Dockerfile b/deployment/transport/Dockerfile
new file mode 100644
index 00000000000..56bf064a272
--- /dev/null
+++ b/deployment/transport/Dockerfile
@@ -0,0 +1,34 @@
+# Candidate only: build the maintained transport from immutable public inputs.
+# No company configuration, credentials or local build context enter this image.
+FROM rust:1.90.0-bookworm@sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends git python3 pkg-config libssl-dev libsodium-dev && rm -rf /var/lib/apt/lists/*
+WORKDIR /build
+RUN git init recipe && git -C recipe remote add origin https://github.com/rijff24/SwanRemoteSupport && \
+    git -C recipe fetch --depth 1 origin 650361413543baf7ef150f5960544154ec77ddeb && \
+    git -C recipe checkout --detach FETCH_HEAD && \
+    test "$(git -C recipe rev-parse HEAD)" = 650361413543baf7ef150f5960544154ec77ddeb
+RUN git init transport && git -C transport remote add origin https://github.com/rustdesk/rustdesk-server && \
+    git -C transport fetch --depth 1 origin 9bae9f2f39d92c4b4ba2e28e089da5071897b22e && \
+    git -C transport checkout --detach FETCH_HEAD && git -C transport submodule update --init --recursive
+RUN python3 recipe/deployment/transport/prepare_source.py transport tests && \
+    python3 recipe/deployment/transport/prepare_source.py transport fix
+WORKDIR /build/transport
+# SQLx compilation opens the tracked schema database and can change its journal
+# header. Preserve the actual pinned inputs before any such build-time writes.
+RUN git diff --cached --quiet HEAD && git diff --quiet HEAD -- . ':!libs/hbb_common' && \
+    git -C libs/hbb_common diff --cached --quiet HEAD && \
+    git -C libs/hbb_common diff --quiet HEAD -- . ':!src/udp.rs' && \
+    python3 ../recipe/deployment/transport/archive_source.py . /build/transport-build-source.zip
+RUN cargo build --release --locked --bin hbbs --bin hbbr
+
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libssl3 libsodium23 && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /build/transport/target/release/hbbs /build/transport/target/release/hbbr /usr/local/bin/
+COPY --from=builder /build/transport/SWAN-SOURCE.json /build/transport-build-source.zip /usr/share/doc/swan-transport/
+COPY --from=builder /build/recipe/LICENCE /usr/share/doc/swan-transport/LICENCE
+LABEL org.opencontainers.image.source="https://github.com/rijff24/SwanRemoteSupport" \
+      org.opencontainers.image.revision="650361413543baf7ef150f5960544154ec77ddeb" \
+      org.opencontainers.image.licenses="AGPL-3.0" \
+      com.swan.transport.status="candidate-not-production-approved"
+WORKDIR /root
+CMD ["hbbs"]
diff --git a/deployment/transport/README.md b/deployment/transport/README.md
new file mode 100644
index 00000000000..2c9b1c00b4d
--- /dev/null
+++ b/deployment/transport/README.md
@@ -0,0 +1,61 @@
+# Candidate maintained transport
+
+The Windows lab reproduced `WSAEFAULT` (10014) when sending an IPv4 sockaddr
+through a dual-stack IPv6 UDP socket. Sending to the equivalent IPv4-mapped
+IPv6 destination succeeded. The candidate patch normalizes that destination in
+both shared `FramedSocket::send` and `send_raw`; IPv4 sockets, native IPv6
+destinations and SOCKS transport keep their existing paths.
+
+`source.json` pins the public server commit, shared submodule commit, upstream
+Cargo lock, regression patch and implementation patch with input/output hashes.
+No company profile supplies source, commands or patches. Existing installer
+component pins and deployments are unchanged until candidate validation passes.
+
+The `swan-transport.yml` workflow prepares a clean pinned checkout and adds the
+regression first. Windows must reproduce error 10014 in the real Rust UDP path
+while the IPv4 and IPv6 controls pass. Linux must pass the baseline. The workflow
+then applies the implementation patch, requires all three network tests to pass,
+and builds both executables using Rust 1.90.0 and `--locked`. Logs and results are
+retained independently of build success. Candidate binaries and exact tracked
+source, patched shared code and the public recipe are archived together.
+
+These are unsigned test artifacts. Passing shared UDP tests does not prove an
+authorized native session, Windows Server 2016 compatibility, Internet NAT
+traversal or relay fallback. Validate those on the isolated lab before changing
+distribution pins. Production publication still requires release approval,
+valid signatures and corresponding public source; this workflow publishes no
+production release and makes no claim of binary reproducibility.
+
+## Linux candidate deployment and integration gate
+
+`Dockerfile` builds the patched rendezvous/relay from the same immutable public
+server and shared-submodule pins. The public recipe is pinned independently to
+project revision `650361413543baf7ef150f5960544154ec77ddeb`; changing the current
+checkout cannot silently change those transport inputs. Rust and both base
+images are pinned, Cargo uses its verified lockfile, and the image contains
+`/usr/share/doc/swan-transport/transport-build-source.zip`, the exact patched
+source, recipe, receipt and AGPL notice. This establishes input provenance;
+apt repositories and compiler output are not claimed bit-for-bit reproducible.
+
+For a **fresh isolated test deployment**, explicitly select the override:
+
+```sh
+docker compose -f deployment/linux/compose.yaml -f deployment/linux/compose.maintained-transport.yaml up --build -d
+```
+
+Do not apply it to existing company volumes before backup/migration verification.
+The normal deployment remains on its previously recorded component pins pending
+candidate acceptance. No project registry image or production release is
+published by this build. The company-component CI now also builds this candidate
+and runs the existing real HTTPS, enrollment and encrypted complete backup/restore
+rehearsal against its immutable local image ID. It validates the embedded public
+recipe receipt before creating the rehearsal stack. These integration checks
+still do not prove native direct/relay sessions or public reachability.
+
+After a successful rehearsal, CI retains
+`MaintainedTransport-Linux-x64-UNSIGNED-TEST`: both Linux x86-64 binaries,
+`transport-build-source.zip`, `SWAN-SOURCE.json`, AGPL license and a hash manifest
+binding them to the immutable image ID and packaging revision. Extraction uses
+an owned stopped container, checks executable architecture and the archived UDP
+patch, and runs no candidate executable. This artifact remains a test input;
+it is not a signed release or a published production container image.
diff --git a/deployment/transport/archive_source.py b/deployment/transport/archive_source.py
new file mode 100644
index 00000000000..fb6f9b9d4a8
--- /dev/null
+++ b/deployment/transport/archive_source.py
@@ -0,0 +1,48 @@
+"""Archive tracked transport inputs, patched shared code and the public recipe."""
+import hashlib
+import json
+import subprocess
+import sys
+import zipfile
+from pathlib import Path, PurePosixPath
+
+source = Path(sys.argv[1]).resolve(strict=True)
+output = Path(sys.argv[2]).resolve()
+project = Path(__file__).resolve().parent
+receipt = json.loads((source / "SWAN-SOURCE.json").read_text())
+if receipt["stage"] != "fix":
+    raise SystemExit("Refusing to archive an unpatched transport candidate")
+pins = json.loads((project / "source.json").read_text())
+shared = source / "libs/hbb_common"
+if (receipt["upstream"] != pins
+        or subprocess.check_output(["git", "-C", str(source), "rev-parse", "HEAD"], text=True).strip() != pins["commit"]
+        or subprocess.check_output(["git", "-C", str(shared), "rev-parse", "HEAD"], text=True).strip() != pins["hbb_common_commit"]):
+    raise SystemExit("Transport archive does not use the pinned public revisions")
+# Compilation can mutate the tracked SQLite schema database. A correctly
+# ordered build must archive first; do not silently call a changed working tree
+# the exact public inputs. Only the hash-verified UDP patch is allowed to differ.
+for directory, excluded in [(source, "libs/hbb_common"), (shared, "src/udp.rs")]:
+    subprocess.run(["git", "-C", str(directory), "diff", "--cached", "--quiet", "HEAD"], check=True)
+    subprocess.run(["git", "-C", str(directory), "diff", "--quiet", "HEAD", "--", ".", ":!" + excluded], check=True)
+udp = (shared / "src/udp.rs").read_bytes().replace(b"\r\n", b"\n")
+if hashlib.sha256(udp).hexdigest() != pins["patches"][-1]["after_sha256"]:
+    raise SystemExit("Transport archive UDP source does not match the reviewed patch")
+tracked = subprocess.check_output(["git", "-C", str(source), "ls-files", "--recurse-submodules", "-z"])
+files = {}
+for raw in filter(None, tracked.split(b"\0")):
+    name = raw.decode()
+    relative = PurePosixPath(name)
+    path = source.joinpath(*relative.parts)
+    if relative.is_absolute() or any(part in ("..", ".git") for part in relative.parts) or path.is_symlink() or not path.is_file():
+        raise SystemExit("Unsafe or missing tracked transport input")
+    files["rustdesk-server/" + name] = path
+files["rustdesk-server/SWAN-SOURCE.json"] = source / "SWAN-SOURCE.json"
+for name in ("source.json", "prepare_source.py", "check_baseline.py", "archive_source.py",
+             "patches/0001-udp-address-regression.patch", "patches/0002-udp-address-normalization.patch"):
+    files["swan-recipe/" + name] = project / name
+output.parent.mkdir(parents=True, exist_ok=True)
+with zipfile.ZipFile(output, "x", compression=zipfile.ZIP_DEFLATED) as archive:
+    for name, path in sorted(files.items()):
+        archive.writestr(name, path.read_bytes())
+print(json.dumps({"source_files": len(files), "sha256": hashlib.sha256(output.read_bytes()).hexdigest(),
+                  "scope": "Exact transport build inputs and recipe; not binary reproducibility"}))
diff --git a/deployment/transport/check_baseline.py b/deployment/transport/check_baseline.py
new file mode 100644
index 00000000000..8a9fa1e9052
--- /dev/null
+++ b/deployment/transport/check_baseline.py
@@ -0,0 +1,35 @@
+"""Verify the baseline failure or the fixed real UDP paths, retaining logs."""
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+source = Path(sys.argv[1]).resolve(strict=True)
+stage = sys.argv[2] if len(sys.argv) == 3 else "baseline"
+if stage not in ("baseline", "fixed"):
+    raise SystemExit("Select baseline or fixed verification")
+result = subprocess.run(["cargo", "+1.90.0", "test", "--release", "--locked", "-p", "hbb_common",
+                         "swan_udp_tests", "--", "--test-threads=1"], cwd=source,
+                        stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+log = result.stdout.decode(errors="replace")
+evidence = source / "swan-evidence"
+evidence.mkdir(exist_ok=stage == "fixed")
+(evidence / (stage + ".log")).write_bytes(result.stdout)
+windows = os.name == "nt"
+expected_failure = (result.returncode != 0 and "os error 10014" in log
+                    and "dual_stack_sends_ipv4_message_and_raw_datagrams ... FAILED" in log
+                    and "ipv4_sender_keeps_ipv4_destination ... ok" in log
+                    and "ipv6_sender_keeps_native_ipv6_destination ... ok" in log)
+all_passed = result.returncode == 0 and all(name + " ... ok" in log for name in (
+    "dual_stack_sends_ipv4_message_and_raw_datagrams",
+    "ipv4_sender_keeps_ipv4_destination", "ipv6_sender_keeps_native_ipv6_destination"))
+passed = expected_failure if windows and stage == "baseline" else all_passed
+receipt = {"stage": stage, "windows": windows, "exit_code": result.returncode,
+           "expected_winsock_failure_reproduced": expected_failure,
+           "baseline_check_passed": passed}
+(evidence / (stage + ".json")).write_text(json.dumps(receipt, indent=2) + "\n")
+print("\n".join(log.splitlines()[-60:]))
+print(json.dumps(receipt))
+if not passed:
+    raise SystemExit("Baseline did not demonstrate the required platform behavior; no fix accepted")
diff --git a/deployment/transport/patches/0001-udp-address-regression.patch b/deployment/transport/patches/0001-udp-address-regression.patch
new file mode 100644
index 00000000000..10d2fa495a8
--- /dev/null
+++ b/deployment/transport/patches/0001-udp-address-regression.patch
@@ -0,0 +1,62 @@
+--- a/src/udp.rs
++++ b/src/udp.rs
+@@ -169,3 +169,59 @@
+         None
+     }
+ }
++
++
++#[cfg(test)]
++mod swan_udp_tests {
++    use super::*;
++    use crate::rendezvous_proto::TestNatRequest;
++    use std::time::Duration;
++
++    fn framed_sender(address: SocketAddr, dual_stack: bool) -> ResultType<FramedSocket> {
++        let domain = if address.is_ipv6() { Domain::ipv6() } else { Domain::ipv4() };
++        let socket = Socket::new(domain, Type::dgram(), None)?;
++        if address.is_ipv6() { socket.set_only_v6(!dual_stack)?; }
++        socket.set_nonblocking(true)?;
++        socket.bind(&address.into())?;
++        Ok(FramedSocket::Direct(UdpFramed::new(
++            UdpSocket::from_std(socket.into_udp_socket())?, BytesCodec::new(),
++        )))
++    }
++
++    #[tokio::test]
++    async fn dual_stack_sends_ipv4_message_and_raw_datagrams() -> ResultType<()> {
++        let receiver = UdpSocket::bind("127.0.0.1:0").await?;
++        let mut sender = framed_sender("[::]:0".parse()?, true)?;
++        let request = TestNatRequest { serial: 21116, ..Default::default() };
++        sender.send(&request, receiver.local_addr()?).await?;
++        let mut buffer = [0u8; 256];
++        let count = tokio::time::timeout(Duration::from_secs(2), receiver.recv(&mut buffer)).await??;
++        assert_eq!(TestNatRequest::parse_from_bytes(&buffer[..count])?.serial, 21116);
++        sender.send_raw(b"Swan raw UDP", receiver.local_addr()?).await?;
++        let count = tokio::time::timeout(Duration::from_secs(2), receiver.recv(&mut buffer)).await??;
++        assert_eq!(&buffer[..count], b"Swan raw UDP");
++        Ok(())
++    }
++
++    #[tokio::test]
++    async fn ipv4_sender_keeps_ipv4_destination() -> ResultType<()> {
++        let receiver = UdpSocket::bind("127.0.0.1:0").await?;
++        let mut sender = framed_sender("127.0.0.1:0".parse()?, false)?;
++        sender.send_raw(b"IPv4 control", receiver.local_addr()?).await?;
++        let mut buffer = [0u8; 64];
++        let count = tokio::time::timeout(Duration::from_secs(2), receiver.recv(&mut buffer)).await??;
++        assert_eq!(&buffer[..count], b"IPv4 control");
++        Ok(())
++    }
++
++    #[tokio::test]
++    async fn ipv6_sender_keeps_native_ipv6_destination() -> ResultType<()> {
++        let receiver = UdpSocket::bind("[::1]:0").await?;
++        let mut sender = framed_sender("[::1]:0".parse()?, false)?;
++        sender.send_raw(b"IPv6 control", receiver.local_addr()?).await?;
++        let mut buffer = [0u8; 64];
++        let count = tokio::time::timeout(Duration::from_secs(2), receiver.recv(&mut buffer)).await??;
++        assert_eq!(&buffer[..count], b"IPv6 control");
++        Ok(())
++    }
++}
diff --git a/deployment/transport/patches/0002-udp-address-normalization.patch b/deployment/transport/patches/0002-udp-address-normalization.patch
new file mode 100644
index 00000000000..2e59af84838
--- /dev/null
+++ b/deployment/transport/patches/0002-udp-address-normalization.patch
@@ -0,0 +1,36 @@
+--- a/src/udp.rs
++++ b/src/udp.rs
+@@ -43,6 +43,17 @@
+     }
+     socket.bind(&addr.into())?;
+     Ok(socket)
++}
++
++fn destination_for_socket(local: SocketAddr, destination: SocketAddr) -> SocketAddr {
++    match (local, destination) {
++        // Winsock rejects an AF_INET sockaddr on an AF_INET6 socket with
++        // WSAEFAULT (10014), even when IPV6_V6ONLY is disabled.
++        (SocketAddr::V6(_), SocketAddr::V4(address)) => SocketAddr::V6(
++            std::net::SocketAddrV6::new(address.ip().to_ipv6_mapped(), address.port(), 0, 0),
++        ),
++        (_, destination) => destination,
++    }
+ }
+ 
+ impl FramedSocket {
+@@ -100,6 +111,7 @@
+         match self {
+             Self::Direct(f) => {
+                 if let TargetAddr::Ip(addr) = addr {
++                    let addr = destination_for_socket(f.get_ref().local_addr()?, addr);
+                     f.send((send_data, addr)).await?
+                 }
+             }
+@@ -120,6 +132,7 @@
+         match self {
+             Self::Direct(f) => {
+                 if let TargetAddr::Ip(addr) = addr {
++                    let addr = destination_for_socket(f.get_ref().local_addr()?, addr);
+                     f.send((Bytes::from(msg), addr)).await?
+                 }
+             }
diff --git a/deployment/transport/prepare_source.py b/deployment/transport/prepare_source.py
new file mode 100644
index 00000000000..e303d8a9cb3
--- /dev/null
+++ b/deployment/transport/prepare_source.py
@@ -0,0 +1,60 @@
+"""Apply reviewed transport patches only to the exact public source pins."""
+import argparse
+import hashlib
+import json
+import subprocess
+from pathlib import Path
+
+
+def git(directory, *arguments):
+    return subprocess.check_output(["git", "-C", str(directory), *arguments])
+
+
+def canonical(path):
+    if not path.is_file() or path.is_symlink():
+        raise ValueError("Expected a regular pinned source file")
+    return path.read_bytes().replace(b"\r\n", b"\n")
+
+
+def prepare(source, stage):
+    project = Path(__file__).resolve().parent
+    manifest = json.loads((project / "source.json").read_text())
+    source = source.resolve(strict=True)
+    shared = source / "libs/hbb_common"
+    if git(source, "rev-parse", "HEAD").decode().strip() != manifest["commit"]:
+        raise ValueError("Wrong transport source revision")
+    if git(shared, "rev-parse", "HEAD").decode().strip() != manifest["hbb_common_commit"]:
+        raise ValueError("Wrong shared transport source revision")
+    if hashlib.sha256(canonical(source / "Cargo.lock")).hexdigest() != manifest["cargo_lock_sha256"]:
+        raise ValueError("Pinned transport dependency lock changed")
+    if stage == "tests" and git(source, "status", "--porcelain").strip():
+        raise ValueError("Baseline checkout must be clean before adding the regression")
+    entry = manifest["patches"][0 if stage == "tests" else 1]
+    patch = (project / entry["path"]).resolve(strict=True)
+    if patch.parent != project / "patches" or hashlib.sha256(patch.read_bytes()).hexdigest() != entry["sha256"]:
+        raise ValueError("Transport patch identity differs")
+    target = shared / "src/udp.rs"
+    before = canonical(target)
+    if hashlib.sha256(before).hexdigest() != entry["before_sha256"]:
+        raise ValueError("Transport source differs from the reviewed patch input")
+    # Use a canonical checkout representation for identical patch application on
+    # Windows and Linux; Git still records the same public source content.
+    target.write_bytes(before)
+    git(shared, "apply", "--check", "--whitespace=error-all", str(patch))
+    git(shared, "apply", "--whitespace=error-all", str(patch))
+    if hashlib.sha256(canonical(target)).hexdigest() != entry["after_sha256"]:
+        raise ValueError("Patched transport source differs from reviewed output")
+    receipt = {"upstream": manifest, "stage": stage,
+               "project_revision": git(project, "rev-parse", "HEAD").decode().strip(),
+               "patched_udp_sha256": entry["after_sha256"], "unsigned_test": True}
+    (source / "SWAN-SOURCE.json").write_text(json.dumps(receipt, indent=2) + "\n")
+    print(json.dumps({"stage": stage, "source": manifest["commit"],
+                      "shared_source": manifest["hbb_common_commit"], "patch_verified": True}))
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("source", type=Path)
+    parser.add_argument("stage", choices=("tests", "fix"))
+    arguments = parser.parse_args()
+    prepare(arguments.source, arguments.stage)
diff --git a/deployment/transport/prepare_windows_components.py b/deployment/transport/prepare_windows_components.py
new file mode 100644
index 00000000000..ebf0db57561
--- /dev/null
+++ b/deployment/transport/prepare_windows_components.py
@@ -0,0 +1,199 @@
+"""Prepare public Windows server inputs; never execute supplied components.
+
+Binary pins and a canonical digest of all corresponding source/recipe files
+bind the maintained transport to reviewed public inputs. Build receipts are
+checked separately because their project revision varies between CI runs.
+"""
+import argparse
+import hashlib
+import io
+import json
+from pathlib import Path, PurePosixPath
+import re
+import stat
+import struct
+import zipfile
+
+ROOT = Path(__file__).resolve().parents[2]
+SOURCE_RECEIPT = "rustdesk-server/SWAN-SOURCE.json"
+TRANSPORT_FILES = {
+    "transport-source/target/release/hbbs.exe": 128 * 1024**2,
+    "transport-source/target/release/hbbr.exe": 128 * 1024**2,
+    "transport-source/SWAN-SOURCE.json": 128 * 1024,
+    "transport-artifacts/transport-build-source.zip": 64 * 1024**2,
+}
+
+
+def canonical(value):
+    if b"\0" not in value:
+        try:
+            return value.decode("utf-8").replace("\r\n", "\n").encode("utf-8")
+        except UnicodeDecodeError:
+            pass
+    return value
+
+
+def entries(archive, limits=None):
+    result = {}
+    total = 0
+    for entry in archive.infolist():
+        name = entry.filename
+        path = PurePosixPath(name)
+        if (entry.is_dir() or path.is_absolute() or "\\" in name or ":" in name
+                or any(p in (".", "..") or p.endswith((" ", ".")) for p in path.parts)
+                or stat.S_ISLNK(entry.external_attr >> 16) or entry.flag_bits & 1
+                or name.casefold() in {p.casefold() for p in result}):
+            raise ValueError("Unsafe or duplicate server input")
+        limit = limits.get(name, -1) if limits is not None else 16 * 1024**2
+        total += entry.file_size
+        if not name or not 0 <= entry.file_size <= limit or total > 300 * 1024**2:
+            raise ValueError("Unexpected or oversized server input")
+        with archive.open(entry) as stream:
+            value = stream.read(limit + 1)
+        if len(value) != entry.file_size:
+            raise ValueError("Server input length changed")
+        result[name] = value
+    if limits is not None and set(result) != set(limits):
+        raise ValueError("Incomplete maintained transport input")
+    return result
+
+
+def read_file(path, limit):
+    info = path.lstat()
+    if (not stat.S_ISREG(info.st_mode) or getattr(info, "st_file_attributes", 0) & 1024
+            or info.st_size > limit):
+        raise ValueError("Expected a bounded regular server input")
+    with path.open("rb") as stream:
+        value = stream.read(limit + 1)
+    if len(value) > limit or len(value) != info.st_size:
+        raise ValueError("Server input changed or exceeded its size limit")
+    return value
+
+
+def transport_inputs(package=None, directory=None):
+    if package is not None:
+        with zipfile.ZipFile(io.BytesIO(read_file(package, 300 * 1024**2))) as archive:
+            return entries(archive, TRANSPORT_FILES)
+    info = directory.lstat()
+    if not stat.S_ISDIR(info.st_mode) or getattr(info, "st_file_attributes", 0) & 1024:
+        raise ValueError("Expected a regular maintained transport directory")
+    directory = directory.resolve(strict=True)
+    allowed_directories = {str(parent) for name in TRANSPORT_FILES
+                           for parent in PurePosixPath(name).parents if str(parent) != "."}
+    found = set()
+    for path in directory.rglob("*"):
+        info = path.lstat()
+        if stat.S_ISLNK(info.st_mode) or getattr(info, "st_file_attributes", 0) & 1024:
+            raise ValueError("Maintained transport inputs must not contain links")
+        if stat.S_ISREG(info.st_mode):
+            found.add(path.relative_to(directory).as_posix())
+        elif not stat.S_ISDIR(info.st_mode) or path.relative_to(directory).as_posix() not in allowed_directories:
+            raise ValueError("Unexpected maintained transport directory entry")
+    if found != set(TRANSPORT_FILES):
+        raise ValueError("Unexpected maintained transport directory contents")
+    return {name: read_file(directory / name, limit) for name, limit in TRANSPORT_FILES.items()}
+
+
+def source_tree_digest(files):
+    digest = hashlib.sha256(b"swan-windows-transport-source-v1\0")
+    items = sorted((name, canonical(value)) for name, value in files.items() if name != SOURCE_RECEIPT)
+    digest.update(struct.pack(">Q", len(items)))
+    for name, value in items:
+        encoded = name.encode("utf-8")
+        digest.update(struct.pack(">Q", len(encoded))); digest.update(encoded)
+        digest.update(struct.pack(">Q", len(value))); digest.update(value)
+    return digest.hexdigest()
+
+
+def normalized_source(files):
+    # Source-only metadata/line endings become deterministic. Shipping EXEs are
+    # never modified. ZIP_STORED avoids compression-library version dependence.
+    output = io.BytesIO()
+    with zipfile.ZipFile(output, "w", compression=zipfile.ZIP_STORED) as archive:
+        for name, value in sorted(files.items()):
+            entry = zipfile.ZipInfo(name, date_time=(1980, 1, 1, 0, 0, 0))
+            entry.create_system = 3
+            entry.external_attr = 0o100644 << 16
+            archive.writestr(entry, canonical(value))
+    return output.getvalue()
+
+
+def prepare(inputs, https_package, destination, root=ROOT):
+    manifest_bytes = (root / "deployment/windows/server-components.json").read_bytes()
+    manifest = json.loads(manifest_bytes)
+    pins = json.loads((root / "deployment/transport/source.json").read_text(encoding="utf-8"))
+    if (manifest["schema"] != 2 or manifest["architecture"] != "x86_64"
+            or manifest["transport"]["kind"] != "swan-maintained-source-build"):
+        raise ValueError("Maintained Windows component policy required")
+    for name, expected in manifest["transport"]["binary_sha256"].items():
+        if name not in ("hbbs.exe", "hbbr.exe"):
+            raise ValueError("Unexpected maintained executable")
+        if hashlib.sha256(inputs["transport-source/target/release/" + name]).hexdigest() != expected:
+            raise ValueError("Maintained Windows executable hash mismatch")
+    if set(manifest["transport"]["binary_sha256"]) != {"hbbs.exe", "hbbr.exe"}:
+        raise ValueError("Incomplete maintained binary pins")
+    with zipfile.ZipFile(io.BytesIO(inputs["transport-artifacts/transport-build-source.zip"])) as archive:
+        source = entries(archive)
+    if (len(source) != manifest["transport"]["source_files"]
+            or source_tree_digest(source) != manifest["transport"]["source_tree_sha256"]):
+        raise ValueError("Maintained transport corresponding source mismatch")
+    if canonical(source[SOURCE_RECEIPT]) != canonical(inputs["transport-source/SWAN-SOURCE.json"]):
+        raise ValueError("Transport source receipts differ")
+    receipt = json.loads(source[SOURCE_RECEIPT])
+    if (set(receipt) != {"upstream", "stage", "project_revision", "patched_udp_sha256", "unsigned_test"}
+            or receipt["stage"] != "fix" or receipt["upstream"] != pins
+            or receipt["patched_udp_sha256"] != pins["patches"][-1]["after_sha256"]
+            or receipt["unsigned_test"] is not True
+            or not re.fullmatch(r"[a-f0-9]{40}", receipt["project_revision"])):
+        raise ValueError("Maintained transport build policy mismatch")
+    https = read_file(https_package, 256 * 1024**2)
+    if hashlib.sha256(https).hexdigest() != manifest["https"]["sha256"]:
+        raise ValueError("Pinned HTTPS archive hash mismatch")
+    with zipfile.ZipFile(io.BytesIO(https)) as archive:
+        names = archive.namelist()
+        if names.count("caddy.exe") != 1 or names.count("LICENSE") != 1:
+            raise ValueError("HTTPS executable or license missing")
+        if archive.getinfo("caddy.exe").file_size > 128 * 1024**2 or not 0 < archive.getinfo("LICENSE").file_size <= 128 * 1024:
+            raise ValueError("HTTPS component exceeds size limit")
+        caddy, caddy_license = archive.read("caddy.exe"), archive.read("LICENSE")
+    if hashlib.sha256(caddy).hexdigest() != manifest["https"]["binary_sha256"]:
+        raise ValueError("Pinned HTTPS executable mismatch")
+    outputs = {name: inputs["transport-source/target/release/" + name] for name in ("hbbs.exe", "hbbr.exe")}
+    outputs.update({"caddy.exe": caddy, "Caddy-LICENSE.txt": caddy_license,
+                    "RustDesk-LICENSE.txt": canonical(source["rustdesk-server/LICENSE"]),
+                    "transport-build-source.zip": normalized_source(source),
+                    "server-components.json": canonical(manifest_bytes)})
+    notices = ("RustDesk rendezvous/relay: AGPL-3.0, upstream RustDesk contributors; Swan maintained UDP normalization.\n"
+               f"Upstream source: {manifest['transport']['source']}\n"
+               f"Public recipe revision: https://github.com/rijff24/SwanRemoteSupport/tree/{receipt['project_revision']}/deployment/transport\n"
+               "Complete corresponding source and recipe: transport-build-source.zip (source ZIP metadata and text checkout endings normalized).\n\n"
+               f"Caddy HTTPS server: Apache-2.0, upstream Caddy contributors.\nSource: {manifest['https']['source']}\n"
+               "Retain both licenses, notices and the transport source archive with distributions. Test inputs do not establish production signing approval.\n")
+    outputs["THIRD-PARTY.txt"] = notices.encode("utf-8")
+    destination = destination.absolute()
+    if destination.exists() or destination.is_symlink():
+        raise ValueError("Component output directory already exists")
+    destination.mkdir()  # Exclusive create, after all input verification.
+    for name, value in outputs.items():
+        with (destination / name).open("xb") as stream:
+            stream.write(value)
+    return {"maintained_transport": True, "verified_source_files": len(source),
+            "source_tree_sha256": source_tree_digest(source), "project_revision": receipt["project_revision"],
+            "sha256": {name: hashlib.sha256(value).hexdigest() for name, value in outputs.items()},
+            "supplier_executables_run": False, "production_publication": False}
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    choice = parser.add_mutually_exclusive_group(required=True)
+    choice.add_argument("--transport-package", type=Path)
+    choice.add_argument("--transport-directory", type=Path)
+    parser.add_argument("--https-package", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    result = prepare(transport_inputs(args.transport_package, args.transport_directory), args.https_package, args.output)
+    print(json.dumps(result, indent=2))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/transport/source.json b/deployment/transport/source.json
new file mode 100644
index 00000000000..b801cc1608b
--- /dev/null
+++ b/deployment/transport/source.json
@@ -0,0 +1,23 @@
+{
+  "schema": 1,
+  "repository": "https://github.com/rustdesk/rustdesk-server",
+  "commit": "9bae9f2f39d92c4b4ba2e28e089da5071897b22e",
+  "hbb_common_commit": "83419b6549636ee39dacef7776c473f5802e08d6",
+  "rust_toolchain": "1.90.0",
+  "cargo_lock_sha256": "a9c8c1a941df0c66a33eeadbb1b7fd413287aefb5f06e0e6ca30ceb92f8caad9",
+  "patches": [
+    {
+      "path": "patches/0001-udp-address-regression.patch",
+      "sha256": "e2ecf9da94c84e5447e81e8667a75dc73d4ab9179efec4f465414599c1f9ec15",
+      "before_sha256": "c7da75a4db64fea07f6dce1ad5a791fb4d791b15dcc41672129b0f6438ad8b2f",
+      "after_sha256": "024397429d5ec03888bff1b856f968764c4bb4e6b09ffa1b9c780ef93a6efac3"
+    },
+    {
+      "path": "patches/0002-udp-address-normalization.patch",
+      "sha256": "c862020cf0fddf6a50e401674006d41775dd955c3eb2a2e7c149260ad888adc2",
+      "before_sha256": "024397429d5ec03888bff1b856f968764c4bb4e6b09ffa1b9c780ef93a6efac3",
+      "after_sha256": "c881d983b3b1cb77be30cf557be84e65064c72f69b414792cd62230fa99811f4"
+    }
+  ],
+  "scope": "Candidate transport patch; not approved for production or substituted into current installers"
+}
diff --git a/deployment/transport/test_windows_components.py b/deployment/transport/test_windows_components.py
new file mode 100644
index 00000000000..dfb23dd3b2b
--- /dev/null
+++ b/deployment/transport/test_windows_components.py
@@ -0,0 +1,163 @@
+"""Verifier boundary tests with inert fixtures; no executable is run."""
+import copy
+import hashlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import tempfile
+import unittest
+import warnings
+import zipfile
+
+spec = importlib.util.spec_from_file_location("windows_components", Path(__file__).with_name("prepare_windows_components.py"))
+components = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(components)
+
+
+def zipped(files, date=(2024, 1, 1, 0, 0, 0)):
+    stream = io.BytesIO()
+    with zipfile.ZipFile(stream, "w") as archive:
+        for name, value in files.items():
+            archive.writestr(zipfile.ZipInfo(name, date_time=date), value)
+    return stream.getvalue()
+
+
+class WindowsComponentsTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory(prefix="swan-maintained-package-")
+        self.addCleanup(self.temporary.cleanup)
+        self.root = Path(self.temporary.name).resolve()
+        for directory in ("deployment/windows", "deployment/transport"):
+            (self.root / directory).mkdir(parents=True)
+        self.pins = {"patches": [{"after_sha256": "c" * 64}], "scope": "inert verifier fixture"}
+        self.receipt = {"upstream": self.pins, "stage": "fix", "project_revision": "a" * 40,
+                        "patched_udp_sha256": "c" * 64, "unsigned_test": True}
+        self.source = {"rustdesk-server/Cargo.toml": b"inert source fixture\n",
+                       "rustdesk-server/LICENSE": b"inert license fixture\n",
+                       "swan-recipe/recipe.py": b"# inert recipe fixture\n",
+                       components.SOURCE_RECEIPT: json.dumps(self.receipt).encode()}
+        self.inputs = {"transport-source/target/release/hbbs.exe": b"inert rendezvous fixture",
+                       "transport-source/target/release/hbbr.exe": b"inert relay fixture",
+                       "transport-source/SWAN-SOURCE.json": self.source[components.SOURCE_RECEIPT],
+                       "transport-artifacts/transport-build-source.zip": zipped(self.source)}
+        https = zipped({"caddy.exe": b"inert HTTPS fixture", "LICENSE": b"inert HTTPS license"})
+        self.https = self.root / "https.zip"
+        self.https.write_bytes(https)
+        self.manifest = {"schema": 2, "architecture": "x86_64",
+                         "transport": {"kind": "swan-maintained-source-build", "source": "https://example.test/source",
+                                       "binary_sha256": {n: hashlib.sha256(self.inputs["transport-source/target/release/" + n]).hexdigest() for n in ("hbbs.exe", "hbbr.exe")},
+                                       "source_files": len(self.source), "source_tree_sha256": components.source_tree_digest(self.source)},
+                         "https": {"source": "https://example.test/https", "sha256": hashlib.sha256(https).hexdigest(),
+                                   "binary_sha256": hashlib.sha256(b"inert HTTPS fixture").hexdigest()}}
+        (self.root / "deployment/windows/server-components.json").write_text(json.dumps(self.manifest), encoding="utf-8")
+        (self.root / "deployment/transport/source.json").write_text(json.dumps(self.pins), encoding="utf-8")
+        self.output = self.root / "prepared"
+
+    def prepare(self, inputs=None, destination=None):
+        return components.prepare(self.inputs if inputs is None else inputs, self.https,
+                                  self.output if destination is None else destination, self.root)
+
+    def reject(self, inputs):
+        with self.assertRaises(ValueError):
+            self.prepare(inputs)
+        self.assertFalse(self.output.exists(), "Rejected inputs must not create output")
+
+    def test_verified_bytes_source_and_licenses_retained_without_execution(self):
+        result = self.prepare()
+        self.assertFalse(result["supplier_executables_run"])
+        self.assertEqual(len(result["sha256"]), 8)
+        for name in ("hbbs.exe", "hbbr.exe"):
+            self.assertEqual((self.output / name).read_bytes(), self.inputs["transport-source/target/release/" + name])
+        with zipfile.ZipFile(self.output / "transport-build-source.zip") as source:
+            self.assertEqual(set(source.namelist()), set(self.source))
+            for entry in source.infolist():
+                self.assertEqual(entry.date_time, (1980, 1, 1, 0, 0, 0))
+        self.assertIn("AGPL-3.0", (self.output / "THIRD-PARTY.txt").read_text())
+
+    def test_source_zip_timestamps_and_checkout_endings_do_not_change_shipping_inputs(self):
+        first = self.prepare()
+        source = {name: value.replace(b"\n", b"\r\n") for name, value in self.source.items()}
+        inputs = dict(self.inputs)
+        inputs["transport-artifacts/transport-build-source.zip"] = zipped(source, (2025, 2, 2, 2, 2, 2))
+        second = self.prepare(inputs, self.root / "second")
+        self.assertEqual(first, second)
+
+    def test_changed_binary_rejected_before_any_output(self):
+        inputs = dict(self.inputs)
+        inputs["transport-source/target/release/hbbs.exe"] += b"changed"
+        self.reject(inputs)
+
+    def test_changed_source_and_extra_file_rejected(self):
+        for change in ("changed", "extra"):
+            source = dict(self.source)
+            source["rustdesk-server/Cargo.toml" if change == "changed" else "unexpected.py"] = b"unreviewed input"
+            inputs = dict(self.inputs)
+            inputs["transport-artifacts/transport-build-source.zip"] = zipped(source)
+            self.reject(inputs)
+
+    def test_forged_receipt_cannot_replace_verified_source(self):
+        for field, value in [("stage", "tests"), ("project_revision", "not-a-revision"),
+                             ("unsigned_test", False), ("patched_udp_sha256", "d" * 64),
+                             ("upstream", {"different": True}), ("unexpected", "unreviewed")]:
+            receipt = copy.deepcopy(self.receipt)
+            receipt[field] = value
+            source = dict(self.source)
+            source[components.SOURCE_RECEIPT] = json.dumps(receipt).encode()
+            inputs = dict(self.inputs)
+            inputs["transport-source/SWAN-SOURCE.json"] = source[components.SOURCE_RECEIPT]
+            inputs["transport-artifacts/transport-build-source.zip"] = zipped(source)
+            self.reject(inputs)
+
+    def test_outer_and_inner_receipt_must_agree(self):
+        inputs = dict(self.inputs)
+        inputs["transport-source/SWAN-SOURCE.json"] += b" "
+        self.reject(inputs)
+
+    def test_wrong_https_archive_rejected(self):
+        self.https.write_bytes(b"wrong archive")
+        self.reject(self.inputs)
+
+    def test_unsafe_and_duplicate_source_paths_rejected(self):
+        for name in ("../outside", "/absolute", "back\\slash", "drive:name"):
+            source = dict(self.source)
+            source[name] = b"unreviewed"
+            inputs = dict(self.inputs)
+            inputs["transport-artifacts/transport-build-source.zip"] = zipped(source)
+            self.reject(inputs)
+        stream = io.BytesIO()
+        with warnings.catch_warnings():
+            warnings.simplefilter("ignore", UserWarning)
+            with zipfile.ZipFile(stream, "w") as archive:
+                for _ in range(2):
+                    archive.writestr("duplicate", b"fixture")
+        inputs = dict(self.inputs)
+        inputs["transport-artifacts/transport-build-source.zip"] = stream.getvalue()
+        self.reject(inputs)
+
+    def test_existing_output_is_never_overwritten(self):
+        self.output.mkdir()
+        marker = self.output / "owned-marker"
+        marker.write_bytes(b"preserve")
+        with self.assertRaises(ValueError):
+            self.prepare()
+        self.assertEqual(marker.read_bytes(), b"preserve")
+
+    def test_artifact_zip_and_extracted_directory_have_same_strict_input_set(self):
+        package = self.root / "transport.zip"
+        package.write_bytes(zipped(self.inputs))
+        self.assertEqual(components.transport_inputs(package=package), self.inputs)
+        directory = self.root / "artifact"
+        directory.mkdir()
+        for name, value in self.inputs.items():
+            path = directory / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes(value)
+        self.assertEqual(components.transport_inputs(directory=directory), self.inputs)
+        (directory / "unexpected").write_bytes(b"unreviewed")
+        with self.assertRaises(ValueError):
+            components.transport_inputs(directory=directory)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/web/test-company-setup.js b/deployment/web/test-company-setup.js
new file mode 100644
index 00000000000..f2912880615
--- /dev/null
+++ b/deployment/web/test-company-setup.js
@@ -0,0 +1,94 @@
+// Browser-form contract checks only; these do not replace real setup/MFA tests.
+'use strict';
+const assert=require('node:assert/strict');
+const fs=require('node:fs');
+const path=require('node:path');
+const vm=require('node:vm');
+const {webcrypto}=require('node:crypto');
+const source=fs.readFileSync(path.join(__dirname,'../../product/management/web/app.js'),'utf8').replace(/\r\n/g,'\n');
+const brand={display_name:'Default support',primary_color:'#007F82',logo_svg:'<svg></svg>',support_url:'',consent_text:'Ask before support.',support_contacts:'',shortcuts:[]};
+
+async function fixture(){
+  const nodes=new Map(),requests=[];
+  class Element {
+    constructor(){this.listeners={};this.children=[];this.disabled=false;this.hidden=false;this.textContent='';}
+    addEventListener(type,callback){this.listeners[type]=callback;}
+    querySelector(selector){
+      if(!this.parts)this.parts=new Map();
+      if(!this.parts.has(selector))this.parts.set(selector,new Element());
+      return this.parts.get(selector);
+    }
+    set innerHTML(html){
+      this.html=html;
+      for(const match of html.matchAll(/\bid="([^"]+)"/g))nodes.set('#'+match[1],new Element());
+    }
+    get innerHTML(){return this.html;}
+  }
+  for(const id of ['content','notice','title','description','nav','logout'])nodes.set('#'+id,new Element());
+  const context=vm.createContext({
+    document:{querySelector:selector=>nodes.get(selector)||null,querySelectorAll:()=>[]},
+    crypto:webcrypto,Uint8Array,TextDecoder,atob:value=>Buffer.from(value,'base64').toString('binary'),
+    FormData:class{constructor(form){return form.values;}},
+    fetch:async(url,options)=>{
+      requests.push({url,options,body:options.body&&JSON.parse(options.body)});
+      let value;
+      if(url==='/api/v1/status')value={configured:false};
+      else if(url==='/api/v1/default-branding')value=brand;
+      else if(url==='/api/v1/setup'&&options.method==='POST')value={configured:true};
+      else if(url==='/api/v1/profile'&&options.method==='GET'){
+        const profile=requests.find(r=>r.url==='/api/v1/setup').body.profile;
+        value={payload:Buffer.from(JSON.stringify(profile)).toString('base64'),signature:'contract-fixture-only'};
+      }else if(url==='/api/v1/profile'&&options.method==='PUT')value={revision:2};
+      else throw Error('Unexpected contract request: '+url);
+      return {ok:true,json:async()=>value};
+    }
+  });
+  assert.ok(source.endsWith('initialize();\n'));
+  vm.runInContext(source.replace(/initialize\(\);\n$/,'globalThis.initialization=initialize();\n'),context);
+  await context.initialization;
+  return {context,nodes,requests};
+}
+function values(){
+  const v=new FormData();
+  for(const [key,value] of Object.entries({url:'https://support.example.org/',rendezvous:'id.example.org:32116',relay:'relay.example.org:32117',key:'public-transport-key',setup_token:'one-use-setup-token',username:'owner',password:'example password for form contract',code:'123456',rollout:'23',update_channel:'test',maintenance_start:'23',maintenance_end:'4',paused:'on'}))v.set(key,value);
+  for(const edition of ['customer','technician']){
+    for(const [key,value] of Object.entries({name:edition==='customer'?'Example customer care':'Example service desk',color:edition==='customer'?'#123456':'#654321',support:'https://example.org/'+edition,contacts:'Company help desk',consent:'Only approve a known technician.',logo:'<svg><path d="M0 0"/></svg>'}))v.set(edition+'_'+key,value);
+    v.append(edition+'_shortcut_label','Company '+edition);v.append(edition+'_shortcut_url','https://example.org/help/'+edition);
+  }
+  return v;
+}
+async function submit(form,v){form.values=v;await form.listeners.submit({preventDefault(){},target:form});}
+
+(async()=>{
+  const f=await fixture();
+  const html=f.nodes.get('#content').innerHTML;
+  for(const name of ['customer_name','technician_name','customer_color','technician_color','customer_contacts','technician_contacts','customer_logo','technician_logo','unattended','paused','rollout','update_channel','maintenance_start','maintenance_end'])assert.ok(html.includes('name="'+name+'"'),name+' is available before setup');
+  assert.ok(html.includes('&lt;svg&gt;'),'SVG source is escaped in the form');
+  const v=values();await submit(f.nodes.get('#setup'),v);
+  const sent=f.requests.find(r=>r.url==='/api/v1/setup');assert.ok(sent);
+  assert.equal(sent.options.headers.Authorization,'Bearer one-use-setup-token');
+  assert.match(sent.body.totp_secret,/^[A-Z2-7]{32}$/);
+  assert.equal(sent.body.username,'owner');assert.equal(sent.body.totp_code,'123456');
+  const p=sent.body.profile;
+  assert.equal(p.management_url,'https://support.example.org');assert.equal(p.rendezvous,'id.example.org:32116');assert.equal(p.relay,'relay.example.org:32117');assert.equal(p.transport_public_key,'public-transport-key');
+  for(const edition of ['customer','technician']){
+    assert.equal(p[edition].display_name,v.get(edition+'_name'));assert.equal(p[edition].primary_color,v.get(edition+'_color'));assert.equal(p[edition].logo_svg,v.get(edition+'_logo'));assert.equal(p[edition].support_url,v.get(edition+'_support'));assert.equal(p[edition].support_contacts,v.get(edition+'_contacts'));assert.equal(p[edition].consent_text,v.get(edition+'_consent'));
+    assert.deepEqual(p[edition].shortcuts,[{label:'Company '+edition,url:'https://example.org/help/'+edition}]);
+  }
+  assert.equal(p.allow_unattended,false);assert.equal(p.updates_paused,true);assert.equal(p.rollout_percent,23);assert.equal(p.update_channel,'test');assert.equal(p.maintenance_start_utc,23);assert.equal(p.maintenance_end_utc,4);
+  assert.equal(brand.display_name,'Default support');assert.deepEqual(brand.shortcuts,[]);
+  assert.ok(f.nodes.get('#login'),'Successful setup returns to MFA login');
+
+  await vm.runInContext('screens.branding()',f.context);
+  v.set('customer_name','Updated customer care');v.set('unattended','on');v.delete('paused');
+  await submit(f.nodes.get('#branding'),v);
+  const edited=f.requests.find(r=>r.url==='/api/v1/profile'&&r.options.method==='PUT').body;
+  assert.equal(edited.customer.display_name,'Updated customer care');assert.equal(edited.technician.display_name,'Example service desk');assert.equal(edited.allow_unattended,true);assert.equal(edited.updates_paused,false);
+
+  const invalid=await fixture(),bad=values();bad.delete('customer_shortcut_url');
+  await submit(invalid.nodes.get('#setup'),bad);
+  assert.equal(invalid.requests.filter(r=>r.url==='/api/v1/setup').length,0,'Incomplete shortcuts must not create a company');
+  assert.match(invalid.nodes.get('#notice').textContent,/complete website shortcuts/);
+  assert.equal(invalid.nodes.get('#setup').querySelector('button[type=submit]').disabled,false);
+  console.log('Company setup and profile-editor form contracts passed (not server or browser acceptance).');
+})().catch(error=>{console.error(error);process.exitCode=1;});
diff --git a/deployment/web/test-installation-status.js b/deployment/web/test-installation-status.js
new file mode 100644
index 00000000000..8ef42482c7d
--- /dev/null
+++ b/deployment/web/test-installation-status.js
@@ -0,0 +1,64 @@
+// Browser contract checks; real reporting and native update tests remain separate.
+'use strict';
+const assert=require('node:assert/strict');
+const fs=require('node:fs');
+const path=require('node:path');
+const vm=require('node:vm');
+
+async function main(){
+  const nodes=new Map(),timers=new Map(),requests=[];
+  let timer=0,hold=false,release,releaseLogout;
+  class Element{
+    addEventListener(){}
+    set innerHTML(value){this.html=value;for(const match of value.matchAll(/\bid="([^"]+)"/g))nodes.set('#'+match[1],new Element());}
+    get innerHTML(){return this.html;}
+  }
+  for(const id of ['content','notice','title','description','nav','logout'])nodes.set('#'+id,new Element());
+  const rows=[
+    {owner_name:'<script>customer</script>',owner_state:'approved',edition:'customer',received_at:0,report:{installed_version:'1.5.7',phase:'downloading',downloaded_bytes:50,total_bytes:100}},
+    {owner_name:'Company technician',owner_state:'active',edition:'technician',received_at:Date.now()/1000,report:{installed_version:'1.5.8',phase:'installing',downloaded_bytes:0,total_bytes:null}},
+  ];
+  const response=value=>({ok:true,json:async()=>value});
+  const context=vm.createContext({
+    document:{querySelector:selector=>nodes.get(selector)||null,querySelectorAll:()=>[]},
+    setTimeout:(callback,delay)=>{assert.equal(delay,10000);timers.set(++timer,callback);return timer;},
+    clearTimeout:id=>timers.delete(id),
+    fetch:async(url,options)=>{
+      requests.push({url,options});
+      assert.equal(options.headers.Authorization,'Bearer fixture-session');
+      if(url==='/api/v1/logout')return new Promise(resolve=>{releaseLogout=()=>resolve(response({ok:true}));});
+      assert.match(url,/^\/api\/v1\/installations\?offset=(0|200)$/);
+      if(hold)return new Promise(resolve=>{release=()=>resolve(response({reports:rows,next_offset:200}));});
+      return response(url.endsWith('=0')?{reports:rows,next_offset:200}:{reports:[],next_offset:null});
+    },
+  });
+  const source=fs.readFileSync(path.join(__dirname,'../../product/management/web/app.js'),'utf8').replace(/\r\n/g,'\n');
+  assert.ok(source.endsWith('initialize();\n'));
+  vm.runInContext(source.replace(/initialize\(\);\n$/,''),context);
+  await vm.runInContext("accessToken='fixture-session';view('installations')",context);
+  let html=nodes.get('#content').innerHTML;
+  assert.ok(!html.includes('<script>customer'));
+  assert.ok(html.includes('&lt;script&gt;customer&lt;/script&gt;'));
+  assert.ok(html.includes('1.5.7')&&html.includes('1.5.8'));
+  assert.ok(html.includes('<progress max="100" value="50"></progress>'));
+  assert.ok(html.includes('Installing update')&&html.includes('Report is over 15 minutes old'));
+  assert.equal(timers.size,1);
+  await nodes.get('#installation-next').onclick();
+  assert.ok(nodes.get('#content').innerHTML.includes('No installation reports yet'));
+  assert.equal(timers.size,1,'Changing pages must replace the prior refresh');
+  await nodes.get('#installation-refresh').onclick();
+  assert.equal(timers.size,1);
+  hold=true;
+  const pending=nodes.get('#installation-refresh').onclick();
+  assert.equal(typeof release,'function');
+  const logout=nodes.get('#logout').onclick();
+  assert.equal(timers.size,0,'Sign-out must stop refresh before the server acknowledges it');
+  const signedOut=nodes.get('#content').innerHTML;
+  release();await pending;
+  assert.equal(nodes.get('#content').innerHTML,signedOut,'A response started before sign-out must never repopulate private installation data');
+  assert.ok(!signedOut.includes('customer&lt;/script&gt;'));
+  assert.equal(typeof releaseLogout,'function');releaseLogout();await logout;
+  assert.ok(requests.some(request=>request.url.endsWith('offset=200')));
+  console.log('Installation status: escaping, progress, pagination, bounded refresh and sign-out race checks passed.');
+}
+main().catch(error=>{console.error(error);process.exitCode=1;});
diff --git a/deployment/windows/07bb8d0-reproduction-and-lab-distribution.json b/deployment/windows/07bb8d0-reproduction-and-lab-distribution.json
new file mode 100644
index 00000000000..285490b5687
--- /dev/null
+++ b/deployment/windows/07bb8d0-reproduction-and-lab-distribution.json
@@ -0,0 +1,107 @@
+{
+  "recorded_utc": "2026-10-28T10:12:08.377174+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "version": "1.5.7",
+  "sequence": 9,
+  "native_comparison": {
+    "utc": "2026-10-28T09:24:03.021428+00:00",
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "comparison_run": 40663413228,
+    "comparison_artifact": 12804453216,
+    "comparison_artifact_digest": "sha256:b42a71875a4bf9cc66c46b5b8cdc45b2341b4c5be0948ad09c4030acc886adc7",
+    "report_sha256": "ac262d4829fde2f5ccb322e14995146c09bdee2b53c835ba7e7590d315d2180f",
+    "shipping_outputs_identical": 8,
+    "source_files_per_build": 1226,
+    "bridge_files_per_build": 6,
+    "msvc_files_per_build": [
+      618,
+      618
+    ],
+    "first_archive_matches_locally_verified_original": true,
+    "second_large_local_download_started": false,
+    "runtime_qualified": false,
+    "production_publication": false
+  },
+  "lab_signing": {
+    "all_seven_signatures_valid": true,
+    "key_nonexportable_verified": true,
+    "private_key_exported": false,
+    "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+    "lab_signed_only": true
+  },
+  "signed_shipping_outputs": [
+    {
+      "sha256": "aa2409b3cf923a6d13dd4a741b0a2a8971ba56b01f13643932a3300a99c6eab6",
+      "name": "agent-signed.exe",
+      "bytes": 5531440
+    },
+    {
+      "sha256": "5db646723587a5ac1e20636c66585635a04512dfe9c249e07cccfb3097f18402",
+      "name": "management-signed.exe",
+      "bytes": 8828720
+    },
+    {
+      "sha256": "128593c99f29b005f6c5713d2be6c3a2db2087702d9c7128cdbdb489c891436d",
+      "name": "worker-signed.exe",
+      "bytes": 4842288
+    },
+    {
+      "sha256": "0e3b8bbdaafdce97e0f96de81ca239189557ed0ca1921ebb78db3bcf81184c1b",
+      "name": "customer-main-signed.exe",
+      "bytes": 383792
+    },
+    {
+      "sha256": "ce64e0e76b8a8fe99574fa111a3a917c42ecddbde2d91ee8e46660c2da1e6071",
+      "name": "technician-signed.exe",
+      "bytes": 24266032
+    },
+    {
+      "sha256": "2f1aa66c652592c9cc721cca0cb3c796825c395a37062af45e3db1960cc4061a",
+      "name": "customer-1.5.7-signed.msi",
+      "bytes": 33640448
+    },
+    {
+      "sha256": "4e88c706f2b1bb2e93695d7dfac845585881ce66b732d992c37ab2b64f6ed1e9",
+      "name": "technician-1.5.7-signed.msi",
+      "bytes": 31391744
+    }
+  ],
+  "release_import_rejections": {
+    "invalid_signatures_rejected": true,
+    "request_cannot_override_operator_release_key": true,
+    "unapproved_builds_rejected_without_job_creation": true
+  },
+  "worker_and_bundle_recipes_unchanged": true,
+  "generated_bundles": [
+    {
+      "edition": "customer",
+      "bundle_sha256": "ba53b90779b6f09299ab4ee35fa511a57268e38d80c9df0753b3be1926055d1b",
+      "bytes": 32503058,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "bundle_sha256": "e047c8ec397c2726401fb6be249511c68c81fa35300059bc3379c7dee517f18f",
+      "bytes": 30303193,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "signed_profile_policy_unchanged": true,
+  "automatic_updates_paused": true,
+  "installer_runtime_qualified": false,
+  "native_session_through_maintained_transport_qualified": false,
+  "production_publication": false
+}
diff --git a/deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json b/deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json
new file mode 100644
index 00000000000..372c881e122
--- /dev/null
+++ b/deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json
@@ -0,0 +1,64 @@
+{
+  "recorded_utc": "2026-10-28T21:06:29.773867+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "clean_os": {
+    "caption": "Microsoft Windows Server 2016 Standard Evaluation",
+    "version": "10.0.14393",
+    "build": "14393",
+    "architecture": "64-bit",
+    "product_footprint_absent": true,
+    "tailscale_absent": true,
+    "autologon_disabled": true,
+    "ssh_acl_verified": true,
+    "normal_shutdown_verified": true,
+    "readonly_backing_preserved": true,
+    "full_memory_snapshot_used": false
+  },
+  "fixture_setup": {
+    "new_blank_disk_and_existing_official_evaluation_iso": true,
+    "specialize_lab_bootstrap_failed_before_product_install": true,
+    "original_installed_disk_preserved_readonly": true,
+    "original_seed_scripts_verified_and_repaired_through_existing_winrm": true,
+    "clean_os_verified_and_preserved_after_lab_repair_before_product_install": true,
+    "setup_media_detached_before_product_install": true,
+    "older_cancelled_uninstall_fixture_preserved": true
+  },
+  "fresh_customer_install": {
+    "version": "1.5.7",
+    "watch_state": "Running",
+    "profile_revision": 14,
+    "sequence": 9,
+    "shipping_verifier_passed": true,
+    "utc": "2026-10-28T20:50:24.3888057Z",
+    "all_signed_files": 96,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "company_enrollment_permissions": {
+    "utc": "2026-10-28T21:05:13.774045+00:00",
+    "version": "1.5.7",
+    "sequence": 9,
+    "actual_enrolled_customer": "WindowsServer2016",
+    "pending_inventory_hidden": true,
+    "pending_grant_status": 403,
+    "explicit_company_approval_verified": true,
+    "authorized_inventory_visible": true,
+    "unassigned_inventory_hidden": true,
+    "unassigned_grant_status": 403,
+    "unattended_without_consent_status": 403,
+    "other_device_records_unchanged": true,
+    "no_successful_grant_or_native_session_created": true,
+    "production_qualified": false
+  },
+  "limits": [
+    "Lab-only publisher and HTTPS trust; no production signing approval.",
+    "No native support session or current maintained-transport runtime qualification from this test.",
+    "No Server2016 GUI, upgrade, repair, uninstall, reboot-after-product-install or remote-feature qualification from this test.",
+    "No real Internet reachability or complete Windows compatibility matrix.",
+    "Automatic update rollout remains paused."
+  ]
+}
diff --git a/deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json b/deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json
new file mode 100644
index 00000000000..c2ece888055
--- /dev/null
+++ b/deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json
@@ -0,0 +1,105 @@
+{
+  "recorded_utc": "2026-10-28T11:54:33.646721+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "os": {
+    "caption": "Microsoft Windows 11 Enterprise Evaluation",
+    "ubr": 9457,
+    "build": "26300",
+    "version": "10.0.26300",
+    "display_version": "26H2"
+  },
+  "customer_upgrade": {
+    "consent_revision": 0,
+    "service_and_watch_running": true,
+    "profile_revision": 14,
+    "identity_credential_and_trust_preserved": true,
+    "shipping_verifier_passed": true,
+    "to_sequence": 9,
+    "utc": "2026-10-28T11:06:13.0216745Z",
+    "standard_user_controls_tested": false,
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "from_version": "1.5.5",
+    "from_sequence": 8,
+    "publisher_verified": true,
+    "production_qualified": false,
+    "to_version": "1.5.7",
+    "explicit_setup_not_automatic_rollout": true,
+    "unattended_consent_off": true
+  },
+  "ordinary_user_pause": {
+    "configuration_watcher_running": true,
+    "sequence": 9,
+    "version": "1.5.7",
+    "production_qualified": false,
+    "unattended_consent_off": true,
+    "native_pause_persisted": true,
+    "native_gui_owned_by_standard_account": true,
+    "consent_revision": 0,
+    "reboot_persistence_tested": false,
+    "utc": "2026-10-28T11:24:35.2154417Z",
+    "new_swan_msi_event_count": 0,
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "shipping_verifier_passed_after_resume": false,
+    "support_paused": true,
+    "gui_token_has_no_administrators_sid": true,
+    "identity_credential_trust_and_consent_preserved": true,
+    "service_installed_running_and_same_process": true,
+    "live_session_termination_tested": false
+  },
+  "normal_paused_reboot": {
+    "production_qualified": false,
+    "pause_persisted_through_normal_reboot": true,
+    "support_paused": true,
+    "unexpected_power_loss_event_count": 0,
+    "new_boot_utc": "2026-10-28T11:27:03.5000000Z",
+    "version": "1.5.7",
+    "kernel_boot_changed": true,
+    "utc": "2026-10-28T11:41:51.1072294Z",
+    "configuration_watch_started_automatically": true,
+    "manual_service_or_watcher_restart": false,
+    "consent_revision": 0,
+    "prior_boot_utc": "2026-10-28T10:10:28.5000000Z",
+    "headless_service_has_no_flutter_or_desktop_plugin_module": true,
+    "service_pid": 3040,
+    "shipping_verifier_passed": true,
+    "sequence": 9,
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "unattended_consent_off": true,
+    "identity_credential_trust_and_consent_preserved": true,
+    "service_started_automatically": true,
+    "normal_restart_event_and_clean_event_log_shutdown_verified": true
+  },
+  "ordinary_user_resume_after_reboot": {
+    "configuration_watcher_running": true,
+    "sequence": 9,
+    "version": "1.5.7",
+    "production_qualified": false,
+    "unattended_consent_off": true,
+    "native_pause_persisted": true,
+    "native_gui_owned_by_standard_account": true,
+    "consent_revision": 0,
+    "reboot_persistence_tested": true,
+    "utc": "2026-10-28T11:51:53.2604792Z",
+    "new_swan_msi_event_count": 0,
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "shipping_verifier_passed_after_resume": true,
+    "support_paused": false,
+    "gui_token_has_no_administrators_sid": true,
+    "identity_credential_trust_and_consent_preserved": true,
+    "service_installed_running_and_same_process": true,
+    "live_session_termination_tested": false
+  },
+  "observed_customer_interface": {
+    "company_branding_visible": true,
+    "normal_installed_common_shortcut_used_before_and_after_reboot": true,
+    "pause_footer_says_support_paused": true,
+    "duplicate_legacy_start_service_link_absent": true,
+    "one_resume_control_visible_while_paused": true,
+    "footer_returns_to_ready_after_resume": true,
+    "elevation_prompt_observed": false
+  },
+  "genuine_remote_session_during_pause_tested": false,
+  "technician_installer_test_is_separate": true,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false
+}
diff --git a/deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json b/deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json
new file mode 100644
index 00000000000..7d1704423c3
--- /dev/null
+++ b/deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json
@@ -0,0 +1,66 @@
+{
+  "utc": "2026-10-28T10:42:56.145831+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "version": "1.5.7",
+  "sequence": 9,
+  "os": {
+    "caption": "Microsoft Windows 11 Enterprise Evaluation",
+    "ubr": 9457,
+    "build": "26300",
+    "version": "10.0.26300",
+    "display_version": "26H2"
+  },
+  "actual_native_processes_owned_by_standard_user": true,
+  "actual_desktop_session": 1,
+  "company_branding_and_https_origin_visible": true,
+  "native_mfa_sign_in_succeeded": true,
+  "visible_authorized_device_count": 4,
+  "session_history_visible": true,
+  "independent_server_login_audit_matches": true,
+  "customer_identity_credential_and_consent_preserved": true,
+  "customer_release_sequence": 8,
+  "customer_profile_revision": 14,
+  "start_menu_shortcut_tested": false,
+  "fresh_standard_profile_install": false,
+  "new_native_remote_session_exercised": false,
+  "full_compatibility_matrix_qualified": false,
+  "production_publication": false,
+  "standard_user_installation": {
+    "always_install_elevated_not_enabled": true,
+    "standard_token_has_no_administrators_sid": true,
+    "no_device_or_privileged_enrollment_credential": true,
+    "shipping_verifier_passed": true,
+    "installed_hashes_and_publishers_verified": true,
+    "per_user_msi_registered_installed": true,
+    "company_branding_verified": true,
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "public_bootstrap_only": true,
+    "utc": "2026-10-28T10:18:14.3009029Z",
+    "continued_pre_msi_standard_profile": true,
+    "version": "1.5.7",
+    "profile_revision": 14,
+    "fresh_standard_profile_install": false,
+    "sequence": 9
+  },
+  "repair": {
+    "source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "pending_recovery_absent": true,
+    "bootstrap_trust_and_release_sequence_preserved": true,
+    "version": "1.5.7",
+    "utc": "2026-10-28T10:46:57.6504958Z",
+    "original_file_retained": true,
+    "missing_executable_restored_from_exact_signed_msi": true,
+    "shipping_verifier_passed": true,
+    "sequence": 9,
+    "production_publication": false,
+    "per_user_msi_still_registered": true,
+    "standard_token_has_no_administrators_sid": true,
+    "customer_identity_preserved": true,
+    "customer_credential_preserved": true,
+    "customer_consent_preserved": true,
+    "task_completed_successfully": true,
+    "original_failed_155_attempt_preserved": true
+  },
+  "native_sign_out_and_normal_window_close_observed": true,
+  "customer_upgrade_to_157_is_a_separate_pending_test": true
+}
diff --git a/deployment/windows/7407fa1-publisher-timeout-ci-evidence.json b/deployment/windows/7407fa1-publisher-timeout-ci-evidence.json
new file mode 100644
index 00000000000..f2de4697fe6
--- /dev/null
+++ b/deployment/windows/7407fa1-publisher-timeout-ci-evidence.json
@@ -0,0 +1,17 @@
+{
+  "source": "7407fa1ca76e22910697f0c31cf385620e520b23",
+  "workflow_run": 40432863268,
+  "windows_job": 121954917886,
+  "ubuntu_job": 121954917487,
+  "linux_deployment_job": 121954918008,
+  "windows_and_linux_component_jobs_passed": true,
+  "windows_verifier_tests_passed": [
+    "completed_and_rejected_verifiers_keep_their_real_exit_status",
+    "stalled_verification_is_an_error_and_its_process_is_reaped",
+    "verifier_child"
+  ],
+  "docker_context_public_file_count": 46,
+  "docker_secret_canaries_excluded": true,
+  "installed_application_timeout_qualified": false,
+  "production_approved": false
+}
diff --git a/deployment/windows/7bfce49-lab-distribution-and-technician-startup.json b/deployment/windows/7bfce49-lab-distribution-and-technician-startup.json
new file mode 100644
index 00000000000..3d270ecfcf7
--- /dev/null
+++ b/deployment/windows/7bfce49-lab-distribution-and-technician-startup.json
@@ -0,0 +1,151 @@
+{
+  "schema": 1,
+  "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+  "version": "1.5.3",
+  "profile_revision": 5,
+  "release_sequence": 6,
+  "reproduction": {
+    "utc": "2026-10-27T11:56:30.019805+00:00",
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "comparison_run": 40499642535,
+    "comparison_artifact": 12731698656,
+    "comparison_artifact_digest": "sha256:b318dcc23fb92f987d86a1ef8fbe7d4ac3ddf99bf66a483d8e21db944b7e1352",
+    "report_sha256": "895777057d7544fe9f0c6624abfafd16738e02739085bfdeccb9fecb87392220",
+    "shipping_outputs_identical": 8,
+    "source_files_per_build": 1211,
+    "bridge_files_per_build": 6,
+    "msvc_files_per_build": [
+      618,
+      618
+    ],
+    "first_archive_matches_locally_verified_original": true,
+    "second_large_local_download_started": false,
+    "runtime_qualified": false,
+    "production_publication": false
+  },
+  "lab_signing": {
+    "all_seven_outputs_valid": true,
+    "key_nonexportable_independently_verified": true,
+    "private_key_exported": false,
+    "original_records_verified": 23,
+    "existing_public_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+    "output_hashes": {
+      "signed_customer_msi_sha256": "a86006a39b951b356446a92b6129806ea9ab5952b4a52024aca06d7a95b546a0",
+      "signed_customer_executable_sha256": "99a9f55f06530126b34b2de87351647b34f9e7aa518c03747536a4d58b4118e6",
+      "signed_technician_msi_sha256": "3e1daa746f4e94d9a59dbe1763c543cbf0b789080df68b100e852d37c23d8126",
+      "signed_technician_executable_sha256": "dcc03e66aa6b423e0083e1b11865e0850ffa86ec5aca125670283868f1f8df6b",
+      "signed_agent_sha256": "45b54d0d8cd966e14f6389d018216f24770205550444332b86def7745caaf1c0",
+      "signed_management_sha256": "798ddf0df404029dda3e64c9bfa921c47a7f40fd4ef1e402e6446b13e1cb1573",
+      "signed_worker_sha256": "b4785729d9718693bd5bc891246eba55a206f6d47d0a521d9ed398401530da74"
+    }
+  },
+  "company_bundles": {
+    "utc": "2026-10-27T12:00:36.798945+00:00",
+    "editions": [
+      {
+        "edition": "customer",
+        "job_id": "ff8cd83e-7653-41d6-b22a-6100ddd602ac",
+        "bundle_sha256": "561f649f71477023a77398f4011c8294ed615e91e4207a8deb7e1adb0c691355",
+        "bytes": 32479083,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "tamper_rejection_verified": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 200,
+        "download_status": 200
+      },
+      {
+        "edition": "technician",
+        "job_id": "d2cf2755-b902-4552-97c1-9e703d0829a6",
+        "bundle_sha256": "5bed238a6d1f5c884a64b9517274cf35a33891043ef3763833523d94036462a9",
+        "bytes": 30288384,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "tamper_rejection_verified": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 401,
+        "download_status": 200
+      }
+    ],
+    "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+    "application_source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "independent_company": true,
+    "updates_paused": true,
+    "installer_executed": false,
+    "native_session_qualified": false,
+    "production_publication": false
+  },
+  "installed_technician_upgrade": {
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "before_version": "1.5.2",
+    "after_version": "1.5.3",
+    "product_state": 5,
+    "before_sequence": 5,
+    "after_sequence": 6,
+    "technician_bootstrap_preserved": true,
+    "profile_revision": 5,
+    "branding_preserved": true,
+    "installed_hashes_and_publishers_verified": true,
+    "pending_install_absent": true,
+    "customer_identity_credential_and_consent_preserved": true,
+    "customer_and_worker_services_running": true,
+    "automatic_upgrade_tested": false,
+    "native_startup_tested": false
+  },
+  "native_mfa_login": {
+    "utc": "2026-10-27T12:09:40.037427+00:00",
+    "application_source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "version": "1.5.3",
+    "release_sequence": 6,
+    "profile_revision": 5,
+    "visible_approved_device_count": 2,
+    "os": "Windows Server 2019 x64 build 17763.3650",
+    "generated_technician_bundle_installed": true,
+    "original_verified_launcher_used": true,
+    "actual_desktop_session": 1,
+    "company_branding_visible": true,
+    "updated_signed_branding_visible": true,
+    "company_https_origin_visible": true,
+    "username_password_and_totp_entered_only_in_native_form": true,
+    "gui_mfa_sign_in_succeeded": true,
+    "authorized_device_and_group_visible": true,
+    "session_history_visible": true,
+    "independent_server_login_audit_matches": true,
+    "same_machine_customer_and_technician": true,
+    "native_remote_session_exercised": false,
+    "standard_user_install_qualified": false,
+    "full_product_acceptance": false
+  },
+  "actual_native_process": {
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "flutter_and_rust_libraries_loaded": true,
+    "native_child_process_running": true,
+    "version": "1.5.3",
+    "utc": "2026-10-27T12:11:48.3374134Z",
+    "native_process_count": 1,
+    "no_new_application_crash_event": true,
+    "source_payload_hashes": {
+      "rustdesk.exe": "1cf3df638d1079e9ec1a5d23ad5bf36d6028a54fa662021a563a3a571a96a969",
+      "librustdesk.dll": "759a8307dcad81b19188ee02e10c2f17091201714bc6890d5b2647dcae1506d0",
+      "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204"
+    },
+    "gui_mfa_and_inventory_observed_separately": true,
+    "remote_session_qualified": false
+  },
+  "worker_recipe_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "worker_recipe_source_identical_to_pinned_candidate": true,
+  "new_worker_or_management_binary_deployed": false,
+  "failed_152_downloads_remain_withdrawn": true,
+  "automatic_updates_paused": true,
+  "production_publication": false,
+  "limits": [
+    "Technician 1.5.3 startup, MFA, authorized inventory and history observed on the existing Server2019 endpoint.",
+    "A path-only check initially rejected an equivalent /./ path; canonical inspection retained exact byte and creation-time checks.",
+    "No new native remote session is claimed here.",
+    "Customer endpoints remain on 1.5.1; real 1.5.3 automatic upgrade and reboot tests remain required.",
+    "Only a lab publisher and private HTTPS endpoint were used.",
+    "No complete Windows compatibility, public Internet transport or production signing qualification."
+  ]
+}
diff --git a/deployment/windows/7bfce49-native-independent-comparison.json b/deployment/windows/7bfce49-native-independent-comparison.json
new file mode 100644
index 00000000000..d23b85e5bb8
--- /dev/null
+++ b/deployment/windows/7bfce49-native-independent-comparison.json
@@ -0,0 +1,2281 @@
+{
+  "schema": 1,
+  "source_commit": "7bfce49aba857e035663f19cb25353828204e9c0",
+  "source_date_epoch": 1793086482,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1211,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1211,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.3-customer-x64-unsigned.msi",
+      "first_sha256": "58167f8b779ce5bba5bf58b5df82296b6e1d02f5fdfa958f366fea6c6727aa06",
+      "second_sha256": "58167f8b779ce5bba5bf58b5df82296b6e1d02f5fdfa958f366fea6c6727aa06",
+      "first_bytes": 33591296,
+      "second_bytes": 33591296,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.3-technician-x64-unsigned.exe",
+      "first_sha256": "2e9eda99368f7c4cfee90a8614d1d5620d03a1de9797794cf2f1e087f22d2d4d",
+      "second_sha256": "2e9eda99368f7c4cfee90a8614d1d5620d03a1de9797794cf2f1e087f22d2d4d",
+      "first_bytes": 24252928,
+      "second_bytes": 24252928,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.3-technician-x64-unsigned.msi",
+      "first_sha256": "bd01be9062808ffebadef79bc6c4559cf990acc8e4af1886f5cef8944af65d03",
+      "second_sha256": "bd01be9062808ffebadef79bc6c4559cf990acc8e4af1886f5cef8944af65d03",
+      "first_bytes": 31334400,
+      "second_bytes": 31334400,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.3-x64-unsigned-install.exe",
+      "first_sha256": "2e9eda99368f7c4cfee90a8614d1d5620d03a1de9797794cf2f1e087f22d2d4d",
+      "second_sha256": "2e9eda99368f7c4cfee90a8614d1d5620d03a1de9797794cf2f1e087f22d2d4d",
+      "first_bytes": 24252928,
+      "second_bytes": 24252928,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "63b972b51b867726d1a44471af717001b5e3f9148fd86b4800f782b77d22db52",
+      "second_sha256": "63b972b51b867726d1a44471af717001b5e3f9148fd86b4800f782b77d22db52",
+      "first_bytes": 64254464,
+      "second_bytes": 64254464,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "6616071f13debfd2b8bdf5ddd8a80237e5b4db2410bcec8ce5ed9fca9fd8a498",
+      "second_sha256": "6616071f13debfd2b8bdf5ddd8a80237e5b4db2410bcec8ce5ed9fca9fd8a498",
+      "first_bytes": 5511168,
+      "second_bytes": 5511168,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "da1780b243252c485842d5c2e6005ec6efd0516a3da07c91924ffbfdb9b86017",
+      "second_sha256": "da1780b243252c485842d5c2e6005ec6efd0516a3da07c91924ffbfdb9b86017",
+      "first_bytes": 8820224,
+      "second_bytes": 8820224,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "154731c628ba77ff7c3ed5f3282e8676a3cfe900bed5fb796c66a56368db5ce6",
+      "second_sha256": "154731c628ba77ff7c3ed5f3282e8676a3cfe900bed5fb796c66a56368db5ce6",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 40468079337,
+      "run_attempt": 1,
+      "artifact": 12720845199,
+      "archive_digest": "sha256:33fd077a820b59104a88da13724bc97e03bdecb3315d10a1835401bd1ab1353d",
+      "bytes": 254681533
+    },
+    {
+      "workflow_run": 40489196703,
+      "run_attempt": 1,
+      "artifact": 12732220473,
+      "archive_digest": "sha256:2641a889cf965c769b4520b33341247c2fce60652676893d6a86b8c5f812da97",
+      "bytes": 254681723
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "run": "40499642535"
+  }
+}
diff --git a/deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json b/deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json
new file mode 100644
index 00000000000..dbe6b877333
--- /dev/null
+++ b/deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json
@@ -0,0 +1,80 @@
+{
+  "automatic_update": {
+    "after_version": "1.5.3",
+    "recovery_markers_and_task_cleaned": true,
+    "all_signed_files_verified": 96,
+    "shipping_verifier_passed": true,
+    "consent_revision": 0,
+    "msi_registered_installed": true,
+    "reboot_qualified": false,
+    "after_sequence": 6,
+    "utc": "2026-10-27T14:23:38.2342671Z",
+    "manual_installer_not_started": true,
+    "unattended_consent": false,
+    "lab_cache_refresh_was_required": true,
+    "service_running_auto_system": true,
+    "native_watch_running": true,
+    "identity_credential_consent_and_trust_preserved": true,
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "production_publication": false
+  },
+  "attended_native_session": {
+    "observed_utc": "2026-10-27T14:28:29.757389+00:00",
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "technician_os": "Windows Server 2019 Desktop Experience",
+    "customer_os": "Windows 10 Pro 22H2",
+    "version": "1.5.3",
+    "session_id": "3eab301e-f798-43d3-8f6f-53a91be27347",
+    "actual_native_mfa_login": true,
+    "customer_accept_prompt_observed_and_clicked": true,
+    "native_remote_desktop_pixels_observed": true,
+    "remote_pointer_selected_customer_recycle_bin": true,
+    "selection_independently_observed_on_customer_console": true,
+    "server_revoked_exact_claimed_active_session": true,
+    "native_session_closed_with_company_authorization_required": true,
+    "fresh_authorized_session_required": true,
+    "unattended_consent_remained_off": true,
+    "clipboard_transfer_uac_reboot_multimonitor_not_tested_in_this_session": true,
+    "public_internet_or_relay_path_not_qualified_by_this_session": true,
+    "production_publication": false,
+    "original_group_access_restored": true,
+    "revoked_grant_not_revived": true
+  },
+  "rollout": {
+    "closed_maintenance_both_installed_agents_deferred": true,
+    "eligible_customer_cohort": 16,
+    "excluded_server19_cohort": 78,
+    "rollout_percent": 20,
+    "excluded_customer_remained_on_151": true,
+    "further_lab_rollout_paused_after_recovery": true
+  },
+  "limitations": [
+    "A lab-only refresh of the stale Windows-owned privacy helper was required before update handoff.",
+    "The diagnostic watcher action initially triggered the ownership guard; restoring its original native action allowed existing durable recovery to complete.",
+    "This does not qualify a fully unattended upgrade across Windows servicing changes; 1.5.4 cache maintenance still requires native testing.",
+    "Clipboard, transfer, UAC, logon-screen remote access, multiple monitors, other OS versions and public transport require separate qualification."
+  ],
+  "normal_reboot": {
+    "msi_registered_installed": true,
+    "unattended_consent": false,
+    "all_signed_files_verified": 96,
+    "prior_boot_utc": "2026-10-27T09:12:32.2746290Z",
+    "shipping_verifier_passed": true,
+    "reboot_qualified": true,
+    "service_started_without_manual_intervention": true,
+    "new_boot_utc": "2026-10-27T14:30:51.5000000Z",
+    "utc": "2026-10-27T14:46:43.9834116Z",
+    "after_sequence": 6,
+    "consent_revision": 0,
+    "manual_installer_not_started": true,
+    "after_version": "1.5.3",
+    "service_running_auto_system": true,
+    "native_watch_running": true,
+    "recovery_markers_and_task_cleaned": true,
+    "lab_cache_refresh_was_required": true,
+    "kernel_reboot_observed": true,
+    "identity_credential_consent_and_trust_preserved": true,
+    "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+    "production_publication": false
+  }
+}
diff --git a/deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json b/deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json
new file mode 100644
index 00000000000..49a509f8e27
--- /dev/null
+++ b/deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json
@@ -0,0 +1,26 @@
+{
+  "observed_utc": "2026-10-27T15:13:04.440289+00:00",
+  "source": "7bfce49aba857e035663f19cb25353828204e9c0",
+  "version": "1.5.3",
+  "technician_os": "Windows Server 2019 Desktop Experience",
+  "customer_os": "Windows 10 Pro 22H2",
+  "explicit_company_identified_consent_dialog_observed": true,
+  "customer_allow_ongoing_support_clicked": true,
+  "authorized_unattended_native_desktop_observed": true,
+  "guest_signout_selected_instead_of_intended_lock": true,
+  "native_remote_signin_screen_observed": true,
+  "owned_lab_password_entered_privately_through_remote_app": true,
+  "native_desktop_returned_after_remote_signin": true,
+  "customer_visible_revoke_control_used": true,
+  "server_consent_disabled": true,
+  "outstanding_leases_closed": 5,
+  "native_connection_closed_with_company_authorization_required": true,
+  "new_authenticated_unattended_grant_rejected_http": 403,
+  "unattended_consent_left_disabled": true,
+  "multiple_outstanding_reconnect_records_require_history_cleanup_review": true,
+  "clipboard_transfer_uac_multimonitor_and_public_transport_not_qualified": true,
+  "production_publication": false,
+  "post_revocation_no_live_server_session": true,
+  "post_revocation_remote_pointer_did_not_change_customer_selection": true,
+  "customer_console_independently_observed": true
+}
diff --git a/deployment/windows/9ba592c-company-bundles-evidence.json b/deployment/windows/9ba592c-company-bundles-evidence.json
new file mode 100644
index 00000000000..5b4a347669b
--- /dev/null
+++ b/deployment/windows/9ba592c-company-bundles-evidence.json
@@ -0,0 +1,70 @@
+{
+  "application_source": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "worker_application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "worker_and_bundled_recipe_paths_unchanged_in_new_source": true,
+  "version": "1.5.2",
+  "sequence": 5,
+  "channel": "test",
+  "lab_signed_only": true,
+  "production_publication": false,
+  "asset_hashes": {
+    "customer.msi": "ad6731f999b2706522a3e1d9a48f930c88417c1b80b1d091edd632223ddbf630",
+    "technician.msi": "aa4572f8a7a714367743d9fe54cb8aa5a6fff29ecff1d7715914a26e8ce7a3ff",
+    "agent.exe": "fba21e0fd6d59a56a0a14979f95896e621a85eaf24a63c08da87b1f84d13885b",
+    "lab-publisher-public.cer": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+    "source.zip": "fa40f77f318b79e69182282aea7e1029ebe1f2a3bb64fb108ca319fb39b2dadf"
+  },
+  "full_corresponding_source_https_verified": true,
+  "public_https_payload_hashes_verified": true,
+  "operator_release_key_override_status": 403,
+  "bad_signature_import_status": 403,
+  "unapproved_build_status": 409,
+  "unapproved_requests_created_no_jobs": true,
+  "both_releases_explicitly_approved": true,
+  "both_worker_jobs_completed": true,
+  "bundles": [
+    {
+      "edition": "customer",
+      "bundle_sha256": "6578f766e93f1be70a2d10a6909d5f8c9317cad16e12bb4398d16a703f1811a2",
+      "bytes": 32498623,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "bundle_sha256": "14606398f6d287fd519c7c34c9c661092abb1d2108609a023581b6268bf6845b",
+      "bytes": 30286567,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "independent_signed_envelope_verification": true,
+  "public_bootstrap_only": true,
+  "profile_revision": 5,
+  "signed_policy_unchanged_excluding_renewed_lifetime": true,
+  "automatic_updates_paused": true,
+  "exact_public_publisher_certificate_trusted_on_worker": true,
+  "new_agent_hash_and_publisher_verified_on_worker": true,
+  "new_agent_executed_during_worker_trust_check": false,
+  "private_key_transferred": false,
+  "existing_worker_and_customer_services_preserved": true,
+  "software_upgrade_executed": false,
+  "limitations": [
+    "These are private-lab test releases with a disposable publisher, not production publication.",
+    "The worker and bundled script paths are unchanged between its deployed source and the new application source; this does not claim that the new worker binary was deployed.",
+    "Envelope tamper rejection here is independent bundle verification; native client rejection remains a separate test.",
+    "The original exact-envelope equality assertion failed because signed profile lifetimes renew on reads. Both signatures and all policy fields were subsequently verified without repeating imports or jobs.",
+    "Automatic installation, session coordination, interruption recovery and full Windows compatibility remain separate acceptance gates."
+  ],
+  "subsequently_withdrawn_due_to_native_startup_failure": true,
+  "withdrawal_and_runtime_evidence": "9ba592c-technician-startup-failure.json"
+}
diff --git a/deployment/windows/9ba592c-lab-signed-msi-evidence.json b/deployment/windows/9ba592c-lab-signed-msi-evidence.json
new file mode 100644
index 00000000000..766fe31bb46
--- /dev/null
+++ b/deployment/windows/9ba592c-lab-signed-msi-evidence.json
@@ -0,0 +1,211 @@
+{
+  "source": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+  "version": "1.5.2",
+  "lab_signed_only": true,
+  "production_publication": false,
+  "signed_packages_installed": false,
+  "unsigned_inputs_independently_reproduced": true,
+  "independent_comparison_evidence": "9ba592c-native-independent-comparison.json",
+  "verified_input_files": 219,
+  "original_inputs_unchanged": true,
+  "all_seven_signatures_reverified": true,
+  "new_key_nonexportable_independently_verified": true,
+  "private_key_exported": false,
+  "publisher": "Swan Disposable Lab Publisher 20261027",
+  "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "signing_receipts": {
+    "agent-signed.exe.signing.json": {
+      "artifact": "agent-signed.exe",
+      "input_sha256": "6616071f13debfd2b8bdf5ddd8a80237e5b4db2410bcec8ce5ed9fca9fd8a498",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "fba21e0fd6d59a56a0a14979f95896e621a85eaf24a63c08da87b1f84d13885b"
+    },
+    "customer-1.5.2-signed.msi.signing.json": {
+      "artifact": "customer-1.5.2-signed.msi",
+      "input_sha256": "34a7ec5043ff8aaca48dc480f5e59e81d2acd1dcb1e9a49cccd6d1e6b2219190",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "ad6731f999b2706522a3e1d9a48f930c88417c1b80b1d091edd632223ddbf630"
+    },
+    "customer-main-signed.exe.signing.json": {
+      "artifact": "customer-main-signed.exe",
+      "input_sha256": "64ba92090a0ffc954a8df43f1750a652cd11c2479d5151ddc7d2b6ae837aff38",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "606136e7df4ab611656bc51f362cabef03c5d5c36c76d47580fa5f6268a94583"
+    },
+    "management-signed.exe.signing.json": {
+      "artifact": "management-signed.exe",
+      "input_sha256": "da1780b243252c485842d5c2e6005ec6efd0516a3da07c91924ffbfdb9b86017",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "ea2910809298333f9253715c86d3c67f90f86b97cb6eb5818c7ac62da6a47dbd"
+    },
+    "technician-1.5.2-signed.msi.signing.json": {
+      "artifact": "technician-1.5.2-signed.msi",
+      "input_sha256": "c45cedc49e767316b34eef5d0b2aa996612e084d15a911ad306fbabf1b511796",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "aa4572f8a7a714367743d9fe54cb8aa5a6fff29ecff1d7715914a26e8ce7a3ff"
+    },
+    "technician-signed.exe.signing.json": {
+      "artifact": "technician-signed.exe",
+      "input_sha256": "c557f1e58ce441be87eb25091eb1a0f1e2cf5c10725d031dec343db38b3a56cf",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "303da1f60010e92891ee38d1bb76dd53574397937290267b76cad385c7f1cb51"
+    },
+    "worker-signed.exe.signing.json": {
+      "artifact": "worker-signed.exe",
+      "input_sha256": "154731c628ba77ff7c3ed5f3282e8676a3cfe900bed5fb796c66a56368db5ce6",
+      "timestamp_url": "http://timestamp.sectigo.com/rfc3161",
+      "schema": 1,
+      "timestamp_verification": "signtool-verify-pa-all-tw",
+      "publisher": "Swan Disposable Lab Publisher 20261027",
+      "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "sha256": "aecf0117104531891dc774572eb21ead7312a6a9d4d729ca9806bbebc0e864b1"
+    }
+  },
+  "original_evidence_files": [
+    {
+      "sha256": "fba21e0fd6d59a56a0a14979f95896e621a85eaf24a63c08da87b1f84d13885b",
+      "name": "agent-signed.exe",
+      "bytes": 5519664
+    },
+    {
+      "sha256": "ea2910809298333f9253715c86d3c67f90f86b97cb6eb5818c7ac62da6a47dbd",
+      "name": "management-signed.exe",
+      "bytes": 8828720
+    },
+    {
+      "sha256": "aecf0117104531891dc774572eb21ead7312a6a9d4d729ca9806bbebc0e864b1",
+      "name": "worker-signed.exe",
+      "bytes": 4842288
+    },
+    {
+      "sha256": "606136e7df4ab611656bc51f362cabef03c5d5c36c76d47580fa5f6268a94583",
+      "name": "customer-main-signed.exe",
+      "bytes": 383792
+    },
+    {
+      "sha256": "303da1f60010e92891ee38d1bb76dd53574397937290267b76cad385c7f1cb51",
+      "name": "technician-signed.exe",
+      "bytes": 24261424
+    },
+    {
+      "sha256": "ad6731f999b2706522a3e1d9a48f930c88417c1b80b1d091edd632223ddbf630",
+      "name": "customer-1.5.2-signed.msi",
+      "bytes": 33628160
+    },
+    {
+      "sha256": "aa4572f8a7a714367743d9fe54cb8aa5a6fff29ecff1d7715914a26e8ce7a3ff",
+      "name": "technician-1.5.2-signed.msi",
+      "bytes": 31371264
+    },
+    {
+      "sha256": "fca1bb809bf733d72aebb084e6359c2095825ee3079ae01f3725ca882d9788f3",
+      "name": "agent-signed.exe.signing.json",
+      "bytes": 525
+    },
+    {
+      "sha256": "f59d9a422515dcdb9fbce01113ea1e8c812d9d865c0baded36079ce39ee06ba3",
+      "name": "management-signed.exe.signing.json",
+      "bytes": 530
+    },
+    {
+      "sha256": "57261da41ca0a110672ad599a74b67f7374fcb09da5834733271b7044f849c43",
+      "name": "worker-signed.exe.signing.json",
+      "bytes": 526
+    },
+    {
+      "sha256": "df4548d26ed60d3d192c9699a08b21d572c59952403c9e6ff34fa3fe6bae34a4",
+      "name": "customer-main-signed.exe.signing.json",
+      "bytes": 533
+    },
+    {
+      "sha256": "6ff7d38c2b96b570408257293ae033a1379e2df8ed617117d7906bd5b7de9418",
+      "name": "technician-signed.exe.signing.json",
+      "bytes": 530
+    },
+    {
+      "sha256": "9675b4d38ebae94a16ccb499df68cc0e46e4baf8c0dc39bb27ff6ee60e2b30ea",
+      "name": "customer-1.5.2-signed.msi.signing.json",
+      "bytes": 534
+    },
+    {
+      "sha256": "a52ace0763614be16da9f44d7d061099c20a6567c8f9e1cb2ee339d8959261af",
+      "name": "technician-1.5.2-signed.msi.signing.json",
+      "bytes": 536
+    },
+    {
+      "sha256": "ed5fd83bea992a76416a1cf13158c95d8527d564f88ca54b3a2f9db4917d720d",
+      "name": "build-result.json",
+      "bytes": 1645
+    },
+    {
+      "sha256": "831c28cc8164a5d7b522622e1e61221521e3fe7be9f09f5cd2c75815d0a2a2ab",
+      "name": "build-journal.jsonl",
+      "bytes": 675
+    },
+    {
+      "sha256": "04a0e36d0185482fc9e846470adebcb76b75e26e9732ba00fe455f68aeaf8ca3",
+      "name": "build-task-registered.json",
+      "bytes": 439
+    },
+    {
+      "sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+      "name": "lab-publisher-public.cer",
+      "bytes": 1078
+    },
+    {
+      "sha256": "3943f697a2785997dd78d50c4a2992909423cbe1c12b52574332bca9d13f034b",
+      "name": "lab-publisher-public.json",
+      "bytes": 378
+    },
+    {
+      "sha256": "3394f4ee136d45129bfdc06a99bf0a56f6d6aff102a8ff65f01d9818b94be586",
+      "name": "customer-1.5.2-unsigned.msi.build.json",
+      "bytes": 758
+    },
+    {
+      "sha256": "8332fc0f439cffb7628e109a2b1cda789af95ff73c495aaac715570ca6f703b0",
+      "name": "customer-1.5.2-unsigned.msi.installed-files.json",
+      "bytes": 14349
+    },
+    {
+      "sha256": "fbefbd4ccc78ad1a51d1ffad6c97eb4845b688938af6dc4236d4e837466ce0b2",
+      "name": "technician-1.5.2-unsigned.msi.build.json",
+      "bytes": 750
+    },
+    {
+      "sha256": "5025fd62d843f070a20dbf98a2fb0b17e6dad5faac364dec808f8f4c81f2af61",
+      "name": "Build-Startup152CompanyPackages.ps1",
+      "bytes": 10509
+    }
+  ],
+  "customer_service_preserved_running": true,
+  "limitations": [
+    "Signatures use an explicitly trusted disposable lab publisher, not an approved production publisher.",
+    "Successful signing and MSI construction do not qualify installation, automatic rollout, interrupted recovery or native sessions for this version.",
+    "The original Windows company VM and its signing identity were not used or modified."
+  ]
+}
diff --git a/deployment/windows/9ba592c-native-independent-comparison.json b/deployment/windows/9ba592c-native-independent-comparison.json
new file mode 100644
index 00000000000..fd82f812141
--- /dev/null
+++ b/deployment/windows/9ba592c-native-independent-comparison.json
@@ -0,0 +1,135 @@
+{
+  "schema": 1,
+  "source_commit": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+  "source_date_epoch": 1793065678,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1203,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversion_count": 1061
+    },
+    {
+      "tracked_files_verified": 1203,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversion_count": 1061
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.2-customer-x64-unsigned.msi",
+      "first_sha256": "60dc02e617ff31d287672ee7c0a649433af70aafaf1c987f41c239d5d827f09b",
+      "second_sha256": "60dc02e617ff31d287672ee7c0a649433af70aafaf1c987f41c239d5d827f09b",
+      "first_bytes": 33591296,
+      "second_bytes": 33591296,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.2-technician-x64-unsigned.exe",
+      "first_sha256": "c557f1e58ce441be87eb25091eb1a0f1e2cf5c10725d031dec343db38b3a56cf",
+      "second_sha256": "c557f1e58ce441be87eb25091eb1a0f1e2cf5c10725d031dec343db38b3a56cf",
+      "first_bytes": 24252928,
+      "second_bytes": 24252928,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.2-technician-x64-unsigned.msi",
+      "first_sha256": "869c2b26d2fd50cda723563b6f79798880f27f00858deff57256ece3d992d8d6",
+      "second_sha256": "869c2b26d2fd50cda723563b6f79798880f27f00858deff57256ece3d992d8d6",
+      "first_bytes": 31330304,
+      "second_bytes": 31330304,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.2-x64-unsigned-install.exe",
+      "first_sha256": "c557f1e58ce441be87eb25091eb1a0f1e2cf5c10725d031dec343db38b3a56cf",
+      "second_sha256": "c557f1e58ce441be87eb25091eb1a0f1e2cf5c10725d031dec343db38b3a56cf",
+      "first_bytes": 24252928,
+      "second_bytes": 24252928,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "5856c2ed738a045814b6739405454840f78530a6c20e475213fb94dbcf810379",
+      "second_sha256": "5856c2ed738a045814b6739405454840f78530a6c20e475213fb94dbcf810379",
+      "first_bytes": 64254464,
+      "second_bytes": 64254464,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "6616071f13debfd2b8bdf5ddd8a80237e5b4db2410bcec8ce5ed9fca9fd8a498",
+      "second_sha256": "6616071f13debfd2b8bdf5ddd8a80237e5b4db2410bcec8ce5ed9fca9fd8a498",
+      "first_bytes": 5511168,
+      "second_bytes": 5511168,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "da1780b243252c485842d5c2e6005ec6efd0516a3da07c91924ffbfdb9b86017",
+      "second_sha256": "da1780b243252c485842d5c2e6005ec6efd0516a3da07c91924ffbfdb9b86017",
+      "first_bytes": 8820224,
+      "second_bytes": 8820224,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "154731c628ba77ff7c3ed5f3282e8676a3cfe900bed5fb796c66a56368db5ce6",
+      "second_sha256": "154731c628ba77ff7c3ed5f3282e8676a3cfe900bed5fb796c66a56368db5ce6",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "utc": "2026-10-27T06:32:25.901337+00:00",
+  "builds": [
+    {
+      "workflow_run": 40435586938,
+      "artifact": 12707165114,
+      "archive_digest": "sha256:34d20a3da90f352cf6cab71817d0960818cf557a383770ad9e43e261b004deac"
+    },
+    {
+      "workflow_run": 40442895972,
+      "artifact": 12709173502,
+      "archive_digest": "sha256:e564e4b4a4b5fbf9c26acb2af8c7a4f0486d3d4047906a9e6d1c495a0733f671"
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "original_comparison_sha256": "89560d25e9076730223e21e156dcb90070d93c658b144482c46408f9184436ba"
+}
diff --git a/deployment/windows/9ba592c-native-source-evidence.json b/deployment/windows/9ba592c-native-source-evidence.json
new file mode 100644
index 00000000000..8d4cf89ecf0
--- /dev/null
+++ b/deployment/windows/9ba592c-native-source-evidence.json
@@ -0,0 +1,18 @@
+{
+  "utc": "2026-10-27T05:19:11.921497+00:00",
+  "source": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+  "workflow_run": 40435586938,
+  "public_tracked_source_files_verified": 1203,
+  "generated_bridge_files_verified": 6,
+  "repositories": {
+    ".": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+    "libs/hbb_common/": "7e1c392c62d39c364127307cd408421dd5f8cfb0"
+  },
+  "source_date_epoch": 1793065678,
+  "independent_rebuild_pending": false,
+  "runtime_qualified": false,
+  "declared_text_checkout_conversion_count": 1061,
+  "original_receipt_sha256": "0290c8747730cc331250de9b9f22d2a07af69402eb3bcb0cfc2c6405106f77e9",
+  "full_source_archive_verified": true,
+  "independent_comparison_evidence": "9ba592c-native-independent-comparison.json"
+}
diff --git a/deployment/windows/9ba592c-native-startup-ci-evidence.json b/deployment/windows/9ba592c-native-startup-ci-evidence.json
new file mode 100644
index 00000000000..d977f522550
--- /dev/null
+++ b/deployment/windows/9ba592c-native-startup-ci-evidence.json
@@ -0,0 +1,96 @@
+{
+  "source": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+  "run": 40435586938,
+  "artifact": 12706347182,
+  "digest": "sha256:8eb9f78d6160a7e32e3b49bf79f6c12c55b1a9a17c1acea0ee1c338fda83d54c",
+  "customer_service_result": {
+    "fixture_revision": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+    "package_sha256": "60dc02e617ff31d287672ee7c0a649433af70aafaf1c987f41c239d5d827f09b",
+    "unsigned_test": true,
+    "passed": true,
+    "scope": "Fresh administrative MSI install/start and service module inspection, then uninstall on disposable CI; no cold reboot, enrollment, signature acceptance or remote session",
+    "install_elapsed_seconds": 4.6496294,
+    "service_running_without_manual_start": true,
+    "no_desktop_engine_or_plugin_modules": true,
+    "service_modules": [
+      "Swan Remote Support.exe",
+      "ntdll.dll",
+      "KERNEL32.DLL",
+      "KERNELBASE.dll",
+      "USER32.dll",
+      "win32u.dll",
+      "GDI32.dll",
+      "gdi32full.dll",
+      "msvcp_win.dll",
+      "ucrtbase.dll",
+      "SHELL32.dll",
+      "ole32.dll",
+      "combase.dll",
+      "RPCRT4.dll",
+      "librustdesk.dll",
+      "oleaut32.dll",
+      "crypt32.dll",
+      "advapi32.dll",
+      "WTSAPI32.dll",
+      "msvcrt.dll",
+      "sechost.dll",
+      "newdev.dll",
+      "bcrypt.dll",
+      "bcryptprimitives.dll",
+      "ws2_32.dll",
+      "shcore.dll",
+      "setupapi.dll",
+      "psapi.dll",
+      "comctl32.dll",
+      "userenv.dll",
+      "secur32.dll",
+      "winspool.drv",
+      "cfgmgr32.dll",
+      "DEVOBJ.dll",
+      "DEVRTL.dll",
+      "dwmapi.dll",
+      "powrprof.dll",
+      "iphlpapi.dll",
+      "d3d11.dll",
+      "dxgi.dll",
+      "pdh.dll",
+      "SAS.dll",
+      "CRYPTBASE.DLL",
+      "SSPICLI.DLL",
+      "UMPDC.dll",
+      "windows.storage.dll",
+      "shlwapi.dll",
+      "WINSTA.dll",
+      "ntmarta.dll"
+    ],
+    "uninstall_verified": true,
+    "completed_utc": "2026-10-27T02:59:35.3055798Z"
+  },
+  "original_file_hashes": {
+    "swan-customer-service-f68712b2e98d475dac66c541e51f4d44/result.json": "2ded8769436c3a3014c45f5c52a3767a92130959c155681d017b46364f97c9a9",
+    "swan-customer-service-f68712b2e98d475dac66c541e51f4d44/uninstall.log": "eaae94a5cbe8a4a2bbc36e6bfac4d86983bd5e40f781be04b35a352ba54854d3",
+    "swan-customer-service-f68712b2e98d475dac66c541e51f4d44/install.log": "1dd7f2269d1877e4ebc58980172645ea20965b2780f6de06faf525ce7efb09e2",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/install.log": "98c417fff4100b6ce9f6159ea7d5972917d1ce97b362780bf39f34d31e2e608e",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/install.log.invocation.json": "54a56fd435e95673624e7e361a430334dfb5e6b9b97168c75c6ec65f7c9fa5d2",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/repair.log": "3d8373351dfb3964844e529ad5395620b56444e67526ec315362f572b6f7e20d",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/repair.log.invocation.json": "17c5492d66974453bd9a0052d6a1b339d8a16743a79a8bf98fa85739380cc8cd",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/result.json": "a82237719e0490123f2460d94854fbc1e420d2bc68d049ef7d63b6e18e4a2976",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/uninstall.log": "6c57dd30efa1e26671effb426466eced4642207dc7f7e377d85dbe799a44e1d7",
+    "swan-msi-lifecycle-b0fb5f2e35b646f384f06644c301115d/uninstall.log.invocation.json": "176cdf61f0cda256adeac9cc802d2e0f67568d57dc0dc81bf74cf7b1579003b1",
+    "swan-msi-metadata-check/result.json": "bce22d82c9053a82ff1c938d6de41c247f4ada5a59e76d28f8105c6d7b491faa",
+    "swan-msi-staging-check/result.json": "2ab67375c547ae03810c9bd8d2e854abbcd0cdca4779a2626922ca48ec02b89a"
+  },
+  "cold_boot_runtime_qualified": false,
+  "signed_release_qualified": false,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40435586938",
+  "native_technician_helper_test": {
+    "name": "server::portable_service::client::edition_tests::outgoing_only_refuses_capture_helper_before_runtime_initialization",
+    "passed": true,
+    "log_timestamp_utc": "2026-10-27T02:51:44.5538558Z"
+  },
+  "limitations": [
+    "Customer MSI was unsigned on a disposable administrative CI runner.",
+    "No cold reboot, enrolled native session, publisher acceptance or full Windows compatibility qualification is established by this evidence."
+  ],
+  "independent_comparison_evidence": "9ba592c-native-independent-comparison.json"
+}
diff --git a/deployment/windows/9ba592c-technician-startup-failure.json b/deployment/windows/9ba592c-technician-startup-failure.json
new file mode 100644
index 00000000000..bc8955a84c9
--- /dev/null
+++ b/deployment/windows/9ba592c-technician-startup-failure.json
@@ -0,0 +1,96 @@
+{
+  "source": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+  "version": "1.5.2",
+  "os": "Windows Server 2019 Desktop Experience x64 17763.3650",
+  "explicit_technician_setup_upgrade_registered": true,
+  "msi_product_state": 5,
+  "installed_hashes_and_publishers_verified": true,
+  "bootstrap_branding_customer_identity_and_consent_preserved": true,
+  "native_startup_passed": false,
+  "application_event_ids": [
+    1000,
+    1001
+  ],
+  "native_exception_code": "0xc06d007e",
+  "faulting_module": "KERNELBASE.dll",
+  "native_cache_hashes": [
+    {
+      "sha256": "64ba92090a0ffc954a8df43f1750a652cd11c2479d5151ddc7d2b6ae837aff38",
+      "name": "rustdesk.exe"
+    },
+    {
+      "sha256": "4391bb302363ac569894c1c174124ad413bb5bae1342f5f3b2594f241d0add8c",
+      "name": "librustdesk.dll"
+    },
+    {
+      "sha256": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+      "name": "flutter_windows.dll"
+    }
+  ],
+  "outer_launcher_success_does_not_qualify_native_startup": true,
+  "both_sequence5_test_releases_withdrawn": true,
+  "both_generated_bundle_downloads_return_404": true,
+  "automatic_updates_remain_paused": true,
+  "baseline_releases_and_customer_services_preserved": true,
+  "loader_api_fixture": {
+    "utc": "2026-10-27T07:30:31.886376+00:00",
+    "results": [
+      {
+        "flags": "0xc00",
+        "results": {
+          "swan-dll-search-app-probe.dll": {
+            "loaded": false,
+            "error": 126
+          },
+          "version.dll": {
+            "loaded": true,
+            "error": null,
+            "loaded_from_application_directory": false
+          },
+          "swan-dll-search-cwd-probe.dll": {
+            "loaded": false,
+            "error": 126
+          },
+          "swan-dll-search-path-probe.dll": {
+            "loaded": false,
+            "error": 126
+          }
+        }
+      },
+      {
+        "flags": "0xe00",
+        "results": {
+          "swan-dll-search-app-probe.dll": {
+            "loaded": true,
+            "error": null,
+            "loaded_from_application_directory": true
+          },
+          "version.dll": {
+            "loaded": true,
+            "error": null,
+            "loaded_from_application_directory": false
+          },
+          "swan-dll-search-cwd-probe.dll": {
+            "loaded": false,
+            "error": 126
+          },
+          "swan-dll-search-path-probe.dll": {
+            "loaded": false,
+            "error": 126
+          }
+        }
+      }
+    ],
+    "actual_windows_loader_test": true,
+    "old_policy_reproduces_application_dll_error_126": true,
+    "application_directory_policy_fixes_resolution": true,
+    "cwd_and_path_remain_excluded": true,
+    "only_isolated_child_processes_changed_policy": true,
+    "host_system_policy_changed": false,
+    "native_application_binary_qualified": false,
+    "scope": "Actual loader search masks in isolated Python child processes; native Rust regression and repaired GUI startup remain separate"
+  },
+  "repair_version": "1.5.3",
+  "repair_native_build_and_gui_retest_pending": true,
+  "production_publication": false
+}
diff --git a/deployment/windows/Build-CustomerExe.ps1 b/deployment/windows/Build-CustomerExe.ps1
new file mode 100644
index 00000000000..065e645fdf8
--- /dev/null
+++ b/deployment/windows/Build-CustomerExe.ps1
@@ -0,0 +1,162 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$SourceArchive,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{64}$')][string]$SourceArchiveSha256,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{40}$')][string]$SourceRevision,
+    [Parameter(Mandatory=$true)][string]$SourceDirectory,
+    [Parameter(Mandatory=$true)][string]$PayloadManifest,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{64}$')][string]$PublisherCertificateSha256,
+    [Parameter(Mandatory=$true)][string]$CargoExe,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{64}$')][string]$CargoSha256,
+    [Parameter(Mandatory=$true)][string]$RustcExe,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{64}$')][string]$RustcSha256,
+    [Parameter(Mandatory=$true)][string]$GitExe,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{64}$')][string]$GitSha256,
+    [Parameter(Mandatory=$true)][string]$LinkExe,
+    [Parameter(Mandatory=$true)][ValidatePattern('^[a-f0-9]{64}$')][string]$LinkSha256,
+    [Parameter(Mandatory=$true)][string]$PythonExe,
+    [Parameter(Mandatory=$true)][string]$CargoHome,
+    [Parameter(Mandatory=$true)][string]$WorkDirectory,
+    [Parameter(Mandatory=$true)][string]$Output
+)
+$ErrorActionPreference='Stop'
+function Invoke-BuildTool([string]$Executable,[string[]]$ToolArguments) {
+    # Windows PowerShell 5.1 turns native stderr into ErrorRecords. Cargo uses
+    # stderr for successful progress too; preserve the output and use its exit
+    # code, while keeping PowerShell failures terminating outside this call.
+    $previousPreference=$ErrorActionPreference
+    $toolExitCode=$null
+    $global:LASTEXITCODE=$null
+    try {
+        $ErrorActionPreference='Continue'
+        & $Executable @ToolArguments 2>&1 | ForEach-Object { Write-Host $_.ToString() }
+        $toolExitCode=$LASTEXITCODE
+    } finally { $ErrorActionPreference=$previousPreference }
+    if ($null -eq $toolExitCode -or $toolExitCode -ne 0) {
+        throw ('Build tool failed ('+[string]$toolExitCode+'): '+[IO.Path]::GetFileName($Executable))
+    }
+}
+if (-not [Environment]::Is64BitProcess -or $env:OS -cne 'Windows_NT') { throw 'Use a Windows x64 release build environment.' }
+$Output=[IO.Path]::GetFullPath($Output)
+$WorkDirectory=[IO.Path]::GetFullPath($WorkDirectory)
+$CargoHome=[IO.Path]::GetFullPath($CargoHome)
+if ($CargoHome -notmatch '^[A-Za-z]:\\' -or $CargoHome.Length -gt 24 -or $CargoHome -eq [IO.Path]::GetPathRoot($CargoHome)) { throw 'Use a dedicated short local Cargo cache, at most24 characters, for locked Git submodule checkouts.' }
+if ($Output -notmatch '-unsigned-install\.exe$') { throw 'Build an -unsigned-install.exe; sign and approve it separately.' }
+foreach ($path in @($Output,$Output+'.build.json',$Output+'.installed-files.json',$Output+'.payload-verification.json',$WorkDirectory)) {
+    if (Test-Path -LiteralPath $path) { throw 'Preserve earlier build state instead of overwriting it.' }
+}
+$SourceArchive=(Resolve-Path -LiteralPath $SourceArchive).Path
+$SourceDirectory=(Resolve-Path -LiteralPath $SourceDirectory).Path
+$PayloadManifest=(Resolve-Path -LiteralPath $PayloadManifest).Path
+$CargoExe=(Resolve-Path -LiteralPath $CargoExe).Path
+$RustcExe=(Resolve-Path -LiteralPath $RustcExe).Path
+$GitExe=(Resolve-Path -LiteralPath $GitExe).Path
+$LinkExe=(Resolve-Path -LiteralPath $LinkExe).Path
+$PythonExe=(Resolve-Path -LiteralPath $PythonExe).Path
+if ((Get-FileHash -LiteralPath $CargoExe).Hash -ine $CargoSha256 -or
+    (Get-FileHash -LiteralPath $RustcExe).Hash -ine $RustcSha256 -or
+    (Get-FileHash -LiteralPath $LinkExe).Hash -ine $LinkSha256 -or
+    (Get-FileHash -LiteralPath $GitExe).Hash -ine $GitSha256) { throw 'Pinned compiler/linker/Git binaries differ.' }
+if ((& $CargoExe --version | Out-String).Trim() -notmatch '^cargo 1\.90\.0 ' -or $LASTEXITCODE) { throw 'Cargo1.90.0 is required.' }
+if ((& $RustcExe --version | Out-String).Trim() -notmatch '^rustc 1\.90\.0 ' -or $LASTEXITCODE) { throw 'Rust1.90.0 is required.' }
+$gitVersion=(& $GitExe --version | Out-String).Trim()
+if ($LASTEXITCODE -or $gitVersion -notmatch '^git version 2\.') { throw 'Pinned Git2.x is required for locked workspace source dependencies.' }
+if ((& $PythonExe --version | Out-String).Trim() -cne 'Python 3.12.10' -or $LASTEXITCODE) { throw 'Python3.12.10 is required.' }
+$pythonSignature=Get-AuthenticodeSignature -LiteralPath $PythonExe
+if ($pythonSignature.Status -ne 'Valid' -or $pythonSignature.SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName,$false) -cne 'Python Software Foundation') { throw 'Python tool publisher verification failed.' }
+$brotliVersion=(& $PythonExe -c 'import brotli; print(brotli.__version__)' | Out-String).Trim()
+if ($LASTEXITCODE -or $brotliVersion -cne '1.1.0') { throw 'Pinned Python brotli1.1.0 is required.' }
+$main=Join-Path $SourceDirectory 'rustdesk.exe'
+$signature=Get-AuthenticodeSignature -LiteralPath $main
+if ($signature.Status -ne 'Valid') { throw 'Sign the inner customer executable before producing its installer.' }
+$hash=[Security.Cryptography.SHA256]::Create()
+try { $certificateHash=([BitConverter]::ToString($hash.ComputeHash($signature.SignerCertificate.RawData))).Replace('-','').ToLowerInvariant() }
+finally { $hash.Dispose() }
+if ($certificateHash -cne $PublisherCertificateSha256) { throw 'Inner executable does not match the intended release publisher.' }
+$resourceCompiler=(Get-Command rc.exe -CommandType Application -ErrorAction Stop).Source
+$resourceSignature=Get-AuthenticodeSignature -LiteralPath $resourceCompiler
+if ($resourceSignature.Status -ne 'Valid' -or $resourceSignature.SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName,$false) -cne 'Microsoft Corporation') { throw 'Use the trusted Microsoft Windows SDK resource compiler.' }
+$resourceCompilerHash=(Get-FileHash $resourceCompiler).Hash.ToLowerInvariant()
+$sdkRegistry=[Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,[Microsoft.Win32.RegistryView]::Registry32)
+try {
+    $sdkRoots=$sdkRegistry.OpenSubKey('SOFTWARE\Microsoft\Windows Kits\Installed Roots')
+    try { if ($null -eq $sdkRoots -or $sdkRoots.GetValueNames().Count -eq 0) { throw 'A registered Windows SDK is required; winres does not locate MSVC resources through PATH alone.' } }
+    finally { if ($null -ne $sdkRoots) { $sdkRoots.Dispose() } }
+} finally { $sdkRegistry.Dispose() }
+$saved=@{}
+foreach ($name in @('PATH','RUSTC','CARGO_HOME','CARGO_TARGET_DIR','CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER','SOURCE_DATE_EPOCH','RUSTFLAGS','CARGO_ENCODED_RUSTFLAGS','PYTHONDONTWRITEBYTECODE')) {
+    $saved[$name]=[Environment]::GetEnvironmentVariable($name,'Process')
+}
+try {
+    $env:CARGO_HOME=$CargoHome
+    Invoke-BuildTool $PythonExe @((Join-Path $PSScriptRoot 'prepare-customer-exe.py'),'--source-archive',$SourceArchive,'--source-sha256',$SourceArchiveSha256,'--source-revision',$SourceRevision,'--payload',$SourceDirectory,'--payload-manifest',$PayloadManifest,'--work-directory',$WorkDirectory)
+    $prepared=[IO.File]::ReadAllText((Join-Path $WorkDirectory 'prepared.json'))|ConvertFrom-Json
+    $stagedMain=Join-Path $WorkDirectory 'payload/Swan Remote Support.exe'
+    $stagedSignature=Get-AuthenticodeSignature -LiteralPath $stagedMain
+    if ($stagedSignature.Status -ne 'Valid') { throw 'Staged inner executable is not signed.' }
+    $hash=[Security.Cryptography.SHA256]::Create()
+    try { $stagedPublisher=([BitConverter]::ToString($hash.ComputeHash($stagedSignature.SignerCertificate.RawData))).Replace('-','').ToLowerInvariant() }
+    finally { $hash.Dispose() }
+    if ($stagedPublisher -cne $certificateHash -or (Get-FileHash $stagedMain).Hash -ine $prepared.main_sha256) { throw 'Staged inner executable or publisher changed.' }
+    $stagedManifest=Join-Path $WorkDirectory 'payload-manifest.json'
+    $env:PATH=[IO.Path]::GetDirectoryName($CargoExe)+';'+[IO.Path]::GetDirectoryName($GitExe)+';'+$env:PATH
+    if ((Get-Command cargo -CommandType Application).Source -ine $CargoExe) { throw 'Pinned Cargo is not selected.' }
+    if ((Get-Command git -CommandType Application).Source -ine $GitExe) { throw 'Pinned Git is not selected.' }
+    $env:RUSTC=$RustcExe
+    $env:CARGO_TARGET_DIR=Join-Path $WorkDirectory 'target'
+    $env:CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER=$LinkExe
+    $env:SOURCE_DATE_EPOCH=[string]$prepared.source_date_epoch
+    $env:RUSTFLAGS=$null
+    $env:CARGO_ENCODED_RUSTFLAGS=@('-Ctarget-feature=+crt-static','-Clink-arg=/Brepro',('--remap-path-prefix='+$WorkDirectory+'=.')) -join [char]31
+    $env:PYTHONDONTWRITEBYTECODE='1'
+    $packer=Join-Path $WorkDirectory 'source/libs/portable'
+    # Execute only the exact corresponding project source selected by the maintainer.
+    # Company profiles and the installer worker cannot supply build commands.
+    Invoke-BuildTool $PythonExe @((Join-Path $packer 'generate.py'),'-f',(Join-Path $WorkDirectory 'payload'),'-o',$packer,'-e','Swan Remote Support.exe','-t','x86_64-pc-windows-msvc')
+    Push-Location $packer
+    try {
+        Invoke-BuildTool $CargoExe @('test','--locked','--release','--target','x86_64-pc-windows-msvc')
+    } finally { Pop-Location }
+    $resourceOutputs=@(Get-ChildItem -LiteralPath (Join-Path $env:CARGO_TARGET_DIR 'x86_64-pc-windows-msvc/release/build') -Directory -Filter 'rustdesk-portable-packer-*' | ForEach-Object {
+        $path=Join-Path $_.FullName 'output'
+        if (Test-Path -LiteralPath $path) { [IO.File]::ReadAllLines($path) | Where-Object { $_ -match "^Selected RC path: '(.*)'$" } }
+    })
+    if ($resourceOutputs.Count -eq 0) { throw 'Missing actual portable resource-compiler selection evidence.' }
+    foreach ($line in $resourceOutputs) {
+        $selected=[regex]::Match($line,"^Selected RC path: '(.*)'$").Groups[1].Value
+        if ([IO.Path]::GetFullPath($selected) -ine $resourceCompiler -or (Get-FileHash -LiteralPath $selected).Hash -ine $resourceCompilerHash) { throw 'Registered Windows SDK resource compiler differs from the configured trusted tool.' }
+    }
+    $built=Join-Path $env:CARGO_TARGET_DIR 'x86_64-pc-windows-msvc/release/rustdesk-portable-packer.exe'
+    [void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($Output))
+    Invoke-BuildTool $PythonExe @((Join-Path $PSScriptRoot 'verify-portable-payload.py'),'--package',$built,'--manifest',$stagedManifest,'--output',($Output+'.payload-verification.json'))
+    [IO.File]::Copy($built,$Output,$false)
+    [IO.File]::Copy($stagedManifest,($Output+'.installed-files.json'),$false)
+    [ordered]@{
+        source_revision=$SourceRevision
+        source_archive_sha256=$SourceArchiveSha256
+        source_date_epoch=$prepared.source_date_epoch
+        sha256=(Get-FileHash $Output).Hash.ToLowerInvariant()
+        installed_manifest_sha256=(Get-FileHash ($Output+'.installed-files.json')).Hash.ToLowerInvariant()
+        inner_executable_sha256=$prepared.main_sha256
+        publisher_certificate_sha256=$certificateHash
+        cargo_sha256=$CargoSha256
+        cargo_home_path_length=$CargoHome.Length
+        rustc_sha256=$RustcSha256
+        git_sha256=$GitSha256
+        git_version=$gitVersion
+        linker_sha256=$LinkSha256
+        resource_compiler_sha256=$resourceCompilerHash
+        actual_resource_compiler_selection_verified=$true
+        producer_script_sha256=(Get-FileHash $PSCommandPath).Hash.ToLowerInvariant()
+        source_stager_sha256=(Get-FileHash (Join-Path $PSScriptRoot 'prepare-customer-exe.py')).Hash.ToLowerInvariant()
+        payload_verifier_sha256=(Get-FileHash (Join-Path $PSScriptRoot 'verify-portable-payload.py')).Hash.ToLowerInvariant()
+        portable_manifest_transform=$prepared.portable_manifest_transform
+        signed_inner_payload_verified=$true
+        outer_signature_required=$true
+        independent_reproduction_verified=$false
+        production_publication=$false
+    }|ConvertTo-Json -Depth 6|Set-Content -LiteralPath ($Output+'.build.json')
+    Write-Host 'Built unsigned outer installer with verified signed inner payload. Outer signing, approved release metadata and clean-machine tests remain required.'
+} finally {
+    foreach ($name in $saved.Keys) { [Environment]::SetEnvironmentVariable($name,$saved[$name],'Process') }
+}
diff --git a/deployment/windows/Build-CustomerMsi.ps1 b/deployment/windows/Build-CustomerMsi.ps1
new file mode 100644
index 00000000000..ce9535d4b38
--- /dev/null
+++ b/deployment/windows/Build-CustomerMsi.ps1
@@ -0,0 +1,54 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$WixExe,
+    [Parameter(Mandatory=$true)][string]$SourceDirectory,
+    [Parameter(Mandatory=$true)][string]$AgentExe,
+    [Parameter(Mandatory=$true)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
+    [Parameter(Mandatory=$true)][string]$Output,
+    [string]$PythonExe='python3',
+    [switch]$UnsignedTest,
+    [ValidateRange(0,4102444799)][long]$SourceDateEpoch=0
+)
+$ErrorActionPreference = 'Stop'
+$WixExe = (Resolve-Path -LiteralPath $WixExe).Path
+$SourceDirectory = (Resolve-Path -LiteralPath $SourceDirectory).Path
+$AgentExe = (Resolve-Path -LiteralPath $AgentExe).Path
+$Output = [IO.Path]::GetFullPath($Output)
+if ($Output -notmatch '-unsigned\.msi$') { throw 'Build output must end in -unsigned.msi; sign and approve it separately.' }
+if (Test-Path -LiteralPath $Output) { throw 'Refusing to overwrite an existing installer.' }
+$toolSignature = Get-AuthenticodeSignature -LiteralPath $WixExe
+if ($toolSignature.Status -ne 'Valid' -or $toolSignature.SignerCertificate.Subject -notmatch 'CN=WiX Toolset \(\.NET Foundation\)') { throw 'WiX tool publisher verification failed.' }
+$toolVersion = (& $WixExe --version | Out-String).Trim()
+if ($LASTEXITCODE -ne 0 -or $toolVersion -notmatch '^5\.0\.2(?:\+|$)') { throw 'WiX 5.0.2 is required.' }
+$main = Join-Path $SourceDirectory 'rustdesk.exe'
+if (-not $UnsignedTest) {
+    $mainSignature = Get-AuthenticodeSignature -LiteralPath $main
+    $agentSignature = Get-AuthenticodeSignature -LiteralPath $AgentExe
+    if ($mainSignature.Status -ne 'Valid' -or $agentSignature.Status -ne 'Valid' -or $mainSignature.SignerCertificate.Thumbprint -ne $agentSignature.SignerCertificate.Thumbprint) { throw 'Production executable inputs require valid signatures from the same release publisher.' }
+}
+New-Item -ItemType Directory -Force ([IO.Path]::GetDirectoryName($Output)) | Out-Null
+$authoring = $Output + '.wxs'
+$manifest = $Output + '.installed-files.json'
+$buildOutput=$Output
+if ($SourceDateEpoch -ne 0) {
+    if ($SourceDateEpoch -lt 315532800) { throw 'SourceDateEpoch must be a release timestamp from 1980 onward.' }
+    $buildOutput=$Output+'.raw-unsigned.msi'
+    if (Test-Path -LiteralPath $buildOutput) { throw 'Refusing to overwrite an intermediate installer.' }
+    $stage=$Output+'.inputs'
+    if (Test-Path -LiteralPath $stage) { throw 'Staged inputs already exist; inspect the earlier build.' }
+    [void][IO.Directory]::CreateDirectory($stage)
+    $copy=Join-Path $PSScriptRoot 'Copy-ReproducibleMsiInput.ps1'
+    $SourceDirectory=& $copy -InputPath $SourceDirectory -Destination (Join-Path $stage 'payload') -SourceDateEpoch $SourceDateEpoch
+    $AgentExe=& $copy -InputPath $AgentExe -Destination (Join-Path $stage 'swan-agent.exe') -SourceDateEpoch $SourceDateEpoch
+    if (-not (Test-Path -LiteralPath (Join-Path $SourceDirectory 'LICENSE.txt'))) {
+        & $copy -InputPath (Join-Path $PSScriptRoot '../../LICENCE') -Destination (Join-Path $SourceDirectory 'LICENSE.txt') -SourceDateEpoch $SourceDateEpoch | Out-Null
+    }
+}
+& $PythonExe (Join-Path $PSScriptRoot 'generate-customer-msi.py') --source $SourceDirectory --agent $AgentExe --version $Version --output $authoring --manifest-output $manifest
+if ($LASTEXITCODE -ne 0) { throw 'Customer payload authoring failed.' }
+& $WixExe build $authoring -arch x64 -o $buildOutput
+if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $buildOutput)) { throw 'Customer MSI build failed.' }
+$metadata=$null
+if ($SourceDateEpoch -ne 0) { $metadata=& (Join-Path $PSScriptRoot 'Set-ReproducibleMsiMetadata.ps1') -InputMsi $buildOutput -OutputMsi $Output -SourceDateEpoch $SourceDateEpoch }
+[pscustomobject]@{version=$Version;wix=$toolVersion;unsigned_test=[bool]$UnsignedTest;metadata=$metadata;sha256=(Get-FileHash -LiteralPath $Output -Algorithm SHA256).Hash.ToLowerInvariant();installed_manifest_sha256=(Get-FileHash -LiteralPath $manifest -Algorithm SHA256).Hash.ToLowerInvariant();agent_sha256=(Get-FileHash -LiteralPath $AgentExe -Algorithm SHA256).Hash.ToLowerInvariant()} | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath ($Output+'.build.json')
+Write-Host 'Built unsigned customer MSI. Signing, approved metadata and clean-machine verification remain required.'
diff --git a/deployment/windows/Build-FlutterEngine.ps1 b/deployment/windows/Build-FlutterEngine.ps1
new file mode 100644
index 00000000000..1cf82255ad8
--- /dev/null
+++ b/deployment/windows/Build-FlutterEngine.ps1
@@ -0,0 +1,99 @@
+param(
+ [Parameter(Mandatory=$true)][string]$BuildRoot,
+ [string]$VisualStudioPath='C:\Program Files\Microsoft Visual Studio\2022\Enterprise'
+)
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+$recipe=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'flutter-engine.lock.json') -Raw | ConvertFrom-Json
+if($recipe.schema -ne 1 -or $recipe.engine.repository -cne 'https://github.com/flutter-team-archive/engine.git' -or $recipe.depot_tools.repository -cne 'https://chromium.googlesource.com/chromium/tools/depot_tools.git'){throw 'Unexpected engine source recipe'}
+if($recipe.buildroot.repository -cne 'https://github.com/flutter/buildroot.git'){throw 'Unexpected Flutter buildroot source'}
+foreach($component in @($recipe.engine,$recipe.depot_tools,$recipe.buildroot)){if($component.revision -cnotmatch '^[0-9a-f]{40}$'){throw 'An immutable source revision is required'}}
+if($recipe.windows_toolchain.msvc_tools_version -cne '14.38.33130' -or $recipe.windows_toolchain.windows_sdk_version -cne '10.0.22621.0'){throw 'Unexpected engine Windows toolchain'}
+$overrideProperties=@($recipe.dependency_overrides.PSObject.Properties)
+if($overrideProperties.Count -ne 1 -or $overrideProperties[0].Name -cne 'src/flutter/third_party/tinygltf' -or $overrideProperties[0].Value.repository -cne 'https://github.com/syoyo/tinygltf.git' -or $overrideProperties[0].Value.revision -cne '9bb5806df4055ac973b970ba5b3e27ce27d98148'){throw 'Dependency override must preserve the reviewed original DEPS commit'}
+$root=[IO.Path]::GetFullPath($BuildRoot)
+if(Test-Path -LiteralPath $root){throw 'Build root must be a new dedicated directory'}
+$parent=Get-Item -LiteralPath ([IO.Path]::GetDirectoryName($root))
+if($parent.Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Build parent cannot be a reparse point'}
+if((Get-PSDrive -Name $parent.PSDrive.Name).Free -lt 40GB){throw 'Engine build requires at least 40 GiB free on its build drive'}
+$env:DEPOT_TOOLS_UPDATE='0'
+$env:DEPOT_TOOLS_WIN_TOOLCHAIN='0'
+$env:GIT_CONFIG_COUNT='1'
+$env:GIT_CONFIG_KEY_0='core.autocrlf'
+$env:GIT_CONFIG_VALUE_0='false'
+$env:PYTHONIOENCODING='utf-8'
+$env:GYP_MSVS_OVERRIDE_PATH=[IO.Path]::GetFullPath($VisualStudioPath)
+$env:WINDOWSSDKDIR='C:\Program Files (x86)\Windows Kits\10'
+if(-not(Test-Path -LiteralPath $env:GYP_MSVS_OVERRIDE_PATH)){throw 'Visual Studio 2022 C++ build tools are required'}
+$msvc=Join-Path $env:GYP_MSVS_OVERRIDE_PATH ('VC\Tools\MSVC\'+$recipe.windows_toolchain.msvc_tools_version)
+if(-not(Test-Path -LiteralPath (Join-Path $msvc 'lib\x64\libcpmt.lib'))){throw 'The pinned Microsoft C++ 14.38.33130 toolset is required'}
+if(-not(Test-Path -LiteralPath (Join-Path $msvc 'ATLMFC\lib\x64\atls.lib'))){throw 'The matching Microsoft C++ 14.38 ATL component is required'}
+if(-not(Test-Path -LiteralPath (Join-Path $env:WINDOWSSDKDIR ('Include\'+$recipe.windows_toolchain.windows_sdk_version)))){throw 'The pinned Windows SDK 10.0.22621.0 is required'}
+New-Item -ItemType Directory -Path $root | Out-Null
+function Invoke-Checked([string]$Executable,[string[]]$Arguments){
+ & $Executable @Arguments
+ if($LASTEXITCODE -ne 0){throw ('Engine build command failed: '+$Executable+' exit '+$LASTEXITCODE)}
+}
+$depot=Join-Path $root 'depot_tools'
+Invoke-Checked git @('init',$depot)
+Invoke-Checked git @('-C',$depot,'remote','add','origin',$recipe.depot_tools.repository)
+Invoke-Checked git @('-C',$depot,'fetch','--depth=1','origin',$recipe.depot_tools.revision)
+Invoke-Checked git @('-C',$depot,'checkout','--detach','FETCH_HEAD')
+$actualDepot=(& git -C $depot rev-parse HEAD).Trim()
+if($LASTEXITCODE -ne 0 -or $actualDepot -cne $recipe.depot_tools.revision){throw 'Depot-tools checkout mismatch'}
+# Disabling automatic source updates also skips the usual Windows bootstrap.
+# Initialize the tools from this revision's own pinned CIPD manifest so gclient
+# can find its generated git.bat without changing the reviewed depot-tools pin.
+Invoke-Checked (Join-Path $depot 'bootstrap\win_tools.bat') @()
+if(-not(Test-Path -LiteralPath (Join-Path $depot 'git.bat'))){throw 'Pinned Windows Git bootstrap did not produce git.bat'}
+$env:PATH=$depot+';'+$env:PATH
+$checkout=Join-Path $root 'checkout'
+New-Item -ItemType Directory -Path $checkout | Out-Null
+$customDeps=@{}
+foreach($entry in $overrideProperties){$customDeps[$entry.Name]=$entry.Value.repository+'@'+$entry.Value.revision}
+$customDepsJson=$customDeps | ConvertTo-Json -Compress
+$solution='solutions = [{"name": "src/flutter", "url": "'+$recipe.engine.repository+'@'+$recipe.engine.revision+'", "deps_file": "DEPS", "managed": False, "custom_deps": '+$customDepsJson+'}]'
+[IO.File]::WriteAllText((Join-Path $checkout '.gclient'),$solution+"`ntarget_os = ['win']`n",[Text.UTF8Encoding]::new($false))
+Push-Location $checkout
+try {
+ Invoke-Checked (Join-Path $depot 'gclient.bat') @('sync','--no-history','--jobs=4')
+ $revisions=& (Join-Path $depot 'gclient.bat') revinfo --actual 2>&1
+ if($LASTEXITCODE -ne 0){throw 'Could not record actual engine dependency revisions'}
+ [IO.File]::WriteAllText((Join-Path $root 'dependency-revisions.txt'),($revisions -join "`n"),[Text.UTF8Encoding]::new($false))
+ $engine=Join-Path $checkout 'src\flutter'
+ Invoke-Checked python @((Join-Path $PSScriptRoot 'flutter-engine-source.py'),'patch',$engine)
+ Invoke-Checked python @((Join-Path $PSScriptRoot 'flutter-engine-source.py'),'patch-buildroot',(Join-Path $checkout 'src'))
+ if((Get-PSDrive -Name $parent.PSDrive.Name).Free -lt 12GB){throw 'Insufficient disk reserve after engine dependency checkout'}
+ $compiler=Join-Path $engine 'buildtools\windows-x64\clang\bin\clang-cl.exe'
+ if(-not(Test-Path -LiteralPath $compiler)){throw 'Pinned engine compiler is missing'}
+ $compilerVersion=& $compiler --version | Out-String
+ if($LASTEXITCODE -ne 0){throw 'Pinned engine compiler version could not be recorded'}
+ $linker=Join-Path $engine 'buildtools\windows-x64\clang\bin\lld-link.exe'
+ if($recipe.linker.path -cne 'buildtools/windows-x64/clang/bin/lld-link.exe' -or $recipe.linker.threads -ne 1 -or -not(Test-Path -LiteralPath $linker)){throw 'Pinned experimental LLVM linker is unavailable'}
+ $linkerVersion=& $linker --version | Out-String
+ if($LASTEXITCODE -ne 0 -or $linkerVersion -notmatch 'LLD'){throw 'Pinned LLVM linker version could not be recorded'}
+ $toolchain=@{runner_os=$env:RUNNER_OS;runner_image=$env:ImageOS;runner_image_version=$env:ImageVersion;git=(& git --version);python=(& python --version);compiler=$compilerVersion;compiler_sha256=(Get-FileHash -LiteralPath $compiler).Hash;visual_studio=$env:GYP_MSVS_OVERRIDE_PATH;msvc_tools_version=$recipe.windows_toolchain.msvc_tools_version;msvc_libcmt_sha256=(Get-FileHash -LiteralPath (Join-Path $msvc 'lib\x64\libcmt.lib')).Hash;msvc_libcpmt_sha256=(Get-FileHash -LiteralPath (Join-Path $msvc 'lib\x64\libcpmt.lib')).Hash;msvc_atls_sha256=(Get-FileHash -LiteralPath (Join-Path $msvc 'ATLMFC\lib\x64\atls.lib')).Hash;windows_sdk_version=$recipe.windows_toolchain.windows_sdk_version;msvc_directories=@(Get-ChildItem -Directory -LiteralPath (Join-Path $env:GYP_MSVS_OVERRIDE_PATH 'VC\Tools\MSVC') | Select-Object -ExpandProperty Name);windows_sdk_versions=@(Get-ChildItem -Directory -LiteralPath (Join-Path $env:WINDOWSSDKDIR 'Include') | Select-Object -ExpandProperty Name);gn_arguments=@('--runtime-mode=release');ninja_target='flutter_windows.dll';source_commit=$env:GITHUB_SHA;workflow_run=$env:GITHUB_RUN_ID}
+ $toolchain.linker_relative_path=$recipe.linker.path
+ $toolchain.linker_sha256=(Get-FileHash -LiteralPath $linker).Hash.ToLowerInvariant()
+ $toolchain.linker_version=$linkerVersion
+ $toolchain | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath (Join-Path $root 'toolchain.json') -Encoding utf8
+ Write-Output $compilerVersion
+ Push-Location (Join-Path $checkout 'src')
+ try {
+  Invoke-Checked python @((Join-Path $engine 'tools\gn'),'--runtime-mode=release')
+  $commands=& (Join-Path $engine 'third_party\ninja\ninja.exe') -C out/host_release -t commands flutter_windows.dll
+  if($LASTEXITCODE -ne 0){throw 'Could not record generated engine compile/link commands'}
+  [IO.File]::WriteAllText((Join-Path $root 'ninja-commands.txt'),($commands -join "`n"),[Text.UTF8Encoding]::new($false))
+  Invoke-Checked python @((Join-Path $PSScriptRoot 'flutter-engine-source.py'),'verify-commands',(Join-Path $root 'ninja-commands.txt'))
+  # Retain response files so the final linker flags are auditable after success.
+  try {
+   Invoke-Checked (Join-Path $engine 'third_party\ninja\ninja.exe') @('-C','out/host_release','-d','keeprsp','-j4','flutter_windows.dll')
+  } finally {
+   if(Test-Path -LiteralPath 'out/host_release/flutter_windows.dll.rsp'){
+    Copy-Item -LiteralPath 'out/host_release/flutter_windows.dll.rsp' -Destination (Join-Path $root 'link-response.txt')
+   }
+  }
+  Invoke-Checked python @((Join-Path $PSScriptRoot 'flutter-engine-source.py'),'verify-link-response',(Join-Path $root 'link-response.txt'))
+ } finally {Pop-Location}
+ Invoke-Checked python @((Join-Path $PSScriptRoot 'flutter-engine-source.py'),'package',$root,(Join-Path $root 'artifacts'))
+} finally {Pop-Location}
diff --git a/deployment/windows/Build-ServerSetup.ps1 b/deployment/windows/Build-ServerSetup.ps1
new file mode 100644
index 00000000000..0ae0c441001
--- /dev/null
+++ b/deployment/windows/Build-ServerSetup.ps1
@@ -0,0 +1,76 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$ManagementExecutable,[Parameter(Mandatory)][string]$ComponentsDirectory,
+      [Parameter(Mandatory)][string]$CompilerPackage,
+      [Parameter(Mandatory)][string]$FrameworkReferencesPackage,
+      [Parameter(Mandatory)][string]$PowerShellReferencesPackage,
+      [Parameter(Mandatory)][string]$OutputDirectory,[switch]$UnsignedTest)
+$ErrorActionPreference = 'Stop'
+if (-not $UnsignedTest) { throw 'Only explicitly unsigned test server packages are supported until production signing and release verification are approved.' }
+$management = (Resolve-Path -LiteralPath $ManagementExecutable).Path
+if ([IO.Path]::GetExtension($management) -ine '.exe') { throw 'Select a Windows management executable.' }
+$reader = [IO.BinaryReader]::new([IO.File]::OpenRead($management))
+try {
+    if ($reader.ReadUInt16() -ne 0x5a4d) { throw 'Management executable DOS header missing.' }
+    $reader.BaseStream.Position = 60
+    $offset = $reader.ReadUInt32()
+    if ($offset+6 -gt $reader.BaseStream.Length) { throw 'Management executable PE header missing.' }
+    $reader.BaseStream.Position = $offset
+    if ($reader.ReadUInt32() -ne 0x4550 -or $reader.ReadUInt16() -ne 0x8664) { throw 'Expected a Windows x64 management executable.' }
+} finally {$reader.Dispose()}
+$components = (Resolve-Path -LiteralPath $ComponentsDirectory).Path
+$output = [IO.Path]::GetFullPath($OutputDirectory)
+if (Test-Path -LiteralPath $output) { throw 'Server package output directory already exists.' }
+$resources = [ordered]@{
+    'Setup-Server.ps1'=(Join-Path $PSScriptRoot 'Setup-Server.ps1')
+    'Install-Server.ps1'=(Join-Path $PSScriptRoot 'Install-Server.ps1')
+    'swan-management.exe'=$management
+    'LICENCE'=(Resolve-Path -LiteralPath (Join-Path $PSScriptRoot '../../LICENCE')).Path
+}
+foreach ($name in @('hbbs.exe','hbbr.exe','caddy.exe','Caddy-LICENSE.txt','RustDesk-LICENSE.txt','THIRD-PARTY.txt','server-components.json','transport-build-source.zip')) {
+    $resources['components/'+$name] = Join-Path $components $name
+}
+$pins=@{'hbbs.exe'='2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be';'hbbr.exe'='97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0';'caddy.exe'='586d4a4cd74bdfd2951b6b81766a32904ffa69c4f1c3d521da3870a2120f1d31'}
+$hashes=[ordered]@{}
+foreach ($name in $resources.Keys) {
+    if ($resources[$name].Contains(',')) { throw 'Compiler resource input paths must not contain commas.' }
+    $hashes[$name]=(Get-FileHash -LiteralPath $resources[$name] -Algorithm SHA256).Hash.ToLowerInvariant()
+    $basename=[IO.Path]::GetFileName($name)
+    if ($pins.ContainsKey($basename) -and $hashes[$name] -ne $pins[$basename]) { throw 'Pinned component executable mismatch.' }
+}
+$revision = & git -C (Join-Path $PSScriptRoot '../..') rev-parse HEAD
+if ($LASTEXITCODE -ne 0 -or $revision -notmatch '^[0-9a-f]{40}$') { throw 'Build from the public Git checkout.' }
+$dirty = -not [string]::IsNullOrEmpty((& git -C (Join-Path $PSScriptRoot '../..') status --porcelain | Out-String).Trim())
+New-Item -ItemType Directory -Path $output | Out-Null
+$compiler=& (Join-Path $PSScriptRoot 'Expand-ServerCompiler.ps1') -Package $CompilerPackage -OutputDirectory (Join-Path $output 'compiler')
+$compilerPin=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'server-compiler.json') -Raw|ConvertFrom-Json
+$references=& (Join-Path $PSScriptRoot 'Expand-ServerReferences.ps1') -FrameworkPackage $FrameworkReferencesPackage -PowerShellPackage $PowerShellReferencesPackage -OutputDirectory (Join-Path $output 'references')
+$referencePins=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'server-references.json') -Raw|ConvertFrom-Json
+$referencePackages=[ordered]@{}
+foreach($kind in @('framework','powershell')){$pin=$referencePins.$kind;$referencePackages[$kind]=[ordered]@{id=$pin.id;version=$pin.version;sha256=$pin.sha256}}
+$referenceHashes=[ordered]@{}
+foreach($name in $references.Keys){$referenceHashes[$name]=(Get-FileHash -LiteralPath $references[$name]).Hash.ToLowerInvariant()}
+$sourcePath = Join-Path $output 'SOURCE.json'
+$sourceFiles=[ordered]@{}
+foreach ($name in @('ServerSetupLauncher.cs','Build-ServerSetup.ps1','Expand-ServerCompiler.ps1','server-compiler.json','Expand-ServerReferences.ps1','server-references.json')) { $sourceFiles[$name]=(Get-FileHash -LiteralPath (Join-Path $PSScriptRoot $name) -Algorithm SHA256).Hash.ToLowerInvariant() }
+$source = [ordered]@{schema=1;unsigned_test=$true;repository='https://github.com/rijff24/SwanRemoteSupport';setup_source_revision=$revision;working_tree_dirty=$dirty;resources=$hashes;build_sources=$sourceFiles;compiler=[ordered]@{id=$compilerPin.id;version=$compilerPin.version;package_sha256=$compilerPin.sha256;compiler_sha256=$compilerPin.compiler_sha256;source=$compilerPin.source;deterministic=$true};reference_packages=$referencePackages;reference_sha256=$referenceHashes}
+[IO.File]::WriteAllText($sourcePath,($source | ConvertTo-Json -Depth 5 -Compress),[Text.UTF8Encoding]::new($false))
+$resources['SOURCE.json']=$sourcePath
+$executable = Join-Path $output 'SwanServerSetup-UNSIGNED-TEST.exe'
+$sourceRoot=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '../..'))
+$arguments = @('/nologo','/noconfig','/nostdlib+','/target:winexe','/platform:x64','/optimize+','/deterministic+',('/pathmap:'+$sourceRoot+'=/_/SwanRemoteSupport'),('/out:'+$executable))
+foreach($path in $references.Values){$arguments+='/reference:'+$path}
+foreach ($name in $resources.Keys) { $arguments += '/resource:'+$resources[$name]+',Swan.'+$name }
+$arguments += Join-Path $PSScriptRoot 'ServerSetupLauncher.cs'
+& $compiler @arguments
+if ($LASTEXITCODE -ne 0) { throw 'Server setup compilation failed; output remains for inspection.' }
+$assembly = [Reflection.Assembly]::LoadFile($executable)
+foreach ($name in (@($hashes.Keys)+@('SOURCE.json'))) {
+    $stream = $assembly.GetManifestResourceStream('Swan.'+$name)
+    if (-not $stream) { throw 'Compiled package resource missing.' }
+    $hasher = [Security.Cryptography.SHA256]::Create()
+    try {$actual=[BitConverter]::ToString($hasher.ComputeHash($stream)).Replace('-','').ToLowerInvariant()} finally {$hasher.Dispose();$stream.Dispose()}
+    $expected=if($name -eq 'SOURCE.json'){(Get-FileHash -LiteralPath $sourcePath).Hash.ToLowerInvariant()}else{$hashes[$name]}
+    if ($actual -ne $expected) { throw 'Compiled package resource differs from the pinned input.' }
+}
+Copy-Item -LiteralPath $resources['LICENCE'] -Destination (Join-Path $output 'LICENCE')
+Write-Output $executable
diff --git a/deployment/windows/Build-TechnicianMsi.ps1 b/deployment/windows/Build-TechnicianMsi.ps1
new file mode 100644
index 00000000000..d708e7d44dd
--- /dev/null
+++ b/deployment/windows/Build-TechnicianMsi.ps1
@@ -0,0 +1,51 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$WixExe,
+    [Parameter(Mandatory=$true)][string]$TechnicianExe,
+    [Parameter(Mandatory=$true)][string]$AgentExe,
+    [Parameter(Mandatory=$true)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version,
+    [Parameter(Mandatory=$true)][string]$Output,
+    [switch]$UnsignedTest,
+    [ValidateRange(0,4102444799)][long]$SourceDateEpoch=0
+)
+$ErrorActionPreference = 'Stop'
+$WixExe = (Resolve-Path -LiteralPath $WixExe).Path
+$TechnicianExe = (Resolve-Path -LiteralPath $TechnicianExe).Path
+$AgentExe = (Resolve-Path -LiteralPath $AgentExe).Path
+$Output = [IO.Path]::GetFullPath($Output)
+if ($Output -notmatch '-unsigned\.msi$') { throw 'Build output must end in -unsigned.msi; sign and approve the package separately.' }
+if (Test-Path -LiteralPath $Output) { throw 'Refusing to overwrite an existing installer.' }
+$toolSignature = Get-AuthenticodeSignature -LiteralPath $WixExe
+if ($toolSignature.Status -ne 'Valid' -or $toolSignature.SignerCertificate.Subject -notmatch 'CN=WiX Toolset \(\.NET Foundation\)') { throw 'WiX tool publisher verification failed.' }
+$toolVersion = (& $WixExe --version | Out-String).Trim()
+if ($LASTEXITCODE -ne 0 -or $toolVersion -notmatch '^5\.0\.2(?:\+|$)') { throw 'WiX 5.0.2 is required.' }
+if (-not $UnsignedTest) {
+    $technicianSignature = Get-AuthenticodeSignature -LiteralPath $TechnicianExe
+    $agentSignature = Get-AuthenticodeSignature -LiteralPath $AgentExe
+    if ($technicianSignature.Status -ne 'Valid' -or $agentSignature.Status -ne 'Valid' -or $technicianSignature.SignerCertificate.Thumbprint -ne $agentSignature.SignerCertificate.Thumbprint) { throw 'Production payloads must have valid signatures from the same release publisher.' }
+}
+$launcher = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot 'Open-Technician.ps1'))
+$license = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '../../LICENCE'))
+$source = Join-Path $PSScriptRoot 'msi/Technician.wxs'
+$productCode = & (Join-Path $PSScriptRoot 'Get-MsiProductCode.ps1') -Edition technician -Version $Version
+New-Item -ItemType Directory -Force ([IO.Path]::GetDirectoryName($Output)) | Out-Null
+$buildOutput=$Output
+if ($SourceDateEpoch -ne 0) {
+    if ($SourceDateEpoch -lt 315532800) { throw 'SourceDateEpoch must be a release timestamp from 1980 onward.' }
+    $buildOutput=$Output+'.raw-unsigned.msi'
+    if (Test-Path -LiteralPath $buildOutput) { throw 'Refusing to overwrite an intermediate installer.' }
+    $stage=$Output+'.inputs'
+    if (Test-Path -LiteralPath $stage) { throw 'Staged inputs already exist; inspect the earlier build.' }
+    [void][IO.Directory]::CreateDirectory($stage)
+    $copy=Join-Path $PSScriptRoot 'Copy-ReproducibleMsiInput.ps1'
+    $TechnicianExe=& $copy -InputPath $TechnicianExe -Destination (Join-Path $stage 'technician.exe') -SourceDateEpoch $SourceDateEpoch
+    $AgentExe=& $copy -InputPath $AgentExe -Destination (Join-Path $stage 'swan-agent.exe') -SourceDateEpoch $SourceDateEpoch
+    $launcher=& $copy -InputPath $launcher -Destination (Join-Path $stage 'Open-Technician.ps1') -SourceDateEpoch $SourceDateEpoch
+    $license=& $copy -InputPath $license -Destination (Join-Path $stage 'LICENSE.txt') -SourceDateEpoch $SourceDateEpoch
+}
+& $WixExe build $source -arch x64 -d ('Version='+$Version) -d ('ProductCode='+$productCode) -d ('TechnicianExe='+$TechnicianExe) -d ('AgentExe='+$AgentExe) -d ('Launcher='+$launcher) -d ('License='+$license) -o $buildOutput
+if ($LASTEXITCODE -ne 0 -or -not (Test-Path -LiteralPath $buildOutput)) { throw 'Technician MSI build failed.' }
+$metadata=$null
+if ($SourceDateEpoch -ne 0) { $metadata=& (Join-Path $PSScriptRoot 'Set-ReproducibleMsiMetadata.ps1') -InputMsi $buildOutput -OutputMsi $Output -SourceDateEpoch $SourceDateEpoch }
+[pscustomobject]@{version=$Version;wix=$toolVersion;unsigned_test=[bool]$UnsignedTest;metadata=$metadata;sha256=(Get-FileHash -LiteralPath $Output -Algorithm SHA256).Hash.ToLowerInvariant();technician_sha256=(Get-FileHash -LiteralPath $TechnicianExe -Algorithm SHA256).Hash.ToLowerInvariant();agent_sha256=(Get-FileHash -LiteralPath $AgentExe -Algorithm SHA256).Hash.ToLowerInvariant()} | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath ($Output+'.build.json')
+Write-Host 'Built unsigned technician MSI. Production distribution requires signing, signed release metadata and clean-machine verification.'
diff --git a/deployment/windows/COMPANY-SIGNING.md b/deployment/windows/COMPANY-SIGNING.md
new file mode 100644
index 00000000000..90c6a210b27
--- /dev/null
+++ b/deployment/windows/COMPANY-SIGNING.md
@@ -0,0 +1,79 @@
+# Optional company signing
+
+For a customer EXE, sign the installed inner executable before rebuilding its
+outer installer with the [customer EXE producer](../../docs/CUSTOMER_EXE_PRODUCER.md).
+Signing only the old outer EXE cannot update or sign its embedded payload.
+
+Company signing is a local operator-controlled integration. The project does
+not provide certificates, approval, shared signing infrastructure or private
+keys. Default distribution consumes unchanged project-signed artifacts.
+
+`Sign-CompanyArtifact.ps1` signs a new copy of one locally prepared EXE or MSI.
+Supply its independently verified input SHA-256, a new output path, the exact
+company publisher, a certificate thumbprint in the local Personal store, a
+Microsoft-signed Windows SDK SignTool path and the company's chosen HTTP or HTTPS
+RFC3161 timestamp endpoint. Select `LocalMachine` only if that is where the
+worker account's certificate is configured. The script does not import or
+export keys, install trust roots, accept remote scripts or modify its input.
+
+The certificate must have a private-key provider available to that account,
+permit code signing and be current. Hardware providers may require their own
+operator interaction. Provider-specific cloud signing is not implemented.
+SignTool uses SHA-256 file and timestamp digests; subsequent verification pins
+the trusted Authenticode publisher and certificate SHA-256 and requires a
+timestamp. A mismatched input is rejected before signing.
+
+SignTool verifies every signature under Authenticode policy with `/pa /all /tw`;
+any error or warning prevents publication, including a missing timestamp. The
+SDK check is authoritative for RFC3161 timestamps because the tested Server
+2016 PowerShell reports no timestamp certificate even after SDK verification
+confirms a valid RFC3161 timestamp.
+
+The timestamp URL is explicit; the tool does not retry with a different scheme.
+Credentials, query parameters and fragments are rejected so the public receipt
+cannot carry timestamp-service credentials. RFC3161 responses remain signed
+and trusted timestamp verification is required. The tested SDK rejected the
+HTTPS DigiCert URL; DigiCert documents
+[its HTTP RFC3161 endpoint](https://knowledge.digicert.com/general-information/rfc3161-compliant-time-stamp-authority-server).
+
+The output `.signing.json` records the original and signed hashes, publisher,
+certificate fingerprint and timestamp endpoint. It is evidence for preparing
+release metadata, not a signed release manifest or administrator approval.
+Sign installed endpoint/agent binaries before regenerating installed-file
+manifests and building packages, then sign the final package. Regenerate every
+affected hash after signing. Embedded company icons or metadata require a
+company build and corresponding source; signing alone does not customize them.
+
+For a new company using company-authored release metadata, explicitly provision
+its chosen release-verification public key in the server/worker and endpoint
+bootstrap. Set the signed release's publisher and certificate fingerprint to
+the company values and include exact corresponding source. Import and approve
+that release through management before the worker or updater consumes it.
+Private release-signing keys remain on the company's release-authoring system.
+Changing an existing deployment's pinned release issuer requires a separate
+trusted migration; changing an environment variable does not authorize clients
+to accept another issuer. Automated issuer migration remains incomplete.
+
+A private Server 2016 VM now exercises actual software-provider signing with a
+non-exportable lab key and a self-signed certificate trusted only in that VM.
+The integration signed a copy of the native agent, obtained a DigiCert RFC3161
+timestamp, passed SDK verification and matched the pinned publisher/certificate
+through `Verify-Package.ps1`, including from a standard account. The unsigned
+input stayed unchanged. An otherwise trusted signature without a timestamp
+produced SDK warning exit `2` and was rejected. Tampered bytes, a different
+publisher, a different certificate, and timestamp URLs containing credentials,
+queries or fragments were rejected. Earlier wrong-input-hash rejection also
+left the input unchanged and created no output.
+
+Subsequent [native1.5.18 producer tests](../../docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json)
+signed the installed customer executable and agent, both MSI editions, the
+technician EXE and a rebuilt customer EXE. The
+[company worker generated all four bundles](../../docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json)
+from approved lab-signed releases; downloaded payload hashes and signed metadata
+were verified independently. This verifies lab signing and worker consumption.
+Complete installation/update qualification, hardware/cloud providers and
+production provider approval remain separate requirements. No lab signing key
+was exported or added to the host's trust stores.
+
+See [Microsoft SignTool documentation](https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool)
+for certificate-store selection and RFC3161 signing options.
diff --git a/deployment/windows/CUSTOMER-MSI.md b/deployment/windows/CUSTOMER-MSI.md
new file mode 100644
index 00000000000..af1f8230aaa
--- /dev/null
+++ b/deployment/windows/CUSTOMER-MSI.md
@@ -0,0 +1,150 @@
+# Customer MSI packaging
+
+`generate-customer-msi.py` authors a per-machine x64 MSI from the complete
+project Flutter payload. It uses stable project upgrade and component identifiers,
+independent of company display names. The canonical application path is
+`%ProgramFiles%/Swan Remote Support/Swan Remote Support.exe`; the agent installs
+under `%ProgramData%/SwanRemoteSupport`. Company profiles, device identity and
+consent are not MSI-owned files and remain separate from release files.
+
+Sign the application executable and agent with the release publisher before
+building a release MSI with the builder's default signature checks. Prepare
+reproducible unsigned MSI metadata, then sign and timestamp the MSI. Generate
+the release's installed-file manifest from the exact signed payload bytes and
+its package hash from the final signed MSI. Signing only an unsigned CI MSI
+does not sign its contained application. Final installed-publisher verification
+still rejects an unsigned application and leaves installation recovery pending.
+See [technician packaging](TECHNICIAN-MSI.md) for signing order and the separate
+WiX build-machine prerequisite.
+
+Company setup checks related registered MSI versions before publishing its setup
+marker or stopping configuration syncing. A downgrade or incompatible same-version
+product is rejected; do not change registration or inflate a package version to
+get past that check. After later setup failures, the installer restores the prior
+configuration task's enabled/running state after checking its action and principal,
+while retaining installation recovery evidence. Restoration errors are surfaced
+with the original failure. Matching server and worker releases are required when
+their bundled setup texts change.
+
+The builder accepts `-SourceDateEpoch <release-commit-epoch>` to prepare stable
+unsigned package metadata before signing, retaining the original WiX output.
+See [metadata preparation](TECHNICIAN-MSI.md). Two local builds using the full
+95-file `e6b87b9` application payload and epoch `1792648409` produced identical
+unsigned MSI SHA-256
+`fc4a992108904aa6ecc2f2cc43fc54ff7c1ab55648cf39d72b5f45cdb061cf84`.
+This verifies repeat builds with the same local inputs, not independent CI
+reproducibility, signed publication or installer lifecycle behavior.
+
+The builder now also stages byte-verified payload and agent copies with consistent
+cabinet timestamps. Two complete payload copies dated in 2020 and 2025 produced
+identical MSI SHA-256
+`839b41f2d17645bfc69eb6f44901f5ce97d6433c59cc8addf49598b8ea3e51c3`
+at the same release epoch. Original payload timestamps and contents remain
+unchanged. Independent CI, cross-time-zone and clean-machine qualification remain
+unverified.
+
+The package includes all payload libraries/assets and a local AGPL license
+notice. Its signed-release manifest covers those installed files. Windows
+Installer owns service installation, start/stop/removal and transaction-based
+major-upgrade removal. The service runs the project executable with `--service`
+as LocalSystem. Windows Installer copies the local operating system's
+RuntimeBroker into the application directory and removes that copy on uninstall;
+it does not redistribute a project copy of Microsoft's binary. Runtime verification
+compares its hash with the current Windows system binary.
+
+Before creating installation folders or starting the service, the MSI uses its
+embedded release agent to prepare the machine-wide customer state directory.
+The helper creates a missing directory with SYSTEM/Administrators ownership and
+permissions atomically, then checks existing files and directories without
+adopting unsafe owners, permissions or reparse points. Unsafe pre-existing state
+must be preserved and investigated; setup does not silently trust it by changing
+its ACL. Explicit company setup uses the same helper before reading saved trust.
+The MSI also executes its embedded agent for uninstall/rollback, rather than
+trusting the installed agent or mutable helper scripts in that state directory.
+New package installation and standard-user negative access checks for this
+hardening remain required before release.
+
+```powershell
+./deployment/windows/Build-CustomerMsi.ps1 `
+  -WixExe C:/BuildTools/WiX/bin/wix.exe -SourceDirectory C:/Release/swan-client `
+  -AgentExe C:/Release/swan-agent.exe -Version 1.5.0 `
+  -Output C:/Release/SwanRemoteSupport-Customer-unsigned.msi
+```
+
+The recipe uses pinned WiX 5.0.2 and verifies its tool publisher/version.
+Production executable inputs need valid signatures from the same publisher.
+The builder produces an unsigned MSI, generated authoring, installed-file
+manifest and build-input hashes. Sign the MSI separately and publish signed
+release metadata before production approval. `-UnsignedTest` permits clearly
+marked test payloads; company workers/installers/updaters retain their signature
+checks. Regenerate hashes and metadata after final signing.
+
+Companies consume the unchanged signed project MSI through their Windows
+worker and distribute its public customer bundle. `Install-Company.ps1` confirms
+the company HTTPS identity, verifies trust and the package, protects the state
+directory, enrolls the device and enables configuration synchronization.
+`-BootstrapPath` plus `-ConfirmedCompanyDomain` provides explicit managed
+configuration input without embedding credentials. The bare MSI does not enroll
+or silently select a company. Full deployment must use the company setup flow;
+new devices stay unavailable until approved.
+
+If setup failed after creating its durable installation marker, retry the same
+bundle first. To replace it with a corrected, newer signed release, run that
+bundle's `Install-Company.ps1 -ReplaceFailedSetup` with the usual company-domain
+confirmation. This explicit recovery retains the original signed receipt under
+the protected state directory's `cancelled-setups` folder. It requires the pinned
+release issuer, matching edition and a strictly newer sequence; it keeps support
+blocked until the replacement's complete installed identity is verified. It does
+not waive package signing or permit replacement during an active session/update.
+Use `-Repair` for an already recorded release; it cannot be combined with
+`-ReplaceFailedSetup`.
+
+## Evidence and remaining verification
+
+A real unsigned package was built from the hash-verified native `31b13aa`
+artifact. Its complete 95-file payload was recovered without executing any
+artifact binary; compressed-file checksums were verified. The final package
+adds the project license and agent. Windows Installer tables and generated
+manifests were inspected, and the CLI build recipe succeeded with pinned WiX.
+Three authoring tests cover full asset/license manifests, service lifecycle,
+stable component identities, unsafe names/versions and incomplete payloads.
+The supplier tool was extracted through MSI-table reads, not installed on the
+host. Packages, extraction records and hashes remain outside Git.
+
+No customer installer ran on this host. Signed clean-machine installation,
+service startup, SYSTEM enrollment, consent, UAC/logon-screen behavior, MSI
+repair/major upgrades, runtime-broker servicing, task cleanup, uninstall and
+interrupted-install rollback remain unverified. Native build CI now includes
+both MSI recipes; its exact results must be recorded separately. MSI service
+rules and a successful build do not establish these acceptance conditions.
+
+Customer MSI uninstall now invokes its installed configuration agent under
+SYSTEM before file removal to remove the separately registered configuration
+task. The task's executable path, `watch` arguments and SYSTEM principal must
+match this installation; an unrelated task is refused. Company identity and
+consent files remain protected for explicit reinstallation. Major upgrades skip
+task removal. A paired MSI rollback action restores the previous enabled/running
+state after an interrupted uninstall, using protected rollback state and a
+validly signed restored agent. A task absent before cleanup is not created by
+rollback. The agent compiles on Windows and both scripts parse; three authoring
+tests pass. Pinned WiX compiled a real unsigned package and its Installer tables
+confirm rollback, cleanup and file-removal order. Actual task deletion, MSI
+rollback and reinstall on clean guests remain unverified.
+
+Failed software updates can now restore the previous customer MSI when both
+previous signed release metadata and its agent support rollback protocol 1.
+Recovery uses the complete verified snapshot and original installer, restricts
+registration removal to the exact failed ProductCode and checks the customer
+service's exact executable path and LocalSystem account before removal. The
+restored service must run automatically. The verified previous agent restores
+only its owned SYSTEM configuration task, deferring startup until recovery
+finishes. Enrollment and consent files remain current. Unexpected registration,
+service or task ownership leaves recovery pending. A separate staged recovery
+task now implements startup and periodic retry across removal of the installed
+agent; see [update recovery](UPDATE-RECOVERY.md). A separate EXE path now
+implements customer service restoration while refusing MSI-managed or unrelated
+installations. These paths have component and read-only planning evidence only; native
+signed installation, removal, restore and restart remain acceptance gates.
+
+References: [WiX service installation](https://docs.firegiant.com/wix/schema/wxs/serviceinstall/)
+and [Windows-owned file copying](https://docs.firegiant.com/wix/schema/wxs/copyfile/).
diff --git a/deployment/windows/Cancel-CustomerExeRecovery.ps1 b/deployment/windows/Cancel-CustomerExeRecovery.ps1
new file mode 100644
index 00000000000..e7373f53f75
--- /dev/null
+++ b/deployment/windows/Cancel-CustomerExeRecovery.ps1
@@ -0,0 +1,19 @@
+$ErrorActionPreference='Stop'
+$env:PSModulePath=Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell\v1.0\Modules'
+$directory=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'
+if (-not (Test-Path -LiteralPath (Join-Path $directory 'managed-state.json'))) { return }
+$marker=Join-Path $directory 'pending-uninstall'
+if (-not (Test-Path -LiteralPath $marker)) {
+    $stream=[IO.File]::Open($marker,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+    try { $stream.Flush($true) } finally { $stream.Dispose() }
+}
+$expected=[IO.Path]::GetFullPath((Join-Path $directory 'swan-agent.exe'))
+$tasks=@(Get-ScheduledTask | Where-Object { $_.TaskName -eq 'Swan Company Configuration' })
+if ($tasks.Count -gt 1) { throw 'Ambiguous company configuration task.' }
+if ($tasks.Count -eq 1) {
+    $task=$tasks[0]
+    if ($task.Actions.Count -ne 1 -or [IO.Path]::GetFullPath($task.Actions[0].Execute) -ine $expected -or $task.Actions[0].Arguments -cne 'watch' -or $task.Principal.UserId -notin @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) { throw 'Configuration task belongs to another installation.' }
+    $task | Disable-ScheduledTask | Out-Null
+    $task | Stop-ScheduledTask
+    $task | Unregister-ScheduledTask -Confirm:$false
+}
diff --git a/deployment/windows/Capture-NativeAomInputs.ps1 b/deployment/windows/Capture-NativeAomInputs.ps1
new file mode 100644
index 00000000000..533ce2ebd84
--- /dev/null
+++ b/deployment/windows/Capture-NativeAomInputs.ps1
@@ -0,0 +1,60 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$OutputDirectory)
+$ErrorActionPreference='Stop'
+$output=[IO.Path]::GetFullPath($OutputDirectory)
+if(Test-Path -LiteralPath $output){throw 'Preserve original native input capture'}
+$root=[IO.Path]::GetFullPath($env:VCPKG_ROOT)
+$installed=Join-Path $root 'installed'
+if($env:VCPKG_INSTALLED_ROOT -and [IO.Path]::GetFullPath($env:VCPKG_INSTALLED_ROOT) -ine $installed){throw 'Unexpected alternate native-library root'}
+$library=Join-Path $installed 'x64-windows-static/lib/aom.lib'
+$copyright=Join-Path $installed 'x64-windows-static/share/aom/copyright'
+foreach($path in @($library,$copyright)){if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'Expected actual AV1 library or attribution missing'}}
+$tree=Join-Path $root 'buildtrees/aom'
+$sources=@(Get-ChildItem -LiteralPath (Join-Path $tree 'src') -Filter encodeframe_utils.c -File -Recurse)
+if($sources.Count -ne 1){throw 'Expected exactly one freshly built AV1 source unit'}
+$source=[IO.File]::ReadAllText($sources[0].FullName).Replace("`r`n","`n")
+$hasher=[Security.Cryptography.SHA256]::Create()
+try{$sourceHash=([BitConverter]::ToString($hasher.ComputeHash([Text.Encoding]::UTF8.GetBytes($source)))).Replace('-','').ToLowerInvariant()}finally{$hasher.Dispose()}
+if($sourceHash -cne 'e36cdda0a1090348a297082be1e3c328885790244db7683ba1e3f025914933d8'){throw 'Actual AV1 source differs from reviewed pinned upstream unit'}
+$release=Join-Path $tree 'x64-windows-static-rel'
+$objects=@(Get-ChildItem -LiteralPath $release -Filter '*encodeframe_utils*.obj' -File -Recurse)
+if($objects.Count -ne 1){throw 'Expected one actual release object before endpoint link'}
+$cache=Join-Path $release 'CMakeCache.txt'
+$cacheText=[IO.File]::ReadAllText($cache)
+$ninja=[regex]::Match($cacheText,'(?m)^CMAKE_MAKE_PROGRAM:FILEPATH=(.+)\r?$').Groups[1].Value.Trim()
+if(-not(Test-Path -LiteralPath $ninja -PathType Leaf) -or [IO.Path]::GetFileName($ninja) -ine 'ninja.exe'){throw 'Actual AV1 Ninja executable missing'}
+$target=$objects[0].FullName.Substring($release.Length+1).Replace('\','/')
+if(-not $target.StartsWith('CMakeFiles/') -or $target.Contains('..')){throw 'Unexpected AV1 object target'}
+New-Item -ItemType Directory -Path $output|Out-Null
+Copy-Item -LiteralPath $library -Destination (Join-Path $output 'aom.lib')
+Copy-Item -LiteralPath $copyright -Destination (Join-Path $output 'AOM-COPYRIGHT.txt')
+Copy-Item -LiteralPath $sources[0].FullName -Destination (Join-Path $output 'encodeframe_utils.c')
+Copy-Item -LiteralPath $objects[0].FullName -Destination (Join-Path $output 'encodeframe_utils.obj')
+Copy-Item -LiteralPath $cache -Destination (Join-Path $output 'CMakeCache.txt')
+foreach($relative in @('build.ninja','CMakeFiles/rules.ninja')){
+ $path=Join-Path $release $relative
+ if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'Actual AV1 compiler command file missing'}
+ Copy-Item -LiteralPath $path -Destination (Join-Path $output ([IO.Path]::GetFileName($relative)))
+}
+& $ninja -C $release -t commands $target 2>&1|Set-Content -LiteralPath (Join-Path $output 'original-compile-commands.log') -Encoding UTF8
+if($LASTEXITCODE){throw 'Unable to capture actual AV1 compiler command'}
+$dependencies=& $ninja -C $release -t deps $target
+if($LASTEXITCODE){throw 'Unable to capture actual compiler dependencies'}
+$dependencies|Set-Content -LiteralPath (Join-Path $output 'actual-compiler-dependencies.log') -Encoding UTF8
+$paths=@($dependencies|Where-Object {$_ -match '^    (.+)$'}|ForEach-Object {$_.Trim()}|Sort-Object -Unique)
+if($paths.Count -lt 10 -or $paths.Count -gt 3000){throw 'Unexpected actual AV1 include set'}
+$inputs=@()
+foreach($path in $paths){
+ $resolved=if([IO.Path]::IsPathRooted($path)){$path}else{Join-Path $release $path}
+ $item=Get-Item -LiteralPath $resolved
+ if($item.PSIsContainer){throw 'Unexpected compiler dependency directory'}
+ $inputs+=@{path=$item.FullName;bytes=$item.Length;sha256=(Get-FileHash -LiteralPath $item.FullName).Hash.ToLowerInvariant()}
+}
+$records=@{}
+foreach($name in @('aom.lib','encodeframe_utils.obj','encodeframe_utils.c','AOM-COPYRIGHT.txt','CMakeCache.txt','build.ninja','rules.ninja','original-compile-commands.log','actual-compiler-dependencies.log')){
+ $item=Get-Item -LiteralPath (Join-Path $output $name)
+ $records[$name]=@{bytes=$item.Length;sha256=(Get-FileHash -LiteralPath $item.FullName).Hash.ToLowerInvariant()}
+}
+if((Get-FileHash -LiteralPath $library).Hash -ine $records['aom.lib'].sha256){throw 'Installed AV1 library changed during capture'}
+@{scope='Actual AV1 source, release object and installed static library before endpoint compilation; not a reproducibility claim';source_commit='10aece4157eb79315da205f39e19bf6ab3ee30d0';canonical_source_sha256=$sourceHash;installed_library_path=$library;files=$records;actual_compiler_inputs=$inputs;shipping_bytes_rewritten=$false}|ConvertTo-Json -Depth 7|Set-Content -LiteralPath (Join-Path $output 'capture.json') -Encoding UTF8
+Write-Output 'Retained actual AV1 object, static library, compiler commands and include hashes before the endpoint build.'
diff --git a/deployment/windows/Commit-Uninstall.ps1 b/deployment/windows/Commit-Uninstall.ps1
new file mode 100644
index 00000000000..e3acfa96aa0
--- /dev/null
+++ b/deployment/windows/Commit-Uninstall.ps1
@@ -0,0 +1,29 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Directory,[Parameter(Mandatory=$true)][ValidateSet('customer','technician')][string]$Edition)
+$ErrorActionPreference='Stop'
+function Complete-Uninstall {
+    param([Parameter(Mandatory=$true)][string]$Directory)
+    $folder=Get-Item -LiteralPath $Directory
+    if (-not $folder.PSIsContainer -or ($folder.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Unsafe uninstall state directory.' }
+    if (Test-Path -LiteralPath (Join-Path $Directory 'swan-agent.exe')) { throw 'Uninstall commit requires the installed agent to be removed.' }
+    $marker=Get-Item -LiteralPath (Join-Path $Directory 'pending-uninstall')
+    if ($marker.PSIsContainer -or ($marker.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Invalid uninstall cancellation marker.' }
+    $records=@()
+    foreach ($name in @('uninstall-cancellation-rollback.json','configuration-task-rollback.json')) {
+        $path=Join-Path $Directory $name
+        if (-not (Test-Path -LiteralPath $path)) { continue }
+        $file=Get-Item -LiteralPath $path
+        if ($file.PSIsContainer -or ($file.Attributes -band [IO.FileAttributes]::ReparsePoint) -or $file.Length -gt 4096) { throw 'Invalid uninstall rollback record.' }
+        $record=Get-Content -LiteralPath $path -Raw|ConvertFrom-Json
+        if ($name -eq 'uninstall-cancellation-rollback.json') {
+            if ($record.marker_existed -isnot [bool]) { throw 'Invalid cancellation rollback state.' }
+        } elseif ($record.enabled -isnot [bool] -or $record.running -isnot [bool]) { throw 'Invalid task rollback state.' }
+        $records+=$path
+    }
+    # All validation precedes deletion. Keep the cancellation marker so staged
+    # update recovery cannot reinstall software the customer just uninstalled.
+    foreach ($path in $records) { Remove-Item -LiteralPath $path }
+}
+$expected=if($Edition -eq 'customer'){Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'}else{Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'SwanRemoteSupport-Technician'}
+if ([IO.Path]::GetFullPath($Directory).TrimEnd('\') -ine [IO.Path]::GetFullPath($expected).TrimEnd('\')) { throw 'Uninstall commit requires the canonical edition state directory.' }
+Complete-Uninstall -Directory $Directory
diff --git a/deployment/windows/Complete-CustomerExeUninstall.ps1 b/deployment/windows/Complete-CustomerExeUninstall.ps1
new file mode 100644
index 00000000000..405fe99007c
--- /dev/null
+++ b/deployment/windows/Complete-CustomerExeUninstall.ps1
@@ -0,0 +1,22 @@
+$ErrorActionPreference='Stop'
+$env:PSModulePath=Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell/v1.0/Modules'
+function Remove-CustomerExeAgent {
+    param([Parameter(Mandatory=$true)][string]$Directory)
+    $folder=Get-Item -LiteralPath $Directory
+    if (-not $folder.PSIsContainer -or ($folder.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Unsafe customer state directory.' }
+    $marker=Get-Item -LiteralPath (Join-Path $Directory 'pending-uninstall')
+    if ($marker.PSIsContainer -or ($marker.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Customer uninstall cancellation is missing or unsafe.' }
+    $agent=Join-Path $Directory 'swan-agent.exe'
+    if (-not (Test-Path -LiteralPath $agent)) { return }
+    $file=Get-Item -LiteralPath $agent
+    if ($file.PSIsContainer -or ($file.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Unsafe installed configuration agent.' }
+    Remove-Item -LiteralPath $agent
+}
+$directory=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'
+if (-not (Test-Path -LiteralPath (Join-Path $directory 'managed-state.json'))) { return }
+if (Test-Path -LiteralPath (Join-Path ([Environment]::GetFolderPath('ProgramFiles')) 'Swan Remote Support/Swan Remote Support.exe')) { throw 'Customer application removal is incomplete.' }
+if (Get-CimInstance Win32_Service -Filter "Name='Swan Remote Support'") { throw 'Customer service removal is incomplete.' }
+if (Get-ScheduledTask 'Swan Company Configuration' -ErrorAction SilentlyContinue) { throw 'Customer configuration task removal is incomplete.' }
+$expected=[IO.Path]::GetFullPath((Join-Path $directory 'swan-agent.exe'))
+if (Get-CimInstance Win32_Process -Filter "Name='swan-agent.exe'" | Where-Object { $_.ExecutablePath -and [IO.Path]::GetFullPath($_.ExecutablePath) -ieq $expected }) { throw 'Installed configuration agent is still running.' }
+Remove-CustomerExeAgent -Directory $directory
diff --git a/deployment/windows/Copy-ReproducibleMsiInput.ps1 b/deployment/windows/Copy-ReproducibleMsiInput.ps1
new file mode 100644
index 00000000000..9c22a2763bb
--- /dev/null
+++ b/deployment/windows/Copy-ReproducibleMsiInput.ps1
@@ -0,0 +1,44 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$InputPath,
+    [Parameter(Mandatory=$true)][string]$Destination,
+    [Parameter(Mandatory=$true)][ValidateRange(315532800,4102444799)][long]$SourceDateEpoch
+)
+$ErrorActionPreference='Stop'
+$source=Get-Item -LiteralPath $InputPath -Force
+$Destination=[IO.Path]::GetFullPath($Destination)
+if (Test-Path -LiteralPath $Destination) { throw 'Refusing to overwrite staged input.' }
+if ($source.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'Reparse points are not valid installer inputs.' }
+if ($Destination.StartsWith($source.FullName.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)) { throw 'Staging must be outside the source tree.' }
+# Cabinet timestamps are local DOS wall-clock values. Give every staged copy
+# the same wall-clock representation of the release epoch, independent of the
+# builder's time zone. Summary-information timestamps remain UTC.
+$timestamp=[DateTime]::SpecifyKind([DateTimeOffset]::FromUnixTimeSeconds($SourceDateEpoch).UtcDateTime,[DateTimeKind]::Unspecified)
+function Copy-InputFile([string]$From,[string]$To) {
+    $expected=(Get-FileHash -LiteralPath $From -Algorithm SHA256).Hash
+    [void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($To))
+    [IO.File]::Copy($From,$To,$false)
+    [IO.File]::SetAttributes($To,[IO.FileAttributes]::Normal)
+    [IO.File]::SetLastWriteTime($To,$timestamp)
+    if ((Get-FileHash -LiteralPath $To -Algorithm SHA256).Hash -ne $expected -or (Get-FileHash -LiteralPath $From -Algorithm SHA256).Hash -ne $expected) { throw 'Installer input changed during staging.' }
+}
+if (-not $source.PSIsContainer) {
+    Copy-InputFile $source.FullName $Destination
+} else {
+    # Walk explicitly so junctions cannot silently pull unrelated host files
+    # into a package. Inspect every entry, including hidden files/directories.
+    $pending=New-Object 'System.Collections.Generic.Stack[string]'
+    $pending.Push($source.FullName)
+    [void][IO.Directory]::CreateDirectory($Destination)
+    while ($pending.Count -gt 0) {
+        $directory=$pending.Pop()
+        foreach($item in Get-ChildItem -LiteralPath $directory -Force) {
+            if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'Reparse points are not valid installer inputs.' }
+            $relative=$item.FullName.Substring($source.FullName.TrimEnd('\').Length+1)
+            $target=Join-Path $Destination $relative
+            if ($item.PSIsContainer) { [void][IO.Directory]::CreateDirectory($target); $pending.Push($item.FullName) }
+            else { Copy-InputFile $item.FullName $target }
+        }
+    }
+}
+$Destination
diff --git a/deployment/windows/Diagnose-AomObject.ps1 b/deployment/windows/Diagnose-AomObject.ps1
new file mode 100644
index 00000000000..d165c6a7a2c
--- /dev/null
+++ b/deployment/windows/Diagnose-AomObject.ps1
@@ -0,0 +1,129 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$WorkDirectory,[ValidateRange(0,64)][int]$RepeatCompiles=0)
+$ErrorActionPreference='Stop'
+$root=[IO.Path]::GetFullPath($WorkDirectory)
+if(Test-Path -LiteralPath $root){throw 'Preserve existing diagnostic build state'}
+if($env:USE_AOM_391){throw 'Unexpected alternative AV1 source selection'}
+$baseline='120deac3062162151622ca4860575a33844ba10b'
+$revision='10aece4157eb79315da205f39e19bf6ab3ee30d0'
+$sourceHash='e36cdda0a1090348a297082be1e3c328885790244db7683ba1e3f025914933d8'
+$vcpkg=Join-Path $env:VCPKG_ROOT 'vcpkg.exe'
+if(-not(Test-Path -LiteralPath $vcpkg -PathType Leaf)){throw 'Pinned vcpkg unavailable'}
+$actual=(& git -C $env:VCPKG_ROOT rev-parse HEAD|Out-String).Trim()
+if($LASTEXITCODE -or $actual -cne $baseline){throw 'vcpkg source differs from application pin'}
+$overlay=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '../../res/vcpkg'))
+New-Item -ItemType Directory -Path (Join-Path $root 'evidence') -Force|Out-Null
+@{image_version=$env:ImageVersion;processors=@(Get-CimInstance Win32_Processor|Select-Object Name,Manufacturer,Architecture,NumberOfCores,NumberOfLogicalProcessors);os=Get-CimInstance Win32_OperatingSystem|Select-Object Version,BuildNumber}|ConvertTo-Json -Depth 4|Set-Content -LiteralPath (Join-Path $root 'evidence/runner-compiler-context.json') -Encoding UTF8
+& (Join-Path $PSScriptRoot 'Record-MsvcToolchain.ps1') -Output (Join-Path $root 'evidence/native-msvc-toolchain.json')
+$env:VCPKG_BINARY_SOURCES='clear'
+$env:VCPKG_DEFAULT_HOST_TRIPLET='x64-windows-static'
+$runs=@()
+foreach($label in @('first','second')){
+ $directory=Join-Path $root $label
+ $manifest=Join-Path $directory 'manifest'
+ $install=Join-Path $directory 'installed'
+ $trees=Join-Path $directory 'buildtrees'
+ $packages=Join-Path $directory 'packages'
+ $evidence=Join-Path $root ('evidence/'+$label)
+ New-Item -ItemType Directory -Path $manifest,$evidence -Force|Out-Null
+ @{name='swan-aom-object-diagnostic';'version-string'='1';dependencies=@('aom');'vcpkg-configuration'=@{
+   'default-registry'=@{kind='builtin';baseline=$baseline};'overlay-ports'=@($overlay)
+ }}|ConvertTo-Json -Depth 6|Set-Content -LiteralPath (Join-Path $manifest 'vcpkg.json') -Encoding UTF8
+ & $vcpkg install --triplet x64-windows-static "--x-manifest-root=$manifest" "--x-install-root=$install" "--x-buildtrees-root=$trees" "--x-packages-root=$packages" 2>&1|Tee-Object -FilePath (Join-Path $evidence 'vcpkg-build.log')
+ if($LASTEXITCODE){throw ('Pinned AV1 diagnostic source build failed: '+$label)}
+ $sources=@(Get-ChildItem -LiteralPath (Join-Path $trees 'aom/src') -Filter encodeframe_utils.c -Recurse -File)
+ if($sources.Count -ne 1){throw 'Expected one pinned AV1 source unit'}
+ $canonical=[IO.File]::ReadAllText($sources[0].FullName).Replace("`r`n","`n")
+ $hasher=[Security.Cryptography.SHA256]::Create()
+ try{$hash=([BitConverter]::ToString($hasher.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical)))).Replace('-','').ToLowerInvariant()}finally{$hasher.Dispose()}
+ if($hash -cne $sourceHash){throw 'Actual AV1 source unit differs from reviewed upstream commit'}
+ Copy-Item -LiteralPath $sources[0].FullName -Destination (Join-Path $evidence 'encodeframe_utils.c')
+ $objects=@(Get-ChildItem -LiteralPath (Join-Path $trees 'aom') -Filter '*encodeframe_utils*.obj' -Recurse -File)
+ if($objects.Count -lt 1 -or $objects.Count -gt 4){throw 'Expected bounded AV1 object set'}
+ $records=@()
+ foreach($file in $objects){
+  $relative=$file.FullName.Substring($trees.Length+1)
+  $target=Join-Path $evidence $relative
+  New-Item -ItemType Directory -Path (Split-Path -Parent $target) -Force|Out-Null
+  Copy-Item -LiteralPath $file.FullName -Destination $target
+  $records+=@{path=$relative.Replace('\','/');bytes=$file.Length;sha256=(Get-FileHash -LiteralPath $file.FullName).Hash.ToLowerInvariant()}
+ }
+ foreach($file in Get-ChildItem -LiteralPath (Join-Path $trees 'aom') -Recurse -File|Where-Object {$_.Name -in @('CMakeCache.txt','build.ninja','rules.ninja') -or $_.Name -like 'aom_av1_encoder*.vcxproj' -or $_.Name -like 'av1_encoder*.vcxproj'}){
+  $target=Join-Path $evidence ($file.FullName.Substring($trees.Length+1))
+  New-Item -ItemType Directory -Path (Split-Path -Parent $target) -Force|Out-Null
+  Copy-Item -LiteralPath $file.FullName -Destination $target
+ }
+ if($label -ceq 'first' -and $RepeatCompiles -gt 0){
+  $releaseObjects=@($objects|Where-Object {$_.FullName -match '[\\/]x64-windows-static-rel[\\/]'})
+  $releaseCaches=@(Get-ChildItem -LiteralPath (Join-Path $trees 'aom') -Filter CMakeCache.txt -Recurse -File|Where-Object {$_.Directory.Name -ceq 'x64-windows-static-rel'})
+  if($releaseObjects.Count -ne 1 -or $releaseCaches.Count -ne 1){throw 'One actual release translation unit and cache required'}
+  $release=$releaseCaches[0].Directory.FullName
+  $cache=[IO.File]::ReadAllText($releaseCaches[0].FullName)
+  $make=[regex]::Match($cache,'(?m)^CMAKE_MAKE_PROGRAM:FILEPATH=(.+)\r?$').Groups[1].Value.Trim()
+  if(-not $make -or -not(Test-Path -LiteralPath $make -PathType Leaf) -or [IO.Path]::GetFileName($make) -ine 'ninja.exe'){throw 'Actual pinned Ninja executable unavailable'}
+  $target=$releaseObjects[0].FullName.Substring($release.Length+1).Replace('\','/')
+  if(-not $target.StartsWith('CMakeFiles/') -or $target.Contains('..')){throw 'Unexpected translation-unit target'}
+  $repeatDirectory=Join-Path $evidence 'translation-unit-repeats'
+  New-Item -ItemType Directory -Path $repeatDirectory|Out-Null
+  & $make -C $release -t commands $target 2>&1|Set-Content -LiteralPath (Join-Path $repeatDirectory 'original-ninja-commands.log') -Encoding UTF8
+  if($LASTEXITCODE){throw 'Cannot capture actual translation-unit commands'}
+  $sourceFile=$sources[0]
+  $originalTime=$sourceFile.LastWriteTimeUtc
+  $compiler=[regex]::Match($cache,'(?m)^CMAKE_C_COMPILER:FILEPATH=(.+)\r?$').Groups[1].Value.Trim().Replace('\','/')
+  $selected=[regex]::Match($compiler,'^(.*)/VC/Tools/MSVC/(14\.[0-9]+\.[0-9]+)/bin/Hostx64/x64/cl\.exe$')
+  if(-not $selected.Success){throw 'Actual cached C compiler is not the selected x64 MSVC toolset'}
+  $vcvars=Join-Path $selected.Groups[1].Value 'VC/Auxiliary/Build/vcvarsall.bat'
+  if(-not(Test-Path -LiteralPath $vcvars -PathType Leaf) -or $vcvars -match '["&|<>^\r\n]'){throw 'Unexpected compiler environment helper path'}
+  $environmentLines=& $env:ComSpec /d /c ('call "'+$vcvars+'" x64 -vcvars_ver='+$selected.Groups[2].Value+' >nul && set INCLUDE && set LIB && set PATH')
+  if($LASTEXITCODE){throw 'Unable to obtain the selected native compiler environment'}
+  $originalEnvironment=@{}
+  $compilerEnvironment=@{}
+  foreach($line in $environmentLines){
+   if($line -match '^(INCLUDE|LIB|LIBPATH|PATH)=(.*)$'){
+    $key=$matches[1].ToUpperInvariant()
+    $originalEnvironment[$key]=[Environment]::GetEnvironmentVariable($key,'Process')
+    $compilerEnvironment[$key]=$matches[2]
+   }
+  }
+  if(-not $compilerEnvironment.ContainsKey('INCLUDE') -or -not $compilerEnvironment.ContainsKey('PATH')){throw 'Selected compiler includes or executable search path missing'}
+  $repeats=@()
+  try{
+   foreach($key in $compilerEnvironment.Keys){[Environment]::SetEnvironmentVariable($key,$compilerEnvironment[$key],'Process')}
+   $compilerEnvironment|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $repeatDirectory 'selected-compiler-environment.json') -Encoding UTF8
+   for($index=1;$index -le $RepeatCompiles;$index++){
+    $before=(Get-FileHash -LiteralPath $sourceFile.FullName).Hash
+    # Force this one real Ninja target to recompile without changing its source.
+    $sourceFile.LastWriteTimeUtc=[DateTime]::UtcNow.AddSeconds($index+1)
+    $name='compile-'+$index.ToString('D2')
+    & $make -C $release -v $target 2>&1|Tee-Object -FilePath (Join-Path $repeatDirectory ($name+'.log'))
+    if($LASTEXITCODE){throw 'Exact translation-unit recompilation failed'}
+    $log=Get-Content -LiteralPath (Join-Path $repeatDirectory ($name+'.log')) -Raw
+    if($log -notmatch 'encodeframe_utils' -or $log -match 'no work to do'){throw 'Expected actual compiler execution did not occur'}
+    if((Get-FileHash -LiteralPath $sourceFile.FullName).Hash -cne $before){throw 'Original source bytes changed during repeat'}
+    $object=Join-Path $repeatDirectory ($name+'-encodeframe_utils.obj')
+    Copy-Item -LiteralPath $releaseObjects[0].FullName -Destination $object
+    $repeats+=@{index=$index;object=[IO.Path]::GetFileName($object);sha256=(Get-FileHash -LiteralPath $object).Hash.ToLowerInvariant();original_source_bytes_unchanged=$true;actual_compiler_invocation_observed=$true}
+   }
+   $dependencyLines=& $make -C $release -t deps $target
+   if($LASTEXITCODE){throw 'Cannot inspect actual MSVC dependency records'}
+   $dependencyLines|Set-Content -LiteralPath (Join-Path $repeatDirectory 'actual-ninja-dependencies.log') -Encoding UTF8
+   $headers=@($dependencyLines|Where-Object {$_ -match '^    (.+)$'}|ForEach-Object {$_.Trim()}|Sort-Object -Unique)
+   if($headers.Count -lt 10 -or $headers.Count -gt 3000){throw 'Unexpected actual translation-unit dependency set'}
+   $inputRecords=@()
+   foreach($path in $headers){
+    $resolved=if([IO.Path]::IsPathRooted($path)){$path}else{Join-Path $release $path}
+    $item=Get-Item -LiteralPath $resolved
+    if($item.PSIsContainer){throw 'Unexpected directory in compiler dependency set'}
+    $inputRecords+=@{path=$item.FullName;bytes=$item.Length;sha256=(Get-FileHash -LiteralPath $item.FullName).Hash.ToLowerInvariant()}
+   }
+   @{scope='Actual files recorded by Ninja from MSVC showIncludes; source/header contents are not published';files=$inputRecords}|ConvertTo-Json -Depth 5|Set-Content -LiteralPath (Join-Path $repeatDirectory 'actual-compiler-inputs.json') -Encoding UTF8
+  }finally{
+   $sourceFile.LastWriteTimeUtc=$originalTime
+   foreach($key in $originalEnvironment.Keys){[Environment]::SetEnvironmentVariable($key,$originalEnvironment[$key],'Process')}
+  }
+  @{scope='Repeated compilation of the same actual pinned AV1 translation unit with original Ninja flags; no function or compiler fix applied';count=$repeats.Count;source_commit=$revision;source_sha256=$sourceHash;records=$repeats;shipping_bytes_rewritten=$false}|ConvertTo-Json -Depth 6|Set-Content -LiteralPath (Join-Path $repeatDirectory 'repeat-report.json') -Encoding UTF8
+ }
+ $runs+=@{label=$label;source_commit=$revision;canonical_source_sha256=$hash;objects=$records;compiled_cache_disabled=$true}
+}
+@{scope='Two real pinned AV1 dependency builds only; not a full app reproduction or runtime qualification';vcpkg_commit=$baseline;source_commit=$revision;runs=$runs;shipping_bytes_rewritten=$false;production_publication=$false}|ConvertTo-Json -Depth 7|Set-Content -LiteralPath (Join-Path $root 'evidence/report.json') -Encoding UTF8
+Write-Output 'Two isolated AV1 source builds completed; original object bytes retained for symbol and code comparison.'
diff --git a/deployment/windows/Expand-ServerCompiler.ps1 b/deployment/windows/Expand-ServerCompiler.ps1
new file mode 100644
index 00000000000..99d6cce4925
--- /dev/null
+++ b/deployment/windows/Expand-ServerCompiler.ps1
@@ -0,0 +1,34 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Package,[Parameter(Mandatory)][string]$OutputDirectory)
+$ErrorActionPreference='Stop'
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+$pin=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'server-compiler.json') -Raw|ConvertFrom-Json
+$Package=(Resolve-Path -LiteralPath $Package).Path
+if($pin.schema -ne 1 -or $pin.id -cne 'Microsoft.Net.Compilers.Toolset.Framework' -or $pin.version -cne '4.12.0' -or
+   (Get-FileHash -LiteralPath $Package -Algorithm SHA256).Hash -ine $pin.sha256){throw 'Pinned server compiler package mismatch.'}
+$OutputDirectory=[IO.Path]::GetFullPath($OutputDirectory)
+if(Test-Path -LiteralPath $OutputDirectory){throw 'Compiler output already exists; preserve it.'}
+$archive=[IO.Compression.ZipFile]::OpenRead($Package)
+try {
+ $seen=@{};$total=0L
+ foreach($entry in $archive.Entries){
+  $name=$entry.FullName
+  if($name -notmatch '^[A-Za-z0-9_\-./+\[\]]+$' -or $name.StartsWith('/') -or @($name.Split('/')|Where-Object{$_ -in @('.','..') -or $_.EndsWith('.')}).Count -or $seen.ContainsKey($name) -or (($entry.ExternalAttributes -shr 16) -band 61440) -eq 40960){throw 'Unsafe compiler archive entry.'}
+  $seen[$name]=$true;$total+=$entry.Length
+  if($seen.Count -gt 4096 -or $entry.Length -gt 50MB -or $total -gt 150MB){throw 'Compiler archive exceeds limits.'}
+ }
+ if(-not $seen.ContainsKey($pin.compiler)){throw 'Compiler missing from pinned archive.'}
+ [void][IO.Directory]::CreateDirectory($OutputDirectory)
+ foreach($entry in $archive.Entries){
+  if($entry.FullName.EndsWith('/')){continue}
+  $target=[IO.Path]::GetFullPath((Join-Path $OutputDirectory $entry.FullName))
+  if(-not $target.StartsWith($OutputDirectory.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)){throw 'Compiler entry escaped output.'}
+  [void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($target))
+  [IO.Compression.ZipFileExtensions]::ExtractToFile($entry,$target,$false)
+ }
+} finally {$archive.Dispose()}
+$compiler=Join-Path $OutputDirectory $pin.compiler
+if((Get-FileHash -LiteralPath $compiler).Hash -ine $pin.compiler_sha256){throw 'Compiler executable pin mismatch.'}
+$signature=Get-AuthenticodeSignature -LiteralPath $compiler
+if($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'O=Microsoft Corporation(?:,|$)'){throw 'Microsoft compiler signature invalid.'}
+$compiler
diff --git a/deployment/windows/Expand-ServerReferences.ps1 b/deployment/windows/Expand-ServerReferences.ps1
new file mode 100644
index 00000000000..aed5a6d06f9
--- /dev/null
+++ b/deployment/windows/Expand-ServerReferences.ps1
@@ -0,0 +1,35 @@
+[CmdletBinding()]
+param(
+ [Parameter(Mandatory)][string]$FrameworkPackage,
+ [Parameter(Mandatory)][string]$PowerShellPackage,
+ [Parameter(Mandatory)][string]$OutputDirectory
+)
+$ErrorActionPreference='Stop'
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+$pins=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'server-references.json') -Raw|ConvertFrom-Json
+if($pins.schema -ne 1){throw 'Unsupported server reference pins.'}
+$packages=@(@{path=(Resolve-Path -LiteralPath $FrameworkPackage).Path;pin=$pins.framework},@{path=(Resolve-Path -LiteralPath $PowerShellPackage).Path;pin=$pins.powershell})
+# Check both archives before extracting anything; package install scripts never run.
+foreach($package in $packages){if((Get-FileHash -LiteralPath $package.path).Hash -ine $package.pin.sha256){throw 'Pinned server reference package mismatch.'}}
+$OutputDirectory=[IO.Path]::GetFullPath($OutputDirectory)
+if(Test-Path -LiteralPath $OutputDirectory){throw 'Reference output already exists; preserve it.'}
+[void][IO.Directory]::CreateDirectory($OutputDirectory)
+$references=[ordered]@{}
+foreach($package in $packages){
+ $archive=[IO.Compression.ZipFile]::OpenRead($package.path)
+ try {
+  foreach($file in $package.pin.reference_files.PSObject.Properties){
+   $name=[IO.Path]::GetFileName($file.Name)
+   if($name -notin @('mscorlib.dll','System.dll','System.Core.dll','System.Security.dll','System.Management.Automation.dll') -or $references.Contains($name)){throw 'Unexpected or duplicate reference assembly.'}
+   $entries=@($archive.Entries|Where-Object{$_.FullName -ceq $file.Name})
+   if($entries.Count -ne 1 -or $entries[0].Length -lt 2 -or $entries[0].Length -gt 16MB){throw 'Reference assembly missing or oversized.'}
+   # Only fixed basenames are written, never paths supplied by the archive.
+   $target=Join-Path $OutputDirectory $name
+   [IO.Compression.ZipFileExtensions]::ExtractToFile($entries[0],$target,$false)
+   if((Get-FileHash -LiteralPath $target).Hash -ine $file.Value){throw 'Reference assembly hash mismatch.'}
+   $references[$name]=$target
+  }
+ } finally {$archive.Dispose()}
+}
+if($references.Count -ne 5){throw 'Incomplete server reference set.'}
+$references
diff --git a/deployment/windows/Expand-WixBuildTools.ps1 b/deployment/windows/Expand-WixBuildTools.ps1
new file mode 100644
index 00000000000..a10fc56b655
--- /dev/null
+++ b/deployment/windows/Expand-WixBuildTools.ps1
@@ -0,0 +1,49 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Package,[Parameter(Mandatory=$true)][string]$OutputDirectory,[string]$SevenZip='7z.exe')
+$ErrorActionPreference = 'Stop'
+$Package = (Resolve-Path -LiteralPath $Package).Path
+$OutputDirectory = [IO.Path]::GetFullPath($OutputDirectory)
+if (Test-Path -LiteralPath $OutputDirectory) { throw 'Tool output directory already exists.' }
+if ((Get-FileHash -LiteralPath $Package -Algorithm SHA256).Hash -ne '097383B2773BDD3D76A6A2CD3F4DE6357BAE59172E1B6FA5AD87CE062074E8D0') { throw 'Pinned WiX 5.0.2 package hash mismatch.' }
+$raw = $OutputDirectory + '.raw'
+if (Test-Path -LiteralPath $raw) { throw 'Raw extraction directory already exists.' }
+& $SevenZip x $Package ('-o'+$raw) -y | Out-Null
+if ($LASTEXITCODE -ne 0) { throw 'WiX extraction failed.' }
+# Read MSI tables; never execute the supplier installer or its custom actions.
+$installer = New-Object -ComObject WindowsInstaller.Installer
+$database = $installer.OpenDatabase($Package,0)
+$directories = @{}
+$components = @{}
+$view = $database.OpenView('SELECT `Directory`,`Directory_Parent`,`DefaultDir` FROM `Directory`')
+$null = $view.Execute()
+while ($row = $view.Fetch()) { $directories[$row.StringData(1)] = @($row.StringData(2),$row.StringData(3)) }
+$null = $view.Close()
+$view = $database.OpenView('SELECT `Component`,`Directory_` FROM `Component`')
+$null = $view.Execute()
+while ($row = $view.Fetch()) { $components[$row.StringData(1)] = $row.StringData(2) }
+$null = $view.Close()
+$view = $database.OpenView('SELECT `File`,`Component_`,`FileName` FROM `File`')
+$null = $view.Execute()
+while ($row = $view.Fetch()) {
+    $parts = [Collections.Generic.List[string]]::new()
+    $directory = $components[$row.StringData(2)]
+    $depth = 0
+    while ($directory -ne 'INSTALLFOLDER' -and $directory -and $directories.ContainsKey($directory)) {
+        if (++$depth -gt 16) { throw 'Unexpected supplier directory depth.' }
+        $name = ($directories[$directory][1] -split '\|')[-1]
+        if ($name -ne '.') { $parts.Insert(0,$name) }
+        $directory = $directories[$directory][0]
+    }
+    # Extension packages installed to separate user storage are not needed here.
+    if ($directory -ne 'INSTALLFOLDER') { continue }
+    $parts.Add(($row.StringData(3) -split '\|')[-1])
+    $destination = [IO.Path]::GetFullPath((Join-Path $OutputDirectory ($parts -join '\')))
+    if (-not $destination.StartsWith($OutputDirectory+'\',[StringComparison]::OrdinalIgnoreCase)) { throw 'Supplier path escaped the tool directory.' }
+    New-Item -ItemType Directory -Force ([IO.Path]::GetDirectoryName($destination)) | Out-Null
+    Copy-Item -LiteralPath (Join-Path $raw $row.StringData(1)) -Destination $destination
+}
+$null = $view.Close()
+$tool = Join-Path $OutputDirectory 'bin/wix.exe'
+$signature = Get-AuthenticodeSignature -LiteralPath $tool
+if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'CN=WiX Toolset \(\.NET Foundation\)') { throw 'Extracted WiX publisher verification failed.' }
+Write-Output $tool
diff --git a/deployment/windows/Get-MsiIdentity.ps1 b/deployment/windows/Get-MsiIdentity.ps1
new file mode 100644
index 00000000000..f657bc7fb36
--- /dev/null
+++ b/deployment/windows/Get-MsiIdentity.ps1
@@ -0,0 +1,23 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Package)
+$ErrorActionPreference = 'Stop'
+# Database mode 0 is read-only. No installation or custom action is invoked.
+$installer = New-Object -ComObject WindowsInstaller.Installer
+$database = $installer.OpenDatabase((Resolve-Path -LiteralPath $Package).Path, 0)
+function Read-Property([string]$Name) {
+    if ($Name -notin @('ProductCode','UpgradeCode','ProductVersion')) { throw 'Unsupported MSI property.' }
+    $view = $database.OpenView('SELECT `Value` FROM `Property` WHERE `Property` = ''' + $Name + '''')
+    try {
+        $null = $view.Execute()
+        $row = $view.Fetch()
+        if ($null -eq $row) { throw "MSI lacks $Name." }
+        return $row.StringData(1)
+    } finally { $null = $view.Close() }
+}
+$summary = $database.SummaryInformation(0)
+@{
+    product_code = Read-Property 'ProductCode'
+    upgrade_code = Read-Property 'UpgradeCode'
+    product_version = Read-Property 'ProductVersion'
+    template = $summary.Property(7)
+} | ConvertTo-Json -Compress
diff --git a/deployment/windows/Get-MsiInstallMode.ps1 b/deployment/windows/Get-MsiInstallMode.ps1
new file mode 100644
index 00000000000..ee00c1be116
--- /dev/null
+++ b/deployment/windows/Get-MsiInstallMode.ps1
@@ -0,0 +1,43 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Package)
+$ErrorActionPreference = 'Stop'
+# Read only: no installer actions or custom actions are executed.
+$installer = New-Object -ComObject WindowsInstaller.Installer
+$database = $installer.OpenDatabase((Resolve-Path -LiteralPath $Package).Path, 0)
+function Read-Property([string]$Name,[switch]$Optional) {
+    $view = $database.OpenView("SELECT ``Value`` FROM ``Property`` WHERE ``Property`` = '$Name'")
+    try {
+        $null = $view.Execute()
+        $row = $view.Fetch()
+        if ($null -eq $row) {
+            if ($Optional) { return '' }
+            throw "MSI property is missing: $Name."
+        }
+        return $row.StringData(1)
+    } finally { $null = $view.Close() }
+}
+function ConvertTo-MsiVersion([string]$Value) {
+    # Windows Installer ignores a legacy package's fourth version field.
+    if ($Value -notmatch '^(\d+)\.(\d+)\.(\d+)(?:\.\d+)?$') { throw 'MSI version cannot be compared safely.' }
+    $parts = @([int]$Matches[1],[int]$Matches[2],[int]$Matches[3])
+    if ($parts[0] -gt 255 -or $parts[1] -gt 255 -or $parts[2] -gt 65535) { throw 'MSI version exceeds supported fields.' }
+    return [version]::new($parts[0],$parts[1],$parts[2])
+}
+$code = Read-Property 'ProductCode'
+if ($code -notmatch '^\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}$') { throw 'Invalid MSI product identity.' }
+$upgrade = Read-Property 'UpgradeCode'
+if ($upgrade -notmatch '^\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}$') { throw 'Invalid MSI upgrade identity.' }
+$version = ConvertTo-MsiVersion (Read-Property 'ProductVersion')
+foreach ($related in $installer.RelatedProducts($upgrade)) {
+    $registered = ConvertTo-MsiVersion ($installer.ProductInfo($related,'VersionString'))
+    if ($registered -gt $version -or ($registered -eq $version -and $related -ine $code)) { throw "This package cannot replace registered product version $registered. Use a newer signed release; setup was not started." }
+}
+$state = $installer.ProductState($code)
+if ($state -eq 5) { Write-Output '/fvamus' }
+elseif ($state -in @(-1, 1)) { Write-Output '/i' }
+elseif ($state -eq 2 -and [string]::IsNullOrEmpty((Read-Property 'ALLUSERS' -Optional))) {
+    # INSTALLSTATE_ABSENT means another user has this product. An ordinary
+    # per-user MSI can install independently for the current Windows account.
+    Write-Output '/i'
+}
+else { throw "MSI product registration cannot be safely recovered (state $state)." }
diff --git a/deployment/windows/Get-MsiProductCode.ps1 b/deployment/windows/Get-MsiProductCode.ps1
new file mode 100644
index 00000000000..b9dc956e2c4
--- /dev/null
+++ b/deployment/windows/Get-MsiProductCode.ps1
@@ -0,0 +1,28 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][ValidateSet('customer','technician')][string]$Edition,
+    [Parameter(Mandatory=$true)][ValidatePattern('^\d+\.\d+\.\d+$')][string]$Version
+)
+$ErrorActionPreference='Stop'
+# Reject aliases such as 01.5.0: Windows compares their numeric fields, while
+# UUIDv5 would otherwise assign a different product identity to the same version.
+if ($Version -cnotmatch '\A(0|[1-9][0-9]{0,2})\.(0|[1-9][0-9]{0,2})\.(0|[1-9][0-9]{0,4})\z') {
+    throw 'Canonical major.minor.build version required (maximum 255.255.65535).'
+}
+$parts=$Version.Split('.')
+if ([int]$parts[0] -gt 255 -or [int]$parts[1] -gt 255 -or [int]$parts[2] -gt 65535) {
+    throw 'MSI version exceeds 255.255.65535.'
+}
+# RFC 4122 UUIDv5: the stable edition UpgradeCode is the namespace. The product
+# changes with its Windows x64 software version, never with company branding.
+$namespace=if($Edition -eq 'customer'){'32a585d7-9a78-4ad2-af72-d0266efc709d'}else{'a4374699-436f-4917-9a4e-223f62a9e634'}
+$bytes=([Guid]$namespace).ToByteArray()
+foreach($segment in @(@(0,4),@(4,2),@(6,2))){[Array]::Reverse($bytes,$segment[0],$segment[1])}
+$name=[Text.Encoding]::UTF8.GetBytes('windows-x64|'+$Version)
+$sha=[Security.Cryptography.SHA1]::Create()
+try{$digest=$sha.ComputeHash([byte[]]($bytes+$name))}finally{$sha.Dispose()}
+[byte[]]$result=$digest[0..15]
+$result[6]=($result[6] -band 15) -bor 80
+$result[8]=($result[8] -band 63) -bor 128
+foreach($segment in @(@(0,4),@(4,2),@(6,2))){[Array]::Reverse($result,$segment[0],$segment[1])}
+([Guid]::new($result)).ToString('D').ToUpperInvariant()
diff --git a/deployment/windows/Get-PinnedArchive.ps1 b/deployment/windows/Get-PinnedArchive.ps1
new file mode 100644
index 00000000000..fbb789e9c85
--- /dev/null
+++ b/deployment/windows/Get-PinnedArchive.ps1
@@ -0,0 +1,43 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][uri]$Uri,
+    [Parameter(Mandatory)][ValidatePattern('^[a-fA-F0-9]{64}$')][string]$Sha256,
+    [Parameter(Mandatory)][string]$Output
+)
+$ErrorActionPreference = 'Stop'
+if (-not $Uri.IsAbsoluteUri -or $Uri.Scheme -cne 'https' -or $Uri.UserInfo) { throw 'Pinned archive downloads require HTTPS without embedded credentials.' }
+$Output = [IO.Path]::GetFullPath($Output)
+if (Test-Path -LiteralPath $Output) {
+    $existing = Get-Item -LiteralPath $Output
+    if ($existing.PSIsContainer -or ($existing.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Existing archive path is unsafe.' }
+    if ((Get-FileHash -LiteralPath $Output -Algorithm SHA256).Hash -ine $Sha256) { throw 'Existing archive differs from the reviewed pin; preserve and inspect it.' }
+    Write-Output $Output
+    return
+}
+$parent = Get-Item -LiteralPath ([IO.Path]::GetDirectoryName($Output))
+if (-not $parent.PSIsContainer -or ($parent.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Archive parent directory is unsafe.' }
+$previousProtocol = [Net.ServicePointManager]::SecurityProtocol
+try {
+    [Net.ServicePointManager]::SecurityProtocol = $previousProtocol -bor [Net.SecurityProtocolType]::Tls12
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        $temporary = Join-Path $parent.FullName ([IO.Path]::GetFileName($Output)+'.'+[Guid]::NewGuid().ToString('N')+'.unverified')
+        try {
+            Invoke-WebRequest -Uri $Uri -OutFile $temporary -UseBasicParsing -TimeoutSec 180
+        } catch {
+            if (Test-Path -LiteralPath $temporary) { Remove-Item -LiteralPath $temporary -Force }
+            if ($attempt -eq 3) { throw 'Pinned archive transfer failed after three attempts; no output was published.' }
+            Write-Warning ('Pinned archive transfer interrupted; retrying attempt '+($attempt+1)+' of 3.')
+            Start-Sleep -Seconds (2 * $attempt)
+            continue
+        }
+        if ((Get-Item -LiteralPath $temporary).Length -gt 512MB -or (Get-FileHash -LiteralPath $temporary -Algorithm SHA256).Hash -ine $Sha256) {
+            throw ('Downloaded archive differs from the reviewed pin; unverified bytes retained at '+$temporary)
+        }
+        # Publish only a complete, hash-verified file. Never replace existing evidence.
+        [IO.File]::Move($temporary,$Output)
+        Write-Output $Output
+        return
+    }
+} finally {
+    [Net.ServicePointManager]::SecurityProtocol = $previousProtocol
+}
diff --git a/deployment/windows/Get-ServerRemovalPlan.ps1 b/deployment/windows/Get-ServerRemovalPlan.ps1
new file mode 100644
index 00000000000..3eb9a16efa9
--- /dev/null
+++ b/deployment/windows/Get-ServerRemovalPlan.ps1
@@ -0,0 +1,35 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$InstallDirectory,[Parameter(Mandatory)][string]$DataDirectory,
+      [Parameter(Mandatory)][string]$ServiceBinary)
+$ErrorActionPreference = 'Stop'
+$install = [IO.Path]::GetFullPath($InstallDirectory)
+$data = [IO.Path]::GetFullPath($DataDirectory)
+if ([IO.Path]::GetFileName($install) -ne 'Swan Company Server' -or [IO.Path]::GetFileName($data) -ne 'SwanCompanyServer') { throw 'Unexpected company installation directory.' }
+$expected = '"'+(Join-Path $install 'swan-management.exe')+'" --service'
+if (-not [string]::Equals($ServiceBinary.Trim(),$expected,[StringComparison]::OrdinalIgnoreCase)) { throw 'Company service executable does not match this installation.' }
+foreach ($directory in @($install,$data,(Join-Path $install 'components'))) {
+    if (Test-Path -LiteralPath $directory) {
+        if ((Get-Item -LiteralPath $directory -Force).Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'Company installation directory is a reparse point.' }
+    }
+}
+$receiptPath = Join-Path $data 'installation.json'
+if ((Get-Item -LiteralPath $receiptPath -Force).Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'Company receipt is a reparse point.' }
+$receipt = Get-Content -LiteralPath $receiptPath -Raw | ConvertFrom-Json
+if ($receipt.schema -ne 1 -or $receipt.service_name -ne 'SwanCompanyServer' -or $receipt.full_stack -isnot [bool] -or
+    -not [string]::Equals($receipt.install_directory,$install,[StringComparison]::OrdinalIgnoreCase) -or
+    -not [string]::Equals($receipt.data_directory,$data,[StringComparison]::OrdinalIgnoreCase)) { throw 'Company installation receipt does not match.' }
+$rules = @($receipt.firewall_rules)
+$expectedRules = @()
+if ($receipt.full_stack) { $expectedRules = @('SwanCompanyServer-TCP','SwanCompanyServer-UDP') }
+if ($rules.Count -ne $expectedRules.Count -or @(Compare-Object $rules $expectedRules).Count) { throw 'Unexpected company firewall ownership.' }
+$files = @(Join-Path $install 'swan-management.exe')
+if ($receipt.full_stack) {
+    foreach ($name in @('hbbs.exe','hbbr.exe','caddy.exe','Caddy-LICENSE.txt','RustDesk-LICENSE.txt','THIRD-PARTY.txt','server-components.json','transport-build-source.zip')) { $files += Join-Path (Join-Path $install 'components') $name }
+}
+foreach ($file in $files) {
+    if (Test-Path -LiteralPath $file) {
+        $item = Get-Item -LiteralPath $file -Force
+        if ($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Unexpected company installation file type.' }
+    }
+}
+[pscustomobject]@{Files=$files; FirewallRules=$rules; InstallDirectory=$install; DataDirectory=$data; FullStack=$receipt.full_stack}
diff --git a/deployment/windows/Get-WindowsCompatibility.ps1 b/deployment/windows/Get-WindowsCompatibility.ps1
new file mode 100644
index 00000000000..ee43a42dc40
--- /dev/null
+++ b/deployment/windows/Get-WindowsCompatibility.ps1
@@ -0,0 +1,17 @@
+$ErrorActionPreference = 'Stop'
+if (-not [Environment]::Is64BitOperatingSystem) { throw 'This release requires Windows x64.' }
+$nativeArchitecture = (Get-ItemProperty -LiteralPath 'HKLM:/SYSTEM/CurrentControlSet/Control/Session Manager/Environment' -Name PROCESSOR_ARCHITECTURE).PROCESSOR_ARCHITECTURE
+if ($nativeArchitecture -ne 'AMD64') { throw 'Native Windows x64 is required; ARM64 is not supported in this release.' }
+$version = Get-ItemProperty -LiteralPath 'HKLM:/SOFTWARE/Microsoft/Windows NT/CurrentVersion'
+$build = [int]$version.CurrentBuildNumber
+if ($version.InstallationType -eq 'Server Core') { throw 'Windows Server Core is not supported.' }
+if ($version.InstallationType -eq 'Server') {
+    foreach ($year in @(2016, 2019, 2022, 2025)) {
+        if ($version.ProductName -match ('Windows Server ' + $year + '\b')) { Write-Output ('server_' + $year); exit 0 }
+    }
+    throw 'This Windows Server release is not supported.'
+}
+if ($version.InstallationType -ne 'Client') { throw 'This Windows installation type is not supported.' }
+if ($build -ge 22000) { Write-Output 'windows_11' }
+elseif ($build -ge 10240) { Write-Output 'windows_10' }
+else { throw 'Windows 10 or 11 is required.' }
diff --git a/deployment/windows/Install-Company.ps1 b/deployment/windows/Install-Company.ps1
new file mode 100644
index 00000000000..858d6e31eac
--- /dev/null
+++ b/deployment/windows/Install-Company.ps1
@@ -0,0 +1,203 @@
+[CmdletBinding()]
+param([switch]$UnattendedConsent,[switch]$Repair,[switch]$ReplaceFailedSetup,[string]$BootstrapPath,[string]$ConfirmedCompanyDomain,[switch]$RequestElevation)
+$ErrorActionPreference = 'Stop'
+function Invoke-CompanySetupProcess {
+    param([string]$FilePath,[string[]]$ArgumentList,[string]$Verb,[string]$WindowStyle)
+    $start = @{FilePath=$FilePath;ArgumentList=$ArgumentList;PassThru=$true}
+    if ($Verb) { $start.Verb = $Verb }
+    if ($WindowStyle) { $start.WindowStyle = $WindowStyle }
+    # Start-Process -Wait waits for descendants too, including the persistent
+    # tray started by customer installation. The signed outer installer already
+    # waits for its installation child and propagates that child's exit code.
+    $process = Start-Process @start
+    try {
+        $process.WaitForExit()
+        $process.Refresh()
+        return $process.ExitCode
+    } finally { $process.Dispose() }
+}
+if (-not [Environment]::Is64BitProcess) { throw 'Use the 64-bit company setup entry point.' }
+$root = $PSScriptRoot
+if (-not $BootstrapPath) { $BootstrapPath = Join-Path $root 'bootstrap.json' }
+$BootstrapPath = [IO.Path]::GetFullPath($BootstrapPath)
+$bootstrap = Get-Content -LiteralPath $BootstrapPath -Raw | ConvertFrom-Json
+if ($bootstrap.edition -notin @('customer','technician')) { throw 'Unknown package edition.' }
+$domain = [uri]$bootstrap.management_url
+if ($domain.Scheme -ne 'https' -or $domain.UserInfo -or -not $domain.Host) { throw 'A company HTTPS endpoint is required.' }
+if ($RequestElevation -and $bootstrap.edition -eq 'customer') {
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    if (-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        $arguments = @('-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',('"' + $PSCommandPath + '"'),'-BootstrapPath',('"' + $BootstrapPath + '"'))
+        if ($Repair) { $arguments += '-Repair' }
+        if ($ReplaceFailedSetup) { $arguments += '-ReplaceFailedSetup' }
+        if ($UnattendedConsent) { $arguments += '-UnattendedConsent' }
+        if ($ConfirmedCompanyDomain) {
+            if ($ConfirmedCompanyDomain -cne $domain.Host) { throw 'Company verification cancelled.' }
+            $arguments += @('-ConfirmedCompanyDomain',('"' + $domain.Host + '"'))
+        }
+        try {
+            $exitCode = Invoke-CompanySetupProcess -FilePath (Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell/v1.0/powershell.exe') -ArgumentList $arguments -Verb RunAs
+        } catch { throw 'Customer setup requires administrator approval. Setup was not started.' }
+        if ($exitCode -ne 0) { throw "Customer setup did not complete ($exitCode). Contact your support company before retrying." }
+        return
+    }
+}
+Write-Host "Company server: $($domain.AbsoluteUri)"
+Write-Host 'Confirm this is the support company you intended to install. The company must approve your device before remote access.'
+if (-not $ConfirmedCompanyDomain) { $ConfirmedCompanyDomain = Read-Host 'Type the company server hostname to confirm' }
+if ($ConfirmedCompanyDomain -cne $domain.Host) { throw 'Company verification cancelled.' }
+if ($UnattendedConsent) {
+    Write-Host 'Unattended access allows approved company technicians to connect while you are absent, including the sign-in screen.'
+    if ((Read-Host 'Type ALLOW ONGOING SUPPORT to consent') -cne 'ALLOW ONGOING SUPPORT') { throw 'Ongoing-access consent not granted.' }
+}
+$agent = Join-Path $root 'swan-agent.exe'
+# The executable verifies signed company profiles itself. Never use unsigned setup files for a production release.
+$signature = Get-AuthenticodeSignature -LiteralPath $agent
+if ($signature.Status -ne 'Valid') { throw 'Configuration agent is not trusted.' }
+$editionDirectory = if ($bootstrap.edition -eq 'technician') { Join-Path $env:LOCALAPPDATA 'SwanRemoteSupport-Technician' } else { Join-Path $env:ProgramData 'SwanRemoteSupport' }
+if ($bootstrap.edition -eq 'customer') {
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    if (-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Run customer setup as administrator.' }
+}
+if ($bootstrap.edition -eq 'customer') {
+    & $agent prepare-customer-directory $editionDirectory
+    if ($LASTEXITCODE -ne 0) { throw 'Customer configuration directory is not trusted. Preserve and investigate existing data before setup.' }
+} else { New-Item -ItemType Directory -Force -Path $editionDirectory | Out-Null }
+$env:SWAN_STATE_DIR = $editionDirectory
+if (-not (Test-Path -LiteralPath (Join-Path $editionDirectory 'managed-state.json'))) {
+    & $agent setup $BootstrapPath --accept-company
+    if ($LASTEXITCODE -ne 0) { throw 'Company configuration verification failed.' }
+}
+& $agent verify-bootstrap $BootstrapPath
+if ($LASTEXITCODE -ne 0) { throw 'Installer does not match the configured company, edition or trust keys.' }
+$installers = @(Get-ChildItem -LiteralPath $root -File | Where-Object { $_.Name -match '^SwanRemoteSupport-install\.(exe|msi)$' })
+if ($installers.Count -ne 1) { throw 'Expected one company installer.' }
+$packageArguments = @('verify-package',(Join-Path $root 'release.json'),$installers[0].FullName)
+$recordArguments = @('record-installation',(Join-Path $root 'release.json'),$installers[0].FullName)
+if ($Repair) { $packageArguments += '--repair'; $recordArguments += '--repair' }
+& $agent @packageArguments
+if ($LASTEXITCODE -ne 0) { throw 'Installer metadata, hash or publisher validation failed.' }
+$systemDirectory = [Environment]::GetFolderPath('System')
+$msiExecutable = Join-Path $systemDirectory 'msiexec.exe'
+$msiOperation = '/i'
+if ($installers[0].Extension -eq '.msi') {
+    $msiOperation = (& (Join-Path $systemDirectory 'WindowsPowerShell/v1.0/powershell.exe') -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File (Join-Path $root 'Get-MsiInstallMode.ps1') -Package $installers[0].FullName | Out-String).Trim()
+    if ($LASTEXITCODE -ne 0 -or $msiOperation -notin @('/i','/fvamus')) { throw 'Cannot select a safe MSI installation or repair mode.' }
+}
+$prepareArguments = @('prepare-installation',(Join-Path $root 'release.json'),$installers[0].FullName)
+if ($Repair) { $prepareArguments += '--repair' }
+if ($ReplaceFailedSetup) { $prepareArguments += '--replace-failed-setup' }
+& $agent @prepareArguments
+if ($LASTEXITCODE -ne 0) { throw 'Cannot prepare explicit installation or preserve cancelled update evidence.' }
+$installationMarker = Join-Path $editionDirectory 'pending-install.json'
+$configurationTaskRestore = $null
+try {
+$activityStream = [IO.File]::Open((Join-Path $editionDirectory 'activity.lock'),[IO.FileMode]::OpenOrCreate,[IO.FileAccess]::ReadWrite,[IO.FileShare]::ReadWrite)
+$activityLocked = $false
+try {
+    # LockFile's exclusive byte range overlaps fs2's session/update lock range.
+    # Refuse active sessions; do not terminate them to perform setup.
+    $activityStream.Lock(0,1)
+    $activityLocked = $true
+    $prepared = Get-Content -LiteralPath $installationMarker -Raw | ConvertFrom-Json
+    $requested = Get-Content -LiteralPath (Join-Path $root 'release.json') -Raw | ConvertFrom-Json
+    if ($prepared.payload -cne $requested.payload -or $prepared.signature -cne $requested.signature) { throw 'Another company setup owns the installation recovery marker.' }
+if ($bootstrap.edition -eq 'customer') {
+    $configurationTask = @(Get-ScheduledTask | Where-Object { $_.TaskName -eq 'Swan Company Configuration' })
+    if ($configurationTask.Count -gt 1) { throw 'Ambiguous existing configuration task.' }
+    if ($configurationTask.Count -eq 1) {
+        $expectedAgent = [IO.Path]::GetFullPath((Join-Path $editionDirectory 'swan-agent.exe'))
+        if ($configurationTask[0].Actions.Count -ne 1 -or [IO.Path]::GetFullPath($configurationTask[0].Actions[0].Execute) -ine $expectedAgent -or $configurationTask[0].Actions[0].Arguments -cne 'watch' -or $configurationTask[0].Principal.UserId -notin @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) { throw 'Existing configuration task does not match this installation.' }
+        $configurationTaskRestore = @{name=$configurationTask[0].TaskName;path=$configurationTask[0].TaskPath;enabled=($configurationTask[0].State.ToString() -ne 'Disabled');active=($configurationTask[0].State.ToString() -in @('Running','Queued'))}
+        $configurationTask[0] | Disable-ScheduledTask | Out-Null
+        $configurationTask[0] | Stop-ScheduledTask
+        $stopDeadline = [DateTime]::UtcNow.AddSeconds(10)
+        while (@(Get-CimInstance Win32_Process -Filter "Name='swan-agent.exe'" | Where-Object { $_.ExecutablePath -ieq $expectedAgent }).Count -gt 0) {
+            if ([DateTime]::UtcNow -ge $stopDeadline) { throw 'Installed configuration agent did not stop. Close its running processes and retry setup.' }
+            Start-Sleep -Milliseconds 100
+        }
+    }
+    if ($installers[0].Extension -eq '.msi') {
+        $exitCode = Invoke-CompanySetupProcess -FilePath $msiExecutable -ArgumentList @($msiOperation,('"' + $installers[0].FullName + '"'),'/passive','/norestart') -WindowStyle Hidden
+    } else {
+        $exitCode = Invoke-CompanySetupProcess -FilePath $installers[0].FullName -ArgumentList '--silent-install','printer=0' -WindowStyle Hidden
+    }
+    if ($exitCode -notin @(0,3010)) { throw "Installation failed ($exitCode)." }
+    $installed = Join-Path $env:ProgramFiles 'Swan Remote Support/Swan Remote Support.exe'
+    if (-not (Test-Path -LiteralPath $installed)) { throw 'Installed executable not found. Verify the package install directory.' }
+    $deviceId = (& $installed --get-id | Out-String).Trim()
+    $enrollmentArguments = @('enroll', $env:COMPUTERNAME, $deviceId)
+    if ($UnattendedConsent) { $enrollmentArguments += '--unattended-consent' }
+    & $agent @enrollmentArguments
+    if ($LASTEXITCODE -ne 0) { throw 'Device enrollment failed. Access remains blocked.' }
+    Copy-Item -LiteralPath $agent -Destination (Join-Path $editionDirectory 'swan-agent.exe') -Force
+} else {
+    $releaseEnvelope = Get-Content -LiteralPath (Join-Path $root 'release.json') -Raw | ConvertFrom-Json
+    # The agent already verified this signed metadata and installer before any copy.
+    $release = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($releaseEnvelope.payload)) | ConvertFrom-Json
+    $portable = Join-Path $editionDirectory 'SwanRemoteSupport-Technician.exe'
+    if ($release.format -eq 'msi') {
+        $exitCode = Invoke-CompanySetupProcess -FilePath $msiExecutable -ArgumentList @($msiOperation,('"' + $installers[0].FullName + '"'),'/passive','/norestart',('INSTALLFOLDER="' + $editionDirectory + '"')) -WindowStyle Hidden
+        if ($exitCode -eq 1625) { throw 'Windows Installer policy prevents this per-user technician installation (1625). Contact your company administrator for an approved deployment.' }
+        if ($exitCode -notin @(0,3010)) { throw "Technician MSI installation failed ($exitCode)." }
+        if (-not (Test-Path -LiteralPath $portable)) { throw 'Technician MSI did not install the expected executable.' }
+    } elseif ($release.format -eq 'exe' -and $release.sha256 -ceq $release.installed_sha256) {
+        Copy-Item -LiteralPath $installers[0].FullName -Destination $portable -Force
+    } else { throw 'Technician setup requires an MSI or a portable EXE with matching installed identity.' }
+    Copy-Item -LiteralPath $agent -Destination (Join-Path $editionDirectory 'swan-agent.exe') -Force
+}
+} finally {
+    try { if ($activityLocked) { $activityStream.Unlock(0,1) } }
+    finally { $activityStream.Dispose() }
+}
+# Sessions remain blocked by the durable marker while the agent verifies the
+# complete installed identity under its own exclusive lock.
+& $agent @recordArguments
+if ($LASTEXITCODE -ne 0) { throw 'Installed application or agent verification failed. Installation recovery is required.' }
+if (Test-Path -LiteralPath $installationMarker) { throw 'Company installation recovery marker remains; support sessions stay blocked.' }
+if ($bootstrap.edition -eq 'customer') {
+    $action = New-ScheduledTaskAction -Execute (Join-Path $editionDirectory 'swan-agent.exe') -Argument 'watch'
+    $trigger = New-ScheduledTaskTrigger -AtStartup
+    $settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -Priority 4
+    Register-ScheduledTask -TaskName 'Swan Company Configuration' -Action $action -Trigger $trigger -Settings $settings -User 'SYSTEM' -RunLevel Highest -Force | Out-Null
+    Enable-ScheduledTask -TaskName 'Swan Company Configuration' | Out-Null
+    Start-ScheduledTask -TaskName 'Swan Company Configuration'
+    Write-Host 'Installed and enrolled. Your company must approve the device. Support status and stop controls remain available.'
+} else {
+    Copy-Item -LiteralPath (Join-Path $root 'Open-Technician.ps1') -Destination (Join-Path $editionDirectory 'Open-Technician.ps1') -Force
+    $shortcutPath = Join-Path ([Environment]::GetFolderPath('Programs')) 'Swan Remote Support Technician.lnk'
+    $shell = New-Object -ComObject WScript.Shell
+    $shortcut = $shell.CreateShortcut($shortcutPath)
+    $shortcut.TargetPath = Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
+    $shortcut.Arguments = '-NoLogo -NoProfile -ExecutionPolicy Bypass -File "' + (Join-Path $editionDirectory 'Open-Technician.ps1') + '"'
+    $shortcut.WorkingDirectory = $editionDirectory
+    $shortcut.IconLocation = $portable
+    $shortcut.Save()
+    if ($release.format -eq 'exe') {
+        Copy-Item -LiteralPath (Join-Path $root 'Uninstall-Technician.ps1') -Destination (Join-Path $editionDirectory 'Uninstall-Technician.ps1') -Force
+        $uninstallShortcut=$shell.CreateShortcut((Join-Path ([Environment]::GetFolderPath('Programs')) 'Uninstall Swan Remote Support Technician.lnk'))
+        $uninstallShortcut.TargetPath=Join-Path $env:SystemRoot 'System32/WindowsPowerShell/v1.0/powershell.exe'
+        $uninstallShortcut.Arguments='-NoLogo -NoProfile -ExecutionPolicy Bypass -File "'+(Join-Path $editionDirectory 'Uninstall-Technician.ps1')+'"'
+        $uninstallShortcut.WorkingDirectory=$editionDirectory
+        $uninstallShortcut.IconLocation=$portable
+        $uninstallShortcut.Save()
+    }
+    Write-Host 'Technician application installed. Use the Start menu shortcut to sign in and request support sessions.'
+}
+} catch {
+    $setupError = $_
+    if ($configurationTaskRestore) {
+        try {
+            $restore = @(Get-ScheduledTask -TaskName $configurationTaskRestore.name -TaskPath $configurationTaskRestore.path)
+            $expectedAgent = [IO.Path]::GetFullPath((Join-Path $editionDirectory 'swan-agent.exe'))
+            if ($restore.Count -ne 1 -or $restore[0].Actions.Count -ne 1 -or [IO.Path]::GetFullPath($restore[0].Actions[0].Execute) -ine $expectedAgent -or $restore[0].Actions[0].Arguments -cne 'watch' -or $restore[0].Principal.UserId -notin @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) { throw 'Configuration task changed during setup; refusing to start it.' }
+            if ($configurationTaskRestore.enabled) {
+                $restore[0] | Enable-ScheduledTask | Out-Null
+                if ($configurationTaskRestore.active) { $restore[0] | Start-ScheduledTask }
+            } else { $restore[0] | Disable-ScheduledTask | Out-Null }
+        } catch {
+            throw [InvalidOperationException]::new(('Customer setup failed and its configuration task could not be restored: '+$_.Exception.Message+' Original setup error: '+$setupError.Exception.Message),$setupError.Exception)
+        }
+    }
+    throw $setupError
+}
diff --git a/deployment/windows/Install-FlutterEngineToolchain.ps1 b/deployment/windows/Install-FlutterEngineToolchain.ps1
new file mode 100644
index 00000000000..eab626d04f8
--- /dev/null
+++ b/deployment/windows/Install-FlutterEngineToolchain.ps1
@@ -0,0 +1,22 @@
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+# Provisioning is confined to the disposable GitHub Windows build runner.
+# Local source builds require the selected toolset to be installed beforehand.
+if($env:GITHUB_ACTIONS -cne 'true' -or $env:RUNNER_OS -cne 'Windows'){throw 'Toolset provisioning is only supported on the disposable GitHub Windows runner'}
+$recipe=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'flutter-engine.lock.json') -Raw | ConvertFrom-Json
+$tools=$recipe.windows_toolchain
+if($tools.msvc_component -cne 'Microsoft.VisualStudio.Component.VC.14.38.17.8.x86.x64' -or $tools.msvc_atl_component -cne 'Microsoft.VisualStudio.Component.VC.14.38.17.8.ATL' -or $tools.msvc_tools_version -cne '14.38.33130'){throw 'Unexpected engine toolset components'}
+$studio='C:\Program Files\Microsoft Visual Studio\2022\Enterprise'
+$compiler=Join-Path $studio ('VC\Tools\MSVC\'+$tools.msvc_tools_version+'\bin\Hostx64\x64\cl.exe')
+$atl=Join-Path $studio ('VC\Tools\MSVC\'+$tools.msvc_tools_version+'\ATLMFC\lib\x64\atls.lib')
+if(-not(Test-Path -LiteralPath $compiler) -or -not(Test-Path -LiteralPath $atl)){
+ $installer='C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe'
+ $signature=Get-AuthenticodeSignature -LiteralPath $installer
+ if($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'CN=Microsoft Corporation(?:,|$)'){throw 'Visual Studio installer publisher verification failed'}
+ $process=Start-Process -FilePath $installer -ArgumentList @('modify','--installPath',('"'+$studio+'"'),'--add',$tools.msvc_component,'--add',$tools.msvc_atl_component,'--quiet','--norestart') -WindowStyle Hidden -Wait -PassThru
+ if($process.ExitCode -ne 0){throw ('Pinned Microsoft toolset installation did not complete without restart: '+$process.ExitCode)}
+}
+foreach($relative in @('bin\Hostx64\x64\cl.exe','include\yvals_core.h','lib\x64\libcmt.lib','lib\x64\libcpmt.lib','ATLMFC\include\atlbase.h','ATLMFC\lib\x64\atls.lib')){
+ if(-not(Test-Path -LiteralPath (Join-Path $studio ('VC\Tools\MSVC\'+$tools.msvc_tools_version+'\'+$relative)))){throw 'Pinned Microsoft toolset is incomplete'}
+}
+Write-Output ('Pinned Microsoft C++ toolset available: '+$tools.msvc_tools_version)
diff --git a/deployment/windows/Install-Server.ps1 b/deployment/windows/Install-Server.ps1
new file mode 100644
index 00000000000..31ea8f5fd8b
--- /dev/null
+++ b/deployment/windows/Install-Server.ps1
@@ -0,0 +1,119 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Executable,[Parameter(Mandatory)][string]$ReleasePublicKey,
+      [Parameter(Mandatory)][ValidatePattern('^[A-Fa-f0-9]{40}$')][string]$PublisherThumbprint,[int]$Port=8080,
+      [string]$ComponentsDirectory,[string]$PublicHostname)
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+if (-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Server installation requires administrator rights.' }
+if ($Port -lt 1024 -or $Port -gt 65535) { throw 'Invalid management port.' }
+$source = (Resolve-Path -LiteralPath $Executable).Path
+$signature = Get-AuthenticodeSignature -LiteralPath $source
+if ($signature.Status -ne 'Valid') { throw 'The company server executable requires a trusted release signature.' }
+if ($signature.SignerCertificate.Thumbprint -ne $PublisherThumbprint) { throw 'Company server signature publisher does not match the configured certificate.' }
+if ([Convert]::FromBase64String($ReleasePublicKey).Length -ne 32) { throw 'Expected a 32-byte project release public key.' }
+$componentPins = @{
+    'hbbs.exe'='2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be'
+    'hbbr.exe'='97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0'
+    'caddy.exe'='586d4a4cd74bdfd2951b6b81766a32904ffa69c4f1c3d521da3870a2120f1d31'
+}
+$fullStack = -not [string]::IsNullOrEmpty($ComponentsDirectory)
+if ($fullStack -ne (-not [string]::IsNullOrEmpty($PublicHostname))) { throw 'Specify both prepared components and the public hostname.' }
+if ($fullStack) {
+    if ($PublicHostname.Length -gt 253 -or $PublicHostname -notmatch '\.' -or @($PublicHostname.Split('.') | Where-Object { $_ -notmatch '^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$' }).Count) { throw 'Invalid company public hostname.' }
+    if ($Port -in @(80,443,21115,21116,21117)) { throw 'Management port conflicts with a packaged component.' }
+    $ComponentsDirectory = (Resolve-Path -LiteralPath $ComponentsDirectory).Path
+    foreach ($name in $componentPins.Keys) {
+        $component = Join-Path $ComponentsDirectory $name
+        if ((Get-Item -LiteralPath $component).Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'Component must be a regular file.' }
+        if ((Get-FileHash -LiteralPath $component -Algorithm SHA256).Hash -ne $componentPins[$name]) { throw 'Packaged server component hash mismatch.' }
+    }
+    foreach ($name in @('Caddy-LICENSE.txt','RustDesk-LICENSE.txt','THIRD-PARTY.txt','server-components.json','transport-build-source.zip')) {
+        if (-not (Test-Path -LiteralPath (Join-Path $ComponentsDirectory $name) -PathType Leaf)) { throw 'Prepared component license or source notice missing.' }
+    }
+}
+# Enumerate first: filtering cmdlets by a missing port/name can itself report an
+# error. Inspection failures must abort rather than masquerade as a free port.
+$ports = if ($fullStack) { @(80,443,21115,21116,21117,$Port) } else { @($Port) }
+$listeners = @(Get-NetTCPConnection -ErrorAction Stop | Where-Object { $_.State -eq 'Listen' -and $_.LocalPort -in $ports })
+if ($listeners.Count) { throw 'A required company server port is already in use. Existing services will not be changed.' }
+if ($fullStack) {
+    if (@(Get-NetUDPEndpoint -ErrorAction Stop | Where-Object LocalPort -eq 21116).Count) { throw 'Company rendezvous UDP port is already in use.' }
+    if (@(Get-NetFirewallRule -ErrorAction Stop | Where-Object Name -in @('SwanCompanyServer-TCP','SwanCompanyServer-UDP')).Count) { throw 'Company firewall rule already exists.' }
+}
+$installDirectory = Join-Path $env:ProgramFiles 'Swan Company Server'
+$dataDirectory = Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanCompanyServer'
+if (@(Get-Service -ErrorAction Stop | Where-Object Name -eq 'SwanCompanyServer').Count) { throw 'Company server already exists. Use the documented backed-up maintenance upgrade procedure.' }
+if ((Test-Path -LiteralPath $installDirectory) -or (Test-Path -LiteralPath $dataDirectory)) { throw 'Company install/data directory already exists. Preserve it and use the recovery or maintenance procedure.' }
+New-Item -ItemType Directory -Path $installDirectory | Out-Null
+$destination = Join-Path $installDirectory 'swan-management.exe'
+Copy-Item -LiteralPath $source -Destination $destination
+$copiedSignature = Get-AuthenticodeSignature -LiteralPath $destination
+if ($copiedSignature.Status -ne 'Valid' -or $copiedSignature.SignerCertificate.Thumbprint -ne $PublisherThumbprint) { throw 'Copied management executable does not match the trusted publisher.' }
+# Run only the verified copy in Program Files. Its embedded helper creates the
+# state root with its private descriptor atomically and refuses existing state,
+# including an object created after the earlier fresh-install precheck.
+$preparation=Start-Process -FilePath $destination -ArgumentList @('prepare-server-directory',('"'+$dataDirectory+'"')) -WorkingDirectory $installDirectory -WindowStyle Hidden -PassThru
+try {
+    if(-not $preparation.WaitForExit(30000)){
+        $preparation.Kill();$preparation.WaitForExit()
+        throw 'Management directory preparation timed out. Select the matching server build and preserve existing files.'
+    }
+    if ($preparation.ExitCode -ne 0) { throw 'Cannot create fresh private server data. Preserve existing files before retrying.' }
+} finally {$preparation.Dispose()}
+$serviceEnvironment = @("SWAN_DATA_DIR=$dataDirectory","SWAN_LISTEN=127.0.0.1:$Port","SWAN_RELEASE_PUBLIC_KEY=$ReleasePublicKey")
+if ($fullStack) {
+    $packaged = Join-Path $installDirectory 'components'
+    New-Item -ItemType Directory -Path $packaged | Out-Null
+    foreach ($name in $componentPins.Keys) { Copy-Item -LiteralPath (Join-Path $ComponentsDirectory $name) -Destination (Join-Path $packaged $name) }
+    foreach ($name in @('Caddy-LICENSE.txt','RustDesk-LICENSE.txt','THIRD-PARTY.txt','server-components.json','transport-build-source.zip')) { Copy-Item -LiteralPath (Join-Path $ComponentsDirectory $name) -Destination (Join-Path $packaged $name) }
+    $configuration = "{`n    admin off`n}`n$PublicHostname {`n    reverse_proxy 127.0.0.1:$Port`n    header Strict-Transport-Security max-age=31536000`n    request_body {`n        max_size 512MB`n    }`n}`n"
+    [IO.File]::WriteAllText((Join-Path $dataDirectory 'Caddyfile'),$configuration,[Text.UTF8Encoding]::new($false))
+    $serviceEnvironment += @('SWAN_COMPONENTS=1',"SWAN_PUBLIC_HOST=$PublicHostname")
+}
+$serviceCreated = $false
+$createdRules = @()
+try {
+    New-Service -Name SwanCompanyServer -DisplayName 'Swan Remote Support Company Server' -BinaryPathName ('"'+$destination+'" --service') -StartupType Automatic | Out-Null
+    $serviceCreated = $true
+    $serviceRegistry = 'HKLM:/SYSTEM/CurrentControlSet/Services/SwanCompanyServer'
+    New-ItemProperty -Path $serviceRegistry -Name Environment -PropertyType MultiString -Value $serviceEnvironment -Force | Out-Null
+    & sc.exe failure SwanCompanyServer reset= 86400 actions= restart/60000/restart/60000/restart/300000 | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'Cannot configure company service recovery.' }
+    # Component supervision reports Stopped with a nonzero exit code after cleanup.
+    & sc.exe failureflag SwanCompanyServer 1 | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'Cannot enable recovery for reported company service failures.' }
+    if ($fullStack) {
+        New-NetFirewallRule -Name 'SwanCompanyServer-TCP' -Group 'SwanCompanyServer' -DisplayName 'Swan company HTTPS and transport' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 80,443,21115,21116,21117 | Out-Null
+        $createdRules += 'SwanCompanyServer-TCP'
+        New-NetFirewallRule -Name 'SwanCompanyServer-UDP' -Group 'SwanCompanyServer' -DisplayName 'Swan company rendezvous UDP' -Direction Inbound -Action Allow -Protocol UDP -LocalPort 21116 | Out-Null
+        $createdRules += 'SwanCompanyServer-UDP'
+    }
+    Start-Service SwanCompanyServer
+    $deadline = [DateTime]::UtcNow.AddSeconds(45)
+    $healthy = $false
+    while ([DateTime]::UtcNow -lt $deadline) {
+        try { $health = Invoke-RestMethod -Uri "http://127.0.0.1:$Port/health" -TimeoutSec 2; $healthy = $health.status -eq 'ok' -and $health.product -eq 'Swan Remote Support' } catch { $healthy = $false }
+        if ($healthy) { break }
+        if ((Get-Service -Name SwanCompanyServer).Status -eq 'Stopped') { throw 'Company service stopped during startup. Review protected component logs.' }
+        Start-Sleep -Milliseconds 250
+    }
+    if (-not $healthy) { throw 'Company management health check timed out.' }
+    $receipt = [ordered]@{schema=1; service_name='SwanCompanyServer'; install_directory=[IO.Path]::GetFullPath($installDirectory);
+        data_directory=[IO.Path]::GetFullPath($dataDirectory); full_stack=$fullStack; firewall_rules=@($createdRules)}
+    [IO.File]::WriteAllText((Join-Path $dataDirectory 'installation.json'),($receipt | ConvertTo-Json -Depth 4),[Text.UTF8Encoding]::new($false))
+} catch {
+    foreach ($rule in $createdRules) { Remove-NetFirewallRule -Name $rule -ErrorAction Continue }
+    if ($serviceCreated) {
+        Stop-Service -Name SwanCompanyServer -ErrorAction Continue
+        & sc.exe delete SwanCompanyServer | Out-Null
+        if ($LASTEXITCODE -ne 0) { Write-Warning 'Failed to remove the newly created company service.' }
+    }
+    Write-Warning 'Installation failed. Newly created files and private data remain for inspection; preserve them before retrying.'
+    throw
+}
+if ($fullStack) {
+    Write-Host "Company components installed. Configure company DNS and forward required ports to this server, then open https://$PublicHostname to complete setup."
+    Write-Host 'HTTPS issuance requires public DNS and inbound reachability. Management health alone does not prove external HTTPS or transport connectivity.'
+} else { Write-Host "Company server installed on localhost:$Port. Put an HTTPS reverse proxy in front of this service." }
+Write-Host "Read the one-time setup token from $dataDirectory/setup-token.txt, then complete the web setup wizard."
+Write-Host 'Existing RustDesk and Tailscale services were not changed. Public transport setup will fail if its required ports are occupied.'
diff --git a/deployment/windows/Install-SwanRemoteSupport.cmd b/deployment/windows/Install-SwanRemoteSupport.cmd
new file mode 100644
index 00000000000..55ca9d4b3bc
--- /dev/null
+++ b/deployment/windows/Install-SwanRemoteSupport.cmd
@@ -0,0 +1,12 @@
+@echo off
+setlocal DisableDelayedExpansion
+set "swan_powershell=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
+if exist "%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe" set "swan_powershell=%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe"
+"%swan_powershell%" -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%~dp0Install-Company.ps1" -RequestElevation
+set "swan_setup_exit=%errorlevel%"
+if not "%swan_setup_exit%"=="0" (
+    echo.
+    echo Setup did not complete. Keep this folder and contact your support company.
+    pause
+)
+exit /b %swan_setup_exit%
diff --git a/deployment/windows/Install-Worker.ps1 b/deployment/windows/Install-Worker.ps1
new file mode 100644
index 00000000000..9b3cfdd8648
--- /dev/null
+++ b/deployment/windows/Install-Worker.ps1
@@ -0,0 +1,101 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Executable,
+      [Parameter(Mandatory)][string]$ConfigurationPath,
+      [Parameter(Mandatory)][ValidatePattern('^[A-Fa-f0-9]{40}$')][string]$PublisherThumbprint)
+$ErrorActionPreference='Stop'
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+if(-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Worker installation requires administrator rights.'}
+$source=(Resolve-Path -LiteralPath $Executable).Path
+if((Get-Item -LiteralPath $source).Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Worker executable must be a regular file.'}
+$signature=Get-AuthenticodeSignature -LiteralPath $source
+if($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Thumbprint -ine $PublisherThumbprint){throw 'Worker signature does not match the trusted publisher.'}
+try {
+ $privateInput=& (Join-Path $PSScriptRoot 'Read-WorkerConfiguration.ps1') -Path $ConfigurationPath -Scope input -Output pipeline
+ $config=$privateInput|ConvertFrom-Json
+} catch {throw 'Worker configuration must be valid JSON in a private local administrator directory. Revoke any credential previously stored publicly.'}
+$allowed=@('management_url','worker_token','release_public_key','profile_public_key')
+if(@($config.PSObject.Properties.Name).Count -ne $allowed.Count -or @($config.PSObject.Properties.Name|Where-Object {$_ -notin $allowed}).Count){throw 'Worker configuration requires exactly the documented fields.'}
+foreach($name in $allowed){if($config.$name -isnot [string] -or [string]::IsNullOrWhiteSpace($config.$name) -or $config.$name.Contains("`n") -or $config.$name.Contains("`r") -or $config.$name.Contains([char]0)){throw 'Invalid worker configuration value.'}}
+$url=$null
+if(-not [Uri]::TryCreate($config.management_url,[UriKind]::Absolute,[ref]$url) -or $url.Scheme -cne 'https' -or -not $url.Host -or $url.UserInfo -or $url.Fragment -or $url.Query){throw 'Worker requires a company HTTPS origin without credentials, query or fragment.'}
+foreach($name in @('release_public_key','profile_public_key')){if([Convert]::FromBase64String($config.$name).Length -ne 32){throw 'Expected a 32-byte public trust key.'}}
+if($config.worker_token -cnotmatch '^[\x21-\x7E]{32,256}$'){throw 'Invalid worker credential format.'}
+$install=Join-Path $env:ProgramFiles 'Swan Installer Worker'
+$data=Join-Path $env:ProgramData 'SwanInstallerWorker'
+if((Get-Service -ErrorAction Stop|Where-Object {$_.Name -ceq 'SwanInstallerWorker'}) -or (Test-Path -LiteralPath $install) -or (Test-Path -LiteralPath $data)){throw 'Existing worker installation must be inspected; replacement is not automatic.'}
+foreach($parent in @($env:ProgramFiles,$env:ProgramData)){if((Get-Item -LiteralPath $parent -Force).Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Worker installation parent cannot be a reparse point.'}}
+New-Item -ItemType Directory -Path $install|Out-Null
+foreach($directory in @($install)){
+ & icacls.exe $directory '/inheritance:r' '/grant:r' '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F'|Out-Null
+ if($LASTEXITCODE -ne 0){throw 'Cannot protect worker installation.'}
+}
+$destination=Join-Path $install 'swan-worker.exe'
+Copy-Item -LiteralPath $source -Destination $destination
+if((Get-FileHash -LiteralPath $source).Hash -cne (Get-FileHash -LiteralPath $destination).Hash){throw 'Worker executable changed during installation.'}
+$installedSignature=Get-AuthenticodeSignature -LiteralPath $destination
+if($installedSignature.Status -ne 'Valid' -or $installedSignature.SignerCertificate.Thumbprint -ine $PublisherThumbprint){throw 'Installed worker signature does not match the trusted publisher.'}
+function Invoke-WorkerSetupCommand([string]$Mode,[string]$Argument,[string]$PrivateConfiguration) {
+ $start=[Diagnostics.ProcessStartInfo]::new()
+ $start.FileName=$destination;$start.Arguments=$Mode
+ if($Argument){$start.Arguments+=' "'+$Argument+'"'}
+ $start.UseShellExecute=$false;$start.CreateNoWindow=$true
+ foreach($name in @('SWAN_WORKER_CONFIG','SWAN_WORKER_TOKEN','SWAN_MANAGEMENT_URL','SWAN_RELEASE_PUBLIC_KEY','SWAN_PROFILE_PUBLIC_KEY','SWAN_ARTIFACT_DIR')){[void]$start.EnvironmentVariables.Remove($name)}
+ if($PrivateConfiguration){$start.EnvironmentVariables['SWAN_WORKER_CONFIG']=$PrivateConfiguration}
+ $process=[Diagnostics.Process]::Start($start)
+ try {
+  if(!$process.WaitForExit(300000)){$process.Kill();$process.WaitForExit();throw 'Worker preparation timed out. Preserve existing files before retrying.'}
+  if($process.ExitCode -ne 0){throw 'Worker preparation failed. Use the matching worker release and preserve existing files.'}
+ }finally{$process.Dispose()}
+}
+# The verified worker creates the state root with its private descriptor in the
+# same operation. An existing or concurrently created root is never adopted.
+Invoke-WorkerSetupCommand 'prepare-worker-directory' $data ''
+$configurationFile=Join-Path $data 'worker.json'
+$canonical=[ordered]@{}
+foreach($name in $allowed){$canonical[$name]=$config.$name}
+$bytes=[Text.UTF8Encoding]::new($false).GetBytes(($canonical|ConvertTo-Json -Compress))
+$file=[IO.FileStream]::new($configurationFile,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+try {
+ $fileAcl=[Security.AccessControl.FileSecurity]::new()
+ $fileAcl.SetOwner([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))
+ $fileAcl.SetAccessRuleProtection($true,$false)
+ foreach($sid in @('S-1-5-18','S-1-5-32-544')){$fileAcl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),'FullControl','Allow'))}
+ Set-Acl -LiteralPath $configurationFile -AclObject $fileAcl
+ $secured=Get-Acl -LiteralPath $configurationFile
+ if(!$secured.AreAccessRulesProtected -or $secured.GetOwner([Security.Principal.SecurityIdentifier]).Value -cne 'S-1-5-32-544'){throw 'Worker configuration file is not privately owned.'}
+ foreach($rule in $secured.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){if($rule.AccessControlType -ne 'Allow' -or $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Worker configuration file grants unexpected access; no credential written.'}}
+ $file.Write($bytes,0,$bytes.Length);$file.Flush($true)
+}finally{$file.Dispose()}
+Invoke-WorkerSetupCommand 'check-configuration' '' $configurationFile
+$artifacts=Join-Path $data 'artifacts';New-Item -ItemType Directory -Path $artifacts|Out-Null
+$created=$false
+try{
+ New-Service -Name SwanInstallerWorker -DisplayName 'Swan Remote Support Installer Worker' -BinaryPathName ('"'+$destination+'" --service') -StartupType Automatic|Out-Null
+ $created=$true
+ $registry='HKLM:\SYSTEM\CurrentControlSet\Services\SwanInstallerWorker'
+ # Registry permissions may gain app-container read ACEs on Windows. Persist
+ # only the public path; the service reads its credential from the private file.
+ $acl=[Security.AccessControl.RegistrySecurity]::new()
+ $acl.SetAccessRuleProtection($true,$false)
+ foreach($sid in @('S-1-5-18','S-1-5-32-544')){
+  $principal=[Security.Principal.SecurityIdentifier]::new($sid)
+  $rule=[Security.AccessControl.RegistryAccessRule]::new($principal,[Security.AccessControl.RegistryRights]::FullControl,[Security.AccessControl.InheritanceFlags]::ContainerInherit,[Security.AccessControl.PropagationFlags]::None,[Security.AccessControl.AccessControlType]::Allow)
+  $acl.AddAccessRule($rule)
+ }
+ Set-Acl -LiteralPath $registry -AclObject $acl
+ $environment=@("SWAN_WORKER_CONFIG=$configurationFile")
+ New-ItemProperty -LiteralPath $registry -Name Environment -PropertyType MultiString -Value $environment|Out-Null
+ & sc.exe failure SwanInstallerWorker reset= 86400 actions= restart/60000/restart/60000/restart/300000|Out-Null
+ if($LASTEXITCODE -ne 0){throw 'Cannot configure worker recovery.'}
+ # The worker reports Stopped with a nonzero exit code for fatal runtime errors.
+ & sc.exe failureflag SwanInstallerWorker 1|Out-Null
+ if($LASTEXITCODE -ne 0){throw 'Cannot enable recovery for reported worker failures.'}
+ Start-Service SwanInstallerWorker
+ (Get-Service SwanInstallerWorker).WaitForStatus([ServiceProcess.ServiceControllerStatus]::Running,[TimeSpan]::FromSeconds(30))
+ @{schema=2;service='SwanInstallerWorker';executable_sha256=(Get-FileHash $destination).Hash;publisher_thumbprint=$PublisherThumbprint;configuration_path=$configurationFile}|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $data 'installation.json')
+}catch{
+ if($created){Stop-Service SwanInstallerWorker -ErrorAction Continue;& sc.exe delete SwanInstallerWorker|Out-Null}
+ Write-Warning 'Worker installation failed; protected files remain for inspection. No automatic replacement will occur.'
+ throw
+}
+Write-Host 'Worker service started. Verify an authenticated completed build and startup after reboot before publication.'
diff --git a/deployment/windows/LOCAL-TESTING.md b/deployment/windows/LOCAL-TESTING.md
new file mode 100644
index 00000000000..4f49302bcd0
--- /dev/null
+++ b/deployment/windows/LOCAL-TESTING.md
@@ -0,0 +1,25 @@
+# Local company-server testing
+
+For offline-consent recovery tests, set `SWAN_TEST_FAULTS=1` in the private test
+environment file. The loopback HTTPS proxy responds with HTTP 503 while a file
+named `simulate-offline` exists inside that test data directory. There is no
+HTTP control endpoint. The lifecycle script creates and removes this file,
+checks durable local revocation while offline, then starts the real agent
+watcher and verifies that recovered server authorization denies unattended
+grants. Use this only with the isolated local test proxy.
+
+An optional second script argument selects a separately built executable
+directory: `node deployment/windows/test-company-lifecycle.js PRIVATE_ENV_FILE
+PRIVATE_BINARY_DIRECTORY`. This permits testing newer agent/server builds
+without replacing running test or production executables. Recorded hashes use
+that directory.
+
+Each company runs its own management, rendezvous, relay and Windows build worker. The project does not operate a shared hosting or signing service.
+
+Copy `local-test.env.example` to `local-test.env`, build `product/Cargo.toml`, then run `Start-LocalTest.ps1` from the repository root. The launcher reads named settings as data and binds management to loopback. `local-test.env` and `swan-data/` are ignored by Git. The data directory contains the database, private profile-signing key and setup token; its Windows ACL permits the current user, administrators and SYSTEM.
+
+The default local administration address is http://127.0.0.1:18080. Use the one-time token in `swan-data/local-test/setup-token.txt` for initial setup. Do not paste the token into issues or build logs. Existing RustDesk services are independent of this test process.
+
+This loopback HTTP listener is for administration smoke tests. Endpoint enrollment and profile synchronization require HTTPS with a trusted certificate. `local-https.js` provides an isolated loopback proxy using PFX/password settings from the ignored environment file. Debug agents accept a DER test certificate through `SWAN_TEST_CA_FILE`; release builds ignore this variable and use operating-system trust roots. Certificate validation remains enabled. Public direct and relay testing requires a company-owned reachable endpoint and a separate external test machine.
+
+Verified on this development machine: management starts, administration responds with HTTP 200, and seventeen product-workspace tests pass. `node deployment/windows/test-company-lifecycle.js PATH_TO_PRIVATE_ENV_FILE` also passed against a fresh HTTPS proxy and newly built agent/server: company setup, device enrollment, approval denial, technician MFA/group inventory and session history, logout credential revocation, consent denial, grant replay denial, signed branding sync and device revocation. The script records executable hashes in the protected data directory and refuses an already configured company. For another run, create a separate empty data directory and environment file, choose unused loopback ports, and copy the public DER test certificate into that directory as `localhost.cer`; preserve earlier databases and results. This API integration uses a test device ID and does not demonstrate native remote desktop. The native Flutter/RustDesk integration, production signatures, complete installers, update installation/recovery and clean-machine Windows compatibility remain release requirements; this development build is not a production release.
diff --git a/deployment/windows/Migrate-WorkerCredential.ps1 b/deployment/windows/Migrate-WorkerCredential.ps1
new file mode 100644
index 00000000000..3e7ea546efe
--- /dev/null
+++ b/deployment/windows/Migrate-WorkerCredential.ps1
@@ -0,0 +1,108 @@
+[CmdletBinding(SupportsShouldProcess=$true)]
+param([Parameter(Mandatory=$true)][string]$Executable,
+      [Parameter(Mandatory=$true)][string]$PreviousConfigurationPath,
+      [Parameter(Mandatory=$true)][string]$ConfigurationPath,
+      [Parameter(Mandatory=$true)][ValidatePattern('^[A-Fa-f0-9]{40}$')][string]$PublisherThumbprint)
+$ErrorActionPreference='Stop'
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+if(!([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Worker migration requires administrator rights.'}
+$install=[IO.Path]::GetFullPath((Join-Path $env:ProgramFiles 'Swan Installer Worker'))
+$data=[IO.Path]::GetFullPath((Join-Path $env:ProgramData 'SwanInstallerWorker'))
+$destination=Join-Path $install 'swan-worker.exe';$receiptPath=Join-Path $data 'installation.json'
+$configurationFile=Join-Path $data 'worker.json';$journal=Join-Path $data 'credential-migration.json'
+$source=(Resolve-Path -LiteralPath $Executable).Path
+foreach($path in @($env:ProgramFiles,$env:ProgramData,$install,$data,$destination,$receiptPath,$source)){
+ if((Get-Item -LiteralPath $path -Force).Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Worker migration paths must not be reparse points.'}
+}
+if((Test-Path -LiteralPath $journal) -or (Test-Path -LiteralPath $configurationFile)){throw 'Migration state already exists; preserve it for explicit recovery.'}
+$service=Get-CimInstance Win32_Service -Filter "Name='SwanInstallerWorker'"
+if(!$service -or $service.PathName -cne ('"'+$destination+'" --service') -or $service.StartName -notin @('LocalSystem','NT AUTHORITY\SYSTEM') -or $service.State -ne 'Stopped' -or $service.StartMode -ne 'Manual'){throw 'Inspect and stop the owned legacy worker, with manual startup, before migration.'}
+if(@(Get-CimInstance Win32_Process|Where-Object {$_.ExecutablePath -ieq $destination}).Count){throw 'An existing worker process remains alive.'}
+$installAcl=Get-Acl -LiteralPath $install
+if(!$installAcl.AreAccessRulesProtected -or $installAcl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Existing worker executable directory is not private.'}
+foreach($rule in $installAcl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){if($rule.AccessControlType -ne 'Allow' -or $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Existing worker executable directory grants unexpected access.'}}
+$receipt=Get-Content -LiteralPath $receiptPath -Raw|ConvertFrom-Json
+if($receipt.schema -ne 1 -or $receipt.service -cne 'SwanInstallerWorker' -or $receipt.executable_sha256 -ine (Get-FileHash -LiteralPath $destination).Hash){throw 'Legacy worker receipt or executable differs.'}
+foreach($item in @(@{path=$destination;pin=$receipt.publisher_thumbprint},@{path=$source;pin=$PublisherThumbprint})){
+ $signature=Get-AuthenticodeSignature -LiteralPath $item.path
+ if($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Thumbprint -ine $item.pin){throw 'Worker executable publisher verification failed.'}
+}
+$read=Join-Path $PSScriptRoot 'Read-WorkerConfiguration.ps1'
+try{
+ $previous=(& $read -Path $PreviousConfigurationPath -Scope input -Output pipeline)|ConvertFrom-Json
+ $next=(& $read -Path $ConfigurationPath -Scope input -Output pipeline)|ConvertFrom-Json
+}catch{throw 'Both worker configurations must be valid private local files.'}
+$fields=@('management_url','worker_token','release_public_key','profile_public_key')
+foreach($configuration in @($previous,$next)){
+ if(@($configuration.PSObject.Properties.Name).Count -ne 4 -or @($configuration.PSObject.Properties.Name|Where-Object {$_ -notin $fields}).Count){throw 'Worker configurations must contain exactly the documented fields.'}
+ foreach($field in $fields){if($configuration.$field -isnot [string] -or [string]::IsNullOrWhiteSpace($configuration.$field)){throw 'Worker configuration fields must be strings.'}}
+ if($configuration.worker_token -cnotmatch '^[\x21-\x7E]{32,256}$'){throw 'Invalid worker credential format.'}
+}
+foreach($field in @('management_url','release_public_key','profile_public_key')){if($previous.$field -cne $next.$field){throw 'Credential migration must retain the existing company and trust keys.'}}
+if($previous.worker_token -ceq $next.worker_token){throw 'Revoke the legacy registration and obtain a new credential.'}
+$uri=$null
+if(![Uri]::TryCreate($next.management_url,[UriKind]::Absolute,[ref]$uri) -or $uri.Scheme -cne 'https' -or !$uri.Host -or $uri.UserInfo -or $uri.Query -or $uri.Fragment){throw 'Worker migration requires the existing company HTTPS origin.'}
+# A receipt or operator assertion is insufficient: confirm that the real HTTPS
+# server rejects the actual old credential. Never disable TLS validation.
+[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12
+$request=[Net.HttpWebRequest]::Create($next.management_url.TrimEnd('/')+'/api/v1/worker/recipe')
+$request.Method='GET';$request.AllowAutoRedirect=$false;$request.Timeout=15000;$request.ReadWriteTimeout=15000
+$request.Headers['Authorization']='Bearer '+$previous.worker_token
+$rejected=$false
+try{$response=$request.GetResponse();$response.Close()}catch [Net.WebException]{
+ if($_.Exception.Response){try{$rejected=[int]$_.Exception.Response.StatusCode -eq 401}finally{$_.Exception.Response.Close()}}
+}
+if(!$rejected){throw 'Company HTTPS endpoint did not confirm rejection of the legacy credential; no files changed.'}
+$request=[Net.HttpWebRequest]::Create($next.management_url.TrimEnd('/')+'/api/v1/worker/recipe')
+$request.Method='GET';$request.AllowAutoRedirect=$false;$request.Timeout=15000;$request.ReadWriteTimeout=15000
+$request.Headers['Authorization']='Bearer '+$next.worker_token
+$accepted=$false
+try{$response=$request.GetResponse();try{$accepted=[int]$response.StatusCode -eq 200}finally{$response.Close()}}catch [Net.WebException]{if($_.Exception.Response){$_.Exception.Response.Close()}}
+if(!$accepted){throw 'Company HTTPS endpoint did not accept the replacement worker credential; no files changed.'}
+if(!$PSCmdlet.ShouldProcess('SwanInstallerWorker','Preserve the stopped legacy installation and migrate to a new private-file credential')){return}
+# Inspect every retained object without changing its permissions. Only an owned
+# private installation may be migrated; public or linked state needs investigation.
+& (Join-Path $PSScriptRoot 'Prepare-CustomerDirectory.ps1') -Directory $data -Scope worker -Existing allow
+$backup=Join-Path $install ('legacy-'+[Guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $backup|Out-Null
+Copy-Item -LiteralPath $destination -Destination (Join-Path $backup 'swan-worker.exe')
+Copy-Item -LiteralPath $receiptPath -Destination (Join-Path $backup 'installation.json')
+if((Get-FileHash (Join-Path $backup 'swan-worker.exe')).Hash -ine $receipt.executable_sha256){throw 'Legacy preservation hash differs; keep the service stopped.'}
+$record=[ordered]@{schema=1;utc=[DateTime]::UtcNow.ToString('o');phase='preserved';legacy_directory=$backup;legacy_credential_rejected=$true;replacement_sha256=(Get-FileHash $source).Hash;artifacts_retained=$true}
+$record|ConvertTo-Json|Set-Content -LiteralPath $journal
+try{
+ $key=[Microsoft.Win32.Registry]::LocalMachine.OpenSubKey('SYSTEM\CurrentControlSet\Services\SwanInstallerWorker',$true)
+ if(!$key){throw 'Worker service registry disappeared.'}
+ try{$key.SetValue('Environment',[string[]]@("SWAN_WORKER_CONFIG=$configurationFile"),[Microsoft.Win32.RegistryValueKind]::MultiString)}finally{$key.Close()}
+ # The retained root is private. Seal the empty file before writing secret bytes.
+ $stream=[IO.FileStream]::new($configurationFile,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+ try{
+  $acl=[Security.AccessControl.FileSecurity]::new();$acl.SetOwner([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'));$acl.SetAccessRuleProtection($true,$false)
+  foreach($sid in @('S-1-5-18','S-1-5-32-544')){$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),'FullControl','Allow'))}
+  Set-Acl -LiteralPath $configurationFile -AclObject $acl
+  $actual=Get-Acl -LiteralPath $configurationFile
+  if(!$actual.AreAccessRulesProtected -or $actual.GetOwner([Security.Principal.SecurityIdentifier]).Value -cne 'S-1-5-32-544'){throw 'Replacement configuration is not private.'}
+  foreach($rule in $actual.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])){if($rule.AccessControlType -ne 'Allow' -or $rule.IdentityReference.Value -notin @('S-1-5-18','S-1-5-32-544')){throw 'Unexpected configuration access; no credential written.'}}
+  $canonical=[ordered]@{};foreach($field in $fields){$canonical[$field]=$next.$field}
+  $bytes=[Text.UTF8Encoding]::new($false).GetBytes(($canonical|ConvertTo-Json -Compress));$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)
+ }finally{$stream.Dispose()}
+ Copy-Item -LiteralPath $source -Destination $destination -Force
+ if((Get-FileHash $destination).Hash -cne $record.replacement_sha256){throw 'Replacement executable changed.'}
+ $signature=Get-AuthenticodeSignature $destination
+ if($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Thumbprint -ine $PublisherThumbprint){throw 'Replacement publisher changed.'}
+ $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=$destination;$start.Arguments='check-configuration';$start.UseShellExecute=$false;$start.CreateNoWindow=$true
+ foreach($name in @('SWAN_WORKER_TOKEN','SWAN_MANAGEMENT_URL','SWAN_RELEASE_PUBLIC_KEY','SWAN_PROFILE_PUBLIC_KEY','SWAN_ARTIFACT_DIR')){[void]$start.EnvironmentVariables.Remove($name)}
+ $start.EnvironmentVariables['SWAN_WORKER_CONFIG']=$configurationFile
+ $process=[Diagnostics.Process]::Start($start)
+ try{if(!$process.WaitForExit(300000)){$process.Kill();$process.WaitForExit();throw 'Configuration verification timed out.'};if($process.ExitCode -ne 0){throw 'Compiled worker rejected replacement configuration.'}}finally{$process.Dispose()}
+ $record.phase='validated';$record|ConvertTo-Json|Set-Content -LiteralPath $journal
+ @{schema=2;service='SwanInstallerWorker';executable_sha256=$record.replacement_sha256;publisher_thumbprint=$PublisherThumbprint;configuration_path=$configurationFile}|ConvertTo-Json|Set-Content -LiteralPath $receiptPath
+ Start-Service SwanInstallerWorker;(Get-Service SwanInstallerWorker).WaitForStatus('Running',[TimeSpan]::FromSeconds(30))
+ Set-Service SwanInstallerWorker -StartupType Automatic
+ $record.phase='started';$record|ConvertTo-Json|Set-Content -LiteralPath $journal
+}catch{
+ Stop-Service SwanInstallerWorker -ErrorAction Continue;Set-Service SwanInstallerWorker -StartupType Manual
+ Write-Warning 'Migration failed. Preserve files and journal; the legacy credential remains revoked and the old worker will not be restarted.'
+ throw
+}
+Write-Host 'Private-file worker migration started. Verify authenticated build completion and reboot before qualification. Legacy files and artifacts remain retained.'
diff --git a/deployment/windows/New-LocalTestVm.ps1 b/deployment/windows/New-LocalTestVm.ps1
new file mode 100644
index 00000000000..874924bc19d
--- /dev/null
+++ b/deployment/windows/New-LocalTestVm.ps1
@@ -0,0 +1,38 @@
+param([Parameter(Mandatory=$true)][string]$EnvironmentFile,[switch]$Resume)
+$ErrorActionPreference = 'Stop'
+# Machine paths belong in an untracked file. Never evaluate its contents as code.
+$settings = @{}
+$allowed = @('SWAN_VM_LAB_ROOT','SWAN_QEMU_DIRECTORY','SWAN_VM_ISO',
+    'SWAN_VM_NAME','SWAN_VM_MEMORY_MIB','SWAN_VM_ACCELERATOR')
+foreach ($line in [IO.File]::ReadAllLines([IO.Path]::GetFullPath($EnvironmentFile))) {
+    if ([string]::IsNullOrWhiteSpace($line) -or $line.TrimStart().StartsWith('#')) { continue }
+    $parts = $line.Split('=',2)
+    if ($parts.Length -ne 2 -or $allowed -notcontains $parts[0]) { throw 'Invalid VM environment entry' }
+    if ($settings.ContainsKey($parts[0])) { throw 'Duplicate VM environment entry' }
+    $settings[$parts[0]] = $parts[1]
+}
+foreach ($key in $allowed) {
+    if ([string]::IsNullOrWhiteSpace($settings[$key])) { throw "Missing VM setting: $key" }
+}
+$iso = Get-Item -LiteralPath $settings['SWAN_VM_ISO']
+$completionPath = $iso.FullName + '.download-complete.json'
+if (-not (Test-Path -LiteralPath $completionPath -PathType Leaf)) {
+    throw 'Evaluation ISO has no completed-download record; wait for a successful download before creating the guest'
+}
+$completion = Get-Content -LiteralPath $completionPath -Raw | ConvertFrom-Json
+if ($completion.bytes -ne $iso.Length -or $completion.sha256 -notmatch '^[a-fA-F0-9]{64}$') {
+    throw 'Invalid evaluation ISO completion record'
+}
+if ((Get-FileHash -LiteralPath $iso.FullName -Algorithm SHA256).Hash -ne $completion.sha256) {
+    throw 'Evaluation ISO changed after download completion'
+}
+$parameters = @{
+    QemuDirectory = $settings['SWAN_QEMU_DIRECTORY']
+    IsoPath = $settings['SWAN_VM_ISO']
+    LabDirectory = $settings['SWAN_VM_LAB_ROOT']
+    Name = $settings['SWAN_VM_NAME']
+    MemoryMiB = [int]$settings['SWAN_VM_MEMORY_MIB']
+    Accelerator = $settings['SWAN_VM_ACCELERATOR']
+}
+$script = if ($Resume) { 'Start-TestVm.ps1' } else { 'New-TestVm.ps1' }
+& (Join-Path $PSScriptRoot $script) @parameters
diff --git a/deployment/windows/New-TestVm.ps1 b/deployment/windows/New-TestVm.ps1
new file mode 100644
index 00000000000..e9ba1bfa0a6
--- /dev/null
+++ b/deployment/windows/New-TestVm.ps1
@@ -0,0 +1,42 @@
+param(
+    [Parameter(Mandatory=$true)][string]$QemuDirectory,
+    [Parameter(Mandatory=$true)][string]$IsoPath,
+    [Parameter(Mandatory=$true)][string]$LabDirectory,
+    [ValidatePattern('^[a-z0-9-]+$')][string]$Name = 'server-2025',
+    [ValidateSet('whpx','whpx-userspace','whpx-baseline','tcg')][string]$Accelerator = 'whpx',
+    [ValidateRange(2048,8192)][int]$MemoryMiB = 4096,
+    [ValidateRange(32,128)][int]$DiskGiB = 64
+)
+$ErrorActionPreference = 'Stop'
+$qemu = Join-Path $QemuDirectory 'qemu-system-x86_64.exe'
+$qemuImg = Join-Path $QemuDirectory 'qemu-img.exe'
+foreach ($required in @($qemu,$qemuImg,$IsoPath)) {
+    if (-not (Test-Path -LiteralPath $required -PathType Leaf)) { throw "Missing file: $required" }
+}
+$lab = [IO.Path]::GetFullPath($LabDirectory)
+$vm = [IO.Path]::GetFullPath((Join-Path $lab $Name))
+if (-not $vm.StartsWith($lab.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)) {
+    throw 'VM directory must stay within the test lab'
+}
+if (Test-Path -LiteralPath $vm) { throw 'VM already exists; refusing to overwrite its disk' }
+$availableMiB = (Get-CimInstance Win32_OperatingSystem).FreePhysicalMemory / 1024
+if ($availableMiB -lt ($MemoryMiB + 1536)) { throw 'Insufficient available memory; leave at least 1.5 GiB for the host' }
+New-Item -ItemType Directory -Path $vm | Out-Null
+$disk = Join-Path $vm 'system.qcow2'
+& $qemuImg create -f qcow2 $disk ($DiskGiB.ToString()+'G')
+if ($LASTEXITCODE -ne 0) { throw 'QEMU disk creation failed' }
+$acceleratorOption = if ($Accelerator -in @('whpx-userspace','whpx-baseline')) { 'whpx,hyperv=off,kernel-irqchip=off' } else { $Accelerator }
+$cpuModel = if ($Accelerator -eq 'whpx-baseline') { 'Westmere-v2' } elseif ($Accelerator -eq 'tcg') { 'max' } else { 'host' }
+$arguments = @('-name',$Name,'-machine','q35','-accel',$acceleratorOption,
+    '-cpu',$cpuModel,'-m',$MemoryMiB.ToString(),'-smp','2','-drive',"file=$disk,format=qcow2",
+    '-cdrom',[IO.Path]::GetFullPath($IsoPath),'-boot','order=d',
+    '-nic','user,model=e1000','-display','none',
+    '-vnc','127.0.0.1:20','-monitor','tcp:127.0.0.1:4444,server=on,wait=off')
+# User-mode NAT avoids host firewall/bridge changes. Management sockets are loopback only.
+# Only one guest may use these ports at a time. No incoming guest ports are forwarded.
+[ordered]@{name=$Name;disk=$disk;iso=[IO.Path]::GetFullPath($IsoPath);
+    accelerator=$Accelerator;arguments=$arguments;created_utc=[DateTime]::UtcNow.ToString('o')
+} | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath (Join-Path $vm 'vm.json') -Encoding UTF8
+# Launch through PowerShell's native argument passing rather than string-built shell code.
+& $qemu @arguments
+if ($LASTEXITCODE -ne 0) { throw "QEMU exited with code $LASTEXITCODE; inspect acceleration availability before retrying" }
diff --git a/deployment/windows/Open-Technician.ps1 b/deployment/windows/Open-Technician.ps1
new file mode 100644
index 00000000000..c8cf2d9d44d
--- /dev/null
+++ b/deployment/windows/Open-Technician.ps1
@@ -0,0 +1,47 @@
+[CmdletBinding()]
+param()
+$ErrorActionPreference = 'Stop'
+$env:SWAN_STATE_DIR = Join-Path $env:LOCALAPPDATA 'SwanRemoteSupport-Technician'
+$agent = Join-Path $env:SWAN_STATE_DIR 'swan-agent.exe'
+if ((Get-AuthenticodeSignature -LiteralPath $agent).Status -ne 'Valid') { throw 'Technician agent requires a valid signature.' }
+# Windows PowerShell turns redirected native stderr into terminating errors under
+# Stop. Observe the actual process exit so an offline sync can use cached branding.
+$syncStart = [Diagnostics.ProcessStartInfo]::new()
+$syncStart.FileName = $agent
+$syncStart.Arguments = 'sync'
+$syncStart.UseShellExecute = $false
+$syncStart.CreateNoWindow = $true
+$syncProcess = [Diagnostics.Process]::Start($syncStart)
+try {
+    $syncProcess.WaitForExit()
+    $syncExit = $syncProcess.ExitCode
+} finally { $syncProcess.Dispose() }
+if ($syncExit -ne 0) { Write-Warning 'Company server unavailable. Cached branding can be displayed; authorization still requires valid company policy.' }
+$portable = Join-Path $env:SWAN_STATE_DIR 'SwanRemoteSupport-Technician.exe'
+if (-not (Test-Path -LiteralPath $portable)) {
+    throw 'Technician application is not installed. Run the company installation bundle.'
+}
+& $agent verify-installed
+if ($LASTEXITCODE -ne 0) { throw 'Technician installed identity or pinned publisher verification failed.' }
+# Login, inventory and ticket creation take place in the graphical application.
+# No password, MFA code, token or grant is passed in process arguments/environment.
+# The portable GUI wrapper can abort with invalid inherited console handles in
+# a hidden Windows PowerShell session. Supply real pipes and drain both streams.
+# Keep the readers alive until the spawned application's inherited pipes close.
+$portableStart = [Diagnostics.ProcessStartInfo]::new()
+$portableStart.FileName = $portable
+$portableStart.WorkingDirectory = $env:SWAN_STATE_DIR
+$portableStart.UseShellExecute = $false
+$portableStart.RedirectStandardInput = $true
+$portableStart.RedirectStandardOutput = $true
+$portableStart.RedirectStandardError = $true
+$portableProcess = [Diagnostics.Process]::Start($portableStart)
+try {
+    $portableProcess.StandardInput.Close()
+    $output = $portableProcess.StandardOutput.ReadToEndAsync()
+    $errors = $portableProcess.StandardError.ReadToEndAsync()
+    $portableProcess.WaitForExit()
+    if ($portableProcess.ExitCode -ne 0) { throw 'Technician application could not start.' }
+    $null = $output.GetAwaiter().GetResult()
+    $null = $errors.GetAwaiter().GetResult()
+} finally { $portableProcess.Dispose() }
diff --git a/deployment/windows/Prepare-CustomerDirectory.ps1 b/deployment/windows/Prepare-CustomerDirectory.ps1
new file mode 100644
index 00000000000..96c9a03ac95
--- /dev/null
+++ b/deployment/windows/Prepare-CustomerDirectory.ps1
@@ -0,0 +1,75 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Directory,[ValidateSet('canonical','custom','server','worker')][string]$Scope='canonical',
+      [ValidateSet('allow','reject')][string]$Existing='allow')
+$ErrorActionPreference='Stop'
+function Assert-CustomerAcl {
+    param([Parameter(Mandatory=$true)]$Acl)
+    $allowed=@('S-1-5-18','S-1-5-32-544')
+    if ($Acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'Customer state has an untrusted owner. Preserve and investigate it before setup.' }
+    $rules=$Acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])
+    foreach($rule in $rules) {
+        if ($rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow -or $rule.IdentityReference.Value -notin $allowed) { throw 'Customer state permissions are not restricted to SYSTEM and Administrators.' }
+    }
+    foreach($sid in $allowed) {
+        if (@($rules|Where-Object {$_.IdentityReference.Value -eq $sid -and ($_.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl}).Count -eq 0) { throw 'Customer state requires full control for SYSTEM and Administrators.' }
+    }
+}
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+if (-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Customer state preparation requires administrator rights.' }
+$Directory=[IO.Path]::GetFullPath($Directory).TrimEnd('\')
+if ($Directory -eq [IO.Path]::GetPathRoot($Directory).TrimEnd('\')) { throw 'A volume root is not a customer state directory.' }
+$expected=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) $(if($Scope -eq 'server'){'SwanCompanyServer'}elseif($Scope -eq 'worker'){'SwanInstallerWorker'}else{'SwanRemoteSupport'})
+if ($Scope -ne 'custom' -and $Directory -ine [IO.Path]::GetFullPath($expected)) { throw 'Setup requires the canonical state directory.' }
+$descriptor=[Security.AccessControl.DirectorySecurity]::new()
+$descriptor.SetOwner([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))
+$descriptor.SetAccessRuleProtection($true,$false)
+foreach($sid in @('S-1-5-18','S-1-5-32-544')) {
+    $descriptor.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),'FullControl','ContainerInherit,ObjectInherit','None','Allow'))
+}
+if(Test-Path -LiteralPath $Directory){
+    if($Existing -eq 'reject'){throw 'State directory already exists; preserve it and use the recovery procedure.'}
+    $existingItem=Get-Item -LiteralPath $Directory -Force
+    if(-not $existingItem.PSIsContainer -or ($existingItem.Attributes -band [IO.FileAttributes]::ReparsePoint)){throw 'Customer state directory is unsafe.'}
+    Assert-CustomerAcl (Get-Acl -LiteralPath $Directory)
+}
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+public static class SwanCustomerDirectoryLock {
+    [StructLayout(LayoutKind.Sequential)]
+    private struct SecurityAttributes { public int Length; public IntPtr Descriptor; [MarshalAs(UnmanagedType.Bool)] public bool Inherit; }
+    [DllImport("kernel32.dll", EntryPoint="CreateDirectoryW", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern bool CreateDirectory(string path,ref SecurityAttributes security);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFile(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    public static int Create(string path,byte[] descriptor) {
+        GCHandle pinned=GCHandle.Alloc(descriptor,GCHandleType.Pinned);
+        try {
+            SecurityAttributes security=new SecurityAttributes { Length=Marshal.SizeOf(typeof(SecurityAttributes)), Descriptor=pinned.AddrOfPinnedObject(), Inherit=false };
+            return CreateDirectory(path,ref security) ? 0 : Marshal.GetLastWin32Error();
+        } finally { pinned.Free(); }
+    }
+    public static SafeFileHandle Open(string path) { return CreateFile(path,0x80000000,1,IntPtr.Zero,3,0x02200000,IntPtr.Zero); }
+}
+'@
+# CreateDirectoryW applies security atomically only to a new directory. An
+# existing object is inspected, never adopted by changing its owner or ACL.
+$created=[SwanCustomerDirectoryLock]::Create($Directory,$descriptor.GetSecurityDescriptorBinaryForm())
+if($created -eq 183 -and $Existing -eq 'reject'){throw 'State directory appeared during setup; preserve it and investigate before retrying.'}
+if($created -notin @(0,183)){throw ([ComponentModel.Win32Exception]::new($created))}
+# Sharing only read access rejects a pre-existing writable directory handle;
+# do not race a user who opened the directory before permissions were secured.
+$handle=[SwanCustomerDirectoryLock]::Open($Directory)
+if ($handle.IsInvalid) { $handle.Dispose();throw 'Customer state directory is in use or cannot be inspected safely.' }
+try {
+    $pending=[Collections.Generic.Stack[string]]::new();$pending.Push($Directory);$count=0
+    while($pending.Count) {
+        $path=$pending.Pop();$item=Get-Item -LiteralPath $path -Force
+        if($path -eq $Directory -and -not $item.PSIsContainer){throw 'Customer state must be a directory.'}
+        if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'Customer state must not contain reparse points.' }
+        Assert-CustomerAcl (Get-Acl -LiteralPath $path)
+        $count++;if($count -gt 10000){throw 'Customer state inspection limit exceeded.'}
+        if($item.PSIsContainer){foreach($child in @(Get-ChildItem -LiteralPath $path -Force)){$pending.Push($child.FullName)}}
+    }
+} finally { $handle.Dispose() }
diff --git a/deployment/windows/Prepare-ServerComponents.ps1 b/deployment/windows/Prepare-ServerComponents.ps1
new file mode 100644
index 00000000000..f1ad3ee195d
--- /dev/null
+++ b/deployment/windows/Prepare-ServerComponents.ps1
@@ -0,0 +1,16 @@
+[CmdletBinding(DefaultParameterSetName='Package')]
+param(
+    [Parameter(Mandatory,ParameterSetName='Package')][string]$TransportPackage,
+    [Parameter(Mandatory,ParameterSetName='Directory')][string]$TransportDirectory,
+    [Parameter(Mandatory)][string]$HttpsPackage,
+    [Parameter(Mandatory)][string]$OutputDirectory,
+    [string]$PythonExecutable='python'
+)
+$ErrorActionPreference='Stop'
+$verifier=Join-Path $PSScriptRoot '../transport/prepare_windows_components.py'
+$arguments=@($verifier,'--https-package',$HttpsPackage,'--output',$OutputDirectory)
+if($PSCmdlet.ParameterSetName -eq 'Package'){$arguments+=@('--transport-package',$TransportPackage)}else{$arguments+=@('--transport-directory',$TransportDirectory)}
+$result=& $PythonExecutable @arguments
+if($LASTEXITCODE -ne 0){throw 'Maintained transport or HTTPS verification failed; preserve any partial output for inspection.'}
+$result|Set-Content -LiteralPath (Join-Path $OutputDirectory 'component-verification.json')
+Write-Output ([IO.Path]::GetFullPath($OutputDirectory))
diff --git a/deployment/windows/Read-WorkerConfiguration.ps1 b/deployment/windows/Read-WorkerConfiguration.ps1
new file mode 100644
index 00000000000..fc074e218bc
--- /dev/null
+++ b/deployment/windows/Read-WorkerConfiguration.ps1
@@ -0,0 +1,63 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Path,[ValidateSet('installed','input')][string]$Scope='installed',
+      [ValidateSet('console','pipeline')][string]$Output='console')
+$ErrorActionPreference='Stop';$ProgressPreference='SilentlyContinue'
+$root=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanInstallerWorker'
+$expected=Join-Path $root 'worker.json'
+if($Scope -eq 'installed') {
+ if([IO.Path]::GetFullPath($Path) -ine [IO.Path]::GetFullPath($expected)){throw 'Use the canonical private worker configuration.'}
+ $allowed=@('S-1-5-18','S-1-5-32-544')
+} else {
+ $identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+ if(!([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Private worker configuration installation requires administrator rights.'}
+ $expected=[IO.Path]::GetFullPath($Path)
+ if($expected.StartsWith('\\')){throw 'Use a private local worker configuration file.'}
+ $root=Split-Path -Parent $expected
+ $allowed=@('S-1-5-18','S-1-5-32-544',$identity.User.Value)|Select-Object -Unique
+}
+foreach($item in @((Split-Path -Parent $root),$root,$expected)){
+ if((Get-Item -LiteralPath $item -Force).Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Worker configuration paths must not be reparse points.'}
+}
+if(-not ('SwanWorkerConfigurationHandle' -as [type])){Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+public static class SwanWorkerConfigurationHandle {
+    [DllImport("kernel32.dll", EntryPoint="CreateFileW", CharSet=CharSet.Unicode, SetLastError=true)]
+    private static extern SafeFileHandle CreateFile(string path,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr template);
+    public static SafeFileHandle Open(string path,bool directory) {
+        return CreateFile(path,0x80000000,1,IntPtr.Zero,3,0x00200000|(directory?0x02000000u:0u),IntPtr.Zero);
+    }
+}
+'@
+}
+$directory=[SwanWorkerConfigurationHandle]::Open($root,$true)
+if($directory.IsInvalid){$directory.Dispose();throw 'Private worker directory is unavailable or in use.'}
+$fileHandle=$null;$stream=$null;$reader=$null
+try {
+ $fileHandle=[SwanWorkerConfigurationHandle]::Open($expected,$false)
+ if($fileHandle.IsInvalid){throw 'Private worker configuration is unavailable or in use.'}
+ foreach($item in @($root,$expected)){
+  $info=Get-Item -LiteralPath $item -Force
+  if($info.Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Worker configuration path changed to a reparse point.'}
+  $acl=Get-Acl -LiteralPath $item
+  if($Scope -eq 'installed' -and !$acl.AreAccessRulesProtected){throw 'Installed worker configuration must not inherit public permissions.'}
+  if($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed){throw 'Private worker configuration has an untrusted owner.'}
+  $rules=$acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])
+  foreach($rule in $rules){if($rule.AccessControlType -ne 'Allow' -or $rule.IdentityReference.Value -notin $allowed){throw 'Private worker configuration grants unexpected access. Revoke credentials previously stored in a public location.'}}
+  foreach($sid in @('S-1-5-18','S-1-5-32-544')){if(@($rules|Where-Object {$_.IdentityReference.Value -eq $sid -and ($_.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl}).Count -eq 0){throw 'Private worker configuration needs SYSTEM and Administrators access.'}}
+ }
+ if(!(Get-Item -LiteralPath $root).PSIsContainer -or (Get-Item -LiteralPath $expected).PSIsContainer){throw 'Invalid worker configuration object type.'}
+ $stream=[IO.FileStream]::new($fileHandle,[IO.FileAccess]::Read)
+ if($stream.Length -lt 1 -or $stream.Length -gt 16384){throw 'Invalid private worker configuration size.'}
+ $reader=[IO.StreamReader]::new($stream,[Text.UTF8Encoding]::new($false,$true),$true)
+ $content=$reader.ReadToEnd()
+ if($Output -eq 'pipeline'){Write-Output $content}else{
+  [Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+  [Console]::Write($content)
+ }
+} finally {
+ if($reader){$reader.Dispose()}elseif($stream){$stream.Dispose()}
+ if($fileHandle){$fileHandle.Dispose()}
+ $directory.Dispose()
+}
diff --git a/deployment/windows/Record-MsvcToolchain.ps1 b/deployment/windows/Record-MsvcToolchain.ps1
new file mode 100644
index 00000000000..aab401a131f
--- /dev/null
+++ b/deployment/windows/Record-MsvcToolchain.ps1
@@ -0,0 +1,44 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Output)
+$ErrorActionPreference='Stop'
+if(Test-Path -LiteralPath $Output){throw 'Preserve existing toolchain identity'}
+$vswhere=Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+$installations=(& $vswhere -latest -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -format json|Out-String)|ConvertFrom-Json
+if($LASTEXITCODE -ne 0 -or @($installations).Count -ne 1){throw 'One selected MSVC installation required'}
+$installation=@($installations)[0]
+$versionFile=Join-Path $installation.installationPath 'VC\Auxiliary\Build\Microsoft.VCToolsVersion.default.txt'
+$version=[IO.File]::ReadAllText($versionFile).Trim()
+if($version -notmatch '^14\.[0-9]+\.[0-9]+$'){throw 'Unexpected default MSVC toolset version'}
+$root=Join-Path $installation.installationPath ('VC\Tools\MSVC\'+$version)
+$records=@()
+foreach($directory in @('include','lib\x64','bin\Hostx64\x64')){
+ $path=Join-Path $root $directory
+ if(-not(Test-Path -LiteralPath $path -PathType Container)){throw 'Required compiler input directory missing'}
+ foreach($file in Get-ChildItem -LiteralPath $path -File -Recurse|Sort-Object FullName){
+  if(($file.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0){throw 'Unexpected toolchain reparse file'}
+  $relative=$file.FullName.Substring($root.Length+1).Replace('\','/')
+  $records+=@{path=$relative;bytes=$file.Length;sha256=(Get-FileHash -LiteralPath $file.FullName -Algorithm SHA256).Hash.ToLowerInvariant()}
+ }
+}
+foreach($required in @('bin/Hostx64/x64/cl.exe','bin/Hostx64/x64/c1xx.dll','bin/Hostx64/x64/c2.dll','bin/Hostx64/x64/link.exe','include/typeinfo','include/memory')){
+ if(-not @($records|Where-Object {$_.path -ceq $required}).Count){throw ('Required compiler input missing: '+$required)}
+}
+$byPath=@{}
+foreach($record in $records){
+ if($byPath.ContainsKey($record.path)){throw 'Duplicate compiler input path'}
+ $byPath[$record.path]=$record
+}
+$orderedPaths=[string[]]@($byPath.Keys)
+[Array]::Sort($orderedPaths,[StringComparer]::Ordinal)
+$records=@($orderedPaths|ForEach-Object {$byPath[$_]})
+$canonical=(@($records|ForEach-Object {$_.path+"`0"+$_.sha256}) -join "`n")+"`n"
+$hasher=[Security.Cryptography.SHA256]::Create()
+try{$digest=([BitConverter]::ToString($hasher.ComputeHash([Text.Encoding]::UTF8.GetBytes($canonical)))).Replace('-','').ToLowerInvariant()}finally{$hasher.Dispose()}
+@{
+ scope='Default MSVC x64 compiler, library and header identity; SDK and actual generated compiler commands require separate evidence'
+ visual_studio_version=$installation.installationVersion
+ toolset_directory_version=$version
+ input_identity_sha256=$digest
+ files=$records
+}|ConvertTo-Json -Depth 5|Set-Content -LiteralPath $Output -Encoding UTF8
+Write-Output ('Recorded '+$records.Count+' MSVC inputs; identity '+$digest)
diff --git a/deployment/windows/Remove-Configuration.ps1 b/deployment/windows/Remove-Configuration.ps1
new file mode 100644
index 00000000000..760b5f9baa3
--- /dev/null
+++ b/deployment/windows/Remove-Configuration.ps1
@@ -0,0 +1,19 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Directory)
+$ErrorActionPreference = 'Stop'
+$expectedAgent = [IO.Path]::GetFullPath((Join-Path $Directory 'swan-agent.exe'))
+$rollbackPath = Join-Path $Directory 'configuration-task-rollback.json'
+if (Test-Path -LiteralPath $rollbackPath) { Remove-Item -LiteralPath $rollbackPath }
+$tasks = @(Get-ScheduledTask | Where-Object { $_.TaskName -eq 'Swan Company Configuration' })
+if ($tasks.Count -eq 0) { return }
+if ($tasks.Count -ne 1) { throw 'Ambiguous company configuration task.' }
+$task = $tasks[0]
+if ($task.Actions.Count -ne 1 -or [IO.Path]::GetFullPath($task.Actions[0].Execute) -ine $expectedAgent -or $task.Actions[0].Arguments -cne 'watch' -or $task.Principal.UserId -notin @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) {
+    throw 'Configuration task does not belong to this installation.'
+}
+@{enabled=($task.State -ne 'Disabled');running=($task.State -eq 'Running')} | ConvertTo-Json | Set-Content -LiteralPath $rollbackPath -Encoding UTF8
+$task | Disable-ScheduledTask | Out-Null
+$task | Stop-ScheduledTask
+$task | Unregister-ScheduledTask -Confirm:$false
+# Preserve company identity and consent data for explicit repair/reinstallation.
+# MSI removes its owned agent binary after this action exits.
diff --git a/deployment/windows/Restart-Configuration.ps1 b/deployment/windows/Restart-Configuration.ps1
new file mode 100644
index 00000000000..2c389d2cee5
--- /dev/null
+++ b/deployment/windows/Restart-Configuration.ps1
@@ -0,0 +1,29 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Directory, [switch]$StopOnly)
+$ErrorActionPreference = 'Stop'
+$expectedAgent = [IO.Path]::GetFullPath((Join-Path $Directory 'swan-agent.exe'))
+if (-not $StopOnly -and (Get-AuthenticodeSignature -LiteralPath $expectedAgent).Status -ne 'Valid') { throw 'Installed agent cannot be restarted until its signature is valid.' }
+$deadline = [DateTime]::UtcNow.AddSeconds(30)
+$stopRequested = $false
+do {
+    $tasks = @(Get-ScheduledTask | Where-Object { $_.TaskName -eq 'Swan Company Configuration' })
+    if ($tasks.Count -ne 1) { throw 'Expected one company configuration task.' }
+    $task = $tasks[0]
+    if ($task.Actions.Count -ne 1 -or [IO.Path]::GetFullPath($task.Actions[0].Execute) -ine $expectedAgent -or $task.Actions[0].Arguments -cne 'watch' -or $task.Principal.UserId -notin @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) { throw 'Configuration task identity does not match this installation.' }
+    if ($task.State -ne 'Running') { break }
+    # An explicit update can be launched while the ordinary watcher is sleeping.
+    # Stop only the task whose exact action and SYSTEM identity were validated.
+    if (-not $stopRequested) { $task | Stop-ScheduledTask; $stopRequested = $true }
+    if ([DateTime]::UtcNow -ge $deadline) { throw 'Previous configuration task has not exited.' }
+    Start-Sleep -Milliseconds 100
+} while ($true)
+if ($StopOnly) { return }
+# Existing installations may still use Task Scheduler's background default.
+# Normalize only the validated task, after its previous instance has exited.
+if ($task.Settings.Priority -ne 4) {
+    $settings = $task.Settings
+    $settings.Priority = 4
+    Set-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -Settings $settings | Out-Null
+}
+$task | Enable-ScheduledTask | Out-Null
+$task | Start-ScheduledTask
diff --git a/deployment/windows/Restart-CustomerUi.ps1 b/deployment/windows/Restart-CustomerUi.ps1
new file mode 100644
index 00000000000..87a0a94f386
--- /dev/null
+++ b/deployment/windows/Restart-CustomerUi.ps1
@@ -0,0 +1,222 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$Directory,
+    [Parameter(Mandatory=$true)][string]$Executable,
+    [ValidateSet('prepare','restart','remove','uninstall')][string]$Operation='restart',
+    [string]$ExpectedHashes=''
+)
+$ErrorActionPreference='Stop'
+
+function Get-CustomerUiTaskName([string]$Prefix,[string]$Sid) {
+    $hash=[Security.Cryptography.SHA256]::Create()
+    try { $suffix=([BitConverter]::ToString($hash.ComputeHash([Text.Encoding]::UTF8.GetBytes($Sid)))).Replace('-','').Substring(0,16) } finally { $hash.Dispose() }
+    return $Prefix+$suffix
+}
+
+function Get-CustomerUiAction([string]$Path,[string]$Sid,[string]$TaskName) {
+    # These values come from the verified installation and OS token, never branding.
+    $wrapper=@'
+$ErrorActionPreference='Stop'
+if ([Security.Principal.WindowsIdentity]::GetCurrent().User.Value -cne '__SID__') { throw 'Customer UI account differs.' }
+foreach ($name in @('SWAN_STATE_DIR','SWAN_TECHNICIAN_TOKEN','SWAN_SESSION_GRANT','SWAN_SESSION_PROOF_KEY')) { [Environment]::SetEnvironmentVariable($name,$null,'Process') }
+Start-Process -FilePath '__EXE__' -WorkingDirectory '__PARENT__' | Out-Null
+$scheduler=New-Object -ComObject Schedule.Service
+$scheduler.Connect()
+$scheduler.GetFolder('\').DeleteTask('__TASK__',0)
+'@
+    foreach ($entry in @(@('__SID__',$Sid),@('__EXE__',$Path),@('__PARENT__',[IO.Path]::GetDirectoryName($Path)),@('__TASK__',$TaskName))) {
+        $wrapper=$wrapper.Replace($entry[0],$entry[1].Replace("'","''"))
+    }
+    $encoded=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($wrapper))
+    return New-ScheduledTaskAction -Execute ($env:SystemRoot+'/System32/WindowsPowerShell/v1.0/powershell.exe') -Argument ('-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand '+$encoded)
+}
+
+function Assert-CustomerUiTask($Task,$Action,[string]$Sid,$Registered) {
+    $principal=[string]$Task.Principal.UserId
+    $actual=if ($principal -match '^S-\d-') { ([Security.Principal.SecurityIdentifier]::new($principal)).Value } else { ([Security.Principal.NTAccount]::new($principal)).Translate([Security.Principal.SecurityIdentifier]).Value }
+    if ($Task.TaskPath -cne '\' -or $Task.Actions.Count -ne 1 -or $actual -cne $Sid -or $Task.Principal.LogonType -ne 'Interactive' -or $Task.Principal.RunLevel -ne 'Limited' -or [IO.Path]::GetFullPath($Task.Actions[0].Execute) -ine [IO.Path]::GetFullPath($Action.Execute) -or $Task.Actions[0].Arguments -cne $Action.Arguments) { throw 'Customer UI task belongs to another installation.' }
+    $security=[Security.AccessControl.RawSecurityDescriptor]::new($Registered.GetSecurityDescriptor(7))
+    if ($security.Owner.Value -cne 'S-1-5-18' -or $security.DiscretionaryAcl.Count -ne 3) { throw 'Customer UI task ownership differs.' }
+    $seen=@{}
+    foreach ($ace in $security.DiscretionaryAcl) {
+        if ($ace.AceType -ne [Security.AccessControl.AceType]::AccessAllowed -or $ace.AceFlags -ne [Security.AccessControl.AceFlags]::None) { throw 'Unexpected customer UI task permission.' }
+        $account=$ace.SecurityIdentifier.Value
+        if ($seen.ContainsKey($account)) { throw 'Duplicate customer UI task permission.' }
+        $seen[$account]=$true
+        if ($account -eq $Sid) {
+            # File generic read/execute and delete; no action write or ACL control.
+            if ($ace.AccessMask -ne 0x1300A9) { throw 'Customer UI task permits unexpected user changes.' }
+        } elseif ($account -in @('S-1-5-18','S-1-5-32-544')) {
+            if ($ace.AccessMask -ne 0x1F01FF) { throw 'Customer UI task system permissions differ.' }
+        } else { throw 'Unexpected customer UI task account.' }
+    }
+    if (!$seen.ContainsKey($Sid) -or !$seen.ContainsKey('S-1-5-18') -or !$seen.ContainsKey('S-1-5-32-544')) { throw 'Customer UI task permissions are incomplete.' }
+}
+
+function Stop-OwnedCustomerUi($Processes,[string]$Path) {
+    if (-not ('SwanCustomerUiProcess' -as [type])) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using System.Text;
+public static class SwanCustomerUiProcess {
+    [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, int pid);
+    [DllImport("kernel32.dll", SetLastError=true)] static extern bool CloseHandle(IntPtr handle);
+    [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetProcessTimes(IntPtr process, out long created, out long exited, out long kernel, out long user);
+    [DllImport("kernel32.dll", EntryPoint="QueryFullProcessImageNameW", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool QueryImage(IntPtr process, uint flags, StringBuilder path, ref int length);
+    [DllImport("advapi32.dll", SetLastError=true)] static extern bool OpenProcessToken(IntPtr process, uint access, out IntPtr token);
+    [DllImport("kernel32.dll", SetLastError=true)] static extern bool TerminateProcess(IntPtr process, uint code);
+    [DllImport("kernel32.dll", SetLastError=true)] static extern uint WaitForSingleObject(IntPtr process, uint milliseconds);
+    public static bool Stop(int pid, long expectedCreated, string expectedPath, string expectedSid) {
+        IntPtr process=OpenProcess(0x1000 | 0x0001 | 0x100000, false, pid);
+        if (process==IntPtr.Zero) {
+            int error=Marshal.GetLastWin32Error();
+            if (error==87 || error==1168) return false;
+            throw new Win32Exception(error);
+        }
+        try {
+            long created, exited, kernel, user;
+            if (!GetProcessTimes(process,out created,out exited,out kernel,out user)) throw new Win32Exception(Marshal.GetLastWin32Error());
+            // CIM creation times have microsecond precision; kernel FILETIME is finer.
+            if (created/10 != expectedCreated/10) throw new InvalidOperationException("Customer UI process creation differs.");
+            int length=32768; var path=new StringBuilder(length);
+            if (!QueryImage(process,0,path,ref length)) throw new Win32Exception(Marshal.GetLastWin32Error());
+            if (!String.Equals(path.ToString(),expectedPath,StringComparison.OrdinalIgnoreCase)) throw new InvalidOperationException("Customer UI executable differs.");
+            IntPtr token;
+            if (!OpenProcessToken(process,8,out token)) throw new Win32Exception(Marshal.GetLastWin32Error());
+            try { using(var identity=new WindowsIdentity(token)) {
+                if (identity.User==null || identity.User.Value!=expectedSid || identity.IsSystem) throw new InvalidOperationException("Customer UI account differs.");
+            }} finally { CloseHandle(token); }
+            if (WaitForSingleObject(process,0)==0) return false;
+            if (!TerminateProcess(process,0)) throw new Win32Exception(Marshal.GetLastWin32Error());
+            if (WaitForSingleObject(process,5000)!=0) throw new InvalidOperationException("Previous customer UI has not exited.");
+            return true;
+        } finally { CloseHandle(process); }
+    }
+}
+'@
+    }
+    foreach ($process in $Processes) {
+        [void][SwanCustomerUiProcess]::Stop($process.Pid,$process.Created.ToFileTimeUtc(),$Path,$process.Sid)
+    }
+}
+
+function Read-CustomerUiRecoveryTasks([string]$StateDirectory,[string]$Path) {
+    if (-not [Security.Principal.WindowsIdentity]::GetCurrent().IsSystem) { throw 'Customer UI recovery requires SYSTEM.' }
+    $directoryPath=[IO.Path]::GetFullPath($StateDirectory).TrimEnd('\')
+    $exe=[IO.Path]::GetFullPath($Path)
+    if ([IO.Path]::GetFileName($exe) -cne 'Swan Remote Support.exe') { throw 'Unexpected installed customer executable.' }
+    $hash=[Security.Cryptography.SHA256]::Create()
+    try { $identifier=([BitConverter]::ToString($hash.ComputeHash([Text.Encoding]::UTF8.GetBytes($directoryPath.ToLowerInvariant())))).Replace('-','').Substring(0,16) } finally { $hash.Dispose() }
+    $prefix='Swan Customer UI '+$identifier+' '
+    $scheduler=New-Object -ComObject Schedule.Service;$scheduler.Connect();$folder=$scheduler.GetFolder('\')
+    $pending=@{}
+    foreach ($task in @(Get-ScheduledTask | Where-Object { $_.TaskName.StartsWith($prefix,[StringComparison]::Ordinal) })) {
+        $principal=[string]$task.Principal.UserId
+        $sid=if ($principal -match '^S-\d-') { ([Security.Principal.SecurityIdentifier]::new($principal)).Value } else { ([Security.Principal.NTAccount]::new($principal)).Translate([Security.Principal.SecurityIdentifier]).Value }
+        if ($sid -eq 'S-1-5-18' -or $task.TaskName -cne (Get-CustomerUiTaskName $prefix $sid)) { throw 'Unexpected customer UI recovery task.' }
+        $action=Get-CustomerUiAction $exe $sid $task.TaskName
+        Assert-CustomerUiTask $task $action $sid ($folder.GetTask($task.TaskName))
+        if ($pending.ContainsKey($sid)) { throw 'Ambiguous customer UI recovery task.' }
+        $pending[$sid]=$task
+    }
+    return @{Prefix=$prefix;Folder=$folder;Tasks=$pending}
+}
+
+function Remove-CustomerUiRecoveryTasks([string]$StateDirectory,[string]$Path) {
+    if (-not (Test-Path -LiteralPath (Join-Path $StateDirectory 'pending-uninstall'))) { throw 'Customer UI cleanup requires explicit uninstall cancellation.' }
+    $context=Read-CustomerUiRecoveryTasks $StateDirectory $Path
+    foreach ($task in $context.Tasks.Values) { $context.Folder.DeleteTask($task.TaskName,0) }
+}
+
+function Restart-VerifiedCustomerUi([string]$StateDirectory,[string]$Path,[switch]$PrepareOnly,[switch]$UninstallPrepare) {
+    if (-not [Security.Principal.WindowsIdentity]::GetCurrent().IsSystem) { throw 'Customer UI update restart requires SYSTEM.' }
+    $directoryPath=[IO.Path]::GetFullPath($StateDirectory).TrimEnd('\')
+    $exe=[IO.Path]::GetFullPath($Path)
+    $executableItem=Get-Item -LiteralPath $exe -ErrorAction SilentlyContinue
+    if ([IO.Path]::GetFileName($exe) -cne 'Swan Remote Support.exe' -or ($executableItem -and ($executableItem.Attributes -band [IO.FileAttributes]::ReparsePoint)) -or (-not $PrepareOnly -and -not $executableItem)) { throw 'Unexpected installed customer executable.' }
+    $cancelled=Test-Path -LiteralPath (Join-Path $directoryPath 'pending-uninstall')
+    if ($UninstallPrepare -and (-not $PrepareOnly -or -not $cancelled)) { throw 'Customer UI uninstall preparation requires explicit cancellation.' }
+    if ($cancelled -and -not $UninstallPrepare) { throw 'Explicit uninstall cancels customer UI restoration.' }
+    $explicitSetup=Test-Path -LiteralPath (Join-Path $directoryPath 'pending-install.json')
+    if ($PrepareOnly -and -not $UninstallPrepare -and -not $explicitSetup -and -not (Test-Path -LiteralPath (Join-Path $directoryPath 'pending-update.json'))) { throw 'Customer UI preparation requires a pending update or verified setup.' }
+    # The caller verified this exact signed release while holding session
+    # exclusion. Do not restart a newly opened post-commit UI on recovery.
+    $record=Join-Path $directoryPath 'installed-release.json'
+    # A bare MSI can be rolled back before company setup records a release.
+    $committed=if($PrepareOnly -or -not (Test-Path -LiteralPath $record)){[DateTime]::MinValue}else{(Get-Item -LiteralPath $record).LastWriteTimeUtc}
+    $old=@();$fresh=@{}
+    foreach ($process in @(Get-CimInstance Win32_Process -Filter "Name='Swan Remote Support.exe'" -OperationTimeoutSec 30)) {
+        if ($process.SessionId -eq 0 -or $process.ExecutablePath -ine $exe) { continue }
+        $owner=Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid -OperationTimeoutSec 30
+        if ($owner.ReturnValue -ne 0) { throw 'Cannot determine customer UI account.' }
+        $sid=([Security.Principal.SecurityIdentifier]::new($owner.Sid)).Value
+        if ($sid -eq 'S-1-5-18') { continue }
+        $created=$process.CreationDate.ToUniversalTime()
+        if (-not $PrepareOnly -and $created -ge $committed) { $fresh[$sid]=$true;continue }
+        $old+=@{Pid=[int]$process.ProcessId;Sid=$sid;Created=$created}
+    }
+    if ($PrepareOnly -and -not $UninstallPrepare -and $old.Count -gt 0) {
+        $hashes=@($ExpectedHashes.Split(','))
+        if ($hashes.Count -ne 2 -or @($hashes | Where-Object { $_ -cnotmatch '^[0-9a-f]{64}$' }).Count) { throw 'Expected signed executable identities are required.' }
+        if($executableItem){
+            if ((Get-FileHash -LiteralPath $exe -Algorithm SHA256).Hash.ToLowerInvariant() -cnotin $hashes) { throw 'Customer executable differs from both signed releases.' }
+        }else{
+            # Explicit repair may replace a missing file while its old image is
+            # still mapped. Keep the exact path/creation/SID process checks;
+            # require a previously recorded installation for this exception.
+            $installedState=if($explicitSetup){Get-Content -LiteralPath (Join-Path $directoryPath 'managed-state.json') -Raw|ConvertFrom-Json}else{$null}
+            if(-not $installedState -or $installedState.last_release_sequence -le 0){throw 'Missing customer executable requires recorded explicit repair.'}
+        }
+    }
+    $context=Read-CustomerUiRecoveryTasks $directoryPath $exe
+    $prefix=$context.Prefix;$folder=$context.Folder;$pending=$context.Tasks
+    foreach ($sid in @($old | ForEach-Object Sid | Sort-Object -Unique)) {
+        if ($fresh.ContainsKey($sid) -or $pending.ContainsKey($sid)) { continue }
+        $name=Get-CustomerUiTaskName $prefix $sid
+        $action=Get-CustomerUiAction $exe $sid $name
+        $principal=New-ScheduledTaskPrincipal -UserId $sid -LogonType Interactive -RunLevel Limited
+        $trigger=New-ScheduledTaskTrigger -AtLogOn -User $sid
+        $settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -MultipleInstances IgnoreNew -Priority 4 -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
+        if ($PrepareOnly) {
+            # No logon trigger may launch an application halfway through MSI.
+            $task=Register-ScheduledTask -TaskName $name -InputObject (New-ScheduledTask -Action $action -Principal $principal -Settings $settings)
+        } else { $task=Register-ScheduledTask -TaskName $name -Action $action -Principal $principal -Trigger $trigger -Settings $settings }
+        # The UI can remove its completed task, but cannot replace its action or
+        # change its ACL. Keep SYSTEM/admin control and do not add a principal ACE.
+        $registered=$folder.GetTask($name)
+        $registered.SetSecurityDescriptor(('O:SYG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FRFXSD;;;'+$sid+')'),0x10)
+        Assert-CustomerUiTask $task $action $sid $registered
+        $pending[$sid]=$task
+    }
+    if ($PrepareOnly) {
+        foreach ($task in @($pending.Values)) { $task | Disable-ScheduledTask | Out-Null }
+    }
+    # Recovery tasks are durable before any old process is stopped. Their action
+    # runs only as that existing user, with no password or elevated token.
+    if ((Test-Path -LiteralPath (Join-Path $directoryPath 'pending-uninstall')) -and -not $UninstallPrepare) { throw 'Explicit uninstall cancels customer UI restoration.' }
+    # MSI must close these images before RemoveFiles can move them into Config.Msi.
+    # Keep the same kernel path, creation-time and owner checks for every process.
+    Stop-OwnedCustomerUi $old $exe
+    if ($PrepareOnly) {
+        @{old_processes_closed=@($old).Count;restarts_disabled_until_verified_commit=$true;credentials_used=$false} | ConvertTo-Json -Compress
+        return
+    }
+    $requested=@();$deferred=@()
+    foreach ($sid in @($pending.Keys)) {
+        $task=$pending[$sid]
+        if ($fresh.ContainsKey($sid)) { $folder.DeleteTask($task.TaskName,0);continue }
+        Set-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -Trigger (New-ScheduledTaskTrigger -AtLogOn -User $sid) | Out-Null
+        $task | Enable-ScheduledTask | Out-Null
+        try { $task | Start-ScheduledTask;$requested+=$sid }
+        catch { Write-Warning ('Customer UI restart deferred to this user next logon: '+$_.Exception.Message);$deferred+=$sid }
+    }
+    @{old_processes_closed=@($old).Count;user_restarts_requested=$requested;user_restarts_deferred_to_logon=$deferred;credentials_used=$false;user_actions_elevated=$false} | ConvertTo-Json -Compress
+}
+
+if ($MyInvocation.InvocationName -ne '.') {
+    if ($Operation -eq 'remove') { Remove-CustomerUiRecoveryTasks $Directory $Executable }
+    else { Restart-VerifiedCustomerUi $Directory $Executable -PrepareOnly:($Operation -in @('prepare','uninstall')) -UninstallPrepare:($Operation -eq 'uninstall') }
+}
diff --git a/deployment/windows/Restore-Configuration.ps1 b/deployment/windows/Restore-Configuration.ps1
new file mode 100644
index 00000000000..7bdefbc600f
--- /dev/null
+++ b/deployment/windows/Restore-Configuration.ps1
@@ -0,0 +1,31 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Directory, [switch]$DeferStart, [switch]$RequireTask)
+$ErrorActionPreference = 'Stop'
+$expectedAgent = [IO.Path]::GetFullPath((Join-Path $Directory 'swan-agent.exe'))
+$rollbackPath = Join-Path $Directory 'configuration-task-rollback.json'
+if (Test-Path -LiteralPath $rollbackPath) {
+    $previous = Get-Content -LiteralPath $rollbackPath -Raw | ConvertFrom-Json
+} elseif ($RequireTask) {
+    $previous = @{enabled=$true;running=$false}
+} else { return }
+if ($previous.enabled -isnot [bool] -or $previous.running -isnot [bool]) { throw 'Invalid configuration task rollback state.' }
+$tasks = @(Get-ScheduledTask | Where-Object { $_.TaskName -eq 'Swan Company Configuration' })
+if ($tasks.Count -gt 1) { throw 'Ambiguous company configuration task.' }
+if ($tasks.Count -eq 1) {
+    $task = $tasks[0]
+    if ($task.Actions.Count -ne 1 -or [IO.Path]::GetFullPath($task.Actions[0].Execute) -ine $expectedAgent -or $task.Actions[0].Arguments -cne 'watch' -or $task.Principal.UserId -notin @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) { throw 'Configuration task does not belong to this installation.' }
+    if ($task.Settings.Priority -ne 4) {
+        $settings = $task.Settings
+        $settings.Priority = 4
+        Set-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -Settings $settings | Out-Null
+    }
+} else {
+if ((Get-AuthenticodeSignature -LiteralPath $expectedAgent).Status -ne 'Valid') { throw 'Cannot restore the configuration task with an untrusted agent.' }
+$action = New-ScheduledTaskAction -Execute $expectedAgent -Argument 'watch'
+$trigger = New-ScheduledTaskTrigger -AtStartup
+$settings = New-ScheduledTaskSettingsSet -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -Priority 4
+Register-ScheduledTask -TaskName 'Swan Company Configuration' -Action $action -Trigger $trigger -Settings $settings -User 'SYSTEM' -RunLevel Highest | Out-Null
+}
+if ($previous.enabled) { Enable-ScheduledTask -TaskName 'Swan Company Configuration' | Out-Null } else { Disable-ScheduledTask -TaskName 'Swan Company Configuration' | Out-Null }
+if ($previous.running -and -not $DeferStart) { Start-ScheduledTask -TaskName 'Swan Company Configuration' }
+if (Test-Path -LiteralPath $rollbackPath) { Remove-Item -LiteralPath $rollbackPath }
diff --git a/deployment/windows/Restore-CustomerExe.ps1 b/deployment/windows/Restore-CustomerExe.ps1
new file mode 100644
index 00000000000..e04e642a9dd
--- /dev/null
+++ b/deployment/windows/Restore-CustomerExe.ps1
@@ -0,0 +1,32 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Package,[Parameter(Mandatory=$true)][string]$Directory)
+$ErrorActionPreference='Stop'
+function Assert-CustomerServiceRecord($Service,[string]$Expected,[bool]$Required) {
+    if ($Service.PathName -ine $Expected -or $Service.StartName -ne 'LocalSystem') { throw 'Customer service belongs to another installation.' }
+    if ($Required -and ($Service.State -ne 'Running' -or $Service.StartMode -ne 'Auto')) { throw 'Restored customer service is not running automatically.' }
+}
+function Assert-Service([bool]$Required) {
+    $services=@(Get-CimInstance -ClassName Win32_Service -Filter "Name='Swan Remote Support'")
+    if ($services.Count -eq 0 -and -not $Required) { return }
+    if ($services.Count -ne 1) { throw 'Expected exactly one customer service.' }
+    $expected='"'+[IO.Path]::GetFullPath((Join-Path $Directory 'Swan Remote Support.exe'))+'" --service'
+    Assert-CustomerServiceRecord $services[0] $expected $Required
+}
+$installer=New-Object -ComObject WindowsInstaller.Installer
+if (@($installer.RelatedProducts('{32A585D7-9A78-4AD2-AF72-D0266EFC709D}')).Count -ne 0) { throw 'EXE rollback cannot modify an MSI-managed installation.' }
+if (Test-Path -LiteralPath 'HKLM:\Software\SwanRemoteSupport\Customer') {
+    $marker=Get-ItemProperty -LiteralPath 'HKLM:\Software\SwanRemoteSupport\Customer'
+    if ($null -ne $marker.PSObject.Properties['ProductCode']) { throw 'EXE rollback cannot modify an MSI registration marker.' }
+}
+$uninstallKey='HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\Swan Remote Support'
+if (Test-Path -LiteralPath $uninstallKey) {
+    $registered=Get-ItemProperty -LiteralPath $uninstallKey
+    $expected='"'+[IO.Path]::GetFullPath((Join-Path $Directory 'Swan Remote Support.exe'))+'" --uninstall'
+    if ($registered.WindowsInstaller -eq 1 -or $registered.UninstallString -ine $expected -or [IO.Path]::GetFullPath($registered.InstallLocation) -ine [IO.Path]::GetFullPath($Directory)) { throw 'Registered customer installation identity differs from recovery.' }
+}
+Assert-Service $false
+# The agent verifies exact signed package bytes/publisher before calling this
+# script; no uninstall command from registry or company profile is executed here.
+$process=Start-Process -FilePath (Resolve-Path -LiteralPath $Package).Path -ArgumentList @('--silent-install','printer=0') -PassThru -Wait -WindowStyle Hidden
+if ($process.ExitCode -ne 0) { throw "Customer restoration remains pending (exit $($process.ExitCode))." }
+Assert-Service $true
diff --git a/deployment/windows/Restore-ReleaseMsi.ps1 b/deployment/windows/Restore-ReleaseMsi.ps1
new file mode 100644
index 00000000000..f150072af1c
--- /dev/null
+++ b/deployment/windows/Restore-ReleaseMsi.ps1
@@ -0,0 +1,80 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$PreviousPackage,
+    [Parameter(Mandatory=$true)][string]$NextProductCode,
+    [Parameter(Mandatory=$true)][string]$NextVersion,
+    [Parameter(Mandatory=$true)][string]$PreviousProductCode,
+    [Parameter(Mandatory=$true)][string]$PreviousVersion,
+    [Parameter(Mandatory=$true)][string]$Directory,
+    [Parameter(Mandatory=$true)][ValidateSet('customer','technician')][string]$Edition,
+    [switch]$InspectOnly
+)
+$ErrorActionPreference = 'Stop'
+$upgrade = if ($Edition -eq 'customer') { '{32A585D7-9A78-4AD2-AF72-D0266EFC709D}' } else { '{A4374699-436F-4917-9A4E-223F62A9E634}' }
+$installer = New-Object -ComObject WindowsInstaller.Installer
+function Read-Identity([string]$Path) {
+    $database = $installer.OpenDatabase((Resolve-Path -LiteralPath $Path).Path, 0)
+    $result = @{}
+    foreach ($name in @('ProductCode','UpgradeCode','ProductVersion')) {
+        $view = $database.OpenView('SELECT `Value` FROM `Property` WHERE `Property` = ''' + $name + '''')
+        try {
+            $null = $view.Execute()
+            $row = $view.Fetch()
+            if ($null -eq $row) { throw 'Missing MSI identity.' }
+            $result[$name] = $row.StringData(1)
+        } finally { $null = $view.Close() }
+    }
+    if ($database.SummaryInformation(0).Property(7).Split(';')[0] -cne 'x64') { throw 'Unexpected MSI platform.' }
+    return $result
+}
+function Assert-Identity($Identity, [string]$Code, [string]$Version) {
+    if ($Identity.ProductCode -ine $Code -or $Identity.UpgradeCode -ine $upgrade -or $Identity.ProductVersion -cne $Version) { throw 'MSI registration differs from the signed recovery identity.' }
+}
+foreach ($code in @($PreviousProductCode,$NextProductCode)) {
+    if ($code -notmatch '^\{[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}\}$') { throw 'Invalid recovery product code.' }
+}
+Assert-Identity (Read-Identity $PreviousPackage) $PreviousProductCode $PreviousVersion
+# Enumerate only this edition's upgrade family in the caller's installer context.
+# Never remove an unexpected product or another user's installation.
+foreach ($code in @($installer.RelatedProducts($upgrade))) {
+    if ($code -ine $PreviousProductCode -and $code -ine $NextProductCode) { throw 'Unexpected installed release; explicit recovery required.' }
+    $version = if ($code -ieq $NextProductCode) { $NextVersion } else { $PreviousVersion }
+    Assert-Identity (Read-Identity ($installer.ProductInfo($code,'LocalPackage'))) $code $version
+}
+$msiexec = Join-Path ([Environment]::GetFolderPath('System')) 'msiexec.exe'
+if ($PreviousProductCode -ieq $NextProductCode -and $PreviousVersion -cne $NextVersion) { throw 'Different versions must use different product codes.' }
+$nextState = $installer.ProductState($NextProductCode)
+if ($nextState -notin @(-1,1,5)) { throw 'Ambiguous next product registration.' }
+$previousState = $installer.ProductState($PreviousProductCode)
+if ($previousState -notin @(-1,1,5)) { throw 'Ambiguous previous product registration.' }
+if ($InspectOnly) {
+    @{ previous_product_code=$PreviousProductCode; next_product_code=$NextProductCode; next_state=$nextState; would_remove_next=($NextProductCode -ine $PreviousProductCode -and $nextState -eq 5); installer_executed=$false } | ConvertTo-Json -Compress
+    return
+}
+function Assert-CustomerServiceRecord($Service, [string]$Expected, [bool]$Required) {
+    if ($Service.PathName -ine $Expected -or $Service.StartName -ne 'LocalSystem') { throw 'Customer service belongs to another installation.' }
+    if ($Required -and ($Service.State -ne 'Running' -or $Service.StartMode -ne 'Auto')) { throw 'Restored customer service is not running automatically.' }
+}
+function Assert-CustomerService([bool]$Required) {
+    $services = @(Get-CimInstance -ClassName Win32_Service -Filter "Name='Swan Remote Support'")
+    if ($services.Count -eq 0 -and -not $Required) { return }
+    if ($services.Count -ne 1) { throw 'Expected exactly one customer service.' }
+    $expected = '"' + [IO.Path]::GetFullPath((Join-Path $Directory 'Swan Remote Support.exe')) + '" --service'
+    Assert-CustomerServiceRecord $services[0] $expected $Required
+}
+if ($Edition -eq 'customer') { Assert-CustomerService $false }
+if ($NextProductCode -ine $PreviousProductCode -and $installer.ProductState($NextProductCode) -eq 5) {
+    # Recheck the exact cached database immediately before narrowly removing it.
+    Assert-Identity (Read-Identity ($installer.ProductInfo($NextProductCode,'LocalPackage'))) $NextProductCode $NextVersion
+    # Suppress user-uninstall cancellation only for this signed recovery path.
+    & $msiexec /x $NextProductCode /qn /norestart SWAN_RECOVERY=1
+    if ($LASTEXITCODE -ne 0) { throw "Removal requires recovery or restart (exit $LASTEXITCODE)." }
+}
+$state = $installer.ProductState($PreviousProductCode)
+$mode = if ($state -eq 5) { '/fvamus' } elseif ($state -in @(-1,1)) { '/i' } else { throw 'Ambiguous previous product registration.' }
+# Quote paths as installer arguments; profile data never supplies commands.
+& $msiexec $mode ('"' + (Resolve-Path -LiteralPath $PreviousPackage).Path + '"') /qn /norestart ('INSTALLFOLDER="' + [IO.Path]::GetFullPath($Directory) + '"')
+if ($LASTEXITCODE -ne 0) { throw "Restoration requires recovery or restart (exit $LASTEXITCODE)." }
+Assert-Identity (Read-Identity ($installer.ProductInfo($PreviousProductCode,'LocalPackage'))) $PreviousProductCode $PreviousVersion
+if ($installer.ProductState($PreviousProductCode) -ne 5) { throw 'Previous product registration was not restored.' }
+if ($Edition -eq 'customer') { Assert-CustomerService $true }
diff --git a/deployment/windows/Run-SetupUiTask.ps1 b/deployment/windows/Run-SetupUiTask.ps1
new file mode 100644
index 00000000000..ea3eab93d5d
--- /dev/null
+++ b/deployment/windows/Run-SetupUiTask.ps1
@@ -0,0 +1,117 @@
+[CmdletBinding()]
+# Internal broker: the signed agent verifies release metadata and publisher
+# before staging. Independently enforce private storage, exact bytes, task
+# ownership and a transaction-bound completion receipt here.
+param(
+    [Parameter(Mandatory=$true)][string]$Directory,
+    [Parameter(Mandatory=$true)][ValidateSet('prepare','restart','cleanup')][string]$Operation,
+    [string]$OperationId='',
+    [string]$AgentSha256='',
+    [string]$MarkerSha256='',
+    [ValidateRange(1,900)][int]$WaitSeconds=900
+)
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+if(-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Customer setup UI recovery requires administrator rights.'}
+$Directory=[IO.Path]::GetFullPath($Directory).TrimEnd('\')
+$canonical=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'
+if($Directory -ine [IO.Path]::GetFullPath($canonical)){throw 'Setup UI recovery requires canonical customer storage.'}
+function Assert-PrivateSetupPath([string]$Path) {
+    $item=Get-Item -LiteralPath $Path -Force
+    if($item.Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Setup UI storage must not contain reparse points.'}
+    $acl=Get-Acl -LiteralPath $Path
+    $allowed=@('S-1-5-18','S-1-5-32-544')
+    if($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed){throw 'Setup UI storage has an untrusted owner.'}
+    $rules=$acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])
+    foreach($rule in $rules){if($rule.AccessControlType -ne 'Allow' -or $rule.IdentityReference.Value -notin $allowed){throw 'Setup UI storage permits an untrusted account.'}}
+    foreach($sid in $allowed){if(-not @($rules|Where-Object {$_.IdentityReference.Value -eq $sid -and ($_.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl}).Count){throw 'Setup UI storage lacks required privileged access.'}}
+}
+Assert-PrivateSetupPath $Directory
+$prefix='Swan Explicit UI '
+$scheduler=New-Object -ComObject Schedule.Service
+$scheduler.Connect();$folder=$scheduler.GetFolder('\')
+function Get-SetupUiAction([string]$Action,[string]$Id) {
+    $executable=Join-Path $Directory ('setup-ui\'+$Id+'\swan-agent.exe')
+    New-ScheduledTaskAction -Execute $executable -Argument ('setup-ui '+$Action+' "'+$Directory+'" '+$Id) -WorkingDirectory (Split-Path $executable)
+}
+function Assert-SetupUiTask($Task,[string]$Action,[string]$Id) {
+    $expected=Get-SetupUiAction $Action $Id
+    $principal=[string]$Task.Principal.UserId
+    $sid=if($principal -match '^S-\d-'){$principal}else{([Security.Principal.NTAccount]::new($principal)).Translate([Security.Principal.SecurityIdentifier]).Value}
+    if($Task.TaskPath -cne '\' -or $Task.TaskName -cne ($prefix+$Action+' '+$Id) -or $Task.Actions.Count -ne 1 -or $sid -cne 'S-1-5-18' -or $Task.Principal.LogonType -ne 'ServiceAccount' -or $Task.Principal.RunLevel -ne 'Highest' -or @($Task.Triggers|Where-Object {$null -ne $_}).Count -or [IO.Path]::GetFullPath($Task.Actions[0].Execute) -ine [IO.Path]::GetFullPath($expected.Execute) -or $Task.Actions[0].Arguments -cne $expected.Arguments -or $Task.Actions[0].WorkingDirectory -ine $expected.WorkingDirectory){throw 'Existing setup UI task does not match the fixed operation.'}
+    $security=[Security.AccessControl.RawSecurityDescriptor]::new(($folder.GetTask($Task.TaskName)).GetSecurityDescriptor(7))
+    if($security.Owner.Value -cne 'S-1-5-32-544' -or $security.DiscretionaryAcl.Count -ne 2){throw 'Setup UI task ownership or permissions differ.'}
+    $seen=@{}
+    foreach($ace in $security.DiscretionaryAcl){
+        $account=$ace.SecurityIdentifier.Value
+        if($ace.AceType -ne [Security.AccessControl.AceType]::AccessAllowed -or $ace.AceFlags -ne [Security.AccessControl.AceFlags]::None -or $account -notin @('S-1-5-18','S-1-5-32-544') -or $ace.AccessMask -ne 0x1F01FF -or $seen.ContainsKey($account)){throw 'Setup UI task permits unexpected access.'}
+        $seen[$account]=$true
+    }
+}
+if($Operation -eq 'cleanup'){
+    $marker=Get-Item -LiteralPath (Join-Path $Directory 'pending-uninstall')
+    if($marker.PSIsContainer -or ($marker.Attributes -band [IO.FileAttributes]::ReparsePoint) -or (Test-Path -LiteralPath (Join-Path $Directory 'swan-agent.exe'))){throw 'Setup UI cleanup requires committed explicit uninstall.'}
+    $tasks=@(Get-ScheduledTask|Where-Object {$_.TaskName.StartsWith($prefix,[StringComparison]::Ordinal)})
+    # Validate every candidate before stopping or deleting any task.
+    foreach($task in $tasks){
+        if($task.TaskName -cnotmatch '^Swan Explicit UI (prepare|restart) ([0-9a-f]{32})$'){throw 'Unexpected setup UI task name.'}
+        Assert-SetupUiTask $task $Matches[1] $Matches[2]
+    }
+    foreach($task in $tasks){
+        if($task.State -in @('Running','Queued')){$task|Stop-ScheduledTask}
+        $deadline=[DateTime]::UtcNow.AddSeconds(10)
+        while((Get-ScheduledTask -TaskName $task.TaskName).State -in @('Running','Queued')){if([DateTime]::UtcNow -ge $deadline){throw 'Setup UI task cleanup remains pending.'};Start-Sleep -Milliseconds 100}
+        $folder.DeleteTask($task.TaskName,0)
+    }
+    return
+}
+if($OperationId -cnotmatch '^[0-9a-f]{32}$' -or $AgentSha256 -cnotmatch '^[0-9a-f]{64}$' -or $MarkerSha256 -cnotmatch '^[0-9a-f]{64}$'){throw 'Invalid fixed setup UI operation identity.'}
+foreach($path in @((Join-Path $Directory 'setup-ui'),(Join-Path $Directory ('setup-ui\'+$OperationId)),(Join-Path $Directory ('setup-ui\'+$OperationId+'\swan-agent.exe')))){Assert-PrivateSetupPath $path}
+$action=Get-SetupUiAction $Operation $OperationId
+if((Get-FileHash -LiteralPath $action.Execute -Algorithm SHA256).Hash.ToLowerInvariant() -cne $AgentSha256){throw 'Staged setup UI agent hash differs.'}
+$marker=Join-Path $Directory 'pending-install.json'
+if((Get-FileHash -LiteralPath $marker -Algorithm SHA256).Hash.ToLowerInvariant() -cne $MarkerSha256){throw 'Signed setup marker changed.'}
+$name=$prefix+$Operation+' '+$OperationId
+if(@(Get-ScheduledTask|Where-Object {$_.TaskName.StartsWith($prefix,[StringComparison]::Ordinal) -and $_.TaskName -cne $name -and $_.State -in @('Running','Queued')}).Count){throw 'Another setup UI operation is still running; preserve and recover it first.'}
+$task=Get-ScheduledTask -TaskName $name -ErrorAction SilentlyContinue
+if($task){Assert-SetupUiTask $task $Operation $OperationId}else{
+    $principal=New-ScheduledTaskPrincipal -UserId 'S-1-5-18' -LogonType ServiceAccount -RunLevel Highest
+    $settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 15) -MultipleInstances IgnoreNew -Priority 4 -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
+    $task=Register-ScheduledTask -TaskName $name -InputObject (New-ScheduledTask -Action $action -Principal $principal -Settings $settings)
+    ($folder.GetTask($name)).SetSecurityDescriptor('O:BAG:BAD:P(A;;FA;;;SY)(A;;FA;;;BA)',0x10)
+    Assert-SetupUiTask $task $Operation $OperationId
+}
+$receipt=Join-Path (Split-Path $action.Execute) ($Operation+'-result.json')
+$startedNew=$false
+$previousRun=(Get-ScheduledTaskInfo -TaskName $name).LastRunTime
+if($task.State -notin @('Running','Queued')){
+    # A verified terminal task may be retried, closing any UI reopened since a
+    # failed setup. Never start a duplicate of a still-running attempt.
+    if(Test-Path -LiteralPath $receipt){Assert-PrivateSetupPath $receipt;Remove-Item -LiteralPath $receipt}
+    # Task Scheduler can round LastRunTime to a second. A quick retry must not
+    # mistake the old terminal result for completion of this new attempt.
+    while([Math]::Abs(([DateTime]::UtcNow-$previousRun.ToUniversalTime()).TotalSeconds) -lt 1.1){Start-Sleep -Milliseconds 50}
+    $task|Start-ScheduledTask
+    $startedNew=$true
+}
+$deadline=[DateTime]::UtcNow.AddSeconds($WaitSeconds)
+$observedActive=$false
+do{
+    $task=Get-ScheduledTask -TaskName $name
+    Assert-SetupUiTask $task $Operation $OperationId
+    $info=Get-ScheduledTaskInfo -TaskName $name
+    if($task.State -in @('Running','Queued')){$observedActive=$true}
+    if($task.State -notin @('Running','Queued') -and $info.LastRunTime.Year -gt 2000 -and (-not $startedNew -or $observedActive -or $info.LastRunTime -ne $previousRun)){break}
+    if([DateTime]::UtcNow -ge $deadline){throw 'Setup UI recovery timed out; task and signed setup marker remain available for recovery.'}
+    Start-Sleep -Milliseconds 200
+}while($true)
+if($info.LastTaskResult -ne 0){throw 'Setup UI recovery failed; preserve its task and signed setup marker.'}
+Assert-PrivateSetupPath $receipt
+$file=Get-Item -LiteralPath $receipt
+if($file.PSIsContainer -or $file.Length -lt 1 -or $file.Length -gt 4096){throw 'Invalid setup UI completion receipt.'}
+$completed=Get-Content -LiteralPath $receipt -Raw|ConvertFrom-Json
+$keys=@($completed.PSObject.Properties.Name)
+$expectedKeys=@('agent_sha256','marker_sha256','operation','operation_id','schema','system_context')
+if($keys.Count -ne 6 -or @($keys|Where-Object {$expectedKeys -cnotcontains $_}).Count -or $completed.schema -ne 1 -or $completed.operation -cne $Operation -or $completed.operation_id -cne $OperationId -or $completed.marker_sha256 -cne $MarkerSha256 -or $completed.agent_sha256 -cne $AgentSha256 -or $completed.system_context -isnot [bool] -or -not $completed.system_context){throw 'Setup UI completion does not match the verified operation.'}
+$folder.DeleteTask($name,0)
diff --git a/deployment/windows/SERVER-COMPONENTS.md b/deployment/windows/SERVER-COMPONENTS.md
new file mode 100644
index 00000000000..861c94d84c7
--- /dev/null
+++ b/deployment/windows/SERVER-COMPONENTS.md
@@ -0,0 +1,245 @@
+# Windows company server components
+
+`Install-Server.ps1` installs the signed management service, optionally with
+packaged rendezvous, relay and HTTPS components. The service supervises its
+own children; component failure stops management, and service stop or a service
+process crash terminates its assigned children. Windows process-job lifecycle
+tests pass, but clean-machine installation, repair and uninstall are still
+unverified. `Setup-Server.ps1` supplies the graphical setup flow, and an
+unsigned test EXE bundles it with management and pinned transport/HTTPS inputs.
+Production signing and clean-machine wizard installation remain incomplete.
+
+The managed rendezvous process now receives an explicit `DB_URL` pointing to
+`transport/db_v2.sqlite3` inside the company data directory. Its Windows upstream
+default instead uses a RustDesk service-profile folder, even when its working
+directory is the company transport directory. Earlier Windows deployments can
+therefore have a working peer database outside their full backup. The presence
+of transport keys in a backup alone does not establish database recovery.
+
+If that legacy database exists and the managed database is absent, startup,
+component checks and full transport export refuse to silently create or omit a
+replacement. Before upgrading, stop builds and sessions, stop the company worker,
+company service and any separate rendezvous process, and preserve the original
+company data, transport keys and legacy database with its WAL/journal. From an
+administrator shell, select the existing company and the verified source folder:
+
+```powershell
+$env:SWAN_DATA_DIR = 'C:\ProgramData\SwanCompanyServer'
+& '.\swan-management.exe' migrate-transport-database `
+  'C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\RustDesk\config'
+```
+
+Use the actual source reported by the previous rendezvous log, not a database
+belonging to another installation. The command requires existing company state
+and transport keys, obtains the offline management lock, and on Windows refuses
+a database still open for writing. It recovers a private copy of the stopped
+database and WAL, checks SQLite integrity, and publishes into company storage
+without overwriting a destination. Original source files and keys remain intact;
+no service is started. An existing destination requires investigation rather
+than deletion or an automatic repeat. Restart the matching company stack, verify
+the same devices and trust keys, then create and test a new full backup. Keep the
+pre-upgrade binaries, original database and backup for rollback.
+
+`server-components.json` now requires the maintained Windows rendezvous and
+relay builds, with fixed executable hashes and a canonical digest of their
+complete compiler inputs and public recipe. `deployment/transport/source.json`
+pins upstream RustDesk server and its shared submodule, Rust, Cargo.lock and the
+reviewed UDP address normalization. That immutable recipe retains its historical
+candidate scope text; current Windows test-installer qualification is recorded
+separately in `server-components.json` and the acceptance report. The stock upstream Windows archive is no
+longer accepted by this preparation path. Caddy 2.10.2 remains archive- and
+executable-hash pinned.
+
+Native and component workflows build the maintained Windows transport in the
+same workflow run, archive its source before compilation, and consume that run's
+artifact. Download the `swan-transport-candidate-windows-2022` artifact ZIP and
+the exact HTTPS archive named in the manifest, then prepare them with Python
+available as a build tool:
+
+```powershell
+./deployment/windows/Prepare-ServerComponents.ps1 `
+  -TransportPackage ./swan-transport-candidate-windows-2022.zip `
+  -HttpsPackage ./caddy_2.10.2_windows_amd64.zip `
+  -OutputDirectory ./prepared-server-components
+```
+
+For an artifact already extracted by the CI download action, use
+`-TransportDirectory` instead of `-TransportPackage`. The four expected inputs
+retain their artifact paths (`transport-source/target/release/`,
+`transport-source/SWAN-SOURCE.json` and `transport-artifacts/`). Use
+`-PythonExecutable` for an explicit Python path. Python is a build requirement;
+the installed server and setup wizard do not require it.
+
+The destination must be new. All inputs are verified before output creation.
+The verifier rejects altered executables, changed/extra/missing source files,
+forged receipts, duplicate/unsafe archive entries, and a wrong HTTPS archive.
+Only fixed filenames are written; supplier executables are not run. The prepared
+set includes both licenses, attribution, the manifest and the complete
+`transport-build-source.zip`. That source archive is embedded in the server
+setup, retained in the installed components directory and included in removal
+ownership checks. Its ZIP metadata and text checkout line endings are normalized
+for reproducible packaging; executable bytes remain unchanged. Public build
+receipt revisions remain in the archive, separate from the digest of invariant
+compiler/recipe inputs. `component-verification.json` records preparation hashes
+outside the embedded installer payload.
+
+This is the unsigned test packaging path. The maintained Windows transport has
+separate source, binary reproducibility and IPv4/IPv6 registration evidence;
+new installer compilation, installation, full native relay sessions, the Windows
+matrix and production signing remain release gates. A new management binary
+requires its matching transport pins: do not replace an existing management
+executable alone. Preserve company data and keys, stop builds/sessions, create
+an encrypted full deployment backup and perform a coordinated administrator
+upgrade with tested rollback. Existing lab services are not changed by source
+or packaging preparation.
+
+Open the graphical wizard from an administrator Windows PowerShell session:
+
+```powershell
+powershell.exe -STA -File ./deployment/windows/Setup-Server.ps1
+```
+
+It collects the company hostname, trusted release key and publisher thumbprint,
+signed management executable and prepared components. Installation runs in a
+background PowerShell instance with structured parameters, so the form stays
+responsive; it prevents closing while installation runs. After success, open
+company HTTPS setup to configure branding, administrator MFA, accounts,
+enrollment and update policy. No secrets are embedded in the wizard or copied
+to public installation bundles. Without administrator rights, installation is
+disabled. The wizard does not request elevation automatically.
+
+For layout inspection, `-RenderPreview OUTPUT.png` renders the form without
+showing it, starting services or enabling installation/browser actions. The
+preview is layout evidence; it does not test privileged installation or backend
+completion/error events. Those require the clean Windows test matrix.
+
+## Unsigned test executable
+
+The x64 .NET Framework launcher uses the Windows PowerShell runtime already
+present in the targeted desktop Windows releases. Building requires .NET Framework
+4.7.2 or newer and the hash-pinned Microsoft Roslyn 4.12.0 package described in
+`server-compiler.json`. The compiler is a build dependency and is not embedded
+in the installer. Download it separately using `Get-PinnedArchive.ps1`; the
+builder verifies the whole package, extracts into a fresh folder and checks the
+compiler executable hash and Microsoft signature before executing it. Download
+both build-only SDK reference packages pinned in `server-references.json` too;
+the builder does not compile against reference assemblies from the host.
+Build only for isolated tests:
+
+```powershell
+./deployment/windows/Build-ServerSetup.ps1 -UnsignedTest `
+  -ManagementExecutable ./swan-management.exe `
+  -ComponentsDirectory ./prepared-server-components `
+  -CompilerPackage ./microsoft.net.compilers.toolset.framework.4.12.0.nupkg `
+  -FrameworkReferencesPackage ./microsoft.netframework.referenceassemblies.net462.1.0.3.nupkg `
+  -PowerShellReferencesPackage ./microsoft.powershell.5.referenceassemblies.1.1.0.nupkg `
+  -OutputDirectory ./server-setup-test
+```
+
+It embeds the wizard and installer scripts, management, pinned transport/HTTPS
+executables, licenses and public source/hash metadata. Input PE architecture
+and component hashes are checked before output; compiled resources must match
+their input hashes. Output is `SwanServerSetup-UNSIGNED-TEST.exe`, with test
+status also shown in its window title. Building without `-UnsignedTest` is
+rejected. A supplied unsigned management executable may be packaged for layout
+tests, but installation still requires its valid trusted publisher signature.
+This does not bypass signing gates or grant production publication approval.
+Resource input paths containing commas are currently unsupported by this builder.
+
+The recipe uses deterministic compilation, explicit .NET Framework references,
+mapped source paths and ordered compact source metadata. `SOURCE.json` records
+compiler/source/package pins and reference-assembly hashes; every embedded
+resource, including that manifest, is verified after compilation. The reference
+packages are `Microsoft.NETFramework.ReferenceAssemblies.net462` 1.0.3 and
+`Microsoft.PowerShell.5.ReferenceAssemblies` 1.1.0. Only five fixed, individually
+hash-checked DLL basenames are extracted; SDK install scripts never run and
+reference assemblies are not embedded in the server installer. Run
+`test_server_setup_reproducibility.ps1` with the same build inputs and a fresh
+`-WorkDirectory` to compare two actual unsigned outputs and test rejection of a
+wrong compiler or reference package. It also executes the packaged launcher's
+preview-only mode and retains its PNG to check runtime binding to Windows
+PowerShell. Independent cross-image comparisons remain required. This does not
+install or qualify the company server.
+
+Use `--render-preview OUTPUT.png` to inspect the packaged layout without opening
+the window or installing services. The launcher executes the installer from its
+embedded resource in memory, using structured parameters. Public binary payloads
+are extracted under a unique protected directory; elevated extraction grants
+only Administrators/SYSTEM access and ownership. Non-elevated previews use the
+current user's private temporary directory. Known payload files are cleaned up
+on normal exit without recursive deletion. Elevated extraction, interrupted
+cleanup and privileged installation remain clean-VM acceptance requirements.
+The installed management copy is signature-checked again before service creation.
+It must be the matching management build supporting `prepare-server-directory`.
+After verifying the protected Program Files copy, installation invokes that
+build's embedded private-directory helper before writing any company state.
+The helper creates the canonical server data root with SYSTEM/Administrators
+permissions atomically and rejects existing state, including a directory that
+appeared after the fresh-install precheck. Existing state is never adopted by
+changing its owner or permissions. Preparation has a bounded 30-second deadline;
+incompatible older executables are not a supported installation input. Unknown
+commands in current management builds fail before opening company data or
+starting a listener. Failure retains newly staged files for investigation.
+
+For a fresh company deployment, run with administrator rights and a trusted
+signed management build containing component supervision:
+
+```powershell
+./deployment/windows/Install-Server.ps1 `
+  -Executable ./swan-management.exe `
+  -ReleasePublicKey PROJECT_RELEASE_PUBLIC_KEY `
+  -PublisherThumbprint TRUSTED_RELEASE_CERTIFICATE_THUMBPRINT `
+  -ComponentsDirectory ./prepared-server-components `
+  -PublicHostname support.example.com
+```
+
+The script rejects existing service/data/install directories, missing licenses,
+modified component executables, invalid hostnames and occupied component ports.
+The management signature must be valid and match the explicitly configured
+certificate thumbprint from the trusted project or company release policy.
+It protects company data, copies the components under the management installation,
+writes a Caddy recipe, registers automatic service recovery, and opens TCP
+80/443/21115–21117 and UDP 21116 for this deployment. Management stays on loopback.
+Configure public company DNS and forwarding before completing the shared web
+setup wizard. Public ACME issuance and external transport tests remain required;
+the script's management health check proves neither.
+
+The service rechecks exact executable hashes before launching fixed commands.
+Rendezvous and relay share `transport/` beneath company data; relay starts only
+after a public transport key is available. Caddy keeps its state beneath `tls/`
+and `proxy-config/`, with its administration API disabled. Component logs are in
+the protected `logs/` directory. Child processes are terminated and waited for
+on service shutdown; this is forced termination, so full backup must wait until
+the service has stopped and must snapshot SQLite using the management CLI.
+Include the complete transport and TLS directories in encrypted backups.
+
+`swan-management.exe check-components` validates packaged executable hashes,
+hostname and the presence of a Caddyfile without launching services. It creates
+component data/log directories under `SWAN_DATA_DIR`; it does not parse the
+HTTPS recipe or prove DNS, certificates or connectivity. Set `SWAN_PUBLIC_HOST`
+and `SWAN_DATA_DIR` for this preflight. Installation failure removes only its
+new service and firewall rules, retaining files/private data for inspection.
+
+## Removal
+
+Run `Uninstall-Server.ps1` with administrator rights to remove this company
+service, its owned firewall rules and the known packaged files. `-WhatIf` checks
+the removal plan without changing them. The installer records public ownership
+metadata in the protected `installation.json`; removal refuses a different
+service executable, company directory, reparse point or unexpected firewall
+ownership. It does not recursively delete installation directories or remove
+unknown files. Company database, configuration, enrollment, keys, TLS storage,
+logs and receipt remain in ProgramData for recovery.
+
+Existing installations without this receipt need an administrator-reviewed
+maintenance procedure. A fresh install deliberately refuses retained company
+data, so do not delete it merely to get past setup. Native removal, reinstallation
+and restore tests still require clean Windows VMs; removal-plan fixtures prove
+ownership rejection and exclusion of data, not successful SCM/firewall removal.
+
+Windows CI is configured to build `SwanServerSetup-UNSIGNED-TEST.exe` with these pinned
+transport/HTTPS archives and the matching management executable. Its artifact
+includes `SwanServerSetup-SOURCE.json` and a checksum. The setup builder checks
+embedded resource hashes and retains component licenses/source notices. These
+outputs remain test packages: production signing and clean-machine setup
+acceptance are required before publication.
diff --git a/deployment/windows/SERVICE-STARTUP.md b/deployment/windows/SERVICE-STARTUP.md
new file mode 100644
index 00000000000..42fc11fb6c0
--- /dev/null
+++ b/deployment/windows/SERVICE-STARTUP.md
@@ -0,0 +1,42 @@
+# Managed customer service startup
+
+The managed Windows launcher connects to the Service Control Manager before
+loading `librustdesk.dll`, reading company state or entering the Rust runtime.
+Microsoft requires prompt dispatcher/handler registration and explicit status
+reporting during initialization; see
+[ServiceMain initialization](https://learn.microsoft.com/en-us/windows/win32/services/service-servicemain-function)
+and [service state transitions](https://learn.microsoft.com/en-us/windows/win32/services/service-status-transitions).
+
+The service name remains `Swan Remote Support`, independently of company display
+branding. The launcher handles an exact `--service` invocation. Desktop arguments
+continue through the existing desktop entry point; ambiguous service arguments
+are rejected. The upstream launcher path is retained when `SWAN_BUILD` is unset.
+
+Initialization reports StartPending with a 15-second wait hint and checkpoints
+every five seconds. A heartbeat thread is confirmed running before DLL loading,
+because DLL initialization can otherwise hold the loader lock and prevent a
+new thread from entering its procedure. Initialization is bounded to 120 seconds.
+If that bound expires, the service reports a stopped/error state and terminates
+its own initializing process. No desktop or authorized session has started at
+that point. The global Windows service timeout is not changed.
+
+Only the core DLL beside the installed executable is selected, with application
+DLL-directory and System32 dependency search. Both new service exports must be
+present; a legacy core is rejected rather than starting another dispatcher.
+The core remains loaded through process exit to avoid unloading while a final
+control callback is in flight.
+
+The Rust service uses the existing managed defaults and receiving-device
+authorization. Its normal service loop reports Running/Stopped through the
+launcher's status callback, and its existing control handler receives stop and
+interrogate requests. Running denotes the service process entering that loop;
+remote availability still requires a usable receiver, approved enrollment,
+valid signed policy and a valid session grant. This bootstrap does not authorize
+connections, change consent, reset identity or enable an upstream password path.
+
+`test_service_bootstrap.ps1` tests the actual Windows service manager with isolated
+simulated DLLs. Cases cover normal startup/control/stop, 35-second DLL loading
+with pending checkpoints, absent DLL/exports, bounded loader timeout and command
+argument handling. These tests establish the launcher boundary, not native Rust
+integration, signing, cold-boot reliability or full product acceptance. Complete
+native builds and enrolled-machine cold-boot tests remain required.
diff --git a/deployment/windows/ServerSetupLauncher.cs b/deployment/windows/ServerSetupLauncher.cs
new file mode 100644
index 00000000000..55271a5f382
--- /dev/null
+++ b/deployment/windows/ServerSetupLauncher.cs
@@ -0,0 +1,139 @@
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Management.Automation;
+using System.Management.Automation.Runspaces;
+using System.Reflection;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Threading;
+
+internal static class ServerSetupLauncher
+{
+    private static readonly string[] PayloadFiles = {
+        "swan-management.exe", "components/hbbs.exe", "components/hbbr.exe", "components/caddy.exe",
+        "components/Caddy-LICENSE.txt", "components/RustDesk-LICENSE.txt", "components/THIRD-PARTY.txt",
+        "components/server-components.json", "components/transport-build-source.zip", "SOURCE.json", "LICENCE"
+    };
+
+    private static Stream Resource(string name)
+    {
+        Stream resource = Assembly.GetExecutingAssembly().GetManifestResourceStream("Swan." + name);
+        if (resource == null) throw new InvalidOperationException("Missing packaged resource: " + name);
+        return resource;
+    }
+
+    private static string Script(string name)
+    {
+        using (Stream input = Resource(name))
+        using (StreamReader reader = new StreamReader(input)) return reader.ReadToEnd();
+    }
+
+    private static string CreatePayloadDirectory()
+    {
+        WindowsIdentity identity = WindowsIdentity.GetCurrent();
+        bool elevated = new WindowsPrincipal(identity).IsInRole(WindowsBuiltInRole.Administrator);
+        SecurityIdentifier administrators = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
+        SecurityIdentifier system = new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null);
+        SecurityIdentifier owner = elevated ? administrators : identity.User;
+        DirectorySecurity access = new DirectorySecurity();
+        access.SetAccessRuleProtection(true, false);
+        access.SetOwner(owner);
+        InheritanceFlags inheritance = InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit;
+        access.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl, inheritance, PropagationFlags.None, AccessControlType.Allow));
+        access.AddAccessRule(new FileSystemAccessRule(system, FileSystemRights.FullControl, inheritance, PropagationFlags.None, AccessControlType.Allow));
+        string parent = elevated ? Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData) : Path.GetTempPath();
+        string root = Path.Combine(parent, "SwanServerSetup-" + Guid.NewGuid().ToString("N"));
+        if (Directory.Exists(root)) throw new IOException("Payload directory already exists.");
+        Directory.CreateDirectory(root, access);
+        DirectoryInfo created = new DirectoryInfo(root);
+        if ((created.Attributes & FileAttributes.ReparsePoint) != 0 ||
+            !created.GetAccessControl().GetOwner(typeof(SecurityIdentifier)).Equals(owner))
+            throw new IOException("Payload directory ownership is invalid.");
+        return root;
+    }
+
+    private static void Extract(string root)
+    {
+        foreach (string relative in PayloadFiles)
+        {
+            string target = Path.Combine(root, relative.Replace('/', Path.DirectorySeparatorChar));
+            Directory.CreateDirectory(Path.GetDirectoryName(target));
+            using (Stream input = Resource(relative))
+            {
+                if (input.Length > 256L * 1024 * 1024) throw new IOException("Packaged component too large.");
+                using (FileStream output = new FileStream(target, FileMode.CreateNew, FileAccess.Write, FileShare.None)) input.CopyTo(output);
+            }
+            // Explicitly retain the protected root owner for payload children,
+            // rather than depending on an elevated token's default owner.
+            IdentityReference owner = new DirectoryInfo(root).GetAccessControl().GetOwner(typeof(SecurityIdentifier));
+            FileSecurity fileAccess = File.GetAccessControl(target);
+            fileAccess.SetOwner(owner);
+            File.SetAccessControl(target, fileAccess);
+            string directory = Path.GetDirectoryName(target);
+            if (directory != root)
+            {
+                DirectorySecurity directoryAccess = Directory.GetAccessControl(directory);
+                directoryAccess.SetOwner(owner);
+                Directory.SetAccessControl(directory, directoryAccess);
+            }
+        }
+    }
+
+    private static void Cleanup(string root)
+    {
+        if (root == null) return;
+        // Fixed basenames only. Retain unexpected files; never recurse.
+        foreach (string relative in PayloadFiles)
+        {
+            string path = Path.Combine(root, relative.Replace('/', Path.DirectorySeparatorChar));
+            if (File.Exists(path)) File.Delete(path);
+        }
+        string components = Path.Combine(root, "components");
+        if (Directory.Exists(components) && Directory.GetFileSystemEntries(components).Length == 0) Directory.Delete(components);
+        if (Directory.Exists(root) && Directory.GetFileSystemEntries(root).Length == 0) Directory.Delete(root);
+    }
+
+    [STAThread]
+    private static int Main(string[] arguments)
+    {
+        string payload = null;
+        try
+        {
+            bool preview = arguments.Length == 2 && arguments[0] == "--render-preview";
+            if (arguments.Length != 0 && !preview) throw new ArgumentException("Use no arguments, or --render-preview OUTPUT.png.");
+            payload = CreatePayloadDirectory();
+            Extract(payload);
+            using (Runspace runspace = RunspaceFactory.CreateRunspace())
+            {
+                runspace.ApartmentState = ApartmentState.STA;
+                runspace.ThreadOptions = PSThreadOptions.UseCurrentThread;
+                runspace.Open();
+                // Installer code stays in the executable resource, not a
+                // mutable temporary script executed by an elevated process.
+                runspace.SessionStateProxy.SetVariable("SwanPackagedInstallerScript", Script("Install-Server.ps1"));
+                using (PowerShell shell = PowerShell.Create())
+                {
+                    shell.Runspace = runspace;
+                    shell.AddScript(Script("Setup-Server.ps1"))
+                        .AddParameter("BundledDirectory", payload)
+                        .AddParameter("UnsignedTestPackage", true);
+                    if (preview) shell.AddParameter("RenderPreview", Path.GetFullPath(arguments[1]));
+                    shell.Invoke();
+                    if (shell.HadErrors) throw new InvalidOperationException("Server setup failed: " + shell.Streams.Error[0]);
+                }
+            }
+            return 0;
+        }
+        catch (Exception error)
+        {
+            Console.Error.WriteLine(error.Message);
+            return 1;
+        }
+        finally
+        {
+            try { Cleanup(payload); }
+            catch (Exception error) { Console.Error.WriteLine("Retained setup payload: " + error.Message); }
+        }
+    }
+}
diff --git a/deployment/windows/Set-ReproducibleMsiMetadata.ps1 b/deployment/windows/Set-ReproducibleMsiMetadata.ps1
new file mode 100644
index 00000000000..5b9fe79c31c
--- /dev/null
+++ b/deployment/windows/Set-ReproducibleMsiMetadata.ps1
@@ -0,0 +1,76 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$InputMsi,
+    [Parameter(Mandatory=$true)][string]$OutputMsi,
+    [Parameter(Mandatory=$true)][ValidateRange(315532800,4102444799)][long]$SourceDateEpoch
+)
+$ErrorActionPreference='Stop'
+$InputMsi=(Resolve-Path -LiteralPath $InputMsi).Path
+$OutputMsi=[IO.Path]::GetFullPath($OutputMsi)
+if ($OutputMsi -notmatch '-unsigned\.msi$') { throw 'Output must end in -unsigned.msi; normalize before signing.' }
+if ((Get-AuthenticodeSignature -LiteralPath $InputMsi).Status -ne 'NotSigned') { throw 'Only unsigned MSI inputs may be normalized.' }
+if (Test-Path -LiteralPath $OutputMsi) { throw 'Refusing to overwrite an installer.' }
+$temporary=$OutputMsi+'.partial'
+if (Test-Path -LiteralPath $temporary) { throw 'An unfinished output exists; inspect it before retrying.' }
+$epoch=[DateTimeOffset]::FromUnixTimeSeconds($SourceDateEpoch).UtcDateTime
+
+function Clear-RootStorageTime([string]$Path) {
+    # MS-CFB 2.6.2 permits zero modified time on the root entry. Validate the
+    # format and directory location instead of assuming WiX's current offsets.
+    $stream=[IO.File]::Open($Path,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite,[IO.FileShare]::None)
+    try {
+        $header=New-Object byte[] 512
+        if ($stream.Read($header,0,512) -ne 512 -or [BitConverter]::ToString($header,0,8) -ne 'D0-CF-11-E0-A1-B1-1A-E1') { throw 'Invalid compound-file header.' }
+        $major=[BitConverter]::ToUInt16($header,26)
+        $shift=[BitConverter]::ToUInt16($header,30)
+        if ([BitConverter]::ToUInt16($header,28) -ne 65534 -or -not (($major -eq 3 -and $shift -eq 9) -or ($major -eq 4 -and $shift -eq 12))) { throw 'Unsupported compound-file format.' }
+        $sectorSize=[long]1 -shl $shift
+        $directory=[BitConverter]::ToUInt32($header,48)
+        $offset=([long]$directory+1)*$sectorSize
+        if ($directory -ge 4294967290 -or $offset -lt $sectorSize -or $offset+$sectorSize -gt $stream.Length) { throw 'Invalid root directory sector.' }
+        $entry=New-Object byte[] 128
+        $stream.Position=$offset
+        if ($stream.Read($entry,0,128) -ne 128 -or $entry[66] -ne 5 -or [BitConverter]::ToUInt16($entry,64) -ne 22 -or [Text.Encoding]::Unicode.GetString($entry,0,22) -cne "Root Entry`0") { throw 'Invalid root directory entry.' }
+        if ([BitConverter]::ToUInt64($entry,100) -ne 0) { throw 'Unexpected nonzero root creation time.' }
+        $stream.Position=$offset+108
+        $stream.Write((New-Object byte[] 8),0,8)
+        $stream.Flush()
+    } finally { $stream.Dispose() }
+}
+
+function Set-Summary([string]$Path,[string]$PackageCode) {
+    $installer=$null; $summary=$null
+    try {
+        $installer=New-Object -ComObject WindowsInstaller.Installer
+        $summary=$installer.SummaryInformation($Path,3)
+        $summary.Property(9)=$PackageCode
+        $summary.Property(12)=$epoch
+        $summary.Property(13)=$epoch
+        [void]$summary.Persist()
+    } finally {
+        if ($null -ne $summary) { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($summary) }
+        if ($null -ne $installer) { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($installer) }
+    }
+    Clear-RootStorageTime $Path
+}
+
+# Canonicalize variable metadata, then derive a package UUIDv5 from every
+# remaining byte. Different payloads, installer tables or epochs get new codes.
+# The fixed namespace is a build-format identifier, never a published PackageCode.
+[IO.File]::Copy($InputMsi,$temporary,$false)
+$namespace=[Guid]'eac92fca-0170-53c1-a207-dfbe3ab9c907'
+Set-Summary $temporary ('{'+$namespace.ToString('D').ToUpperInvariant()+'}')
+$canonicalHash=(Get-FileHash -LiteralPath $temporary -Algorithm SHA256).Hash.ToLowerInvariant()
+$bytes=$namespace.ToByteArray()
+foreach($segment in @(@(0,4),@(4,2),@(6,2))){[Array]::Reverse($bytes,$segment[0],$segment[1])}
+$name=[Text.Encoding]::UTF8.GetBytes('swan-msi-metadata-v1|'+$canonicalHash)
+$sha=[Security.Cryptography.SHA1]::Create()
+try{$digest=$sha.ComputeHash([byte[]]($bytes+$name))}finally{$sha.Dispose()}
+[byte[]]$result=$digest[0..15]
+$result[6]=($result[6] -band 15) -bor 80
+$result[8]=($result[8] -band 63) -bor 128
+foreach($segment in @(@(0,4),@(4,2),@(6,2))){[Array]::Reverse($result,$segment[0],$segment[1])}
+$packageCode='{'+([Guid]::new($result)).ToString('D').ToUpperInvariant()+'}'
+Set-Summary $temporary $packageCode
+[IO.File]::Move($temporary,$OutputMsi)
+[pscustomobject]@{package_code=$packageCode;source_date_epoch=$SourceDateEpoch;canonical_sha256=$canonicalHash;sha256=(Get-FileHash -LiteralPath $OutputMsi -Algorithm SHA256).Hash.ToLowerInvariant()}
diff --git a/deployment/windows/Setup-Server.ps1 b/deployment/windows/Setup-Server.ps1
new file mode 100644
index 00000000000..a24777ab505
--- /dev/null
+++ b/deployment/windows/Setup-Server.ps1
@@ -0,0 +1,206 @@
+[CmdletBinding()]
+param([string]$RenderPreview,[string]$BundledDirectory,[switch]$UnsignedTestPackage)
+$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Windows.Forms
+Add-Type -AssemblyName System.Drawing
+[Windows.Forms.Application]::EnableVisualStyles()
+if ([Threading.Thread]::CurrentThread.ApartmentState -ne 'STA') { throw 'Run this wizard using Windows PowerShell with -STA.' }
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$administrator = ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+$script:operation = $null
+$script:setupUrl = $null
+$script:installerText = $null
+if (Get-Variable -Name SwanPackagedInstallerScript -ErrorAction SilentlyContinue) {
+    $script:installerText = $SwanPackagedInstallerScript
+} else { $script:installerText = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'Install-Server.ps1') -Raw }
+$form = [Windows.Forms.Form]::new()
+$form.Text = 'Swan Remote Support - Company server setup'
+if ($UnsignedTestPackage) {$form.Text += ' [UNSIGNED TEST]'}
+$form.ClientSize = [Drawing.Size]::new(820,680)
+$form.MinimumSize = $form.Size
+$form.MaximumSize = $form.Size
+$form.StartPosition = 'CenterScreen'
+$form.Font = [Drawing.Font]::new('Segoe UI',10)
+$form.BackColor = [Drawing.Color]::White
+$form.MaximizeBox = $false
+$title = [Windows.Forms.Label]::new()
+$title.Text = 'Swan Remote Support'
+$title.Font = [Drawing.Font]::new('Segoe UI',22,[Drawing.FontStyle]::Bold)
+$title.ForeColor = [Drawing.Color]::FromArgb(0,125,135)
+$title.SetBounds(24,18,760,45)
+$form.Controls.Add($title)
+$intro = [Windows.Forms.Label]::new()
+$intro.Text = 'Set up your company server, then configure your company in the HTTPS setup page.'
+$intro.SetBounds(26,70,760,38)
+$form.Controls.Add($intro)
+function Add-Field([string]$Label,[int]$Y,[string]$Help,[bool]$Browse=$false) {
+    $caption = [Windows.Forms.Label]::new()
+    $caption.Text = $Label
+    $caption.SetBounds(26,$Y,760,22)
+    $form.Controls.Add($caption)
+    $input = [Windows.Forms.TextBox]::new()
+    $width = 768
+    if ($Browse) {$width=674}
+    $input.SetBounds(26,($Y+24),$width,28)
+    $form.Controls.Add($input)
+    $hint = [Windows.Forms.Label]::new()
+    $hint.Text = $Help
+    $hint.ForeColor = [Drawing.Color]::DimGray
+    $hint.Font = [Drawing.Font]::new('Segoe UI',9)
+    $hint.SetBounds(26,($Y+54),768,24)
+    $form.Controls.Add($hint)
+    return $input
+}
+$hostInput = Add-Field 'Company public hostname' 116 'For example, support.example.com. Configure DNS and public port forwarding for this server.'
+$keyInput = Add-Field 'Trusted project release public key' 195 'Use the base64 release key supplied through your trusted project or company release policy.'
+$publisherInput = Add-Field 'Trusted management publisher certificate thumbprint' 274 'Use the certificate fingerprint from your trusted release policy, not from an unverified download.'
+$executableInput = Add-Field 'Signed management executable' 353 'Select the signed swan-management.exe from your reviewed release.' $true
+$componentsInput = Add-Field 'Prepared server components folder' 432 'Contains pinned rendezvous, relay, HTTPS executables and their license/source notices.' $true
+if ($BundledDirectory) {
+    $executableInput.Text = Join-Path $BundledDirectory 'swan-management.exe'
+    $componentsInput.Text = Join-Path $BundledDirectory 'components'
+}
+$fileButton = [Windows.Forms.Button]::new()
+$fileButton.Text = 'Browse...'
+$fileButton.SetBounds(714,377,80,28)
+$fileButton.Add_Click({
+    $dialog = [Windows.Forms.OpenFileDialog]::new()
+    $dialog.Filter = 'Management executable (*.exe)|*.exe'
+    try {if ($dialog.ShowDialog($form) -eq 'OK') {$executableInput.Text=$dialog.FileName}} finally {$dialog.Dispose()}
+})
+$form.Controls.Add($fileButton)
+$folderButton = [Windows.Forms.Button]::new()
+$folderButton.Text = 'Browse...'
+$folderButton.SetBounds(714,456,80,28)
+$folderButton.Add_Click({
+    $dialog = [Windows.Forms.FolderBrowserDialog]::new()
+    $dialog.Description = 'Select the prepared server components folder'
+    try {if ($dialog.ShowDialog($form) -eq 'OK') {$componentsInput.Text=$dialog.SelectedPath}} finally {$dialog.Dispose()}
+})
+$form.Controls.Add($folderButton)
+$status = [Windows.Forms.Label]::new()
+$status.Text = 'Company branding, administrator MFA, device policy and update settings follow in web setup.'
+if (-not $administrator) {$status.Text='Open this wizard as administrator to install. You can review setup here without installing.'}
+if ($RenderPreview) {$status.Text='Preview only. Installation and browser actions are disabled.'}
+$status.SetBounds(26,520,768,42)
+$form.Controls.Add($status)
+$log = [Windows.Forms.TextBox]::new()
+$log.Multiline = $true
+$log.ReadOnly = $true
+$log.ScrollBars = 'Vertical'
+$log.SetBounds(26,568,768,50)
+$form.Controls.Add($log)
+$progress = [Windows.Forms.ProgressBar]::new()
+$progress.SetBounds(26,630,768,8)
+$form.Controls.Add($progress)
+$installButton = [Windows.Forms.Button]::new()
+$installButton.Text = 'Install company server'
+$installButton.SetBounds(26,640,205,32)
+$installButton.BackColor = [Drawing.Color]::FromArgb(0,125,135)
+$installButton.ForeColor = [Drawing.Color]::White
+$installButton.FlatStyle = 'Flat'
+$installButton.Enabled = $administrator -and -not $RenderPreview
+$form.Controls.Add($installButton)
+$webButton = [Windows.Forms.Button]::new()
+$webButton.Text = 'Open company setup'
+$webButton.SetBounds(244,640,205,32)
+$webButton.Enabled = $false
+$webButton.Add_Click({
+    if ($script:setupUrl -and -not $RenderPreview) {
+        $start = [Diagnostics.ProcessStartInfo]::new($script:setupUrl)
+        $start.UseShellExecute = $true
+        [Diagnostics.Process]::Start($start) | Out-Null
+    }
+})
+$form.Controls.Add($webButton)
+$closeButton = [Windows.Forms.Button]::new()
+$closeButton.Text = 'Close'
+$closeButton.SetBounds(689,640,105,32)
+$closeButton.Add_Click({$form.Close()})
+$form.Controls.Add($closeButton)
+$timer = [Windows.Forms.Timer]::new()
+$timer.Interval = 250
+$installButton.Add_Click({
+    try {
+        $hostname = $hostInput.Text.Trim()
+        if ($hostname.Length -gt 253 -or $hostname -notmatch '\.' -or @($hostname.Split('.') | Where-Object {$_ -notmatch '^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$'}).Count) {throw 'Enter a valid public company hostname.'}
+        if ([Convert]::FromBase64String($keyInput.Text.Trim()).Length -ne 32) {throw 'The release public key must decode to 32 bytes.'}
+        if ($publisherInput.Text.Trim() -notmatch '^[A-Fa-f0-9]{40}$') {throw 'Enter the trusted certificate thumbprint from your release policy.'}
+        if (-not (Test-Path -LiteralPath $executableInput.Text -PathType Leaf)) {throw 'Select the signed management executable.'}
+        if (-not (Test-Path -LiteralPath $componentsInput.Text -PathType Container)) {throw 'Select the prepared server components folder.'}
+        $parameters = @{Executable=$executableInput.Text;ReleasePublicKey=$keyInput.Text.Trim();PublisherThumbprint=$publisherInput.Text.Trim();ComponentsDirectory=$componentsInput.Text;PublicHostname=$hostname}
+        $worker = [Management.Automation.PowerShell]::Create()
+        $worker.AddScript($script:installerText).AddParameters($parameters) | Out-Null
+        $handle = $worker.BeginInvoke()
+        $script:operation = @{Worker=$worker;Handle=$handle;Hostname=$hostname}
+        foreach ($control in @($hostInput,$keyInput,$publisherInput,$executableInput,$componentsInput,$fileButton,$folderButton,$installButton,$closeButton)) {$control.Enabled=$false}
+        $log.Text = 'Installing company components. Public certificate issuance depends on DNS and reachability.'
+        $status.Text = 'Installation is running. Keep this wizard open until it finishes.'
+        $progress.Style = 'Marquee'
+        $timer.Start()
+    } catch {$log.Text=$_.Exception.Message}
+})
+$timer.Add_Tick({
+    if (-not $script:operation -or -not $script:operation.Handle.IsCompleted) {return}
+    $timer.Stop()
+    $operation = $script:operation
+    try {
+        $operation.Worker.EndInvoke($operation.Handle) | Out-Null
+        if ($operation.Worker.HadErrors) {throw ($operation.Worker.Streams.Error | Out-String)}
+        $log.Text = ($operation.Worker.Streams.Information | Out-String).Trim()
+        $script:setupUrl = 'https://'+$operation.Hostname
+        $webButton.Enabled = $true
+        $status.Text = 'Server installed. Complete company setup over HTTPS. Retrieve the one-time token from protected server data.'
+    } catch {
+        $log.Text = $_.Exception.Message
+        $status.Text = 'Installation failed. Review the error and retained files before retrying.'
+        foreach ($control in @($hostInput,$keyInput,$publisherInput,$executableInput,$componentsInput,$fileButton,$folderButton)) {$control.Enabled=$true}
+        $installButton.Enabled = $administrator
+    } finally {
+        $operation.Worker.Dispose()
+        $script:operation = $null
+        $closeButton.Enabled = $true
+        $progress.Style = 'Blocks'
+    }
+})
+$form.Add_FormClosing({param($sender,$event)
+    if ($script:operation) {$event.Cancel=$true;$status.Text='Wait for the current installation to finish before closing.'}
+})
+if (-not $RenderPreview) {
+    # Keep the actions above the taskbar on a 1024x768 server console. Smaller
+    # work areas retain all controls through scrolling rather than clipping.
+    $area = [Windows.Forms.Screen]::FromControl($form).WorkingArea
+    $form.AutoScroll = $true
+    $form.AutoScrollMinSize = $form.ClientSize
+    $size = [Drawing.Size]::new([Math]::Min($form.Width,$area.Width),[Math]::Min($form.Height,$area.Height))
+    $form.MinimumSize = $size
+    $form.MaximumSize = $size
+    $form.Size = $size
+    $form.StartPosition = 'Manual'
+    $form.Location = [Drawing.Point]::new(($area.Left+[int](($area.Width-$form.Width)/2)),($area.Top+[int](($area.Height-$form.Height)/2)))
+}
+try {
+    if ($RenderPreview) {
+        $form.CreateControl()
+        $form.PerformLayout()
+        $bitmap = [Drawing.Bitmap]::new($form.Width,$form.Height)
+        try {
+            $form.DrawToBitmap($bitmap,[Drawing.Rectangle]::new(0,0,$form.Width,$form.Height))
+            # Hidden forms suppress child drawing. Render each control without
+            # showing the form or enabling installation/browser actions.
+            $graphics = [Drawing.Graphics]::FromImage($bitmap)
+            $left = [int](($form.Width-$form.ClientSize.Width)/2)
+            $top = $form.Height-$form.ClientSize.Height-$left
+            try {
+                foreach ($control in $form.Controls) {
+                    $child = [Drawing.Bitmap]::new($control.Width,$control.Height)
+                    try {
+                        $control.DrawToBitmap($child,[Drawing.Rectangle]::new(0,0,$control.Width,$control.Height))
+                        $graphics.DrawImageUnscaled($child,($left+$control.Left),($top+$control.Top))
+                    } finally {$child.Dispose()}
+                }
+            } finally {$graphics.Dispose()}
+            $bitmap.Save([IO.Path]::GetFullPath($RenderPreview),[Drawing.Imaging.ImageFormat]::Png)
+        } finally {$bitmap.Dispose()}
+    } else {[Windows.Forms.Application]::Run($form)}
+} finally {$timer.Dispose();$form.Dispose()}
diff --git a/deployment/windows/Sign-CompanyArtifact.ps1 b/deployment/windows/Sign-CompanyArtifact.ps1
new file mode 100644
index 00000000000..40a47f71b2d
--- /dev/null
+++ b/deployment/windows/Sign-CompanyArtifact.ps1
@@ -0,0 +1,57 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$ArtifactPath,
+    [Parameter(Mandatory=$true)][string]$ExpectedSha256,
+    [Parameter(Mandatory=$true)][string]$OutputPath,
+    [Parameter(Mandatory=$true)][string]$CertificateThumbprint,
+    [ValidateSet('CurrentUser','LocalMachine')][string]$CertificateStore='CurrentUser',
+    [Parameter(Mandatory=$true)][string]$Publisher,
+    [Parameter(Mandatory=$true)][string]$SignToolPath,
+    [Parameter(Mandatory=$true)][string]$TimestampUrl
+)
+$ErrorActionPreference='Stop'
+if ($ExpectedSha256 -notmatch '^[0-9a-fA-F]{64}$' -or $CertificateThumbprint -notmatch '^[0-9a-fA-F]{40}$') { throw 'Invalid artifact hash or certificate thumbprint.' }
+$source=(Resolve-Path -LiteralPath $ArtifactPath).Path
+$extension=[IO.Path]::GetExtension($source).ToLowerInvariant()
+if ($extension -notin @('.exe','.msi')) { throw 'Only locally prepared EXE or MSI artifacts can be signed.' }
+if ((Get-FileHash -LiteralPath $source -Algorithm SHA256).Hash -ine $ExpectedSha256) { throw 'Input artifact hash mismatch.' }
+$destination=[IO.Path]::GetFullPath($OutputPath)
+if ([IO.Path]::GetExtension($destination).ToLowerInvariant() -ne $extension -or (Test-Path -LiteralPath $destination) -or (Test-Path -LiteralPath ($destination+'.signing.json'))) { throw 'Use a new output filename with the same artifact extension.' }
+if (-not (Test-Path -LiteralPath ([IO.Path]::GetDirectoryName($destination)) -PathType Container)) { throw 'Output directory must already exist.' }
+$timestamp=[Uri]$TimestampUrl
+# RFC3161 responses are signed and verified by SignTool/Authenticode. SDK tools
+# and common providers use HTTP; accept the operator's explicit URL without
+# falling back or recording credentials in the public signing receipt.
+if (-not $timestamp.IsAbsoluteUri -or $timestamp.Scheme -notin @('http','https') -or -not $timestamp.Host -or $timestamp.UserInfo -or $timestamp.Query -or $timestamp.Fragment) { throw 'Use an HTTP or HTTPS RFC3161 timestamp endpoint without credentials, query parameters or fragments.' }
+$tool=(Resolve-Path -LiteralPath $SignToolPath).Path
+$toolSignature=Get-AuthenticodeSignature -LiteralPath $tool
+if ($toolSignature.Status -ne 'Valid' -or $toolSignature.SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName,$false) -ne 'Microsoft Corporation') { throw 'SignTool must be a trusted Microsoft-signed Windows SDK executable.' }
+$certificate=Get-Item -LiteralPath ('Cert:\'+$CertificateStore+'\My\'+$CertificateThumbprint)
+if (-not $certificate.HasPrivateKey -or $certificate.NotBefore.ToUniversalTime() -gt [DateTime]::UtcNow -or $certificate.NotAfter.ToUniversalTime() -le [DateTime]::UtcNow) { throw 'An active company certificate with a local private-key provider is required.' }
+if (-not ($certificate.EnhancedKeyUsageList | Where-Object {$_.ObjectId -eq '1.3.6.1.5.5.7.3.3'})) { throw 'Certificate must permit code signing.' }
+if ($certificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName,$false) -cne $Publisher) { throw 'Selected certificate does not match the explicit company publisher.' }
+$hasher=[Security.Cryptography.SHA256]::Create()
+try {$certificateHash=[BitConverter]::ToString($hasher.ComputeHash($certificate.RawData)).Replace('-','')} finally {$hasher.Dispose()}
+$staging=$destination+'.'+[Guid]::NewGuid().ToString('N')+'.partial'+$extension
+try {
+    [IO.File]::Copy($source,$staging,$false)
+    if ((Get-FileHash -LiteralPath $staging -Algorithm SHA256).Hash -ine $ExpectedSha256) { throw 'Staged artifact differs from the pinned input.' }
+    $arguments=@('sign','/sha1',$CertificateThumbprint,'/fd','SHA256','/tr',$timestamp.AbsoluteUri,'/td','SHA256')
+    if ($CertificateStore -eq 'LocalMachine') {$arguments+='/sm'}
+    & $tool @arguments $staging
+    if ($LASTEXITCODE -ne 0) { throw 'Company signing failed; no output artifact was published.' }
+    & $tool verify /pa /all /tw $staging
+    if ($LASTEXITCODE -ne 0) { throw 'Company signature or trusted timestamp verification failed; no output artifact was published.' }
+    $null=& (Join-Path $PSScriptRoot 'Verify-Package.ps1') -Path $staging -Publisher $Publisher -CertificateSha256 $certificateHash
+    # Windows PowerShell 5.1 on Server 2016 can return a null timestamp
+    # certificate for a valid RFC3161 signature. SignTool /tw above warns
+    # (nonzero exit) when a timestamp is absent and verifies its trust.
+    $hash=(Get-FileHash -LiteralPath $staging -Algorithm SHA256).Hash
+    [IO.File]::Move($staging,$destination)
+    $record=@{schema=1;input_sha256=$ExpectedSha256.ToLowerInvariant();sha256=$hash.ToLowerInvariant();publisher=$Publisher;publisher_certificate_sha256=$certificateHash.ToLowerInvariant();timestamp_url=$timestamp.AbsoluteUri;timestamp_verification='signtool-verify-pa-all-tw';artifact=[IO.Path]::GetFileName($destination)}
+    [IO.File]::WriteAllText($destination+'.signing.json',($record | ConvertTo-Json))
+    Write-Output ('Verified company-signed artifact: '+$destination)
+} catch {
+    if (Test-Path -LiteralPath $staging) {Remove-Item -LiteralPath $staging -Force}
+    throw
+}
diff --git a/deployment/windows/Start-LocalTest.ps1 b/deployment/windows/Start-LocalTest.ps1
new file mode 100644
index 00000000000..710ebf1c28d
--- /dev/null
+++ b/deployment/windows/Start-LocalTest.ps1
@@ -0,0 +1,24 @@
+param(
+    [string]$EnvironmentFile = (Join-Path $PSScriptRoot 'local-test.env'),
+    [string]$ServerExecutable = (Join-Path $PSScriptRoot '../../product/target/debug/swan-management.exe')
+)
+$ErrorActionPreference = 'Stop'
+if (!(Test-Path -LiteralPath $EnvironmentFile)) { throw 'Create local-test.env from local-test.env.example first.' }
+# Only named server settings are accepted; the file is data, never PowerShell code.
+$allowed = @('SWAN_LISTEN', 'SWAN_DATA_DIR', 'SWAN_RELEASE_PUBLIC_KEY', 'SWAN_TEST_TLS_PORT', 'SWAN_TEST_TLS_PFX', 'SWAN_TEST_TLS_PASSWORD', 'SWAN_TEST_FAULTS', 'SWAN_TEST_CA_FILE')
+foreach ($line in Get-Content -LiteralPath $EnvironmentFile) {
+    if (!$line.Trim() -or $line.TrimStart().StartsWith('#')) { continue }
+    if ($line -notmatch '^([A-Z_]+)=(.*)$' -or $Matches[1] -notin $allowed) { throw 'Invalid local environment setting.' }
+    [Environment]::SetEnvironmentVariable($Matches[1], $Matches[2], 'Process')
+}
+if ($env:SWAN_LISTEN -notmatch '^127\.0\.0\.1:\d+$') { throw 'Local tests must bind to loopback.' }
+if (!$env:SWAN_DATA_DIR) { throw 'Set a separate local test data directory.' }
+$testDataPath = [IO.Path]::GetFullPath($env:SWAN_DATA_DIR)
+New-Item -ItemType Directory -Path $testDataPath -Force | Out-Null
+$testUserSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+& icacls.exe $testDataPath /inheritance:r /grant:r ('*' + $testUserSid + ':(OI)(CI)F') '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+if ($LASTEXITCODE -ne 0) { throw 'Failed to protect local test data.' }
+$env:SWAN_DATA_DIR = $testDataPath
+if (!(Test-Path -LiteralPath $ServerExecutable)) { throw 'Build the product workspace before starting local tests.' }
+& $ServerExecutable
+if ($LASTEXITCODE -ne 0) { throw "Management server exited with code $LASTEXITCODE" }
diff --git a/deployment/windows/Start-TestVm.ps1 b/deployment/windows/Start-TestVm.ps1
new file mode 100644
index 00000000000..8bdadd469bc
--- /dev/null
+++ b/deployment/windows/Start-TestVm.ps1
@@ -0,0 +1,39 @@
+param(
+    [Parameter(Mandatory=$true)][string]$QemuDirectory,
+    [Parameter(Mandatory=$true)][string]$IsoPath,
+    [Parameter(Mandatory=$true)][string]$LabDirectory,
+    [ValidatePattern('^[a-z0-9-]+$')][string]$Name = 'server-2025',
+    [ValidateSet('whpx','whpx-userspace','whpx-baseline','tcg')][string]$Accelerator = 'tcg',
+    [ValidateRange(2048,8192)][int]$MemoryMiB = 4096
+)
+$ErrorActionPreference = 'Stop'
+$lab = [IO.Path]::GetFullPath($LabDirectory)
+$vm = [IO.Path]::GetFullPath((Join-Path $lab $Name))
+if (-not $vm.StartsWith($lab.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase)) {
+    throw 'VM directory must stay within the test lab'
+}
+$disk = Join-Path $vm 'system.qcow2'
+$qemu = Join-Path $QemuDirectory 'qemu-system-x86_64.exe'
+foreach ($required in @($disk,$qemu,$IsoPath)) {
+    if (-not (Test-Path -LiteralPath $required -PathType Leaf)) { throw "Missing file: $required" }
+}
+$iso = Get-Item -LiteralPath $IsoPath
+$completionPath = $iso.FullName + '.download-complete.json'
+if (-not (Test-Path -LiteralPath $completionPath -PathType Leaf)) { throw 'Missing ISO completion record' }
+$completion = Get-Content -LiteralPath $completionPath -Raw | ConvertFrom-Json
+if ($completion.bytes -ne $iso.Length -or $completion.sha256 -notmatch '^[a-fA-F0-9]{64}$') { throw 'Invalid ISO completion record' }
+if ((Get-FileHash -LiteralPath $iso.FullName -Algorithm SHA256).Hash -ne $completion.sha256) { throw 'ISO changed after download completion' }
+if ((Get-CimInstance Win32_OperatingSystem).FreePhysicalMemory / 1024 -lt ($MemoryMiB + 1536)) { throw 'Insufficient memory for the guest and host reserve' }
+$running = Get-CimInstance Win32_Process -Filter "Name='qemu-system-x86_64.exe'"
+if ($running | Where-Object { $_.CommandLine -and $_.CommandLine.Contains($disk) }) { throw 'Guest disk is already in use' }
+# Reconstruct fixed arguments; saved metadata must never supply arbitrary QEMU options.
+$acceleratorOption = if ($Accelerator -in @('whpx-userspace','whpx-baseline')) { 'whpx,hyperv=off,kernel-irqchip=off' } else { $Accelerator }
+$cpuModel = if ($Accelerator -eq 'whpx-baseline') { 'Westmere-v2' } elseif ($Accelerator -eq 'tcg') { 'max' } else { 'host' }
+$arguments = @('-name',$Name,'-machine','q35','-accel',$acceleratorOption,
+    '-cpu',$cpuModel,'-m',$MemoryMiB.ToString(),'-smp','2','-drive',"file=$disk,format=qcow2",
+    '-cdrom',$iso.FullName,'-boot','order=d','-nic','user,model=e1000',
+    '-display','none','-vnc','127.0.0.1:20','-monitor','tcp:127.0.0.1:4444,server=on,wait=off')
+[ordered]@{ accelerator=$Accelerator;started_utc=[DateTime]::UtcNow.ToString('o') } |
+    ConvertTo-Json | Set-Content -LiteralPath (Join-Path $vm 'last-start.json') -Encoding UTF8
+& $qemu @arguments
+if ($LASTEXITCODE -ne 0) { throw "QEMU exited with code $LASTEXITCODE" }
diff --git a/deployment/windows/TECHNICIAN-MSI.md b/deployment/windows/TECHNICIAN-MSI.md
new file mode 100644
index 00000000000..799ac9b9758
--- /dev/null
+++ b/deployment/windows/TECHNICIAN-MSI.md
@@ -0,0 +1,219 @@
+# Technician MSI packaging
+
+`msi/Technician.wxs` defines the generic per-user x64 technician MSI. Its fixed
+upgrade and component identifiers do not depend on a company display name. It
+installs the packed technician executable, agent, graphical-launcher script and
+license under `%LOCALAPPDATA%/SwanRemoteSupport-Technician`, with a Start menu
+shortcut. Upgrade removal is scheduled inside the MSI transaction. Company
+state is not an MSI-owned file and is preserved through major upgrades.
+
+Release signing order matters: sign the packed technician executable and agent
+with the same release publisher before invoking `Build-TechnicianMsi.ps1`
+without `-UnsignedTest`. Prepare the unsigned MSI's reproducible metadata, then
+sign and timestamp that MSI. Generate release metadata from the final signed
+MSI, signed packed executable and signed agent hashes. Signing an unsigned CI
+MSI alone leaves its embedded executable unsigned: setup can install its files
+but final installed-publisher verification rejects it, retains recovery state
+and does not record a completed release. The 23 October lab test demonstrates
+this rejection; it is not a successful company-bundle installation.
+The subsequent sequence-10 lab package followed the correct signing order and
+passed explicit failed-setup recovery in a Server 2016 administrator profile,
+including installed publisher/hash checks, retained old-marker evidence and
+sequence commit. See the dated [acceptance report](../../docs/ACCEPTANCE.md) for
+the exact source and limits; fresh-machine and standard-user bundle acceptance
+remain open.
+
+The pinned WiX 5.0.2 build tool requires .NET Framework 4.7.2 or later on the
+MSI build machine. An unupdated Server 2016 image with 4.6.2 needs this build
+prerequisite separately. This is distinct from the endpoint application's
+runtime requirements. The ordinary company worker bundles already built,
+signed release packages; it does not rebuild their MSI payloads by default.
+Versions must use canonical ASCII `major.minor.build` fields without leading
+zeroes (except `0`), within `255.255.65535`. Both builders reject aliases and
+overflow before authoring product identities. These limits follow Microsoft's
+[ProductVersion specification](https://learn.microsoft.com/windows/win32/msi/productversion).
+
+ProductCode is a UUIDv5 derived from the stable edition UpgradeCode namespace
+and `windows-x64|<software-version>`. Identical-version rebuilds therefore keep
+the same product identity; a new software version gets a new identity. Company
+names and branding are not identity inputs. The customer builder uses the same
+rule with its own existing UpgradeCode. Stable ProductCode alone does not make
+MSI bytes reproducible or qualify upgrade/recovery behavior.
+
+`Set-ReproducibleMsiMetadata.ps1 -InputMsi <original> -OutputMsi <new-unsigned.msi>
+-SourceDateEpoch <release-commit-epoch>` prepares a separate unsigned copy before
+signing. It fixes summary timestamps, clears the permitted root-storage modified
+time and derives a UUIDv5 PackageCode from the resulting canonical package hash.
+Changes to package content or the epoch change the PackageCode. Existing outputs
+and signed inputs are rejected. Originals remain intact. Both MSI builders enable
+this step with `-SourceDateEpoch <release-commit-epoch>`, retaining the raw WiX
+output and recording the metadata receipt. The Windows build workflow passes
+its pinned source-commit epoch and runs the staging and metadata guard tests;
+its execution and independent native comparisons are recorded below. The company
+worker does not invoke this build step by default.
+
+Two actual WiX 5.0.2 technician builds using the same `e6b87b9` payload produced
+identical prepared MSI bytes at epoch `1792648409`: SHA-256
+`68ea4ffe612d521a8354910381fb964b18624d413f73c207181bb068ae627855`.
+Two subsequent full technician builder invocations with this option produced
+identical final unsigned bytes, SHA-256
+`bc349fff46cf371579e2f99d78ec11713768896531013f074358daf01cd76efb`.
+The native metadata test passes under Windows PowerShell 5.1 and checks
+idempotence, changed-epoch and changed-table package identities, overwrite
+rejection, signed-input rejection and preservation of original files. This does
+not establish independent CI reproducibility, signing reproducibility or
+clean-machine installer lifecycles. Those remain release gates.
+
+Metadata preparation alone did not remove input timestamps from cabinets: two
+copies of identical executable/agent bytes dated in 2020 and 2025 initially
+produced different MSI hashes. With `-SourceDateEpoch`, the builders now stage
+byte-verified copies of every payload, launcher and license input with consistent
+cabinet timestamps, without changing originals. Reparse points and destinations
+inside the source tree are rejected. Repeating those different-timestamp
+technician builds produced identical SHA-256
+`96d33dd08f5f30a49d9d318017e7ff343f4e20f87f837ad0499b5ae4c4c709e5`.
+The staging checks passed on Windows PowerShell 5.1. Cross-time-zone builders
+and independently downloaded binary inputs remain unverified.
+
+Metadata format references: Microsoft's [package codes](https://learn.microsoft.com/en-us/windows/win32/msi/package-codes),
+[summary revision](https://learn.microsoft.com/en-us/windows/win32/msi/revision-number-summary)
+and [compound-file root directory](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/026fde6e-143d-41bf-a7da-c08b2130d50e).
+
+Windows Installer policy can prohibit unmanaged per-user installations. A
+standard-user test of the signed `e6b87b9` package on Server 2022 build
+`20348.587` returned error 1625: the MSI log reported effective `DisableMsi=1`,
+although no explicit registry policy value was present. No payload or per-user
+registration remained. Repair and uninstall were not run after that failure.
+An absent registry value therefore does not establish that installation is
+permitted. Company setup reports this policy rejection and directs the user to
+their administrator for an approved deployment; it does not change the policy
+or silently retry with elevated privileges. See Microsoft's
+[DisableMSI documentation](https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi).
+
+The original unsigned 1.5.0 MSI at `e9d89ca` also returned 1625 on Server 2016
+`14393.693` under an actual standard user in active console session 1. Its log
+reported effective `DisableMsi=1`, with no explicit machine registry value. The
+technician directory remained absent. This stopped the proposed 1.5.1 upgrade
+test at initial installation; no standard-user upgrade/repair/uninstall pass is
+claimed. The same exact MSI inputs passed an administrator-profile major upgrade
+on that VM. No installer policy was changed. See the dated
+[acceptance records](../../docs/ACCEPTANCE.md) for the distinct scopes.
+
+Complete independent native builds at `e9d89ca` (1.5.0) and `699c9e0` (1.5.1)
+now have [original comparison reports](../../docs/SOURCE_AND_LICENSE.md) proving
+all eight unsigned shipping files byte-identical within each source revision.
+On Server 2016 `14393.693`, the actual 1.5.0 to 1.5.1 administrator-profile MSI
+upgrade, subsequent missing-executable repair and uninstall passed. These
+results do not qualify standard-user installation on a server that rejects
+unmanaged MSI packages, company bootstrap, automatic updates or recovery.
+
+Build with pinned WiX 5.0.2:
+
+```powershell
+./deployment/windows/Build-TechnicianMsi.ps1 `
+  -WixExe C:/BuildTools/WiX/bin/wix.exe `
+  -TechnicianExe C:/Release/SwanRemoteSupport-Technician.exe `
+  -AgentExe C:/Release/swan-agent.exe `
+  -Version 1.5.0 -Output C:/Release/SwanRemoteSupport-Technician-unsigned.msi
+```
+
+Production inputs require valid signatures from the same release publisher.
+The builder itself produces an unsigned MSI; sign that container separately,
+then compute release hashes and publish signed release metadata. `-UnsignedTest`
+allows clearly marked local/CI test payloads and does not bypass installation,
+worker or updater trust checks. No project signing key is provided to a company.
+
+The technician update helper also identifies MSI exit 1625 as a Windows policy
+rejection and directs the user to their company administrator. Existing signed
+receipt, rollback and publisher checks remain in force; this diagnostic does
+not elevate the installer or change Windows policy.
+
+The official WiX package is pinned to SHA-256
+`097383b2773bdd3d76a6a2cd3f4de6357bae59172e1b6fa5ad87ce062074e8d0`.
+`Expand-WixBuildTools.ps1` reads its MSI tables and extracts tools without running
+the supplier installer. `Build-TechnicianMsi.ps1` checks the extracted executable
+publisher and exact tool version before execution. Native CI includes this
+recipe and uploads the unsigned MSI with its build-input hashes.
+
+A company worker consumes the approved unchanged MSI release and bundles it
+with public company bootstrap data and canonical setup scripts. Technician
+bundle downloads require company authentication. Run `Install-Company.ps1` to
+validate, configure and record installation, rather than launching the bare MSI
+and assuming it has enrolled or configured the app.
+
+For a managed deployment, an explicit public bootstrap file can be provided:
+
+```powershell
+./Install-Company.ps1 -BootstrapPath C:/Deployment/company-bootstrap.json `
+  -ConfirmedCompanyDomain support.example.com
+```
+
+This confirms the exact HTTPS hostname and retains signed endpoint/profile,
+company ownership, hash, publisher and installed-identity checks. The bootstrap
+contains no technician credentials. Without this explicit hostname, setup asks
+for confirmation interactively. Unattended customer consent remains a separate
+explicit action; this parameter cannot grant it.
+
+The technician updater supports both portable EXEs and MSI containers. MSI
+artifact and installed executable hashes are distinct signed fields. MSI
+installation uses the canonical per-user folder and requires full installed
+application/agent verification before the pending receipt is cleared.
+
+Failed MSI updates can now enter durable technician rollback when the previous
+signed release and agent both support rollback protocol 1. Recovery requires the
+retained original MSI and complete verified snapshot. It checks the current
+user's edition-specific upgrade family and cached product identities before
+removing only the exact failed ProductCode, then installs or repairs the verified
+previous package. Unexpected registrations stop recovery. Interrupted removal
+or restoration leaves the signed receipt pending for retry; no company identity
+or consent is restored from software snapshots. Hash, publisher, installed-file
+and agent checks must pass before quarantining the failed release and clearing
+the receipt. The same registration recovery now supports customer MSI releases,
+with additional service and configuration-task ownership checks.
+
+`Restore-ReleaseMsi.ps1 -Edition technician -InspectOnly` performs read-only identity and
+registration planning and exits before invoking Windows Installer. It is a
+diagnostic, not evidence that native rollback succeeds. Production recovery
+uses the signed agent's prior hash/publisher checks and does not select this mode.
+
+A separate staged recovery task implements logon and periodic retry even when
+the installed agent has been removed during rollback. Explicit MSI uninstall
+cancels recovery before removing its files; the paired uninstall rollback
+restores the prior cancellation state. See [update recovery](UPDATE-RECOVERY.md).
+Task execution and reboot recovery remain native acceptance gates.
+
+## Evidence and remaining work
+
+An actual unsigned MSI was built locally with WiX `5.0.2+aa65968c` from the
+verified native `31b13aa` artifact. The MSI tables contain the four expected files,
+stable upgrade code, per-user location, major-upgrade behavior and Windows
+launch conditions. A second build rehearsed the extraction/build scripts.
+Packages and their hashes remain outside Git. No supplier installer or product
+installer ran on this host during these builds. Rust product tests and
+PowerShell parsing pass.
+
+A separate disposable administrator on Server 2022 build `20348.587` passed
+install, missing-executable repair and uninstall for the stable-identity 1.5.0
+MSI built with recipe `67786dd` and verified `e6b87b9` lab-signed payloads. The
+MSI was unsigned (SHA-256
+`f3cb6e56229488b9d6d4dec0e07318a5520b82ee66177435ae358c98faf348e7`).
+All phases returned zero, and execution policy stayed unchanged. This does not
+supersede the standard-user policy failure described above.
+
+That isolated administrative profile also passed reinstall after uninstall,
+the MSI 1.5.0-to-1.5.1 major upgrade, and uninstall of 1.5.1. All operations
+returned zero; old/new product registration, payload hashes, shortcut and an
+unowned fixture file were checked. Both packages contained the same application
+payload. This does not demonstrate an application update or preservation of
+real enrollment/consent state.
+
+The full clean-machine matrix, company setup, upgrades between different native
+application builds, signed automatic MSI updates and interruption rollback remain unverified.
+Customer MSI authoring is available separately; end-to-end company
+publication remains unverified. The bare MSI launch conditions do not replace the signed agent's
+Windows compatibility preflight. Advertised Windows compatibility requires the
+full acceptance matrix.
+
+Sources: [WiX 5.0.2](https://github.com/wixtoolset/wix/releases/tag/v5.0.2),
+[package scope](https://docs.firegiant.com/wix/schema/wxs/package/) and
+[major-upgrade transaction scheduling](https://docs.firegiant.com/wix/schema/wxs/majorupgrade/).
diff --git a/deployment/windows/Test-DisposableMsi.ps1 b/deployment/windows/Test-DisposableMsi.ps1
new file mode 100644
index 00000000000..b62573525c4
--- /dev/null
+++ b/deployment/windows/Test-DisposableMsi.ps1
@@ -0,0 +1,126 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][ValidateSet('customer','technician')][string]$Edition,
+    [Parameter(Mandatory)][ValidateSet('install','repair','uninstall')][string]$Phase,
+    [Parameter(Mandatory)][string]$Package,
+    [Parameter(Mandatory)][ValidatePattern('^[a-fA-F0-9]{64}$')][string]$PackageSha256,
+    [Parameter(Mandatory)][ValidatePattern('^[a-fA-F0-9]{64}$')][string]$AgentSha256,
+    [Parameter(Mandatory)][ValidatePattern('^[a-fA-F0-9]{40}$')][string]$SourceRevision,
+    [Parameter(Mandatory)][string]$ExpectedComputerName,
+    [Parameter(Mandatory)][string]$ResultDirectory,
+    [string]$Manifest,
+    [string]$ManifestSha256,
+    [string]$TechnicianSha256,
+    [switch]$RequireStandardUser
+)
+$ErrorActionPreference='Stop'
+# This deliberately mutates a disposable guest. A private, independently
+# provisioned marker and exact machine name prevent accidental host execution.
+if ($env:COMPUTERNAME -cne $ExpectedComputerName) { throw 'Wrong test computer.' }
+$marker = Get-Content -LiteralPath 'C:/SwanLab/disposable-lab.json' -Raw | ConvertFrom-Json
+if ($marker.purpose -cne 'swan-disposable-windows-acceptance' -or $marker.computer_name -cne $ExpectedComputerName) { throw 'Disposable guest marker missing or mismatched.' }
+if (-not [Environment]::Is64BitProcess) { throw 'Run the x64 test shell.' }
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+$administrator=([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if ($Edition -eq 'customer' -and -not $administrator) { throw 'Customer MSI tests require an administrator.' }
+if ($RequireStandardUser -and ($Edition -ne 'technician' -or $administrator)) { throw 'Expected a standard-user technician test.' }
+$packagePath=(Resolve-Path -LiteralPath $Package).Path
+if ([IO.Path]::GetExtension($packagePath) -ine '.msi' -or (Get-FileHash -LiteralPath $packagePath -Algorithm SHA256).Hash -ine $PackageSha256) { throw 'MSI hash or format mismatch.' }
+$msi=& (Join-Path $PSScriptRoot 'Get-MsiIdentity.ps1') -Package $packagePath | ConvertFrom-Json
+$upgrade=if($Edition -eq 'customer'){'{32A585D7-9A78-4AD2-AF72-D0266EFC709D}'}else{'{A4374699-436F-4917-9A4E-223F62A9E634}'}
+if ($msi.upgrade_code -ine $upgrade -or $msi.template -notmatch '^x64;' -or $msi.product_code -notmatch '^\{[A-Fa-f0-9-]{36}\}$') { throw 'Unexpected MSI edition or architecture.' }
+$compatibility=(& (Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell/v1.0/powershell.exe') -NoProfile -NonInteractive -File (Join-Path $PSScriptRoot 'Get-WindowsCompatibility.ps1') | Out-String).Trim()
+if ($LASTEXITCODE -ne 0 -or $compatibility -notmatch '^(windows_10|windows_11|server_2016|server_2019|server_2022|server_2025)$') { throw 'Unsupported guest operating system.' }
+$install=if($Edition -eq 'customer'){Join-Path $env:ProgramFiles 'Swan Remote Support'}else{Join-Path $env:LOCALAPPDATA 'SwanRemoteSupport-Technician'}
+$main=Join-Path $install $(if($Edition -eq 'customer'){'Swan Remote Support.exe'}else{'SwanRemoteSupport-Technician.exe'})
+$agent=if($Edition -eq 'customer'){Join-Path $env:ProgramData 'SwanRemoteSupport/swan-agent.exe'}else{Join-Path $install 'swan-agent.exe'}
+$installer=New-Object -ComObject WindowsInstaller.Installer
+$shortcut=if($Edition -eq 'technician'){Join-Path ([Environment]::GetFolderPath('Programs')) 'Swan Remote Support Technician.lnk'}else{$null}
+$files=@()
+if ($Edition -eq 'technician' -and $TechnicianSha256 -notmatch '^[a-fA-F0-9]{64}$') { throw 'Pinned technician executable hash required.' }
+if ($Edition -eq 'customer') {
+    if ($ManifestSha256 -notmatch '^[a-fA-F0-9]{64}$' -or (Get-FileHash -LiteralPath $Manifest -Algorithm SHA256).Hash -ine $ManifestSha256) { throw 'Pinned customer manifest required.' }
+    # Windows PowerShell 5.1 emits a JSON array as one pipeline object. Assign
+    # it first, then enumerate its entries consistently in both supported shells.
+    $decoded=Get-Content -LiteralPath $Manifest -Raw | ConvertFrom-Json
+    $files=@($decoded)
+    $seen=@{}
+    foreach($file in $files){
+        if ($file.path -notmatch '^[A-Za-z0-9 _\-.@+/]+$' -or @($file.path.Split('/') | Where-Object {$_ -in @('','.', '..') -or $_.EndsWith('.') -or $_.EndsWith(' ')}).Count -or $seen.ContainsKey($file.path) -or $file.sha256 -notmatch '^[a-fA-F0-9]{64}$') { throw 'Unsafe manifest entry.' }
+        $seen[$file.path]=$true
+    }
+    if (@($files | Where-Object path -eq 'LICENSE.txt').Count -ne 1) { throw 'Expected a single packaged license.' }
+}
+function Assert-Payload {
+    if ($installer.ProductState($msi.product_code) -ne 5) { throw 'MSI product is not registered as installed for this account.' }
+    foreach($path in @($main,$agent)){if(-not(Test-Path -LiteralPath $path -PathType Leaf)){throw 'Installed application or agent missing.'}}
+    if ((Get-FileHash -LiteralPath $agent -Algorithm SHA256).Hash -ine $AgentSha256) { throw 'Installed agent hash mismatch.' }
+    if ($Edition -eq 'technician' -and (Get-FileHash -LiteralPath $main -Algorithm SHA256).Hash -ine $TechnicianSha256) { throw 'Installed technician hash mismatch.' }
+    if ($Edition -eq 'technician' -and -not (Test-Path -LiteralPath $shortcut -PathType Leaf)) { throw 'Technician shortcut missing.' }
+    foreach($file in $files){
+        $path=Join-Path $install $file.path
+        if ((Get-Item -LiteralPath $path).Attributes -band [IO.FileAttributes]::ReparsePoint -or (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash -ine $file.sha256) { throw "Installed file differs: $($file.path)" }
+    }
+    if($Edition -eq 'customer'){
+        $service=Get-CimInstance Win32_Service -Filter "Name='Swan Remote Support'"
+        if(-not $service -or $service.PathName -ine ('"'+$main+'" --service') -or $service.StartName -ne 'LocalSystem' -or $service.State -ne 'Running'){throw 'Customer service ownership, startup or executable mismatch.'}
+    }
+}
+if($Phase -eq 'install'){
+    if ($installer.ProductState($msi.product_code) -ne -1) { throw 'Fresh installation requires an unregistered product.' }
+    if((Test-Path -LiteralPath $install) -or (Test-Path -LiteralPath $agent)){throw 'Fresh installation requires an unused product directory.'}
+    if($Edition -eq 'customer' -and (Get-CimInstance Win32_Service -Filter "Name='Swan Remote Support'")){throw 'Customer service already present.'}
+}else{
+    Assert-Payload
+}
+$resultRoot=[IO.Path]::GetFullPath($ResultDirectory)
+if(Test-Path -LiteralPath $resultRoot){throw 'Use a new result directory for each phase.'}
+New-Item -ItemType Directory -Path $resultRoot | Out-Null
+if($Phase -eq 'repair' -and $Edition -eq 'customer'){
+    # Modify only a previously hash-verified, non-executable package key path.
+    [IO.File]::WriteAllText((Join-Path $install 'LICENSE.txt'),'Disposable repair test: replace this damaged packaged file.')
+}
+if($Phase -eq 'repair' -and $Edition -eq 'technician'){
+    # Prove missing-file recovery instead of merely invoking repair on an intact
+    # installation. Retain the previously verified test executable as evidence.
+    $repairSource=[IO.Path]::GetFullPath($main)
+    $repairBackup=[IO.Path]::GetFullPath((Join-Path $resultRoot 'repair-retained-technician.exe'))
+    if(-not $repairSource.StartsWith([IO.Path]::GetFullPath($install).TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase) -or
+       -not $repairBackup.StartsWith($resultRoot.TrimEnd('\')+'\',[StringComparison]::OrdinalIgnoreCase) -or
+       (Get-Item -LiteralPath $install).Attributes -band [IO.FileAttributes]::ReparsePoint -or
+       (Get-Item -LiteralPath $main).Attributes -band [IO.FileAttributes]::ReparsePoint -or
+       (Get-Item -LiteralPath $resultRoot).Attributes -band [IO.FileAttributes]::ReparsePoint -or
+       (Test-Path -LiteralPath $repairBackup)) {throw 'Repair fixture escaped its owned installation or evidence directory.'}
+    Move-Item -LiteralPath $repairSource -Destination $repairBackup
+    if((Get-FileHash -LiteralPath $repairBackup -Algorithm SHA256).Hash -ine $TechnicianSha256 -or (Test-Path -LiteralPath $main)){throw 'Missing-file repair preparation failed.'}
+}
+$operation=if($Phase -eq 'install'){'/i'}elseif($Phase -eq 'repair'){'/fvamus'}else{'/x'}
+$log=Join-Path $resultRoot 'msi.log'
+$windows=Get-ItemProperty -LiteralPath 'HKLM:/SOFTWARE/Microsoft/Windows NT/CurrentVersion'
+# Windows 11 retains a Windows 10 ProductName for compatibility in this key.
+# Use the operating-system provider for its actual identity; retain UBR for the
+# exact installed revision. Earlier evidence must retain its original caption.
+$operatingSystem=Get-CimInstance Win32_OperatingSystem
+$os=[ordered]@{Caption=$operatingSystem.Caption;Version=$operatingSystem.Version;BuildNumber=$operatingSystem.BuildNumber;OSArchitecture=$operatingSystem.OSArchitecture;revision=$windows.UBR}
+$report=[ordered]@{edition=$Edition;phase=$Phase;source=$SourceRevision;administrator=$administrator;standard_user_required=[bool]$RequireStandardUser;runner_sha256=(Get-FileHash -LiteralPath $PSCommandPath -Algorithm SHA256).Hash.ToLowerInvariant();package_sha256=$PackageSha256.ToLowerInvariant();agent_sha256=$AgentSha256.ToLowerInvariant();msi=$msi;platform=$compatibility;os=$os;exit_code=$null;reboot_required=$false;passed=$false;scope='Bare MSI lifecycle only; no company enrollment, publisher, update or session acceptance'}
+$report['missing_technician_file_repair']=($Phase -eq 'repair' -and $Edition -eq 'technician')
+try{
+    $process=Start-Process -FilePath (Join-Path ([Environment]::GetFolderPath('System')) 'msiexec.exe') -ArgumentList @($operation,('"'+$packagePath+'"'),'/qn','/norestart','/l*v',('"'+$log+'"')) -WindowStyle Hidden -Wait -PassThru
+    $report.exit_code=$process.ExitCode
+    $report.reboot_required=($process.ExitCode -eq 3010)
+    if($process.ExitCode -notin @(0,3010)){throw "MSI phase failed ($($process.ExitCode)); inspect private log."}
+    if($Phase -eq 'uninstall'){
+        if ($installer.ProductState($msi.product_code) -ne -1) { throw 'Uninstall retained MSI product registration.' }
+        foreach($path in @($main,$agent)){if(Test-Path -LiteralPath $path){throw 'Uninstall retained the application or agent executable.'}}
+        foreach($file in $files){if(Test-Path -LiteralPath (Join-Path $install $file.path)){throw "Uninstall retained packaged file: $($file.path)"}}
+        if($Edition -eq 'technician'){
+            foreach($path in @($shortcut,(Join-Path $install 'Open-Technician.ps1'),(Join-Path $install 'LICENSE.txt'))){if(Test-Path -LiteralPath $path){throw 'Uninstall retained technician payload or shortcut.'}}
+            foreach($name in @('Executable','Agent','Launcher','License')){if(Get-ItemProperty -LiteralPath 'HKCU:\Software\SwanRemoteSupport\Technician' -Name $name -ErrorAction SilentlyContinue){throw 'Uninstall retained technician component registration.'}}
+        }
+        if($Edition -eq 'customer' -and (Get-CimInstance Win32_Service -Filter "Name='Swan Remote Support'")){throw 'Uninstall retained the customer service.'}
+    }else{Assert-Payload}
+    $report.passed=$true
+}finally{
+    $report | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath (Join-Path $resultRoot 'result.json')
+}
+$report | ConvertTo-Json -Depth 6
diff --git a/deployment/windows/UPDATE-RECOVERY.md b/deployment/windows/UPDATE-RECOVERY.md
new file mode 100644
index 00000000000..6ff4657ded8
--- /dev/null
+++ b/deployment/windows/UPDATE-RECOVERY.md
@@ -0,0 +1,122 @@
+# Durable endpoint update recovery
+
+Before launching an update helper, the agent registers a separate scheduled task
+pointing to the exact hash/publisher-verified helper under
+`updates/<release-sequence>/swan-agent.exe`. It stores no password, technician
+token, device token or grant in task arguments. The only argument is
+`recover-update-task`; the helper derives the company state directory from its
+own staged location rather than inherited environment settings.
+
+Customer recovery runs as SYSTEM at startup and every five minutes. Technician
+recovery runs as the current user, with limited privileges, at logon and every
+five minutes. Configuration and recovery tasks use normal priority (Task Scheduler
+priority 4), including when a validated configuration task is restarted or restored
+from an older installation. Trust-check and installation helpers also explicitly
+start at normal priority; they must not inherit a background caller's priority.
+This does not change their accounts, privileges, action paths or approval checks.
+Tasks use a per-directory, edition and sequence name. Registration
+or deletion refuses unexpected task paths, actions, arguments or principals.
+Failed registration stops handoff before installation. The staged folder is
+outside the MSI-owned installed files; customer setup protects its state tree
+with SYSTEM/administrator ACLs.
+
+On each attempt, the staged helper checks its location, the signed pending
+receipt, edition, sequence and its own hash/publisher. It resumes only that exact
+release or its durably prepared rollback. Public artifact retries send no
+credentials. Existing activity locks prevent concurrent installation or support
+sessions. Logs remain in the private update folder. A customer update writes
+signed `configuration-restart.json` before committing its release. If installation
+committed but the watcher restart failed, its recovery task verifies the exact
+installed release, payload and MSI registration, then retries the restart under
+the activity lock. The marker blocks sessions and another automatic update until
+restart succeeds. An older release's recovery task cannot restart a newer release.
+When both recovery markers are absent, or uninstall cancellation is present, the
+task removes only its own verified task registration and does not install software.
+
+Before replacing customer files, the helper stops only the validated installation-
+owned SYSTEM configuration task, releasing the previous agent executable. MSI
+completion additionally requires the signed package's product code and version
+to be registered with Windows Installer. Matching executable hashes alone do not
+prove that an MSI with unchanged binaries installed. Explicit verified setup or
+repair checks the same registration and takes responsibility for registering its
+watcher before retiring an earlier restart marker.
+
+Explicit MSI uninstall writes `pending-uninstall` before file removal, blocking
+new sessions and automatic recovery. Paired uninstall rollback restores the
+previous cancellation state, including an earlier cancellation. Uninstall commit
+clears only the now-obsolete cancellation/task rollback records
+after MSI has removed the installed agent. A separate agent copy embedded in the
+signed MSI runs this commit action, so it does not depend on the deleted installed
+executable. It retains `pending-uninstall`, identity and consent. Failed removal
+retains rollback information until Windows Installer invokes rollback. This avoids
+a successful uninstall leaving a record that blocks the next removal after a bare
+MSI reinstall. Two real uninstall/explicit-repair reinstall cycles passed in a
+Server 2016 administrative technician profile using the signed d8fad20 MSI and
+f84ffb0 generated setup. Each uninstall retained cancellation and company state,
+cleared obsolete rollback records, and removed only that account's payload.
+Explicit repair restored its exact signed identity and cleared cancellation;
+the other technician account and customer service were preserved. This does not
+qualify standard-user, customer-edition or automatic-update recovery.
+The technician MSI uses the same commit cleanup in the installing user's context
+and restricts its state path to that user's local application data. Customer
+cleanup runs under SYSTEM and restricts its path to the machine-wide customer
+directory. Neither edition deletes the cancellation marker or company identity.
+Software
+rollback narrowly uninstalls its verified failed MSI with `SWAN_RECOVERY=1`,
+excluding user-uninstall cancellation actions. Only explicit verified setup or
+repair clears the cancellation marker. Explicit setup now verifies its incoming
+package again under the activity lock, publishes a setup marker without
+overwriting a different interrupted setup, and archives the exact original
+cancelled receipt at `updates/<sequence>/cancelled-update.json`. An unchanged
+archive permits interrupted preparation to retry; a conflicting archive fails
+closed. Cancellation and setup markers keep sessions blocked until full installed
+identity verification completes. A setup interrupted after committing its exact
+installed metadata may finish only that same signed setup; ordinary sequence
+replay rejection resumes when the marker is gone. This implements the transition
+but does not yet demonstrate native uninstall/reinstall.
+
+For diagnostics, `Update-RecoveryTask.ps1 -InspectOnly` reads task ownership and
+outputs a proposed identity without registering or removing a task. It does not
+prove executable trust or successful registration. `test_update_recovery_task.ps1`
+tests exact-SID account resolution, ownership rejection and cancellation files.
+It also registers, inspects and removes one isolated technician task using a
+signed OS binary without starting it. Windows may return a short principal name
+after registration by SID; the guard resolves that account to its SID and rejects
+foreign or unresolvable identities. It never accepts a name suffix as ownership.
+
+The company bundle includes the fixed read-only MSI mode inspector. Setup selects
+repair for the exact already-registered product and installation for an unknown
+product. Both the updater and setup resolve Windows Installer from the OS system
+directory. This does not authorize another edition, publisher, version or package:
+signed metadata, artifact identity and package checks still precede installation.
+
+## Verification boundary
+
+Customer EXE rollback now reinstalls only the retained previous hash/publisher-
+verified package after complete snapshot and previous-agent capability checks.
+It rejects an MSI upgrade-family registration, MSI product marker, wrong
+uninstall registration, or another installation's service. The restored service
+must run automatically; installed endpoint/agent files verify before metadata
+and failed-release quarantine are published. Identity, keys and consent remain
+current. Explicit customer EXE uninstall runs a fixed encoded cancellation
+script inside its elevated uninstall batch before service/file removal, stopping
+only its owned configuration task. Recovery rechecks cancellation before
+completion.
+
+Native service/process command generation now quotes stable names containing
+spaces. SYSTEM installation uses the OS command processor directly. Silent
+portable packages wait for the extracted install process and propagate its exit
+status; GUI launch keeps its existing asynchronous behavior. The standalone wait
+module's Windows child lifecycle tests pass, including failed exit and missing
+executable handling. Native app/packer syntax parses, but current full native
+compilation and signed installer execution have not yet passed.
+
+Windows agent/worker compilation, agent component tests, read-only task planning,
+Scheduled Task object creation and ownership/cancellation regressions pass.
+Unsigned customer and technician packaging rehearsals using historical 1.4.9
+native inputs compile; read-only MSI tables confirm rollback/cancellation/file
+removal order and upgrade/recovery exclusions. These are authoring checks, not
+the current native release or successful installation. Actual signed task
+registration, startup/logon execution, reboot between removal and restoration,
+uninstall/reinstall, task cleanup, customer EXE rollback and the full supported
+Windows matrix remain acceptance gates.
diff --git a/deployment/windows/Uninstall-Server.ps1 b/deployment/windows/Uninstall-Server.ps1
new file mode 100644
index 00000000000..15a2df142b8
--- /dev/null
+++ b/deployment/windows/Uninstall-Server.ps1
@@ -0,0 +1,31 @@
+[CmdletBinding(SupportsShouldProcess=$true)]
+param()
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+if (-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Server removal requires administrator rights.' }
+$install = Join-Path $env:ProgramFiles 'Swan Company Server'
+$data = Join-Path $env:ProgramData 'SwanCompanyServer'
+$service = Get-CimInstance Win32_Service -Filter "Name='SwanCompanyServer'"
+if (-not $service) { throw 'Company service is not installed. Retained files/data require the recovery procedure.' }
+$plan = & (Join-Path $PSScriptRoot 'Get-ServerRemovalPlan.ps1') -InstallDirectory $install -DataDirectory $data -ServiceBinary $service.PathName
+# Check rule ownership before stopping anything. Never remove unrelated rules.
+foreach ($name in $plan.FirewallRules) {
+    $rule = Get-NetFirewallRule -Name $name -ErrorAction SilentlyContinue
+    if ($rule -and $rule.Group -ne 'SwanCompanyServer') { throw 'Company firewall rule ownership changed.' }
+}
+if ($PSCmdlet.ShouldProcess('SwanCompanyServer','Remove company service, owned firewall rules and packaged files; retain company data')) {
+    Stop-Service -Name SwanCompanyServer
+    (Get-Service -Name SwanCompanyServer).WaitForStatus([ServiceProcess.ServiceControllerStatus]::Stopped,[TimeSpan]::FromSeconds(30))
+    & sc.exe delete SwanCompanyServer | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'Company service removal failed.' }
+    foreach ($name in $plan.FirewallRules) {
+        if (Get-NetFirewallRule -Name $name -ErrorAction SilentlyContinue) { Remove-NetFirewallRule -Name $name }
+    }
+    foreach ($file in $plan.Files) { if (Test-Path -LiteralPath $file) { Remove-Item -LiteralPath $file } }
+    # Nonrecursive removal leaves any unexpected files untouched.
+    foreach ($directory in @((Join-Path $install 'components'),$install)) {
+        if ((Test-Path -LiteralPath $directory) -and -not @(Get-ChildItem -LiteralPath $directory -Force).Count) { Remove-Item -LiteralPath $directory }
+    }
+    Write-Host "Company service removed. Company identity, database, transport keys, TLS storage and logs remain in $data."
+    Write-Host 'Preserve an encrypted backup before reinstalling or restoring. Other RustDesk and Tailscale services were not changed.'
+}
diff --git a/deployment/windows/Uninstall-Technician.ps1 b/deployment/windows/Uninstall-Technician.ps1
new file mode 100644
index 00000000000..3ee9dc4f3ef
--- /dev/null
+++ b/deployment/windows/Uninstall-Technician.ps1
@@ -0,0 +1,48 @@
+[CmdletBinding(SupportsShouldProcess)]
+param([switch]$Confirmed)
+$ErrorActionPreference='Stop'
+$directory=[IO.Path]::GetFullPath((Join-Path $env:LOCALAPPDATA 'SwanRemoteSupport-Technician'))
+if([IO.Path]::GetFullPath($PSScriptRoot) -ine $directory){throw 'Run the installed technician uninstaller.'}
+foreach($path in @($env:LOCALAPPDATA,$directory)){
+    $item=Get-Item -LiteralPath $path -Force
+    if(-not $item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)){throw 'Technician installation directory is unsafe.'}
+}
+$metadata=Get-Content -LiteralPath (Join-Path $directory 'installed-release.json') -Raw|ConvertFrom-Json
+$release=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($metadata.payload))|ConvertFrom-Json
+if($release.edition -cne 'technician' -or $release.format -cne 'exe'){throw 'Use Windows installed-app removal for MSI installations.'}
+$agent=Join-Path $directory 'swan-agent.exe'
+if((Get-AuthenticodeSignature -LiteralPath $agent).Status -ne 'Valid'){throw 'Repair the configuration agent before uninstalling.'}
+$env:SWAN_STATE_DIR=$directory
+& $agent verify-installed
+if($LASTEXITCODE -ne 0){throw 'Repair the installed identity before uninstalling.'}
+if(-not $Confirmed -and -not $WhatIfPreference){
+    Add-Type -AssemblyName System.Windows.Forms
+    if([Windows.Forms.MessageBox]::Show('Remove the technician application? Close it first. Company configuration is retained for reinstall.','Remove technician application','YesNo','Question') -ne 'Yes'){return}
+}
+if(-not $PSCmdlet.ShouldProcess($directory,'Remove portable technician application and retain company state')){return}
+$lock=[IO.File]::Open((Join-Path $directory 'activity.lock'),[IO.FileMode]::OpenOrCreate,[IO.FileAccess]::ReadWrite,[IO.FileShare]::ReadWrite)
+$locked=$false
+try{
+    $lock.Lock(0,1);$locked=$true
+    & $agent cancel-update-recovery
+    if($LASTEXITCODE -ne 0){throw 'Update recovery cancellation failed; no application files were removed.'}
+    # Fixed regular files only: never recurse into company state, releases or
+    # extracted runtimes shared with another installation.
+    foreach($name in @('SwanRemoteSupport-Technician.exe','Open-Technician.ps1','swan-agent.exe')){
+        $path=Join-Path $directory $name
+        if(Test-Path -LiteralPath $path){
+            $item=Get-Item -LiteralPath $path -Force
+            if($item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)){throw 'Unexpected application file; removal remains pending.'}
+            Remove-Item -LiteralPath $path -Force
+        }
+    }
+    foreach($name in @('Swan Remote Support Technician.lnk','Uninstall Swan Remote Support Technician.lnk')){
+        $path=Join-Path ([Environment]::GetFolderPath('Programs')) $name
+        if(Test-Path -LiteralPath $path){
+            $shell=New-Object -ComObject WScript.Shell
+            $shortcut=$shell.CreateShortcut($path)
+            if($shortcut.Arguments.Contains('"'+(Join-Path $directory 'Open-Technician.ps1')+'"') -or $shortcut.Arguments.Contains('"'+(Join-Path $directory 'Uninstall-Technician.ps1')+'"')){Remove-Item -LiteralPath $path}
+        }
+    }
+    Write-Output 'Technician application removed. Company state is retained and automatic recovery is cancelled.'
+}finally{if($locked){$lock.Unlock(0,1)};$lock.Dispose()}
diff --git a/deployment/windows/Uninstall-Worker.ps1 b/deployment/windows/Uninstall-Worker.ps1
new file mode 100644
index 00000000000..f07262126c2
--- /dev/null
+++ b/deployment/windows/Uninstall-Worker.ps1
@@ -0,0 +1,28 @@
+[CmdletBinding(SupportsShouldProcess=$true)]
+param()
+$ErrorActionPreference='Stop'
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+if(-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Worker removal requires administrator rights.'}
+$install=[IO.Path]::GetFullPath((Join-Path $env:ProgramFiles 'Swan Installer Worker'))
+$data=[IO.Path]::GetFullPath((Join-Path $env:ProgramData 'SwanInstallerWorker'))
+$executable=Join-Path $install 'swan-worker.exe'
+foreach($path in @($env:ProgramFiles,$env:ProgramData,$install,$data,$executable,(Join-Path $data 'installation.json'))){
+ if((Get-Item -LiteralPath $path -Force).Attributes -band [IO.FileAttributes]::ReparsePoint){throw 'Worker removal paths cannot be reparse points.'}
+}
+$service=Get-CimInstance Win32_Service -Filter "Name='SwanInstallerWorker'"
+if(-not $service -or $service.PathName -cne ('"'+$executable+'" --service') -or $service.StartName -notin @('LocalSystem','NT AUTHORITY\SYSTEM')){throw 'Worker service ownership mismatch.'}
+$receipt=Get-Content -LiteralPath (Join-Path $data 'installation.json') -Raw|ConvertFrom-Json
+if($receipt.schema -notin @(1,2) -or $receipt.service -cne 'SwanInstallerWorker' -or $receipt.executable_sha256 -ine (Get-FileHash -LiteralPath $executable).Hash){throw 'Worker installation receipt or executable changed.'}
+$signature=Get-AuthenticodeSignature -LiteralPath $executable
+if($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Thumbprint -ine $receipt.publisher_thumbprint){throw 'Worker publisher no longer matches the installation receipt.'}
+if($PSCmdlet.ShouldProcess('SwanInstallerWorker','Stop and remove the owned service and executable; retain private artifacts and receipt')){
+ $controller=Get-Service SwanInstallerWorker
+ try{if($controller.Status -ne [ServiceProcess.ServiceControllerStatus]::Stopped){Stop-Service SwanInstallerWorker;$controller.WaitForStatus([ServiceProcess.ServiceControllerStatus]::Stopped,[TimeSpan]::FromSeconds(30))}}finally{$controller.Dispose()}
+ if($service.ProcessId -ne 0 -and (Get-CimInstance Win32_Process -Filter "ProcessId=$($service.ProcessId)")){throw 'Worker process remains alive; retain all files.'}
+ & sc.exe delete SwanInstallerWorker|Out-Null
+ if($LASTEXITCODE -ne 0){throw 'Worker service deletion failed; retain all files.'}
+ Remove-Item -LiteralPath $executable
+ if(-not @(Get-ChildItem -LiteralPath $install -Force).Count){Remove-Item -LiteralPath $install}
+ Write-Host 'Worker service and executable removed. Protected artifacts and receipt remain for inspection.'
+ Write-Host 'Retained private configuration can contain the worker credential. Revoke it in company administration before removing or replacing the worker.'
+}
diff --git a/deployment/windows/Update-RecoveryTask.ps1 b/deployment/windows/Update-RecoveryTask.ps1
new file mode 100644
index 00000000000..88531b8c702
--- /dev/null
+++ b/deployment/windows/Update-RecoveryTask.ps1
@@ -0,0 +1,53 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][ValidateSet('register','remove')][string]$Operation,
+    [Parameter(Mandatory=$true)][string]$Directory,
+    [Parameter(Mandatory=$true)][ValidateSet('customer','technician')][string]$Edition,
+    [Parameter(Mandatory=$true)][UInt64]$Sequence,
+    [switch]$InspectOnly
+)
+$ErrorActionPreference='Stop'
+function Assert-RecoveryTask($Task,[string]$Helper,[string]$AccountSid) {
+    if ($Task.TaskPath -cne '\' -or $Task.Actions.Count -ne 1 -or [IO.Path]::GetFullPath($Task.Actions[0].Execute) -ine $Helper -or $Task.Actions[0].Arguments -cne 'recover-update-task') { throw 'Update recovery task belongs to another installation.' }
+    # Task Scheduler can return a short account name after registration by SID.
+    # Resolve that identity; never authorize by display-name or suffix matching.
+    try {
+        $principal=[string]$Task.Principal.UserId
+        $actualSid=if ($principal -match '^S-\d-') { ([Security.Principal.SecurityIdentifier]::new($principal)).Value } else { ([Security.Principal.NTAccount]::new($principal)).Translate([Security.Principal.SecurityIdentifier]).Value }
+        $expectedSid=([Security.Principal.SecurityIdentifier]::new($AccountSid)).Value
+    } catch { throw 'Update recovery task account cannot be resolved.' }
+    if ($actualSid -cne $expectedSid) { throw 'Update recovery task belongs to another installation.' }
+}
+$directoryPath=[IO.Path]::GetFullPath($Directory).TrimEnd('\')
+if ($Sequence -eq 0) { throw 'A positive recovery sequence is required.' }
+$helper=Join-Path $directoryPath ("updates\$Sequence\swan-agent.exe")
+$hash=[Security.Cryptography.SHA256]::Create()
+try { $identifier=([BitConverter]::ToString($hash.ComputeHash([Text.Encoding]::UTF8.GetBytes($directoryPath.ToLowerInvariant())))).Replace('-','').Substring(0,16) } finally { $hash.Dispose() }
+$name="Swan Update Recovery $Edition $identifier $Sequence"
+$user=if ($Edition -eq 'customer') { 'S-1-5-18' } else { [Security.Principal.WindowsIdentity]::GetCurrent().User.Value }
+$tasks=@(Get-ScheduledTask | Where-Object { $_.TaskName -ceq $name })
+if ($tasks.Count -gt 1) { throw 'Ambiguous update recovery task.' }
+if ($tasks.Count -eq 1) {
+    $task=$tasks[0]
+    Assert-RecoveryTask $task $helper $user
+}
+if ($InspectOnly) {
+    @{task_name=$name;helper=$helper;principal=$user;operation=$Operation;task_mutated=$false} | ConvertTo-Json -Compress
+    return
+}
+if ($Operation -eq 'remove') {
+    if ($tasks.Count -eq 1) { $tasks[0] | Unregister-ScheduledTask -Confirm:$false }
+    return
+}
+if ((Get-AuthenticodeSignature -LiteralPath $helper).Status -ne 'Valid') { throw 'Recovery helper signature is invalid.' }
+$action=New-ScheduledTaskAction -Execute $helper -Argument 'recover-update-task'
+$repeat=New-ScheduledTaskTrigger -Once -At ([DateTime]::Now.AddMinutes(5)) -RepetitionInterval (New-TimeSpan -Minutes 5)
+$settings=New-ScheduledTaskSettingsSet -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Hours 2) -MultipleInstances IgnoreNew -Priority 4
+if ($Edition -eq 'customer') {
+    $startup=New-ScheduledTaskTrigger -AtStartup
+    $principal=New-ScheduledTaskPrincipal -UserId $user -LogonType ServiceAccount -RunLevel Highest
+} else {
+    $startup=New-ScheduledTaskTrigger -AtLogOn -User $user
+    $principal=New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Limited
+}
+Register-ScheduledTask -TaskName $name -Action $action -Trigger @($startup,$repeat) -Settings $settings -Principal $principal -Force | Out-Null
diff --git a/deployment/windows/Update-UninstallCancellation.ps1 b/deployment/windows/Update-UninstallCancellation.ps1
new file mode 100644
index 00000000000..897ebf7aafc
--- /dev/null
+++ b/deployment/windows/Update-UninstallCancellation.ps1
@@ -0,0 +1,25 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$Directory,[Parameter(Mandatory=$true)][ValidateSet('cancel','restore')][string]$Operation)
+$ErrorActionPreference='Stop'
+$marker=Join-Path $Directory 'pending-uninstall'
+$rollback=Join-Path $Directory 'uninstall-cancellation-rollback.json'
+if ($Operation -eq 'cancel') {
+    if (Test-Path -LiteralPath $rollback) { throw 'Previous uninstall cancellation requires explicit recovery.' }
+    $bytes=[Text.Encoding]::UTF8.GetBytes((@{marker_existed=(Test-Path -LiteralPath $marker)} | ConvertTo-Json -Compress))
+    $temporary=Join-Path $Directory ('uninstall-cancellation-'+[Guid]::NewGuid().ToString('N')+'.tmp')
+    try {
+        $stream=[IO.File]::Open($temporary,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+        try { $stream.Write($bytes,0,$bytes.Length);$stream.Flush($true) } finally { $stream.Dispose() }
+        [IO.File]::Move($temporary,$rollback)
+    } finally { if (Test-Path -LiteralPath $temporary) { Remove-Item -LiteralPath $temporary } }
+    if (-not (Test-Path -LiteralPath $marker)) {
+        $stream=[IO.File]::Open($marker,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None)
+        try { $stream.Flush($true) } finally { $stream.Dispose() }
+    }
+} else {
+    if (-not (Test-Path -LiteralPath $rollback)) { return }
+    $previous=Get-Content -LiteralPath $rollback -Raw | ConvertFrom-Json
+    if ($previous.marker_existed -isnot [bool]) { throw 'Invalid uninstall cancellation rollback state.' }
+    if (-not $previous.marker_existed -and (Test-Path -LiteralPath $marker)) { Remove-Item -LiteralPath $marker }
+    Remove-Item -LiteralPath $rollback
+}
diff --git a/deployment/windows/VM-TESTING.md b/deployment/windows/VM-TESTING.md
new file mode 100644
index 00000000000..af96014c9a7
--- /dev/null
+++ b/deployment/windows/VM-TESTING.md
@@ -0,0 +1,116 @@
+# Isolated Windows acceptance lab
+
+Use official Microsoft evaluation media, within its evaluation period. Never
+disable activation checks or redistribute evaluation images with project releases.
+Media, VM disks, local credentials, screenshots and raw test logs stay outside Git.
+
+Choose the local lab, QEMU and ISO paths in a private local environment file.
+The initial resource budget is one guest at a time, 4 GiB RAM, two virtual CPUs
+and a sparse 64 GiB disk. User-mode
+NAT does not change the host bridge, firewall or existing RustDesk services.
+VNC (port 5920) and the QEMU monitor (4444) listen on loopback only. These sockets
+provide full guest access; close QEMU when the guest is not under test.
+
+`New-TestVm.ps1` requires an already verified QEMU installation and ISO. It
+refuses existing VM directories. Prefer WHPX after checking it starts on the
+host; TCG is a slower fallback. The host must retain 1.5 GiB available memory.
+For TCG, the scripts select QEMU's `max` CPU model. A local QMP capability probe confirmed
+SSE4.2 and POPCNT are exposed by that model and absent from the default `qemu64`
+model. Server 2025 requires these instructions; this supplies supported emulated
+instructions rather than bypassing the operating system's hardware checks.
+WHPX uses the host CPU model. `SWAN_VM_ACCELERATOR=whpx-userspace` selects the
+documented `whpx,hyperv=off,kernel-irqchip=off` variant for diagnosing the observed
+interrupt-backend failure; it is not evidence that acceleration works.
+`New-LocalTestVm.ps1 -EnvironmentFile PATH_TO_PRIVATE_ENV` reads the six
+`SWAN_VM_*` settings from the private environment file without executing them.
+It requires `ISO_PATH.download-complete.json` containing `bytes` and `sha256`,
+recorded only after the official HTTPS download exits successfully. It verifies
+the recorded size and hash before creating a guest. This record proves local
+download integrity; it does not replace verification of the Microsoft origin.
+Do not write the completion record while a downloader is still running.
+For a preserved guest, add `-Resume` and set `SWAN_VM_ACCELERATOR=tcg` in the
+private environment file to try the software-emulation fallback. The resume
+helper verifies the ISO again, retains the existing disk, reconstructs fixed
+loopback-only QEMU options, and refuses a disk already in use. TCG performance
+and successful Windows installation still require actual verification.
+Windows 11 also requires supported UEFI/Secure Boot and TPM configuration:
+the generic starter script is for Server guests and does not establish Windows
+11 compatibility. Do not bypass Windows 11 hardware requirements for acceptance.
+
+Choose **Desktop Experience** for every Server installation. Record edition,
+build, patch level, ISO origin and SHA-256, accelerator and product commit.
+Keep a clean installation checkpoint before testing each package.
+
+## Required matrix
+
+Windows 10 and 11 x64; Windows Server 2016, 2019, 2022 and 2025 Desktop Experience.
+Each row remains **unverified** until actual installation and upgrade evidence
+exists for that guest. Unit tests and host installation are insufficient.
+
+For each guest, capture installation, repair, restart, uninstall, branding sync
+and offline cache, attended approval, unattended opt-in/revocation, authorized
+and denied access, UAC/logon screen, clipboard, transfer, multiple monitors,
+interrupted upgrade recovery and identity preservation. Test direct and relay
+connections between separate guests. Public Internet traversal needs a separate
+external network; local NAT success does not prove public reachability.
+
+Official media starting points:
+
+- <https://www.microsoft.com/en-us/evalcenter/evaluate-windows-11-enterprise>
+- <https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2025>
+- <https://www.microsoft.com/en-us/evalcenter/download-windows-server-2016>
+- <https://www.qemu.org/download/>
+
+Evaluation expiration or missing supported media must be reported as an
+unverified matrix row, never as a passing compatibility test.
+
+## Bare MSI lifecycle checks
+
+`Test-DisposableMsi.ps1` runs one actual MSI phase (`install`, `repair`, or
+`uninstall`) inside an independently provisioned disposable guest. It requires
+an exact `ExpectedComputerName` and a private `C:\SwanLab\disposable-lab.json`
+marker with `purpose` equal to `swan-disposable-windows-acceptance` and
+`computer_name` equal to that guest's name. Never create this marker on the host
+or on a company/customer machine.
+
+Pass the verified package SHA-256, source revision and agent SHA-256; technician
+tests also require the portable executable SHA-256. Customer tests require the
+installed-files manifest and its verified SHA-256. Copy `Get-MsiIdentity.ps1`
+and `Get-WindowsCompatibility.ps1` alongside the runner. Use a new result
+directory for each phase and keep raw MSI logs private.
+
+Fresh installation refuses existing application/agent paths. Customer checks
+verify every manifested file and the running service's exact executable,
+arguments and LocalSystem identity. Customer repair first damages the verified
+packaged license file, then checks that MSI repair restores the complete
+manifest. Both editions check agent hashes, and technician checks its executable
+hash. Technician repair retains the verified installed executable in the new
+phase result directory, confirms it is missing from the installation, and then
+requires MSI repair to restore it. The retained executable is private test
+evidence and is not automatically deleted. Use `-RequireStandardUser` for technician tests to reject an elevated
+account; customer phases require administrator access. Reports record the
+actual administrator status. Both editions check Windows Installer registration.
+Uninstall checks all customer manifest files, application/agent executables,
+the customer service, and technician launcher, license, shortcut and component
+registration. Exit code 3010 is recorded as requiring a reboot; perform and verify
+that reboot before interpreting later tests as reboot acceptance.
+
+This runner does not configure a company, approve enrollment, test signatures,
+exercise updates or establish a remote session. Successful bare MSI phases
+cannot replace those acceptance requirements. Do not edit production installer
+verification to accommodate unsigned lab packages.
+
+The first local WHPX probe reported `Unexpected VP exit code 4`; the isolated
+guest was stopped. Its sparse disk is preserved outside Git. No operating
+system installation or accelerator compatibility is established by that probe.
+The official Server 2025 ISO subsequently downloaded successfully and its size
+and SHA-256 were recorded privately. A TCG guest reached the Windows boot loader.
+The initial TCG attempt used the insufficient default CPU and was restarted
+with the corrected model. No completed Windows installation is recorded yet.
+The corrected TCG attempt reached a Windows crash screen reporting
+`SYSTEM_SERVICE_EXCEPTION (0x3B)` in `win32kbase.sys`. Its screenshot and disk
+remain private. The WHPX userspace-interrupt attempt emitted repeated XSAVE
+state errors. `SWAN_VM_ACCELERATOR=whpx-baseline` retains that interrupt mode
+and selects `Westmere-v2`; a local QMP probe confirmed SSE4.2, POPCNT, CX16 and
+NX are present, while XSAVE and AVX are absent. Its actual installation result
+remains unverified. No operating system hardware-check bypass is applied.
diff --git a/deployment/windows/Verify-MsiRegistration.ps1 b/deployment/windows/Verify-MsiRegistration.ps1
new file mode 100644
index 00000000000..dd69b94088d
--- /dev/null
+++ b/deployment/windows/Verify-MsiRegistration.ps1
@@ -0,0 +1,7 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$ProductCode, [Parameter(Mandatory=$true)][string]$Version)
+$ErrorActionPreference = 'Stop'
+$installer = New-Object -ComObject WindowsInstaller.Installer
+if ($installer.ProductState($ProductCode) -ne 5 -or $installer.ProductInfo($ProductCode, 'VersionString') -cne $Version) {
+    throw 'The expected MSI product and version are not installed.'
+}
diff --git a/deployment/windows/Verify-Package.ps1 b/deployment/windows/Verify-Package.ps1
new file mode 100644
index 00000000000..84a6072d3cf
--- /dev/null
+++ b/deployment/windows/Verify-Package.ps1
@@ -0,0 +1,13 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Path,[Parameter(Mandatory)][string]$Publisher,[Parameter(Mandatory)][string]$CertificateSha256,[string]$Sha256)
+$ErrorActionPreference = 'Stop'
+$resolved = (Resolve-Path -LiteralPath $Path).Path
+if ($Sha256 -and (Get-FileHash -LiteralPath $resolved -Algorithm SHA256).Hash -ne $Sha256) { throw 'Package hash does not match signed release metadata.' }
+$signature = Get-AuthenticodeSignature -LiteralPath $resolved
+if ($signature.Status -ne 'Valid' -or -not $signature.SignerCertificate) { throw 'Package requires a valid trusted Authenticode signature.' }
+$actualPublisher = $signature.SignerCertificate.GetNameInfo([System.Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false)
+if ($actualPublisher -cne $Publisher) { throw 'Package publisher does not match the approved release publisher.' }
+$hasher = [Security.Cryptography.SHA256]::Create()
+try { $certificateHash = [BitConverter]::ToString($hasher.ComputeHash($signature.SignerCertificate.RawData)).Replace('-', '') } finally { $hasher.Dispose() }
+if ($certificateHash -ine $CertificateSha256) { throw 'Signing certificate does not match the approved release certificate.' }
+Write-Output 'Package signature and publisher verified.'
diff --git a/deployment/windows/WORKER.md b/deployment/windows/WORKER.md
new file mode 100644
index 00000000000..99f5a38a91c
--- /dev/null
+++ b/deployment/windows/WORKER.md
@@ -0,0 +1,131 @@
+# Company Windows installer worker
+
+Each company provides its own Windows worker. A Linux company server also needs
+this Windows machine; the project does not host a shared build service. The
+worker connects outbound to the company's HTTPS management endpoint and consumes
+approved signed release inputs. It does not execute company-provided build scripts.
+
+Use the worker executable from the same pinned source/release as the management
+server: the server validates a canonical bundle recipe. Verify the published
+artifact hash and trusted Authenticode publisher before running it. A lab-signed
+binary is a test fixture, not a production release.
+
+An administrator registers a worker through the authenticated administration
+interface/API (`POST /api/v1/workers`). The returned worker token is a secret.
+Store it outside Git, in a local configuration file restricted to the worker
+account, SYSTEM and administrators. Do not put it in command-line arguments,
+public installers, website files, build artifacts or logs.
+
+Installed services read `C:\ProgramData\SwanInstallerWorker\worker.json`.
+The service registry contains only `SWAN_WORKER_CONFIG`, the public path to that
+file. The directory and file must be owned by Administrators, have protected
+permissions granting only SYSTEM and Administrators access, and contain no
+reparse points. The executable checks these permissions before reading secrets
+or claiming a job. App-container read access is rejected too.
+
+Foreground operator processes may still use `SWAN_MANAGEMENT_URL`,
+`SWAN_WORKER_TOKEN`, `SWAN_RELEASE_PUBLIC_KEY`, `SWAN_PROFILE_PUBLIC_KEY` and
+`SWAN_ARTIFACT_DIR` in their process environment. Never persist these secret
+values in service registry settings. Service mode requires the private file and
+cannot fall back to environment credentials. HTTPS certificate validation must
+remain enabled; workers need public trust pins, never project signing keys.
+
+The executable supports foreground operation and a Windows SCM entrypoint
+(`swan-worker.exe --service`, service name `SwanInstallerWorker`). Install it from
+an administrator PowerShell session with `Install-Worker.ps1 -Executable <path>
+-ConfigurationPath <private-json-path> -PublisherThumbprint <trusted-thumbprint>`.
+The JSON file must contain exactly four string fields: `management_url`,
+`worker_token`, `release_public_key` and `profile_public_key`. Obtain their actual
+values through company setup and authenticated worker registration; never commit
+this file or share the token.
+
+The installer checks the source and copied executable's publisher, refuses an
+existing installation, and creates the state directory with private permissions
+atomically. It protects the empty configuration file before writing credentials,
+then asks the compiled worker to validate it before creating the service. Keep
+the input configuration in a private local administrator directory; its parent
+and file must allow only SYSTEM, Administrators and the installing administrator,
+with full access for SYSTEM and Administrators. Ship the matching
+`Read-WorkerConfiguration.ps1` beside `Install-Worker.ps1`.
+
+The service uses LocalSystem, automatic startup and SCM restart policy, with no
+inbound firewall rule. Its artifacts use the canonical private state directory.
+Service output is appended to protected `worker-service.log`; log rotation
+remains pending. Do not run a foreground worker alongside the service.
+
+**Legacy credential storage:** earlier development installers persisted the
+worker token in the service registry. A real Server 2016 test found additional
+app-container read permissions despite a protected registry ACL. Revoke those
+worker registrations before upgrading, keep the old worker stopped, and remove
+its secret environment values. Never merely copy the old token into a new file.
+The source now uses private file storage. Compiled Windows permission checks
+and a Server 2016 lab migration, actual standard-user read denial, both edition
+builds and authenticated build completion after reboot passed; see the dated
+acceptance evidence. Fresh installation with this installer, the complete Windows
+matrix and production signing remain separate gates. Existing installations and
+retained data are refused rather than silently overwritten by fresh setup. Preserve receipts and artifacts while
+planning migration. A restored management backup can resurrect revoked token
+hashes: revoke legacy registrations again before exposing a restored service.
+
+For a stopped schema-1 installation, `Migrate-WorkerCredential.ps1 -Executable
+<new-signed-worker> -PreviousConfigurationPath <private-original-json>
+-ConfigurationPath <private-new-json> -PublisherThumbprint <trusted-thumbprint>`
+provides an explicit migration path. First revoke the old registration and set
+the service to manual startup. The script requires the same company and public
+trust keys, a different credential, a real HTTPS 401 response for the old
+credential, and HTTP 200 for the replacement worker credential. It preserves the old executable and receipt under a unique private
+directory, retains artifacts, and records a migration journal. On failure it
+keeps the service stopped/manual; it never reactivates the revoked legacy
+credential. Inspect `-WhatIf` first. A retained journal/configuration requires
+explicit recovery rather than repeating migration. The actual lab-signed worker
+migration passed on Server 2016, preserving the legacy executable/receipt and a
+retention fixture. Both branded packages were generated afterward; private file
+permissions and authentication survived reboot. This does not qualify every
+Windows version or a production publisher.
+
+Approve a compatible release on the server, queue a customer or technician build,
+and inspect its terminal status, protected log and artifact hash. Customer bundle
+downloads are public; technician bundle downloads require authentication. Test
+both access paths and verify the downloaded hash before installation. Failed jobs
+must not be published as successful packages.
+
+A permanent upload-validation rejection (HTTP 400, 413, 415 or 422) produces a
+failed completion report with no download URL or artifact hash. The retained
+local bundle remains available for inspection. This prevents malformed or
+incompatible output from remaining a running job indefinitely. Review matching
+server/worker releases and approved inputs before queueing a replacement job.
+Authentication/authorization failures, conflicting state, network failures,
+rate limits and temporary server errors retain recovery rather than fabricating
+a terminal result. Temporary upload failures retry the identical buffered bytes.
+
+Error details admit only fixed public rejection labels from a bounded JSON
+response. Arbitrary server text, credentials and response URLs are not copied
+into job logs; diagnostic body reading also has a short deadline. This behavior
+requires deployment of the updated worker and does not repair old pending jobs
+by itself. See the dated acceptance record for unit/CI and runtime scope.
+
+After a company configuration-key rotation, independently verify the new public
+pin and update the protected worker configuration before restarting it. Automatic
+worker trust-pin rotation is not currently implemented. Regenerate bundles after
+rotation; old completed builds are invalidated by the management service.
+
+See [signing requirements](../../docs/WINDOWS_CODE_SIGNING.md),
+[company signing integration](COMPANY-SIGNING.md), and
+[acceptance evidence](../../docs/ACCEPTANCE.md) before production publication.
+
+Remove an owned installation with administrator `Uninstall-Worker.ps1`; use
+`-WhatIf` to inspect the operation first. It verifies service identity, receipt,
+executable hash and publisher before stopping anything. It retains private
+artifacts and the receipt, and does not remove the original configuration file.
+Reinstallation currently refuses retained data; preserve it before planning a
+replacement. Removal does not revoke the server-side worker token. Disposable
+Server 2016 removal and reinstallation passed after explicitly archiving retained
+data; automatic migration of retained data remains unverified.
+
+Administrators can list worker IDs and disabled status with `GET /api/v1/workers`
+and permanently disable a credential with `DELETE /api/v1/workers/{worker_id}`,
+using their authenticated administrator session. Revocation atomically cancels
+that worker's running and uploaded builds and records an audit event. Queue new
+jobs for a replacement worker; cancelled claims cannot complete later. Completed
+packages remain available, so withdraw their release separately if its published
+packages must also be disabled. The list never returns tokens or token hashes.
diff --git a/deployment/windows/a1d67be-native-build-evidence.json b/deployment/windows/a1d67be-native-build-evidence.json
new file mode 100644
index 00000000000..dad15f047fa
--- /dev/null
+++ b/deployment/windows/a1d67be-native-build-evidence.json
@@ -0,0 +1,33 @@
+{
+  "source": "a1d67be97c914377554e946a9e16597b1197e334",
+  "workflow_run": 40415706839,
+  "artifact": 12698162287,
+  "artifact_digest": "sha256:c9b9f0d9f5ee48e391e77cd83a13724ad1e60c2ba670ed2cb3b374aff954f473",
+  "verified_sdk_identity": {
+    "archive_url": "https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.24.5-stable.zip",
+    "version": "3.24.5",
+    "archive_sha256": "b8a7485acd3c6fb23a76b7ac09f89e8d93d62fbff7147c6f5f8c5686d949eeac",
+    "engine_revision": "a18df97ca57a249df5d8d68cd0820600223ce262",
+    "framework_revision": "dec2ee5c1f98f8e84a7d5380c05eb8a3d0a81668"
+  },
+  "all_manifest_hashes_match": true,
+  "shipping_file_count": 54,
+  "native_managed_updater_regression_passed": true,
+  "required_steps": {
+    "Build branded client": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "public_tracked_source_files_verified": 1192,
+  "generated_bridge_files_verified": 6,
+  "independent_rebuild_passed": true,
+  "runtime_upgrade_qualified": false,
+  "production_signed_release": false,
+  "complete_archive_bytes": 254658035,
+  "source_verification_receipt_sha256": "b9088cba32ef527c8982b8f6628c0140909a7f71a5b4eb6d84ad77535d8ef817",
+  "independent_comparison": "a1d67be-native-independent-comparison.json"
+}
diff --git a/deployment/windows/a1d67be-native-independent-comparison.json b/deployment/windows/a1d67be-native-independent-comparison.json
new file mode 100644
index 00000000000..365ba0bb2a4
--- /dev/null
+++ b/deployment/windows/a1d67be-native-independent-comparison.json
@@ -0,0 +1,135 @@
+{
+  "schema": 1,
+  "source_commit": "a1d67be97c914377554e946a9e16597b1197e334",
+  "source_date_epoch": 1793055112,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1192,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversion_count": 1050
+    },
+    {
+      "tracked_files_verified": 1192,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversion_count": 1050
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.2-customer-x64-unsigned.msi",
+      "first_sha256": "dea165ad3e881ce42a95df93722df101615acbe1549e51455383d378afb307c5",
+      "second_sha256": "dea165ad3e881ce42a95df93722df101615acbe1549e51455383d378afb307c5",
+      "first_bytes": 33611776,
+      "second_bytes": 33611776,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.2-technician-x64-unsigned.exe",
+      "first_sha256": "7ac13ff876b11047d31272cfec7f3629f58e3309a43f07a8d0dbdff7db258e34",
+      "second_sha256": "7ac13ff876b11047d31272cfec7f3629f58e3309a43f07a8d0dbdff7db258e34",
+      "first_bytes": 24254976,
+      "second_bytes": 24254976,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.2-technician-x64-unsigned.msi",
+      "first_sha256": "85c1a70e7cfb73c93624480e5b8747e69b446b536f7e078b7fd87b398a5fa754",
+      "second_sha256": "85c1a70e7cfb73c93624480e5b8747e69b446b536f7e078b7fd87b398a5fa754",
+      "first_bytes": 31334400,
+      "second_bytes": 31334400,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.2-x64-unsigned-install.exe",
+      "first_sha256": "7ac13ff876b11047d31272cfec7f3629f58e3309a43f07a8d0dbdff7db258e34",
+      "second_sha256": "7ac13ff876b11047d31272cfec7f3629f58e3309a43f07a8d0dbdff7db258e34",
+      "first_bytes": 24254976,
+      "second_bytes": 24254976,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "89156eb3313ba0689508f3207a40a330d28e13183c2179470cd6346f210636ab",
+      "second_sha256": "89156eb3313ba0689508f3207a40a330d28e13183c2179470cd6346f210636ab",
+      "first_bytes": 64254464,
+      "second_bytes": 64254464,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "83f85b77c8ae2e1743414d992f2029ab8cb7254a533559ec111223ca4387a034",
+      "second_sha256": "83f85b77c8ae2e1743414d992f2029ab8cb7254a533559ec111223ca4387a034",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "8c81c66721871809b49940e2d00c4861d292dc61ff00dcd0fb2a891de27ac4eb",
+      "second_sha256": "8c81c66721871809b49940e2d00c4861d292dc61ff00dcd0fb2a891de27ac4eb",
+      "first_bytes": 8820224,
+      "second_bytes": 8820224,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "95fd203ea0dd0f1796660bf74218a7a242327ae2def4b595f414a85aa19caf23",
+      "second_sha256": "95fd203ea0dd0f1796660bf74218a7a242327ae2def4b595f414a85aa19caf23",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "utc": "2026-10-27T01:27:32.617674+00:00",
+  "builds": [
+    {
+      "workflow_run": 40415706839,
+      "artifact": 12698162287,
+      "archive_digest": "sha256:c9b9f0d9f5ee48e391e77cd83a13724ad1e60c2ba670ed2cb3b374aff954f473"
+    },
+    {
+      "workflow_run": 40423647265,
+      "artifact": 12701450778,
+      "archive_digest": "sha256:aaf57d74ad81199da9f728a24f87fda3832fd2039aa1a1f73a44dfd4c4bffc32"
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "original_comparison_sha256": "18d0d180a4133ffb291539f6d0d43b1f264b66839ac699b4085e203b574ac3eb"
+}
diff --git a/deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json b/deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json
new file mode 100644
index 00000000000..6d11bf248fe
--- /dev/null
+++ b/deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json
@@ -0,0 +1,152 @@
+{
+  "recorded_utc": "2026-10-27T20:56:12.538988+00:00",
+  "application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "version": "1.5.4",
+  "release_sequence": 7,
+  "isolated_company_lab": true,
+  "production_publication": false,
+  "all_windows_versions_qualified": false,
+  "remote_features_requalified_on_154": false,
+  "reboot": {
+    "msi_registered_installed": true,
+    "unattended_consent": false,
+    "all_signed_files_verified": 96,
+    "prior_boot_utc": "2026-10-27T18:49:03.5000000Z",
+    "shipping_verifier_passed": true,
+    "reboot_qualified": true,
+    "service_started_without_manual_intervention": true,
+    "new_boot_utc": "2026-10-27T20:38:42.5000000Z",
+    "utc": "2026-10-27T20:53:30.4542134Z",
+    "after_sequence": 7,
+    "consent_revision": 2,
+    "manual_installer_not_started": true,
+    "after_version": "1.5.4",
+    "service_running_auto_system": true,
+    "native_watch_running": true,
+    "recovery_markers_and_task_cleaned": true,
+    "kernel_reboot_observed": true,
+    "manual_cache_or_task_repair_during_this_upgrade": false,
+    "identity_credential_consent_and_trust_preserved": true,
+    "source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "production_publication": false
+  },
+  "automatic_upgrade": {
+    "after_version": "1.5.4",
+    "recovery_markers_and_task_cleaned": true,
+    "all_signed_files_verified": 96,
+    "shipping_verifier_passed": true,
+    "consent_revision": 2,
+    "msi_registered_installed": true,
+    "reboot_qualified": false,
+    "manual_cache_or_task_repair_during_this_upgrade": false,
+    "after_sequence": 7,
+    "utc": "2026-10-27T20:30:03.5298712Z",
+    "manual_installer_not_started": true,
+    "unattended_consent": false,
+    "service_running_auto_system": true,
+    "native_watch_running": true,
+    "identity_credential_consent_and_trust_preserved": true,
+    "source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "production_publication": false
+  },
+  "real_os_cache_regression": {
+    "sequence": 7,
+    "automatic_native_watcher_repaired_real_stale_microsoft_cache": true,
+    "all_signed_project_files_unchanged": 96,
+    "software_version": "1.5.4",
+    "generated_cache_matches_current_system": true,
+    "source_system_file_unchanged": true,
+    "unmodified_shipping_verifier_passed": true,
+    "native_watcher_and_service_running": true,
+    "lab_only": true,
+    "identity_credential_trust_and_consent_unchanged": true,
+    "software_not_reinstalled_or_upgraded_during_regression": true,
+    "production_publication": false,
+    "utc": "2026-10-27T20:35:37.9642589Z",
+    "profile_revision": 14,
+    "source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "system_modification_time_preserved": true,
+    "software_rollout_paused_during_ordinary_os_cache_maintenance": true,
+    "no_service_or_helper_killed": true,
+    "no_wrapper_or_maintenance_cli_used": true,
+    "current_system_sha256": "ea91cd0634c69789b68770311b4e892010fe9e37d16c15fd33c461a04cebe4e3"
+  },
+  "native_technician": {
+    "source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "flutter_and_rust_libraries_loaded": true,
+    "native_child_process_running": true,
+    "version": "1.5.4",
+    "utc": "2026-10-27T20:54:24.5530335Z",
+    "native_process_count": 1,
+    "no_new_application_crash_event": true,
+    "source_payload_hashes": {
+      "rustdesk.exe": "4f5102314a8cb5043726f9cb929c47d608aff0e1d1dd9ffb7d4c8b1ac7b10a4a",
+      "librustdesk.dll": "b249d64e8994ffa36612ff68f4bd05c868c553e788eef7f2602b28bf229a5b82",
+      "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204"
+    },
+    "gui_mfa_and_inventory_observed_separately": false,
+    "remote_session_qualified": false
+  },
+  "technician_mfa": {
+    "utc": "2026-10-27T20:54:56.393573+00:00",
+    "application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "version": "1.5.4",
+    "release_sequence": 7,
+    "profile_revision": 14,
+    "visible_approved_device_count": 2,
+    "os": "Windows Server 2019 x64 build 17763.3650",
+    "generated_technician_bundle_installed": true,
+    "original_verified_launcher_used": true,
+    "actual_desktop_session": 1,
+    "company_branding_visible": true,
+    "updated_signed_branding_visible": true,
+    "company_https_origin_visible": true,
+    "username_password_and_totp_entered_only_in_native_form": true,
+    "gui_mfa_sign_in_succeeded": true,
+    "authorized_device_and_group_visible": true,
+    "session_history_visible": true,
+    "independent_server_login_audit_matches": true,
+    "same_machine_customer_and_technician": true,
+    "native_remote_session_exercised": false,
+    "standard_user_install_qualified": false,
+    "full_product_acceptance": false
+  },
+  "distribution": {
+    "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+    "public_customer_anonymous_status": 200,
+    "protected_technician_anonymous_status": 401,
+    "bundles": [
+      {
+        "edition": "customer",
+        "bundle_sha256": "f17f204a4839be740a33d249538ed357291bbbeeb885da26827dc5864fc7735e",
+        "bytes": 32494720,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "tamper_rejection_verified": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 200,
+        "download_status": 200
+      },
+      {
+        "edition": "technician",
+        "bundle_sha256": "9b8467840afa9a117856b5910b9c621d8a2130f7723e6b28d1327c91115347d1",
+        "bytes": 30292776,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "tamper_rejection_verified": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 401,
+        "download_status": 200
+      }
+    ]
+  },
+  "limitations": [
+    "Nonexportable disposable-lab publisher only; no production signing approval.",
+    "Fresh Windows11 and full six-OS qualification incomplete.",
+    "1.5.3 remote-session evidence does not qualify all features on 1.5.4.",
+    "Public Internet connectivity and old Windows company restore remain separate gates.",
+    "Consent-dialog scrolling follow-up is not in this reproduced candidate."
+  ]
+}
diff --git a/deployment/windows/a6670d6-native-independent-comparison.json b/deployment/windows/a6670d6-native-independent-comparison.json
new file mode 100644
index 00000000000..e68dfdb2892
--- /dev/null
+++ b/deployment/windows/a6670d6-native-independent-comparison.json
@@ -0,0 +1,2289 @@
+{
+  "schema": 1,
+  "source_commit": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "source_date_epoch": 1793109911,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1215,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1215,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.4-customer-x64-unsigned.msi",
+      "first_sha256": "3091230dbc7c42d8545bd4ba01d41347c87868235a281ea0bce430dedbf87c54",
+      "second_sha256": "3091230dbc7c42d8545bd4ba01d41347c87868235a281ea0bce430dedbf87c54",
+      "first_bytes": 33603584,
+      "second_bytes": 33603584,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.4-technician-x64-unsigned.exe",
+      "first_sha256": "3bd6ebe2378d8de270edb4361955d3a9e32d0d889e847b0676ad6494c330a866",
+      "second_sha256": "3bd6ebe2378d8de270edb4361955d3a9e32d0d889e847b0676ad6494c330a866",
+      "first_bytes": 24251904,
+      "second_bytes": 24251904,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.4-technician-x64-unsigned.msi",
+      "first_sha256": "72cc2a811fd73208509b79f26ef77bc994a0bd22c6a0783b3799578c47bb77f3",
+      "second_sha256": "72cc2a811fd73208509b79f26ef77bc994a0bd22c6a0783b3799578c47bb77f3",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.4-x64-unsigned-install.exe",
+      "first_sha256": "3bd6ebe2378d8de270edb4361955d3a9e32d0d889e847b0676ad6494c330a866",
+      "second_sha256": "3bd6ebe2378d8de270edb4361955d3a9e32d0d889e847b0676ad6494c330a866",
+      "first_bytes": 24251904,
+      "second_bytes": 24251904,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "3d627af2a1f7cd5eb369007d60a653262774adcdfc49f476b033bd2c64608552",
+      "second_sha256": "3d627af2a1f7cd5eb369007d60a653262774adcdfc49f476b033bd2c64608552",
+      "first_bytes": 64254464,
+      "second_bytes": 64254464,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "275784095cd7483afe38aa7c7a7d35b5969d278aee4156d30bf364b2ebd4bfd1",
+      "second_sha256": "275784095cd7483afe38aa7c7a7d35b5969d278aee4156d30bf364b2ebd4bfd1",
+      "first_bytes": 5522944,
+      "second_bytes": 5522944,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "574522f921555e20d7ea29ca5ab5d8551101925d57031735c1e7be7363de0d00",
+      "second_sha256": "574522f921555e20d7ea29ca5ab5d8551101925d57031735c1e7be7363de0d00",
+      "first_bytes": 8820224,
+      "second_bytes": 8820224,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+      "second_sha256": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 40520718494,
+      "run_attempt": 1,
+      "artifact": 12745553190,
+      "archive_digest": "sha256:bf37c69b2989c64030a5b7d70dc69182ff062df81edda07843af5e28ec67b652",
+      "bytes": 254719682
+    },
+    {
+      "workflow_run": 40534403214,
+      "run_attempt": 1,
+      "artifact": 12753645365,
+      "archive_digest": "sha256:ca9ce3e89cc861527e4ba215669528a5bd74bf7f3959e592758d951b5c41cd5f",
+      "bytes": 254719700
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "run": "40549751275"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/a6670d6-server2022-recoverable-cold-boot.json b/deployment/windows/a6670d6-server2022-recoverable-cold-boot.json
new file mode 100644
index 00000000000..2afbf43fd5b
--- /dev/null
+++ b/deployment/windows/a6670d6-server2022-recoverable-cold-boot.json
@@ -0,0 +1,39 @@
+{
+  "application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "version": "1.5.4",
+  "sequence": 7,
+  "os": "Windows Server 2022 Standard Evaluation Desktop Experience 20348.587",
+  "verified_utc": "2026-10-27T23:45:27.7923788Z",
+  "recovery": {
+    "normal_shutdown_before_recovery_completed": false,
+    "original_disk_and_two_full_vm_checkpoints_preserved": true,
+    "cold_boot_used_separate_copy_on_write_overlay": true,
+    "original_disk_read_only": true,
+    "simultaneous_duplicate_guest": false,
+    "guest_memory_increased_from_2_to_3_gib": true,
+    "cause_of_original_shutdown_and_remote_administration_stall_established": false
+  },
+  "read_only_shipping_checks": {
+    "same_enrolled_device_identity": true,
+    "credential_present_not_exported": true,
+    "unattended_consent_off": true,
+    "consent_revision": 2,
+    "profile_revision": 14,
+    "installed_release_sequence": 7,
+    "shipping_verify_installed_passed": true,
+    "signed_file_count": 96,
+    "agent_signature_and_existing_lab_publisher_verified": true,
+    "service_running_automatically": true,
+    "configuration_watcher_running_automatically": true
+  },
+  "subsequent_shutdown": {
+    "request_utc": "2026-10-27T23:45:51.2559307Z",
+    "normal_shutdown_without_forcing_apps": true,
+    "qemu_exit_utc": "2026-10-27T23:46:11.150273+00:00",
+    "qemu_exit_code": 0,
+    "subsequent_boot_verified": false
+  },
+  "full_normal_reboot_cycle_acceptance_claimed": false,
+  "new_1_5_5_fixes_tested": false,
+  "production_qualified": false
+}
diff --git a/deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json b/deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json
new file mode 100644
index 00000000000..3e23762d27d
--- /dev/null
+++ b/deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json
@@ -0,0 +1,102 @@
+{
+  "recorded_utc": "2026-10-27T22:25:40.249109+00:00",
+  "application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "version": "1.5.4",
+  "sequence": 7,
+  "os": "Windows Server 2022 Standard Evaluation Desktop Experience 20348.587",
+  "fresh_pristine_os_install_claimed": false,
+  "baseline": "Previously tested endpoint after uninstall: only original zero-byte pending-uninstall marker remained; no application, service or enrollment state. Marker was preserved for shipping setup to handle.",
+  "setup": {
+    "version": "1.5.4",
+    "watch_state": "Running",
+    "profile_revision": 14,
+    "sequence": 7,
+    "shipping_verifier_passed": true,
+    "utc": "2026-10-27T22:00:40.0547516Z",
+    "all_signed_files": 96,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "enrollment": {
+    "utc": "2026-10-27T22:02:17.219799+00:00",
+    "version": "1.5.4",
+    "sequence": 7,
+    "actual_enrolled_customer": "Server2022",
+    "pending_inventory_hidden": true,
+    "pending_grant_status": 403,
+    "explicit_company_approval_verified": true,
+    "authorized_inventory_visible": true,
+    "unassigned_inventory_hidden": true,
+    "unassigned_grant_status": 403,
+    "unattended_without_consent_status": 403,
+    "other_device_records_unchanged": true,
+    "no_successful_grant_or_native_session_created": true,
+    "production_qualified": false
+  },
+  "package_rejections": {
+    "source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+    "production_qualified": false,
+    "test_metadata_not_imported_or_published": true,
+    "version": "1.5.4",
+    "utc": "2026-10-27T22:03:08.8838989Z",
+    "no_installer_or_update_handoff": true,
+    "installed_payload_still_verifies": true,
+    "sequence": 7,
+    "exact_signed_repair_control_accepted": true,
+    "rejections": [
+      {
+        "expected_reason_verified": true,
+        "case": "tampered-hash",
+        "rejected": true
+      },
+      {
+        "expected_reason_verified": true,
+        "case": "bad-signature",
+        "rejected": true
+      },
+      {
+        "expected_reason_verified": true,
+        "case": "wrong-publisher",
+        "rejected": true
+      },
+      {
+        "expected_reason_verified": true,
+        "case": "wrong-certificate",
+        "rejected": true
+      },
+      {
+        "expected_reason_verified": true,
+        "case": "replayed-release",
+        "rejected": true
+      }
+    ],
+    "identity_credential_consent_and_sequence_unchanged": true,
+    "original_installer_unchanged": true
+  },
+  "standard_user_consent": {
+    "utc": "2026-10-27T22:17:20.771729+00:00",
+    "actual_standard_user_native_consent_ui_enabled_then_revoked": true,
+    "server_enabled_then_revoked_independently_verified": true,
+    "new_unattended_grant_after_revocation_status": 403,
+    "no_remote_session_started": true,
+    "production_qualified": false
+  },
+  "standard_user_native_branding_visible": true,
+  "actual_customer_shortcut_launched": true,
+  "startup_without_msi_repair_passed": false,
+  "ordinary_user_stop_without_elevation_passed": false,
+  "stop_elevation_prompt_canceled_without_admin_credentials": true,
+  "full_os_or_remote_feature_acceptance": false,
+  "production_publication": false,
+  "shortcut_repair_detection": [
+    {
+      "event_id": 1004,
+      "feature": "Customer",
+      "keypath_reported_unavailable": "C:\\ProgramData\\SwanRemoteSupport\\swan-agent.exe"
+    }
+  ]
+}
diff --git a/deployment/windows/a6670d6-win10-recoverable-cold-boot.json b/deployment/windows/a6670d6-win10-recoverable-cold-boot.json
new file mode 100644
index 00000000000..2e3a85002e7
--- /dev/null
+++ b/deployment/windows/a6670d6-win10-recoverable-cold-boot.json
@@ -0,0 +1,42 @@
+{
+  "application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "version": "1.5.4",
+  "sequence": 7,
+  "normal_shutdown_completed_before_recovery": false,
+  "original_disk_and_two_whole_vm_snapshots_preserved": true,
+  "original_disk_read_only": true,
+  "separate_private_cold_overlay": true,
+  "simultaneous_duplicate_vm": false,
+  "guest_memory_mib": 3072,
+  "controller_checkpoint_timeout_recovered_by_independent_monitor_check": true,
+  "verified_checks": {
+    "identity_credential_and_trust_preserved": true,
+    "windows_generated_cache_matches_current_system": true,
+    "private_key_exported": false,
+    "unattended_consent_disabled": true,
+    "recoverable_cold_overlay": true,
+    "no_recovery_markers": true,
+    "consent_revision": 2,
+    "customer_service": "Running",
+    "existing_lab_private_key_nonexportable": true,
+    "shipping_verifier_passed": true,
+    "service_account": "LocalSystem",
+    "utc": "2026-10-28T01:14:04.5817531Z",
+    "release_sequence": 7,
+    "watch_state": "Running",
+    "existing_lab_private_key_present": true,
+    "service_start_mode": "Auto",
+    "credentials_disclosed": false,
+    "normal_shutdown_qualification": false
+  },
+  "full_normal_reboot_acceptance_claimed": false,
+  "new_1_5_5_runtime_qualification_claimed": false,
+  "production_qualified": false,
+  "subsequent_normal_shutdown": {
+    "after_lab_signing_completed": true,
+    "qemu_exit_utc": "2026-10-28T02:18:17.781311+00:00",
+    "qemu_exit_code": 0,
+    "forced_app_close": false,
+    "subsequent_boot_verified": false
+  }
+}
diff --git a/deployment/windows/archive-build-source.py b/deployment/windows/archive-build-source.py
new file mode 100644
index 00000000000..cd340e29a5a
--- /dev/null
+++ b/deployment/windows/archive-build-source.py
@@ -0,0 +1,118 @@
+"""Archive tracked build inputs and explicitly named generated bridge sources.
+
+Never sweep the working directory: ignored credentials, lab data, and binaries
+are excluded. Run after bridge generation and before application compilation.
+The included workflow describes subsequent deterministic packaging transforms.
+"""
+import argparse
+import hashlib
+import json
+from pathlib import Path, PurePosixPath
+import subprocess
+import zipfile
+
+BRIDGE_FILES = (
+    "src/bridge_generated.rs", "src/bridge_generated.io.rs",
+    "flutter/lib/generated_bridge.dart", "flutter/lib/generated_bridge.freezed.dart",
+    "flutter/macos/Runner/bridge_generated.h", "flutter/ios/Runner/bridge_generated.h",
+)
+
+
+def git(root, *args):
+    return subprocess.check_output(["git", "-C", str(root), *args])
+
+
+def safe_path(value):
+    path = PurePosixPath(value)
+    if path.is_absolute() or ".." in path.parts or ".git" in path.parts or "\\" in value or ":" in value:
+        raise ValueError("Unsafe source path")
+    return path
+
+
+def collect(root, components_only=False):
+    files, repositories = {}, {}
+
+    def repository(directory, prefix="", expected=None):
+        revision = git(directory, "rev-parse", "HEAD").decode().strip()
+        if expected is not None and revision != expected:
+            raise ValueError("Submodule does not match pinned source")
+        repositories[prefix or "."] = revision
+        records = git(directory, "ls-files", "--stage", "-z").split(b"\0")
+        for record in filter(None, records):
+            header, name = record.split(b"\t", 1)
+            mode, object_id, stage = header.decode().split()
+            if stage != "0":
+                raise ValueError("Unmerged source index")
+            relative = name.decode("utf-8")
+            safe_path(relative)
+            if components_only and not (
+                prefix + relative in ("LICENCE", ".cargo/config.toml", ".dockerignore")
+                or (prefix + relative).startswith(("product/", "deployment/", "branding/"))
+            ):
+                continue
+            archive_name = prefix + relative
+            path = directory / relative
+            if path.is_symlink() or not path.resolve().is_relative_to(root):
+                raise ValueError("Source link or path escaped checkout")
+            if mode == "160000":
+                if not path.is_dir():
+                    raise ValueError("Uninitialized source submodule")
+                repository(path, archive_name + "/", object_id)
+            elif mode in ("100644", "100755"):
+                if not path.is_file():
+                    raise ValueError("Tracked source missing")
+                files[archive_name] = (path, mode)
+            else:
+                raise ValueError("Unsupported source file mode")
+
+    repository(root)
+    for name in (() if components_only else BRIDGE_FILES):
+        path = root / name
+        if not path.is_file() or path.is_symlink() or not path.resolve().is_relative_to(root):
+            raise ValueError("Generated bridge source missing or unsafe")
+        files[name] = (path, "100644")
+    return files, repositories
+
+
+def archive(root, output, components_only=False):
+    root = root.resolve(strict=True)
+    files, repositories = collect(root, components_only)
+    # Explicit exclusive creation prevents silently replacing release evidence.
+    manifest = {"schema": 1, "snapshot": "before-component-compilation" if components_only else "before-application-compilation",
+                "repositories": repositories, "generated_bridge_files": [] if components_only else list(BRIDGE_FILES),
+                "files": {}}
+    if not components_only:
+        epoch = git(root, "show", "-s", "--format=%ct", "HEAD").decode().strip()
+        if not epoch.isascii() or not epoch.isdecimal():
+            raise ValueError("Invalid source commit timestamp")
+        manifest["source_date_epoch"] = int(epoch)
+    with output.open("xb") as destination, zipfile.ZipFile(destination, "w", compression=zipfile.ZIP_DEFLATED) as package:
+        for name, (path, mode) in sorted(files.items()):
+            data = path.read_bytes()
+            manifest["files"][name] = {"sha256": hashlib.sha256(data).hexdigest(), "mode": mode}
+            info = zipfile.ZipInfo("source/" + name, (1980, 1, 1, 0, 0, 0))
+            info.create_system = 3
+            info.external_attr = int(mode, 8) << 16
+            info.compress_type = zipfile.ZIP_DEFLATED
+            package.writestr(info, data)
+        receipt = zipfile.ZipInfo("BUILD-SOURCE.json", (1980, 1, 1, 0, 0, 0))
+        receipt.compress_type = zipfile.ZIP_DEFLATED
+        receipt.create_system = 3
+        receipt.external_attr = 0o100644 << 16
+        package.writestr(receipt, json.dumps(manifest, sort_keys=True, indent=2))
+    with zipfile.ZipFile(output) as package:
+        if package.testzip() is not None:
+            raise ValueError("Source archive CRC failure")
+        for name, entry in manifest["files"].items():
+            if hashlib.sha256(package.read("source/" + name)).hexdigest() != entry["sha256"]:
+                raise ValueError("Source archive hash mismatch")
+    return hashlib.sha256(output.read_bytes()).hexdigest()
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("root", type=Path)
+    parser.add_argument("output", type=Path)
+    parser.add_argument("--components-only", action="store_true", help="Archive company components and their deployment inputs without unrelated client submodules or generated bridges")
+    args = parser.parse_args()
+    print(archive(args.root, args.output, args.components_only))
diff --git a/deployment/windows/compare-native-builds.py b/deployment/windows/compare-native-builds.py
new file mode 100644
index 00000000000..6c494de864e
--- /dev/null
+++ b/deployment/windows/compare-native-builds.py
@@ -0,0 +1,368 @@
+"""Verify public build provenance and compare original unsigned release bytes.
+
+This verifier never installs or executes artifact contents. Source text checkout
+line endings are recorded separately; shipping binaries are never normalized.
+"""
+import argparse
+import ast
+import hashlib
+import io
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import subprocess
+import tomllib
+import urllib.error
+import urllib.parse
+import urllib.request
+import zipfile
+
+BRIDGE = ("src/bridge_generated.rs", "src/bridge_generated.io.rs",
+          "flutter/lib/generated_bridge.dart", "flutter/lib/generated_bridge.freezed.dart",
+          "flutter/macos/Runner/bridge_generated.h", "flutter/ios/Runner/bridge_generated.h")
+MAX_ARCHIVE = 1024 ** 3
+
+
+class VerificationError(ValueError):
+    pass
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def git(root, *args):
+    return subprocess.check_output(["git", "-C", str(root), *args], stderr=subprocess.PIPE)
+
+
+def source_version(root, revision):
+    version = tomllib.loads(git(root, "show", revision + ":Cargo.toml").decode("utf-8"))["package"]["version"]
+    if not re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version):
+        raise VerificationError("Unexpected native version")
+    return version
+
+
+def shipping_names(version):
+    return {"SwanRemoteSupport-" + version + suffix for suffix in (
+        "-customer-x64-unsigned.msi", "-technician-x64-unsigned.exe",
+        "-technician-x64-unsigned.msi", "-x64-unsigned-install.exe")
+    } | {"SwanServerSetup-UNSIGNED-TEST.exe", "swan-agent.exe", "swan-management.exe", "swan-worker.exe"}
+
+
+def source_tree(root, revision):
+    files, repositories = {}, {}
+
+    def visit(directory, commit, prefix=""):
+        if git(directory, "rev-parse", commit + "^{commit}").decode().strip() != commit:
+            raise VerificationError("Pinned source commit is missing or differs")
+        repositories[prefix or "."] = commit
+        for item in filter(None, git(directory, "ls-tree", "-r", "-z", commit).split(b"\0")):
+            header, path = item.split(b"\t", 1)
+            mode, kind, object_id = header.decode().split()
+            name = path.decode()
+            if kind == "commit":
+                visit(directory / name, object_id, prefix + name + "/")
+            elif kind == "blob" and mode in ("100644", "100755"):
+                files[prefix + name] = (mode, object_id)
+            else:
+                raise VerificationError("Unsupported source tree entry")
+
+    visit(root, revision)
+    return files, repositories
+
+
+def validate_entries(archive):
+    entries = archive.infolist()
+    names = [e.filename for e in entries]
+    if len(names) != len(set(n.casefold() for n in names)) or len(names) > 10000:
+        raise VerificationError("Duplicate or excessive archive entries")
+    if sum(e.file_size for e in entries) > 2 * MAX_ARCHIVE:
+        raise VerificationError("Archive expands beyond verification bound")
+    for e in entries:
+        path = PurePosixPath(e.filename)
+        if (e.is_dir() or path.is_absolute() or "\\" in e.filename or ":" in e.filename
+                or not path.parts or any(p in ("", ".", "..") for p in e.filename.split("/"))
+                or (e.external_attr >> 16) & 0o170000 == 0o120000
+                or e.file_size > 512 * 1024 ** 2):
+            raise VerificationError("Unsafe archive entry")
+    return set(names)
+
+
+def entry_hash(archive, name):
+    digest = hashlib.sha256()
+    with archive.open(name) as stream:
+        for block in iter(lambda: stream.read(1024 ** 2), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def verify_source(archive, tracked, repositories, epoch):
+    info = archive.getinfo("SwanRemoteSupport-build-source.zip")
+    if info.file_size > 256 * 1024 ** 2:
+        raise VerificationError("Source archive exceeds bound")
+    with zipfile.ZipFile(io.BytesIO(archive.read(info))) as source:
+        names = validate_entries(source)
+        expected = set(tracked) | set(BRIDGE)
+        if names != {"BUILD-SOURCE.json"} | {"source/" + n for n in expected}:
+            raise VerificationError("Corresponding source file set differs from public source")
+        manifest = json.loads(source.read("BUILD-SOURCE.json"))
+        if (manifest["repositories"] != repositories or set(manifest["files"]) != expected
+                or manifest.get("source_date_epoch") != epoch
+                or set(manifest["generated_bridge_files"]) != set(BRIDGE)):
+            raise VerificationError("Source manifest provenance differs")
+        conversions, bridges = [], {}
+        for name in sorted(expected):
+            data = source.read("source/" + name)
+            if hashlib.sha256(data).hexdigest() != manifest["files"][name]["sha256"]:
+                raise VerificationError("Source manifest content hash differs")
+            if name in BRIDGE:
+                bridges[name] = hashlib.sha256(data).hexdigest()
+                continue
+            mode, blob = tracked[name]
+            if manifest["files"][name]["mode"] != mode:
+                raise VerificationError("Source mode differs")
+            def git_hash(value):
+                return hashlib.sha1(b"blob " + str(len(value)).encode() + b"\0" + value).hexdigest()
+            if git_hash(data) != blob:
+                normalized = data.replace(b"\r\n", b"\n")
+                if b"\0" in data or (git_hash(normalized) != blob
+                        and git_hash(normalized.replace(b"\n", b"\r\n")) != blob):
+                    raise VerificationError("Original public source blob differs")
+                conversions.append(name)
+        wrapper_input = None
+        script = "deployment/windows/patch-flutter-client-wrapper.py"
+        fixture = "deployment/windows/fixtures/flutter-sdk-3.24.5/core_implementations.cc"
+        if script in tracked:
+            if fixture not in tracked:
+                raise VerificationError("Reviewed client-wrapper source preimage missing")
+            tree = ast.parse(source.read("source/" + script).decode("utf-8-sig"))
+            pins = [node.value.value for node in tree.body if isinstance(node, ast.Assign)
+                    and len(node.targets) == 1 and isinstance(node.targets[0], ast.Name)
+                    and node.targets[0].id == "PATCHED_SHA256" and isinstance(node.value, ast.Constant)]
+            if len(pins) != 1 or not isinstance(pins[0], str) or not re.fullmatch(r"[0-9a-f]{64}", pins[0]):
+                raise VerificationError("Reviewed patched client-wrapper source pin missing")
+            wrapper_input = {"script_sha256": manifest["files"][script]["sha256"],
+                             "patched_source_sha256": pins[0],
+                             "original_canonical_sha256": hashlib.sha256(
+                                 source.read("source/" + fixture).replace(b"\r\n", b"\n")).hexdigest()}
+    return {"tracked_files_verified": len(tracked), "bridge_hashes": bridges,
+            "client_wrapper_patch_input": wrapper_input,
+            "declared_source_text_checkout_conversions": conversions}
+
+
+def verify_client_wrapper(archive, expected):
+    if expected is None:
+        return None
+    name = "flutter-client-wrapper-repro.json"
+    if name not in archive.namelist() or archive.getinfo(name).file_size > 64 * 1024:
+        raise VerificationError("Reviewed client-wrapper patch receipt missing or excessive")
+    receipt = json.loads(archive.read(name).decode("utf-8-sig"))
+    if (receipt.get("engine_revision") != "a18df97ca57a249df5d8d68cd0820600223ce262"
+            or receipt.get("original_canonical_sha256") != expected["original_canonical_sha256"]
+            or receipt.get("patch_script_sha256") != expected["script_sha256"]
+            or receipt.get("engine_binaries_changed") is not False
+            or receipt.get("shipping_pe_normalization") is not False):
+        raise VerificationError("Client-wrapper receipt differs from reviewed public inputs")
+    files = receipt.get("files")
+    if not isinstance(files, list) or not 1 <= len(files) <= 4:
+        raise VerificationError("Unexpected client-wrapper source set")
+    seen, hashes = set(), set()
+    for item in files:
+        if not isinstance(item, dict):
+            raise VerificationError("Invalid patched client-wrapper source entry")
+        path = item.get("path", "")
+        if (not isinstance(path, str) or not path.startswith("bin/cache/artifacts/engine/")
+                or "\\" in path or ":" in path or any(p in ("", ".", "..") for p in path.split("/"))
+                or not path.endswith("/cpp_client_wrapper/core_implementations.cc") or path in seen
+                or item.get("patched_sha256") != expected["patched_source_sha256"]):
+            raise VerificationError("Unsafe or invalid patched client-wrapper source identity")
+        seen.add(path)
+        hashes.add(item["patched_sha256"])
+    return {"original_canonical_sha256": expected["original_canonical_sha256"],
+            "patched_source_sha256": sorted(hashes), "source_files": len(files)}
+
+
+def verify_msvc_inputs(archive, required):
+    name = "native-msvc-toolchain.json"
+    if name not in archive.namelist():
+        if required:
+            raise VerificationError("Required MSVC input identity is missing")
+        return None
+    if archive.getinfo(name).file_size > 2 * 1024 ** 2:
+        raise VerificationError("MSVC input identity exceeds bound")
+    manifest = json.loads(archive.read(name).decode("utf-8-sig"))
+    files = manifest.get("files")
+    if not isinstance(files, list) or not 6 <= len(files) <= 10000:
+        raise VerificationError("Invalid MSVC input file set")
+    seen = set()
+    for entry in files:
+        if not isinstance(entry, dict):
+            raise VerificationError("Invalid MSVC input entry")
+        path = entry.get("path", "")
+        digest = entry.get("sha256", "")
+        if (not isinstance(path, str) or not path or path.startswith("/")
+                or any(p in ("", ".", "..") for p in path.split("/"))
+                or not path.isascii() or any(ord(c) < 32 for c in path)
+                or "\\" in path or ":" in path
+                or path.casefold() in seen
+                or not isinstance(digest, str) or not re.fullmatch(r"[0-9a-f]{64}", digest)
+                or type(entry.get("bytes")) is not int or entry["bytes"] < 0):
+            raise VerificationError("Unsafe or invalid MSVC input entry")
+        seen.add(path.casefold())
+    required_files = {"bin/hostx64/x64/" + n for n in ("cl.exe", "c1xx.dll", "c2.dll", "link.exe")}
+    if not required_files.union({"include/typeinfo", "include/memory"}) <= seen:
+        raise VerificationError("Required MSVC inputs missing")
+    canonical = "".join(e["path"] + "\0" + e["sha256"] + "\n"
+                        for e in sorted(files, key=lambda e: e["path"]))
+    identity = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    if identity != manifest.get("input_identity_sha256"):
+        raise VerificationError("MSVC input identity digest differs")
+    return {"input_identity_sha256": identity, "files": len(files),
+            "visual_studio_version": manifest.get("visual_studio_version"),
+            "toolset_directory_version": manifest.get("toolset_directory_version"),
+            "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"}
+
+
+def compare(first, second, checkout, revision):
+    tracked, repositories = source_tree(checkout, revision)
+    epoch = int(git(checkout, "show", "-s", "--format=%ct", revision))
+    with zipfile.ZipFile(first) as a, zipfile.ZipFile(second) as b:
+        names = [validate_entries(z) for z in (a, b)]
+        proof = [verify_source(z, tracked, repositories, epoch) for z in (a, b)]
+        if proof[0]["bridge_hashes"] != proof[1]["bridge_hashes"]:
+            raise VerificationError("Independently generated bridge bytes differ")
+        wrapper = [verify_client_wrapper(z, p["client_wrapper_patch_input"])
+                   for z, p in zip((a, b), proof)]
+        if wrapper[0] != wrapper[1]:
+            raise VerificationError("Reviewed client-wrapper compilation inputs differ")
+        toolchains = [verify_msvc_inputs(z, "deployment/windows/Record-MsvcToolchain.ps1" in tracked)
+                      for z in (a, b)]
+        outputs = [{n for n in ns if "/" not in n and n.lower().endswith((".exe", ".msi", ".dll"))} for ns in names]
+        required = shipping_names(source_version(checkout, revision))
+        if outputs[0] != required or outputs[1] != required:
+            raise VerificationError("Unsigned shipping output sets differ or are incomplete")
+        for z, ns in zip((a, b), names):
+            for line in z.read("SHA256SUMS.txt").decode().splitlines():
+                if not line.strip():
+                    continue
+                digest, name = line.split(None, 1)
+                name = name.strip().lstrip("*")
+                if name not in ns or entry_hash(z, name) != digest:
+                    raise VerificationError("Declared artifact file hash differs")
+        records = []
+        for name in sorted(outputs[0]):
+            left, right = entry_hash(a, name), entry_hash(b, name)
+            records.append({"path": name, "first_sha256": left, "second_sha256": right,
+                            "first_bytes": a.getinfo(name).file_size,
+                            "second_bytes": b.getinfo(name).file_size,
+                            "identical": left == right and a.getinfo(name).file_size == b.getinfo(name).file_size})
+    return {"schema": 1, "source_commit": revision, "source_date_epoch": epoch, "source_proofs": proof,
+            "msvc_input_proofs": toolchains, "client_wrapper_input_proofs": wrapper,
+            "recorded_msvc_inputs_identical": (toolchains[0]["input_identity_sha256"] == toolchains[1]["input_identity_sha256"]
+                                               if all(toolchains) else None),
+            "outputs": records, "all_shipping_bytes_identical": all(r["identical"] for r in records),
+            "normalization_applied_to_shipping_files": False,
+            "executables_run": False, "runtime_qualified": False, "production_approved": False,
+            "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification"}
+
+
+def api_json(repository, path, token):
+    request = urllib.request.Request("https://api.github.com/repos/" + repository + path,
+        headers={"Authorization": "Bearer " + token, "Accept": "application/vnd.github+json"})
+    with urllib.request.build_opener(NoRedirect()).open(request, timeout=30) as response:
+        data = response.read(2 * 1024 ** 2 + 1)
+    if len(data) > 2 * 1024 ** 2:
+        raise VerificationError("API metadata exceeds bound")
+    return json.loads(data)
+
+
+def fetch(repository, run_id, revision, artifact_name, token, target):
+    run = api_json(repository, "/actions/runs/" + str(run_id), token)
+    if (run["head_sha"] != revision or run["status"] != "completed" or run["conclusion"] != "success"
+            or run["path"] != ".github/workflows/swan-windows-build.yml"):
+        raise VerificationError("Expected a successful exact-source native workflow")
+    artifacts = api_json(repository, "/actions/runs/" + str(run_id) + "/artifacts?per_page=100", token)
+    matches = [a for a in artifacts["artifacts"] if a["name"] == artifact_name and not a["expired"]]
+    if len(matches) != 1:
+        raise VerificationError("Expected one complete unexpired native artifact")
+    item = matches[0]
+    if (item["workflow_run"]["head_sha"] != revision
+            or not re.fullmatch(r"sha256:[0-9a-f]{64}", item.get("digest", ""))
+            or not 0 < item["size_in_bytes"] < MAX_ARCHIVE):
+        raise VerificationError("Invalid artifact identity or digest")
+    request = urllib.request.Request("https://api.github.com/repos/" + repository + "/actions/artifacts/" + str(item["id"]) + "/zip",
+        headers={"Authorization": "Bearer " + token})
+    try:
+        urllib.request.build_opener(NoRedirect()).open(request, timeout=30)
+    except urllib.error.HTTPError as error:
+        if error.code != 302:
+            raise VerificationError("Artifact redirect unavailable") from None
+        location = error.headers["Location"]
+    else:
+        raise VerificationError("Expected an artifact download redirect")
+    parsed = urllib.parse.urlparse(location)
+    if (parsed.scheme != "https" or not (parsed.hostname or "").endswith(".blob.core.windows.net")
+            or parsed.username or parsed.password):
+        raise VerificationError("Unexpected artifact download origin")
+    digest, count = hashlib.sha256(), 0
+    # No authorization header is forwarded to the signed storage URL.
+    with urllib.request.build_opener(NoRedirect()).open(location, timeout=30) as response, target.open("xb") as output:
+        for block in iter(lambda: response.read(1024 ** 2), b""):
+            count += len(block)
+            if count > item["size_in_bytes"]:
+                raise VerificationError("Artifact exceeds declared size")
+            output.write(block)
+            digest.update(block)
+    if count != item["size_in_bytes"] or "sha256:" + digest.hexdigest() != item["digest"]:
+        raise VerificationError("Original artifact archive digest differs")
+    return {"workflow_run": run_id, "run_attempt": run["run_attempt"], "artifact": item["id"],
+            "archive_digest": item["digest"], "bytes": count}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--first-run", required=True, type=int)
+    parser.add_argument("--second-run", required=True, type=int)
+    parser.add_argument("--source", required=True)
+    parser.add_argument("--checkout", required=True, type=Path)
+    parser.add_argument("--work", required=True, type=Path)
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args()
+    repository, token = os.environ.get("GITHUB_REPOSITORY", ""), os.environ.get("GITHUB_TOKEN", "")
+    if (not re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", repository) or not token
+            or not re.fullmatch(r"[0-9a-f]{40}", args.source)
+            or min(args.first_run, args.second_run) <= 0 or args.first_run == args.second_run):
+        raise VerificationError("Invalid repository, source, token or independent run identities")
+    if args.output.exists() or args.work.exists():
+        raise VerificationError("Do not replace retained comparison evidence")
+    if git(args.checkout, "rev-parse", "HEAD").decode().strip() != args.source:
+        raise VerificationError("Comparison checkout differs from the requested source")
+    version = source_version(args.checkout, args.source)
+    args.work.mkdir(parents=True)
+    paths = [args.work / "first.zip", args.work / "second.zip"]
+    inputs = [fetch(repository, run, args.source, "SwanRemoteSupport-" + version + "-x64-unsigned", token, path)
+              for run, path in zip((args.first_run, args.second_run), paths)]
+    if inputs[0]["artifact"] == inputs[1]["artifact"]:
+        raise VerificationError("Independent runs reused the same artifact")
+    result = compare(*paths, args.checkout, args.source)
+    result["builds"] = inputs
+    result["independent_rebuild_verified"] = result["all_shipping_bytes_identical"]
+    result["comparison_workflow"] = {"source": os.environ.get("GITHUB_SHA"), "run": os.environ.get("GITHUB_RUN_ID")}
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    with args.output.open("x", encoding="utf-8") as output:
+        json.dump(result, output, indent=2)
+    print(json.dumps({"source": args.source, "outputs": len(result["outputs"]),
+                      "all_shipping_bytes_identical": result["all_shipping_bytes_identical"]}))
+    return 0 if result["all_shipping_bytes_identical"] else 1
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except VerificationError as error:
+        raise SystemExit(str(error)) from None
+    except Exception as error:
+        # Network exception messages can contain signed URLs. Preserve no such URL in logs.
+        raise SystemExit("Comparison verification failed: " + type(error).__name__) from None
diff --git a/deployment/windows/cpp-path-probe-0fd6519-observations.json b/deployment/windows/cpp-path-probe-0fd6519-observations.json
new file mode 100644
index 00000000000..5ebee4c1f5f
--- /dev/null
+++ b/deployment/windows/cpp-path-probe-0fd6519-observations.json
@@ -0,0 +1,207 @@
+{
+  "binaries_executed": false,
+  "shipping_normalized": false,
+  "scope": "Controlled compiler-only lambda/anonymous-namespace observations; no generated DLL executed; not a product rebuild",
+  "cases": [
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "4da93fcb3262830b4ecd860541e24ca0186a54394e3083c8f7856d61225596ab",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_06eae38a316eb2e5a0f37bc2cf7529a3>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "4da93fcb3262830b4ecd860541e24ca0186a54394e3083c8f7856d61225596ab",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_06eae38a316eb2e5a0f37bc2cf7529a3>"
+          ]
+        }
+      ],
+      "variant": "link-only",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "dea26705004e39894a2e6635804cb49c91f2fde4215fca5aa01d48ace70829ff",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_9455154c6b1191619a39a8e18adddbe3>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "d1562790024718c490153db5ce7b5b15d8a14189316cf56f322b513bf0d71946",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_1af3a9270409049f764fa8f127c2be03>"
+          ]
+        }
+      ],
+      "variant": "link-only",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "eee06590b203c07d7345a0fa86c6b1c1649336a8b91f842ec5ffb318859d4604",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_be6131b957f15562aa491c9057da2280>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "eee06590b203c07d7345a0fa86c6b1c1649336a8b91f842ec5ffb318859d4604",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_be6131b957f15562aa491c9057da2280>"
+          ]
+        }
+      ],
+      "variant": "compiler-brepro",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "e2bf0ed25c81cb6ab5622233eeb35e1de4301a1815134a4056356ea7f20cff3b",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_43c9d04fcb2ec7b9992eda92bc4fd085>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "5ce902ae40e06897fbfc59fb68d974a37edf0c517509f42fb14b3b0b643b32fa",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_5152f9ef4c09d668693444aa2270d295>"
+          ]
+        }
+      ],
+      "variant": "compiler-brepro",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "103eaf79139dc1cc0fd87ae17cef7488366bfe29c189272dcc6e9e0d65b68e91",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_2dd0ad7d3eeb654dc3d99c987cd9d42f>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "103eaf79139dc1cc0fd87ae17cef7488366bfe29c189272dcc6e9e0d65b68e91",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_2dd0ad7d3eeb654dc3d99c987cd9d42f>"
+          ]
+        }
+      ],
+      "variant": "compiler-deterministic",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "9b3814bbd47e5d8dd1bd952423989411f2d23609951d7d3b5f77b45e76507de2",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_a16a9cd9f0b14c7fdff1e0af8bcf19a1>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "895068bddb546029248974b6da1e701d8d79723ec66e8c65a8585303290ad3d8",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_420a2d1d2c768b7442d00c7a69c5b864>"
+          ]
+        }
+      ],
+      "variant": "compiler-deterministic",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "698fe63f3be649885acdf0bf1ccbf6d764a224a702899b477a7bae043b25a99c",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_6b81b06cad09fbfb86716eda2f14647a>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "698fe63f3be649885acdf0bf1ccbf6d764a224a702899b477a7bae043b25a99c",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_6b81b06cad09fbfb86716eda2f14647a>"
+          ]
+        }
+      ],
+      "variant": "compiler-brepro-trim",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "b17d8a7b7125fb2c61bc57fe090441de9072569f40e7e4b22bd56a69906f6e0d",
+          "iteration": 1,
+          "lambda_names": [
+            "<lambda_85b6dcf30f1d7d30250d942acb2fe5b8>"
+          ]
+        },
+        {
+          "compiler_exit": 0,
+          "usable": true,
+          "sha256": "d04f57220752f6b988955d8ffe8abb9653e378e7f6473a07dc530446af34ef0c",
+          "iteration": 2,
+          "lambda_names": [
+            "<lambda_22295d44df15688dc34a26889e71972f>"
+          ]
+        }
+      ],
+      "variant": "compiler-brepro-trim",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    }
+  ]
+}
diff --git a/deployment/windows/cpp-path-probe-d93b067-observations.json b/deployment/windows/cpp-path-probe-d93b067-observations.json
new file mode 100644
index 00000000000..0c2a9c429e9
--- /dev/null
+++ b/deployment/windows/cpp-path-probe-d93b067-observations.json
@@ -0,0 +1,307 @@
+{
+  "cases": [
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_06eae38a316eb2e5a0f37bc2cf7529a3>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "4da93fcb3262830b4ecd860541e24ca0186a54394e3083c8f7856d61225596ab",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_06eae38a316eb2e5a0f37bc2cf7529a3>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "4da93fcb3262830b4ecd860541e24ca0186a54394e3083c8f7856d61225596ab",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "link-only",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_9455154c6b1191619a39a8e18adddbe3>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "dea26705004e39894a2e6635804cb49c91f2fde4215fca5aa01d48ace70829ff",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_1af3a9270409049f764fa8f127c2be03>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "d1562790024718c490153db5ce7b5b15d8a14189316cf56f322b513bf0d71946",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "link-only",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_be6131b957f15562aa491c9057da2280>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "eee06590b203c07d7345a0fa86c6b1c1649336a8b91f842ec5ffb318859d4604",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_be6131b957f15562aa491c9057da2280>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "eee06590b203c07d7345a0fa86c6b1c1649336a8b91f842ec5ffb318859d4604",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-brepro",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_43c9d04fcb2ec7b9992eda92bc4fd085>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "e2bf0ed25c81cb6ab5622233eeb35e1de4301a1815134a4056356ea7f20cff3b",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_5152f9ef4c09d668693444aa2270d295>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "5ce902ae40e06897fbfc59fb68d974a37edf0c517509f42fb14b3b0b643b32fa",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-brepro",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_2dd0ad7d3eeb654dc3d99c987cd9d42f>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "103eaf79139dc1cc0fd87ae17cef7488366bfe29c189272dcc6e9e0d65b68e91",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_2dd0ad7d3eeb654dc3d99c987cd9d42f>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "103eaf79139dc1cc0fd87ae17cef7488366bfe29c189272dcc6e9e0d65b68e91",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-deterministic",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_a16a9cd9f0b14c7fdff1e0af8bcf19a1>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "9b3814bbd47e5d8dd1bd952423989411f2d23609951d7d3b5f77b45e76507de2",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_420a2d1d2c768b7442d00c7a69c5b864>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "895068bddb546029248974b6da1e701d8d79723ec66e8c65a8585303290ad3d8",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-deterministic",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_6b81b06cad09fbfb86716eda2f14647a>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "aa350976cdbf49a69e5bc1f89eccdd6f465cd09cb950f5fe8a9683795f4c425a",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_6b81b06cad09fbfb86716eda2f14647a>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "aa350976cdbf49a69e5bc1f89eccdd6f465cd09cb950f5fe8a9683795f4c425a",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-brepro-trim",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_85b6dcf30f1d7d30250d942acb2fe5b8>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "f4f8526b3603e8fb9b7661fe203ec13912ce00a32b4b8cf8a5f4752db45ee8f5",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_22295d44df15688dc34a26889e71972f>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "ad6fdf9f8d8a58b9db421ddf3dd896ae4a3de4d08cbe3617a88542ca87d7da93",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-brepro-trim",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_34b3eab3f9e802263d73b95999e2fce0>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "129354a9a5ee1335b943c34f68d93ad4a0dd0db24755d8e03e0b049692efd36a",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_34b3eab3f9e802263d73b95999e2fce0>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "129354a9a5ee1335b943c34f68d93ad4a0dd0db24755d8e03e0b049692efd36a",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-relative-source",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_8bca299b3ce7abdd8d3e331b284c8199>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "b3cf2ebf523864603077e00630e55e087f1e983e7d8d3903bd465e6878adb57f",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_a6c86505a98d2be0e2689fb651f2789f>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "8c2094c39cb04280a84fee4f66d7a006f4731efaa0bb10b5a6ebbc5b7986e438",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-relative-source",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_7d04346f771e8639b586e19dc5e6d891>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "4d68816b8ca7b557e1ef434bad843e247d1db41f6a8ae795ea1c2b806eeb8d5b",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_7d04346f771e8639b586e19dc5e6d891>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "4d68816b8ca7b557e1ef434bad843e247d1db41f6a8ae795ea1c2b806eeb8d5b",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-pathmap",
+      "mode": "same-path-new-mtime",
+      "original_dlls_identical": true
+    },
+    {
+      "builds": [
+        {
+          "lambda_names": [
+            "<lambda_e68f26fdac8330294c845e2694fb23cc>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "a13dd650b01ec22760b3f110dbe77f6baa73f5aca865a54396a5c08414b973e3",
+          "usable": true,
+          "iteration": 1
+        },
+        {
+          "lambda_names": [
+            "<lambda_f63ff74a22d0c5711dff1acf2f93a1e6>"
+          ],
+          "compiler_exit": 0,
+          "sha256": "ea297c44357c07dd46c3158d3936e2ac1662e7dc9696b8719c65e2f581e82de4",
+          "usable": true,
+          "iteration": 2
+        }
+      ],
+      "variant": "compiler-pathmap",
+      "mode": "different-paths",
+      "original_dlls_identical": false
+    }
+  ],
+  "binaries_executed": false,
+  "scope": "Controlled compiler-only lambda/anonymous-namespace observations; no generated DLL executed; not a product rebuild",
+  "shipping_normalized": false
+}
diff --git a/deployment/windows/cpp-toolchain-ordinal-validation.json b/deployment/windows/cpp-toolchain-ordinal-validation.json
new file mode 100644
index 00000000000..825d73f8822
--- /dev/null
+++ b/deployment/windows/cpp-toolchain-ordinal-validation.json
@@ -0,0 +1,11 @@
+{
+  "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+  "files": 618,
+  "visual_studio_version": "17.14.37806.7",
+  "toolset_directory_version": "14.44.35207",
+  "scope": "Windows probe manifest validation; not product reproducibility or runtime acceptance",
+  "probe_run": 40031644530,
+  "provider_digest": "sha256:b7ac90888bd076055b5e48f92cced44c01c34bef20ce0f640925740fe873e754",
+  "original_manifest_sha256": "bb10aa3f6269ae23501ce833f2e48df002ab8b1f529080fb015553212c0e1b89",
+  "original_artifacts_retained": true
+}
\ No newline at end of file
diff --git a/deployment/windows/d74a631-native-build-evidence.json b/deployment/windows/d74a631-native-build-evidence.json
new file mode 100644
index 00000000000..5b7595fbe78
--- /dev/null
+++ b/deployment/windows/d74a631-native-build-evidence.json
@@ -0,0 +1,24 @@
+{
+  "source": "d74a63143e98de70676ac6e09864183ee52a2963",
+  "workflow_run": 40398269765,
+  "artifact": 12693280053,
+  "artifact_digest": "sha256:fcebe69a9541660b8515da6287c1c453663236f2096abe4bbf69b6a43e2f04ad",
+  "all_manifest_hashes_match": true,
+  "native_managed_updater_regression_passed": true,
+  "required_steps": {
+    "Build branded client": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "public_tracked_source_files_verified": 1186,
+  "generated_bridge_files_verified": 6,
+  "independent_rebuild_run": 40410425646,
+  "independent_rebuild_conclusion": "failed before native compilation: old Flutter installer selected latest stable and wrong SDK path; engine guard rejected it",
+  "independent_byte_reproduction_verified": false,
+  "runtime_upgrade_qualified": false,
+  "production_publication": false
+}
diff --git a/deployment/windows/da0c621-lab-distribution-evidence.json b/deployment/windows/da0c621-lab-distribution-evidence.json
new file mode 100644
index 00000000000..bae0116847a
--- /dev/null
+++ b/deployment/windows/da0c621-lab-distribution-evidence.json
@@ -0,0 +1,90 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "lab_signing_only": true,
+  "production_approved": false,
+  "signed_customer_msi_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+  "signed_technician_msi_sha256": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3",
+  "installed_customer_manifest_files": 96,
+  "default_signed_input_checks_used": true,
+  "company_worker_distribution": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "profile_revision": 18,
+    "updates_remain_paused": true,
+    "editions": [
+      {
+        "edition": "customer",
+        "sequence": 14,
+        "job_id": "26ab7ada-34c3-4f74-9ae8-8882c7516e84",
+        "bundle_sha256": "1befe45998b9be1e24a13cc885141d509bf784ab8a54413e95011786776fb81b",
+        "bytes": 32508767,
+        "entries": 12,
+        "seven_pinned_source_texts_exact": true,
+        "public_bootstrap_fields_only": true,
+        "both_signatures_verified_against_preexisting_pins": true,
+        "tampered_signed_payload_rejected": true,
+        "release_envelope_unchanged": true,
+        "signed_msi_and_agent_hashes_verified": true,
+        "anonymous_status": 200,
+        "authorized_status": 200,
+        "unapproved_build_rejected": true
+      },
+      {
+        "edition": "technician",
+        "sequence": 15,
+        "job_id": "39640b31-b45e-4f10-9a71-b5f6d842b5c7",
+        "bundle_sha256": "ad96efa8099f28c7792a76f64d1fb1fa81e6e8c9ee0bfac788c6a85e7d2e87d4",
+        "bytes": 30301910,
+        "entries": 12,
+        "seven_pinned_source_texts_exact": true,
+        "public_bootstrap_fields_only": true,
+        "both_signatures_verified_against_preexisting_pins": true,
+        "tampered_signed_payload_rejected": true,
+        "release_envelope_unchanged": true,
+        "signed_msi_and_agent_hashes_verified": true,
+        "anonymous_status": 401,
+        "authorized_status": 200,
+        "unapproved_build_rejected": true
+      }
+    ],
+    "installer_executed": false,
+    "external_reachability_proven": false,
+    "production_approved": false
+  },
+  "technician_explicit_upgrade": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "original_evidence_files": 13,
+    "generated_bundle_sequence_13_to_15_upgrade_passed": true,
+    "administrator_profile_test": true,
+    "standard_user_acceptance": false,
+    "installed_signed_payload_and_cached_msi_hashes_verified": {
+      "installed-technician.exe": "008a5198410b29e74dbc6cd402ef9c1de31535a821a71a9d3f2dbab66f70ec1a",
+      "installed-agent.exe": "c7bfac26344a8f46aa2238b631e3be25785eaaeb5fd721cbf844c438be4d6206",
+      "cached-installer15.msi": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3"
+    },
+    "profile_signatures_and_original_pins_verified": true,
+    "company_configuration_preserved": true,
+    "original_failed_setup_archive_preserved": true,
+    "pending_install_marker_absent": true,
+    "before_and_after_native_verify_installed_exit": 0,
+    "customer_service_and_pending_evidence_unchanged": true,
+    "technician_company_login_or_native_session_tested": false,
+    "production_approved": false
+  },
+  "scope": "Existing isolated company on Server2016; lab publisher only; real worker distribution, administrative explicit technician upgrade, separate endpoint raw customer MSI lifecycle. Not public connectivity, standard-user, automatic-update or full product qualification.",
+  "customer_msi_lifecycle": {
+    "passed": true,
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "package_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+    "guest": "SWAN-END-16",
+    "os": "Server 2016 Standard Evaluation Desktop Experience 14393.693 x64",
+    "run_as": "NT AUTHORITY\\SYSTEM",
+    "phases": [
+      "install",
+      "repair",
+      "uninstall"
+    ],
+    "installed_manifest_files": 96,
+    "scope": "Administrative customer company-lab-signed bare MSI reinstall after prior uninstall retained its cancellation marker, damaged-license repair and uninstall; all 96 payload hashes and installed publishers checked. Not enrollment, GUI, update or complete Windows qualification.",
+    "full_product_acceptance": false
+  }
+}
diff --git a/deployment/windows/da0c621-linux-company-two-machine-session-evidence.json b/deployment/windows/da0c621-linux-company-two-machine-session-evidence.json
new file mode 100644
index 00000000000..b9c7f082d9f
--- /dev/null
+++ b/deployment/windows/da0c621-linux-company-two-machine-session-evidence.json
@@ -0,0 +1,57 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "lab_only": true,
+  "passed_scope": [
+    "Separate Windows machines using an independently hosted Linux company server",
+    "Technician native MFA and group-authorized inventory",
+    "Attended grant claimed by receiving customer",
+    "Customer approval prompt and acceptance",
+    "Remote desktop video and remote mouse minimize verified on receiving console",
+    "Authorization lease renewed beyond initial expiry",
+    "Customer native Stop support disconnected technician and prevented reconnect"
+  ],
+  "technician_os": "Server 2025 26100.32230",
+  "customer_os": "Server 2019 17763.3650",
+  "transport_classification": "Successful private NAT lab session used company relay; matching receiver and relay UUID verified",
+  "customer_automatic_start_failed": true,
+  "automatic_start_failure": {
+    "events": [
+      7000,
+      7009
+    ],
+    "timeout_milliseconds": 30000,
+    "manual_recovery_succeeded": true,
+    "root_cause_confirmed": false
+  },
+  "session_server_closure_verified": false,
+  "unqualified": [
+    "Public Internet connectivity",
+    "Direct NAT traversal and separately forced relay coverage",
+    "Native unauthorized or wrong-company connection rejection",
+    "Active-session permission revocation and expired-lease termination",
+    "Keyboard clipboard transfer UAC logon screen and multiple monitors",
+    "Automatic updates",
+    "Reliable cold-boot service startup"
+  ],
+  "original_receipt_sha256": {
+    "native-two-machine-session-live.json": "a7c9a22e9130a08bedd2669ff3dbfa7da551c8ff908f69f2fba4f297f525f69d",
+    "native-two-machine-customer-stop.json": "8837876c3a4face09ee11b8ed4f344677c01b04f0a48deeff2afee05ad81945e",
+    "customer19-boot-timeout-record.json": "edec1845f1376f40eef0de225d2fe84640be44b5607f57fae201118352e73abe"
+  },
+  "full_product_acceptance": false,
+  "relay_evidence": {
+    "utc": "2026-10-27T00:53:44.328248+00:00",
+    "successful_session_used_relay": true,
+    "matching_receiver_and_relay_connection_id_verified": true,
+    "receiver_relay_time": "2026-10-27T00:43:22.379423Z",
+    "relay_pair_time": "2026-10-27T00:43:22.160426Z",
+    "native_video_service_time": "2026-10-27T00:43:37.906121Z",
+    "earlier_relay_handshake_failed_to_receive_public_key": true,
+    "direct_transport_qualified": false,
+    "public_internet_qualified": false,
+    "original_log_sha256": {
+      "customer19-native-session-server.private.log": "c61bdea45c8b25e86d461c66af128c09528c6f8f2617c08945fbd5a287a13546",
+      "native-session-hbbr.private.log": "30d78b79d0e94937b984750a7a11114dfc9107b532b3b1938fdd201267eab8c9"
+    }
+  }
+}
diff --git a/deployment/windows/da0c621-server19-fresh-msi-evidence.json b/deployment/windows/da0c621-server19-fresh-msi-evidence.json
new file mode 100644
index 00000000000..1c0371a81f0
--- /dev/null
+++ b/deployment/windows/da0c621-server19-fresh-msi-evidence.json
@@ -0,0 +1,264 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "customer": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "package_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+    "passed": true,
+    "phases": [
+      {
+        "phase": "install",
+        "exit_code": 0
+      },
+      {
+        "phase": "repair",
+        "exit_code": 0
+      },
+      {
+        "phase": "uninstall",
+        "exit_code": 0
+      }
+    ],
+    "actual_reboot_verified": true,
+    "service_automatically_restarted": true,
+    "installed_manifest_files": 96,
+    "os": {
+      "Caption": "Microsoft Windows Server 2019 Standard Evaluation",
+      "Version": "10.0.17763",
+      "BuildNumber": "17763",
+      "OSArchitecture": "64-bit",
+      "revision": 3650
+    },
+    "original_evidence_records": [
+      {
+        "sha256": "20eb044ba33bd8e302aac436adc2bfa4791434abc68a97de69c50a9468c382cf",
+        "name": "fresh-before-install.json",
+        "bytes": 346
+      },
+      {
+        "sha256": "a966ee27d175123f3ff78e7217df919806de649e7cde90a9b9c4688cdd913e9c",
+        "name": "transfer-manifest.json",
+        "bytes": 779
+      },
+      {
+        "sha256": "61ba432a068e1fb31ee1090f59e4256925f9a31735a387751a0b0955a27b8e04",
+        "name": "Run-InstallRepair.ps1",
+        "bytes": 4756
+      },
+      {
+        "sha256": "4429ee9fa887b00d0f5d370ba83a56ddd1ffac516fb1d5532bbef992e08c2864",
+        "name": "Verify-RebootUninstall-Utc.ps1",
+        "bytes": 3991
+      },
+      {
+        "sha256": "10cacf2be9e211dad0f9166114f159e1fb6b4d6f21144c420e676dae515c61b1",
+        "name": "installed-files.json",
+        "bytes": 14349
+      },
+      {
+        "sha256": "fdcc0e863bccc4bd5cba533a2a98d7091fd52e08e1e3135d1061b5cb07003dc4",
+        "name": "lifecycle-started.json",
+        "bytes": 736
+      },
+      {
+        "sha256": "cfe16fbf63f914cb12b46a02730fd53813de3b9d0cd2f7433e79fe5dc81b3412",
+        "name": "pre-reboot-boot.json",
+        "bytes": 55
+      },
+      {
+        "sha256": "ad1a04e61b1fe5afbef06db8764ae07c14f6fc3568f5387962a97d14a571ae4c",
+        "name": "pre-reboot-lifecycle.json",
+        "bytes": 1548
+      },
+      {
+        "sha256": "1ebb02545504b2f4649695552aaf87773d2ea9ae8d8a202281c8ff5b7844a2bd",
+        "name": "reboot-request.json",
+        "bytes": 304
+      },
+      {
+        "sha256": "a89210877ade5e740f6c173b60a6c4e792051f0ea2518eef88ed0682ff354761",
+        "name": "reboot-verification.json",
+        "bytes": 278
+      },
+      {
+        "sha256": "d2e5323a5a0e2e1f77bdfb84f6c2cb6d179f5194426ce1aaa81eb698ca6a4841",
+        "name": "post-reboot-service-original.json",
+        "bytes": 253
+      },
+      {
+        "sha256": "293a235f78429b83e958b2d1076fc78af287ff1efbb3883bc94c81af50171403",
+        "name": "post-reboot-lifecycle.json",
+        "bytes": 507
+      },
+      {
+        "sha256": "1fd5f97cc8a6a2170529227fcb24f64a23e09779b22bba6cdb17969fd8bc7ea2",
+        "name": "results/install/result.json",
+        "bytes": 1265
+      },
+      {
+        "sha256": "0480dec30cfd59ce9389c2e695efb9f7eebdc11059c5db527a48a8eb312468ed",
+        "name": "results/install/msi.log",
+        "bytes": 356012
+      },
+      {
+        "sha256": "b4b4decaad9c4142b250458168ab2fd66ff2baced0207b70b9687c51122aae5e",
+        "name": "results/repair/result.json",
+        "bytes": 1264
+      },
+      {
+        "sha256": "3d218038ade04eb09773781e4aadf6cffbb8780c7cd2a67cb8b74377cdef2c5c",
+        "name": "results/repair/msi.log",
+        "bytes": 403498
+      },
+      {
+        "sha256": "d4b4c1ccabb72a98184d6943eab82354540cde1e9cbb739d9fa6f13636d28eaa",
+        "name": "results/uninstall/result.json",
+        "bytes": 1267
+      },
+      {
+        "sha256": "354009478592e75a09b21de32beb560d3cf1cad35ddf96941d010096b0ebb346",
+        "name": "results/uninstall/msi.log",
+        "bytes": 272284
+      }
+    ],
+    "fresh_before_install": {
+      "build": "17763",
+      "technician_product_state": -1,
+      "installation_type": "Server",
+      "customer_product_state": -1,
+      "utc": "2026-10-26T16:28:31.3212963Z",
+      "company_management_started": false,
+      "revision": 3650,
+      "caption": "Microsoft Windows Server 2019 Standard Evaluation",
+      "fresh_vm": true
+    },
+    "scope": "Administrative lab-signed raw customer MSI on a newly created WindowsServer2019 Desktop Experience disk with absent customer and technician registrations before installation; real reboot and service verification. Not enrollment, sessions or automatic updates",
+    "full_product_acceptance": false
+  },
+  "technician": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "passed": true,
+    "edition": "technician",
+    "package_sha256": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3",
+    "administrative": true,
+    "phases": [
+      {
+        "passed": true,
+        "exit_code": 0,
+        "missing_file_repair": false,
+        "log_sha256": "66f7c9bff7b978860545a5983b9ab5f4c1e1da4ad9e85d5d2c833eda8b2bc8c4",
+        "phase": "install",
+        "result_sha256": "e0a2e4fd66e1e7cd9fa099accb0eb2a5098fa6e7622c2c79370883ee1c5ee245"
+      },
+      {
+        "passed": true,
+        "exit_code": 0,
+        "missing_file_repair": true,
+        "log_sha256": "ac63d397e3de860eb3ae8c996935d2ed78921ab1494e1fe7ba7d7ce1a4a15a0c",
+        "phase": "repair",
+        "result_sha256": "3d177540e692ec11cc408201de337bcaf64975f7b65ccb5a3c8e9268b684d689"
+      },
+      {
+        "passed": true,
+        "exit_code": 0,
+        "missing_file_repair": false,
+        "log_sha256": "a60c50b83b78b653a7bd5fe0e81742269c141ab4984f5e863aca60f4e8812eca",
+        "phase": "uninstall",
+        "result_sha256": "832842f46f9ce743261d96e8254676ab293a7001315792cec4a85628972cfb27"
+      }
+    ],
+    "os": {
+      "Caption": "Microsoft Windows Server 2019 Standard Evaluation",
+      "Version": "10.0.17763",
+      "BuildNumber": "17763",
+      "OSArchitecture": "64-bit",
+      "revision": 3650
+    },
+    "original_evidence_records": [
+      {
+        "sha256": "316bb962459e8cae87b884bb64ef2f1c6a14343ea38849e75e2362dbefda04b7",
+        "name": "transfer-manifest.json",
+        "bytes": 577
+      },
+      {
+        "sha256": "1eb6c2f66ba4ceb58a52026fc797bb9e35010b9b821c34ae77511d39ee855d28",
+        "name": "Run-Lifecycle.ps1",
+        "bytes": 4342
+      },
+      {
+        "sha256": "4a3e98464044e3511a38c6f917f01f63ff43c2b41253d52e0819bde22c313384",
+        "name": "Test-DisposableMsi.ps1",
+        "bytes": 11239
+      },
+      {
+        "sha256": "64b7144b38c8b963b98cbb96f9964395c9413ce1a1b614d10fd0d57484f7619e",
+        "name": "Get-MsiIdentity.ps1",
+        "bytes": 1035
+      },
+      {
+        "sha256": "845e8355e969b95b38b6ea83f4b89103fdc541aa088d95e2602f0d23005aa8ea",
+        "name": "Get-WindowsCompatibility.ps1",
+        "bytes": 1202
+      },
+      {
+        "sha256": "fb92a86dc385eae59c46a8abcb84ae7acf0ef32c5a87fb5178c0d45e0c6a59ee",
+        "name": "lifecycle-started.json",
+        "bytes": 736
+      },
+      {
+        "sha256": "b8e852b5573170fab53127a3fbdf16a2a0c93fb2de3a2dfc3c572a8ecf13db99",
+        "name": "lifecycle-result.json",
+        "bytes": 1941
+      },
+      {
+        "sha256": "e0a2e4fd66e1e7cd9fa099accb0eb2a5098fa6e7622c2c79370883ee1c5ee245",
+        "name": "results/install/result.json",
+        "bytes": 1267
+      },
+      {
+        "sha256": "66f7c9bff7b978860545a5983b9ab5f4c1e1da4ad9e85d5d2c833eda8b2bc8c4",
+        "name": "results/install/msi.log",
+        "bytes": 130814
+      },
+      {
+        "sha256": "3d177540e692ec11cc408201de337bcaf64975f7b65ccb5a3c8e9268b684d689",
+        "name": "results/repair/result.json",
+        "bytes": 1265
+      },
+      {
+        "sha256": "ac63d397e3de860eb3ae8c996935d2ed78921ab1494e1fe7ba7d7ce1a4a15a0c",
+        "name": "results/repair/msi.log",
+        "bytes": 102614
+      },
+      {
+        "sha256": "832842f46f9ce743261d96e8254676ab293a7001315792cec4a85628972cfb27",
+        "name": "results/uninstall/result.json",
+        "bytes": 1269
+      },
+      {
+        "sha256": "a60c50b83b78b653a7bd5fe0e81742269c141ab4984f5e863aca60f4e8812eca",
+        "name": "results/uninstall/msi.log",
+        "bytes": 94686
+      }
+    ],
+    "scope": "Raw lab-signed technician MSI first application context on newly created Server2019 VM after customer lifecycle testing; administrative install, missing-executable repair and uninstall. Not standard-user, login, sessions, software-version upgrade or approved automatic updates.",
+    "full_product_acceptance": false
+  },
+  "lab_bootstrap": {
+    "original_specialize_command_exit": 1,
+    "initial_lab_tools_absent": true,
+    "original_failure_cause_established": false,
+    "repair": "Manually ran the pinned seed bootstrap after reaching the administrative console; pinned SSH identity verified, automatic login disabled, and original setup diagnostics retained. This is a test-infrastructure repair, not a Swan installer workaround.",
+    "temporary_management_forward_removed": true,
+    "setup_media_detached_before_installers": true,
+    "no_swan_products_present_before_first_customer_install": true
+  },
+  "limitations": [
+    "Lab signing only; production signing not approved.",
+    "Raw MSI lifecycle, not generated company enrollment on this OS.",
+    "Technician uses administrative per-user context after customer lifecycle; not standard-user qualification.",
+    "No GUI login, remote sessions, public NAT traversal, grant enforcement, software-version upgrade or automatic update acceptance is established.",
+    "Company-approved test release metadata still targets Server2016 only.",
+    "Operating-system lab bootstrap required manual repair; this does not prove unattended OS provisioning."
+  ],
+  "full_product_acceptance": false
+}
diff --git a/deployment/windows/da0c621-server22-fresh-msi-evidence.json b/deployment/windows/da0c621-server22-fresh-msi-evidence.json
new file mode 100644
index 00000000000..3c5031b1fa5
--- /dev/null
+++ b/deployment/windows/da0c621-server22-fresh-msi-evidence.json
@@ -0,0 +1,263 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "customer": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "package_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+    "passed": true,
+    "phases": [
+      {
+        "phase": "install",
+        "exit_code": 0
+      },
+      {
+        "phase": "repair",
+        "exit_code": 0
+      },
+      {
+        "phase": "uninstall",
+        "exit_code": 0
+      }
+    ],
+    "actual_reboot_verified": true,
+    "service_automatically_restarted": true,
+    "installed_manifest_files": 96,
+    "os": {
+      "Caption": "Microsoft Windows Server 2022 Standard Evaluation",
+      "Version": "10.0.20348",
+      "BuildNumber": "20348",
+      "OSArchitecture": "64-bit",
+      "revision": 587
+    },
+    "original_evidence_records": [
+      {
+        "sha256": "602b9cbc9fc2ceb8f14c9c1dc95bb2a29a9bf0ce2015d703b3b90287a28ca243",
+        "name": "fresh-before-install.json",
+        "bytes": 345
+      },
+      {
+        "sha256": "b7ef7b3c6fbb6fb610aa9f571762679a81f4697f11e0e6241bd38594564b7b4d",
+        "name": "transfer-manifest.json",
+        "bytes": 779
+      },
+      {
+        "sha256": "9236e7ac1ed7980b1be4e86a91f8a5feac3879be363c6e2933d6482346de97ba",
+        "name": "Run-InstallRepair.ps1",
+        "bytes": 4756
+      },
+      {
+        "sha256": "6f90c6b2e303827a7dc2a8bd62fedadb353268dbce466275945150567b0f8a6e",
+        "name": "Verify-RebootUninstall-Utc.ps1",
+        "bytes": 3991
+      },
+      {
+        "sha256": "10cacf2be9e211dad0f9166114f159e1fb6b4d6f21144c420e676dae515c61b1",
+        "name": "installed-files.json",
+        "bytes": 14349
+      },
+      {
+        "sha256": "83a9e00e480bcb3de1bc07bed6b8122856a34db1131c54744dc6242f80e7b76a",
+        "name": "lifecycle-started.json",
+        "bytes": 736
+      },
+      {
+        "sha256": "e974d95899a1b275a9e473b8527a26580b6bb6929aff27365b8b0df6f8ec5881",
+        "name": "pre-reboot-boot.json",
+        "bytes": 55
+      },
+      {
+        "sha256": "580b5eeaed5ebe15e7674e0afe7c215dc4af5e66c45c47fd26565cb9fa29a1ca",
+        "name": "pre-reboot-lifecycle.json",
+        "bytes": 1548
+      },
+      {
+        "sha256": "028ce6e72b2f53f01773ee6feb377c4161ced835780c400682fe04bfcba7bffe",
+        "name": "reboot-request.json",
+        "bytes": 168
+      },
+      {
+        "sha256": "ca6b5a8c4bb139b1a3fac7eeb6bbf12c0c7b33396c0a872891c72aee169100b8",
+        "name": "reboot-verification.json",
+        "bytes": 278
+      },
+      {
+        "sha256": "ed7cc487711842e64c312f84336b1d48867dcbe6c77ba48517efa14a5da5074f",
+        "name": "post-reboot-service-original.json",
+        "bytes": 298
+      },
+      {
+        "sha256": "742d185d627d0c0d30389ac75792194adff447a23d146f9a3e9437fcaeeedea5",
+        "name": "post-reboot-lifecycle.json",
+        "bytes": 507
+      },
+      {
+        "sha256": "4049372b611051de750089ba9e496d842f6f2a3326e12d59a9c659d17638eb54",
+        "name": "results/install/result.json",
+        "bytes": 1264
+      },
+      {
+        "sha256": "70d1ddb17621f08481ed2a2b4b9a827dcc3939de14b5a6987708426931410d0d",
+        "name": "results/install/msi.log",
+        "bytes": 355690
+      },
+      {
+        "sha256": "9a33a0778d7d01adb2d98bc0819a493e5cc15e602c13dda24ed53aa9da0e73f6",
+        "name": "results/repair/result.json",
+        "bytes": 1263
+      },
+      {
+        "sha256": "08ba2da25ec4f9e51d8cc43e9e48bd04ec47007dabe6d2d3e70b6550be317ca2",
+        "name": "results/repair/msi.log",
+        "bytes": 403432
+      },
+      {
+        "sha256": "e128a6dddb2928083f5e2114c81565ea1eec2842866ae5fa4b9e54e6b5b6b694",
+        "name": "results/uninstall/result.json",
+        "bytes": 1266
+      },
+      {
+        "sha256": "0c64112cc8f870143161ff4e7ff931e2656e1a7fc2797502b94db44a418df5a8",
+        "name": "results/uninstall/msi.log",
+        "bytes": 271966
+      }
+    ],
+    "fresh_before_install": {
+      "build": "20348",
+      "technician_product_state": -1,
+      "installation_type": "Server",
+      "customer_product_state": -1,
+      "utc": "2026-10-24T04:11:09.8944267Z",
+      "company_management_started": false,
+      "revision": 587,
+      "caption": "Microsoft Windows Server 2022 Standard Evaluation",
+      "fresh_vm": true
+    },
+    "scope": "Administrative lab-signed raw customer MSI on a newly created WindowsServer2022 Desktop Experience disk with absent customer and technician registrations before installation; real reboot and service verification. Not enrollment, sessions or automatic updates",
+    "full_product_acceptance": false
+  },
+  "technician": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "passed": true,
+    "edition": "technician",
+    "package_sha256": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3",
+    "administrative": true,
+    "phases": [
+      {
+        "passed": true,
+        "exit_code": 0,
+        "missing_file_repair": false,
+        "log_sha256": "c46e1a6d7bb480ae4c3743404d02628545652082631f8e772ff77afe22df60d1",
+        "phase": "install",
+        "result_sha256": "2d3efa80eedb8dde3dc2e85356d12f08da036536a597cb9f79d50d063ac73e00"
+      },
+      {
+        "passed": true,
+        "exit_code": 0,
+        "missing_file_repair": true,
+        "log_sha256": "37f028d00277de3170bbb356bedcdb37abc8bdae0c5a6aabb31ced412b425e37",
+        "phase": "repair",
+        "result_sha256": "93e68b654861898fb8de4e588e647716463ad680dc705d0b10f274f08f44fbb1"
+      },
+      {
+        "passed": true,
+        "exit_code": 0,
+        "missing_file_repair": false,
+        "log_sha256": "28b570ec714667fa4cc3389a783dbea0e98d74e2230f39163b6f3d96361a7b61",
+        "phase": "uninstall",
+        "result_sha256": "c515ee1e0d62f5099f71f43cf7ce56f957507d71063b02db852e14a7c3f1e065"
+      }
+    ],
+    "os": {
+      "Caption": "Microsoft Windows Server 2022 Standard Evaluation",
+      "Version": "10.0.20348",
+      "BuildNumber": "20348",
+      "OSArchitecture": "64-bit",
+      "revision": 587
+    },
+    "original_evidence_records": [
+      {
+        "sha256": "43a6b84c0238d694d950ae7ee3821625566a5c1e7e97f652b5e87d6b2e1c396b",
+        "name": "transfer-manifest.json",
+        "bytes": 577
+      },
+      {
+        "sha256": "ddf36b1a32155674a08468ca23540543965ac6a2f48418eaed0fbe86c2391e00",
+        "name": "Run-Lifecycle.ps1",
+        "bytes": 4342
+      },
+      {
+        "sha256": "4a3e98464044e3511a38c6f917f01f63ff43c2b41253d52e0819bde22c313384",
+        "name": "Test-DisposableMsi.ps1",
+        "bytes": 11239
+      },
+      {
+        "sha256": "64b7144b38c8b963b98cbb96f9964395c9413ce1a1b614d10fd0d57484f7619e",
+        "name": "Get-MsiIdentity.ps1",
+        "bytes": 1035
+      },
+      {
+        "sha256": "845e8355e969b95b38b6ea83f4b89103fdc541aa088d95e2602f0d23005aa8ea",
+        "name": "Get-WindowsCompatibility.ps1",
+        "bytes": 1202
+      },
+      {
+        "sha256": "2046b844c618e0ed1bdf7e790c3ee8f1e83745e6ad233a1288ed5f314fea10aa",
+        "name": "lifecycle-started.json",
+        "bytes": 736
+      },
+      {
+        "sha256": "929d198fd3c9f715715a1fcac713c08670453bedaaf322b1adfe56bf51e3ac54",
+        "name": "lifecycle-result.json",
+        "bytes": 1941
+      },
+      {
+        "sha256": "2d3efa80eedb8dde3dc2e85356d12f08da036536a597cb9f79d50d063ac73e00",
+        "name": "results/install/result.json",
+        "bytes": 1266
+      },
+      {
+        "sha256": "c46e1a6d7bb480ae4c3743404d02628545652082631f8e772ff77afe22df60d1",
+        "name": "results/install/msi.log",
+        "bytes": 130222
+      },
+      {
+        "sha256": "93e68b654861898fb8de4e588e647716463ad680dc705d0b10f274f08f44fbb1",
+        "name": "results/repair/result.json",
+        "bytes": 1264
+      },
+      {
+        "sha256": "37f028d00277de3170bbb356bedcdb37abc8bdae0c5a6aabb31ced412b425e37",
+        "name": "results/repair/msi.log",
+        "bytes": 102348
+      },
+      {
+        "sha256": "c515ee1e0d62f5099f71f43cf7ce56f957507d71063b02db852e14a7c3f1e065",
+        "name": "results/uninstall/result.json",
+        "bytes": 1268
+      },
+      {
+        "sha256": "28b570ec714667fa4cc3389a783dbea0e98d74e2230f39163b6f3d96361a7b61",
+        "name": "results/uninstall/msi.log",
+        "bytes": 94424
+      }
+    ],
+    "scope": "Raw lab-signed technician MSI first application context on newly created Server2022 VM after customer lifecycle testing; administrative install, missing-executable repair and uninstall. Not standard-user, login, sessions, software-version upgrade or approved automatic updates.",
+    "full_product_acceptance": false
+  },
+  "lab_bootstrap": {
+    "initial_ssh_start_failed": true,
+    "cause_verified": "Copied SSH host key retained Authenticated Users read access; sshd -t rejected the key and reported no available hostkeys.",
+    "repair_verified": "Both lab access files now have protected Administrator/SYSTEM-only ACLs; original key bytes and pinned SSH identity were preserved. SSH startup and connection verified.",
+    "temporary_management_forward_removed": true,
+    "setup_media_detached_before_installers": true,
+    "initial_attempt_before_msi": "Lab root certificate import succeeded; optional TrustedPublisher store import returned access denied. No MSI ran in that attempt. Subsequent run used existing root trust, valid Authenticode signatures and explicit publisher checks, without retrying the denied store operation.",
+    "future_local_seed_generator_corrected": true
+  },
+  "limitations": [
+    "Lab signing only; production signing not approved.",
+    "Raw MSI lifecycle, not generated company enrollment on this OS.",
+    "Technician uses administrative per-user context after customer lifecycle; not a second untouched OS installation or a standard-user test.",
+    "No GUI login, remote desktop, public NAT traversal, grant enforcement or automatic update acceptance is established by these MSI checks.",
+    "Company-approved test release metadata still targets Server2016 only."
+  ],
+  "full_product_acceptance": false
+}
diff --git a/deployment/windows/da0c621-server22-standard-batch-failure.json b/deployment/windows/da0c621-server22-standard-batch-failure.json
new file mode 100644
index 00000000000..a46b04c2973
--- /dev/null
+++ b/deployment/windows/da0c621-server22-standard-batch-failure.json
@@ -0,0 +1,104 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "passed": false,
+  "edition": "technician",
+  "phase": "install",
+  "msi_exit": 1601,
+  "windows_installer_server_connection_error": "0x80070005",
+  "standard_user_token_verified": true,
+  "loaded_user_profile_verified": true,
+  "execution_context": "Password-backed Windows scheduled batch task; interactive desktop test still required",
+  "os": {
+    "Caption": "Microsoft Windows Server 2022 Standard Evaluation",
+    "Version": "10.0.20348",
+    "BuildNumber": "20348",
+    "OSArchitecture": "64-bit",
+    "revision": 587
+  },
+  "temporary_batch_right_restored": true,
+  "tasks_disabled": true,
+  "scope": "Failed standard-user batch-context raw MSI test; no installation, repair, uninstall, company login or full standard-user acceptance established. Root cause of Windows Installer connection denial is not established.",
+  "original_evidence_records": [
+    {
+      "sha256": "7d74124d136c5f9c3ae1c0f22ce721225fc4a56605059de35aecdaa1562b009e",
+      "name": "transfer-manifest.json",
+      "bytes": 577
+    },
+    {
+      "sha256": "a2cb9fba0a11e4d2a6cac35797fce85ae5b76e93b29989e4bbdc4788b38462fe",
+      "name": "Run-Lifecycle.ps1",
+      "bytes": 4469
+    },
+    {
+      "sha256": "4a3e98464044e3511a38c6f917f01f63ff43c2b41253d52e0819bde22c313384",
+      "name": "Test-DisposableMsi.ps1",
+      "bytes": 11239
+    },
+    {
+      "sha256": "64b7144b38c8b963b98cbb96f9964395c9413ce1a1b614d10fd0d57484f7619e",
+      "name": "Get-MsiIdentity.ps1",
+      "bytes": 1035
+    },
+    {
+      "sha256": "845e8355e969b95b38b6ea83f4b89103fdc541aa088d95e2602f0d23005aa8ea",
+      "name": "Get-WindowsCompatibility.ps1",
+      "bytes": 1202
+    },
+    {
+      "sha256": "df79dd9d6d05d1a9489d3458e534aa8d70aaa5bda511a48a62110c89012789ca",
+      "name": "lifecycle-started.json",
+      "bytes": 740
+    },
+    {
+      "sha256": "a15c7be2cf4b83b0a438a4e79f5467c1d5c5f3128919ca3fbc9610748156452d",
+      "name": "lifecycle-result.json",
+      "bytes": 200
+    },
+    {
+      "sha256": "945f0e73902975b3da6abfa5df6d34b9a305be9a514b517f7ae235c45714d24a",
+      "name": "results/install/result.json",
+      "bytes": 1270
+    },
+    {
+      "sha256": "5cd1b4c215bb8f47cd4ee001101e593c8fa9aaf68ff4b9215b509280018b3de9",
+      "name": "results/install/msi.log",
+      "bytes": 2072
+    },
+    {
+      "sha256": "e19d9d161641175fc573c45765d39cbfbf5be5581b9a46ae65b7f0d93219bfc7",
+      "name": "batch-right-temporary.json",
+      "bytes": 238
+    },
+    {
+      "sha256": "c536c92f35f74aadd948ea8bf488f2319b964ad0e8a972a59df53c314a503e7e",
+      "name": "batch-right-restored.json",
+      "bytes": 175
+    },
+    {
+      "sha256": "833b591ce042f92fc9a4d38f2e4f1e8f07a17509625528b1372f633d040c8ec9",
+      "name": "password-task-original.xml",
+      "bytes": 1313
+    },
+    {
+      "sha256": "1edfa7a544599157ddf1ce3fc4959ae90202d5d6bf2c0dc6833367394743e882",
+      "name": "direct-driver-started.json",
+      "bytes": 147
+    },
+    {
+      "sha256": "772ae3d3b13109edfe4df3ab09c119feb2fbf9aee12edba8875e44a67cefa384",
+      "name": "direct-driver-exit.json",
+      "bytes": 77
+    },
+    {
+      "sha256": "9bcdc5177ce8e6b95f037347465f5df97508b985a893ab3b3c4b565aa3d77a2c",
+      "name": "logged-standard-execution.json",
+      "bytes": 400
+    },
+    {
+      "sha256": "7e2b1ae93d123ca40e2be825977e6fa1d7a341eda33dbf04ad9f0fec684e0f6a",
+      "name": "failure-task-state-original.json",
+      "bytes": 212
+    }
+  ],
+  "full_product_acceptance": false
+}
diff --git a/deployment/windows/da0c621-server25-company-technician-evidence.json b/deployment/windows/da0c621-server25-company-technician-evidence.json
new file mode 100644
index 00000000000..e0c1175a96e
--- /dev/null
+++ b/deployment/windows/da0c621-server25-company-technician-evidence.json
@@ -0,0 +1,63 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "server_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "os": "Windows Server 2025 Standard Evaluation Desktop Experience x64 26100.32230",
+  "lab_only": true,
+  "worker": {
+    "authenticated_outbound_build_completed": true,
+    "local_system_service": true,
+    "protected_artifact_matches_server": true,
+    "credential_and_registry_acl_protected": true
+  },
+  "distribution": {
+    "edition": "technician",
+    "release_sequence": 3,
+    "bundle_sha256": "e11e2fbd44a0e16d3e0e01f7b47a5b71093f1b4650d3301bc7a22a3a9c81afb2",
+    "authenticated_download_passed": true,
+    "anonymous_download_rejected": true,
+    "project_signed_production_release": false
+  },
+  "installation": {
+    "release_sequence": 3,
+    "current_branding_received": true,
+    "native_session_tested": false,
+    "utc": "2026-10-27T00:21:43.8359528Z",
+    "company_identity_matches": true,
+    "no_device_token_in_technician_state": true,
+    "edition": "technician",
+    "installed_signature_valid": true,
+    "pending_install_absent": true,
+    "technician_login_tested": false,
+    "standard_user_qualified": false,
+    "profile_revision": 5
+  },
+  "native_login": {
+    "utc": "2026-10-27T00:30:40.560673+00:00",
+    "os": "Windows Server 2025 x64 build 26100.32230",
+    "generated_technician_bundle_installed": true,
+    "release_sequence": 3,
+    "original_verified_launcher_used": true,
+    "actual_desktop_session": 1,
+    "company_branding_and_https_visible": true,
+    "gui_mfa_sign_in_succeeded": true,
+    "authorized_device_and_group_visible": true,
+    "session_history_visible": true,
+    "independent_login_audit_matches": true,
+    "native_remote_session_exercised": false,
+    "standard_user_install_qualified": false
+  },
+  "full_product_acceptance": false,
+  "remaining": [
+    "Separate-machine native sessions and receiver authorization",
+    "Standard-user installation",
+    "Software-version upgrade and automatic rollout",
+    "Public Internet transport",
+    "Production signing"
+  ],
+  "original_receipt_sha256": {
+    "worker25-authenticated-build-verified.json": "64fc22a801e9dd646a9ec1b0b6f918ccdd4bcf9a4fcd92354d96631d79a31de4",
+    "server25-technician-bundle-verified.json": "35b6cdd323a6529506a9369d042b87845e5b16557704d0ad78d3942f87888c5e",
+    "server25-technician-original-setup-result.json": "647b9de0f5a9f1e7551afff45347233da3425e584803091ea4f648d04336112f",
+    "native-technician25-login-verified.json": "037379f2ffbb7a4fef96b97ac8d4eca89053b1bf02fafeaf11e22e81691f9bce"
+  }
+}
diff --git a/deployment/windows/da0c621-server25-customer-msi-evidence.json b/deployment/windows/da0c621-server25-customer-msi-evidence.json
new file mode 100644
index 00000000000..27f6d9dcf78
--- /dev/null
+++ b/deployment/windows/da0c621-server25-customer-msi-evidence.json
@@ -0,0 +1,134 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "package_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+  "passed": true,
+  "phases": [
+    {
+      "phase": "install",
+      "exit_code": 0
+    },
+    {
+      "phase": "repair",
+      "exit_code": 0
+    },
+    {
+      "phase": "uninstall",
+      "exit_code": 0
+    }
+  ],
+  "actual_reboot_verified": true,
+  "service_automatically_restarted": true,
+  "installed_manifest_files": 96,
+  "os": {
+    "Caption": "Microsoft Windows Server 2025 Standard Evaluation",
+    "Version": "10.0.26100",
+    "BuildNumber": "26100",
+    "OSArchitecture": "64-bit",
+    "revision": 32230
+  },
+  "original_evidence_records": [
+    {
+      "sha256": "6ab1ac12187ea87007a43efeead92a9329a77723d738b3939e11f3d50092ef52",
+      "name": "fresh-before-install.json",
+      "bytes": 347
+    },
+    {
+      "sha256": "a867e0ac76a19a4f9f959c468ff4afddc7b45eefceb94f1a571ef65221e9383f",
+      "name": "transfer-manifest.json",
+      "bytes": 779
+    },
+    {
+      "sha256": "076cb43c0ee9b9a42289046606381f3bf67d6c0bc0aea37195889baf4e78e12e",
+      "name": "Run-InstallRepair.ps1",
+      "bytes": 4756
+    },
+    {
+      "sha256": "ace4af7c97cbd0c6ebcbba3d80d6c3787a4a9dd82e07fd2090bb5f2a207c97c5",
+      "name": "Verify-RebootUninstall-Utc.ps1",
+      "bytes": 3991
+    },
+    {
+      "sha256": "10cacf2be9e211dad0f9166114f159e1fb6b4d6f21144c420e676dae515c61b1",
+      "name": "installed-files.json",
+      "bytes": 14349
+    },
+    {
+      "sha256": "3eb22aac15264b3b551d3dad3cdd85c45063d9a0cab67919758f758d7c395eff",
+      "name": "lifecycle-started.json",
+      "bytes": 733
+    },
+    {
+      "sha256": "c3e90634c8814705f8719b9ab5020492b2d305a59da754ce745ca9bb5bf88406",
+      "name": "pre-reboot-boot.json",
+      "bytes": 55
+    },
+    {
+      "sha256": "3952c089bfc6df0f98ca691e291ef1bf7e5906ea9c3a6a76ba5746aa4cae381d",
+      "name": "pre-reboot-lifecycle.json",
+      "bytes": 1548
+    },
+    {
+      "sha256": "d51d19583e6b6e2706f020090a52521ce75bf0fc709be8872160bc29a116063c",
+      "name": "reboot-request.json",
+      "bytes": 256
+    },
+    {
+      "sha256": "a0d0226fe33efcf27d444cf168d54cd3bae9c2298feb7a7a967568e128bed398",
+      "name": "reboot-verification.json",
+      "bytes": 278
+    },
+    {
+      "sha256": "a3cac8b796328c72e2bf6e65572523967e2db3d1567290fc016a7edd51355662",
+      "name": "post-reboot-service-original.json",
+      "bytes": 228
+    },
+    {
+      "sha256": "946ea8354bc9d82c15fa8bcf6803ab11c76b3c13333651c48cebaad449e79fef",
+      "name": "post-reboot-lifecycle.json",
+      "bytes": 507
+    },
+    {
+      "sha256": "1dd25500820e4c45da54284afec6e0cb62bea48d0b47806be08a409baa881dc8",
+      "name": "results/install/result.json",
+      "bytes": 1266
+    },
+    {
+      "sha256": "f012f39618fec973c443caa5423debc5aa74ffe1ce6d6ef616660032e676dddc",
+      "name": "results/install/msi.log",
+      "bytes": 355808
+    },
+    {
+      "sha256": "8bb62df50036772c33500c71e1594abc90e60a9a60e62300cdfbb8be0306d912",
+      "name": "results/repair/result.json",
+      "bytes": 1265
+    },
+    {
+      "sha256": "1c6e5b130761cf33606971c49cb04e3f5067c29f2a51b3a1bda2cb0cc492e80a",
+      "name": "results/repair/msi.log",
+      "bytes": 403734
+    },
+    {
+      "sha256": "c8d2d79a56937b143a254f2741827706c06623333ce05560ae705d9467b155e0",
+      "name": "results/uninstall/result.json",
+      "bytes": 1268
+    },
+    {
+      "sha256": "67db7989812e2f85b5fcab780176124fde581d145818e4978423e0e688f65708",
+      "name": "results/uninstall/msi.log",
+      "bytes": 272270
+    }
+  ],
+  "full_product_acceptance": false,
+  "logon_context": "Local administrator S4U tasks, highest privileges, session 0; no account password supplied to task registration",
+  "fresh_machine_scope": "New Server 2025 Standard Evaluation Desktop Experience VM; product registrations absent before the test sequence; technician lifecycle completed before customer testing",
+  "lab_signatures_only": true,
+  "post_reboot_task_disabled_after_one_run": true,
+  "automatic_service_identity": "LocalSystem",
+  "service_started_manually": false,
+  "limitations": [
+    "Not standard-user installation",
+    "Not managed enrollment or native support sessions",
+    "Service startup does not qualify remote logon-screen access",
+    "Not software-version upgrade or approved automatic updates"
+  ]
+}
diff --git a/deployment/windows/da0c621-server25-technician-msi-evidence.json b/deployment/windows/da0c621-server25-technician-msi-evidence.json
new file mode 100644
index 00000000000..7ca31abd8d0
--- /dev/null
+++ b/deployment/windows/da0c621-server25-technician-msi-evidence.json
@@ -0,0 +1,117 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "passed": true,
+  "edition": "technician",
+  "package_sha256": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3",
+  "administrative": true,
+  "phases": [
+    {
+      "passed": true,
+      "exit_code": 0,
+      "missing_file_repair": false,
+      "log_sha256": "220fbac1ec4561704c2fc0ed5e4012f9b4a0b9d672bdc206739671013b977cb5",
+      "phase": "install",
+      "result_sha256": "eda5109fbc043b31e4030ff8d70e5455062dec4019e608fb6767f9eee96983ad"
+    },
+    {
+      "passed": true,
+      "exit_code": 0,
+      "missing_file_repair": true,
+      "log_sha256": "7d97ca8b656f3c3a012bdb8681c23d401581a60732bc6562d8e941332d737f9c",
+      "phase": "repair",
+      "result_sha256": "13421809e1add5fd015a97dff0732887461786714c9ccaa7039797f71b5a59d6"
+    },
+    {
+      "passed": true,
+      "exit_code": 0,
+      "missing_file_repair": false,
+      "log_sha256": "1e6ce35a2e1866b2fbbaaacc7fda4f8fa1b07f4c4a1ec34ae2a4c25ceba3295b",
+      "phase": "uninstall",
+      "result_sha256": "c67c68ffe8a4a324770e2a8bc3de2fdd6dc714b45b434b3c6d31f5dd39cf261a"
+    }
+  ],
+  "os": {
+    "Caption": "Microsoft Windows Server 2025 Standard Evaluation",
+    "Version": "10.0.26100",
+    "BuildNumber": "26100",
+    "OSArchitecture": "64-bit",
+    "revision": 32230
+  },
+  "original_evidence_records": [
+    {
+      "sha256": "1ab1cb74664f0748c107780146c4cbcdcfdd7a3ab66b5e56992b571e2b3523b0",
+      "name": "transfer-manifest.json",
+      "bytes": 577
+    },
+    {
+      "sha256": "c4cd6515bdff6f11c87cdd65c9aabcfd7e66de8b0979de4f6634085bc79188f9",
+      "name": "Run-Lifecycle.ps1",
+      "bytes": 4342
+    },
+    {
+      "sha256": "4a3e98464044e3511a38c6f917f01f63ff43c2b41253d52e0819bde22c313384",
+      "name": "Test-DisposableMsi.ps1",
+      "bytes": 11239
+    },
+    {
+      "sha256": "64b7144b38c8b963b98cbb96f9964395c9413ce1a1b614d10fd0d57484f7619e",
+      "name": "Get-MsiIdentity.ps1",
+      "bytes": 1035
+    },
+    {
+      "sha256": "845e8355e969b95b38b6ea83f4b89103fdc541aa088d95e2602f0d23005aa8ea",
+      "name": "Get-WindowsCompatibility.ps1",
+      "bytes": 1202
+    },
+    {
+      "sha256": "82b2137605fbb68a2de954b7222600dd628fec89ee22b0fe1b79d1088f996063",
+      "name": "lifecycle-started.json",
+      "bytes": 733
+    },
+    {
+      "sha256": "4c538e89323888418e93697161b37a59197eeb83c154d6cd5493770890d0c12c",
+      "name": "lifecycle-result.json",
+      "bytes": 1941
+    },
+    {
+      "sha256": "eda5109fbc043b31e4030ff8d70e5455062dec4019e608fb6767f9eee96983ad",
+      "name": "results/install/result.json",
+      "bytes": 1268
+    },
+    {
+      "sha256": "220fbac1ec4561704c2fc0ed5e4012f9b4a0b9d672bdc206739671013b977cb5",
+      "name": "results/install/msi.log",
+      "bytes": 130456
+    },
+    {
+      "sha256": "13421809e1add5fd015a97dff0732887461786714c9ccaa7039797f71b5a59d6",
+      "name": "results/repair/result.json",
+      "bytes": 1266
+    },
+    {
+      "sha256": "7d97ca8b656f3c3a012bdb8681c23d401581a60732bc6562d8e941332d737f9c",
+      "name": "results/repair/msi.log",
+      "bytes": 102768
+    },
+    {
+      "sha256": "c67c68ffe8a4a324770e2a8bc3de2fdd6dc714b45b434b3c6d31f5dd39cf261a",
+      "name": "results/uninstall/result.json",
+      "bytes": 1270
+    },
+    {
+      "sha256": "1e6ce35a2e1866b2fbbaaacc7fda4f8fa1b07f4c4a1ec34ae2a4c25ceba3295b",
+      "name": "results/uninstall/msi.log",
+      "bytes": 94658
+    }
+  ],
+  "full_product_acceptance": false,
+  "logon_context": "Local administrator S4U task, highest privileges, session 0; no account password supplied to task registration",
+  "application_context": "First Swan application installation context on a newly created Server 2025 Standard Evaluation Desktop Experience VM; technician tested before customer edition",
+  "lab_signatures_only": true,
+  "limitations": [
+    "Not standard-user installation",
+    "Not technician login or native session acceptance",
+    "Not software-version upgrade or approved automatic updates",
+    "Customer reboot lifecycle remains separate"
+  ]
+}
diff --git a/deployment/windows/da0c621-win10-bounded-evidence.json b/deployment/windows/da0c621-win10-bounded-evidence.json
new file mode 100644
index 00000000000..8a5002c2d0a
--- /dev/null
+++ b/deployment/windows/da0c621-win10-bounded-evidence.json
@@ -0,0 +1,71 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "bounded_customer_msi_result": {
+    "source": "da0c621845057bed321a98a1886ef15891e431a9",
+    "package_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+    "passed": true,
+    "phases": [
+      {
+        "phase": "install",
+        "exit_code": 0
+      },
+      {
+        "phase": "repair",
+        "exit_code": 0
+      },
+      {
+        "phase": "uninstall",
+        "exit_code": 0
+      }
+    ],
+    "actual_reboot_verified": true,
+    "service_automatically_restarted": true,
+    "installed_manifest_files": 96,
+    "os": {
+      "Caption": "Microsoft Windows 10 Pro",
+      "Version": "10.0.19045",
+      "BuildNumber": "19045",
+      "OSArchitecture": "64-bit",
+      "revision": 3803
+    },
+    "scope": "Administrative lab-signed raw MSI on existing Windows10 Pro disk, real reboot and service verification; not enrollment, sessions, automatic updates or fresh-disk qualification",
+    "full_product_acceptance": false
+  },
+  "test_driver_corrections": {
+    "utc_vs_local_datetime_guard_fixed": true,
+    "powershell5_array_enumeration_fixed": true,
+    "original_failed_guard_preserved": true,
+    "no_extra_reboot_or_installation_to_fix_guard": true
+  },
+  "later_lab_runtime_concern": {
+    "console_black_and_ssh_winrm_unresponsive": true,
+    "qemu_remained_running": true,
+    "acpi_powerdown_did_not_stop_guest": true,
+    "forced_vm_stop_recorded": true,
+    "after_forced_stop_container_check_errors": 0,
+    "guest_recovered_after_cold_start": true,
+    "disk_retry_event_153_observed": true,
+    "cause_established": false,
+    "subsequent_guest_shutdown_completed": true,
+    "full_windows10_qualification": false
+  },
+  "lab_credential_incident": {
+    "legacy_private_test_password_displayed": true,
+    "literal_removed_from_legacy_helper": true,
+    "replacement_not_displayed": true,
+    "password_reset_not_completed": true,
+    "reset_and_private_file_cleanup_rejected_by_automatic_review": "blocked by policy",
+    "explicit_approval_requested": true,
+    "affected_vm_offline": true,
+    "private_transfer_file_retained_in_administrator_system_only_directory": true
+  },
+  "restoration": {
+    "original_endpoint_reachable": true,
+    "company_services_and_customer_pid_preserved": true,
+    "company_https_binding_unchanged": true,
+    "updates_remain_paused": true,
+    "host_rustdesk_services_not_changed": true
+  },
+  "production_approved": false,
+  "full_product_acceptance": false
+}
diff --git a/deployment/windows/da0c621-win10-company-customer-evidence.json b/deployment/windows/da0c621-win10-company-customer-evidence.json
new file mode 100644
index 00000000000..5c6af76c146
--- /dev/null
+++ b/deployment/windows/da0c621-win10-company-customer-evidence.json
@@ -0,0 +1,93 @@
+{
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "test_only": true,
+  "production_publication": false,
+  "bundle_sha256": "65da4aa12d9934de118a0f1df73b92eb2c5e79e84349736f4661911ad5d3dfb0",
+  "public_customer_download_status": 200,
+  "bootstrap_public_fields_only": true,
+  "profile_and_release_signatures_verified": true,
+  "exact_bundled_source_texts_verified": 7,
+  "installer_sha256": "c53626be8ed32f4678d1c7cc1a4b88ca53a07a86f94d36e94b61e68d5f9f06a2",
+  "installed_executable_sha256": "ec9ce7e5b475ef64a19d08fca3bd843f2b2540d0206e416c87055012f4c2ab59",
+  "agent_sha256": "c7bfac26344a8f46aa2238b631e3be25785eaaeb5fd721cbf844c438be4d6206",
+  "installed_state": {
+    "consent_revision": 0,
+    "utc": "2026-10-27T05:56:02.7460549Z",
+    "profile_revision": 5,
+    "credential_disclosed": false,
+    "release_sequence": 4,
+    "customer_service_running": true,
+    "unattended_consent": false,
+    "automatic_local_system_service": true,
+    "manual_server_address_edit": false,
+    "tailscale_service_absent": true,
+    "os": {
+      "caption": "Microsoft Windows 10 Pro",
+      "architecture": "64-bit",
+      "build": "19045",
+      "version": "10.0.19045"
+    },
+    "pending_install_absent": true,
+    "installed_hashes_and_publishers_verified": true,
+    "device_token_present": true
+  },
+  "authorization": {
+    "utc": "2026-10-27T05:57:49.302574+00:00",
+    "unique_fresh_native_enrollment": true,
+    "pending_device_inventory_hidden": true,
+    "pending_device_grant_status": 403,
+    "explicit_company_approval_verified": true,
+    "authorized_group_inventory_visible": true,
+    "unassigned_inventory_hidden": true,
+    "unassigned_grant_status": 403,
+    "unattended_without_consent_status": 403,
+    "unattended_consent_remains_false": true,
+    "existing_server19_device_record_unchanged": true,
+    "automatic_updates_paused": true,
+    "native_session_tested": false,
+    "no_successful_grant_created_by_this_test": true,
+    "production_publication": false
+  },
+  "original_setup_records": [
+    {
+      "sha256": "eba9bfcc61a017f4dd3a6d66533d308421e544df77e47354de7c274a6907865b",
+      "name": "setup-start.json",
+      "bytes": 174
+    },
+    {
+      "sha256": "b9c8f984e1dbb10cc3d85148335ef9341f8eae96e44beeb46a5e36cbfbd7868f",
+      "name": "setup-result.json",
+      "bytes": 530
+    },
+    {
+      "sha256": "30682401c1f1c0ed26af27b889cd895463c7af076b39b04c1059bad3c5bedb4c",
+      "name": "private-lab-network-preparation.json",
+      "bytes": 380
+    },
+    {
+      "sha256": "03f561f75170d7787ba280b464f7b7e1ab5a8cf75e358daaa4664980201c2e0c",
+      "name": "idle-msi-preflight.json",
+      "bytes": 230
+    },
+    {
+      "sha256": "aeea8f1742fe99667993a9b89a029912c94904cf33a0fe9c6b82574eadd7d448",
+      "name": "Install-GeneratedWin10Customer.ps1",
+      "bytes": 4976
+    }
+  ],
+  "private_lab_dns_and_public_ca_provisioned": true,
+  "tls_verification_disabled": false,
+  "limitations": [
+    "Standard Microsoft Windows 10 Pro 22H2 x64 VM; no licensed-evaluation or production-activation claim.",
+    "This uses the existing signed 1.5.1 baseline. It does not qualify 1.5.2 installation or upgrades.",
+    "Private laboratory name resolution and public CA trust were provisioned separately; public Internet hosting is unproven.",
+    "Approval and negative grant results are management API checks; no native Windows 10 support session is claimed.",
+    "Cold reboot, customer repair/uninstall, standard-user behavior and desktop features remain separate tests."
+  ],
+  "retained_preflight_failures": [
+    "An overbroad guard refused an idle Windows Installer service before creating setup state.",
+    "A later guard path-regex error also stopped before setup.",
+    "The successful preflight accepted only the exact idle service command, required available service stop control and an unowned execute mutex; no service or installer was stopped."
+  ]
+}
diff --git a/deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json b/deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json
new file mode 100644
index 00000000000..a70bcd3d8b9
--- /dev/null
+++ b/deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json
@@ -0,0 +1,125 @@
+{
+  "source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "passed": true,
+  "edition": "technician",
+  "package_sha256": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3",
+  "administrative": true,
+  "phases": [
+    {
+      "passed": true,
+      "exit_code": 0,
+      "missing_file_repair": false,
+      "log_sha256": "22ad4b9077121512bfb17f2a04d7c3f3a5046e1557508fc20ca5dce8ae0b7d74",
+      "phase": "install",
+      "result_sha256": "c3cc04868e9f9c300855b34a23d09688039ffbd3dfe93b89d4679773b6c79b48"
+    },
+    {
+      "passed": true,
+      "exit_code": 0,
+      "missing_file_repair": true,
+      "log_sha256": "ddf11ca5d4eaa339d4dd2823670d9c7a0918a999e042e4771c52579d3243791f",
+      "phase": "repair",
+      "result_sha256": "9cbcae649a1b7ad13b8230dcd48172ff7f7395beab3e150b972e8b89782cbfe4"
+    },
+    {
+      "passed": true,
+      "exit_code": 0,
+      "missing_file_repair": false,
+      "log_sha256": "3f3c061e560ecc892f1af2a196eb960c46636b3bf50640986edf9bdb987a8839",
+      "phase": "uninstall",
+      "result_sha256": "6ec0bd3c5f6292aaf8534cd2d8aac50eeb03bea40069275ef083b2c6a1b02895"
+    }
+  ],
+  "os": {
+    "Caption": "Microsoft Windows 10 Pro",
+    "Version": "10.0.19045",
+    "BuildNumber": "19045",
+    "OSArchitecture": "64-bit",
+    "revision": 3803
+  },
+  "original_evidence_records": [
+    {
+      "sha256": "ae351e031665c51db38c81fdd77f3eb3d68709db1b512ce33ca3de61b43d7679",
+      "name": "transfer-manifest.json",
+      "bytes": 577
+    },
+    {
+      "sha256": "f0c9f7e509f442040b220f14e5ba906413ac04ea6fc2d20f1f1b4a2dba46701f",
+      "name": "Run-Lifecycle.ps1",
+      "bytes": 4345
+    },
+    {
+      "sha256": "4a3e98464044e3511a38c6f917f01f63ff43c2b41253d52e0819bde22c313384",
+      "name": "Test-DisposableMsi.ps1",
+      "bytes": 11239
+    },
+    {
+      "sha256": "64b7144b38c8b963b98cbb96f9964395c9413ce1a1b614d10fd0d57484f7619e",
+      "name": "Get-MsiIdentity.ps1",
+      "bytes": 1035
+    },
+    {
+      "sha256": "845e8355e969b95b38b6ea83f4b89103fdc541aa088d95e2602f0d23005aa8ea",
+      "name": "Get-WindowsCompatibility.ps1",
+      "bytes": 1202
+    },
+    {
+      "sha256": "e866ce520416b1ef59b005508a95a16b017866d1bcad63560d0c44de356eb600",
+      "name": "lifecycle-started.json",
+      "bytes": 731
+    },
+    {
+      "sha256": "c345c8119de80464276249521a8a6221aa9cd34f5e6708df4ed7f19825fd271f",
+      "name": "lifecycle-result.json",
+      "bytes": 1942
+    },
+    {
+      "sha256": "daa42ba4f8c6d4c65598c23dcf6f257f5e8af8f00134d2170762689e611b7834",
+      "name": "trust-preflight.json",
+      "bytes": 748
+    },
+    {
+      "sha256": "c3cc04868e9f9c300855b34a23d09688039ffbd3dfe93b89d4679773b6c79b48",
+      "name": "results/install/result.json",
+      "bytes": 1241
+    },
+    {
+      "sha256": "22ad4b9077121512bfb17f2a04d7c3f3a5046e1557508fc20ca5dce8ae0b7d74",
+      "name": "results/install/msi.log",
+      "bytes": 131154
+    },
+    {
+      "sha256": "9cbcae649a1b7ad13b8230dcd48172ff7f7395beab3e150b972e8b89782cbfe4",
+      "name": "results/repair/result.json",
+      "bytes": 1239
+    },
+    {
+      "sha256": "ddf11ca5d4eaa339d4dd2823670d9c7a0918a999e042e4771c52579d3243791f",
+      "name": "results/repair/msi.log",
+      "bytes": 102804
+    },
+    {
+      "sha256": "6ec0bd3c5f6292aaf8534cd2d8aac50eeb03bea40069275ef083b2c6a1b02895",
+      "name": "results/uninstall/result.json",
+      "bytes": 1243
+    },
+    {
+      "sha256": "3f3c061e560ecc892f1af2a196eb960c46636b3bf50640986edf9bdb987a8839",
+      "name": "results/uninstall/msi.log",
+      "bytes": 83212
+    }
+  ],
+  "scope": "Raw lab-signed technician MSI first application context on newly created standard Windows10 Pro VM, in an administrator SSH child test process; original certificate-cmdlet and restricted-script preflight failures were retained and occurred before MSI; administrative install, missing-executable repair and uninstall. Not standard-user, login, sessions, software-version upgrade or approved automatic updates.",
+  "full_product_acceptance": false,
+  "lab_signed_only": true,
+  "production_publication": false,
+  "clean_vm": true,
+  "os_media": "Standard Microsoft Windows 10 22H2 x64; no activation bypass or licensed evaluation claim",
+  "certificate_sha256": "d5d4567bf67622ae8bda75e22db7b72b278c0eaa58450427bf8bf0e0bba3f94e",
+  "permanent_execution_policies_changed": false,
+  "retained_preflight_failures": [
+    "Import-Certificate returned access denied before MSI. A separate query proved a full RID-500 administrator token; exact public certificate trust was then verified through X509Store. Original cause is unproven.",
+    "Default script restriction prevented the wrapper from starting MSI. The actual test ran in one child PowerShell process with explicit process-only execution policy.",
+    "The first evidence helper transfer timed out. Original results were subsequently collected without uploading a helper and all 14 records matched their guest hashes."
+  ]
+}
diff --git a/deployment/windows/e95010e-first-build-and-source-verification.json b/deployment/windows/e95010e-first-build-and-source-verification.json
new file mode 100644
index 00000000000..a418ae69d3b
--- /dev/null
+++ b/deployment/windows/e95010e-first-build-and-source-verification.json
@@ -0,0 +1,46 @@
+{
+  "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+  "version": "1.5.5",
+  "first_build_run": 40601171957,
+  "first_build_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40601171957",
+  "artifact": 12781940818,
+  "artifact_digest": "sha256:ee17a7d4afd12ffa7473c7f76f29a588c159d408d629af0f9d780bd8de093a7a",
+  "artifact_archive_bytes": 254787437,
+  "native_pause_authorization_regression_passed": true,
+  "native_file_transfer_handle_regression_passed": true,
+  "required_build_checks": {
+    "Reject paused support and authorization reuse after resume": "success",
+    "Reject cross-target and stale-login file-transfer handles": "success",
+    "Verify hardened DLL search supports delayed application libraries": "success",
+    "Build branded client": "success",
+    "Reject incoming capture helpers in the technician edition": "success",
+    "Verify service launcher defers desktop DLL loading": "success",
+    "Verify customer MSI starts a headless native service": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "complete_corresponding_source_verified": true,
+  "public_tracked_source_files_verified": 1220,
+  "generated_bridge_files_verified": 6,
+  "source_date_epoch": 1793143064,
+  "independent_rebuild_run": 40608282560,
+  "independent_rebuild_verified": true,
+  "lab_signing_started": true,
+  "standard_user_pause_runtime_verified": false,
+  "file_transfer_runtime_verified": false,
+  "full_windows_matrix_verified": false,
+  "production_qualified": false,
+  "comparison_run": 40616863517,
+  "comparison_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40616863517",
+  "shipping_outputs_identical": 8,
+  "normalization_applied_to_shipping_files": false,
+  "lab_signed_outputs_verified": 7,
+  "lab_signing_key_remains_nonexportable": true,
+  "private_signing_key_exported": false,
+  "lab_publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "production_publication": false
+}
diff --git a/deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json b/deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json
new file mode 100644
index 00000000000..ffc10065793
--- /dev/null
+++ b/deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json
@@ -0,0 +1,109 @@
+{
+  "recorded_utc": "2026-10-28T03:06:38.412382+00:00",
+  "application_source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+  "version": "1.5.5",
+  "sequence": 8,
+  "independent_linux_company": true,
+  "management_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+  "lab_signed_only": true,
+  "release_import_rejections": {
+    "invalid_signatures_rejected": true,
+    "request_cannot_override_operator_release_key": true,
+    "unapproved_builds_rejected_without_job_creation": true
+  },
+  "generated_bundles": [
+    {
+      "edition": "customer",
+      "bundle_sha256": "e5dca113b5815c1f0dae510107301ccdf06206bc257b742eb19a416f6cd5d097",
+      "bytes": 32507195,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "bundle_sha256": "1c163b744a6a39bdc24ebf42efa07f6ccd25edc9dab9c43a6620eb3c55234186",
+      "bytes": 30302957,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "automatic_updates_paused": true,
+  "technician_upgrade": {
+    "pending_install_absent": true,
+    "technician_bootstrap_preserved": true,
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "before_sequence": 7,
+    "automatic_upgrade_tested": false,
+    "product_state": 5,
+    "before_version": "1.5.4",
+    "installed_hashes_and_publishers_verified": true,
+    "native_startup_tested": false,
+    "utc": "2026-10-28T02:56:05.0227518Z",
+    "branding_preserved": true,
+    "after_sequence": 8,
+    "customer_unattended_consent": false,
+    "profile_revision": 14,
+    "after_version": "1.5.5",
+    "installer_not_repeated": true,
+    "customer_and_worker_services_running": true,
+    "customer_release_sequence": 1,
+    "original_postcheck_path_expression_corrected": true,
+    "customer_consent_revision": 2,
+    "customer_identity_credential_and_consent_preserved": true,
+    "verified_utc": "2026-10-28T02:56:04.581846+00:00"
+  },
+  "technician_native_process": {
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "flutter_and_rust_libraries_loaded": true,
+    "native_child_process_running": true,
+    "version": "1.5.5",
+    "utc": "2026-10-28T03:00:18.0190924Z",
+    "native_process_count": 1,
+    "no_new_application_crash_event": true,
+    "source_payload_hashes": {
+      "rustdesk.exe": "4832f94ff08886b6e9106b3e0194270e6282240f5bfd5e8bdedf20c86852ff02",
+      "librustdesk.dll": "fd700bdfb900dc96d3c5c0ff3c31fbd8735720b8d6fc101c8de517f939643967",
+      "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204"
+    },
+    "gui_mfa_and_inventory_observed_separately": false,
+    "remote_session_qualified": false
+  },
+  "technician_gui_login": {
+    "utc": "2026-10-28T03:03:22.877075+00:00",
+    "application_source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "version": "1.5.5",
+    "release_sequence": 8,
+    "profile_revision": 14,
+    "visible_approved_device_count": 3,
+    "os": "Windows Server 2019 x64 build 17763.3650",
+    "generated_technician_bundle_installed": true,
+    "original_verified_launcher_used": true,
+    "actual_desktop_session": 1,
+    "company_branding_visible": true,
+    "updated_signed_branding_visible": true,
+    "company_https_origin_visible": true,
+    "username_password_and_totp_entered_only_in_native_form": true,
+    "gui_mfa_sign_in_succeeded": true,
+    "authorized_device_and_group_visible": true,
+    "session_history_visible": true,
+    "independent_server_login_audit_matches": true,
+    "same_machine_customer_and_technician": true,
+    "native_remote_session_exercised": false,
+    "standard_user_install_qualified": false,
+    "full_product_acceptance": false
+  },
+  "customer_1_5_5_runtime_tested": false,
+  "new_pause_and_file_transfer_runtime_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false
+}
diff --git a/deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json b/deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json
new file mode 100644
index 00000000000..0a7c784396b
--- /dev/null
+++ b/deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json
@@ -0,0 +1,131 @@
+{
+  "application_source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+  "version": "1.5.5",
+  "sequence": 8,
+  "existing_server2022_endpoint_not_pristine_os": true,
+  "actual_company_bundle_upgrade": {
+    "consent_revision": 2,
+    "service_and_watch_running": true,
+    "profile_revision": 14,
+    "identity_credential_and_trust_preserved": true,
+    "shipping_verifier_passed": true,
+    "to_sequence": 8,
+    "utc": "2026-10-28T03:26:07.3295813Z",
+    "standard_user_controls_tested": false,
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "from_version": "1.5.4",
+    "from_sequence": 7,
+    "publisher_verified": true,
+    "production_qualified": false,
+    "to_version": "1.5.5",
+    "explicit_setup_not_automatic_rollout": true,
+    "unattended_consent_off": true
+  },
+  "ordinary_user_launch_baseline": {
+    "consent_off": true,
+    "version": "1.5.5",
+    "ordinary_owned_user_console_active": true,
+    "common_shortcut_direct_target": true,
+    "release_sequence": 8,
+    "utc": "2026-10-28T03:29:06.0826814Z",
+    "service_running": true,
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "support_paused": false,
+    "consent_revision": 2,
+    "production_qualified": false,
+    "common_shortcut_not_advertised": true,
+    "native_service_configuration_found": true
+  },
+  "actual_ordinary_user_stop": {
+    "configuration_watcher_running": true,
+    "sequence": 8,
+    "version": "1.5.5",
+    "production_qualified": false,
+    "unattended_consent_off": true,
+    "native_pause_persisted": true,
+    "native_gui_owned_by_standard_account": true,
+    "consent_revision": 2,
+    "reboot_persistence_tested": false,
+    "utc": "2026-10-28T03:34:59.5030806Z",
+    "new_swan_msi_event_count": 0,
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "shipping_verifier_passed_after_resume": false,
+    "support_paused": true,
+    "gui_token_has_no_administrators_sid": true,
+    "identity_credential_trust_and_consent_preserved": true,
+    "service_installed_running_and_same_process": true,
+    "live_session_termination_tested": false
+  },
+  "actual_start_menu_shortcut_used": true,
+  "administrator_prompt_after_stop": false,
+  "misleading_legacy_footer_observed": true,
+  "legacy_footer_fix_in_next_1_5_6_source_not_installed": true,
+  "resume_and_reboot_persistence_qualified": true,
+  "active_session_termination_qualified": false,
+  "production_qualified": false,
+  "normal_paused_reboot": {
+    "sequence": 8,
+    "identity_credential_trust_and_consent_preserved": true,
+    "version": "1.5.5",
+    "consent_revision": 2,
+    "unattended_consent_off": true,
+    "production_qualified": false,
+    "configuration_watch_started_automatically": true,
+    "shipping_verifier_passed": true,
+    "pause_persisted_through_normal_reboot": true,
+    "utc": "2026-10-28T03:54:35.8781091Z",
+    "new_boot_utc": "2026-10-28T03:38:51.5000000Z",
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "manual_service_or_watcher_restart": false,
+    "normal_restart_event_and_clean_event_log_shutdown_verified": true,
+    "service_started_automatically": true,
+    "support_paused": true,
+    "kernel_boot_changed": true,
+    "prior_boot_utc": "2026-10-28T03:07:23.5000000Z"
+  },
+  "normal_reboot_unexpected_event_check": {
+    "retained_shutdown_tracker_dialog_observed": true,
+    "events": [],
+    "utc": "2026-10-28T03:59:58.2474905Z",
+    "new_unexpected_shutdown_event_count": 0
+  },
+  "actual_ordinary_user_resume": {
+    "configuration_watcher_running": true,
+    "sequence": 8,
+    "version": "1.5.5",
+    "production_qualified": false,
+    "unattended_consent_off": true,
+    "native_pause_persisted": true,
+    "native_gui_owned_by_standard_account": true,
+    "consent_revision": 2,
+    "reboot_persistence_tested": true,
+    "utc": "2026-10-28T04:02:36.8282906Z",
+    "new_swan_msi_event_count": 0,
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "shipping_verifier_passed_after_resume": true,
+    "support_paused": false,
+    "gui_token_has_no_administrators_sid": true,
+    "identity_credential_trust_and_consent_preserved": true,
+    "service_installed_running_and_same_process": true,
+    "live_session_termination_tested": false
+  },
+  "consent_dialog_scroll_and_cancel": {
+    "utc": "2026-10-28T04:04:50.851068+00:00",
+    "source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+    "version": "1.5.5",
+    "sequence": 8,
+    "actual_standard_user_dialog_opened": true,
+    "company_identity_and_https_origin_visible": true,
+    "unattended_and_windows_signin_scope_visible": true,
+    "full_policy_scroll_verified_in_small_window": true,
+    "fixed_cancel_and_allow_buttons_visible": true,
+    "cancel_clicked_without_enabling": true,
+    "local_consent_off": true,
+    "consent_revision": 2,
+    "server_unattended_flag_off": true,
+    "new_unattended_grant_status": 403,
+    "no_remote_session_or_optin_created": true,
+    "production_qualified": false
+  },
+  "administrator_prompt_after_resume": false
+}
diff --git a/deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json b/deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json
new file mode 100644
index 00000000000..e0c9f603596
--- /dev/null
+++ b/deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json
@@ -0,0 +1,142 @@
+{
+  "application_source": "e95010e31f58840572b4080b69f18c9dd55adb4e",
+  "version": "1.5.5",
+  "release_sequence": 8,
+  "os": "Windows 11 Enterprise Evaluation x64 26300.9457",
+  "fresh_customer_install": {
+    "version": "1.5.5",
+    "watch_state": "Running",
+    "profile_revision": 14,
+    "sequence": 8,
+    "shipping_verifier_passed": true,
+    "utc": "2026-10-28T04:33:12.7183731Z",
+    "all_signed_files": 96,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "enrollment_and_authorization": {
+    "utc": "2026-10-28T04:34:22.520324+00:00",
+    "version": "1.5.5",
+    "sequence": 8,
+    "actual_enrolled_customer": "Windows11",
+    "pending_inventory_hidden": true,
+    "pending_grant_status": 403,
+    "explicit_company_approval_verified": true,
+    "authorized_inventory_visible": true,
+    "unassigned_inventory_hidden": true,
+    "unassigned_grant_status": 403,
+    "unattended_without_consent_status": 403,
+    "other_device_records_unchanged": true,
+    "no_successful_grant_or_native_session_created": true,
+    "production_qualified": false
+  },
+  "technician_standard_user_attempt": {
+    "genuine_non_administrator_token": true,
+    "always_install_elevated_not_enabled": true,
+    "initial_limited_password_task_never_ran": true,
+    "limited_interactive_task_used_after_owned_user_first_logon": true,
+    "original_test_task_reached_30_minute_deadline": true,
+    "extraction_and_verified_bootstrap_preserved": true,
+    "guarded_pre_msi_continuation_failed_closed": true,
+    "failure": "Publisher verification exceeded 120-second budget",
+    "technician_msi_not_launched": true,
+    "technician_executable_absent": true,
+    "no_pending_install_or_update_marker": true,
+    "customer_identity_credential_and_consent_preserved": true,
+    "fresh_technician_install_passed": false
+  },
+  "independent_read_only_standard_user_trust_diagnostic": [
+    {
+      "utc": "2026-10-28T06:44:04.1688145Z",
+      "stage": "started",
+      "value": ""
+    },
+    {
+      "utc": "2026-10-28T06:44:11.3045778Z",
+      "stage": "ordinary_token_verified",
+      "value": ""
+    },
+    {
+      "utc": "2026-10-28T06:44:11.3829506Z",
+      "stage": "before_resolve_path",
+      "value": ""
+    },
+    {
+      "utc": "2026-10-28T06:44:11.4035133Z",
+      "stage": "before_file_hash",
+      "value": ""
+    },
+    {
+      "utc": "2026-10-28T06:45:18.4321547Z",
+      "stage": "file_hash_completed",
+      "value": "9EF49B8D60DE7E9B7A86C88AD54B77390834A921CC24A472BAC893534CEB064A"
+    },
+    {
+      "utc": "2026-10-28T06:45:18.4321547Z",
+      "stage": "before_package_authenticode",
+      "value": ""
+    },
+    {
+      "utc": "2026-10-28T06:45:18.7504732Z",
+      "stage": "package_authenticode_completed",
+      "value": "Valid"
+    },
+    {
+      "utc": "2026-10-28T06:45:18.8763948Z",
+      "stage": "package_signer_thumbprint",
+      "value": "AF817683AA78C45F318B05DD13101CBECC744362"
+    },
+    {
+      "utc": "2026-10-28T06:45:18.8763948Z",
+      "stage": "before_windows_authenticode",
+      "value": ""
+    },
+    {
+      "utc": "2026-10-28T06:45:18.9937085Z",
+      "stage": "windows_authenticode_completed",
+      "value": "Valid"
+    },
+    {
+      "utc": "2026-10-28T06:45:18.9959353Z",
+      "stage": "completed",
+      "value": ""
+    }
+  ],
+  "source_fix": {
+    "package_publisher_verification_budget_seconds": 300,
+    "signature_hash_publisher_and_certificate_checks_retained": true,
+    "timeout_still_fails_closed_and_reaps_verifier": true,
+    "installed_fix_tested": false,
+    "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+    "candidate_version": "1.5.7",
+    "component_checks": {
+      "windows_and_linux_workflow": 40647664923,
+      "conclusion": "success",
+      "push_workflow": 40647659405,
+      "local_source_archive_tests": 5,
+      "local_installer_metadata_tests": 6
+    },
+    "native_build": {
+      "run_id": 40647688419,
+      "last_observed_status": "in_progress",
+      "observed_utc": "2026-10-28T07:23:22.875992+00:00",
+      "independent_reproduction_not_yet_run": true
+    }
+  },
+  "production_qualified": false,
+  "remaining": [
+    "Rebuild exact public source and verify independent outputs.",
+    "Sign test packages using retained nonexportable lab key.",
+    "Install actual generated technician bundle as ordinary Windows11 user.",
+    "Complete native GUI, reboot, lifecycle and remote-feature qualification."
+  ],
+  "lab_cleanup": {
+    "normal_guest_shutdown_exit": 0,
+    "normal_guest_shutdown_utc": "2026-10-28T07:07:55.464867+00:00",
+    "original_clean_os_and_current_partial_technician_state_preserved": true
+  }
+}
diff --git a/deployment/windows/emit-flutter-reply-fixture.py b/deployment/windows/emit-flutter-reply-fixture.py
new file mode 100644
index 00000000000..e82000ed9c4
--- /dev/null
+++ b/deployment/windows/emit-flutter-reply-fixture.py
@@ -0,0 +1,16 @@
+"""Generate the compiler fixture from the actual SDK patch callable, not a copy."""
+import argparse
+import importlib.util
+from pathlib import Path
+
+root = Path(__file__).parent
+spec = importlib.util.spec_from_file_location("reply_patch", root / "patch-flutter-client-wrapper.py")
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument("--output", required=True, type=Path)
+args = parser.parse_args()
+template = (root / "fixtures/flutter_reply_handler.cpp.in").read_text(encoding="utf-8")
+if template.count("@NAMED_REPLY@") != 1 or args.output.exists():
+    raise ValueError("Unexpected template or existing fixture source")
+args.output.write_text(template.replace("@NAMED_REPLY@", module.NAMED_REPLY), encoding="utf-8")
diff --git a/deployment/windows/engine-05d5369-reproducibility.json b/deployment/windows/engine-05d5369-reproducibility.json
new file mode 100644
index 00000000000..613686ca790
--- /dev/null
+++ b/deployment/windows/engine-05d5369-reproducibility.json
@@ -0,0 +1,53 @@
+{
+  "schema_version": 1,
+  "source_commit": "05d5369c04804b9a9b2dc06df0cb85b0efe6f274",
+  "verified_utc": "2026-10-22T12:15:28.327686+00:00",
+  "builds": [
+    {
+      "workflow_run": 39753153773,
+      "artifact": 12416969754,
+      "archive_digest": "sha256:5629a63868421d17ac00a6cdd4215cda852c59b8bcf9efb802482d6248751d53",
+      "evidence_files_verified": 19,
+      "public_engine_source_files_verified": 5604,
+      "public_buildroot_source_files_verified": 145
+    },
+    {
+      "workflow_run": 39761977920,
+      "artifact": 12420939008,
+      "archive_digest": "sha256:f1e6df169a68c3cc470d68522d7ea997ade549f2c07b621566f76bc07192b258",
+      "evidence_files_verified": 19,
+      "public_engine_source_files_verified": 5604,
+      "public_buildroot_source_files_verified": 145
+    }
+  ],
+  "comparison": "Original DLL, import library and PDB bytes from two independent exact-source CI rebuilds; no normalization",
+  "files": [
+    {
+      "path": "flutter_windows.dll",
+      "bytes_first": 18156544,
+      "bytes_second": 18156544,
+      "first_sha256": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+      "second_sha256": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+      "identical": true
+    },
+    {
+      "path": "flutter_windows.dll.lib",
+      "bytes_first": 30436,
+      "bytes_second": 30436,
+      "first_sha256": "f7183633a4053b822ad6e353484c76528ffe98242cbe5bef04923ca40373eafc",
+      "second_sha256": "f7183633a4053b822ad6e353484c76528ffe98242cbe5bef04923ca40373eafc",
+      "identical": true
+    },
+    {
+      "path": "flutter_windows.dll.pdb",
+      "bytes_first": 239464448,
+      "bytes_second": 239464448,
+      "first_sha256": "64317fb6c9248d35fd3b2ed4c72147d44676b27c3d17bee0e74b986942abe521",
+      "second_sha256": "64317fb6c9248d35fd3b2ed4c72147d44676b27c3d17bee0e74b986942abe521",
+      "identical": true
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "full_runtime_qualified": false,
+  "production_approved": false
+}
diff --git a/deployment/windows/fixtures/flutter-sdk-3.24.5/LICENSE b/deployment/windows/fixtures/flutter-sdk-3.24.5/LICENSE
new file mode 100644
index 00000000000..c6823b81eb8
--- /dev/null
+++ b/deployment/windows/fixtures/flutter-sdk-3.24.5/LICENSE
@@ -0,0 +1,25 @@
+Copyright 2013 The Flutter Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+      copyright notice, this list of conditions and the following
+      disclaimer in the documentation and/or other materials provided
+      with the distribution.
+    * Neither the name of Google Inc. nor the names of its
+      contributors may be used to endorse or promote products derived
+      from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/deployment/windows/fixtures/flutter-sdk-3.24.5/SOURCE.json b/deployment/windows/fixtures/flutter-sdk-3.24.5/SOURCE.json
new file mode 100644
index 00000000000..fd037431d26
--- /dev/null
+++ b/deployment/windows/fixtures/flutter-sdk-3.24.5/SOURCE.json
@@ -0,0 +1,8 @@
+{
+  "repository": "https://github.com/flutter/engine",
+  "revision": "a18df97ca57a249df5d8d68cd0820600223ce262",
+  "path": "shell/platform/common/client_wrapper/core_implementations.cc",
+  "sha256": "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989",
+  "license": "LICENSE",
+  "purpose": "Reviewed upstream preimage for fail-closed source-only reply-handler patch tests"
+}
diff --git a/deployment/windows/fixtures/flutter-sdk-3.24.5/core_implementations.cc b/deployment/windows/fixtures/flutter-sdk-3.24.5/core_implementations.cc
new file mode 100644
index 00000000000..f682f1b2299
--- /dev/null
+++ b/deployment/windows/fixtures/flutter-sdk-3.24.5/core_implementations.cc
@@ -0,0 +1,284 @@
+// Copyright 2013 The Flutter Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file contains the implementations of any class in the wrapper that
+// - is not fully inline, and
+// - is necessary for all clients of the wrapper (either app or plugin).
+// It exists instead of the usual structure of having some_class_name.cc files
+// so that changes to the set of things that need non-header implementations
+// are not breaking changes for the template.
+//
+// If https://github.com/flutter/flutter/issues/57146 is fixed, this can be
+// removed in favor of the normal structure since templates will no longer
+// manually include files.
+
+#include <cassert>
+#include <iostream>
+#include <variant>
+
+#include "binary_messenger_impl.h"
+#include "include/flutter/engine_method_result.h"
+#include "include/flutter/method_channel.h"
+#include "include/flutter/standard_method_codec.h"
+#include "texture_registrar_impl.h"
+
+namespace flutter {
+
+// ========== binary_messenger_impl.h ==========
+
+namespace {
+
+using FlutterDesktopMessengerScopedLock =
+    std::unique_ptr<FlutterDesktopMessenger,
+                    decltype(&FlutterDesktopMessengerUnlock)>;
+
+// Passes |message| to |user_data|, which must be a BinaryMessageHandler, along
+// with a BinaryReply that will send a response on |message|'s response handle.
+//
+// This serves as an adaptor between the function-pointer-based message callback
+// interface provided by the C API and the std::function-based message handler
+// interface of BinaryMessenger.
+void ForwardToHandler(FlutterDesktopMessengerRef messenger,
+                      const FlutterDesktopMessage* message,
+                      void* user_data) {
+  auto* response_handle = message->response_handle;
+  auto messenger_ptr = std::shared_ptr<FlutterDesktopMessenger>(
+      FlutterDesktopMessengerAddRef(messenger),
+      &FlutterDesktopMessengerRelease);
+  BinaryReply reply_handler = [messenger_ptr, response_handle](
+                                  const uint8_t* reply,
+                                  size_t reply_size) mutable {
+    // Note: This lambda can be called on any thread.
+    auto lock = FlutterDesktopMessengerScopedLock(
+        FlutterDesktopMessengerLock(messenger_ptr.get()),
+        &FlutterDesktopMessengerUnlock);
+    if (!FlutterDesktopMessengerIsAvailable(messenger_ptr.get())) {
+      // Drop reply if it comes in after the engine is destroyed.
+      return;
+    }
+    if (!response_handle) {
+      std::cerr << "Error: Response can be set only once. Ignoring "
+                   "duplicate response."
+                << std::endl;
+      return;
+    }
+    FlutterDesktopMessengerSendResponse(messenger_ptr.get(), response_handle,
+                                        reply, reply_size);
+    // The engine frees the response handle once
+    // FlutterDesktopSendMessageResponse is called.
+    response_handle = nullptr;
+  };
+
+  const BinaryMessageHandler& message_handler =
+      *static_cast<BinaryMessageHandler*>(user_data);
+
+  message_handler(message->message, message->message_size,
+                  std::move(reply_handler));
+}
+}  // namespace
+
+BinaryMessengerImpl::BinaryMessengerImpl(
+    FlutterDesktopMessengerRef core_messenger)
+    : messenger_(core_messenger) {}
+
+BinaryMessengerImpl::~BinaryMessengerImpl() = default;
+
+void BinaryMessengerImpl::Send(const std::string& channel,
+                               const uint8_t* message,
+                               size_t message_size,
+                               BinaryReply reply) const {
+  if (reply == nullptr) {
+    FlutterDesktopMessengerSend(messenger_, channel.c_str(), message,
+                                message_size);
+    return;
+  }
+  struct Captures {
+    BinaryReply reply;
+  };
+  auto captures = new Captures();
+  captures->reply = reply;
+
+  auto message_reply = [](const uint8_t* data, size_t data_size,
+                          void* user_data) {
+    auto captures = reinterpret_cast<Captures*>(user_data);
+    captures->reply(data, data_size);
+    delete captures;
+  };
+  bool result = FlutterDesktopMessengerSendWithReply(
+      messenger_, channel.c_str(), message, message_size, message_reply,
+      captures);
+  if (!result) {
+    delete captures;
+  }
+}
+
+void BinaryMessengerImpl::SetMessageHandler(const std::string& channel,
+                                            BinaryMessageHandler handler) {
+  if (!handler) {
+    handlers_.erase(channel);
+    FlutterDesktopMessengerSetCallback(messenger_, channel.c_str(), nullptr,
+                                       nullptr);
+    return;
+  }
+  // Save the handler, to keep it alive.
+  handlers_[channel] = std::move(handler);
+  BinaryMessageHandler* message_handler = &handlers_[channel];
+  // Set an adaptor callback that will invoke the handler.
+  FlutterDesktopMessengerSetCallback(messenger_, channel.c_str(),
+                                     ForwardToHandler, message_handler);
+}
+
+// ========== engine_method_result.h ==========
+
+namespace internal {
+
+ReplyManager::ReplyManager(BinaryReply reply_handler)
+    : reply_handler_(std::move(reply_handler)) {
+  assert(reply_handler_);
+}
+
+ReplyManager::~ReplyManager() {
+  if (reply_handler_) {
+    // Warn, rather than send a not-implemented response, since the engine may
+    // no longer be valid at this point.
+    std::cerr
+        << "Warning: Failed to respond to a message. This is a memory leak."
+        << std::endl;
+  }
+}
+
+void ReplyManager::SendResponseData(const std::vector<uint8_t>* data) {
+  if (!reply_handler_) {
+    std::cerr
+        << "Error: Only one of Success, Error, or NotImplemented can be "
+           "called,"
+        << " and it can be called exactly once. Ignoring duplicate result."
+        << std::endl;
+    return;
+  }
+
+  const uint8_t* message = data && !data->empty() ? data->data() : nullptr;
+  size_t message_size = data ? data->size() : 0;
+  reply_handler_(message, message_size);
+  reply_handler_ = nullptr;
+}
+
+}  // namespace internal
+
+// ========== method_channel.h ==========
+
+namespace {
+
+constexpr char kControlChannelName[] = "dev.flutter/channel-buffers";
+constexpr char kResizeMethod[] = "resize";
+constexpr char kOverflowMethod[] = "overflow";
+
+}  // namespace
+
+namespace internal {
+
+void ResizeChannel(BinaryMessenger* messenger, std::string name, int new_size) {
+  auto control_channel = std::make_unique<MethodChannel<EncodableValue>>(
+      messenger, kControlChannelName, &StandardMethodCodec::GetInstance());
+
+  // The deserialization logic handles only 32 bits values, see
+  // https://github.com/flutter/engine/blob/93e8901490e78c7ba7e319cce4470d9c6478c6dc/lib/ui/channel_buffers.dart#L495.
+  control_channel->InvokeMethod(
+      kResizeMethod, std::make_unique<EncodableValue>(EncodableList{
+                         EncodableValue(name),
+                         EncodableValue(static_cast<int32_t>(new_size)),
+                     }));
+}
+
+void SetChannelWarnsOnOverflow(BinaryMessenger* messenger,
+                               std::string name,
+                               bool warns) {
+  auto control_channel = std::make_unique<MethodChannel<EncodableValue>>(
+      messenger, kControlChannelName, &StandardMethodCodec::GetInstance());
+
+  control_channel->InvokeMethod(kOverflowMethod,
+                                std::make_unique<EncodableValue>(EncodableList{
+                                    EncodableValue(name),
+                                    EncodableValue(!warns),
+                                }));
+}
+
+}  // namespace internal
+
+// ========== texture_registrar_impl.h ==========
+
+TextureRegistrarImpl::TextureRegistrarImpl(
+    FlutterDesktopTextureRegistrarRef texture_registrar_ref)
+    : texture_registrar_ref_(texture_registrar_ref) {}
+
+TextureRegistrarImpl::~TextureRegistrarImpl() = default;
+
+int64_t TextureRegistrarImpl::RegisterTexture(TextureVariant* texture) {
+  FlutterDesktopTextureInfo info = {};
+  if (auto pixel_buffer_texture = std::get_if<PixelBufferTexture>(texture)) {
+    info.type = kFlutterDesktopPixelBufferTexture;
+    info.pixel_buffer_config.user_data = pixel_buffer_texture;
+    info.pixel_buffer_config.callback =
+        [](size_t width, size_t height,
+           void* user_data) -> const FlutterDesktopPixelBuffer* {
+      auto texture = static_cast<PixelBufferTexture*>(user_data);
+      return texture->CopyPixelBuffer(width, height);
+    };
+  } else if (auto gpu_surface_texture =
+                 std::get_if<GpuSurfaceTexture>(texture)) {
+    info.type = kFlutterDesktopGpuSurfaceTexture;
+    info.gpu_surface_config.struct_size =
+        sizeof(FlutterDesktopGpuSurfaceTextureConfig);
+    info.gpu_surface_config.type = gpu_surface_texture->surface_type();
+    info.gpu_surface_config.user_data = gpu_surface_texture;
+    info.gpu_surface_config.callback =
+        [](size_t width, size_t height,
+           void* user_data) -> const FlutterDesktopGpuSurfaceDescriptor* {
+      auto texture = static_cast<GpuSurfaceTexture*>(user_data);
+      return texture->ObtainDescriptor(width, height);
+    };
+  } else {
+    std::cerr << "Attempting to register unknown texture variant." << std::endl;
+    return -1;
+  }
+
+  int64_t texture_id = FlutterDesktopTextureRegistrarRegisterExternalTexture(
+      texture_registrar_ref_, &info);
+  return texture_id;
+}  // namespace flutter
+
+bool TextureRegistrarImpl::MarkTextureFrameAvailable(int64_t texture_id) {
+  return FlutterDesktopTextureRegistrarMarkExternalTextureFrameAvailable(
+      texture_registrar_ref_, texture_id);
+}
+
+void TextureRegistrarImpl::UnregisterTexture(int64_t texture_id,
+                                             std::function<void()> callback) {
+  if (callback == nullptr) {
+    FlutterDesktopTextureRegistrarUnregisterExternalTexture(
+        texture_registrar_ref_, texture_id, nullptr, nullptr);
+    return;
+  }
+
+  struct Captures {
+    std::function<void()> callback;
+  };
+  auto captures = new Captures();
+  captures->callback = std::move(callback);
+  FlutterDesktopTextureRegistrarUnregisterExternalTexture(
+      texture_registrar_ref_, texture_id,
+      [](void* opaque) {
+        auto captures = reinterpret_cast<Captures*>(opaque);
+        captures->callback();
+        delete captures;
+      },
+      captures);
+}
+
+bool TextureRegistrarImpl::UnregisterTexture(int64_t texture_id) {
+  UnregisterTexture(texture_id, nullptr);
+  return true;
+}
+
+}  // namespace flutter
diff --git a/deployment/windows/fixtures/flutter_reply_handler.cpp.in b/deployment/windows/fixtures/flutter_reply_handler.cpp.in
new file mode 100644
index 00000000000..1d7e3283f20
--- /dev/null
+++ b/deployment/windows/fixtures/flutter_reply_handler.cpp.in
@@ -0,0 +1,104 @@
+#include <cstdint>
+#include <cstdio>
+#include <functional>
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <thread>
+#include <typeinfo>
+
+struct FlutterDesktopMessageResponseHandle {};
+struct FlutterDesktopMessenger {
+  std::recursive_mutex mutex;
+  bool available = true;
+  unsigned references = 0, releases = 0, locks = 0, unlocks = 0, sends = 0;
+  const std::uint8_t* data = nullptr;
+  std::size_t size = 0;
+};
+FlutterDesktopMessenger* FlutterDesktopMessengerAddRef(FlutterDesktopMessenger* m) {
+  ++m->references;
+  return m;
+}
+void FlutterDesktopMessengerRelease(FlutterDesktopMessenger* m) {
+  --m->references;
+  ++m->releases;
+}
+FlutterDesktopMessenger* FlutterDesktopMessengerLock(FlutterDesktopMessenger* m) {
+  m->mutex.lock();
+  ++m->locks;
+  return m;
+}
+void FlutterDesktopMessengerUnlock(FlutterDesktopMessenger* m) {
+  ++m->unlocks;
+  m->mutex.unlock();
+}
+bool FlutterDesktopMessengerIsAvailable(FlutterDesktopMessenger* m) {
+  return m->available;
+}
+void FlutterDesktopMessengerSendResponse(
+    FlutterDesktopMessenger* m, const FlutterDesktopMessageResponseHandle*,
+    const std::uint8_t* data, std::size_t size) {
+  ++m->sends;
+  m->data = data;
+  m->size = size;
+}
+namespace flutter {
+@NAMED_REPLY@
+}
+using Reply = std::function<void(const std::uint8_t*, std::size_t)>;
+bool Check(bool value, const char* label) {
+  if (!value) std::fprintf(stderr, "Reply fixture failed: %s\n", label);
+  return value;
+}
+struct InvokeReply {
+  Reply* reply;
+  void operator()() { (*reply)(nullptr, 0); }
+};
+bool RunSemantics() {
+  FlutterDesktopMessageResponseHandle handle;
+  const std::uint8_t bytes[] = {1, 2, 3};
+  FlutterDesktopMessenger m;
+  {
+    auto owner = std::shared_ptr<FlutterDesktopMessenger>(
+        FlutterDesktopMessengerAddRef(&m), &FlutterDesktopMessengerRelease);
+    Reply reply = flutter::internal::SwanBinaryReplyHandler(owner, &handle);
+    Reply copy = reply;
+    reply = nullptr;
+    owner.reset();
+    if (!Check(m.references == 1 && m.releases == 0, "copied callback retains messenger")) return false;
+    copy(bytes, sizeof(bytes));
+    copy(nullptr, 0);
+    if (!Check(m.sends == 1 && m.data == bytes && m.size == sizeof(bytes), "one response, exact payload")) return false;
+    if (!Check(m.locks == 2 && m.unlocks == 2, "duplicate path unlocks")) return false;
+  }
+  if (!Check(m.references == 0 && m.releases == 1, "last callback releases messenger")) return false;
+  FlutterDesktopMessenger unavailable;
+  unavailable.available = false;
+  {
+    auto owner = std::shared_ptr<FlutterDesktopMessenger>(
+        FlutterDesktopMessengerAddRef(&unavailable), &FlutterDesktopMessengerRelease);
+    Reply reply = flutter::internal::SwanBinaryReplyHandler(owner, &handle);
+    reply(bytes, sizeof(bytes));
+    if (!Check(unavailable.sends == 0 && unavailable.locks == 1 && unavailable.unlocks == 1,
+               "destroyed engine drops reply and unlocks")) return false;
+  }
+  if (!Check(unavailable.references == 0 && unavailable.releases == 1, "unavailable engine reference released")) return false;
+  FlutterDesktopMessenger concurrent;
+  {
+    auto owner = std::shared_ptr<FlutterDesktopMessenger>(
+        FlutterDesktopMessengerAddRef(&concurrent), &FlutterDesktopMessengerRelease);
+    Reply reply = flutter::internal::SwanBinaryReplyHandler(owner, &handle);
+    std::thread workers[4];
+    for (auto& worker : workers) worker = std::thread(InvokeReply{&reply});
+    for (auto& worker : workers) worker.join();
+    if (!Check(concurrent.sends == 1 && concurrent.data == nullptr && concurrent.size == 0,
+               "concurrent empty replies serialize to one send")) return false;
+    if (!Check(concurrent.locks == 4 && concurrent.unlocks == 4, "concurrent paths unlock")) return false;
+  }
+  return Check(concurrent.references == 0 && concurrent.releases == 1, "concurrent callback reference released");
+}
+int main() {
+  if (!RunSemantics()) return 1;
+  std::printf("%s\n%s\n1\n", __FILE__, typeid(flutter::internal::SwanBinaryReplyHandler).name());
+  return 0;
+}
diff --git a/deployment/windows/flutter-engine-buildroot.patch b/deployment/windows/flutter-engine-buildroot.patch
new file mode 100644
index 00000000000..1fc7c222bb6
--- /dev/null
+++ b/deployment/windows/flutter-engine-buildroot.patch
@@ -0,0 +1,73 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index d38a4cf..8fcb1b9 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -82,4 +82,14 @@ config("compiler") {
+       "/guard:cf",  # Enable control flow guard security checks.
+     ]
++    if (!is_debug) {
++      # Content-based COFF/PE timestamps; release linking is non-incremental.
++      cflags += [ "/Brepro" ]
++      ldflags += [ "/Brepro", "/PDBALTPATH:%_PDB%" ]
++      if (is_clang) {
++        cflags += [ "-fdebug-compilation-dir=." ]
++        # Keep PDB type integration ordering deterministic in the pinned LLD.
++        ldflags += [ "/threads:1" ]
++      }
++    }
+   } else {
+     # Common GCC compiler flags setup.
+diff --git a/build/toolchain/win/BUILD.gn b/build/toolchain/win/BUILD.gn
+index 006c805..31b0556 100644
+--- a/build/toolchain/win/BUILD.gn
++++ b/build/toolchain/win/BUILD.gn
+@@ -90,4 +90,8 @@ template("msvc_toolchain") {
+
+     cl = invoker.cl
++    linker = "link.exe"
++    if (toolchain_is_clang) {
++      linker = rebase_path("$clang_base_path/bin/lld-link.exe", root_build_dir)
++    }
+
+     # Make these apply to all tools below.
+@@ -199,9 +203,8 @@ template("msvc_toolchain") {
+       dllname = "{{root_out_dir}}/{{target_output_name}}{{output_extension}}"
+       libname = "${dllname}.lib"  # e.g. foo.dll.lib
+-      expname = "${dllname}.exp"
+       pdbname = "${dllname}.pdb"
+       rspfile = "${dllname}.rsp"
+
+-      link_command = "\"$python_path\" $tool_wrapper_path link-wrapper $env False link.exe /nologo /IMPLIB:$libname /DLL /OUT:$dllname /PDB:${dllname}.pdb @$rspfile"
++      link_command = "\"$python_path\" $tool_wrapper_path link-wrapper $env False $linker /nologo /IMPLIB:$libname /DLL /OUT:$dllname /PDB:${dllname}.pdb @$rspfile"
+
+       # TODO(brettw) support manifests
+@@ -214,8 +217,11 @@ template("msvc_toolchain") {
+       outputs = [
+         dllname,
+-        expname,
+         libname,
+         pdbname,
+       ]
++      # LLD writes the import library directly without an intermediate .exp.
++      if (!toolchain_is_clang) {
++        outputs += [ "${dllname}.exp" ]
++      }
+       link_output = libname
+       depend_output = libname
+@@ -234,5 +240,5 @@ template("msvc_toolchain") {
+       pdbfile = "$binary_output.pdb"
+
+-      link_command = "\"$python_path\" $tool_wrapper_path link-wrapper $env False link.exe /nologo /OUT:$binary_output /PDB:$pdbfile @$rspfile"
++      link_command = "\"$python_path\" $tool_wrapper_path link-wrapper $env False $linker /nologo /OUT:$binary_output /PDB:$pdbfile @$rspfile"
+
+       # TODO(brettw) support manifests
+diff --git a/build/toolchain/win/setup_toolchain.py b/build/toolchain/win/setup_toolchain.py
+index 521c243..e33ac0a 100644
+--- a/build/toolchain/win/setup_toolchain.py
++++ b/build/toolchain/win/setup_toolchain.py
+@@ -187,4 +187,5 @@ def _LoadToolchainEnv(cpu, toolchain_root, sdk_dir, target_store):
+     # packaged toolchain in build/vs_toolchain.py.
+     args.append(SDK_VERSION)
++    args.append('-vcvars_ver=14.38')
+     variables = _LoadEnvFromBat(args)
+   return _ExtractImportantEnvironment(variables)
diff --git a/deployment/windows/flutter-engine-source.py b/deployment/windows/flutter-engine-source.py
new file mode 100644
index 00000000000..4315d1199d3
--- /dev/null
+++ b/deployment/windows/flutter-engine-source.py
@@ -0,0 +1,265 @@
+"""Verify and package the independent Windows Flutter engine reconstruction."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import re
+import struct
+import subprocess
+import zipfile
+
+RECIPE = Path(__file__).resolve().parent
+
+
+def sha(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def git(root, *args):
+    return subprocess.check_output(["git", "-C", str(root), *args])
+
+
+def load_recipe():
+    lock = json.loads((RECIPE / "flutter-engine.lock.json").read_text(encoding="utf-8"))
+    if lock["schema"] != 1 or lock["engine"]["repository"] != "https://github.com/flutter-team-archive/engine.git":
+        raise ValueError("Unexpected engine source")
+    if lock["depot_tools"]["repository"] != "https://chromium.googlesource.com/chromium/tools/depot_tools.git":
+        raise ValueError("Unexpected depot-tools source")
+    if lock["buildroot"]["repository"] != "https://github.com/flutter/buildroot.git":
+        raise ValueError("Unexpected Flutter buildroot source")
+    for component in ("engine", "depot_tools", "buildroot"):
+        if not re.fullmatch(r"[0-9a-f]{40}", lock[component]["revision"]):
+            raise ValueError("Source must use a full immutable revision")
+    if lock["patch"]["file"] != "flutter-engine-windows.patch" or set(lock["patch"]["files"]) != {
+        "shell/platform/windows/flutter_windows_engine.cc", "fml/hex_codec.h", "build/archives/BUILD.gn"
+    }:
+        raise ValueError("Unexpected patch scope")
+    patch = RECIPE / lock["patch"]["file"]
+    if sha(patch) != lock["patch"]["sha256"]:
+        raise ValueError("Engine patch hash differs from reviewed recipe")
+    if lock["gn_arguments"] != ["--runtime-mode=release"] or lock["ninja_target"] != "flutter_windows.dll":
+        raise ValueError("Unexpected engine build arguments")
+    overrides = lock.get("dependency_overrides", {})
+    if set(overrides) != {"src/flutter/third_party/tinygltf"}:
+        raise ValueError("Unexpected engine dependency override")
+    tinygltf = overrides["src/flutter/third_party/tinygltf"]
+    if (tinygltf["repository"] != "https://github.com/syoyo/tinygltf.git"
+            or tinygltf["revision"] != "9bb5806df4055ac973b970ba5b3e27ce27d98148"):
+        raise ValueError("Dependency mirror override must preserve the original DEPS commit")
+    buildroot = lock["buildroot"]
+    if (buildroot["patch_file"] != "flutter-engine-buildroot.patch"
+            or set(buildroot["files"]) != {"build/toolchain/win/setup_toolchain.py", "build/config/compiler/BUILD.gn",
+                                         "build/toolchain/win/BUILD.gn"}
+            or sha(RECIPE / buildroot["patch_file"]) != buildroot["patch_sha256"]):
+        raise ValueError("Unexpected buildroot toolset-selection patch")
+    if lock.get("linker") != {
+        "path": "buildtools/windows-x64/clang/bin/lld-link.exe",
+        "source": "pinned-engine-DEPS-clang-package", "threads": 1,
+    }:
+        raise ValueError("Unexpected experimental engine linker")
+    if lock["windows_toolchain"] != {
+        "msvc_component": "Microsoft.VisualStudio.Component.VC.14.38.17.8.x86.x64",
+        "msvc_atl_component": "Microsoft.VisualStudio.Component.VC.14.38.17.8.ATL",
+        "msvc_tools_version": "14.38.33130", "vcvars_selector": "14.38",
+        "windows_sdk_version": "10.0.22621.0",
+    }:
+        raise ValueError("Unexpected Windows engine toolset")
+    return lock, patch
+
+
+def verify_checkout(engine, lock, patched):
+    engine = engine.resolve(strict=True)
+    if Path(git(engine, "rev-parse", "--show-toplevel").decode().strip()).resolve() != engine:
+        raise ValueError("Expected the engine repository root")
+    if git(engine, "rev-parse", "HEAD").decode().strip() != lock["engine"]["revision"]:
+        raise ValueError("Engine revision differs from reviewed source")
+    if git(engine, "diff", "--cached", "--name-only").strip():
+        raise ValueError("Engine has staged changes")
+    changed = set(git(engine, "diff", "--name-only").decode().splitlines())
+    if changed != (set(lock["patch"]["files"]) if patched else set()):
+        raise ValueError("Unexpected engine source modifications")
+    if sha(engine / "DEPS") != lock["engine"]["deps_sha256"]:
+        raise ValueError("Engine dependency recipe changed")
+    for name, expected in lock["patch"]["files"].items():
+        path = engine / name
+        if path.is_symlink() or sha(path) != expected["patched_sha256" if patched else "original_sha256"]:
+            raise ValueError("Engine source bytes changed: " + name)
+
+
+def apply_patch(engine):
+    lock, patch = load_recipe()
+    verify_checkout(engine, lock, False)
+    # Check all inputs before making any source change. Git applies the reviewed
+    # patch; profile fields and network content never supply executable commands.
+    subprocess.run(["git", "-C", str(engine), "apply", "--check", str(patch)], check=True)
+    subprocess.run(["git", "-C", str(engine), "apply", str(patch)], check=True)
+    verify_checkout(engine, lock, True)
+
+
+def verify_buildroot(root, lock, patched):
+    root = root.resolve(strict=True)
+    expected = lock["buildroot"]
+    if Path(git(root, "rev-parse", "--show-toplevel").decode().strip()).resolve() != root:
+        raise ValueError("Expected the Flutter buildroot repository root")
+    if git(root, "rev-parse", "HEAD").decode().strip() != expected["revision"]:
+        raise ValueError("Buildroot source revision changed")
+    if git(root, "diff", "--cached", "--name-only").strip():
+        raise ValueError("Buildroot has staged changes")
+    changed = set(git(root, "diff", "--name-only").decode().splitlines())
+    if changed != (set(expected["files"]) if patched else set()):
+        raise ValueError("Unexpected buildroot source modifications")
+    for name, hashes in expected["files"].items():
+        path = root / name
+        if path.is_symlink() or sha(path) != hashes["patched_sha256" if patched else "original_sha256"]:
+            raise ValueError("Buildroot source bytes changed: " + name)
+
+
+def patch_buildroot(root):
+    lock, _ = load_recipe()
+    verify_buildroot(root, lock, False)
+    patch = RECIPE / lock["buildroot"]["patch_file"]
+    subprocess.run(["git", "-C", str(root), "apply", "--check", str(patch)], check=True)
+    subprocess.run(["git", "-C", str(root), "apply", str(patch)], check=True)
+    verify_buildroot(root, lock, True)
+
+
+def verify_commands(path, lock):
+    commands = path.read_text(encoding="utf-8-sig").replace("\\", "/")
+    if "_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH" in commands:
+        raise ValueError("Compiler and standard-library compatibility checks must remain enabled")
+    msvc = set(re.findall(r'/VC/Tools/MSVC/([^/\s"]+)/', commands, re.IGNORECASE))
+    sdk = set(re.findall(r'/Windows Kits/10/(?:include|lib)/([^/\s"]+)/', commands, re.IGNORECASE))
+    if msvc != {lock["windows_toolchain"]["msvc_tools_version"]}:
+        raise ValueError("Generated compile/link commands do not use only the pinned MSVC toolset")
+    if sdk != {lock["windows_toolchain"]["windows_sdk_version"]}:
+        raise ValueError("Generated compile/link commands do not use only the pinned Windows SDK")
+    compiles = [line for line in commands.splitlines() if re.search(r'clang-cl(?:\.exe)?\b', line)]
+    if not compiles or any("/Brepro" not in line or "-fdebug-compilation-dir=." not in line for line in compiles):
+        raise ValueError("Generated compiler commands lack deterministic timestamp/path controls")
+    links = [line for line in commands.splitlines()
+             if re.search(r'/OUT:(?:\./)?flutter_windows\.dll(?:\s|$)', line, re.IGNORECASE)]
+    if len(links) != 1 or "flutter/" + lock["linker"]["path"] not in links[0]:
+        raise ValueError("Final engine command must use the pinned DEPS LLVM linker")
+
+
+def verify_link_response(path):
+    response = path.read_text(encoding="utf-8-sig")
+    for flag in ("/Brepro", "/PDBALTPATH:%_PDB%", "/INCREMENTAL:NO", "/threads:1"):
+        if flag.lower() not in response.lower().split():
+            raise ValueError("Final engine link lacks deterministic flag: " + flag)
+    switches = re.findall(r'/INCREMENTAL(?::(?:YES|NO))?(?=\s|$)', response, re.IGNORECASE)
+    if any(switch.lower() != "/incremental:no" for switch in switches):
+        raise ValueError("Incremental linking cannot be used for reproducible engine builds")
+    if any(switch.lower() != "/threads:1" for switch in re.findall(r'/threads:\S+', response, re.IGNORECASE)):
+        raise ValueError("Experimental engine linking requires a single integration thread")
+
+
+def package(build, output):
+    lock, patch = load_recipe()
+    engine = build / "checkout/src/flutter"
+    verify_checkout(engine, lock, True)
+    verify_buildroot(build / "checkout/src", lock, True)
+    verify_commands(build / "ninja-commands.txt", lock)
+    verify_link_response(build / "link-response.txt")
+    if git(build / "depot_tools", "rev-parse", "HEAD").decode().strip() != lock["depot_tools"]["revision"]:
+        raise ValueError("Depot-tools revision changed")
+    for name, expected in lock["dependency_overrides"].items():
+        dependency = build / "checkout" / name
+        if (git(dependency, "rev-parse", "HEAD").decode().strip() != expected["revision"]
+                or git(dependency, "config", "--get", "remote.origin.url").decode().strip() != expected["repository"]):
+            raise ValueError("Dependency source override changed: " + name)
+    if output.exists():
+        raise FileExistsError("Do not overwrite an existing engine result")
+    release = build / "checkout/src/out/host_release"
+    binaries = [release / ("flutter_windows.dll" + suffix) for suffix in ("", ".lib", ".pdb")]
+    for path in binaries:
+        if path.is_symlink() or not path.is_file() or not 0 < path.stat().st_size < 512 * 1024 * 1024:
+            raise ValueError("Missing or unsafe engine output: " + path.name)
+    dll = binaries[0].read_bytes()
+    if dll[:2] != b"MZ" or len(dll) < 64:
+        raise ValueError("Engine is not a Windows PE file")
+    pe = struct.unpack_from("<I", dll, 60)[0]
+    if (pe + 24 > len(dll) or dll[pe:pe + 4] != b"PE\0\0"
+            or struct.unpack_from("<H", dll, pe + 4)[0] != 0x8664
+            or not struct.unpack_from("<H", dll, pe + 22)[0] & 0x2000):
+        raise ValueError("Engine is not Windows x64")
+    for name in ("dependency-revisions.txt", "toolchain.json", "ninja-commands.txt", "link-response.txt"):
+        if not (build / name).is_file():
+            raise ValueError("Missing engine build evidence: " + name)
+    toolchain = json.loads((build / "toolchain.json").read_text(encoding="utf-8-sig"))
+    for field in ("msvc_tools_version", "windows_sdk_version"):
+        if toolchain[field] != lock["windows_toolchain"][field]:
+            raise ValueError("Recorded toolchain differs from reviewed recipe")
+    if (toolchain.get("linker_relative_path") != lock["linker"]["path"]
+            or toolchain.get("linker_sha256") != sha(engine / lock["linker"]["path"])):
+        raise ValueError("Recorded LLVM linker differs from the pinned engine package")
+    if not (release / "args.gn").is_file():
+        raise ValueError("Missing generated engine build arguments")
+    output.mkdir(parents=True)
+    archive = output / "windows-x64-release-source-built.zip"
+    with zipfile.ZipFile(archive, "x", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as zipped:
+        for path in sorted(binaries):
+            info = zipfile.ZipInfo(path.name, (1980, 1, 1, 0, 0, 0))
+            info.external_attr = 0o100644 << 16
+            info.compress_type = zipfile.ZIP_DEFLATED
+            zipped.writestr(info, path.read_bytes())
+    subprocess.run(["git", "-C", str(engine), "archive", "--format=zip",
+                    "--output=" + str((output / "FlutterEngine-original-source.zip").resolve()), "HEAD"], check=True)
+    subprocess.run(["git", "-C", str(build / "checkout/src"), "archive", "--format=zip",
+                    "--output=" + str((output / "FlutterBuildroot-original-source.zip").resolve()), "HEAD"], check=True)
+    for path in [RECIPE / "flutter-engine.lock.json", patch, Path(__file__),
+                 RECIPE / lock["buildroot"]["patch_file"], RECIPE / "Build-FlutterEngine.ps1",
+                 RECIPE / "Install-FlutterEngineToolchain.ps1", build / "dependency-revisions.txt",
+                 build / "toolchain.json", build / "ninja-commands.txt", build / "link-response.txt"]:
+        (output / path.name).write_bytes(path.read_bytes())
+    (output / "applied-source.patch").write_bytes(git(engine, "diff", "--binary", "--no-ext-diff"))
+    (output / "applied-buildroot.patch").write_bytes(git(build / "checkout/src", "diff", "--binary", "--no-ext-diff"))
+    (output / "args.gn").write_bytes((release / "args.gn").read_bytes())
+    (output / "gclient-config.txt").write_bytes((build / "checkout/.gclient").read_bytes())
+    workflow = RECIPE.parents[1] / ".github/workflows/swan-flutter-engine.yml"
+    (output / workflow.name).write_bytes(workflow.read_bytes())
+    result = {
+        "schema": 1, "engine_revision": lock["engine"]["revision"],
+        "depot_tools_revision": lock["depot_tools"]["revision"],
+        "buildroot_revision": lock["buildroot"]["revision"],
+        "msvc_tools_version": lock["windows_toolchain"]["msvc_tools_version"],
+        "archive_sha256": sha(archive),
+        "binary_files": {path.name: sha(path) for path in binaries},
+        "evidence_files": {path.name: sha(path) for path in output.iterdir() if path.is_file()},
+        "upstream_binary_match_verified": False, "independent_rebuild_verified": False,
+        "runtime_qualified": False, "production_approved": False,
+        "scope": "Source-built engine candidate only; does not replace the application workflow's pinned engine",
+    }
+    (output / "ENGINE-BUILD.json").write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
+    return result
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    patch_parser = sub.add_parser("patch")
+    patch_parser.add_argument("engine", type=Path)
+    root_parser = sub.add_parser("patch-buildroot")
+    root_parser.add_argument("root", type=Path)
+    command_parser = sub.add_parser("verify-commands")
+    command_parser.add_argument("commands", type=Path)
+    link_parser = sub.add_parser("verify-link-response")
+    link_parser.add_argument("response", type=Path)
+    package_parser = sub.add_parser("package")
+    package_parser.add_argument("build", type=Path)
+    package_parser.add_argument("output", type=Path)
+    args = parser.parse_args()
+    if args.command == "patch":
+        apply_patch(args.engine)
+        print("Reviewed engine source and patch hashes verified")
+    elif args.command == "patch-buildroot":
+        patch_buildroot(args.root)
+        print("Reviewed buildroot source and toolset-selection patch verified")
+    elif args.command == "verify-commands":
+        verify_commands(args.commands, load_recipe()[0])
+        print("Generated commands use the pinned Microsoft toolset and Windows SDK")
+    elif args.command == "verify-link-response":
+        verify_link_response(args.response)
+        print("Final engine link uses deterministic timestamp/path controls and excludes incremental linking")
+    else:
+        print(json.dumps(package(args.build, args.output)))
diff --git a/deployment/windows/flutter-engine-windows.patch b/deployment/windows/flutter-engine-windows.patch
new file mode 100644
index 00000000000..2aad2899a95
--- /dev/null
+++ b/deployment/windows/flutter-engine-windows.patch
@@ -0,0 +1,34 @@
+diff --git a/build/archives/BUILD.gn b/build/archives/BUILD.gn
+index 0e327b4..1178f34 100644
+--- a/build/archives/BUILD.gn
++++ b/build/archives/BUILD.gn
+@@ -253,8 +253,4 @@ if (host_os == "win") {
+         destination = "flutter_windows.dll"
+       },
+-      {
+-        source = "$root_out_dir/flutter_windows.dll.exp"
+-        destination = "flutter_windows.dll.exp"
+-      },
+       {
+         source = "$root_out_dir/flutter_windows.dll.lib"
+diff --git a/fml/hex_codec.h b/fml/hex_codec.h
+index 4de83fb..60be379 100644
+--- a/fml/hex_codec.h
++++ b/fml/hex_codec.h
+@@ -6,4 +6,5 @@
+ #define FLUTTER_FML_HEX_CODEC_H_
+
++#include <string>
+ #include <string_view>
+
+diff --git a/shell/platform/windows/flutter_windows_engine.cc b/shell/platform/windows/flutter_windows_engine.cc
+index 6962136..cb1799f 100644
+--- a/shell/platform/windows/flutter_windows_engine.cc
++++ b/shell/platform/windows/flutter_windows_engine.cc
+@@ -67,5 +67,5 @@ FlutterRendererConfig GetOpenGLRendererConfig() {
+       return false;
+     }
+-    return host->egl_manager()->render_context()->ClearCurrent();
++    return host->egl_manager()->render_context()->MakeCurrent();
+   };
+   config.open_gl.present = [](void* user_data) -> bool { FML_UNREACHABLE(); };
diff --git a/deployment/windows/flutter-engine.lock.json b/deployment/windows/flutter-engine.lock.json
new file mode 100644
index 00000000000..26bf682c6a9
--- /dev/null
+++ b/deployment/windows/flutter-engine.lock.json
@@ -0,0 +1,79 @@
+{
+  "schema": 1,
+  "engine": {
+    "repository": "https://github.com/flutter-team-archive/engine.git",
+    "revision": "db49896cf25ceabc44096d5f088d86414e05a7aa",
+    "tag_reference": "3.24.4",
+    "deps_sha256": "21defd97b8a7d8e28e9e6fc5b5b7d15f824b8c99f554f27676d433e9b4734b41"
+  },
+  "depot_tools": {
+    "repository": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
+    "revision": "580b4ff3f5cd0dcaa2eacda28cefe0f45320e8f7"
+  },
+  "patch": {
+    "file": "flutter-engine-windows.patch",
+    "sha256": "4e966e98d96e768145671e9efb6ff9af3407fdc9f609f35eaa41b9f5cb27528f",
+    "files": {
+      "shell/platform/windows/flutter_windows_engine.cc": {
+        "original_sha256": "28ca726b790daf49e7dbeddb212e54eb7932f6a795704e2058b4b53d42ea479c",
+        "patched_sha256": "638b0bbbfa2679781feaa072b57ad48e2794ad1e9c9b3da44908b1cfe08bad6e"
+      },
+      "fml/hex_codec.h": {
+        "original_sha256": "ccf41a4cf1a24e7b6a88af244542507d549b8aba02c4303fe8a47a36c5c922a8",
+        "patched_sha256": "cba92d82927832b3c7fb9c6727ba99e7d9d9b1777e80cd2d5b0b8557b69f26e8"
+      },
+      "build/archives/BUILD.gn": {
+        "original_sha256": "9fea9055c58fed94b91b3d5c1c5c6a7b1f3a46b46337d50fbf2f8d56e3ef48ca",
+        "patched_sha256": "0007c4ba5ecbd426904b18254808ceaaae01b6237f3f94f64a25a7a1a5078196"
+      }
+    }
+  },
+  "gn_arguments": [
+    "--runtime-mode=release"
+  ],
+  "ninja_target": "flutter_windows.dll",
+  "upstream_binary": {
+    "sha256": "ec8cabf36ee4ff24c8d98de25b00e70781eb03876265aee84d0fe554a110036e",
+    "source_to_binary_match_verified": false
+  },
+  "status": "Source reconstruction candidate; independent builds and runtime qualification required before replacing the pinned upstream engine",
+  "dependency_overrides": {
+    "src/flutter/third_party/tinygltf": {
+      "repository": "https://github.com/syoyo/tinygltf.git",
+      "revision": "9bb5806df4055ac973b970ba5b3e27ce27d98148",
+      "reason": "The Flutter mirror no longer exposes this exact DEPS commit; use the canonical upstream repository without changing the source revision."
+    }
+  },
+  "buildroot": {
+    "repository": "https://github.com/flutter/buildroot.git",
+    "revision": "e265c359126b24351f534080fb22edaa159f2215",
+    "patch_file": "flutter-engine-buildroot.patch",
+    "patch_sha256": "eb8cac7686ac7cb3e2595f3c6e4fc2d72fd6961d662f357f416caf0545535aaa",
+    "files": {
+      "build/toolchain/win/setup_toolchain.py": {
+        "original_sha256": "ee45bc284922f01b107aea6b31b7b5b5f81d33480acd4cbf0c516ff09f47a03c",
+        "patched_sha256": "0eb81ef45f71b803e0a04d99a90c024de4c53ec009099557ac59ebf762126cef"
+      },
+      "build/config/compiler/BUILD.gn": {
+        "original_sha256": "db1892df2c28b8b5b730467a777a3d722f2f3f07e81a902e691ee19b6264c9de",
+        "patched_sha256": "cb3d429220cae24978a9f96a3232d85ee6a3d798d2d4539e108203fbd5b87ca8"
+      },
+      "build/toolchain/win/BUILD.gn": {
+        "original_sha256": "26a00b317541f63d548bf605f5554a2b08580318fe79f052c5fcb67e0d1449db",
+        "patched_sha256": "ce1b14c0ba313771744ae28110503f03f19dc8971aa66adeabe55a1cab2e6c16"
+      }
+    }
+  },
+  "windows_toolchain": {
+    "msvc_component": "Microsoft.VisualStudio.Component.VC.14.38.17.8.x86.x64",
+    "msvc_tools_version": "14.38.33130",
+    "vcvars_selector": "14.38",
+    "windows_sdk_version": "10.0.22621.0",
+    "msvc_atl_component": "Microsoft.VisualStudio.Component.VC.14.38.17.8.ATL"
+  },
+  "linker": {
+    "path": "buildtools/windows-x64/clang/bin/lld-link.exe",
+    "source": "pinned-engine-DEPS-clang-package",
+    "threads": 1
+  }
+}
diff --git a/deployment/windows/generate-customer-msi.py b/deployment/windows/generate-customer-msi.py
new file mode 100644
index 00000000000..850dad6e940
--- /dev/null
+++ b/deployment/windows/generate-customer-msi.py
@@ -0,0 +1,137 @@
+"""Author a generic customer MSI from the complete pinned Flutter payload.
+
+Company profiles are never executable build input. Sign the final MSI separately.
+"""
+import argparse
+import hashlib
+import importlib.util
+import json
+from pathlib import Path
+import re
+import uuid
+import xml.etree.ElementTree as ET
+
+NAMESPACE = "http://wixtoolset.org/schemas/v4/wxs"
+UPGRADE = uuid.UUID("32a585d7-9a78-4ad2-af72-d0266efc709d")
+ET.register_namespace("", NAMESPACE)
+
+
+def element(parent, tag, **attributes):
+    return ET.SubElement(parent, "{" + NAMESPACE + "}" + tag, attributes)
+
+
+def identifier(kind, path):
+    return kind + hashlib.sha256(path.encode()).hexdigest()[:30]
+
+
+def author(source, agent, version):
+    if not re.fullmatch(r"(0|[1-9][0-9]{0,2})\.(0|[1-9][0-9]{0,2})\.(0|[1-9][0-9]{0,4})", version):
+        raise ValueError("Canonical major.minor.build version required")
+    if any(int(part) > limit for part, limit in zip(version.split("."), (255, 255, 65535))):
+        raise ValueError("MSI version exceeds 255.255.65535")
+    source = source.resolve(strict=True)
+    agent = agent.resolve(strict=True)
+    spec = importlib.util.spec_from_file_location("payload", Path(__file__).with_name("generate-payload-manifest.py"))
+    payload = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(payload)
+    files = payload.manifest("customer", source)
+    root = ET.Element("{" + NAMESPACE + "}Wix")
+    package = element(root, "Package", Name="Swan Remote Support", Manufacturer="Swan Remote Support", Version=version,
+                      ProductCode=str(uuid.uuid5(UPGRADE, "windows-x64|" + version)).upper(),
+                      UpgradeCode=str(UPGRADE).upper(), Scope="perMachine", InstallerVersion="500", Language="1033")
+    element(package, "MajorUpgrade", DowngradeErrorMessage="A newer Swan Remote Support version is already installed.", Schedule="afterInstallInitialize")
+    element(package, "MediaTemplate", EmbedCab="yes")
+    element(package, "Property", Id="ARPNOMODIFY", Value="1")
+    # Standard users cannot inspect the private agent keypath. An advertised
+    # shortcut mistakes that access denial for damage and starts MSI repair,
+    # bypassing the company setup wrapper's session and watcher coordination.
+    element(package, "Property", Id="DISABLEADVTSHORTCUTS", Value="1")
+    element(package, "SetProperty", Id="ARPINSTALLLOCATION", Value="[INSTALLFOLDER]", After="CostFinalize", Sequence="execute")
+    for prop, name, key in [("WINDOWSBUILD", "CurrentBuildNumber", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"),
+                            ("INSTALLATIONTYPE", "InstallationType", "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"),
+                            ("OSARCH", "PROCESSOR_ARCHITECTURE", "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment")]:
+        property_element = element(package, "Property", Id=prop)
+        element(property_element, "RegistrySearch", Id=prop+"Search", Root="HKLM", Key=key, Name=name, Type="raw", Bitness="always64")
+    element(package, "Launch", Condition='Installed OR (VersionNT64 AND OSARCH = "AMD64" AND WINDOWSBUILD >= 10240 AND (INSTALLATIONTYPE = "Client" OR INSTALLATIONTYPE = "Server"))',
+            Message="Windows 10/11 x64 or Windows Server with Desktop Experience is required.")
+    programs = element(package, "StandardDirectory", Id="ProgramFiles64Folder")
+    install = element(programs, "Directory", Id="INSTALLFOLDER", Name="Swan Remote Support")
+    directories = {"": install}
+    feature = element(package, "Feature", Id="Customer", Title="Customer support application", Level="1")
+    for file in files:
+        path = file["path"]
+        parts = path.split("/")
+        if any(not re.fullmatch(r"[A-Za-z0-9 _\-.@+]+", part) or part in (".", "..") or part.endswith((".", " ")) for part in parts):
+            raise ValueError("Unsupported payload path")
+        parent = ""
+        for name in parts[:-1]:
+            current = parent+"/"+name if parent else name
+            if current not in directories:
+                directories[current] = element(directories[parent], "Directory", Id=identifier("D", current), Name=name)
+            parent = current
+        component_id = identifier("C", path)
+        component = element(directories[parent], "Component", Id=component_id, Guid=str(uuid.uuid5(UPGRADE, path)).upper(), Bitness="always64")
+        original = source / ("rustdesk.exe" if path == "Swan Remote Support.exe" else path)
+        file_element = element(component, "File", Id=identifier("F", path), Name=parts[-1], Source=str(original), KeyPath="yes", Checksum="yes")
+        if path == "Swan Remote Support.exe":
+            element(component, "ServiceInstall", Id="CustomerService", Name="Swan Remote Support", DisplayName="Swan Remote Support", Type="ownProcess", Start="auto", ErrorControl="normal", Arguments="--service", Account="LocalSystem", Vital="yes")
+            element(component, "ServiceControl", Id="CustomerServiceControl", Name="Swan Remote Support", Start="install", Stop="both", Remove="uninstall", Wait="yes")
+            element(component, "CopyFile", Id="WindowsRuntimeBroker", SourceDirectory="System64Folder", SourceName="RuntimeBroker.exe", DestinationDirectory="INSTALLFOLDER", DestinationName="RuntimeBroker_rustdesk.exe")
+            element(component, "RemoveFile", Id="RemoveWindowsRuntimeBroker", Name="RuntimeBroker_rustdesk.exe", On="uninstall")
+            element(file_element, "Shortcut", Id="CustomerShortcut", Directory="ProgramMenuFolder", Name="Swan Remote Support", Advertise="yes", WorkingDirectory="INSTALLFOLDER")
+        element(feature, "ComponentRef", Id=component_id)
+    license_path = Path(__file__).resolve().parents[2] / "LICENCE"
+    if not any(file["path"].lower() == "license.txt" for file in files):
+        component_id = identifier("C", "LICENSE.txt")
+        component = element(install, "Component", Id=component_id, Guid=str(uuid.uuid5(UPGRADE, "LICENSE.txt")).upper(), Bitness="always64")
+        element(component, "File", Id=identifier("F", "LICENSE.txt"), Name="LICENSE.txt", Source=str(license_path), KeyPath="yes")
+        element(feature, "ComponentRef", Id=component_id)
+        files.append({"path": "LICENSE.txt", "sha256": hashlib.sha256(license_path.read_bytes()).hexdigest()})
+    registration = element(install, "Component", Id="CustomerMsiRegistration", Guid=str(uuid.uuid5(UPGRADE, "msi-registration")).upper(), Bitness="always64")
+    element(registration, "RegistryValue", Root="HKLM", Key="Software\\SwanRemoteSupport\\Customer", Name="ProductCode", Type="string", Value="[ProductCode]", KeyPath="yes")
+    element(feature, "ComponentRef", Id="CustomerMsiRegistration")
+    data = element(package, "StandardDirectory", Id="CommonAppDataFolder")
+    state = element(data, "Directory", Id="STATEFOLDER", Name="SwanRemoteSupport")
+    component = element(state, "Component", Id="ConfigurationAgent", Guid=str(uuid.uuid5(UPGRADE, "configuration-agent")).upper(), Bitness="always64")
+    element(component, "File", Id="ConfigurationAgentExe", Name="swan-agent.exe", Source=str(agent), KeyPath="yes")
+    element(feature, "ComponentRef", Id="ConfigurationAgent")
+    element(package, "Binary", Id="UninstallCommitAgent", SourceFile=str(agent))
+    element(package, "CustomAction", Id="PrepareCustomerState", BinaryRef="UninstallCommitAgent",
+            ExeCommand='prepare-customer-directory "[STATEFOLDER]."', Execute="deferred", Impersonate="no", Return="check")
+    element(package, "CustomAction", Id="RemoveCompanyConfigurationTask", BinaryRef="UninstallCommitAgent",
+            ExeCommand='remove-configuration-task "[STATEFOLDER]."', Execute="deferred", Impersonate="no", Return="check")
+    element(package, "CustomAction", Id="RestoreCompanyConfigurationTask", BinaryRef="UninstallCommitAgent",
+            ExeCommand='restore-configuration-task "[STATEFOLDER]."', Execute="rollback", Impersonate="no", Return="check")
+    element(package, "CustomAction", Id="CommitCompanyUninstall", BinaryRef="UninstallCommitAgent",
+            ExeCommand='commit-uninstall customer "[STATEFOLDER]."', Execute="commit", Impersonate="no", Return="check")
+    sequence = element(package, "InstallExecuteSequence")
+    element(sequence, "Custom", Action="PrepareCustomerState", Before="CreateFolders", Condition='NOT (REMOVE = "ALL")')
+    element(sequence, "Custom", Action="RestoreCompanyConfigurationTask", Before="RemoveCompanyConfigurationTask",
+            Condition='REMOVE = "ALL" AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY')
+    element(sequence, "Custom", Action="RemoveCompanyConfigurationTask", Before="RemoveFiles",
+            Condition='REMOVE = "ALL" AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY')
+    element(sequence, "Custom", Action="CommitCompanyUninstall", After="RemoveCompanyConfigurationTask",
+            Condition='REMOVE = "ALL" AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY')
+    return ET.ElementTree(root), files
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--source", type=Path, required=True)
+    parser.add_argument("--agent", type=Path, required=True)
+    parser.add_argument("--version", required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--manifest-output", type=Path)
+    args = parser.parse_args()
+    tree, files = author(args.source, args.agent, args.version)
+    ET.indent(tree, space="  ")
+    with args.output.open("xb") as stream:
+        tree.write(stream, encoding="utf-8", xml_declaration=True)
+    if args.manifest_output:
+        with args.manifest_output.open("x", encoding="utf-8") as stream:
+            json.dump(files, stream, indent=2)
+            stream.write("\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/windows/generate-payload-manifest.py b/deployment/windows/generate-payload-manifest.py
new file mode 100644
index 00000000000..0a6467c773d
--- /dev/null
+++ b/deployment/windows/generate-payload-manifest.py
@@ -0,0 +1,65 @@
+"""Generate release installed_files input after final binary signing.
+
+Unsigned CI output is only a draft and must be regenerated after signing.
+This script never signs metadata or executes payload files.
+"""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+
+def digest(file):
+    if file.stat().st_size > 512 * 1024 * 1024:
+        raise ValueError("Payload file exceeds limit")
+    with file.open("rb") as stream:
+        result = hashlib.sha256()
+        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+            result.update(chunk)
+        return result.hexdigest()
+
+
+def manifest(edition, source):
+    source = source.resolve(strict=True)
+    if edition == "technician":
+        if not source.is_file() or source.suffix.lower() != ".exe":
+            raise ValueError("Technician source must be the complete portable EXE")
+        return [{"path": "SwanRemoteSupport-Technician.exe", "sha256": digest(source)}]
+    if not source.is_dir():
+        raise ValueError("Customer source must be the final Flutter payload directory")
+    files = []
+    names = set()
+    for file in sorted(source.rglob("*")):
+        if file.is_symlink() or getattr(file.lstat(), "st_file_attributes", 0) & 0x400:
+            raise ValueError("Payload links are not allowed")
+        if not file.is_file():
+            continue
+        name = file.relative_to(source).as_posix()
+        if name.lower() == "rustdesk.exe":
+            name = "Swan Remote Support.exe"
+        if name.lower() in names or name.lower() == "runtimebroker_rustdesk.exe":
+            raise ValueError("Duplicate or Windows-owned payload file")
+        names.add(name.lower())
+        files.append({"path": name, "sha256": digest(file)})
+        if len(files) > 4096:
+            raise ValueError("Payload manifest exceeds limit")
+    if not {"swan remote support.exe", "librustdesk.dll", "flutter_windows.dll"} <= names:
+        raise ValueError("Required customer executable or native libraries missing")
+    return files
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--edition", choices=("customer", "technician"), required=True)
+    parser.add_argument("--source", type=Path, required=True)
+    parser.add_argument("--output", type=Path, required=True)
+    args = parser.parse_args()
+    files = manifest(args.edition, args.source)
+    with args.output.open("x", encoding="utf-8") as stream:
+        json.dump(files, stream, indent=2)
+        stream.write("\n")
+    print(f"Generated {len(files)} installed payload identities; metadata is unsigned.")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/windows/install-pinned-flutter.ps1 b/deployment/windows/install-pinned-flutter.ps1
new file mode 100644
index 00000000000..ad92b792f76
--- /dev/null
+++ b/deployment/windows/install-pinned-flutter.ps1
@@ -0,0 +1,38 @@
+param(
+    [Parameter(Mandatory=$true)][string]$Destination,
+    [string]$Archive,
+    [string]$ExpectedVersion='3.24.5'
+)
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+$version='3.24.5'
+$revision='dec2ee5c1f98f8e84a7d5380c05eb8a3d0a81668'
+$engine='a18df97ca57a249df5d8d68cd0820600223ce262'
+$sha256='b8a7485acd3c6fb23a76b7ac09f89e8d93d62fbff7147c6f5f8c5686d949eeac'
+# Pin from the publisher's releases_windows.json; never resolve a moving channel.
+$url='https://storage.googleapis.com/flutter_infra_release/releases/stable/windows/flutter_windows_3.24.5-stable.zip'
+if($ExpectedVersion -cne $version){throw 'Requested Flutter version differs from the pinned SDK'}
+$Destination=[IO.Path]::GetFullPath($Destination)
+if(Test-Path -LiteralPath $Destination){throw 'Refuse to overwrite an existing SDK destination'}
+if(-not(Test-Path -LiteralPath (Split-Path -Parent $Destination) -PathType Container)){throw 'SDK parent directory is missing'}
+if(-not $Archive){
+    $Archive=$Destination+'.zip'
+    if(Test-Path -LiteralPath $Archive){throw 'Existing SDK download must be inspected before retrying'}
+    Invoke-WebRequest -Uri $url -OutFile $Archive -MaximumRetryCount 2 -RetryIntervalSec 2
+}
+$Archive=[IO.Path]::GetFullPath($Archive)
+if((Get-FileHash -LiteralPath $Archive -Algorithm SHA256).Hash -ine $sha256){throw 'Pinned Flutter archive hash mismatch'}
+Expand-Archive -LiteralPath $Archive -DestinationPath $Destination
+$sdk=Join-Path $Destination 'flutter'
+$actual=(git -C $sdk rev-parse HEAD | Out-String).Trim()
+if($LASTEXITCODE -ne 0 -or $actual -cne $revision){throw 'Flutter SDK source revision differs from its pin'}
+if(([IO.File]::ReadAllText((Join-Path $sdk 'bin/internal/engine.version'))).Trim() -cne $engine){throw 'Flutter SDK engine revision differs from its pin'}
+if(-not(Test-Path -LiteralPath (Join-Path $sdk 'bin/cache/dart-sdk/bin/dart.exe') -PathType Leaf)){throw 'Pinned Dart SDK is missing'}
+$receipt=@{version=$version;framework_revision=$actual;engine_revision=$engine;archive_sha256=$sha256;archive_url=$url}
+$receipt|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $Destination 'sdk-identity.json') -Encoding utf8
+if($env:GITHUB_ENV){
+    Add-Content -LiteralPath $env:GITHUB_ENV -Value ('FLUTTER_ROOT='+$sdk) -Encoding utf8
+    Add-Content -LiteralPath $env:GITHUB_ENV -Value ('PUB_CACHE='+$Destination+'/.pub-cache') -Encoding utf8
+}
+if($env:GITHUB_PATH){Add-Content -LiteralPath $env:GITHUB_PATH -Value (Join-Path $sdk 'bin') -Encoding utf8}
+$receipt|ConvertTo-Json -Compress
diff --git a/deployment/windows/lab-restart-and-paused-updates-20261027.json b/deployment/windows/lab-restart-and-paused-updates-20261027.json
new file mode 100644
index 00000000000..63ff97ea32b
--- /dev/null
+++ b/deployment/windows/lab-restart-and-paused-updates-20261027.json
@@ -0,0 +1,115 @@
+{
+  "schema": 1,
+  "observed_utc": "2026-10-27T10:32:58.2410247Z",
+  "sources": {
+    "baseline_customer_151": "da0c621845057bed321a98a1886ef15891e431a9",
+    "installed_technician_152": "9ba592ca0431ce734a1edf7391aec183f5c100fa",
+    "candidate_153": "7bfce49aba857e035663f19cb25353828204e9c0"
+  },
+  "installed_pause_checks": {
+    "editions": [
+      {
+        "profile_revision": 5,
+        "identity_credential_consent_trust_preserved": true,
+        "release_sequence": 1,
+        "program_and_agent_hashes_unchanged": true,
+        "no_install_or_update_receipt": true,
+        "edition": "customer",
+        "credential_disclosed": false,
+        "actual_installed_updater_returned_false": true
+      },
+      {
+        "profile_revision": 5,
+        "identity_credential_consent_trust_preserved": true,
+        "release_sequence": 5,
+        "program_and_agent_hashes_unchanged": true,
+        "no_install_or_update_receipt": true,
+        "edition": "technician",
+        "credential_disclosed": false,
+        "actual_installed_updater_returned_false": true
+      }
+    ],
+    "utc": "2026-10-27T08:29:20.0006809Z",
+    "automatic_update_installation_tested": false,
+    "customer_and_worker_services_running": true,
+    "native_gui_startup_qualified": false
+  },
+  "windows10_full_restart": {
+    "result": "failed service auto-start acceptance",
+    "normal_restart_requested": true,
+    "force_reset": false,
+    "kernel_boot_changed": true,
+    "identity_credential_consent_trust_and_release_preserved": true,
+    "nonexportable_lab_signing_identity_retained": true,
+    "baseline_service_recovery": {
+      "credential_disclosed": false,
+      "identity_credential_consent_and_release_preserved": true,
+      "utc": "2026-10-27T10:32:58.2410247Z",
+      "replacement_153_not_yet_installed": true,
+      "cold_boot_pass": false,
+      "service_after": "Running",
+      "application_event_ids": [
+        1000
+      ],
+      "baseline_version": "1.5.1",
+      "manual_start_performed": true,
+      "system_event_ids": [
+        7000,
+        7009,
+        7000,
+        7000,
+        7009
+      ],
+      "service_before": "Stopped"
+    },
+    "startup_event_records_retained_privately": true,
+    "event_times_crossed_guest_clock_correction": true,
+    "historical_error_ids_not_all_attributed_to_latest_boot": true
+  },
+  "clock_validation": {
+    "host_external_https_time_agreed": true,
+    "guests": [
+      {
+        "application_expiry_checks_changed": false,
+        "before_utc": "2026-10-27T08:30:03.8637366Z",
+        "forward_two_hours": true,
+        "activation_action": false,
+        "guest": "SWAN-END-10B",
+        "host_clock_changed": false,
+        "after_utc": "2026-10-27T10:30:04.2722560Z"
+      },
+      {
+        "application_expiry_checks_changed": false,
+        "before_utc": "2026-10-27T10:30:08.6876199Z",
+        "forward_two_hours": false,
+        "activation_action": false,
+        "guest": "SWAN-END-19",
+        "host_clock_changed": false,
+        "after_utc": "2026-10-27T10:30:08.8166085Z"
+      }
+    ],
+    "clock_backdating": false,
+    "production_system_changed": false
+  },
+  "candidate_153": {
+    "first_workflow_run": 40468079337,
+    "first_workflow_conclusion": "success",
+    "archive_collection_still_running": true,
+    "independent_workflow_run": 40489196703,
+    "independent_rebuild_pending": true,
+    "installed_gui_and_cold_boot_retest_pending": true
+  },
+  "source_receipts": {
+    "server19-installed-paused-update-verified.json": "86f04e0022cebad5bfec131261c1171dcaa73d928804fe5a4058a1306e88b64e",
+    "win10-full-restart-request-returned.json": "79b7d697f0319302ecd0760013418b0e599b19cd743d5d570e31cb2f5143a8f8",
+    "win10-baseline-service-recovery-result.json": "5f7a3331ee8c9c8d97f0a3aa82d5aa32c9496d3e0ea1406223867e0fe4aa33cc",
+    "owned-guest-clock-alignment-20261027.json": "e4171ebcd45dcbcac13444f15f4315a60526f258c82d24ecee6f4e50fa89d746"
+  },
+  "limits": [
+    "The paused checks did not perform an automatic upgrade or interruption recovery.",
+    "The installed technician 1.5.2 GUI failure and withdrawal remain in force.",
+    "The baseline 1.5.1 service required manual recovery after a full Windows 10 restart.",
+    "Candidate 1.5.3 CI success is not proof of installed GUI startup, cold-boot service recovery, or a native session."
+  ],
+  "production_publication": false
+}
diff --git a/deployment/windows/local-https.js b/deployment/windows/local-https.js
new file mode 100644
index 00000000000..36b3195ce22
--- /dev/null
+++ b/deployment/windows/local-https.js
@@ -0,0 +1,34 @@
+// Local test TLS termination. PFX and password are private local environment data.
+const fs = require('node:fs');
+const https = require('node:https');
+const http = require('node:http');
+const envFile = process.argv[2];
+if (!envFile) throw new Error('Pass the ignored local-test.env path');
+const settings = {};
+for (const line of fs.readFileSync(envFile, 'utf8').split(/\r?\n/)) {
+  if (!line.trim() || line.trimStart().startsWith('#')) continue;
+  const match = /^([A-Z_]+)=(.*)$/.exec(line);
+  if (!match) throw new Error('Invalid local environment file');
+  settings[match[1]] = match[2];
+}
+if (!/^127\.0\.0\.1:\d+$/.test(settings.SWAN_LISTEN)) throw new Error('Management must use loopback');
+const port = Number(settings.SWAN_TEST_TLS_PORT);
+if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid local TLS port');
+const upstreamPort = Number(settings.SWAN_LISTEN.split(':')[1]);
+const server = https.createServer({
+  pfx: fs.readFileSync(settings.SWAN_TEST_TLS_PFX),
+  passphrase: settings.SWAN_TEST_TLS_PASSWORD,
+  minVersion: 'TLSv1.2',
+}, (request, response) => {
+  // Explicit, local-only test fault. No HTTP endpoint can control this switch.
+  if (settings.SWAN_TEST_FAULTS === '1' && fs.existsSync(require('node:path').join(settings.SWAN_DATA_DIR,'simulate-offline'))) {
+    response.writeHead(503,{'content-type':'application/json'});response.end('{"error":"Isolated test outage"}');return;
+  }
+  const upstream = http.request({hostname:'127.0.0.1', port:upstreamPort,
+    path:request.url, method:request.method, headers:{...request.headers, host:`localhost:${upstreamPort}`}}, result => {
+    response.writeHead(result.statusCode, result.headers); result.pipe(response);
+  });
+  upstream.on('error', () => {if (!response.headersSent) response.writeHead(502);response.end('Local management unavailable');});
+  request.on('aborted', () => upstream.destroy());request.pipe(upstream);
+});
+server.listen(port, '127.0.0.1', () => console.log(`Local HTTPS test listener: https://localhost:${port}`));
diff --git a/deployment/windows/local-test.env.example b/deployment/windows/local-test.env.example
new file mode 100644
index 00000000000..3dced8e003e
--- /dev/null
+++ b/deployment/windows/local-test.env.example
@@ -0,0 +1,5 @@
+# Copy to local-test.env. Actual machine settings and keys must stay out of Git.
+SWAN_LISTEN=127.0.0.1:18080
+SWAN_DATA_DIR=swan-data/local-test
+# Set a public release verification key before testing release import.
+SWAN_RELEASE_PUBLIC_KEY=
diff --git a/deployment/windows/msi/Technician.wxs b/deployment/windows/msi/Technician.wxs
new file mode 100644
index 00000000000..d77cff02e4a
--- /dev/null
+++ b/deployment/windows/msi/Technician.wxs
@@ -0,0 +1,45 @@
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="Swan Remote Support Technician" Manufacturer="Swan Remote Support" Version="$(var.Version)" ProductCode="$(var.ProductCode)" UpgradeCode="A4374699-436F-4917-9A4E-223F62A9E634" Scope="perUser" InstallerVersion="500" Language="1033">
+    <MajorUpgrade DowngradeErrorMessage="A newer Swan Remote Support Technician version is already installed." Schedule="afterInstallInitialize" />
+    <MediaTemplate EmbedCab="yes" />
+    <Binary Id="UninstallCommitAgent" SourceFile="$(var.AgentExe)" />
+    <CustomAction Id="CancelUpdateRecovery" BinaryRef="UninstallCommitAgent" ExeCommand="cancel-update-recovery &quot;[INSTALLFOLDER].&quot;" Execute="deferred" Impersonate="yes" Return="check" />
+    <CustomAction Id="RestoreUpdateRecovery" BinaryRef="UninstallCommitAgent" ExeCommand="restore-update-recovery &quot;[INSTALLFOLDER].&quot;" Execute="rollback" Impersonate="yes" Return="check" />
+    <CustomAction Id="CommitTechnicianUninstall" BinaryRef="UninstallCommitAgent" ExeCommand="commit-uninstall technician &quot;[INSTALLFOLDER].&quot;" Execute="commit" Impersonate="yes" Return="check" />
+    <InstallExecuteSequence>
+      <Custom Action="RestoreUpdateRecovery" Before="CancelUpdateRecovery" Condition="REMOVE = &quot;ALL&quot; AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY" />
+      <Custom Action="CancelUpdateRecovery" Before="RemoveFiles" Condition="REMOVE = &quot;ALL&quot; AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY" />
+      <Custom Action="CommitTechnicianUninstall" After="CancelUpdateRecovery" Condition="REMOVE = &quot;ALL&quot; AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY" />
+    </InstallExecuteSequence>
+    <Property Id="ARPNOMODIFY" Value="1" />
+    <Property Id="WINDOWSBUILD"><RegistrySearch Id="WindowsBuild" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion" Name="CurrentBuildNumber" Type="raw" Bitness="always64" /></Property>
+    <Property Id="INSTALLATIONTYPE"><RegistrySearch Id="InstallationType" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion" Name="InstallationType" Type="raw" Bitness="always64" /></Property>
+    <Property Id="OSARCH"><RegistrySearch Id="NativeArchitecture" Root="HKLM" Key="SYSTEM\CurrentControlSet\Control\Session Manager\Environment" Name="PROCESSOR_ARCHITECTURE" Type="raw" Bitness="always64" /></Property>
+    <Launch Condition="Installed OR (VersionNT64 AND OSARCH = &quot;AMD64&quot; AND WINDOWSBUILD &gt;= 10240 AND (INSTALLATIONTYPE = &quot;Client&quot; OR INSTALLATIONTYPE = &quot;Server&quot;))" Message="Windows 10/11 x64 or Windows Server with Desktop Experience is required." />
+    <StandardDirectory Id="LocalAppDataFolder">
+      <Directory Id="INSTALLFOLDER" Name="SwanRemoteSupport-Technician">
+        <Component Id="TechnicianExecutable" Guid="E2E2A30E-CC9D-5642-9553-BFB3191BF22E" Bitness="always64">
+          <File Id="TechnicianExe" Name="SwanRemoteSupport-Technician.exe" Source="$(var.TechnicianExe)" />
+          <RegistryValue Root="HKCU" Key="Software\SwanRemoteSupport\Technician" Name="Executable" Type="integer" Value="1" KeyPath="yes" />
+          <RemoveFolder Id="RemoveTechnicianFolder" On="uninstall" />
+        </Component>
+        <Component Id="ConfigurationAgent" Guid="5E8AE9B0-EA42-5C7B-B65C-A74560185608" Bitness="always64">
+          <File Id="AgentExe" Name="swan-agent.exe" Source="$(var.AgentExe)" />
+          <RegistryValue Root="HKCU" Key="Software\SwanRemoteSupport\Technician" Name="Agent" Type="integer" Value="1" KeyPath="yes" />
+        </Component>
+        <Component Id="TechnicianLauncher" Guid="9B9E9523-BABF-547E-8BC6-0D583818A384" Bitness="always64">
+          <File Id="Launcher" Name="Open-Technician.ps1" Source="$(var.Launcher)" />
+          <Shortcut Id="TechnicianShortcut" Directory="ProgramMenuFolder" Name="Swan Remote Support Technician" Target="[System64Folder]WindowsPowerShell\v1.0\powershell.exe" Arguments="-NoLogo -NoProfile -ExecutionPolicy Bypass -File &quot;[INSTALLFOLDER]Open-Technician.ps1&quot;" WorkingDirectory="INSTALLFOLDER" />
+          <RegistryValue Root="HKCU" Key="Software\SwanRemoteSupport\Technician" Name="Launcher" Type="integer" Value="1" KeyPath="yes" />
+        </Component>
+        <Component Id="LicenseNotice" Guid="5C987B06-E04B-5D27-A24B-2B8E139B697E" Bitness="always64">
+          <File Id="License" Name="LICENSE.txt" Source="$(var.License)" />
+          <RegistryValue Root="HKCU" Key="Software\SwanRemoteSupport\Technician" Name="License" Type="integer" Value="1" KeyPath="yes" />
+        </Component>
+      </Directory>
+    </StandardDirectory>
+    <Feature Id="Technician" Title="Technician application" Level="1">
+      <ComponentRef Id="TechnicianExecutable" /><ComponentRef Id="ConfigurationAgent" /><ComponentRef Id="TechnicianLauncher" /><ComponentRef Id="LicenseNotice" />
+    </Feature>
+  </Package>
+</Wix>
diff --git a/deployment/windows/native-49ced68-rebuild-comparison.json b/deployment/windows/native-49ced68-rebuild-comparison.json
new file mode 100644
index 00000000000..9a8cae0d8c9
--- /dev/null
+++ b/deployment/windows/native-49ced68-rebuild-comparison.json
@@ -0,0 +1,2128 @@
+{
+  "schema": 1,
+  "source_commit": "49ced6854f3cbaab84d95807e9bf342e11588f0f",
+  "source_date_epoch": 1792663292,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1143,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-components.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1143,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-components.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.0-customer-x64-unsigned.msi",
+      "first_sha256": "380ff4e7aa2d87c3514cd9ee30141886c3f465dcbdbffca79c57169f0415e890",
+      "second_sha256": "380ff4e7aa2d87c3514cd9ee30141886c3f465dcbdbffca79c57169f0415e890",
+      "first_bytes": 33619968,
+      "second_bytes": 33619968,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-technician-x64-unsigned.exe",
+      "first_sha256": "311046f974fdff39ae8a8e11986e773ab7e60c1872f6bbd2788f5c6e02d78148",
+      "second_sha256": "bf7df329e10c059efb204cbd3d132ed2ba9dba4c83749c4bffbd1234357ca41d",
+      "first_bytes": 24260096,
+      "second_bytes": 24260096,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-technician-x64-unsigned.msi",
+      "first_sha256": "4c52d73115a49b3cf51b07d8abd12a83c86fa7bed151c11146654bd2ddcad3c9",
+      "second_sha256": "d857815afb2dac4133a604aa9d3e91930cda93e8598c7d702534eecc5eebe2f5",
+      "first_bytes": 31338496,
+      "second_bytes": 31338496,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-x64-unsigned-install.exe",
+      "first_sha256": "311046f974fdff39ae8a8e11986e773ab7e60c1872f6bbd2788f5c6e02d78148",
+      "second_sha256": "bf7df329e10c059efb204cbd3d132ed2ba9dba4c83749c4bffbd1234357ca41d",
+      "first_bytes": 24260096,
+      "second_bytes": 24260096,
+      "identical": false
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "83fccbc602e033870eebc6b09eadec23994ddd1438b5231a4201db5a856a7169",
+      "second_sha256": "c6d2e215dcdad004103a9869712de1fbd5326f46b29bb501ff176776819d7529",
+      "first_bytes": 64245760,
+      "second_bytes": 64245760,
+      "identical": false
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "second_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "second_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "first_bytes": 8813056,
+      "second_bytes": 8813056,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "second_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "first_bytes": 4802048,
+      "second_bytes": 4802048,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": false,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 39760022829,
+      "run_attempt": 1,
+      "artifact": 12420272826,
+      "archive_digest": "sha256:c1ed67f599910d9d94e58caa1635761521c1f91d140fe3c435ea1716646710d8",
+      "bytes": 256166945
+    },
+    {
+      "workflow_run": 39769432105,
+      "run_attempt": 2,
+      "artifact": 12428807644,
+      "archive_digest": "sha256:d60b614b0df098233f27a1555c6d9f0510ed676ef27c7700204c371b447a38a5",
+      "bytes": 256166947
+    }
+  ],
+  "independent_rebuild_verified": false,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "39789394627"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-4c5accb-rebuild-comparison.json b/deployment/windows/native-4c5accb-rebuild-comparison.json
new file mode 100644
index 00000000000..ab5492766e4
--- /dev/null
+++ b/deployment/windows/native-4c5accb-rebuild-comparison.json
@@ -0,0 +1,2156 @@
+{
+  "schema": 1,
+  "source_commit": "4c5accb7ae73615c799a43fa70dc2a49aeed0822",
+  "source_date_epoch": 1792703512,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1157,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1157,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.1-customer-x64-unsigned.msi",
+      "first_sha256": "b7f98073f17e32d206e6026392f1f47f540adfc60a6dae5a5f03b75a634bdc5b",
+      "second_sha256": "b7f98073f17e32d206e6026392f1f47f540adfc60a6dae5a5f03b75a634bdc5b",
+      "first_bytes": 33611776,
+      "second_bytes": 33611776,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.exe",
+      "first_sha256": "cede4bad34a29a78a70d627b751e949b51db02cb95b324aaffa1173f2499fa0a",
+      "second_sha256": "cede4bad34a29a78a70d627b751e949b51db02cb95b324aaffa1173f2499fa0a",
+      "first_bytes": 24268800,
+      "second_bytes": 24268800,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.msi",
+      "first_sha256": "fb13e6f43656164b7d6d4f18601edb186e2f7d511791383e2a62fbd7e158acf8",
+      "second_sha256": "fb13e6f43656164b7d6d4f18601edb186e2f7d511791383e2a62fbd7e158acf8",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-x64-unsigned-install.exe",
+      "first_sha256": "cede4bad34a29a78a70d627b751e949b51db02cb95b324aaffa1173f2499fa0a",
+      "second_sha256": "cede4bad34a29a78a70d627b751e949b51db02cb95b324aaffa1173f2499fa0a",
+      "first_bytes": 24268800,
+      "second_bytes": 24268800,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "9190424b95f7df2b1de71e3db2febee9c0f64fa842a2ff0262888474e5827a80",
+      "second_sha256": "9190424b95f7df2b1de71e3db2febee9c0f64fa842a2ff0262888474e5827a80",
+      "first_bytes": 64247296,
+      "second_bytes": 64247296,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "030c230b9ed43eec3eb4b4b857dd77f626b0ffe3ccf81835f63a4bc932b2606a",
+      "second_sha256": "030c230b9ed43eec3eb4b4b857dd77f626b0ffe3ccf81835f63a4bc932b2606a",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "second_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "first_bytes": 8813056,
+      "second_bytes": 8813056,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "9624a05cae857d48d02270a7128992faa3522903801a7fce3cbbb32996f3ef12",
+      "second_sha256": "9624a05cae857d48d02270a7128992faa3522903801a7fce3cbbb32996f3ef12",
+      "first_bytes": 4826624,
+      "second_bytes": 4826624,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 39867952641,
+      "run_attempt": 1,
+      "artifact": 12467652430,
+      "archive_digest": "sha256:4c8388f1faf7c416e96834c975b72646d728ede8005c7132acdf28f50bb30cf7",
+      "bytes": 254512605
+    },
+    {
+      "workflow_run": 39867956814,
+      "run_attempt": 1,
+      "artifact": 12467476411,
+      "archive_digest": "sha256:58e48e54d33a4ebfe57e37d336c53bb6e8c993773d020fd23449a303855c3dd0",
+      "bytes": 254512609
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "39876756059"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-699c9e0-rebuild-comparison.json b/deployment/windows/native-699c9e0-rebuild-comparison.json
new file mode 100644
index 00000000000..6305a6a1c04
--- /dev/null
+++ b/deployment/windows/native-699c9e0-rebuild-comparison.json
@@ -0,0 +1,2152 @@
+{
+  "schema": 1,
+  "source_commit": "699c9e022ad71e4a409be52b56c9fe9697074bdf",
+  "source_date_epoch": 1792688872,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1155,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1155,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.1-customer-x64-unsigned.msi",
+      "first_sha256": "e9f96112c456c3d7a7a59eb95d64fb1c0571582b6c9233f25179b5cd3044d533",
+      "second_sha256": "e9f96112c456c3d7a7a59eb95d64fb1c0571582b6c9233f25179b5cd3044d533",
+      "first_bytes": 33619968,
+      "second_bytes": 33619968,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.exe",
+      "first_sha256": "524dc70ce1276e86ed03f967e0df1ea2702776ea9db88eb4cdb09b6be4a3bf54",
+      "second_sha256": "524dc70ce1276e86ed03f967e0df1ea2702776ea9db88eb4cdb09b6be4a3bf54",
+      "first_bytes": 24268288,
+      "second_bytes": 24268288,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.msi",
+      "first_sha256": "f09b59d42287b595548e6a894f6fb498f46106218d66fc6742e5f17eae8b8b4d",
+      "second_sha256": "f09b59d42287b595548e6a894f6fb498f46106218d66fc6742e5f17eae8b8b4d",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-x64-unsigned-install.exe",
+      "first_sha256": "524dc70ce1276e86ed03f967e0df1ea2702776ea9db88eb4cdb09b6be4a3bf54",
+      "second_sha256": "524dc70ce1276e86ed03f967e0df1ea2702776ea9db88eb4cdb09b6be4a3bf54",
+      "first_bytes": 24268288,
+      "second_bytes": 24268288,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "1ac3798acac6adbd7916b0e507870818735568251f89067a2b416f9de73a96d5",
+      "second_sha256": "1ac3798acac6adbd7916b0e507870818735568251f89067a2b416f9de73a96d5",
+      "first_bytes": 64247296,
+      "second_bytes": 64247296,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "second_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "second_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "first_bytes": 8813056,
+      "second_bytes": 8813056,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "second_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "first_bytes": 4802048,
+      "second_bytes": 4802048,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 39820151128,
+      "run_attempt": 1,
+      "artifact": 12448656126,
+      "archive_digest": "sha256:29feb0ff710c1e9b7dc7ff8a412a11b1a148d476390b279264be2aa816e72064",
+      "bytes": 254480079
+    },
+    {
+      "workflow_run": 39832811268,
+      "run_attempt": 1,
+      "artifact": 12454290734,
+      "archive_digest": "sha256:c183c7a7c93e3484208d5424791dcd111a0ff507a94b8f77410b936a95b63817",
+      "bytes": 254480469
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "39844492046"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-9e4ea6d-rebuild-comparison.json b/deployment/windows/native-9e4ea6d-rebuild-comparison.json
new file mode 100644
index 00000000000..2d3cb61d8d6
--- /dev/null
+++ b/deployment/windows/native-9e4ea6d-rebuild-comparison.json
@@ -0,0 +1,2140 @@
+{
+  "schema": 1,
+  "source_commit": "9e4ea6dfce7dc1e66eccf6e1068780a23ae8fd59",
+  "source_date_epoch": 1792671441,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1149,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1149,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.0-customer-x64-unsigned.msi",
+      "first_sha256": "9ebb1d8e56248b9b6005ed1a884ff29ec5edd8421b60b00253ec743e875cac48",
+      "second_sha256": "9ebb1d8e56248b9b6005ed1a884ff29ec5edd8421b60b00253ec743e875cac48",
+      "first_bytes": 33599488,
+      "second_bytes": 33599488,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-technician-x64-unsigned.exe",
+      "first_sha256": "029ad1c1d184d28e66d28ed85d1fdda29c3e1bb120d57d4dfb938afd1088ecc6",
+      "second_sha256": "9076eb18975037c70812f6808926aa915bb3e3154dee4f79c5010f6125956a66",
+      "first_bytes": 24270336,
+      "second_bytes": 24270336,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-technician-x64-unsigned.msi",
+      "first_sha256": "297265c102b0c94b5361c76b9873bc2b09fe3e76b2f98975a06b840452babeba",
+      "second_sha256": "06c2a2d41cbd3eb37669daad3a4526d0961e2d02f444976587f90a35101aaaa2",
+      "first_bytes": 31350784,
+      "second_bytes": 31350784,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-x64-unsigned-install.exe",
+      "first_sha256": "029ad1c1d184d28e66d28ed85d1fdda29c3e1bb120d57d4dfb938afd1088ecc6",
+      "second_sha256": "9076eb18975037c70812f6808926aa915bb3e3154dee4f79c5010f6125956a66",
+      "first_bytes": 24270336,
+      "second_bytes": 24270336,
+      "identical": false
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "30be82aec50f72404e9bf0e3e6d9bec53dfc636cec775ea3c4a264fbd7c0f33f",
+      "second_sha256": "30be82aec50f72404e9bf0e3e6d9bec53dfc636cec775ea3c4a264fbd7c0f33f",
+      "first_bytes": 64247296,
+      "second_bytes": 64247296,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "second_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "second_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "first_bytes": 8813056,
+      "second_bytes": 8813056,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "second_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "first_bytes": 4802048,
+      "second_bytes": 4802048,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": false,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 39777271372,
+      "run_attempt": 1,
+      "artifact": 12428888511,
+      "archive_digest": "sha256:831b85463fad70e75c1639bbe7b821d631a99ba66662d150cc23881175d93c43",
+      "bytes": 254432570
+    },
+    {
+      "workflow_run": 39789147510,
+      "run_attempt": 1,
+      "artifact": 12433926886,
+      "archive_digest": "sha256:fe5de2239c85abcde4491d51fa45de89b1c63839fc0142d6c6fba923f3f4270d",
+      "bytes": 254433503
+    }
+  ],
+  "independent_rebuild_verified": false,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "39800887785"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-d8fad20-rebuild-comparison.json b/deployment/windows/native-d8fad20-rebuild-comparison.json
new file mode 100644
index 00000000000..29532183b9f
--- /dev/null
+++ b/deployment/windows/native-d8fad20-rebuild-comparison.json
@@ -0,0 +1,2162 @@
+{
+  "schema": 1,
+  "source_commit": "d8fad20408281c5936425da0e37ccb7606f1d2f7",
+  "source_date_epoch": 1792771528,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1160,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1160,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.1-customer-x64-unsigned.msi",
+      "first_sha256": "148f5f23bf0c28645d1b1d5360987ca474678405bcb2e4b1fae7759a266fcd66",
+      "second_sha256": "148f5f23bf0c28645d1b1d5360987ca474678405bcb2e4b1fae7759a266fcd66",
+      "first_bytes": 33603584,
+      "second_bytes": 33603584,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.exe",
+      "first_sha256": "e7c4524b6432b3939d8fd1a1427da2b37eb7e6293c016450858f798af8db7001",
+      "second_sha256": "e7c4524b6432b3939d8fd1a1427da2b37eb7e6293c016450858f798af8db7001",
+      "first_bytes": 24271360,
+      "second_bytes": 24271360,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.msi",
+      "first_sha256": "12cc69bc9d79f246571341c2f2af03589ca8c810fe9a9fb3d5d4c2efc7c53325",
+      "second_sha256": "12cc69bc9d79f246571341c2f2af03589ca8c810fe9a9fb3d5d4c2efc7c53325",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-x64-unsigned-install.exe",
+      "first_sha256": "e7c4524b6432b3939d8fd1a1427da2b37eb7e6293c016450858f798af8db7001",
+      "second_sha256": "e7c4524b6432b3939d8fd1a1427da2b37eb7e6293c016450858f798af8db7001",
+      "first_bytes": 24271360,
+      "second_bytes": 24271360,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "87fb95f5412e53757daf6a7f95b5c94debc3400134eff4b307c780d03847bcfc",
+      "second_sha256": "87fb95f5412e53757daf6a7f95b5c94debc3400134eff4b307c780d03847bcfc",
+      "first_bytes": 64253952,
+      "second_bytes": 64253952,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "6f197e9b8581ff419acd60fa695421e1da85b0dd7b5850d0fc920abe8ad3224b",
+      "second_sha256": "6f197e9b8581ff419acd60fa695421e1da85b0dd7b5850d0fc920abe8ad3224b",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "f7e3c8cbb2b2a3bdd3dbe50f1ed61426921347b795104398a94536e902649656",
+      "second_sha256": "f7e3c8cbb2b2a3bdd3dbe50f1ed61426921347b795104398a94536e902649656",
+      "first_bytes": 8819712,
+      "second_bytes": 8819712,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "aeaa9b5c58ce7cbcd3ec71fd03ddec546fd32a9caa045a1fe040e206314b27ce",
+      "second_sha256": "aeaa9b5c58ce7cbcd3ec71fd03ddec546fd32a9caa045a1fe040e206314b27ce",
+      "first_bytes": 4833280,
+      "second_bytes": 4833280,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 39984444925,
+      "run_attempt": 1,
+      "artifact": 12517409127,
+      "archive_digest": "sha256:c67a287094a504220626c7f4d88a12e76fb67a607fdb4de955ffe68c240bc960",
+      "bytes": 254570815
+    },
+    {
+      "workflow_run": 39984452304,
+      "run_attempt": 1,
+      "artifact": 12519008217,
+      "archive_digest": "sha256:b6bb955cbf3a8d66503abec5f034a8854d60e974c0061b8df0a15602f880db62",
+      "bytes": 254570860
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "39995075014"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-da0c621-rebuild-comparison.json b/deployment/windows/native-da0c621-rebuild-comparison.json
new file mode 100644
index 00000000000..aa56ab59513
--- /dev/null
+++ b/deployment/windows/native-da0c621-rebuild-comparison.json
@@ -0,0 +1,2193 @@
+{
+  "schema": 1,
+  "source_commit": "da0c621845057bed321a98a1886ef15891e431a9",
+  "source_date_epoch": 1792793252,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1167,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1167,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37806.7",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.1-customer-x64-unsigned.msi",
+      "first_sha256": "ed1ee16b4898f6048b947ba47734fb0b504ac7edd30e788825835d0b99c1595c",
+      "second_sha256": "ed1ee16b4898f6048b947ba47734fb0b504ac7edd30e788825835d0b99c1595c",
+      "first_bytes": 33611776,
+      "second_bytes": 33611776,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.exe",
+      "first_sha256": "9b2f3c3648a604aebdf05115c2d334bed425a897101efc4d95c3ef38d1cf26ab",
+      "second_sha256": "9b2f3c3648a604aebdf05115c2d334bed425a897101efc4d95c3ef38d1cf26ab",
+      "first_bytes": 24270336,
+      "second_bytes": 24270336,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.msi",
+      "first_sha256": "71779cb97852e6e651581923e1b6db21a9fd9b4289a0e9234adac9eb78a464b2",
+      "second_sha256": "71779cb97852e6e651581923e1b6db21a9fd9b4289a0e9234adac9eb78a464b2",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-x64-unsigned-install.exe",
+      "first_sha256": "9b2f3c3648a604aebdf05115c2d334bed425a897101efc4d95c3ef38d1cf26ab",
+      "second_sha256": "9b2f3c3648a604aebdf05115c2d334bed425a897101efc4d95c3ef38d1cf26ab",
+      "first_bytes": 24270336,
+      "second_bytes": 24270336,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "51df25e3f45562e9326839b0ecee0424eb0b2dcefb275156435094b6cef9a0e2",
+      "second_sha256": "51df25e3f45562e9326839b0ecee0424eb0b2dcefb275156435094b6cef9a0e2",
+      "first_bytes": 64254464,
+      "second_bytes": 64254464,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "83f85b77c8ae2e1743414d992f2029ab8cb7254a533559ec111223ca4387a034",
+      "second_sha256": "83f85b77c8ae2e1743414d992f2029ab8cb7254a533559ec111223ca4387a034",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "8c81c66721871809b49940e2d00c4861d292dc61ff00dcd0fb2a891de27ac4eb",
+      "second_sha256": "8c81c66721871809b49940e2d00c4861d292dc61ff00dcd0fb2a891de27ac4eb",
+      "first_bytes": 8820224,
+      "second_bytes": 8820224,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "95fd203ea0dd0f1796660bf74218a7a242327ae2def4b595f414a85aa19caf23",
+      "second_sha256": "95fd203ea0dd0f1796660bf74218a7a242327ae2def4b595f414a85aa19caf23",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 40031742464,
+      "run_attempt": 1,
+      "artifact": 12538835584,
+      "archive_digest": "sha256:0cac6aee73d6098d90a773af5bdf3a136ea8219025d95bc216645b6ce5ee2d9d",
+      "bytes": 254647943
+    },
+    {
+      "workflow_run": 40031748532,
+      "run_attempt": 1,
+      "artifact": 12538975457,
+      "archive_digest": "sha256:243743b10e2f160df7cc51857df0095cd65a04e9d26852b9f53c8136746705b1",
+      "bytes": 254648174
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "4102bb36b02923bd12c297abf7d91c47bf638364",
+    "run": "40040238668"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-e9d89ca-rebuild-comparison.json b/deployment/windows/native-e9d89ca-rebuild-comparison.json
new file mode 100644
index 00000000000..e7ff6f1ad6e
--- /dev/null
+++ b/deployment/windows/native-e9d89ca-rebuild-comparison.json
@@ -0,0 +1,2152 @@
+{
+  "schema": 1,
+  "source_commit": "e9d89ca97319590905a39663b76718ee53bcdd78",
+  "source_date_epoch": 1792683613,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1155,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1155,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.0-customer-x64-unsigned.msi",
+      "first_sha256": "4faa16a9ca5fac82f932fcd6545dcbc7028718da91385729f254687ce56da1f0",
+      "second_sha256": "4faa16a9ca5fac82f932fcd6545dcbc7028718da91385729f254687ce56da1f0",
+      "first_bytes": 33599488,
+      "second_bytes": 33599488,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-technician-x64-unsigned.exe",
+      "first_sha256": "c1bc77b27b64405ee628a8e2a7da81bc878ef0b3cf3c3f7a6c849d4ad9c605d1",
+      "second_sha256": "c1bc77b27b64405ee628a8e2a7da81bc878ef0b3cf3c3f7a6c849d4ad9c605d1",
+      "first_bytes": 24268800,
+      "second_bytes": 24268800,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-technician-x64-unsigned.msi",
+      "first_sha256": "f9bf6db54580945e4f588a84e95fffc77632f2a43d7c80881485dc8342d3ac33",
+      "second_sha256": "f9bf6db54580945e4f588a84e95fffc77632f2a43d7c80881485dc8342d3ac33",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.0-x64-unsigned-install.exe",
+      "first_sha256": "c1bc77b27b64405ee628a8e2a7da81bc878ef0b3cf3c3f7a6c849d4ad9c605d1",
+      "second_sha256": "c1bc77b27b64405ee628a8e2a7da81bc878ef0b3cf3c3f7a6c849d4ad9c605d1",
+      "first_bytes": 24268800,
+      "second_bytes": 24268800,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "835abb8889db1494d61b849ebae42c514504ddea644cb9b64068f1dc01bae5a2",
+      "second_sha256": "835abb8889db1494d61b849ebae42c514504ddea644cb9b64068f1dc01bae5a2",
+      "first_bytes": 64247296,
+      "second_bytes": 64247296,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "second_sha256": "a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "second_sha256": "43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3",
+      "first_bytes": 8813056,
+      "second_bytes": 8813056,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "second_sha256": "2369d484bc34876e6e65fe06183654bc2fe2bd7ff9b66f3e37b9b8f288cf9d4b",
+      "first_bytes": 4802048,
+      "second_bytes": 4802048,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 39807079997,
+      "run_attempt": 1,
+      "artifact": 12441954299,
+      "archive_digest": "sha256:d1f38b6874964e8b8f44679c631a2833ddbc30546a279be37abee9466a9ff358",
+      "bytes": 254463644
+    },
+    {
+      "workflow_run": 39819129959,
+      "run_attempt": 1,
+      "artifact": 12448245525,
+      "archive_digest": "sha256:a0f47011f8b163c158b590c969ae18774e60b4fc24be18bdbf18e7e9a51a71b5",
+      "bytes": 254463955
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "39829786141"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-f84ffb0-rebuild-comparison.json b/deployment/windows/native-f84ffb0-rebuild-comparison.json
new file mode 100644
index 00000000000..90ca280ed1c
--- /dev/null
+++ b/deployment/windows/native-f84ffb0-rebuild-comparison.json
@@ -0,0 +1,2166 @@
+{
+  "schema": 1,
+  "source_commit": "f84ffb0b6577e494998d0ce95c4565906c33a321",
+  "source_date_epoch": 1792780218,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1162,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1162,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "flutter/lib/generated_bridge.dart": "0df68aa681e39ec769a23053bbcd9022bee09885e1a16b1dd7a26b28f6a8a38a",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "d7b339a3f2d8ef4ec4631f4d4e61f7aea695ba211b4ff8a227321e3eb7738c02",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/verify-reproducible-pe.py",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/components.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.1-customer-x64-unsigned.msi",
+      "first_sha256": "c65be3b7ffb57e097e9148e4c12c8545bc6fa618ce7cb00c15292a3b065aeef2",
+      "second_sha256": "cd3ab70088811bc4b604da70eec361b85c9cb93ee26294f7eae6399e9cb566f8",
+      "first_bytes": 33619968,
+      "second_bytes": 33615872,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.exe",
+      "first_sha256": "780774240c0fd73f28fbb46d1dca5975f046b333bf9bbd99f07589ec6b014aa1",
+      "second_sha256": "b83361889689c7655d3e34ac0f93348767a506898619ba1c4ae2f34ef2de0ef5",
+      "first_bytes": 24269312,
+      "second_bytes": 24269312,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-technician-x64-unsigned.msi",
+      "first_sha256": "2ca662f784c1112cca9df16bcfb1b44eb5739931c623294785889fc9a36ee69b",
+      "second_sha256": "e1b4b8f66b7d0e33b6da4c92fbd10b4fddc482096bd194366dd551989c0ea3c5",
+      "first_bytes": 31346688,
+      "second_bytes": 31346688,
+      "identical": false
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.1-x64-unsigned-install.exe",
+      "first_sha256": "780774240c0fd73f28fbb46d1dca5975f046b333bf9bbd99f07589ec6b014aa1",
+      "second_sha256": "b83361889689c7655d3e34ac0f93348767a506898619ba1c4ae2f34ef2de0ef5",
+      "first_bytes": 24269312,
+      "second_bytes": 24269312,
+      "identical": false
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "a8e21fcf5cd88e3caa29318b4fd07359da4c3dfc232993029c7be5ad55a60ff9",
+      "second_sha256": "a8e21fcf5cd88e3caa29318b4fd07359da4c3dfc232993029c7be5ad55a60ff9",
+      "first_bytes": 64254464,
+      "second_bytes": 64254464,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "83f85b77c8ae2e1743414d992f2029ab8cb7254a533559ec111223ca4387a034",
+      "second_sha256": "83f85b77c8ae2e1743414d992f2029ab8cb7254a533559ec111223ca4387a034",
+      "first_bytes": 5509632,
+      "second_bytes": 5509632,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "8c81c66721871809b49940e2d00c4861d292dc61ff00dcd0fb2a891de27ac4eb",
+      "second_sha256": "8c81c66721871809b49940e2d00c4861d292dc61ff00dcd0fb2a891de27ac4eb",
+      "first_bytes": 8820224,
+      "second_bytes": 8820224,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "95fd203ea0dd0f1796660bf74218a7a242327ae2def4b595f414a85aa19caf23",
+      "second_sha256": "95fd203ea0dd0f1796660bf74218a7a242327ae2def4b595f414a85aa19caf23",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": false,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 40003860186,
+      "run_attempt": 1,
+      "artifact": 12526383159,
+      "archive_digest": "sha256:9e450f89d14d2bbec9ea9505f44b57f42abc7b703c4e1a0eef71bf419b5b03cc",
+      "bytes": 254594073
+    },
+    {
+      "workflow_run": 40003868465,
+      "run_attempt": 1,
+      "artifact": 12526179090,
+      "archive_digest": "sha256:59c97d699ae543746cdd4093e58e37d4a55cc4715f93fb1b80e89ac24f50ef51",
+      "bytes": 254593593
+    }
+  ],
+  "independent_rebuild_verified": false,
+  "comparison_workflow": {
+    "source": "89039772db027868eecb4de3217fa3dbd9fb8c79",
+    "run": "40016176888"
+  }
+}
\ No newline at end of file
diff --git a/deployment/windows/native-f84ffb0-toolchain-observations.json b/deployment/windows/native-f84ffb0-toolchain-observations.json
new file mode 100644
index 00000000000..0f7f26e50a2
--- /dev/null
+++ b/deployment/windows/native-f84ffb0-toolchain-observations.json
@@ -0,0 +1,27 @@
+{
+  "scope": "Original full-build log observations; toolchain mismatch is not proven cause",
+  "jobs": [
+    {
+      "id": 120590002806,
+      "original_log_sha256": "09ee633cce4b13e2b234fc36576e9ff27ae072cf925fe4bc598724e2756fd491",
+      "observations": [
+        "2026-10-23T18:37:42.0968552Z Version: 20261021.618",
+        "2026-10-23T18:37:42.0984173Z Version: 20261021.343.1",
+        "2026-10-23T18:37:44.8607059Z Working directory is 'D:\\a\\SwanRemoteSupport\\SwanRemoteSupport'",
+        "2026-10-23T18:39:54.6240074Z     \u2022 Visual Studio Enterprise 2022 version 17.14.37806.7",
+        "2026-10-23T18:41:05.6050078Z Compiler found: C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/MSVC/14.44.35207/bin/Hostx64/x64/cl.exe"
+      ]
+    },
+    {
+      "id": 120590478599,
+      "original_log_sha256": "6b4688fc29e1237862bc0a36f6d692f88bb39ddcf7974719de143bb5742db8b3",
+      "observations": [
+        "2026-10-23T18:38:44.2005181Z Version: 20261012.601",
+        "2026-10-23T18:38:44.2013632Z Version: 20261012.333.1",
+        "2026-10-23T18:38:48.4416716Z Working directory is 'D:\\a\\SwanRemoteSupport\\SwanRemoteSupport'",
+        "2026-10-23T18:41:20.2925440Z     \u2022 Visual Studio Enterprise 2022 version 17.14.37710.0",
+        "2026-10-23T18:42:36.4486018Z Compiler found: C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/MSVC/14.44.35207/bin/Hostx64/x64/cl.exe"
+      ]
+    }
+  ]
+}
diff --git a/deployment/windows/patch-flutter-client-wrapper.py b/deployment/windows/patch-flutter-client-wrapper.py
new file mode 100644
index 00000000000..7bb690e0085
--- /dev/null
+++ b/deployment/windows/patch-flutter-client-wrapper.py
@@ -0,0 +1,114 @@
+"""Patch only the reviewed SDK reply callable; never normalize shipping binaries."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+ENGINE = "a18df97ca57a249df5d8d68cd0820600223ce262"
+ORIGINAL_SHA256 = "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989"
+PATCHED_SHA256 = "4ecdd3b3ace7672043ffbcddd157324915f21854d2c7885cbdaf73fdac6731a0"
+UPSTREAM = ("https://github.com/flutter/engine/blob/" + ENGINE
+            + "/shell/platform/common/client_wrapper/core_implementations.cc")
+
+# This type has external named linkage. An anonymous-namespace type would again
+# include a physical-source-path identifier in MSVC RTTI.
+NAMED_REPLY = r'''
+namespace internal {
+class SwanBinaryReplyHandler {
+ public:
+  SwanBinaryReplyHandler(
+      const std::shared_ptr<FlutterDesktopMessenger>& messenger,
+      const FlutterDesktopMessageResponseHandle* response_handle)
+      : messenger_(messenger), response_handle_(response_handle) {}
+
+  void operator()(const uint8_t* reply, size_t reply_size) {
+    auto lock = std::unique_ptr<FlutterDesktopMessenger,
+                               decltype(&FlutterDesktopMessengerUnlock)>(
+        FlutterDesktopMessengerLock(messenger_.get()),
+        &FlutterDesktopMessengerUnlock);
+    if (!FlutterDesktopMessengerIsAvailable(messenger_.get())) {
+      return;
+    }
+    if (!response_handle_) {
+      std::cerr << "Error: Response can be set only once. Ignoring "
+                   "duplicate response."
+                << std::endl;
+      return;
+    }
+    FlutterDesktopMessengerSendResponse(messenger_.get(), response_handle_,
+                                        reply, reply_size);
+    response_handle_ = nullptr;
+  }
+
+ private:
+  std::shared_ptr<FlutterDesktopMessenger> messenger_;
+  const FlutterDesktopMessageResponseHandle* response_handle_;
+};
+}  // namespace internal
+'''
+
+def transform(data):
+    # Only source line endings may be canonicalized; this is not a PE rewrite.
+    source = data.replace(b"\r\n", b"\n")
+    if hashlib.sha256(source).hexdigest() != ORIGINAL_SHA256:
+        raise ValueError("Flutter client-wrapper preimage differs from reviewed source")
+    text = source.decode("utf-8")
+    start = text.index("  BinaryReply reply_handler = [messenger_ptr, response_handle](")
+    end = text.index("\n  };", start) + len("\n  };")
+    replacement = ("  BinaryReply reply_handler =\n"
+                   "      internal::SwanBinaryReplyHandler(messenger_ptr, response_handle);")
+    text = text[:start] + replacement + text[end:]
+    marker = "namespace flutter {\n"
+    if text.count(marker) != 1:
+        raise ValueError("Unexpected Flutter wrapper namespace")
+    result = text.replace(marker, marker + NAMED_REPLY, 1).encode("utf-8")
+    if hashlib.sha256(result).hexdigest() != PATCHED_SHA256:
+        raise ValueError("Patched Flutter wrapper differs from reviewed output")
+    return result
+
+
+def patch(sdk, receipt):
+    if receipt.exists():
+        raise FileExistsError("Preserve the existing wrapper patch receipt")
+    if (sdk / "bin/internal/engine.version").read_text().strip() != ENGINE:
+        raise ValueError("Expected the pinned Flutter 3.24.5 SDK engine")
+    root = sdk / "bin/cache/artifacts/engine"
+    paths = sorted(root.rglob("core_implementations.cc"))
+    if not 1 <= len(paths) <= 4:
+        raise ValueError("Expected a bounded set of cached client-wrapper sources")
+    changes = []
+    for path in paths:
+        for ancestor in (path, *path.parents):
+            if ancestor == sdk.parent:
+                break
+            if ancestor.is_symlink() or getattr(ancestor, "is_junction", lambda: False)():
+                raise ValueError("Unexpected wrapper source link")
+        if "cpp_client_wrapper" not in path.parts:
+            raise ValueError("Unexpected wrapper source location")
+        original = path.read_bytes()
+        patched = transform(original)
+        changes.append((path, patched, hashlib.sha256(original).hexdigest()))
+    # Validate every input before writing any SDK source.
+    for path, patched, _ in changes:
+        path.write_bytes(patched)
+    result = {"engine_revision": ENGINE, "upstream": UPSTREAM,
+              "original_canonical_sha256": ORIGINAL_SHA256,
+              "patch_script_sha256": hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),
+              "files": [{"path": path.relative_to(sdk).as_posix(),
+                         "original_sha256": original,
+                         "patched_sha256": hashlib.sha256(patched).hexdigest()}
+                        for path, patched, original in changes],
+              "engine_binaries_changed": False, "shipping_pe_normalization": False,
+              "full_native_reproduction_and_runtime_required": True}
+    receipt.parent.mkdir(parents=True, exist_ok=True)
+    with receipt.open("x", encoding="utf-8") as output:
+        json.dump(result, output, indent=2)
+    return result
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--sdk", required=True, type=Path)
+    parser.add_argument("--receipt", required=True, type=Path)
+    arguments = parser.parse_args()
+    print(json.dumps(patch(arguments.sdk, arguments.receipt), indent=2))
diff --git a/deployment/windows/prepare-customer-exe.py b/deployment/windows/prepare-customer-exe.py
new file mode 100644
index 00000000000..bcd2053c3de
--- /dev/null
+++ b/deployment/windows/prepare-customer-exe.py
@@ -0,0 +1,158 @@
+"""Stage pinned corresponding source and an exact, already signed customer payload.
+
+This is a release-maintainer tool, not an installer-worker profile command.
+It never executes source, payload files, or downloaded tools.
+"""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import stat
+import zipfile
+
+
+def safe_path(name):
+    path = PurePosixPath(name)
+    if (not name or name != path.as_posix() or path.is_absolute() or "\\" in name or ":" in name
+            or any(part in (".", "..") or part.endswith((" ", "."))
+                   or any(ord(c) < 32 for c in part) for part in path.parts)):
+        raise ValueError("Unsafe package path")
+    reserved = {"CON", "PRN", "AUX", "NUL"} | {
+        prefix + str(i) for prefix in ("COM", "LPT") for i in range(1, 10)}
+    if any(part.split(".")[0].upper() in reserved for part in path.parts):
+        raise ValueError("Windows-reserved package path")
+    return path
+
+
+def load_payload(source, manifest):
+    if source.is_symlink() or getattr(source.lstat(), "st_file_attributes", 0) & 0x400:
+        raise ValueError("Payload root must not be a link")
+    expected = {}
+    for item in manifest:
+        if set(item) != {"path", "sha256"} or not re.fullmatch(r"[0-9a-f]{64}", item["sha256"]):
+            raise ValueError("Invalid installed payload manifest")
+        name = safe_path(item["path"]).as_posix()
+        if name.casefold() in {n.casefold() for n in expected}:
+            raise ValueError("Duplicate installed payload path")
+        expected[name] = item["sha256"]
+    if not 3 <= len(expected) <= 4096:
+        raise ValueError("Unexpected customer payload count")
+    actual = {}
+    total = 0
+    for file in sorted(source.rglob("*")):
+        if file.is_symlink() or getattr(file.lstat(), "st_file_attributes", 0) & 0x400:
+            raise ValueError("Payload links are not allowed")
+        if not file.is_file():
+            continue
+        name = safe_path(file.relative_to(source).as_posix()).as_posix()
+        installed = "Swan Remote Support.exe" if name == "rustdesk.exe" else name
+        if installed not in expected or installed in actual:
+            raise ValueError("Unexpected customer payload file")
+        total += file.stat().st_size
+        if file.stat().st_size > 128 * 1024**2 or total > 512 * 1024**2:
+            raise ValueError("Customer payload exceeds limits")
+        data = file.read_bytes()
+        if hashlib.sha256(data).hexdigest() != expected[installed]:
+            raise ValueError("Signed payload hash differs: " + installed)
+        # The native installer copies the payload directory without renaming
+        # its main executable. Stage its stable installed name before packing.
+        actual[installed] = (installed, data)
+    if set(actual) != set(expected) or not {
+            "Swan Remote Support.exe", "librustdesk.dll", "flutter_windows.dll"} <= set(actual):
+        raise ValueError("Incomplete customer payload")
+    return actual
+
+
+def prepare(archive, archive_sha256, revision, source, manifest, work):
+    if not re.fullmatch(r"[0-9a-f]{64}", archive_sha256) or not re.fullmatch(r"[0-9a-f]{40}", revision):
+        raise ValueError("Exact archive and public source pins are required")
+    with archive.open("rb") as stream:
+        if hashlib.file_digest(stream, "sha256").hexdigest() != archive_sha256:
+            raise ValueError("Corresponding source archive hash differs")
+    payload = load_payload(source, manifest)
+    staged = {}
+    with zipfile.ZipFile(archive) as z:
+        metadata = json.loads(z.read("BUILD-SOURCE.json"))
+        if metadata["repositories"]["."] != revision:
+            raise ValueError("Corresponding source revision differs")
+        epoch = metadata["source_date_epoch"]
+        if not isinstance(epoch, int) or not 315532800 <= epoch <= 4102444799:
+            raise ValueError("Invalid source date epoch")
+        expected = metadata["files"]
+        if not 3 <= len(expected) <= 20000:
+            raise ValueError("Invalid corresponding source manifest size")
+        names = z.namelist()
+        if len(names) != len(set(names)) or set(names) != {
+                "BUILD-SOURCE.json"} | {"source/" + name for name in expected}:
+            raise ValueError("Source archive has undeclared or duplicate entries")
+        total = 0
+        folded = set()
+        for entry in z.infolist():
+            if entry.filename == "BUILD-SOURCE.json":
+                continue
+            name = entry.filename[len("source/"):]
+            path = safe_path(name)
+            if (entry.is_dir() or stat.S_ISLNK(entry.external_attr >> 16)
+                    or name.casefold() in folded or entry.file_size > 64 * 1024**2):
+                raise ValueError("Unsafe corresponding source entry")
+            folded.add(name.casefold())
+            total += entry.file_size
+            if total > 256 * 1024**2:
+                raise ValueError("Corresponding source exceeds size limit")
+            data = z.read(entry)
+            if hashlib.sha256(data).hexdigest() != expected[name]["sha256"]:
+                raise ValueError("Corresponding source file hash differs")
+            staged[path.as_posix()] = data
+    required = {"Cargo.toml", "Cargo.lock", ".cargo/config.toml", "libs/portable/Cargo.toml",
+                "libs/portable/generate.py", "libs/portable/build.rs", "res/icon.ico", "res/manifest.xml"}
+    if not required <= set(staged):
+        raise ValueError("Incomplete portable packer corresponding source")
+    work.mkdir(exist_ok=False)
+    for root, entries in ((work / "source", staged),
+                          (work / "payload", {name: data for name, data in payload.values()})):
+        for name, data in entries.items():
+            target = root / name
+            target.parent.mkdir(parents=True, exist_ok=True)
+            with target.open("xb") as output:
+                output.write(data)
+            os.utime(target, (epoch, epoch))
+    # Match the portable-installer resource transformation in the native build
+    # workflow; do not accept resource edits or commands from company profiles.
+    resource = work / "source/res/manifest.xml"
+    resource_before = resource.read_bytes()
+    resource_after = b"".join(line for line in resource_before.splitlines(keepends=True)
+                              if b"dpiAware" not in line)
+    resource.write_bytes(resource_after)
+    os.utime(resource, (epoch, epoch))
+    record = {"source_revision": revision, "source_archive_sha256": archive_sha256,
+              "source_date_epoch": epoch, "payload_files": len(payload),
+              "main_sha256": hashlib.sha256(payload["Swan Remote Support.exe"][1]).hexdigest(),
+              "payload_manifest": manifest, "source_files": len(staged),
+              "portable_manifest_transform": {
+                  "operation": "remove dpiAware lines, matching the native portable build workflow",
+                  "before_sha256": hashlib.sha256(resource_before).hexdigest(),
+                  "after_sha256": hashlib.sha256(resource_after).hexdigest()},
+              "executables_run": False}
+    (work / "payload-manifest.json").write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
+    (work / "prepared.json").write_text(json.dumps(record, indent=2) + "\n", encoding="utf-8")
+    return record
+
+
+def main():
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument("--source-archive", type=Path, required=True)
+    p.add_argument("--source-sha256", required=True)
+    p.add_argument("--source-revision", required=True)
+    p.add_argument("--payload", type=Path, required=True)
+    p.add_argument("--payload-manifest", type=Path, required=True)
+    p.add_argument("--work-directory", type=Path, required=True)
+    a = p.parse_args()
+    record = prepare(a.source_archive, a.source_sha256, a.source_revision, a.payload,
+                     json.loads(a.payload_manifest.read_text(encoding="utf-8-sig")), a.work_directory)
+    print(json.dumps({k: v for k, v in record.items() if k != "payload_manifest"}))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/windows/select-engine-candidate.py b/deployment/windows/select-engine-candidate.py
new file mode 100644
index 00000000000..672a530cc09
--- /dev/null
+++ b/deployment/windows/select-engine-candidate.py
@@ -0,0 +1,88 @@
+"""Select the reviewed experimental engine without replacing the SDK compiler."""
+import argparse
+import hashlib
+import io
+import json
+from pathlib import Path
+import zipfile
+
+ARCHIVE_SHA256 = "96a19e1b2f838e11a375235c29ada407adcff5e4e124c60f0bc54eb527e8c978"
+BINARIES = {
+    "flutter_windows.dll": "8f6153cb66e9dd6cb354c94089e8c00fa6f3041b50bc593c275b4cb55f8a1a07",
+    "flutter_windows.dll.lib": "b8bd040e25393a103caaff762f3a95ab48d4f96c09c03dcd6cec9f01d8acca00",
+    "flutter_windows.dll.pdb": "7542bcc7cf7ef96d08fed1a2a4b5082932def0f68f933c01eaeba7f9c1893cb0",
+}
+SNAPSHOT_VERSION = b"80a49c7111088100a233b2ae788e1f48"
+SDK_ENGINE = "a18df97ca57a249df5d8d68cd0820600223ce262"
+
+
+def select(candidate, sdk, receipt, source_candidate="source-candidate-9f97ef0"):
+    if source_candidate == "source-candidate-9f97ef0":
+        archive_sha256, binaries = ARCHIVE_SHA256, BINARIES
+        source_commit, workflow_run, artifact = "9f97ef0053d822bcf5cf3f5f03bf5dc571247d16", 39716739857, 12401286693
+        independent_runs = []
+    elif source_candidate == "source-candidate-05d5369":
+        archive_sha256 = "2c84aedf35e0a93a86013b0c4903450dc740e4c8d049d971ed31b214e3b60500"
+        binaries = {
+            "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+            "flutter_windows.dll.lib": "f7183633a4053b822ad6e353484c76528ffe98242cbe5bef04923ca40373eafc",
+            "flutter_windows.dll.pdb": "64317fb6c9248d35fd3b2ed4c72147d44676b27c3d17bee0e74b986942abe521",
+        }
+        source_commit, workflow_run, artifact = "05d5369c04804b9a9b2dc06df0cb85b0efe6f274", 39753153773, 12416969754
+        independent_runs = [39753153773, 39761977920]
+    else:
+        raise ValueError("Unknown source engine candidate")
+    if receipt.exists():
+        raise FileExistsError("Do not overwrite candidate selection evidence")
+    if (sdk / "bin/internal/engine.version").read_text().strip() != SDK_ENGINE:
+        raise ValueError("Expected the reviewed Flutter 3.24.5 SDK")
+    target = sdk / "bin/cache/artifacts/engine/windows-x64-release"
+    compiler = target / "gen_snapshot.exe"
+    compiler_bytes = compiler.read_bytes()
+    if SNAPSHOT_VERSION not in compiler_bytes:
+        raise ValueError("SDK snapshot compiler is incompatible with the candidate engine")
+    data = (candidate / "windows-x64-release-source-built.zip").read_bytes()
+    if hashlib.sha256(data).hexdigest() != archive_sha256:
+        raise ValueError("Candidate archive differs from the reviewed build")
+    with zipfile.ZipFile(io.BytesIO(data)) as archive:
+        if len(archive.infolist()) != 3 or set(archive.namelist()) != set(binaries):
+            raise ValueError("Unexpected candidate engine files")
+        files = {name: archive.read(name) for name in binaries}
+    for name, content in files.items():
+        if hashlib.sha256(content).hexdigest() != binaries[name]:
+            raise ValueError("Candidate engine hash mismatch: " + name)
+        if (target / name).is_symlink():
+            raise ValueError("Engine destination cannot be a symlink")
+    if SNAPSHOT_VERSION not in files["flutter_windows.dll"]:
+        raise ValueError("Candidate runtime snapshot version is incompatible")
+    # Validate the complete input before changing the disposable SDK cache.
+    # Keep its matching gen_snapshot and SDK snapshots; do not copy arbitrary ZIP entries.
+    for name, content in files.items():
+        (target / name).write_bytes(content)
+    if compiler.read_bytes() != compiler_bytes:
+        raise ValueError("SDK compiler changed during engine selection")
+    result = {
+        "source_commit": source_commit,
+        "workflow_run": workflow_run, "artifact": artifact,
+        "archive_sha256": archive_sha256, "binary_files": binaries,
+        "independent_rebuild_verified": bool(independent_runs),
+        "independent_rebuild_runs": independent_runs,
+        "sdk_engine_revision": SDK_ENGINE,
+        "snapshot_compiler_sha256": hashlib.sha256(compiler_bytes).hexdigest(),
+        "snapshot_version": SNAPSHOT_VERSION.decode(),
+        "runtime_qualified": False, "production_approved": False,
+        "scope": "Experimental native rebuild using the source engine and matching SDK snapshot compiler",
+    }
+    receipt.parent.mkdir(parents=True, exist_ok=True)
+    receipt.write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
+    return result
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--candidate", required=True, type=Path)
+    parser.add_argument("--sdk", required=True, type=Path)
+    parser.add_argument("--receipt", required=True, type=Path)
+    parser.add_argument("--source-candidate", choices=("source-candidate-9f97ef0", "source-candidate-05d5369"), default="source-candidate-9f97ef0")
+    args = parser.parse_args()
+    print(json.dumps(select(args.candidate, args.sdk, args.receipt, args.source_candidate), indent=2))
diff --git a/deployment/windows/server-compiler.json b/deployment/windows/server-compiler.json
new file mode 100644
index 00000000000..7cdaa801a45
--- /dev/null
+++ b/deployment/windows/server-compiler.json
@@ -0,0 +1,14 @@
+{
+  "schema": 1,
+  "id": "Microsoft.Net.Compilers.Toolset.Framework",
+  "version": "4.12.0",
+  "url": "https://api.nuget.org/v3-flatcontainer/microsoft.net.compilers.toolset.framework/4.12.0/microsoft.net.compilers.toolset.framework.4.12.0.nupkg",
+  "sha256": "df03cf2ff2c60acab3041b07503252d98b723a2c9afb4f417926699a14f27baf",
+  "sha512_base64": "vRBKKe8CJIVhFIUIAab5BKqbfe9I8uoGHan3hFGXDojLo5ywU/xuEr10NiKVS1hE2LvuKxUuWkOFoAhTsgolxA==",
+  "catalog": "https://api.nuget.org/v3/registration5-gz-semver2/microsoft.net.compilers.toolset.framework/4.12.0.json",
+  "source": "https://github.com/dotnet/roslyn/commit/dfa7fc6bdea31a858a402168384192b633c811fa",
+  "license": "MIT",
+  "compiler": "tasks/net472/csc.exe",
+  "compiler_sha256": "48fc3f6dbd905197a6c46b46ce02e230bae2b2862eec59879b62553797999b85",
+  "build_runtime": ".NET Framework 4.7.2 or newer"
+}
diff --git a/deployment/windows/server-components.json b/deployment/windows/server-components.json
new file mode 100644
index 00000000000..4f0af7bc2dd
--- /dev/null
+++ b/deployment/windows/server-components.json
@@ -0,0 +1,28 @@
+{
+  "schema": 2,
+  "architecture": "x86_64",
+  "transport": {
+    "kind": "swan-maintained-source-build",
+    "source": "https://github.com/rustdesk/rustdesk-server/tree/9bae9f2f39d92c4b4ba2e28e089da5071897b22e",
+    "binary_sha256": {
+      "hbbs.exe": "2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be",
+      "hbbr.exe": "97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0"
+    },
+    "source_files": 140,
+    "source_tree_sha256": "c0d40c3b122dfe740fbea5946f3bba9fb67734b57e80c8b7fb4ee3cdcef85541",
+    "files": [
+      "hbbs.exe",
+      "hbbr.exe"
+    ],
+    "qualification": "Unsigned test installer integration only; original candidate recipe provenance remains immutable."
+  },
+  "https": {
+    "source": "https://github.com/caddyserver/caddy/tree/v2.10.2",
+    "url": "https://github.com/caddyserver/caddy/releases/download/v2.10.2/caddy_2.10.2_windows_amd64.zip",
+    "sha256": "9fd1ef9be5d9b05852b66ccc25f96f23d8651bcab20779861a745bdffa273722",
+    "files": [
+      "caddy.exe"
+    ],
+    "binary_sha256": "586d4a4cd74bdfd2951b6b81766a32904ffa69c4f1c3d521da3870a2120f1d31"
+  }
+}
diff --git a/deployment/windows/server-references.json b/deployment/windows/server-references.json
new file mode 100644
index 00000000000..910fe25ecc2
--- /dev/null
+++ b/deployment/windows/server-references.json
@@ -0,0 +1,26 @@
+{
+  "schema": 1,
+  "framework": {
+    "id": "Microsoft.NETFramework.ReferenceAssemblies.net462",
+    "version": "1.0.3",
+    "url": "https://api.nuget.org/v3-flatcontainer/microsoft.netframework.referenceassemblies.net462/1.0.3/microsoft.netframework.referenceassemblies.net462.1.0.3.nupkg",
+    "sha256": "ee692a845743500910855d4c330ca6e9ef87c16e16f740e4474d187185d66e21",
+    "sha512_base64": "HMn0QQmPYcJsVuKet9WA8IQbBweZvc7US88N39itSRqcn/1XOT/Kao1QiiykxU+vx8k7/zim11cVmKtunju4MA==",
+    "reference_files": {
+      "build/.NETFramework/v4.6.2/mscorlib.dll": "f8b1e8838944f96ea36b670b32a54c0eb0eca3743946363acc676d1d7ef893b0",
+      "build/.NETFramework/v4.6.2/System.Core.dll": "8debc6f7136250f07a8cb8a576de71bdbe7e9618b6c70abc8a5f7a98222671a3",
+      "build/.NETFramework/v4.6.2/System.dll": "19359fe1fdef82d265afdd0f1ba15e978795ea483a63e6f2881f993bd20bbd65",
+      "build/.NETFramework/v4.6.2/System.Security.dll": "e6b195bc118a7b447643ab3f514c47c8243f5b405e843e99311df3ae6355de15"
+    }
+  },
+  "powershell": {
+    "id": "Microsoft.PowerShell.5.ReferenceAssemblies",
+    "version": "1.1.0",
+    "url": "https://api.nuget.org/v3-flatcontainer/microsoft.powershell.5.referenceassemblies/1.1.0/microsoft.powershell.5.referenceassemblies.1.1.0.nupkg",
+    "sha256": "2bc5ab45f20bfa5d9d141611cf8b68c23a8d94371f01bcea65e5f71a86deea45",
+    "sha512_base64": "uOCntmxGwdTiBLQ5JX2+2tbixdw3H7I+5TjZRjpcqaw7ptuBJIlN4frXN6snywNDoqRl0Fs42Y+I6pB/CLBbgQ==",
+    "reference_files": {
+      "lib/net4/System.Management.Automation.dll": "c3a5868584a777422cebcf31d6718fd2b26d5e2314d3b5ba6d8e47aa40faba0c"
+    }
+  }
+}
diff --git a/deployment/windows/server19-company-peer-https-evidence.json b/deployment/windows/server19-company-peer-https-evidence.json
new file mode 100644
index 00000000000..4214fc2abe3
--- /dev/null
+++ b/deployment/windows/server19-company-peer-https-evidence.json
@@ -0,0 +1,31 @@
+{
+  "date": "2026-10-26",
+  "scope": "Existing company deployment reached from separate newly installed WindowsServer2019 x64 lab VM using normal HTTPS validation and isolated lab DNS. This is a network/trust check, not native client qualification.",
+  "maintenance": {
+    "private_lab_https_binding_verified": true,
+    "company_https_healthy": true,
+    "device_identity_and_consent_preserved": true,
+    "host_settings_unchanged": true,
+    "rollback_backup_retained": true
+  },
+  "peer": {
+    "profile_https_status": 200,
+    "certificate_validation_enabled": true,
+    "unauthenticated_inventory_status": 401,
+    "tls_private_key_transferred": false,
+    "profile_signature_verified_against_original_pin": true,
+    "company_identity_matches_original_bundle": true,
+    "profile_revision": 18,
+    "profile_currently_time_valid": true,
+    "updates_remain_paused": true,
+    "native_enrollment_or_sessions_tested": false
+  },
+  "private_original_record_sha256": "cf456ce025963449a82d57971e0249e434cfbf0ecebede529f0e404ef848eb8a",
+  "limitations": [
+    "Public CA material was explicitly trusted and isolated lab DNS configured on the disposable guest; this does not establish Internet DNS, public ACME or public reachability.",
+    "The saved lab transport profile points to parallel-test ports without active parallel listeners; installed transport components use their normal ports. Transport testing remains open.",
+    "No native device enrollment, technician login, direct/relay session or update rollout was exercised.",
+    "Machine-specific addresses, configuration and keys remain outside the repository."
+  ],
+  "full_product_acceptance": false
+}
diff --git a/deployment/windows/service-bootstrap-tests/CMakeLists.txt b/deployment/windows/service-bootstrap-tests/CMakeLists.txt
new file mode 100644
index 00000000000..edf0ce0c92b
--- /dev/null
+++ b/deployment/windows/service-bootstrap-tests/CMakeLists.txt
@@ -0,0 +1,24 @@
+cmake_minimum_required(VERSION 3.20)
+project(SwanServiceBootstrapChecks LANGUAGES CXX)
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+set(bootstrap "${CMAKE_CURRENT_SOURCE_DIR}/../../../flutter/windows/runner")
+
+foreach(name bootstrap-check bootstrap-timeout-check)
+  add_executable(${name} WIN32 main.cpp "${bootstrap}/service_bootstrap.cpp")
+  target_include_directories(${name} PRIVATE "${bootstrap}")
+  target_link_libraries(${name} PRIVATE advapi32 shell32)
+  target_compile_definitions(${name} PRIVATE UNICODE _UNICODE)
+endforeach()
+target_compile_definitions(bootstrap-check PRIVATE
+  "SWAN_SERVICE_BOOTSTRAP_NAME=L\"SwanLabBootstrapFixture\"")
+target_compile_definitions(bootstrap-timeout-check PRIVATE
+  "SWAN_SERVICE_BOOTSTRAP_NAME=L\"SwanLabBootstrapTimeoutFixture\""
+  SWAN_SERVICE_BOOTSTRAP_TIMEOUT_MS=10000)
+
+foreach(name core-fast core-slow core-timeout core-missing-export)
+  add_library(${name} SHARED core.cpp)
+endforeach()
+target_compile_definitions(core-slow PRIVATE BOOTSTRAP_TEST_DELAY_MS=35000)
+target_compile_definitions(core-timeout PRIVATE BOOTSTRAP_TEST_DELAY_MS=30000)
+target_compile_definitions(core-missing-export PRIVATE BOOTSTRAP_TEST_MISSING_EXPORT)
diff --git a/deployment/windows/service-bootstrap-tests/core.cpp b/deployment/windows/service-bootstrap-tests/core.cpp
new file mode 100644
index 00000000000..592dd0e710f
--- /dev/null
+++ b/deployment/windows/service-bootstrap-tests/core.cpp
@@ -0,0 +1,46 @@
+#include <windows.h>
+#include <atomic>
+#include <cstdint>
+
+// This DLL tests the loader/service boundary only. It has no remote-control,
+// network, company-profile, enrollment or authorization implementation.
+namespace {
+std::atomic<HANDLE> stop_event{nullptr};
+}
+
+BOOL WINAPI DllMain(HINSTANCE, DWORD reason, void*) {
+#ifdef BOOTSTRAP_TEST_DELAY_MS
+  if (reason == DLL_PROCESS_ATTACH) Sleep(BOOTSTRAP_TEST_DELAY_MS);
+#endif
+  return TRUE;
+}
+
+#ifndef BOOTSTRAP_TEST_MISSING_EXPORT
+extern "C" __declspec(dllexport) uint32_t __cdecl swan_service_bootstrap(
+    int(__cdecl* report)(uint32_t, uint32_t)) {
+  HANDLE event = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+  if (!event) return GetLastError();
+  stop_event.store(event, std::memory_order_release);
+  if (!report(SERVICE_RUNNING, ERROR_SUCCESS)) return GetLastError();
+  const DWORD wait = WaitForSingleObject(event, 60000);
+  const DWORD result = wait == WAIT_OBJECT_0 ? ERROR_SUCCESS : ERROR_TIMEOUT;
+  report(SERVICE_STOPPED, result);
+  // Keep the event valid until process exit; a final control callback can race.
+  return result;
+}
+#endif
+
+extern "C" __declspec(dllexport) uint32_t __cdecl swan_service_control(uint32_t control) {
+  if (control == SERVICE_CONTROL_INTERROGATE) return NO_ERROR;
+  HANDLE event = stop_event.load(std::memory_order_acquire);
+  if (control == SERVICE_CONTROL_STOP && event) {
+    return SetEvent(event) ? NO_ERROR : GetLastError();
+  }
+  return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+// A core with only the legacy ABI must be rejected, rather than recursively
+// attempting to connect a second service dispatcher.
+extern "C" __declspec(dllexport) char** __cdecl rustdesk_core_main_args(int*) {
+  return nullptr;
+}
diff --git a/deployment/windows/service-bootstrap-tests/main.cpp b/deployment/windows/service-bootstrap-tests/main.cpp
new file mode 100644
index 00000000000..69fed7870e3
--- /dev/null
+++ b/deployment/windows/service-bootstrap-tests/main.cpp
@@ -0,0 +1,8 @@
+#include <windows.h>
+#include "service_bootstrap.h"
+
+int WINAPI wWinMain(HINSTANCE, HINSTANCE, wchar_t*, int) {
+  int code = 0;
+  if (RunSwanServiceIfRequested(&code)) return code;
+  return 7;  // The real desktop entry point is deliberately absent in this fixture.
+}
diff --git a/deployment/windows/test-company-lifecycle.js b/deployment/windows/test-company-lifecycle.js
new file mode 100644
index 00000000000..7ac82f25a2d
--- /dev/null
+++ b/deployment/windows/test-company-lifecycle.js
@@ -0,0 +1,122 @@
+// Real local HTTPS/API and built-agent integration. Requires a fresh test server.
+// This does not substitute for native remote desktop or clean-machine tests.
+const fs=require('node:fs'), path=require('node:path'), https=require('node:https');
+const crypto=require('node:crypto'), assert=require('node:assert/strict');
+const {spawnSync,spawn}=require('node:child_process');
+const root=path.resolve(__dirname,'../..');
+const envFile=process.argv[2];
+if(!envFile)throw new Error('Pass a private local-test.env file for a fresh isolated server');
+const settings={};
+for(const line of fs.readFileSync(envFile,'utf8').split(/\r?\n/)){
+  if(!line.trim()||line.trimStart().startsWith('#'))continue;
+  const match=/^([A-Z_]+)=(.*)$/.exec(line);if(!match)throw new Error('Invalid test environment data');
+  settings[match[1]]=match[2];
+}
+assert.match(settings.SWAN_LISTEN??'',/^127\.0\.0\.1:\d+$/);
+assert(settings.SWAN_DATA_DIR,'A separate test data directory is required');
+const data=path.resolve(settings.SWAN_DATA_DIR);
+const binaryDirectory=process.argv[3]?path.resolve(process.argv[3]):path.join(root,'product/target/debug');
+const agent=path.join(binaryDirectory,'swan-agent.exe');
+const ca=new crypto.X509Certificate(fs.readFileSync(path.join(data,'localhost.cer'))).toString();
+const port=Number(settings.SWAN_TEST_TLS_PORT);assert(Number.isInteger(port)&&port>=1024&&port<=65535);
+const base=`https://localhost:${port}`;
+const alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+function base32(bytes){let bits=0,value=0,result='';for(const byte of bytes){value=(value<<8)|byte;bits+=8;while(bits>=5){result+=alphabet[(value>>>(bits-5))&31];bits-=5;}}if(bits)result+=alphabet[(value<<(5-bits))&31];return result;}
+function decode32(text){let bits=0,value=0,result=[];for(const c of text.replace(/=/g,'')){value=(value<<5)|alphabet.indexOf(c);bits+=5;if(bits>=8){result.push((value>>>(bits-8))&255);bits-=8;}}return Buffer.from(result);}
+function totp(secret,offset=0){const step=BigInt(Math.floor(Date.now()/30000)+offset);const counter=Buffer.alloc(8);counter.writeBigUInt64BE(step);const hash=crypto.createHmac('sha1',decode32(secret)).update(counter).digest();const pos=hash[19]&15;return String((hash.readUInt32BE(pos)&0x7fffffff)%1000000).padStart(6,'0');}
+function api(endpoint,method='GET',token,body){return new Promise((resolve,reject)=>{
+  const bytes=body===undefined?null:Buffer.from(JSON.stringify(body));
+  const request=https.request(base+'/api/v1/'+endpoint,{method,ca,headers:{'content-type':'application/json',...(token?{authorization:'Bearer '+token}:{}),...(bytes?{'content-length':bytes.length}:{})}},response=>{
+    const chunks=[];response.on('data',chunk=>chunks.push(chunk));response.on('end',()=>{try{resolve({status:response.statusCode,body:JSON.parse(Buffer.concat(chunks))});}catch(error){reject(error);}});
+  });request.on('error',reject);if(bytes)request.write(bytes);request.end();
+});}
+function runAgent(directory,args,extra={}){const result=spawnSync(agent,args,{env:{...process.env,SWAN_STATE_DIR:directory,SWAN_TEST_CA_FILE:path.join(data,'localhost.cer'),...extra},encoding:'utf8',timeout:30000});assert.equal(result.status,0,`Agent ${args[0]} failed: ${result.stderr}`);return result.stdout;}
+function state(directory){return JSON.parse(fs.readFileSync(path.join(directory,'managed-state.json')));}
+async function main(){
+  const status=(await api('status')).body;assert.equal(status.configured,false,'Refuse to change an already configured test company');
+  const password=crypto.randomBytes(24).toString('hex'), secret=base32(crypto.randomBytes(20));
+  const brand={display_name:'Local Test Company Support',primary_color:'#007F82',logo_svg:'',support_url:base,consent_text:'Local test support requires approval.'};
+  const transport=crypto.generateKeyPairSync('ed25519').publicKey.export({type:'spki',format:'der'}).subarray(-32).toString('base64');
+  const profile={schema:1,company_id:'setup',revision:1,issued_at:Math.floor(Date.now()/1000),expires_at:Math.floor(Date.now()/1000)+3600,management_url:base,rendezvous:'localhost:22116',relay:'localhost:22117',transport_public_key:transport,customer:brand,technician:{...brand,display_name:'Local Test Technician'},allow_unattended:true,updates_paused:true,rollout_percent:100,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:'test',next_profile_public_key:null};
+  const setup=await api('setup','POST',fs.readFileSync(path.join(data,'setup-token.txt'),'utf8').trim(),{profile,username:'test-admin',password,totp_secret:secret,totp_code:totp(secret)});assert.equal(setup.status,200);
+  fs.writeFileSync(path.join(data,'test-admin.private.json'),JSON.stringify({username:'test-admin',password,totp_secret:secret}));
+  const login=await api('login','POST',null,{username:'test-admin',password,totp_code:totp(secret,1)});assert.equal(login.status,200);const admin=login.body.token;
+  if(settings.SWAN_TEST_CA_FILE){
+    assert.equal((await api('network/check','POST')).status,401,'Unauthenticated network diagnostics accepted');
+    const diagnostics=await api('network/check','POST',admin,{management_url:'https://unconfigured.invalid'});
+    assert.equal(diagnostics.status,200);assert.equal(diagnostics.body.management_url,base,'Probe used an unconfigured request target');
+    assert.equal(diagnostics.body.https_and_company_signature_valid,true,'Configured HTTPS company trust check failed');
+    assert.equal(diagnostics.body.vantage_point,'company_server');assert.equal(diagnostics.body.tcp_checks.length,3);
+    assert.equal(diagnostics.body.external_reachability_verified,false);assert.equal(diagnostics.body.udp_reachability_verified,false);
+  }
+  const signed=(await api('profile')).body;const current=JSON.parse(Buffer.from(signed.payload,'base64'));
+  const bootstrap={schema:1,edition:'customer',company_id:current.company_id,management_url:base,profile_public_key:status.profile_public_key,release_public_key:''};
+  const customerDir=path.join(data,'customer-agent'), techDir=path.join(data,'technician-agent');
+  const customerBootstrap=path.join(data,'customer-bootstrap.json');fs.writeFileSync(customerBootstrap,JSON.stringify(bootstrap));
+  runAgent(customerDir,['setup',customerBootstrap,'--accept-company']);runAgent(customerDir,['enroll','Local HTTPS test device','987654321']);
+  const customer=state(customerDir);assert.equal(customer.unattended_consent,false);
+  runAgent(customerDir,['verify-bootstrap',customerBootstrap]);
+  runAgent(customerDir,['enroll','Local HTTPS test device','987654321']);
+  assert.equal(state(customerDir).device_id,customer.device_id);assert.equal(state(customerDir).device_token,customer.device_token);
+  assert.throws(()=>runAgent(customerDir,['enroll','Different identity','987654322']),'Repair replaced transport identity');
+  const proof=crypto.generateKeyPairSync('ed25519').publicKey.export({type:'spki',format:'der'}).subarray(-32).toString('base64');
+  const ticket={device_id:customer.device_id,proof_public_key:proof,unattended:false};
+  assert.equal((await api('grants','POST',admin,ticket)).status,403,'Pending device was accessible');
+  assert.equal((await api(`devices/${customer.device_id}/state`,'PUT',admin,{state:'approved',group:'test-customers'})).status,200);
+  const technicianPassword=crypto.randomBytes(24).toString('hex');
+  const technician=(await api('users','POST',admin,{username:'test-technician',password:technicianPassword,role:'technician'})).body;
+  const techBootstrap=path.join(data,'technician-bootstrap.json');fs.writeFileSync(techBootstrap,JSON.stringify({...bootstrap,edition:'technician'}));runAgent(techDir,['setup',techBootstrap,'--accept-company']);
+  const technicianLogin=JSON.parse(runAgent(techDir,['login','test-technician'],{SWAN_LOGIN_PASSWORD:technicianPassword,SWAN_LOGIN_TOTP:totp(technician.totp_secret)}));
+  const auth={SWAN_TECHNICIAN_TOKEN:technicianLogin.token};assert.equal(JSON.parse(runAgent(techDir,['devices'],auth)).length,0,'Technician without group access saw device');
+  assert.equal((await api(`groups/test-customers/users/${technician.id}`,'PUT',admin,{})).status,200);
+  assert.equal(JSON.parse(runAgent(techDir,['devices'],auth)).length,1);
+  runAgent(customerDir,['allow-unattended','--confirm-unattended']);assert.equal(state(customerDir).unattended_consent,true);
+  if(settings.SWAN_TEST_FAULTS==='1') {
+    assert.equal((await api('grants','POST',admin,{...ticket,unattended:true})).status,200,'Enabled consent did not authorize unattended request');
+    const outage=path.join(data,'simulate-offline');fs.writeFileSync(outage,'local test outage');
+    try {runAgent(customerDir,['revoke-unattended']);assert.equal(state(customerDir).unattended_consent,false,'Offline revoke was not durable');}
+    finally {fs.unlinkSync(outage);}
+    assert.equal((await api('grants','POST',admin,{...ticket,unattended:true})).status,200,'Outage did not leave server consent unsynchronized');
+    const watcher=spawn(agent,['watch'],{env:{...process.env,SWAN_STATE_DIR:customerDir,SWAN_TEST_CA_FILE:path.join(data,'localhost.cer')},stdio:'ignore'});
+    let synchronized=false;
+    try {
+      const deadline=Date.now()+20000;
+      while(Date.now()<deadline){
+        if((await api('grants','POST',admin,{...ticket,unattended:true})).status===403){synchronized=true;break;}
+        assert.equal(watcher.exitCode,null,'Background watcher exited before recovery');
+        await new Promise(resolve=>setTimeout(resolve,200));
+      }
+      assert(synchronized,'Background watcher did not synchronize offline revocation');
+      assert.equal(state(customerDir).unattended_consent,false,'Recovery restored revoked consent');
+    } finally {if(watcher.exitCode===null)watcher.kill();}
+  } else {runAgent(customerDir,['revoke-unattended']);assert.equal(state(customerDir).unattended_consent,false);}
+  const policy=(await api('groups/test-customers/permissions','GET',admin)).body;
+  assert.equal(policy.recording,false);policy.keyboard=false;
+  assert.equal((await api('groups/test-customers/permissions','PUT',technicianLogin.token,policy)).status,401,'Technician changed group policy');
+  assert.equal((await api('groups/test-customers/permissions','PUT',admin,policy)).status,200);
+  assert.equal((await api('grants','POST',technicianLogin.token,{...ticket,unattended:true})).status,403,'Unattended grant issued without consent');
+  const grant=await api('grants','POST',technicianLogin.token,ticket);assert.equal(grant.status,200);
+  const issued=JSON.parse(Buffer.from(grant.body.payload,'base64'));assert.equal(issued.permissions.keyboard,false);assert.equal(issued.permissions.file,true);
+  assert.equal((await api('grants/claim','POST',customer.device_token,{grant:grant.body})).status,200);
+  assert.equal((await api('grants/claim','POST',customer.device_token,{grant:grant.body})).status,403,'Grant replay accepted');
+  policy.file=false;assert.equal((await api('groups/test-customers/permissions','PUT',admin,policy)).status,200);
+  assert.equal((await api(`grants/${issued.grant_id}/renew`,'POST',customer.device_token)).status,403,'Reduced policy renewed older permissions');
+  const history=JSON.parse(runAgent(techDir,['history'],auth));assert.equal(history.length,1);assert.equal(history[0].claimed,true);assert.equal(history[0].device_id,customer.device_id);
+  const accessPath=`groups/test-customers/users/${technician.id}`;
+  assert.equal((await api(accessPath,'DELETE',technicianLogin.token)).status,401,'Technician revoked group access');
+  assert.equal((await api(accessPath,'DELETE',admin)).status,200);
+  assert.equal(JSON.parse(runAgent(techDir,['devices'],auth)).length,0,'Revoked group remained visible');
+  assert.equal((await api('grants','POST',technicianLogin.token,ticket)).status,403,'Revoked group issued a grant');
+  assert.equal((await api(accessPath,'PUT',admin,{})).status,200);
+  assert.equal((await api(`grants/${issued.grant_id}/renew`,'POST',customer.device_token)).status,403,'Re-grant revived revoked session');
+  current.customer.display_name='Changed Local Test Branding';assert.equal((await api('profile','PUT',admin,current)).status,200);
+  runAgent(customerDir,['sync']);const updated=JSON.parse(Buffer.from(state(customerDir).profile.payload,'base64'));assert.equal(updated.customer.display_name,'Changed Local Test Branding');assert.equal(updated.revision,2);
+  assert.equal((await api(`devices/${customer.device_id}/state`,'PUT',admin,{state:'revoked',group:'test-customers'})).status,200);
+  assert.equal((await api('grants','POST',technicianLogin.token,ticket)).status,403,'Revoked device accessible');
+  runAgent(techDir,['logout'],auth);assert.equal((await api('devices','GET',technicianLogin.token)).status,401,'Logged-out credential still authorized');
+  const source=spawnSync('git',['rev-parse','HEAD'],{cwd:root,encoding:'utf8'});
+  const dirty=spawnSync('git',['status','--porcelain'],{cwd:root,encoding:'utf8'});
+  fs.writeFileSync(path.join(data,'lifecycle-result.json'),JSON.stringify({passed:true,at:new Date().toISOString(),source_commit:source.status===0?source.stdout.trim():'unknown',source_dirty:dirty.status===0?dirty.stdout.trim().length>0:null,agent_sha256:crypto.createHash('sha256').update(fs.readFileSync(agent)).digest('hex'),management_sha256:crypto.createHash('sha256').update(fs.readFileSync(path.join(binaryDirectory,'swan-management.exe'))).digest('hex'),offline_revocation_recovery:settings.SWAN_TEST_FAULTS==='1',checks:['HTTPS certificate validation','fresh company setup','built agent bootstrap and enrollment','pending approval denial','technician MFA login and group inventory','technician session history','logout revokes credentials','unattended consent denial','grant replay denial','signed branding sync','device revocation']},null,2));
+  console.log('PASS: real local HTTPS company lifecycle, group revocation and built-agent checks. Native sessions and installers remain separate tests.');
+}
+main().catch(error=>{console.error(error.message);process.exitCode=1;});
diff --git a/deployment/windows/test-native-profile-time.py b/deployment/windows/test-native-profile-time.py
new file mode 100644
index 00000000000..0923579b655
--- /dev/null
+++ b/deployment/windows/test-native-profile-time.py
@@ -0,0 +1,129 @@
+"""Exercise native cached-profile trust and time validation without network or installed state.
+
+Requires Python cryptography. The signing key is ephemeral and never serialized.
+Use an independently hash-verified swan-agent executable and a fresh private output
+directory. This harness does not install software or establish a remote session.
+"""
+import argparse
+import base64
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import time
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.exceptions import InvalidSignature
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("agent", type=Path)
+    parser.add_argument("expected_sha256")
+    parser.add_argument("output", type=Path)
+    args = parser.parse_args()
+    agent = args.agent.resolve(strict=True)
+    digest = hashlib.sha256(agent.read_bytes()).hexdigest()
+    if digest != args.expected_sha256.lower():
+        raise SystemExit("Native agent hash mismatch")
+    output = args.output.resolve()
+    output.mkdir(parents=False, exist_ok=False)
+    key = Ed25519PrivateKey.generate()
+    public = base64.b64encode(key.public_key().public_bytes(
+        serialization.Encoding.Raw, serialization.PublicFormat.Raw)).decode()
+    bootstrap = dict(schema=1, edition="technician", company_id="time-validation-lab",
+                     management_url="https://time-validation.example.invalid",
+                     profile_public_key=public, release_public_key=public)
+    branding = dict(display_name="Time validation lab", primary_color="#007F82",
+                    logo_svg="", support_url="", consent_text="Approve lab support.")
+    now = int(time.time())
+    time_error = "Expired or future profile"
+    cases = [("valid", now - 60, now + 3600, None),
+             ("expired", now - 3600, now - 60, time_error),
+             ("future", now + 3600, now + 7200, time_error),
+             ("invalid_lifetime", now - 60, now - 120, time_error)]
+    cases += [(name, now - 60, now + 3600, error) for name, error in [
+        ("tampered_branding", "Invalid signature"),
+        ("wrong_signing_key", "Invalid signature"),
+        ("wrong_company", "Wrong company or schema"),
+        ("replayed_revision", "Replayed profile"),
+        ("bootstrap_company", "Installer belongs to another company or edition"),
+        ("bootstrap_edition", "Installer belongs to another company or edition"),
+        ("bootstrap_trust_key", "Installer cannot replace configured trust keys"),
+        ("bootstrap_endpoint", "Installer endpoint differs from trusted company configuration"),
+    ]]
+    results = []
+    for name, issued, expires, expected_error in cases:
+        accepted = expected_error is None
+        directory = output / name
+        directory.mkdir()
+        profile = dict(schema=1, company_id=bootstrap["company_id"], revision=1,
+                       issued_at=issued, expires_at=expires,
+                       management_url=bootstrap["management_url"],
+                       rendezvous="transport.example.invalid", relay="transport.example.invalid",
+                       transport_public_key=public, customer=branding, technician=branding,
+                       allow_unattended=False, updates_paused=True, rollout_percent=0,
+                       maintenance_start_utc=0, maintenance_end_utc=23,
+                       update_channel="test", next_profile_public_key=None)
+        if name == "wrong_company":
+            profile["company_id"] = "another-company"
+        payload = json.dumps(profile, separators=(",", ":")).encode()
+        signer = Ed25519PrivateKey.generate() if name == "wrong_signing_key" else key
+        signature = signer.sign(payload)
+        signer.public_key().verify(signature, payload)
+        if name == "tampered_branding":
+            profile["technician"] = dict(branding, display_name="Tampered company")
+            payload = json.dumps(profile, separators=(",", ":")).encode()
+        signature_matches_pin = True
+        try:
+            key.public_key().verify(signature, payload)
+        except InvalidSignature:
+            signature_matches_pin = False
+        if signature_matches_pin != (name not in ("tampered_branding", "wrong_signing_key")):
+            raise RuntimeError(f"Unexpected fixture signature: {name}")
+        state = dict(bootstrap=bootstrap, profile=dict(
+            payload=base64.b64encode(payload).decode(),
+            signature=base64.b64encode(signature).decode()),
+            accepted_revision=2 if name == "replayed_revision" else 1,
+            device_id=None, device_token=None, unattended_consent=False,
+            consent_revision=0, last_release_sequence=0)
+        state_path = directory / "managed-state.json"
+        state_path.write_text(json.dumps(state), encoding="utf-8")
+        bootstrap_path = directory / "bootstrap.json"
+        installer_bootstrap = dict(bootstrap)
+        if name == "bootstrap_company":
+            installer_bootstrap["company_id"] = "another-company"
+        elif name == "bootstrap_edition":
+            installer_bootstrap["edition"] = "customer"
+        elif name == "bootstrap_trust_key":
+            installer_bootstrap["profile_public_key"] = base64.b64encode(
+                Ed25519PrivateKey.generate().public_key().public_bytes(
+                    serialization.Encoding.Raw, serialization.PublicFormat.Raw)).decode()
+        elif name == "bootstrap_endpoint":
+            installer_bootstrap["management_url"] = "https://another-company.example.invalid"
+        bootstrap_path.write_text(json.dumps(installer_bootstrap), encoding="utf-8")
+        before = state_path.read_bytes()
+        bootstrap_before = bootstrap_path.read_bytes()
+        env = os.environ.copy()
+        env["SWAN_STATE_DIR"] = str(directory)
+        completed = subprocess.run([str(agent), "verify-bootstrap", str(bootstrap_path)],
+                                   env=env, capture_output=True, text=True, timeout=30)
+        if (completed.returncode == 0) != accepted:
+            raise RuntimeError(f"Unexpected native validation outcome: {name}")
+        if not accepted and expected_error not in completed.stderr:
+            raise RuntimeError(f"Rejection did not exercise expected trust validation: {name}")
+        if state_path.read_bytes() != before or bootstrap_path.read_bytes() != bootstrap_before:
+            raise RuntimeError(f"Native verification changed fixture state: {name}")
+        results.append(dict(case=name, accepted=accepted, state_unchanged=True,
+                            signature_matches_pinned_key=signature_matches_pin,
+                            expected_rejection_verified=not accepted))
+    result = dict(agent_sha256=digest, cases=results,
+                  scope="Native cached-profile validation; synthetic company; no network or installation")
+    (output / "result.json").write_text(json.dumps(result, indent=2), encoding="utf-8")
+    print(json.dumps(result))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/windows/test-network-probe.js b/deployment/windows/test-network-probe.js
new file mode 100644
index 00000000000..dbc1d4c63b1
--- /dev/null
+++ b/deployment/windows/test-network-probe.js
@@ -0,0 +1,132 @@
+'use strict';
+// Exercise the compiled CLI and real TLS/signatures. TCP/UDP peers below are
+// scripted diagnostics, not native-session or public-connectivity qualification.
+const fs = require('node:fs'), path = require('node:path');
+const https = require('node:https'), net = require('node:net'), dgram = require('node:dgram');
+const crypto = require('node:crypto'), assert = require('node:assert/strict');
+const {spawn} = require('node:child_process');
+const [environment, executable, resultPath] = process.argv.slice(2);
+assert(environment && executable && resultPath, 'Pass private TLS environment, management executable and new result path');
+assert(!fs.existsSync(resultPath), 'Preserve existing evidence');
+const settings = Object.fromEntries(fs.readFileSync(environment, 'utf8').split(/\r?\n/).filter(Boolean).map(line => {
+  const match = /^([A-Z_]+)=(.*)$/.exec(line); assert(match, 'Invalid private test environment'); return [match[1], match[2]];
+}));
+const directory = path.dirname(path.resolve(resultPath)), sentinel = path.join(directory, 'must-not-create-company-state');
+assert(!fs.existsSync(sentinel), 'State sentinel already exists');
+const key = crypto.generateKeyPairSync('ed25519');
+const publicKey = key.publicKey.export({type:'spki', format:'der'}).subarray(-32).toString('base64');
+let mode = 'valid', profile, child, udp, udpOpen = false;
+let transportConnections = 0, profileRequests = 0;
+const listeners = [], checks = [], credentials = [], requestedPaths = [];
+const listen = (server, port = 0) => new Promise((resolve, reject) => {
+  server.once('error', reject); server.listen(port, '127.0.0.1', () => { server.removeListener('error', reject); resolve(server.address().port); });
+});
+const tcp = () => net.createServer(socket => { ++transportConnections; socket.end(); });
+async function reserveDiagnosticPorts() {
+  // Windows may reserve UDP ranges independently of TCP. Reserve the complete
+  // fixture before returning, and retry boundedly without changing host policy.
+  for (let attempt=0; attempt<32; ++attempt) {
+    const nat=tcp(), id=tcp(), socket=dgram.createSocket('udp4');
+    const port=crypto.randomInt(20000,45000); let complete=false;
+    try {
+      await listen(nat,port); await listen(id,port+1);
+      await new Promise((resolve,reject) => {
+        socket.once('error',reject);
+        socket.bind(port+1,'127.0.0.1',() => {socket.removeListener('error',reject);resolve();});
+      });
+      complete=true; listeners.push(nat,id); return {port,socket};
+    } catch (error) { if (!['EADDRINUSE','EACCES'].includes(error.code)) throw error; }
+    finally {
+      if (!complete) {
+        socket.close();
+        for (const listener of [id,nat]) if (listener.listening) await new Promise(resolve => listener.close(resolve));
+      }
+    }
+  }
+  throw new Error('No adjacent loopback TCP fixture ports available');
+}
+const server = https.createServer({pfx:fs.readFileSync(settings.SWAN_TEST_TLS_PFX), passphrase:settings.SWAN_TEST_TLS_PASSWORD}, (request, response) => {
+  requestedPaths.push(request.url);
+  credentials.push(!!request.headers.authorization || !!request.headers.cookie);
+  if (request.url !== '/api/v1/profile') { response.writeHead(404); response.end(); return; }
+  ++profileRequests;
+  if (mode === 'redirect') { response.writeHead(302, {location:'/redirected'}); response.end(); return; }
+  const value = {...profile};
+  if (mode === 'expired') { value.issued_at -= 7200; value.expires_at = value.issued_at + 3600; }
+  if (mode === 'future') { value.issued_at += 3600; value.expires_at += 3600; }
+  if (mode === 'zero-revision') value.revision = 0;
+  if (mode === 'wrong-company') value.company_id = 'another-company';
+  let payload = Buffer.from(JSON.stringify(value));
+  const signature = crypto.sign(null, payload, key.privateKey).toString('base64');
+  if (mode === 'tampered') payload = Buffer.from(JSON.stringify({...value, revision:999}));
+  response.setHeader('content-type','application/json');
+  response.end(JSON.stringify({payload:payload.toString('base64'), signature}));
+});
+async function command(label, args, expected, expectedReport) {
+  const before = transportConnections;
+  child = spawn(path.resolve(executable), args, {windowsHide:true, stdio:['ignore','pipe','pipe'], env:{...process.env, SWAN_DATA_DIR:sentinel, SWAN_TECHNICIAN_TOKEN:'not-a-real-token-do-not-send'}});
+  let output = '', error = '';
+  child.stdout.on('data', data => { output += data; }); child.stderr.on('data', data => { error += data; });
+  const timer = setTimeout(() => child.kill(), 30000);
+  let code;
+  try { code = await new Promise((resolve, reject) => {child.once('error', reject); child.once('exit', resolve);}); }
+  finally {clearTimeout(timer);}
+  assert.equal(code, expected, `${label}: unexpected CLI exit (${error.slice(0,300)})`);
+  assert(!fs.existsSync(sentinel), `${label}: checker opened company state`);
+  if (expectedReport !== undefined) {
+    const report = JSON.parse(output); assert.equal(report.requested_checks_passed, expectedReport);
+    assert.equal(report.outside_vantage_independently_attested, false);
+    assert.equal(report.native_direct_and_relay_sessions_verified, false);
+    assert.equal(report.connected_addresses_public_candidates, false);
+    if (label !== 'malformed-udp') assert.equal(report.all_endpoint_checks_passed, true);
+    else assert.equal(report.udp_check.reachable, false);
+  } else if (label !== 'help') {
+    assert.equal(transportConnections, before, `${label}: untrusted profile reached transport`);
+    assert.equal(output.trim(), '', `${label}: emitted a success report for invalid trust`);
+  }
+  checks.push(label);
+}
+async function main() {
+  const reserved = await reserveDiagnosticPorts(), natPort = reserved.port;
+  udp=reserved.socket; udpOpen=true;
+  const relay = tcp(); listeners.push(relay); const relayPort = await listen(relay);
+  udp.on('message', (bytes, peer) => {
+    assert.deepEqual(bytes, Buffer.from([0x7a,0x06,0x12,0x01,0x00,0x1a,0x01,0x00]));
+    udp.send(mode === 'malformed-udp' ? Buffer.from([0]) : Buffer.from([0x82,0x01,0x02,0x08,0x02]), peer.port, peer.address);
+  });
+  const httpsPort = await listen(server); listeners.push(server);
+  const brand = {display_name:'Probe fixture',primary_color:'#007777',logo_svg:'<svg/>',support_url:'',consent_text:'Approve support.',support_contacts:'',shortcuts:[]};
+  const now = Math.floor(Date.now()/1000), url = `https://localhost:${httpsPort}`;
+  profile = {schema:1,company_id:'probe-fixture',revision:1,issued_at:now,expires_at:now+3600,management_url:url,rendezvous:`127.0.0.1:${natPort+1}`,relay:`127.0.0.1:${relayPort}`,transport_public_key:publicKey,customer:brand,technician:brand,allow_unattended:false,updates_paused:true,rollout_percent:0,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:'test',next_profile_public_key:null};
+  const bootstrap = {schema:1,edition:'customer',company_id:profile.company_id,management_url:url,profile_public_key:publicKey,release_public_key:''};
+  const bootstrapPath = path.join(directory,'probe-bootstrap.json'); fs.writeFileSync(bootstrapPath, JSON.stringify(bootstrap), {flag:'wx'});
+  const args = ['check-network',bootstrapPath,'--ca-file',settings.SWAN_TEST_CA_FILE];
+  const pemPath = path.join(directory,'root.pem');
+  fs.writeFileSync(pemPath,new crypto.X509Certificate(fs.readFileSync(settings.SWAN_TEST_CA_FILE)).toString(),{flag:'wx'});
+  await command('help',['check-network','--help'],0);
+  await command('trusted-private',args,0,true);
+  await command('trusted-pem',['check-network',bootstrapPath,'--ca-file',pemPath],0,true);
+  await command('private-cannot-qualify-outside',[...args,'--outside-network'],1,false);
+  for (const label of ['expired','future','zero-revision','wrong-company','tampered','redirect']) {mode=label; await command(label,args,1);}
+  mode='valid';
+  const wrongKeyPath = path.join(directory,'wrong-key-bootstrap.json');
+  const wrongKey = crypto.generateKeyPairSync('ed25519').publicKey.export({type:'spki',format:'der'}).subarray(-32).toString('base64');
+  fs.writeFileSync(wrongKeyPath,JSON.stringify({...bootstrap,profile_public_key:wrongKey}),{flag:'wx'});
+  await command('wrong-pinned-key',['check-network',wrongKeyPath,'--ca-file',settings.SWAN_TEST_CA_FILE],1);
+  const wrongHostPath = path.join(directory,'wrong-host-bootstrap.json');
+  fs.writeFileSync(wrongHostPath,JSON.stringify({...bootstrap,management_url:`https://127.0.0.1:${httpsPort}`}),{flag:'wx'});
+  await command('certificate-hostname-mismatch',['check-network',wrongHostPath,'--ca-file',settings.SWAN_TEST_CA_FILE],1);
+  mode='valid'; await command('untrusted-ca',['check-network',bootstrapPath],1);
+  await command('insecure-option-rejected',[...args,'--insecure'],1);
+  mode='malformed-udp'; await command(mode,args,1,false);
+  assert(profileRequests >= 10); assert(credentials.every(value => !value), 'Checker transmitted account credentials');
+  assert(!requestedPaths.includes('/redirected'), 'Checker followed a profile redirect');
+  fs.writeFileSync(resultPath, JSON.stringify({passed:true,checks,management_sha256:crypto.createHash('sha256').update(fs.readFileSync(executable)).digest('hex'),no_company_state_created:true,no_request_credentials:true,real_https_and_ed25519:true,transport_peers:'scripted fixture; not native sessions',native_or_external_connectivity_qualified:false},null,2), {flag:'wx'});
+  console.log('PASS: compiled checker TLS, signed profiles, trust rejection, private-scope enforcement and no company state or credentials.');
+}
+main().catch(error => {console.error(error.message); process.exitCode=1;}).finally(async () => {
+  if (child && child.exitCode === null && child.signalCode === null) child.kill();
+  server.closeAllConnections();
+  for (const listener of listeners) if (listener.listening) await new Promise(resolve => listener.close(resolve));
+  if (udpOpen) udp.close();
+});
diff --git a/deployment/windows/test-profile-rotation.js b/deployment/windows/test-profile-rotation.js
new file mode 100644
index 00000000000..36a7f035a54
--- /dev/null
+++ b/deployment/windows/test-profile-rotation.js
@@ -0,0 +1,89 @@
+// Owns only freshly created, loopback-only fixture processes. No production inputs.
+const fs=require('node:fs'),path=require('node:path'),https=require('node:https');
+const crypto=require('node:crypto'),assert=require('node:assert/strict');
+const {spawn,spawnSync}=require('node:child_process');
+const root=path.resolve(__dirname,'../..'),settings={};
+assert(process.argv[2]&&process.argv[3],'Pass private fixture environment and binary directory');
+for(const line of fs.readFileSync(process.argv[2],'utf8').split(/\r?\n/)) {
+  if(!line.trim()||line.trimStart().startsWith('#'))continue;
+  const match=/^([A-Z_]+)=(.*)$/.exec(line);assert(match,'Invalid environment file');settings[match[1]]=match[2];
+}
+assert.match(settings.SWAN_LISTEN??'',/^127\.0\.0\.1:\d+$/);
+const data=path.resolve(settings.SWAN_DATA_DIR),binary=path.resolve(process.argv[3]);
+assert(fs.existsSync(path.join(data,'rotation-fixture.marker')),'Only explicitly marked isolated fixtures are allowed');
+assert(!fs.existsSync(path.join(data,'management.sqlite3')),'A fresh, unconfigured fixture is required');
+const manager=path.join(binary,'swan-management.exe'),agent=path.join(binary,'swan-agent.exe');
+const caFile=path.join(data,'localhost.cer'),ca=new crypto.X509Certificate(fs.readFileSync(caFile)).toString();
+const port=Number(settings.SWAN_TEST_TLS_PORT);assert(Number.isInteger(port)&&port>=1024&&port<=65535);
+const env={...process.env,...settings,SWAN_TEST_CA_FILE:caFile};
+let server,proxy;
+function request(endpoint,method='GET',token,body){return new Promise((resolve,reject)=>{const bytes=body===undefined?null:Buffer.from(JSON.stringify(body));const call=https.request(`https://localhost:${port}/api/v1/${endpoint}`,{method,ca,timeout:2000,headers:{'content-type':'application/json',...(token?{authorization:'Bearer '+token}:{}),...(bytes?{'content-length':bytes.length}:{})}},response=>{const chunks=[];response.on('data',c=>chunks.push(c));response.on('end',()=>{try{resolve({status:response.statusCode,body:JSON.parse(Buffer.concat(chunks))});}catch(error){reject(error);}});});call.on('error',reject);call.on('timeout',()=>call.destroy());if(bytes)call.write(bytes);call.end();});}
+async function api(endpoint){const result=await request(endpoint);assert.equal(result.status,200);return result.body;}
+function totp(secret){const alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';let bits=0,value=0,bytes=[];for(const c of secret.replace(/=/g,'')){value=(value<<5)|alphabet.indexOf(c);bits+=5;if(bits>=8){bytes.push((value>>>(bits-8))&255);bits-=8;}}const counter=Buffer.alloc(8);counter.writeBigUInt64BE(BigInt(Math.floor(Date.now()/30000)+1));const hash=crypto.createHmac('sha1',Buffer.from(bytes)).update(counter).digest();const offset=hash[19]&15;return String((hash.readUInt32BE(offset)&0x7fffffff)%1000000).padStart(6,'0');}
+function run(executable,args,extra={}){const result=spawnSync(executable,args,{cwd:root,env:{...env,...extra},encoding:'utf8',timeout:60000});assert.equal(result.status,0,`Isolated ${path.basename(executable)} ${args[0]} failed`);return result.stdout;}
+function agentRun(directory,args){return run(agent,args,{SWAN_STATE_DIR:directory});}
+function readState(directory){return JSON.parse(fs.readFileSync(path.join(directory,'managed-state.json')));}
+async function ready(){const deadline=Date.now()+20000;while(Date.now()<deadline){assert.equal(server.exitCode,null,'Owned management process exited');assert.equal(server.signalCode,null,'Owned management process terminated');assert.equal(proxy.exitCode,null,'Owned HTTPS proxy exited');assert.equal(proxy.signalCode,null,'Owned HTTPS proxy terminated');try{return await api('status');}catch{}await new Promise(r=>setTimeout(r,200));}throw new Error('Owned fixture did not become ready');}
+async function stop(child){if(!child||child.exitCode!==null||child.signalCode!==null)return;const exited=new Promise(resolve=>child.once('exit',resolve));assert(child.kill(),'Owned fixture process could not be stopped');await exited;}
+function start(){server=spawn(manager,[],{cwd:root,env,stdio:'ignore'});}
+async function main(){
+  start();proxy=spawn(process.execPath,[path.join(__dirname,'local-https.js'),process.argv[2]],{cwd:root,env,stdio:'ignore'});
+  const initial=await ready();assert.equal(initial.configured,false);
+  run(process.execPath,[path.join(__dirname,'test-company-lifecycle.js'),process.argv[2],binary]);
+  const customerDir=path.join(data,'customer-agent'),techDir=path.join(data,'technician-agent'),missedDir=path.join(data,'missed-transition-agent');
+  agentRun(missedDir,['setup',path.join(data,'customer-bootstrap.json'),'--accept-company']);
+  const original=readState(customerDir),oldKey=original.bootstrap.profile_public_key;
+  await stop(server);run(manager,['prepare-profile-key']);start();await ready();
+  agentRun(customerDir,['sync']);agentRun(techDir,['sync']);
+  const prepared=readState(customerDir),transition=JSON.parse(Buffer.from(prepared.profile.payload,'base64'));
+  assert.equal(prepared.bootstrap.profile_public_key,oldKey);assert(transition.next_profile_public_key);assert.notEqual(transition.next_profile_public_key,oldKey);
+  assert.equal(readState(techDir).bootstrap.profile_public_key,oldKey);
+  // The lifecycle consumed the following MFA step. Wait for a genuinely fresh
+  // step instead of replaying that code or weakening the server's MFA checks.
+  await new Promise(resolve=>setTimeout(resolve,30000-Date.now()%30000+300));
+  const credentials=JSON.parse(fs.readFileSync(path.join(data,'test-admin.private.json')));
+  const login=await request('login','POST',null,{username:credentials.username,password:credentials.password,totp_code:totp(credentials.totp_secret)});assert.equal(login.status,200);
+  const approval=await request(`devices/${original.device_id}/state`,'PUT',login.body.token,{state:'approved',group:'test-customers'});assert.equal(approval.status,200);
+  const proof=crypto.generateKeyPairSync('ed25519').publicKey.export({type:'spki',format:'der'}).subarray(-32).toString('base64');
+  const activeGrant=await request('grants','POST',login.body.token,{device_id:original.device_id,proof_public_key:proof,unattended:false});assert.equal(activeGrant.status,200);
+  const grantBody=JSON.parse(Buffer.from(activeGrant.body.payload,'base64'));
+  assert.equal((await request('grants/claim','POST',original.device_token,{grant:activeGrant.body})).status,200);
+  await stop(server);
+  const denied=spawnSync(manager,['activate-profile-key'],{cwd:root,env,stdio:'ignore'});assert.notEqual(denied.status,0,'Activation without synchronization confirmation succeeded');
+  run(manager,['activate-profile-key','--confirm-clients-synced']);start();const activated=await ready();
+  assert.equal(activated.profile_public_key,transition.next_profile_public_key);
+  assert(grantBody.expires_at>Math.floor(Date.now()/1000),'Grant expired before the rotation check');
+  assert.equal((await request(`grants/${grantBody.grant_id}/renew`,'POST',original.device_token)).status,403,'Rotation renewed an old claimed grant');
+  const envelope=await api('profile');const newProfile=JSON.parse(Buffer.from(envelope.payload,'base64'));
+  const oldDer=Buffer.concat([Buffer.from('302a300506032b6570032100','hex'),Buffer.from(oldKey,'base64')]);
+  assert.equal(crypto.verify(null,Buffer.from(envelope.payload,'base64'),crypto.createPublicKey({key:oldDer,type:'spki',format:'der'}),Buffer.from(envelope.signature,'base64')),false);
+  agentRun(customerDir,['sync']);agentRun(techDir,['sync']);
+  const after=readState(customerDir);assert.equal(after.bootstrap.profile_public_key,activated.profile_public_key);assert.equal(readState(techDir).bootstrap.profile_public_key,activated.profile_public_key);
+  for(const key of ['device_id','device_token','unattended_consent','consent_revision'])assert.equal(after[key],original[key],`Rotation changed ${key}`);
+  assert(newProfile.revision>transition.revision);
+  const missed=spawnSync(agent,['sync'],{cwd:root,env:{...env,SWAN_STATE_DIR:missedDir},stdio:'ignore',timeout:30000});assert.notEqual(missed.status,0,'A client missing the trusted transition accepted the new key');assert.equal(readState(missedDir).bootstrap.profile_public_key,oldKey);
+  await stop(server);start();await ready();agentRun(customerDir,['sync']);assert.equal(readState(customerDir).bootstrap.profile_public_key,activated.profile_public_key);
+  // Export the real local HTTPS identity as storage files, not dummy bytes.
+  // The passphrase exists only in the child-process environment.
+  await stop(server);await stop(proxy);
+  const tlsStorage=path.join(data,'https-storage');fs.mkdirSync(tlsStorage);
+  fs.copyFileSync(settings.SWAN_TEST_TLS_PFX,path.join(tlsStorage,'localhost.pfx'));
+  fs.copyFileSync(caFile,path.join(tlsStorage,'localhost.cer'));
+  const backupPassword=crypto.randomBytes(32).toString('hex'),backup=path.join(data,'rotated-company.swan-backup');
+  run(manager,['backup',backup,'--deployment-env',process.argv[2],'--tls-directory',tlsStorage],{SWAN_BACKUP_PASSPHRASE:backupPassword});
+  const restored=path.join(data,'restored-company');
+  run(manager,['restore',backup],{SWAN_DATA_DIR:restored,SWAN_BACKUP_PASSPHRASE:backupPassword});
+  for(const name of ['localhost.pfx','localhost.cer'])assert.deepEqual(fs.readFileSync(path.join(restored,'tls-storage',name)),fs.readFileSync(path.join(tlsStorage,name)));
+  const restoredSettings={...settings,SWAN_DATA_DIR:restored,SWAN_TEST_TLS_PFX:path.join(restored,'tls-storage','localhost.pfx'),SWAN_TEST_CA_FILE:path.join(restored,'tls-storage','localhost.cer')};
+  const restoredEnvFile=path.join(data,'restored-test.env');fs.writeFileSync(restoredEnvFile,Object.entries(restoredSettings).map(([key,value])=>`${key}=${value}`).join('\n')+'\n');
+  server=spawn(manager,[],{cwd:root,env:{...env,...restoredSettings},stdio:'ignore'});
+  proxy=spawn(process.execPath,[path.join(__dirname,'local-https.js'),restoredEnvFile],{cwd:root,env,stdio:'ignore'});
+  assert.equal((await ready()).profile_public_key,activated.profile_public_key);
+  assert.equal((await request('device/status','GET',original.device_token)).status,200,'Restored device credential lost ownership');
+  assert.equal((await request(`grants/${grantBody.grant_id}/renew`,'POST',original.device_token)).status,403,'Restore revived the closed grant');
+  agentRun(customerDir,['sync']);assert.equal(readState(customerDir).bootstrap.profile_public_key,activated.profile_public_key);
+  const sha256=file=>crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+  fs.writeFileSync(path.join(data,'rotation-result.json'),JSON.stringify({passed:true,at:new Date().toISOString(),source_commit:run('git',['rev-parse','HEAD']).trim(),source_dirty:run('git',['status','--porcelain']).trim().length>0,management_sha256:sha256(manager),agent_sha256:sha256(agent),checks:['HTTPS trusted transition','customer and technician key rotation','identity and revoked consent preserved','missed-transition client rejected','activation confirmation required','claimed unexpired grant renewal denied','restart persistence','encrypted CLI export and restore of rotated company and TLS storage','restored HTTPS identity and device credential','restored grant stays closed'],native_endpoint_tested:false},null,2));
+  console.log('PASS: real HTTPS profile-key rotation with built customer/technician agents. Native apps and live sessions remain unverified.');
+}
+main().catch(error=>{console.error(error.message);process.exitCode=1;}).finally(async()=>{await stop(server);await stop(proxy);});
diff --git a/deployment/windows/test-server-restore.js b/deployment/windows/test-server-restore.js
new file mode 100644
index 00000000000..e5024f5bf38
--- /dev/null
+++ b/deployment/windows/test-server-restore.js
@@ -0,0 +1,34 @@
+// Real HTTPS restore rehearsal for an isolated lifecycle fixture, not production.
+const fs=require('node:fs'),path=require('node:path'),https=require('node:https');
+const crypto=require('node:crypto'),assert=require('node:assert/strict');
+function settings(file){const values={};for(const line of fs.readFileSync(file,'utf8').split(/\r?\n/)){if(!line.trim()||line.trimStart().startsWith('#'))continue;const match=/^([A-Z_]+)=(.*)$/.exec(line);assert(match,'Invalid private test environment');values[match[1]]=match[2];}assert.match(values.SWAN_LISTEN,/^127\.0\.0\.1:\d+$/);return values;}
+function endpoint(values){const data=path.resolve(values.SWAN_DATA_DIR),port=Number(values.SWAN_TEST_TLS_PORT);assert(Number.isInteger(port)&&port>=1024&&port<=65535);return {data,base:`https://localhost:${port}`,ca:new crypto.X509Certificate(fs.readFileSync(path.join(data,'localhost.cer'))).toString()};}
+function api(server,route,method='GET',token,body){return new Promise((resolve,reject)=>{const bytes=body===undefined?null:Buffer.from(JSON.stringify(body));const request=https.request(server.base+'/api/v1/'+route,{method,ca:server.ca,headers:{'content-type':'application/json',...(token?{authorization:'Bearer '+token}:{}),...(bytes?{'content-length':bytes.length}:{})}},response=>{const chunks=[];response.on('data',chunk=>chunks.push(chunk));response.on('end',()=>{try{resolve({status:response.statusCode,body:JSON.parse(Buffer.concat(chunks))});}catch(error){reject(error);}});});request.setTimeout(15000,()=>request.destroy(new Error('Test request timed out')));request.on('error',reject);if(bytes)request.write(bytes);request.end();});}
+function totp(secret){let bits=0,value=0,decoded=[];for(const c of secret.replace(/=/g,'')){const index='ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'.indexOf(c);assert(index>=0);value=(value<<5)|index;bits+=5;if(bits>=8){decoded.push((value>>>(bits-8))&255);bits-=8;}}const counter=Buffer.alloc(8);counter.writeBigUInt64BE(BigInt(Math.floor(Date.now()/30000)+1));const hash=crypto.createHmac('sha1',Buffer.from(decoded)).update(counter).digest(),offset=hash[19]&15;return String((hash.readUInt32BE(offset)&0x7fffffff)%1000000).padStart(6,'0');}
+function verifiedProfile(envelope,key){const der=Buffer.concat([Buffer.from('302a300506032b6570032100','hex'),Buffer.from(key,'base64')]);assert(crypto.verify(null,Buffer.from(envelope.payload,'base64'),{key:der,type:'spki',format:'der'},Buffer.from(envelope.signature,'base64')),'Restored profile signature is invalid');return JSON.parse(Buffer.from(envelope.payload,'base64'));}
+async function main(){
+  assert(process.argv[2]&&process.argv[3],'Pass original and restored private test environment files');
+  const original=endpoint(settings(process.argv[2])),restored=endpoint(settings(process.argv[3]));assert.notEqual(original.data,restored.data);assert.notEqual(original.base,restored.base);
+  const status=(await api(original,'status')).body,newStatus=(await api(restored,'status')).body;
+  assert.equal(status.configured,true);assert.deepEqual(newStatus,status,'Company setup or trust key changed on restore');
+  const profile=verifiedProfile((await api(original,'profile')).body,status.profile_public_key);
+  assert.deepEqual(verifiedProfile((await api(restored,'profile')).body,status.profile_public_key),profile,'Signed configuration changed on restore');
+  const identity=JSON.parse(fs.readFileSync(path.join(original.data,'test-admin.private.json')));
+  const loginBody={username:identity.username,password:identity.password,totp_code:totp(identity.totp_secret)};
+  const oldLogin=await api(original,'login','POST',null,loginBody),newLogin=await api(restored,'login','POST',null,loginBody);
+  assert.equal(oldLogin.status,200,'Original test MFA login failed');assert.equal(newLogin.status,200,'Restored MFA login failed');
+  const oldToken=oldLogin.body.token,newToken=newLogin.body.token;
+  try {
+    for(const route of ['devices','users','groups/test-customers/permissions']){
+      const before=await api(original,route,'GET',oldToken),after=await api(restored,route,'GET',newToken);
+      assert.equal(before.status,200);assert.equal(after.status,200);assert.deepEqual(after.body,before.body,`Restored ${route} differs`);
+    }
+    const device=JSON.parse(fs.readFileSync(path.join(original.data,'customer-agent/managed-state.json')));
+    assert.equal((await api(restored,'device/status','GET',device.device_token)).status,401,'Restore reenabled a revoked device');
+    const proof=crypto.generateKeyPairSync('ed25519').publicKey.export({type:'spki',format:'der'}).subarray(-32).toString('base64');
+    assert.equal((await api(restored,'grants','POST',newToken,{device_id:device.device_id,proof_public_key:proof,unattended:false})).status,403,'Restored server issued a grant for a revoked device');
+    fs.writeFileSync(path.join(restored.data,'restore-result.json'),JSON.stringify({passed:true,at:new Date().toISOString(),company_id:profile.company_id,checks:['HTTPS certificate validation','configuration signing key preserved','signed profile preserved','administrator MFA login','accounts and devices preserved','group capability policy preserved','revoked device denied','revoked-device grant denied']},null,2));
+  } finally {await api(original,'logout','POST',oldToken);await api(restored,'logout','POST',newToken);}
+  console.log('PASS: real HTTPS server restore preserves company trust, MFA, device state and group policy; revoked access remains denied.');
+}
+main().catch(error=>{console.error(error.message);process.exitCode=1;});
diff --git a/deployment/windows/test-update-download.js b/deployment/windows/test-update-download.js
new file mode 100644
index 00000000000..13ed74f6140
--- /dev/null
+++ b/deployment/windows/test-update-download.js
@@ -0,0 +1,67 @@
+'use strict';
+// Real HTTPS transport regression; no installer or helper code is executed.
+const fs = require('node:fs'), path = require('node:path');
+const https = require('node:https'), crypto = require('node:crypto');
+const assert = require('node:assert/strict');
+const {spawn, spawnSync} = require('node:child_process');
+const [environment, executable, resultPath] = process.argv.slice(2);
+assert(environment && executable && resultPath, 'Pass private TLS environment, Rust agent test executable, and new result path');
+assert(!fs.existsSync(resultPath), 'Do not overwrite previous evidence');
+const settings = {};
+for (const line of fs.readFileSync(environment, 'utf8').split(/\r?\n/)) {
+  if (!line.trim() || line.trimStart().startsWith('#')) continue;
+  const match = /^([A-Z_]+)=(.*)$/.exec(line);
+  assert(match, 'Invalid environment file'); settings[match[1]] = match[2];
+}
+assert(settings.SWAN_TEST_TLS_PFX && settings.SWAN_TEST_CA_FILE, 'Private test TLS paths required');
+const payload = Buffer.from('Swan HTTPS recovery download fixture\n');
+const requests = [];
+const server = https.createServer({pfx: fs.readFileSync(settings.SWAN_TEST_TLS_PFX), passphrase: settings.SWAN_TEST_TLS_PASSWORD}, (request, response) => {
+  requests.push({path: request.url, authorization: !!request.headers.authorization, cookie: !!request.headers.cookie});
+  if (request.url === '/artifact') { response.writeHead(302, {location: '/payload'}); response.end(); }
+  else if (request.url === '/payload') { response.end(payload); }
+  else if (request.url === '/tampered') { response.end('tampered download'); }
+  else if (request.url === '/oversized') { response.writeHead(200, {'content-length': 512 * 1024 * 1024 + 1}); response.flushHeaders(); response.end(); }
+  else if (request.url === '/large') {
+    response.writeHead(200, {'content-length': 16 * 1024 * 1024});
+    const chunk = Buffer.alloc(64 * 1024, 0x5a); let remaining = 256;
+    const send = () => { while (remaining) { --remaining; if (!response.write(chunk)) { response.once('drain', send); return; } } response.end(); };
+    send();
+  }
+  else if (request.url === '/partial') {
+    response.writeHead(200, {'content-length': payload.length});
+    response.flushHeaders(); response.write(payload.subarray(0, 8));
+    setImmediate(() => response.destroy());
+  } else { response.writeHead(404); response.end(); }
+});
+let child;
+async function main() {
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  const base = `https://localhost:${server.address().port}`;
+  child = spawn(path.resolve(executable), ['update::tests::https_download_recovery_preserves_staging_on_tamper_and_interruption', '--exact', '--ignored', '--nocapture'], {
+    env: {...process.env, SWAN_TEST_CA_FILE: settings.SWAN_TEST_CA_FILE, SWAN_TEST_DOWNLOAD_BASE: base, SWAN_TECHNICIAN_TOKEN: 'not-a-real-credential-downloads-must-not-send-it'},
+    stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true,
+  });
+  let output = '';
+  child.stdout.on('data', data => { output += data; });
+  child.stderr.on('data', data => { output += data; });
+  const code = await new Promise((resolve, reject) => { child.once('error', reject); child.once('exit', resolve); });
+  assert.equal(code, 0, 'HTTPS download test failed\n' + output);
+  assert.match(output, /1 passed; 0 failed/);
+  for (const route of ['/artifact', '/payload', '/tampered', '/partial', '/oversized', '/large']) assert(requests.some(request => request.path === route), `Missing ${route} request`);
+  assert(requests.every(request => !request.authorization && !request.cookie), 'Artifact requests carried credentials');
+  const hash = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+  const root = path.resolve(__dirname, '../..');
+  const commit = spawnSync('git', ['rev-parse', 'HEAD'], {cwd: root, encoding: 'utf8'});
+  const dirty = spawnSync('git', ['status', '--porcelain'], {cwd: root, encoding: 'utf8'});
+  assert.equal(commit.status, 0); assert.equal(dirty.status, 0);
+  fs.writeFileSync(resultPath, JSON.stringify({passed: true, at: new Date().toISOString(), source_commit: commit.stdout.trim(), source_dirty: dirty.stdout.trim().length > 0, agent_test_sha256: hash(executable), tls_identity_sha256: hash(settings.SWAN_TEST_CA_FILE), checks: ['real HTTPS redirect', 'exact artifact hash', 'tamper rejection retains staging', 'interrupted response retains staging', 'oversized response rejected', '16 MiB streamed response verified', 'no artifact credentials', 'temporary staging cleaned'], requests, native_installer_executed: false}, null, 2), {flag: 'wx'});
+  console.log('PASS: HTTPS redirect, tamper/interruption rejection, complete staging retained, no artifact credentials.');
+}
+main().catch(error => { console.error(error.message); process.exitCode = 1; }).finally(async () => {
+  if (child && child.exitCode === null && child.signalCode === null) {
+    const exited = new Promise(resolve => child.once('exit', resolve)); child.kill(); await exited;
+  }
+  server.closeAllConnections();
+  if (server.listening) await new Promise(resolve => server.close(resolve));
+});
diff --git a/deployment/windows/test_build_source.py b/deployment/windows/test_build_source.py
new file mode 100644
index 00000000000..839b3d01c20
--- /dev/null
+++ b/deployment/windows/test_build_source.py
@@ -0,0 +1,117 @@
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+import zipfile
+
+spec = importlib.util.spec_from_file_location("build_source", Path(__file__).with_name("archive-build-source.py"))
+source = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(source)
+
+
+class BuildSourceTests(unittest.TestCase):
+    def fixture(self, root):
+        subprocess.run(["git", "init", str(root)], check=True, capture_output=True)
+        (root / "tracked.rs").write_text("original", encoding="utf-8")
+        (root / ".gitignore").write_text("private.env\n", encoding="utf-8")
+        subprocess.run(["git", "-C", str(root), "add", "."], check=True, capture_output=True)
+        subprocess.run(["git", "-C", str(root), "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                        "commit", "-m", "fixture"], check=True, capture_output=True)
+        for name in source.BRIDGE_FILES:
+            path = root / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text("generated bridge source", encoding="utf-8")
+
+    def test_actual_sources_only_and_repeatable_archive(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder) / "checkout"
+            self.fixture(root)
+            (root / "tracked.rs").write_text("modified build input", encoding="utf-8")
+            (root / "private.env").write_text("secret must never enter archive", encoding="utf-8")
+            (root / "untracked.log").write_text("private log", encoding="utf-8")
+            first, second = Path(folder) / "first.zip", Path(folder) / "second.zip"
+            self.assertEqual(source.archive(root, first), source.archive(root, second))
+            with zipfile.ZipFile(first) as package:
+                self.assertEqual(package.read("source/tracked.rs"), b"modified build input")
+                self.assertNotIn("source/private.env", package.namelist())
+                self.assertNotIn("source/untracked.log", package.namelist())
+                receipt = json.loads(package.read("BUILD-SOURCE.json"))
+                self.assertEqual(len(receipt["generated_bridge_files"]), 6)
+                self.assertEqual(receipt["source_date_epoch"], int(source.git(root, "show", "-s", "--format=%ct", "HEAD")))
+                self.assertEqual(set(receipt["files"]), {"tracked.rs", ".gitignore", *source.BRIDGE_FILES})
+            with self.assertRaises(FileExistsError):
+                source.archive(root, first)
+
+    def test_missing_generated_input_fails_before_output(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder) / "checkout"
+            self.fixture(root)
+            (root / source.BRIDGE_FILES[0]).unlink()
+            output = Path(folder) / "output.zip"
+            with self.assertRaisesRegex(ValueError, "Generated bridge source missing"):
+                source.archive(root, output)
+            self.assertFalse(output.exists())
+
+    def test_component_archive_preserves_embedded_inputs_without_client_bridges_or_private_files(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder) / "checkout"
+            self.fixture(root)
+            names = ("product/Cargo.lock", "product/management/src/main.rs", "deployment/windows/Install-SwanRemoteSupport.cmd",
+                     "branding/swan-support-mark.svg", "LICENCE", ".cargo/config.toml", ".dockerignore")
+            for name in names:
+                path = root / name
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(b"public build input\r\n")
+                subprocess.run(["git", "-C", str(root), "add", name], check=True, capture_output=True)
+            (root / "product/private.env").write_text("private canary", encoding="utf-8")
+            # A component build does not initialize or consume desktop bridges.
+            for name in source.BRIDGE_FILES:
+                (root / name).unlink()
+            output, repeated = Path(folder) / "component.zip", Path(folder) / "repeated.zip"
+            self.assertEqual(source.archive(root, output, True), source.archive(root, repeated, True))
+            with zipfile.ZipFile(output) as package:
+                receipt = json.loads(package.read("BUILD-SOURCE.json"))
+                self.assertEqual(receipt["generated_bridge_files"], [])
+                self.assertEqual(set(receipt["files"]), set(names))
+                self.assertEqual(set(package.namelist()), {"BUILD-SOURCE.json", *("source/" + name for name in names)})
+                for name in names:
+                    self.assertEqual(package.read("source/" + name), b"public build input\r\n")
+
+    def test_submodule_pin_mismatch_is_rejected(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder) / "checkout"
+            self.fixture(root)
+            child = root / "dependency"
+            self.fixture(child)
+            subprocess.run(["git", "-C", str(root), "add", "dependency"], check=True, capture_output=True)
+            matching = Path(folder) / "matching.zip"
+            source.archive(root, matching)
+            with zipfile.ZipFile(matching) as package:
+                self.assertEqual(package.read("source/dependency/tracked.rs"), b"original")
+                receipt = json.loads(package.read("BUILD-SOURCE.json"))
+                self.assertIn("dependency/", receipt["repositories"])
+            (child / "tracked.rs").write_text("new child revision", encoding="utf-8")
+            subprocess.run(["git", "-C", str(child), "add", "tracked.rs"], check=True, capture_output=True)
+            subprocess.run(["git", "-C", str(child), "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                            "commit", "-m", "changed"], check=True, capture_output=True)
+            with self.assertRaisesRegex(ValueError, "Submodule does not match"):
+                source.archive(root, Path(folder) / "output.zip")
+
+    def test_index_symlink_cannot_publish_its_target(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder) / "checkout"
+            self.fixture(root)
+            blob = subprocess.check_output(["git", "-C", str(root), "hash-object", "-w", "--stdin"], input=b"private.env").decode().strip()
+            subprocess.run(["git", "-C", str(root), "update-index", "--add", "--cacheinfo",
+                            "120000," + blob + ",linked.env"], check=True, capture_output=True)
+            (root / "linked.env").write_text("sensitive target", encoding="utf-8")
+            output = Path(folder) / "output.zip"
+            with self.assertRaisesRegex(ValueError, "Unsupported source file mode"):
+                source.archive(root, output)
+            self.assertFalse(output.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_company_setup_entrypoint.ps1 b/deployment/windows/test_company_setup_entrypoint.ps1
new file mode 100644
index 00000000000..2203b0d28a4
--- /dev/null
+++ b/deployment/windows/test_company_setup_entrypoint.ps1
@@ -0,0 +1,148 @@
+$ErrorActionPreference='Stop'
+if (-not [Environment]::Is64BitProcess) { throw 'Run the x64 setup-entry tests.' }
+$root=Join-Path ([IO.Path]::GetTempPath()) ('swan-setup-entry-'+[guid]::NewGuid().ToString('N'))
+$bundle=Join-Path $root "Company & setup's folder!"
+$oldLocal=$env:LOCALAPPDATA
+$process=$null
+New-Item -ItemType Directory -Path $bundle|Out-Null
+try {
+    foreach($name in @('Install-Company.ps1','Install-SwanRemoteSupport.cmd')) {
+        $text=[IO.File]::ReadAllText((Join-Path $PSScriptRoot $name)).Replace("`r`n","`n")
+        [IO.File]::WriteAllText((Join-Path $bundle $name),$text,[Text.UTF8Encoding]::new($false))
+    }
+    $setup=Join-Path $bundle 'Install-Company.ps1'
+    $bootstrap=Join-Path $bundle 'bootstrap.json'
+    $env:LOCALAPPDATA=Join-Path $root 'profile'
+    [IO.File]::WriteAllText((Join-Path $bundle 'swan-agent.exe'),'This fixture must never execute.')
+    function Write-Bootstrap([string]$Edition,[string]$Url) {
+        @{edition=$Edition;management_url=$Url}|ConvertTo-Json|Set-Content -LiteralPath $bootstrap -Encoding UTF8
+    }
+    $setupTestState=[pscustomobject]@{Calls=@();ExitCode=0;Cancel=$false;Waited=$false}
+    function Start-Process {
+        param($FilePath,$ArgumentList,$Verb,[switch]$PassThru,[switch]$Wait)
+        $setupTestState.Calls+=@{file=$FilePath;arguments=$ArgumentList;verb=$Verb;wait=[bool]$Wait}
+        if($setupTestState.Cancel){throw 'Simulated elevation cancellation'}
+        $result=[pscustomobject]@{ExitCode=$setupTestState.ExitCode}
+        $result|Add-Member ScriptMethod WaitForExit {$setupTestState.Waited=$true}
+        $result|Add-Member ScriptMethod Refresh {}
+        $result|Add-Member ScriptMethod Dispose {}
+        $result
+    }
+    function Assert-Rejected([string]$Edition,[string]$Url,[string]$Expected) {
+        Write-Bootstrap $Edition $Url
+        $rejected=$false
+        try { & $setup -RequestElevation -ConfirmedCompanyDomain 'company.test' }
+        catch { if($_.Exception.Message -cne $Expected){throw};$rejected=$true }
+        if(-not $rejected -or $setupTestState.Calls.Count){throw 'Preflight unexpectedly started an elevated process'}
+    }
+    Assert-Rejected 'other' 'https://company.test' 'Unknown package edition.'
+    Assert-Rejected 'customer' 'http://company.test' 'A company HTTPS endpoint is required.'
+    Assert-Rejected 'technician' 'https://company.test' 'Configuration agent is not trusted.'
+    if(Test-Path $env:LOCALAPPDATA){throw 'Rejected technician setup wrote installation state'}
+
+    $administrator=([Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+    if(-not $administrator) {
+        Write-Bootstrap 'customer' 'https://company.test'
+        & $setup -RequestElevation -ConfirmedCompanyDomain 'company.test' -Repair -ReplaceFailedSetup -UnattendedConsent
+        if($setupTestState.Calls.Count -ne 1 -or $setupTestState.Calls[0].verb -cne 'RunAs' -or $setupTestState.Calls[0].wait -or -not $setupTestState.Waited){throw 'Customer setup did not await its elevated process independently of descendants'}
+        $a=$setupTestState.Calls[0].arguments
+        foreach($value in @(('"'+$setup+'"'),('"'+$bootstrap+'"'),'-Repair','-ReplaceFailedSetup','-UnattendedConsent','"company.test"')){if($value -cnotin $a){throw 'Elevation lost a quoted path or explicit setup option'}}
+        if('-RequestElevation' -in $a){throw 'Elevation could loop'}
+        $setupTestState.Calls=@();$setupTestState.ExitCode=32
+        $rejected=$false
+        try { & $setup -RequestElevation -ConfirmedCompanyDomain 'company.test' }
+        catch { if($_.Exception.Message -notlike 'Customer setup did not complete (32).*'){throw};$rejected=$true }
+        if(-not $rejected){throw 'Elevated failure was reported as success'}
+        $setupTestState.Calls=@();$setupTestState.Cancel=$true;$rejected=$false
+        try { & $setup -RequestElevation -ConfirmedCompanyDomain 'company.test' }
+        catch { if($_.Exception.Message -cne 'Customer setup requires administrator approval. Setup was not started.'){throw};$rejected=$true }
+        if(-not $rejected){throw 'Cancelled elevation did not fail closed'}
+    }
+    Remove-Item Function:\Start-Process
+
+    # Execute the shipping wait helper against a real installer-like process
+    # that exits unsuccessfully after starting a persistent tray-like child.
+    $tokens=$null;$parseErrors=$null
+    $ast=[Management.Automation.Language.Parser]::ParseFile($setup,[ref]$tokens,[ref]$parseErrors)
+    if($parseErrors.Count){throw 'Shipping setup did not parse'}
+    $helper=$ast.Find({param($node) $node -is [Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -ceq 'Invoke-CompanySetupProcess'},$false)
+    if($null -eq $helper){throw 'Shipping setup wait helper missing'}
+    . ([scriptblock]::Create($helper.Extent.Text))
+    $powerShell=Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell/v1.0/powershell.exe'
+    $sleeper=Join-Path $root 'owned-tray-fixture.ps1'
+    $parent=Join-Path $root 'owned-installer-fixture.ps1'
+    $childPid=Join-Path $root 'owned-tray.pid'
+    'Start-Sleep -Seconds 30'|Set-Content -LiteralPath $sleeper
+    @'
+param([string]$Sleeper,[string]$ChildPid)
+$start=[Diagnostics.ProcessStartInfo]::new()
+$start.FileName=Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell/v1.0/powershell.exe'
+$start.Arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "'+$Sleeper+'"'
+$start.UseShellExecute=$false;$start.CreateNoWindow=$true
+$child=[Diagnostics.Process]::Start($start)
+[IO.File]::WriteAllText($ChildPid,[string]$child.Id)
+Start-Sleep -Milliseconds 500
+exit 7
+'@|Set-Content -LiteralPath $parent
+    $started=[DateTime]::UtcNow;$waitChild=$null
+    $fixtureLocal=$env:LOCALAPPDATA
+    $env:LOCALAPPDATA=$oldLocal
+    try {
+        $exitCode=Invoke-CompanySetupProcess -FilePath $powerShell -ArgumentList @('-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass','-File',('"'+$parent+'"'),'-Sleeper',('"'+$sleeper+'"'),'-ChildPid',('"'+$childPid+'"')) -WindowStyle Hidden
+        if($exitCode -ne 7){throw 'Installer failure exit status was lost'}
+        $waitChild=[Diagnostics.Process]::GetProcessById([int][IO.File]::ReadAllText($childPid))
+        if($waitChild.StartTime.ToUniversalTime() -lt $started -or $waitChild.MainModule.FileName -ine $powerShell){throw 'Fixture child identity differs'}
+        if($waitChild.HasExited -or ([DateTime]::UtcNow-$started).TotalSeconds -ge 20){throw 'Setup waited for its persistent tray descendant'}
+    } finally {
+        $env:LOCALAPPDATA=$fixtureLocal
+        if($null -ne $waitChild){try {if(-not $waitChild.HasExited){$waitChild.Kill();$waitChild.WaitForExit()}}finally{$waitChild.Dispose()}}
+    }
+    Write-Output 'Real installer exit 7 preserved while its owned tray descendant remained running.'
+
+    # Exercise the real CMD/Windows PowerShell path with LF bundle text, spaces,
+    # apostrophe and ampersand in its folder. The invalid fixture agent must fail
+    # signature verification before any installation or enrollment can occur.
+    Write-Bootstrap 'technician' 'https://company.test'
+    $start=[Diagnostics.ProcessStartInfo]::new()
+    $start.FileName=Join-Path ([Environment]::GetFolderPath('System')) 'cmd.exe'
+    $start.Arguments='/d /s /c ""'+(Join-Path $bundle 'Install-SwanRemoteSupport.cmd')+'""'
+    $start.UseShellExecute=$false;$start.CreateNoWindow=$true
+    $start.RedirectStandardInput=$true;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+    # .NET Framework creates and flushes its stdin writer during Process.Start,
+    # before StandardInput is first accessed. Set its encoding at creation time.
+    $previousInputEncoding=[Console]::InputEncoding
+    try {
+        [Console]::InputEncoding=[Text.UTF8Encoding]::new($false)
+        $process=[Diagnostics.Process]::Start($start)
+    } finally { [Console]::InputEncoding=$previousInputEncoding }
+    $stdout=$process.StandardOutput.ReadToEndAsync();$stderr=$process.StandardError.ReadToEndAsync()
+    # Windows PowerShell may select a BOM-emitting encoding for redirected
+    # input on hosted runners. Supply the same plain hostname a user types.
+    $process.StandardInput.WriteLine('company.test');$process.StandardInput.Close()
+    if(-not $process.WaitForExit(60000)){throw 'Setup fixture did not exit; inspect the owned test process'}
+    $output=$stdout.GetAwaiter().GetResult()+$stderr.GetAwaiter().GetResult()
+    if($process.ExitCode -ne 1 -or $output -notmatch 'Configuration agent is not trusted.' -or $output -notmatch 'Setup did not complete.'){
+        # This subprocess has only inert fixture inputs, no credentials or company state.
+        Write-Output (@{fixture_exit_code=$process.ExitCode;fixture_output=$output.Substring(0,[Math]::Min($output.Length,4096))}|ConvertTo-Json -Compress)
+        throw 'Real entry point lost its path, trust rejection or failure exit code'
+    }
+    $process.Dispose()
+    $process=$null
+    if(Test-Path $env:LOCALAPPDATA){throw 'Rejected CMD setup wrote installation state'}
+    @{real_cmd_trust_rejection=$true;technician_never_elevates=$true;unsafe_bootstrap_rejected=$true;elevation_routing_fixture_tested=(-not $administrator);actual_uac_tested=$false;scope='Entry-point routing and real unsigned-agent rejection; no successful product installation'}|ConvertTo-Json -Compress
+} finally {
+    if($null -ne $process) {
+        try {
+            if(-not $process.HasExited) {
+                # This handle identifies only the CMD process created above and
+                # its fixture children; never stop a user's existing console.
+                & (Join-Path ([Environment]::GetFolderPath('System')) 'taskkill.exe') /PID $process.Id /T /F|Out-Null
+            }
+        } finally { $process.Dispose() }
+    }
+    Remove-Item Function:\Start-Process -ErrorAction SilentlyContinue
+    $env:LOCALAPPDATA=$oldLocal
+    $resolved=[IO.Path]::GetFullPath($root)
+    if([IO.Path]::GetDirectoryName($resolved) -ine [IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\') -or [IO.Path]::GetFileName($resolved) -notmatch '^swan-setup-entry-[a-f0-9]{32}$'){throw 'Fixture cleanup path changed'}
+    Remove-Item -LiteralPath $resolved -Recurse -Force
+}
diff --git a/deployment/windows/test_company_watch_recovery.ps1 b/deployment/windows/test_company_watch_recovery.ps1
new file mode 100644
index 00000000000..57cff702c50
--- /dev/null
+++ b/deployment/windows/test_company_watch_recovery.ps1
@@ -0,0 +1,44 @@
+$ErrorActionPreference='Stop'
+$tokens=$null;$errors=$null
+$ast=[Management.Automation.Language.Parser]::ParseFile((Join-Path $PSScriptRoot 'Install-Company.ps1'),[ref]$tokens,[ref]$errors)
+if($errors){throw 'Setup source does not parse'}
+$capture=@($ast.FindAll({param($node) $node -is [Management.Automation.Language.AssignmentStatementAst] -and $node.Left.Extent.Text -eq '$configurationTaskRestore' -and $node.Right.Extent.Text.StartsWith('@{')},$true))
+$handler=@($ast.FindAll({param($node) $node -is [Management.Automation.Language.CatchClauseAst] -and $node.Body.Extent.Text -match '^\{\s*\$setupError = \$_'},$true))
+if($capture.Count -ne 1 -or $handler.Count -ne 1){throw 'Expected actual setup snapshot and failure handler'}
+$snapshot=[scriptblock]::Create($capture[0].Extent.Text)
+$text=$handler[0].Body.Extent.Text
+$recover=[scriptblock]::Create($text.Substring(1,$text.Length-2))
+$editionDirectory=Join-Path ([IO.Path]::GetTempPath()) 'swan-watch-unit-state'
+$agent=[IO.Path]::GetFullPath((Join-Path $editionDirectory 'swan-agent.exe'))
+function Get-ScheduledTask {param($TaskName,$TaskPath) if($TaskName -cne 'Swan Company Configuration' -or $TaskPath -cne '\'){throw 'Unexpected task target'};if(-not $script:missing){$script:task}}
+function Enable-ScheduledTask {param([Parameter(ValueFromPipeline)]$InputObject) process {$script:enabled++;$script:task.State='Ready'}}
+function Disable-ScheduledTask {param([Parameter(ValueFromPipeline)]$InputObject) process {$script:disabled++;$script:task.State='Disabled'}}
+function Start-ScheduledTask {param([Parameter(ValueFromPipeline)]$InputObject) process {if($script:failStart){throw 'Simulated scheduler start failure'};$script:started++;$script:task.State='Running'}}
+$cases=@(
+    @{before='Running';after='Running';enable=1;start=1;disable=0},
+    @{before='Queued';after='Running';enable=1;start=1;disable=0},
+    @{before='Ready';after='Ready';enable=1;start=0;disable=0},
+    @{before='Disabled';after='Disabled';enable=0;start=0;disable=1}
+)
+$count=0
+foreach($case in $cases){
+    $script:task=[pscustomobject]@{TaskName='Swan Company Configuration';TaskPath='\';State=$case.before;Actions=@([pscustomobject]@{Execute=$agent;Arguments='watch'});Principal=[pscustomobject]@{UserId='SYSTEM'}}
+    $configurationTask=@($script:task);. $snapshot
+    $script:task.State='Disabled';$script:enabled=0;$script:disabled=0;$script:started=0;$script:missing=$false;$script:failStart=$false
+    $caught=$false
+    try {try {throw 'Simulated MSI failure (1603).'}catch {& $recover}}catch {if($_.Exception.Message -cne 'Simulated MSI failure (1603).'){throw};$caught=$true}
+    if(-not $caught -or $script:task.State -cne $case.after -or $script:enabled -ne $case.enable -or $script:started -ne $case.start -or $script:disabled -ne $case.disable){throw 'Setup failure did not preserve prior watcher state and original error'}
+    $count++
+}
+foreach($unsafe in @('changed-action','missing-task','restart-failure')){
+    $script:task=[pscustomobject]@{TaskName='Swan Company Configuration';TaskPath='\';State='Running';Actions=@([pscustomobject]@{Execute=$agent;Arguments='watch'});Principal=[pscustomobject]@{UserId='SYSTEM'}}
+    $configurationTask=@($script:task);. $snapshot
+    $script:task.State='Disabled';$script:enabled=0;$script:disabled=0;$script:started=0;$script:missing=($unsafe -eq 'missing-task');$script:failStart=($unsafe -eq 'restart-failure')
+    if($unsafe -eq 'changed-action'){$script:task.Actions[0].Execute=Join-Path $editionDirectory 'unexpected.exe'}
+    $caught=$false
+    try {try {throw 'Original setup rejection.'}catch {& $recover}}catch {if($_.Exception.Message -notlike 'Customer setup failed and its configuration task could not be restored:*Original setup error: Original setup rejection.'){throw};$caught=$true}
+    if(-not $caught -or $script:started -ne 0){throw 'Unsafe or failed task restoration was silently accepted'}
+    if($unsafe -ne 'restart-failure' -and $script:enabled -ne 0){throw 'Changed or missing task was modified'}
+    $count++
+}
+@{passed=$true;cases=$count;scope='Actual setup snapshot/failure-handler AST with isolated scheduler substitutes; no installed software, task or enrollment was changed'}|ConvertTo-Json -Compress
diff --git a/deployment/windows/test_customer_directory.ps1 b/deployment/windows/test_customer_directory.ps1
new file mode 100644
index 00000000000..dfd9abb7851
--- /dev/null
+++ b/deployment/windows/test_customer_directory.ps1
@@ -0,0 +1,69 @@
+param([switch]$RequireAdministratorCases)
+$ErrorActionPreference='Stop'
+$script=Join-Path $PSScriptRoot 'Prepare-CustomerDirectory.ps1'
+$tokens=$null;$errors=$null
+$ast=[System.Management.Automation.Language.Parser]::ParseFile($script,[ref]$tokens,[ref]$errors)
+if($errors.Count){throw 'Customer directory helper failed parsing.'}
+$guard=$ast.Find({param($node)$node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Assert-CustomerAcl'},$true)
+if($null -eq $guard){throw 'Customer ACL guard missing.'}
+. ([ScriptBlock]::Create($guard.Extent.Text))
+function New-FixtureAcl([string]$owner){
+    $acl=[Security.AccessControl.DirectorySecurity]::new()
+    $acl.SetOwner([Security.Principal.SecurityIdentifier]::new($owner));$acl.SetAccessRuleProtection($true,$false)
+    foreach($sid in @('S-1-5-18','S-1-5-32-544')){$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),'FullControl','ContainerInherit,ObjectInherit','None','Allow'))}
+    return $acl
+}
+Assert-CustomerAcl (New-FixtureAcl 'S-1-5-18')
+Assert-CustomerAcl (New-FixtureAcl 'S-1-5-32-544')
+foreach($sid in @('S-1-5-32-545','S-1-1-0')){
+    $acl=New-FixtureAcl 'S-1-5-18'
+    $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),'ReadAndExecute,Write','ContainerInherit,ObjectInherit','None','Allow'))
+    $rejected=$false;try{Assert-CustomerAcl $acl}catch{$rejected=$true}
+    if(-not $rejected){throw 'Unprivileged state permissions accepted.'}
+}
+$rejected=$false;try{Assert-CustomerAcl (New-FixtureAcl 'S-1-5-32-545')}catch{$rejected=$true}
+if(-not $rejected){throw 'Untrusted owner accepted.'}
+$root=Join-Path ([IO.Path]::GetTempPath()) ('swan-directory-security-'+[Guid]::NewGuid().ToString('N'))
+$native=Join-Path ([Environment]::GetFolderPath('System')) 'WindowsPowerShell/v1.0/powershell.exe'
+function Invoke-DirectoryHelper([string]$Directory,[ValidateSet('allow','reject')][string]$Existing='allow') {
+    # Windows PowerShell converts redirected native stderr into terminating
+    # errors under Stop. Observe the child exit code for intentional rejection.
+    $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=$native
+    $start.Arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "'+$script+'" -Directory "'+$Directory+'" -Scope custom -Existing '+$Existing
+    $start.UseShellExecute=$false;$start.CreateNoWindow=$true
+    $start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+    $process=[Diagnostics.Process]::Start($start)
+    try {
+        $output=$process.StandardOutput.ReadToEndAsync();$errors=$process.StandardError.ReadToEndAsync()
+        if(-not $process.WaitForExit(30000)){$process.Kill();$process.WaitForExit();throw 'Customer directory fixture exceeded its deadline.'}
+        $null=$output.GetAwaiter().GetResult();$null=$errors.GetAwaiter().GetResult()
+        return $process.ExitCode
+    } finally {$process.Dispose()}
+}
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+$admin=([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if($RequireAdministratorCases -and -not $admin){throw 'Administrator filesystem cases are required for this run.'}
+if($admin){
+    try{
+        if((Invoke-DirectoryHelper $root) -ne 0){throw 'Private directory creation failed.'}
+        Assert-CustomerAcl (Get-Acl -LiteralPath $root)
+        if((Invoke-DirectoryHelper $root) -ne 0){throw 'Trusted existing directory rejected.'}
+        $before=(Get-Acl -LiteralPath $root).Sddl
+        if((Invoke-DirectoryHelper $root 'reject') -eq 0 -or (Get-Acl -LiteralPath $root).Sddl -cne $before){throw 'Fresh-state mode adopted or changed an existing directory.'}
+        $child=Join-Path $root 'untrusted.txt';[IO.File]::WriteAllText($child,'untrusted fixture: preserve')
+        $fileAcl=[Security.AccessControl.FileSecurity]::new();$fileAcl.SetOwner($identity.User);$fileAcl.SetAccessRuleProtection($true,$false)
+        $fileAcl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new($identity.User,'FullControl','Allow'))
+        Set-Acl -LiteralPath $child -AclObject $fileAcl
+        $before=(Get-Acl -LiteralPath $child).Sddl
+        if((Invoke-DirectoryHelper $root) -eq 0 -or (Get-Acl -LiteralPath $child).Sddl -cne $before -or [IO.File]::ReadAllText($child) -cne 'untrusted fixture: preserve'){throw 'Untrusted existing file was adopted or changed.'}
+        Remove-Item -LiteralPath $child
+        $broad=Get-Acl -LiteralPath $root
+        $broad.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new('S-1-5-32-545'),'Write','ContainerInherit,ObjectInherit','None','Allow'))
+        Set-Acl -LiteralPath $root -AclObject $broad;$before=(Get-Acl -LiteralPath $root).Sddl
+        if((Invoke-DirectoryHelper $root) -eq 0 -or (Get-Acl -LiteralPath $root).Sddl -cne $before){throw 'Writable existing state was silently adopted.'}
+    }finally{
+        $child=Join-Path $root 'untrusted.txt';if(Test-Path -LiteralPath $child){Remove-Item -LiteralPath $child}
+        if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root}
+    }
+}
+Write-Output ('Customer directory ACL checks passed; administrator filesystem cases executed: '+$admin)
diff --git a/deployment/windows/test_customer_exe.py b/deployment/windows/test_customer_exe.py
new file mode 100644
index 00000000000..135a145dd12
--- /dev/null
+++ b/deployment/windows/test_customer_exe.py
@@ -0,0 +1,144 @@
+import hashlib
+import importlib.util
+import json
+from pathlib import Path
+import shutil
+import struct
+import tempfile
+import unittest
+import zipfile
+
+import brotli
+
+
+def module(name, filename):
+    spec = importlib.util.spec_from_file_location(name, Path(__file__).with_name(filename))
+    value = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(value)
+    return value
+
+
+staging = module("customer_exe_staging", "prepare-customer-exe.py")
+portable = module("customer_exe_verification", "verify-portable-payload.py")
+
+
+class CustomerExeTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.payload = self.root / "payload"
+        self.payload.mkdir()
+        self.files = {"rustdesk.exe": b"signed inner executable bytes",
+                      "librustdesk.dll": b"native library", "flutter_windows.dll": b"engine"}
+        for name, data in self.files.items():
+            (self.payload / name).write_bytes(data)
+        self.manifest = [{"path": "Swan Remote Support.exe" if n == "rustdesk.exe" else n,
+                          "sha256": hashlib.sha256(v).hexdigest()} for n, v in self.files.items()]
+        self.revision = "a" * 40
+
+    def source_archive(self, extra=None):
+        names = {"Cargo.toml", "Cargo.lock", ".cargo/config.toml", "libs/portable/Cargo.toml",
+                 "libs/portable/generate.py", "libs/portable/build.rs", "res/icon.ico", "res/manifest.xml"}
+        files = {name: ("source:" + name).encode() for name in names}
+        files.update(extra or {})
+        metadata = {"repositories": {".": self.revision}, "source_date_epoch": 1793661395,
+                    "files": {n: {"sha256": hashlib.sha256(v).hexdigest()} for n, v in files.items()}}
+        archive = self.root / "source.zip"
+        with zipfile.ZipFile(archive, "x") as z:
+            z.writestr("BUILD-SOURCE.json", json.dumps(metadata))
+            for name, data in files.items():
+                z.writestr("source/" + name, data)
+        return archive, hashlib.sha256(archive.read_bytes()).hexdigest()
+
+    def package(self, entries=None, entrypoint=b".\\Swan Remote Support.exe"):
+        raw = bytearray(b"not a PE; test the portable container only\0rustdesk")
+        files = {"Swan Remote Support.exe" if n == "rustdesk.exe" else n: v
+                 for n, v in self.files.items()} if entries is None else entries
+        for name, content in files.items():
+            encoded = ("./" + name).encode()
+            compressed = brotli.compress(content)
+            raw.extend(struct.pack(">I", len(encoded)) + encoded)
+            raw.extend(struct.pack(">I", len(compressed)) + compressed + hashlib.md5(content).hexdigest().encode())
+        raw.extend(b"rustdesk" + entrypoint)
+        package = self.root / "container.bin"
+        package.write_bytes(raw)
+        return package
+
+    def test_pinned_source_and_exact_signed_inner_bytes_are_staged_without_execution(self):
+        archive, digest = self.source_archive()
+        work = self.root / "work"
+        record = staging.prepare(archive, digest, self.revision, self.payload, self.manifest, work)
+        self.assertFalse(record["executables_run"])
+        self.assertEqual(record["payload_files"], 3)
+        self.assertEqual((work / "payload/Swan Remote Support.exe").read_bytes(), self.files["rustdesk.exe"])
+        self.assertFalse((work / "payload/rustdesk.exe").exists())
+        self.assertEqual((work / "source/Cargo.lock").read_bytes(), b"source:Cargo.lock")
+        with self.assertRaises(FileExistsError):
+            staging.prepare(archive, digest, self.revision, self.payload, self.manifest, work)
+
+    def test_wrong_source_hash_or_revision_is_rejected_before_staging(self):
+        archive, digest = self.source_archive()
+        for pin, revision in (("0" * 64, self.revision), (digest, "b" * 40)):
+            work = self.root / "work"
+            with self.assertRaises(ValueError):
+                staging.prepare(archive, pin, revision, self.payload, self.manifest, work)
+            self.assertFalse(work.exists())
+
+    def test_native_directory_copy_installs_the_exact_manifest_names(self):
+        archive, digest = self.source_archive()
+        work = self.root / "work"
+        staging.prepare(archive, digest, self.revision, self.payload, self.manifest, work)
+        installed = self.root / "installed"
+        # The native Flutter installer copies the directory without renaming.
+        shutil.copytree(work / "payload", installed)
+        actual = {f.relative_to(installed).as_posix(): hashlib.sha256(f.read_bytes()).hexdigest()
+                  for f in installed.rglob("*") if f.is_file()}
+        self.assertEqual(actual, {item["path"]: item["sha256"] for item in self.manifest})
+
+    def test_legacy_packaged_filename_cannot_be_remapped_into_a_passing_manifest(self):
+        with self.assertRaises(ValueError):
+            portable.verify(self.package(self.files, b".\\rustdesk.exe"), self.manifest)
+        with self.assertRaises(ValueError):
+            portable.verify(self.package(entrypoint=b".\\rustdesk.exe"), self.manifest)
+
+    def test_tampered_inner_executable_cannot_be_wrapped_using_the_signed_manifest(self):
+        archive, digest = self.source_archive()
+        (self.payload / "rustdesk.exe").write_bytes(b"unsigned replacement")
+        with self.assertRaises(ValueError):
+            staging.prepare(archive, digest, self.revision, self.payload, self.manifest, self.root / "work")
+
+    def test_source_archive_cannot_escape_or_alias_windows_paths(self):
+        for name in ("../escape", "a//b", "C:/escape", "a/CON.txt", "a/b."):
+            with self.subTest(name=name), self.assertRaises(ValueError):
+                staging.safe_path(name)
+
+    def test_exact_embedded_payload_passes_without_running_it(self):
+        result = portable.verify(self.package(), self.manifest)
+        self.assertTrue(result["embedded_payload_matches_manifest"])
+        self.assertFalse(result["payload_executed"])
+        self.assertEqual(result["embedded_files"], 3)
+
+    def test_signing_only_outer_does_not_make_old_inner_bytes_match(self):
+        changed = {"Swan Remote Support.exe" if n == "rustdesk.exe" else n: v
+                   for n, v in self.files.items()}
+        changed["Swan Remote Support.exe"] = b"earlier unsigned inner executable"
+        with self.assertRaises(ValueError):
+            portable.verify(self.package(changed), self.manifest)
+
+    def test_corrupted_payload_or_entrypoint_is_rejected(self):
+        package = self.package()
+        package.write_bytes(package.read_bytes().replace(hashlib.md5(self.files["rustdesk.exe"]).hexdigest().encode(), b"0" * 32))
+        with self.assertRaises(ValueError):
+            portable.verify(package, self.manifest)
+        with self.assertRaises(ValueError):
+            portable.verify(self.package(entrypoint=b"../another.exe"), self.manifest)
+
+    def test_duplicate_installed_name_or_unsafe_embedded_path_is_rejected(self):
+        for extra in ({"Swan Remote Support.exe": b"alias"}, {"../escape": b"outside"}):
+            with self.subTest(extra=extra), self.assertRaises(ValueError):
+                portable.verify(self.package(dict(self.files, **extra)), self.manifest)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_customer_exe_native_output.ps1 b/deployment/windows/test_customer_exe_native_output.ps1
new file mode 100644
index 00000000000..571cd919148
--- /dev/null
+++ b/deployment/windows/test_customer_exe_native_output.ps1
@@ -0,0 +1,24 @@
+param(
+    [Parameter(Mandatory=$true)][string]$PythonExe,
+    [string]$ProducerPath
+)
+$ErrorActionPreference='Stop'
+if(!$ProducerPath){$ProducerPath=Join-Path $PSScriptRoot 'Build-CustomerExe.ps1'}
+$tokens=$null;$errors=$null
+$ast=[Management.Automation.Language.Parser]::ParseFile($ProducerPath,[ref]$tokens,[ref]$errors)
+if($errors.Count){throw 'Producer syntax invalid'}
+$functions=@($ast.FindAll({param($node) $node -is [Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -ceq 'Invoke-BuildTool'},$true))
+if($functions.Count -ne 1){throw 'Expected one real producer native-command helper'}
+. ([ScriptBlock]::Create($functions[0].Extent.Text))
+Invoke-BuildTool $PythonExe @('-c',"import sys; print('normal build output'); print('normal compiler progress', file=sys.stderr)")
+if($ErrorActionPreference -cne 'Stop'){throw 'Native progress weakened PowerShell error handling'}
+$rejected=$false
+try{Invoke-BuildTool $PythonExe @('-c',"import sys; print('deliberate build rejection', file=sys.stderr); sys.exit(7)")}catch{if($_.Exception.Message -notmatch 'Build tool failed \(7\)'){throw};$rejected=$true}
+if(!$rejected -or $ErrorActionPreference -cne 'Stop'){throw 'Native failure was accepted or preference was not restored'}
+Invoke-BuildTool $PythonExe @('-c',"print('successful command after rejection')")
+$missing=Join-Path $PSScriptRoot 'nonexistent-native-build-tool.exe'
+if(Test-Path $missing){throw 'Missing-tool fixture already exists'}
+$rejected=$false
+try{Invoke-BuildTool $missing @()}catch{$rejected=$true}
+if(!$rejected -or $ErrorActionPreference -cne 'Stop'){throw 'Missing tool inherited a stale successful exit code'}
+Write-Host 'Actual producer helper accepts native progress, rejects exit7 and a missing tool, restores Stop and supports a subsequent successful command.'
diff --git a/deployment/windows/test_customer_exe_uninstall.ps1 b/deployment/windows/test_customer_exe_uninstall.ps1
new file mode 100644
index 00000000000..ceaea3a60cb
--- /dev/null
+++ b/deployment/windows/test_customer_exe_uninstall.ps1
@@ -0,0 +1,37 @@
+$ErrorActionPreference='Stop'
+$script=Join-Path $PSScriptRoot 'Complete-CustomerExeUninstall.ps1'
+$tokens=$null;$errors=$null
+$ast=[Management.Automation.Language.Parser]::ParseFile($script,[ref]$tokens,[ref]$errors)
+if ($errors.Count) { throw 'Customer uninstall completion failed parsing.' }
+$function=$ast.Find({param($node) $node -is [Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Remove-CustomerExeAgent'},$true)
+if (-not $function) { throw 'Customer uninstall completion function missing.' }
+. ([ScriptBlock]::Create($function.Extent.Text))
+$root=Join-Path ([IO.Path]::GetTempPath()) ('swan-customer-exe-uninstall-'+[Guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory $root|Out-Null
+$agent=Join-Path $root 'swan-agent.exe';$marker=Join-Path $root 'pending-uninstall'
+$state=Join-Path $root 'managed-state.json';$other=Join-Path $root 'other.exe'
+try {
+    [IO.File]::WriteAllText($agent,'inert agent fixture')
+    [IO.File]::WriteAllText($state,'retained identity and consent')
+    [IO.File]::WriteAllText($other,'unrelated retained fixture')
+    $rejected=$false
+    try { Remove-CustomerExeAgent -Directory $root } catch { $rejected=$true }
+    if (-not $rejected -or -not (Test-Path $agent)) { throw 'Agent removed without uninstall cancellation.' }
+    New-Item -ItemType Directory $marker|Out-Null
+    $rejected=$false
+    try { Remove-CustomerExeAgent -Directory $root } catch { $rejected=$true }
+    if (-not $rejected -or -not (Test-Path $agent)) { throw 'Invalid marker allowed removal.' }
+    Remove-Item -LiteralPath $marker
+    [IO.File]::WriteAllText($marker,'')
+    Remove-CustomerExeAgent -Directory $root
+    Remove-CustomerExeAgent -Directory $root
+    if ((Test-Path $agent) -or -not (Test-Path $marker) -or [IO.File]::ReadAllText($state) -cne 'retained identity and consent' -or [IO.File]::ReadAllText($other) -cne 'unrelated retained fixture') { throw 'Removal changed retained data or failed to remove agent.' }
+    New-Item -ItemType Directory $agent|Out-Null
+    $rejected=$false
+    try { Remove-CustomerExeAgent -Directory $root } catch { $rejected=$true }
+    if (-not $rejected -or -not (Test-Path $agent)) { throw 'Directory accepted as agent.' }
+} finally {
+    foreach($path in @($agent,$marker,$state,$other)) { if(Test-Path -LiteralPath $path){Remove-Item -LiteralPath $path} }
+    Remove-Item -LiteralPath $root
+}
+Write-Output 'Customer EXE uninstall completion checks passed; installed applications were not changed.'
diff --git a/deployment/windows/test_customer_msi.py b/deployment/windows/test_customer_msi.py
new file mode 100644
index 00000000000..55fa574239b
--- /dev/null
+++ b/deployment/windows/test_customer_msi.py
@@ -0,0 +1,168 @@
+import importlib.util
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+import uuid
+
+spec = importlib.util.spec_from_file_location("customer_msi", Path(__file__).with_name("generate-customer-msi.py"))
+msi = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(msi)
+
+
+class CustomerMsiTests(unittest.TestCase):
+    def test_product_codes_follow_standard_uuid5_across_both_builders(self):
+        shell = shutil.which("pwsh") or shutil.which("powershell")
+        if not shell:
+            self.skipTest("PowerShell required for cross-builder identity validation")
+        script = Path(__file__).with_name("Get-MsiProductCode.ps1")
+        namespaces = {"customer": msi.UPGRADE, "technician": uuid.UUID("a4374699-436f-4917-9a4e-223f62a9e634")}
+        observed = set()
+        for edition, namespace in namespaces.items():
+            for version in ("1.5.0", "1.5.1", "0.0.0", "255.255.65535"):
+                actual = subprocess.check_output([shell, "-NoProfile", "-NonInteractive", "-File", str(script),
+                                                  "-Edition", edition, "-Version", version], text=True).strip()
+                expected = str(uuid.uuid5(namespace, "windows-x64|" + version)).upper()
+                self.assertEqual(actual, expected)
+                observed.add(actual)
+        self.assertEqual(len(observed), 8)
+
+    def test_version_aliases_and_msi_overflow_are_rejected_by_both_builders(self):
+        shell = shutil.which("pwsh") or shutil.which("powershell")
+        if not shell:
+            self.skipTest("PowerShell required for cross-builder version validation")
+        script = Path(__file__).with_name("Get-MsiProductCode.ps1")
+        with tempfile.TemporaryDirectory() as folder:
+            source, agent = self.fixture(Path(folder))
+            for version in ("01.5.0", "1.05.0", "1.5.00", "256.0.0", "1.256.0", "1.0.65536",
+                            "1.5.0.1", "1.5.0\n", "١.5.0", "999999999999999999999.0.0"):
+                with self.subTest(version=repr(version)):
+                    with self.assertRaises(ValueError):
+                        msi.author(source, agent, version)
+                    for edition in ("customer", "technician"):
+                        result = subprocess.run([shell, "-NoProfile", "-NonInteractive", "-File", str(script),
+                                                 "-Edition", edition, "-Version", version], capture_output=True)
+                        self.assertNotEqual(result.returncode, 0)
+
+    def fixture(self, root):
+        source = root / "payload"
+        source.mkdir()
+        for name in ("rustdesk.exe", "librustdesk.dll", "flutter_windows.dll"):
+            (source / name).write_bytes(name.encode())
+        assets = source / "data" / "flutter_assets"
+        assets.mkdir(parents=True)
+        (assets / "test.txt").write_bytes(b"asset")
+        agent = root / "agent.exe"
+        agent.write_bytes(b"agent")
+        return source, agent
+
+    def test_full_manifest_license_and_service_lifecycle(self):
+        with tempfile.TemporaryDirectory() as folder:
+            source, agent = self.fixture(Path(folder))
+            tree, files = msi.author(source, agent, "1.5.0")
+            paths = {file["path"] for file in files}
+            self.assertEqual(paths, {"Swan Remote Support.exe", "librustdesk.dll", "flutter_windows.dll", "data/flutter_assets/test.txt", "LICENSE.txt"})
+            ns = {"w": msi.NAMESPACE}
+            shortcut_policy = tree.find("w:Package/w:Property[@Id='DISABLEADVTSHORTCUTS']", ns)
+            self.assertEqual(shortcut_policy.attrib["Value"], "1")
+            self.assertEqual(tree.find("w:Package", ns).attrib["ProductCode"],
+                             str(uuid.uuid5(msi.UPGRADE, "windows-x64|1.5.0")).upper())
+            service = tree.find(".//w:ServiceInstall", ns)
+            self.assertEqual(service.attrib["Name"], "Swan Remote Support")
+            self.assertEqual(service.attrib["Arguments"], "--service")
+            control = tree.find(".//w:ServiceControl", ns)
+            self.assertEqual(control.attrib["Stop"], "both")
+            self.assertEqual(control.attrib["Remove"], "uninstall")
+            copy = tree.find(".//w:CopyFile", ns)
+            self.assertEqual(copy.attrib["SourceDirectory"], "System64Folder")
+            self.assertEqual(copy.attrib["DestinationName"], "RuntimeBroker_rustdesk.exe")
+            registration = tree.find(".//w:Component[@Id='CustomerMsiRegistration']/w:RegistryValue", ns)
+            self.assertEqual(registration.attrib["Root"], "HKLM")
+            self.assertEqual(registration.attrib["Value"], "[ProductCode]")
+            self.assertEqual(registration.attrib["Key"], "Software\\SwanRemoteSupport\\Customer")
+            location = tree.find(".//w:SetProperty[@Id='ARPINSTALLLOCATION']", ns)
+            self.assertEqual(location.attrib["Value"], "[INSTALLFOLDER]")
+            cleanup = tree.find(".//w:CustomAction[@Id='RemoveCompanyConfigurationTask']", ns)
+            self.assertEqual(cleanup.attrib["BinaryRef"], "UninstallCommitAgent")
+            self.assertEqual(cleanup.attrib["ExeCommand"], 'remove-configuration-task "[STATEFOLDER]."')
+            self.assertEqual(cleanup.attrib["Execute"], "deferred")
+            self.assertEqual(cleanup.attrib["Impersonate"], "no")
+            scheduling = tree.find(".//w:InstallExecuteSequence/w:Custom[@Action='RemoveCompanyConfigurationTask']", ns)
+            self.assertEqual(scheduling.attrib["Before"], "RemoveFiles")
+            self.assertEqual(scheduling.attrib["Condition"], 'REMOVE = "ALL" AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY')
+            rollback = tree.find(".//w:CustomAction[@Id='RestoreCompanyConfigurationTask']", ns)
+            self.assertEqual(rollback.attrib["Execute"], "rollback")
+            self.assertEqual(rollback.attrib["BinaryRef"], "UninstallCommitAgent")
+            self.assertEqual(rollback.attrib["ExeCommand"], 'restore-configuration-task "[STATEFOLDER]."')
+            rollback_scheduling = tree.find(".//w:InstallExecuteSequence/w:Custom[@Action='RestoreCompanyConfigurationTask']", ns)
+            self.assertEqual(rollback_scheduling.attrib["Before"], "RemoveCompanyConfigurationTask")
+            embedded = tree.find(".//w:Binary[@Id='UninstallCommitAgent']", ns)
+            self.assertEqual(embedded.attrib["SourceFile"], str(agent.resolve()))
+            commit = tree.find(".//w:CustomAction[@Id='CommitCompanyUninstall']", ns)
+            self.assertEqual(commit.attrib["BinaryRef"], "UninstallCommitAgent")
+            self.assertEqual(commit.attrib["Execute"], "commit")
+            self.assertEqual(commit.attrib["Impersonate"], "no")
+            self.assertEqual(commit.attrib["Return"], "check")
+            self.assertEqual(commit.attrib["ExeCommand"], 'commit-uninstall customer "[STATEFOLDER]."')
+            commit_scheduling = tree.find(".//w:InstallExecuteSequence/w:Custom[@Action='CommitCompanyUninstall']", ns)
+            self.assertEqual(commit_scheduling.attrib["After"], "RemoveCompanyConfigurationTask")
+            self.assertEqual(commit_scheduling.attrib["Condition"], scheduling.attrib["Condition"])
+            preparation = tree.find(".//w:CustomAction[@Id='PrepareCustomerState']", ns)
+            self.assertEqual(preparation.attrib["BinaryRef"], "UninstallCommitAgent")
+            self.assertEqual(preparation.attrib["ExeCommand"], 'prepare-customer-directory "[STATEFOLDER]."')
+            self.assertEqual(preparation.attrib["Execute"], "deferred")
+            self.assertEqual(preparation.attrib["Impersonate"], "no")
+            preparation_sequence = tree.find(".//w:InstallExecuteSequence/w:Custom[@Action='PrepareCustomerState']", ns)
+            self.assertEqual(preparation_sequence.attrib["Before"], "CreateFolders")
+            self.assertEqual(preparation_sequence.attrib["Condition"], 'NOT (REMOVE = "ALL")')
+            installed_files = tree.findall(".//w:File", ns)
+            self.assertEqual(len(installed_files), len(files)+1)
+
+    def test_technician_uninstall_commit_retains_user_context(self):
+        import xml.etree.ElementTree as ET
+        tree = ET.parse(Path(__file__).with_name("msi") / "Technician.wxs")
+        ns = {"w": msi.NAMESPACE}
+        action = tree.find(".//w:CustomAction[@Id='CommitTechnicianUninstall']", ns)
+        self.assertEqual(action.attrib["BinaryRef"], "UninstallCommitAgent")
+        self.assertEqual(action.attrib["ExeCommand"], 'commit-uninstall technician "[INSTALLFOLDER]."')
+        self.assertEqual(action.attrib["Execute"], "commit")
+        self.assertEqual(action.attrib["Impersonate"], "yes")
+        self.assertEqual(action.attrib["Return"], "check")
+        sequence = tree.find(".//w:InstallExecuteSequence/w:Custom[@Action='CommitTechnicianUninstall']", ns)
+        self.assertEqual(sequence.attrib["After"], "CancelUpdateRecovery")
+        self.assertEqual(sequence.attrib["Condition"], 'REMOVE = "ALL" AND NOT UPGRADINGPRODUCTCODE AND NOT SWAN_RECOVERY')
+        for name, command in (("CancelUpdateRecovery", "cancel-update-recovery"), ("RestoreUpdateRecovery", "restore-update-recovery")):
+            action = tree.find(".//w:CustomAction[@Id='" + name + "']", ns)
+            self.assertEqual(action.attrib["BinaryRef"], "UninstallCommitAgent")
+            self.assertEqual(action.attrib["ExeCommand"], command + ' "[INSTALLFOLDER]."')
+            self.assertEqual(action.attrib["Impersonate"], "yes")
+
+    def test_component_identity_survives_version_and_payload_changes(self):
+        with tempfile.TemporaryDirectory() as folder:
+            source, agent = self.fixture(Path(folder))
+            first, _ = msi.author(source, agent, "1.5.0")
+            (source / "rustdesk.exe").write_bytes(b"new release")
+            second, _ = msi.author(source, agent, "1.6.0")
+            tag = "{"+msi.NAMESPACE+"}Component"
+            first_ids = {item.attrib["Id"]: item.attrib["Guid"] for item in first.iter(tag)}
+            second_ids = {item.attrib["Id"]: item.attrib["Guid"] for item in second.iter(tag)}
+            self.assertEqual(first_ids, second_ids)
+
+    def test_unsafe_names_versions_and_incomplete_payloads_are_rejected(self):
+        with tempfile.TemporaryDirectory() as folder:
+            source, agent = self.fixture(Path(folder))
+            with self.assertRaises(ValueError):
+                msi.author(source, agent, "1.5.0;command")
+            bad = source / "bad'.dll"
+            bad.write_bytes(b"unsafe")
+            with self.assertRaises(ValueError):
+                msi.author(source, agent, "1.5.0")
+            bad.unlink()
+            (source / "librustdesk.dll").unlink()
+            with self.assertRaises(ValueError):
+                msi.author(source, agent, "1.5.0")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_customer_service_startup.ps1 b/deployment/windows/test_customer_service_startup.ps1
new file mode 100644
index 00000000000..079cdd5700b
--- /dev/null
+++ b/deployment/windows/test_customer_service_startup.ps1
@@ -0,0 +1,89 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Package,[Parameter(Mandatory)][string]$CustomerExecutable)
+$ErrorActionPreference='Stop'
+if($env:GITHUB_ACTIONS -ne 'true' -or $env:RUNNER_OS -ne 'Windows' -or -not $env:RUNNER_TEMP){throw 'This installation test requires a disposable Windows CI runner.'}
+$packagePath=(Resolve-Path -LiteralPath $Package).Path
+if($packagePath -notmatch '-unsigned\.msi$'){throw 'Select an explicitly unsigned test MSI.'}
+$packageHash=(Get-FileHash -LiteralPath $packagePath).Hash
+$executableHash=(Get-FileHash -LiteralPath $CustomerExecutable).Hash
+$installation=Join-Path $env:ProgramFiles 'Swan Remote Support'
+$state=Join-Path $env:ProgramData 'SwanRemoteSupport'
+$registration='HKLM:\Software\SwanRemoteSupport\Customer'
+$serviceName='Swan Remote Support'
+if((Test-Path -LiteralPath $installation) -or (Test-Path -LiteralPath $state) -or (Test-Path -LiteralPath $registration) -or (Get-Service -Name $serviceName -ErrorAction SilentlyContinue)){throw 'Preserve an existing customer installation or configuration.'}
+$root=Join-Path ([IO.Path]::GetFullPath($env:RUNNER_TEMP)) ('swan-customer-service-'+[guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $root|Out-Null
+$script:msiActive=$false
+function Invoke-OwnedMsi([string]$Operation,[string]$Name){
+ if($Operation -notin @('/i','/x') -or $Name -notin @('install','uninstall')){throw 'Invalid lifecycle operation.'}
+ if((Get-FileHash -LiteralPath $packagePath).Hash -cne $packageHash){throw 'MSI bytes changed.'}
+ $log=Join-Path $root ($Name+'.log')
+ if(@($packagePath,$log)|Where-Object {$_ -match '["\r\n]'}){throw 'Unsupported MSI argument.'}
+ $start=[Diagnostics.ProcessStartInfo]::new()
+ $start.FileName=Join-Path $env:SystemRoot 'System32\msiexec.exe'
+ $start.UseShellExecute=$false
+ $start.CreateNoWindow=$true
+ $start.Arguments=$Operation+' "'+$packagePath+'" /qn /norestart /l*v "'+$log+'"'
+ $process=[Diagnostics.Process]::Start($start)
+ $script:msiActive=$true
+ try{
+  if(-not $process.WaitForExit(180000)){throw 'Original MSI is still running; do not launch a competing cleanup.'}
+  $script:msiActive=$false
+  if($process.ExitCode -ne 0){throw ('MSI '+$Name+' failed: '+$process.ExitCode)}
+ }finally{$process.Dispose()}
+}
+$installed=$false
+$passed=$false
+$record=[ordered]@{fixture_revision=$env:GITHUB_SHA;package_sha256=$packageHash.ToLowerInvariant();unsigned_test=$true;passed=$false;scope='Fresh administrative MSI install/start and service module inspection, then uninstall on disposable CI; no cold reboot, enrollment, signature acceptance or remote session'}
+try{
+ $timer=[Diagnostics.Stopwatch]::StartNew()
+ Invoke-OwnedMsi '/i' 'install'
+ $installed=$true
+ $timer.Stop()
+ $record.install_elapsed_seconds=$timer.Elapsed.TotalSeconds
+ $target=Join-Path $installation 'Swan Remote Support.exe'
+ if((Get-FileHash -LiteralPath $target).Hash -cne $executableHash){throw 'Installed launcher differs from built payload.'}
+ $shortcut=Join-Path ([Environment]::GetFolderPath('CommonPrograms')) 'Swan Remote Support.lnk'
+ if(-not (Test-Path -LiteralPath $shortcut)){throw 'Installed customer shortcut is missing.'}
+ $shell=New-Object -ComObject WScript.Shell
+ $link=$shell.CreateShortcut($shortcut)
+ if([IO.Path]::GetFullPath($link.TargetPath) -ine [IO.Path]::GetFullPath($target)){throw 'Customer shortcut must directly open the installed application rather than invoke MSI advertisement.'}
+ Add-Type -TypeDefinition @'
+using System.Runtime.InteropServices;
+using System.Text;
+public static class SwanCustomerShortcutCheck {
+ [DllImport("msi.dll", CharSet=CharSet.Unicode, EntryPoint="MsiGetShortcutTargetW")]
+ public static extern uint GetTarget(string shortcut, StringBuilder product, StringBuilder feature, StringBuilder component);
+}
+'@
+ if([SwanCustomerShortcutCheck]::GetTarget($shortcut,[Text.StringBuilder]::new(39),[Text.StringBuilder]::new(39),[Text.StringBuilder]::new(39)) -eq 0){throw 'Advertised customer shortcut can trigger an uncoordinated MSI repair for standard users.'}
+ $record.customer_shortcut_direct_target_verified=$true
+ $record.customer_shortcut_not_advertised=$true
+ $service=Get-CimInstance Win32_Service -Filter "Name='Swan Remote Support'"
+ if($service.State -ne 'Running' -or $service.StartMode -ne 'Auto' -or $service.StartName -ne 'LocalSystem'){throw 'MSI did not start the expected automatic LocalSystem service.'}
+ if($service.PathName -cne ('"'+$target+'" --service')){throw 'Unexpected service executable or arguments.'}
+ $process=Get-Process -Id $service.ProcessId
+ try{$modules=@($process.Modules|ForEach-Object ModuleName)}finally{$process.Dispose()}
+ if(-not ($modules -icontains 'librustdesk.dll')){throw 'Expected native service core missing.'}
+ if(@($modules|Where-Object {$_ -ieq 'flutter_windows.dll' -or $_ -imatch '_plugin\.dll$'}).Count){throw 'Headless service eagerly loaded desktop DLLs.'}
+ $record.service_running_without_manual_start=$true
+ $record.no_desktop_engine_or_plugin_modules=$true
+ $record.service_modules=$modules
+ $passed=$true
+}catch{
+ $record.failure=$_.Exception.Message
+ throw
+}finally{
+ try{if($installed -and -not $script:msiActive){
+  try{
+   Invoke-OwnedMsi '/x' 'uninstall'
+   if((Get-Service -Name $serviceName -ErrorAction SilentlyContinue) -or (Test-Path -LiteralPath (Join-Path $installation 'Swan Remote Support.exe')) -or (Test-Path -LiteralPath $registration)){throw 'Owned customer installation remains after uninstall.'}
+   $record.uninstall_verified=$true
+  }catch{$passed=$false;$record.cleanup_failure=$_.Exception.Message;throw}
+ }}finally{
+ $record.passed=$passed
+ $record.completed_utc=[DateTime]::UtcNow.ToString('o')
+ $record|ConvertTo-Json -Depth 5|Set-Content -LiteralPath (Join-Path $root 'result.json')
+ }
+}
+Write-Output ('Customer service startup and module test passed; evidence: '+$root)
diff --git a/deployment/windows/test_customer_ui_restart.ps1 b/deployment/windows/test_customer_ui_restart.ps1
new file mode 100644
index 00000000000..ba3ffb7ed0f
--- /dev/null
+++ b/deployment/windows/test_customer_ui_restart.ps1
@@ -0,0 +1,201 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$Directory,
+    [Parameter(Mandatory=$true)][string]$Executable,
+    [Parameter(Mandatory=$true)][string]$ResultPath
+)
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+if (-not [Security.Principal.WindowsIdentity]::GetCurrent().IsSystem) { throw 'Use SYSTEM in a disposable Windows lab with an installed customer and a logged-in standard user.' }
+if (Test-Path -LiteralPath $Directory) { throw 'Preserve the previous test directory.' }
+$exe=[IO.Path]::GetFullPath($Executable)
+$initial=@()
+foreach ($process in @(Get-CimInstance Win32_Process -Filter "Name='Swan Remote Support.exe'")) {
+    if ($process.SessionId -eq 0 -or $process.ExecutablePath -ine $exe) { continue }
+    $owner=Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid
+    if ($owner.ReturnValue -ne 0) { throw 'Cannot identify disposable customer UI.' }
+    if ($owner.Sid -ne 'S-1-5-18') { $initial+=@{Pid=[int]$process.ProcessId;Sid=$owner.Sid;Created=$process.CreationDate.ToUniversalTime()} }
+}
+$accounts=@($initial | ForEach-Object Sid | Sort-Object -Unique)
+if ($accounts.Count -ne 1 -or $initial.Count -lt 1) { throw 'One genuine standard-user customer desktop is required.' }
+$sid=$accounts[0]
+$administrators=Get-LocalGroup -SID 'S-1-5-32-544'
+if (@(Get-LocalGroupMember -Group $administrators.Name | Where-Object { $_.SID.Value -eq $sid }).Count) { throw 'Administrator UI does not qualify this regression.' }
+$serviceBefore=(Get-Service -Name 'Swan Remote Support').Status
+if ($serviceBefore -ne 'Running') { throw 'The disposable customer service must already be healthy.' }
+$payloadBefore=(Get-FileHash -LiteralPath $exe).Hash
+New-Item -ItemType Directory -Path $Directory | Out-Null
+& icacls.exe $Directory /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+if ($LASTEXITCODE -ne 0) { throw 'Private fixture directory failed.' }
+# This is a separate helper fixture, not a forged installation or authorization.
+# Real automatic-update acceptance must also exercise the signed MSI/agent path.
+[IO.File]::WriteAllText((Join-Path $Directory 'installed-release.json'),'{}')
+. (Join-Path $PSScriptRoot 'Restart-CustomerUi.ps1') -Directory $Directory -Executable $exe
+function Require([bool]$Condition,[string]$Message) { if (-not $Condition) { throw $Message } }
+function Require-OriginalProcesses {
+    foreach ($process in $initial) {
+        $current=Get-CimInstance Win32_Process -Filter ('ProcessId='+$process.Pid)
+        Require ($null -ne $current -and $current.CreationDate.ToUniversalTime() -eq $process.Created) 'A safety rejection stopped an original GUI.'
+    }
+}
+function New-OwnedFixtureTask([string]$Name,$Action) {
+    $principal=New-ScheduledTaskPrincipal -UserId $sid -LogonType Interactive -RunLevel Limited
+    $trigger=New-ScheduledTaskTrigger -AtLogOn -User $sid
+    $settings=New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 2) -MultipleInstances IgnoreNew -Priority 4 -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
+    $task=Register-ScheduledTask -TaskName $Name -Action $Action -Principal $principal -Trigger $trigger -Settings $settings
+    $scheduler=New-Object -ComObject Schedule.Service;$scheduler.Connect();$registered=$scheduler.GetFolder('\').GetTask($Name)
+    $registered.SetSecurityDescriptor(('O:SYG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FRFXSD;;;'+$sid+')'),0x10)
+    Assert-CustomerUiTask $task $Action $sid $registered
+    return $task
+}
+Stop-OwnedCustomerUi @() $exe
+$probe=$initial[0]
+foreach ($case in @('creation','path','sid')) {
+    $created=$probe.Created.ToFileTimeUtc();$path=$exe;$account=$sid
+    if ($case -eq 'creation') { $created+=10 }
+    elseif ($case -eq 'path') { $path=Join-Path $Directory 'Swan Remote Support.exe' }
+    else { $account='S-1-5-18' }
+    $rejected=$false
+    try { [void][SwanCustomerUiProcess]::Stop($probe.Pid,$created,$path,$account) } catch { $rejected=$true }
+    Require $rejected ('Native process guard accepted wrong '+$case)
+    Require-OriginalProcesses
+}
+$context=Read-CustomerUiRecoveryTasks $Directory $exe
+$name=Get-CustomerUiTaskName $context.Prefix $sid
+Require (-not (Get-ScheduledTask -TaskName $name -ErrorAction SilentlyContinue)) 'Preserve an existing task.'
+$foreignAction=New-ScheduledTaskAction -Execute ($env:SystemRoot+'/System32/notepad.exe')
+$foreignPrincipal=New-ScheduledTaskPrincipal -UserId 'S-1-5-18' -LogonType ServiceAccount -RunLevel Highest
+Register-ScheduledTask -TaskName $name -Action $foreignAction -Principal $foreignPrincipal | Out-Null
+$rejected=$false
+try { Restart-VerifiedCustomerUi $Directory $exe | Out-Null } catch { $rejected=$true }
+Require $rejected 'A foreign task was accepted.'
+$foreign=Get-ScheduledTask -TaskName $name
+Require ($foreign.Actions[0].Execute -ceq $foreignAction.Execute -and $foreign.Principal.UserId -in @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) 'Foreign task was changed.'
+Require-OriginalProcesses
+$foreign | Unregister-ScheduledTask -Confirm:$false
+
+$rejected=$false
+try { Restart-VerifiedCustomerUi $Directory $exe -PrepareOnly | Out-Null } catch { $rejected=$true }
+Require $rejected 'Preparation without pending update was accepted.'
+Require-OriginalProcesses
+$rejected=$false
+try { Restart-VerifiedCustomerUi $Directory $exe -PrepareOnly -UninstallPrepare | Out-Null } catch { $rejected=$true }
+Require $rejected 'Uninstall preparation without explicit cancellation was accepted.'
+Require-OriginalProcesses
+[IO.File]::WriteAllText((Join-Path $Directory 'pending-update.json'),'{}')
+$ExpectedHashes=('0'*64)+','+('0'*64)
+$rejected=$false
+try { Restart-VerifiedCustomerUi $Directory $exe -PrepareOnly | Out-Null } catch { $rejected=$true }
+Require $rejected 'Preparation accepted an executable outside both signed identities.'
+Require-OriginalProcesses
+$ExpectedHashes=$payloadBefore.ToLowerInvariant()+','+$payloadBefore.ToLowerInvariant()
+
+$originalStop=(Get-Item Function:\Stop-OwnedCustomerUi).ScriptBlock
+try {
+    function Stop-OwnedCustomerUi { throw 'Simulated interruption before stopping old GUI.' }
+    $interrupted=$false
+    try { Restart-VerifiedCustomerUi $Directory $exe -PrepareOnly | Out-Null } catch { $interrupted=$true }
+    Require $interrupted 'The pre-stop interruption was not exercised.'
+    Require-OriginalProcesses
+    $context=Read-CustomerUiRecoveryTasks $Directory $exe
+    Require ($context.Tasks.Count -eq 1 -and $context.Tasks.ContainsKey($sid)) 'Restart intent was not durable before process stop.'
+    $preparedTask=Get-ScheduledTask -TaskName $name
+    Require ($preparedTask.State -eq 'Disabled' -and @($preparedTask.Triggers | Where-Object { $null -ne $_ }).Count -eq 0) 'Unverified installation could trigger a user launch.'
+} finally { Set-Item Function:\Stop-OwnedCustomerUi -Value $originalStop }
+
+try {
+    function Start-ScheduledTask { throw 'Simulated interruption after stopping old GUI, before user launch.' }
+    $prepared=Restart-VerifiedCustomerUi $Directory $exe -PrepareOnly | ConvertFrom-Json
+    Require ($prepared.old_processes_closed -eq $initial.Count -and $prepared.restarts_disabled_until_verified_commit) 'Pre-MSI preparation did not close its exact old UI.'
+    Require ((Get-ScheduledTask -TaskName $name).State -eq 'Disabled') 'Preparation enabled premature relaunch.'
+    $deferred=Restart-VerifiedCustomerUi $Directory $exe | ConvertFrom-Json
+    Require ($deferred.old_processes_closed -eq 0 -and $sid -in $deferred.user_restarts_deferred_to_logon) 'Post-stop restart intent was lost.'
+    $context=Read-CustomerUiRecoveryTasks $Directory $exe
+    Require ($context.Tasks.Count -eq 1) 'Post-stop interruption lost its durable task.'
+} finally { Remove-Item Function:\Start-ScheduledTask }
+
+$restored=Restart-VerifiedCustomerUi $Directory $exe | ConvertFrom-Json
+Require ($sid -in $restored.user_restarts_requested) 'Recovery did not request the original standard-user GUI.'
+$deadline=[DateTime]::UtcNow.AddSeconds(90);$fresh=@()
+do {
+    $fresh=@()
+    foreach ($process in @(Get-CimInstance Win32_Process -Filter "Name='Swan Remote Support.exe'")) {
+        if ($process.SessionId -eq 0 -or $process.ExecutablePath -ine $exe -or $process.CreationDate.ToUniversalTime() -lt (Get-Item (Join-Path $Directory 'installed-release.json')).LastWriteTimeUtc) { continue }
+        $owner=Invoke-CimMethod -InputObject $process -MethodName GetOwnerSid
+        if ($owner.ReturnValue -eq 0 -and $owner.Sid -eq $sid) { $fresh+=@{Pid=$process.ProcessId;Created=$process.CreationDate.ToUniversalTime()} }
+    }
+    $queued=Get-ScheduledTask -TaskName $name -ErrorAction SilentlyContinue
+    if ($fresh.Count -gt 0 -and -not $queued) { break }
+    if ([DateTime]::UtcNow -ge $deadline) { throw 'Standard-user relaunch or task self-cleanup did not complete.' }
+    Start-Sleep -Seconds 2
+} while ($true)
+$idempotent=Restart-VerifiedCustomerUi $Directory $exe | ConvertFrom-Json
+Require ($idempotent.old_processes_closed -eq 0 -and @($idempotent.user_restarts_requested).Count -eq 0) 'Retry restarted an already fresh UI.'
+foreach ($process in $fresh) {
+    $current=Get-CimInstance Win32_Process -Filter ('ProcessId='+$process.Pid)
+    Require ($null -ne $current -and $current.CreationDate.ToUniversalTime() -eq $process.Created) 'Fresh UI was stopped on retry.'
+}
+# Exercise the uninstall boundary against real mapped images before MSI removes
+# them, then simulate rollback using only this private fixture's marker.
+Remove-Item -LiteralPath (Join-Path $Directory 'pending-update.json')
+[IO.File]::WriteAllText((Join-Path $Directory 'pending-uninstall'),'')
+$closed=Restart-VerifiedCustomerUi $Directory $exe -PrepareOnly -UninstallPrepare | ConvertFrom-Json
+Require ($closed.old_processes_closed -gt 0) 'Uninstall preparation left the real customer UI running.'
+$preparedTask=Get-ScheduledTask -TaskName $name
+Require ($preparedTask.State -eq 'Disabled' -and @($preparedTask.Triggers|Where-Object {$null -ne $_}).Count -eq 0) 'Uninstall could relaunch the UI before commit or rollback.'
+foreach ($process in $fresh) {
+    $current=Get-CimInstance Win32_Process -Filter ('ProcessId='+$process.Pid)
+    Require ($null -eq $current -or $current.CreationDate.ToUniversalTime() -ne $process.Created) 'Uninstall retained an original mapped UI image.'
+}
+$remaining=@(Get-CimInstance Win32_Process -Filter "Name='Swan Remote Support.exe'"|Where-Object {$_.SessionId -gt 0 -and $_.ExecutablePath -ieq $exe}|Where-Object {(Invoke-CimMethod -InputObject $_ -MethodName GetOwnerSid).Sid -eq $sid})
+Require ($remaining.Count -eq 0) 'Uninstall retained another mapped customer UI image.'
+$rejected=$false
+try { Restart-VerifiedCustomerUi $Directory $exe | Out-Null } catch { $rejected=$true }
+Require $rejected 'Cancelled uninstall allowed a UI restart before rollback.'
+Remove-Item -LiteralPath (Join-Path $Directory 'pending-uninstall')
+# A raw MSI may not have a release record yet; rollback must still reopen its UI.
+Remove-Item -LiteralPath (Join-Path $Directory 'installed-release.json')
+$rollback=Restart-VerifiedCustomerUi $Directory $exe | ConvertFrom-Json
+Require ($sid -in $rollback.user_restarts_requested) 'Uninstall rollback lost the original user UI.'
+$deadline=[DateTime]::UtcNow.AddSeconds(90)
+do {
+    $restored=@(Get-CimInstance Win32_Process -Filter "Name='Swan Remote Support.exe'"|Where-Object {$_.SessionId -gt 0 -and $_.ExecutablePath -ieq $exe}|Where-Object {(Invoke-CimMethod -InputObject $_ -MethodName GetOwnerSid).Sid -eq $sid})
+    if($restored.Count -gt 0 -and -not(Get-ScheduledTask $name -ErrorAction SilentlyContinue)){break}
+    if([DateTime]::UtcNow -ge $deadline){throw 'Uninstall rollback did not restore the standard-user UI and clean up its task.'}
+    Start-Sleep -Seconds 2
+}while($true)
+$action=Get-CustomerUiAction $exe $sid $name
+New-OwnedFixtureTask $name $action | Out-Null
+$sentinel='SwanLab UI sentinel '+($name -replace '^Swan Customer UI ','')
+Register-ScheduledTask -TaskName $sentinel -Action $foreignAction -Principal $foreignPrincipal | Out-Null
+[IO.File]::WriteAllText((Join-Path $Directory 'pending-uninstall'),'')
+Remove-CustomerUiRecoveryTasks $Directory $exe
+Require (-not (Get-ScheduledTask -TaskName $name -ErrorAction SilentlyContinue)) 'Uninstall left its owned UI task.'
+$retained=Get-ScheduledTask -TaskName $sentinel
+Require ($retained.Actions[0].Execute -ceq $foreignAction.Execute -and $retained.Principal.UserId -in @('SYSTEM','S-1-5-18','NT AUTHORITY\SYSTEM')) 'Uninstall changed an unrelated task.'
+$retained | Unregister-ScheduledTask -Confirm:$false
+Require ((Get-Service -Name 'Swan Remote Support').Status -eq $serviceBefore -and (Get-FileHash -LiteralPath $exe).Hash -ceq $payloadBefore) 'The helper changed the service or application payload.'
+@{
+    native_wrong_creation_path_and_sid_rejected=$true
+    preparation_requires_pending_update_and_signed_executable_identity=$true
+    uninstall_requires_explicit_cancellation=$true
+    uninstall_closes_real_ui_before_file_removal=$true
+    uninstall_disables_ui_until_commit_or_rollback=$true
+    uninstall_rollback_restores_standard_user_ui=$true
+    uninstall_rollback_handles_unconfigured_msi=$true
+    real_pre_msi_stop_keeps_disabled_durable_recovery_task=$true
+    foreign_task_unchanged=$true
+    restart_intent_durable_before_stop=$true
+    restart_intent_survives_stop_before_launch=$true
+    real_standard_user_gui_relaunched=$true
+    temporary_task_self_deleted=$true
+    fresh_gui_preserved_on_retry=$true
+    owned_task_removed_on_uninstall=$true
+    unrelated_task_preserved=$true
+    service_and_payload_unchanged=$true
+    passwords_or_privileged_user_tokens_used=$false
+    standard_user_sid=$sid
+    new_gui_processes=$fresh
+    automatic_update_qualified=$false
+    utc=[DateTime]::UtcNow.ToString('o')
+} | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $ResultPath
diff --git a/deployment/windows/test_engine_candidate.py b/deployment/windows/test_engine_candidate.py
new file mode 100644
index 00000000000..5bf46e3fa09
--- /dev/null
+++ b/deployment/windows/test_engine_candidate.py
@@ -0,0 +1,90 @@
+import hashlib
+import importlib.util
+import io
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+import zipfile
+
+spec = importlib.util.spec_from_file_location("engine_candidate", Path(__file__).with_name("select-engine-candidate.py"))
+candidate = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(candidate)
+
+
+class EngineCandidateTests(unittest.TestCase):
+    def fixture(self, root):
+        sdk = root / "sdk"
+        (sdk / "bin/internal").mkdir(parents=True)
+        (sdk / "bin/internal/engine.version").write_text(candidate.SDK_ENGINE + "\n")
+        target = sdk / "bin/cache/artifacts/engine/windows-x64-release"
+        target.mkdir(parents=True)
+        (target / "gen_snapshot.exe").write_bytes(b"compiler:" + candidate.SNAPSHOT_VERSION)
+        (target / "flutter_windows.dll").write_bytes(b"original")
+        source = root / "candidate"
+        source.mkdir()
+        files = {"flutter_windows.dll": b"engine:" + candidate.SNAPSHOT_VERSION,
+                 "flutter_windows.dll.lib": b"import library", "flutter_windows.dll.pdb": b"symbols"}
+        stream = io.BytesIO()
+        with zipfile.ZipFile(stream, "w") as archive:
+            for name, data in files.items():
+                archive.writestr(name, data)
+        raw = stream.getvalue()
+        (source / "windows-x64-release-source-built.zip").write_bytes(raw)
+        return sdk, target, source, files, raw
+
+    def test_matching_compiler_survives_engine_selection(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            sdk, target, source, files, raw = self.fixture(root)
+            compiler = (target / "gen_snapshot.exe").read_bytes()
+            hashes = {name: hashlib.sha256(data).hexdigest() for name, data in files.items()}
+            with patch.object(candidate, "ARCHIVE_SHA256", hashlib.sha256(raw).hexdigest()), patch.object(candidate, "BINARIES", hashes):
+                receipt = candidate.select(source, sdk, root / "receipt.json")
+            self.assertEqual((target / "gen_snapshot.exe").read_bytes(), compiler)
+            self.assertEqual((target / "flutter_windows.dll").read_bytes(), files["flutter_windows.dll"])
+            self.assertFalse(receipt["runtime_qualified"])
+            self.assertFalse(receipt["production_approved"])
+
+    def test_incompatible_compiler_rejected_before_modification(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            sdk, target, source, _, _ = self.fixture(root)
+            (target / "gen_snapshot.exe").write_bytes(b"other snapshot format")
+            with self.assertRaisesRegex(ValueError, "snapshot compiler"):
+                candidate.select(source, sdk, root / "receipt.json")
+            self.assertEqual((target / "flutter_windows.dll").read_bytes(), b"original")
+            self.assertFalse((root / "receipt.json").exists())
+
+    def test_tampered_archive_rejected_before_modification(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            sdk, target, source, _, _ = self.fixture(root)
+            with self.assertRaisesRegex(ValueError, "archive differs"):
+                candidate.select(source, sdk, root / "receipt.json")
+            self.assertEqual((target / "flutter_windows.dll").read_bytes(), b"original")
+            self.assertFalse((root / "receipt.json").exists())
+
+    def test_unknown_candidate_rejected_before_modification(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            sdk, target, source, _, _ = self.fixture(root)
+            with self.assertRaisesRegex(ValueError, "Unknown source engine"):
+                candidate.select(source, sdk, root / "receipt.json", "unreviewed")
+            self.assertEqual((target / "flutter_windows.dll").read_bytes(), b"original")
+            self.assertFalse((root / "receipt.json").exists())
+
+    def test_previous_generation_cannot_satisfy_new_candidate(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            sdk, target, source, files, raw = self.fixture(root)
+            hashes = {name: hashlib.sha256(data).hexdigest() for name, data in files.items()}
+            with patch.object(candidate, "ARCHIVE_SHA256", hashlib.sha256(raw).hexdigest()), patch.object(candidate, "BINARIES", hashes):
+                with self.assertRaisesRegex(ValueError, "archive differs"):
+                    candidate.select(source, sdk, root / "receipt.json", "source-candidate-05d5369")
+            self.assertEqual((target / "flutter_windows.dll").read_bytes(), b"original")
+            self.assertFalse((root / "receipt.json").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_flutter_client_wrapper.py b/deployment/windows/test_flutter_client_wrapper.py
new file mode 100644
index 00000000000..e82e9a8aa90
--- /dev/null
+++ b/deployment/windows/test_flutter_client_wrapper.py
@@ -0,0 +1,71 @@
+import hashlib
+import importlib.util
+from pathlib import Path
+import tempfile
+import unittest
+
+ROOT = Path(__file__).parent
+spec = importlib.util.spec_from_file_location("wrapper_patch", ROOT / "patch-flutter-client-wrapper.py")
+patcher = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(patcher)
+ORIGINAL = ROOT / "fixtures/flutter-sdk-3.24.5/core_implementations.cc"
+
+
+class WrapperPatchTests(unittest.TestCase):
+    def sdk(self, directory):
+        sdk = Path(directory) / "sdk"
+        version = sdk / "bin/internal/engine.version"
+        version.parent.mkdir(parents=True)
+        version.write_text(patcher.ENGINE)
+        source = sdk / "bin/cache/artifacts/engine/common/cpp_client_wrapper/core_implementations.cc"
+        source.parent.mkdir(parents=True)
+        source.write_bytes(ORIGINAL.read_bytes())
+        return sdk, source, Path(directory) / "receipt.json"
+
+    def test_reviewed_upstream_and_both_source_line_endings(self):
+        data = ORIGINAL.read_bytes().replace(b"\r\n", b"\n")
+        self.assertEqual(hashlib.sha256(data).hexdigest(), patcher.ORIGINAL_SHA256)
+        patched = patcher.transform(data)
+        self.assertEqual(hashlib.sha256(patched).hexdigest(), patcher.PATCHED_SHA256)
+        self.assertEqual(patched, patcher.transform(data.replace(b"\n", b"\r\n")))
+        self.assertTrue(patched.startswith(b"// Copyright 2013 The Flutter Authors."))
+        self.assertIn(b"BSD-style license", patched)
+
+    def test_unknown_source_cannot_be_patched(self):
+        with self.assertRaises(ValueError):
+            patcher.transform(ORIGINAL.read_bytes() + b"\n// changed upstream\n")
+
+    def test_unknown_engine_does_not_change_source(self):
+        with tempfile.TemporaryDirectory() as directory:
+            sdk, source, receipt = self.sdk(directory)
+            (sdk / "bin/internal/engine.version").write_text("wrong-engine")
+            with self.assertRaises(ValueError):
+                patcher.patch(sdk, receipt)
+            self.assertEqual(source.read_bytes(), ORIGINAL.read_bytes())
+            self.assertFalse(receipt.exists())
+
+    def test_all_preimages_validated_before_any_write(self):
+        with tempfile.TemporaryDirectory() as directory:
+            sdk, source, receipt = self.sdk(directory)
+            other = source.parents[2] / "windows-x64/cpp_client_wrapper/core_implementations.cc"
+            other.parent.mkdir(parents=True)
+            other.write_bytes(b"unexpected source")
+            with self.assertRaises(ValueError):
+                patcher.patch(sdk, receipt)
+            self.assertEqual(source.read_bytes(), ORIGINAL.read_bytes())
+            self.assertFalse(receipt.exists())
+
+    def test_source_patch_receipt_never_allows_a_silent_repeat(self):
+        with tempfile.TemporaryDirectory() as directory:
+            sdk, source, receipt = self.sdk(directory)
+            result = patcher.patch(sdk, receipt)
+            self.assertEqual(result["files"][0]["patched_sha256"], hashlib.sha256(source.read_bytes()).hexdigest())
+            self.assertFalse(result["engine_binaries_changed"])
+            before = source.read_bytes()
+            with self.assertRaises(FileExistsError):
+                patcher.patch(sdk, receipt)
+            self.assertEqual(source.read_bytes(), before)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_flutter_engine_source.py b/deployment/windows/test_flutter_engine_source.py
new file mode 100644
index 00000000000..a68561784ef
--- /dev/null
+++ b/deployment/windows/test_flutter_engine_source.py
@@ -0,0 +1,81 @@
+import importlib.util
+import json
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location("engine_source", Path(__file__).with_name("flutter-engine-source.py"))
+source = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(source)
+
+
+class EngineSourceTests(unittest.TestCase):
+    def test_reviewed_source_recipe_and_patch_hashes(self):
+        source.load_recipe()
+
+    def test_changed_patch_or_dependency_pin_is_rejected(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            for name in ("flutter-engine.lock.json", "flutter-engine-windows.patch", "flutter-engine-buildroot.patch"):
+                (root / name).write_bytes((source.RECIPE / name).read_bytes())
+            with patch.object(source, "RECIPE", root):
+                source.load_recipe()
+                target = root / "flutter-engine-buildroot.patch"
+                original = target.read_bytes()
+                target.write_bytes(original + b"unreviewed patch\n")
+                with self.assertRaisesRegex(ValueError, "toolset-selection patch"):
+                    source.load_recipe()
+                target.write_bytes(original)
+                lock_path = root / "flutter-engine.lock.json"
+                lock = json.loads(lock_path.read_text(encoding="utf-8"))
+                lock["dependency_overrides"]["src/flutter/third_party/tinygltf"]["revision"] = "0" * 40
+                lock_path.write_text(json.dumps(lock), encoding="utf-8")
+                with self.assertRaisesRegex(ValueError, "original DEPS commit"):
+                    source.load_recipe()
+
+    def test_compile_commands_fail_closed_on_toolchain_drift(self):
+        lock, _ = source.load_recipe()
+        valid = ('clang-cl /Brepro -fdebug-compilation-dir=. -imsvc"C:\\VS\\VC\\Tools\\MSVC\\14.38.33130\\include" '
+                 '-imsvc"C:\\Program Files (x86)\\Windows Kits\\10\\include\\10.0.22621.0\\ucrt"\n'
+                 '../../flutter/buildtools/windows-x64/clang/bin/lld-link.exe /OUT:./flutter_windows.dll /libpath:"C:\\VS\\VC\\Tools\\MSVC\\14.38.33130\\lib\\x64" '
+                 '/libpath:"C:\\Program Files (x86)\\Windows Kits\\10\\lib\\10.0.22621.0\\um\\x64"\n')
+        rejected = [
+            valid.replace("14.38.33130", "14.44.35207"),
+            valid.replace("10.0.22621.0", "10.0.26100.0"),
+            valid + valid.replace("14.38.33130", "14.44.35207"),
+            valid + " -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH=1",
+            valid.replace("/Brepro", ""),
+            valid.replace("-fdebug-compilation-dir=.", ""),
+            valid.replace("../../flutter/buildtools/windows-x64/clang/bin/lld-link.exe", "link.exe"),
+            valid.replace("../../flutter/buildtools/windows-x64/clang/bin/lld-link.exe", "C:/unreviewed/lld-link.exe"),
+            "clang-cl without auditable toolchain paths",
+        ]
+        with tempfile.TemporaryDirectory() as directory:
+            commands = Path(directory) / "commands.txt"
+            commands.write_text(valid, encoding="utf-8")
+            source.verify_commands(commands, lock)
+            for text in rejected:
+                with self.subTest(commands=text):
+                    commands.write_text(text, encoding="utf-8")
+                    with self.assertRaises(ValueError):
+                        source.verify_commands(commands, lock)
+
+    def test_final_link_response_rejects_timestamp_and_incremental_drift(self):
+        valid = "objects.obj /Brepro /PDBALTPATH:%_PDB% /INCREMENTAL:NO /DEBUG /threads:1"
+        with tempfile.TemporaryDirectory() as directory:
+            response = Path(directory) / "link-response.txt"
+            response.write_text(valid, encoding="utf-8")
+            source.verify_link_response(response)
+            for text in (valid.replace("/Brepro", ""), valid.replace("/PDBALTPATH:%_PDB%", ""),
+                         valid.replace("/INCREMENTAL:NO", "/INCREMENTAL"), valid + " /INCREMENTAL:YES",
+                         valid.replace("/threads:1", ""), valid.replace("/threads:1", "/threads:4"),
+                         valid + " /threads:4"):
+                with self.subTest(response=text):
+                    response.write_text(text, encoding="utf-8")
+                    with self.assertRaises(ValueError):
+                        source.verify_link_response(response)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_msi_install_mode.ps1 b/deployment/windows/test_msi_install_mode.ps1
new file mode 100644
index 00000000000..552e9d06b20
--- /dev/null
+++ b/deployment/windows/test_msi_install_mode.ps1
@@ -0,0 +1,54 @@
+$ErrorActionPreference='Stop'
+$fixture=Join-Path ([IO.Path]::GetTempPath()) ('swan-msi-mode-'+[guid]::NewGuid().ToString('N')+'.msi')
+[IO.File]::WriteAllText($fixture,'Inert database stand-in; never executed.')
+$script:code='{D32FA420-4F84-50A6-BAB2-CBFDA73F87C9}'
+$script:other='{A6857EBE-9FD4-52DE-B899-454C2F066E52}'
+$script:properties=@{ProductCode=$script:code;UpgradeCode='{A4374699-436F-4917-9A4E-223F62A9E634}';ProductVersion='1.5.1'}
+$global:SwanMsiModeFixture=@{properties=$script:properties}
+$database=[pscustomobject]@{}
+$database|Add-Member ScriptMethod OpenView {param($sql) $name=$sql.Split("'")[-2];$view=[pscustomobject]@{PropertyName=$name};$view|Add-Member ScriptMethod Execute {};$view|Add-Member ScriptMethod Close {};$view|Add-Member ScriptMethod Fetch {if(-not $global:SwanMsiModeFixture.properties.ContainsKey($this.PropertyName)){return $null};$row=[pscustomobject]@{PropertyName=$this.PropertyName};$row|Add-Member ScriptMethod StringData {param($index) $global:SwanMsiModeFixture.properties[$this.PropertyName]};return $row};return $view}
+$script:database=$database
+$script:installer=[pscustomobject]@{}
+$global:SwanMsiModeFixture.database=$database
+$global:SwanMsiModeFixture.installer=$script:installer
+$script:installer|Add-Member ScriptMethod OpenDatabase {param($path,$mode) if($mode -ne 0){throw 'Database must be opened read-only'};return $global:SwanMsiModeFixture.database}
+$script:installer|Add-Member ScriptMethod RelatedProducts {param($upgrade) return @($global:SwanMsiModeFixture.related.Keys)}
+$script:installer|Add-Member ScriptMethod ProductInfo {param($code,$name) if($name -cne 'VersionString'){throw 'Unexpected catalog query'};return $global:SwanMsiModeFixture.related[$code]}
+$script:installer|Add-Member ScriptMethod ProductState {param($code) return $global:SwanMsiModeFixture.state}
+function New-Object {param($ComObject) if($ComObject -cne 'WindowsInstaller.Installer'){throw 'Unexpected factory'};return $global:SwanMsiModeFixture.installer}
+try {
+    $cases=@(
+        @{state=-1;related=@{};version='1.5.1';mode='/i'},
+        @{state=1;related=@{};version='1.5.1';mode='/i'},
+        @{state=5;related=@{$script:code='1.5.1'};version='1.5.1';mode='/fvamus'},
+        @{state=-1;related=@{$script:other='1.5.0'};version='1.5.1';mode='/i'},
+        @{state=-1;related=@{$script:other='1.5.7'};version='1.5.1';reject=$true;reason='This package cannot replace registered product version*'},
+        @{state=-1;related=@{$script:other='1.5.1'};version='1.5.1';reject=$true;reason='This package cannot replace registered product version*'},
+        @{state=-1;related=@{$script:other='1.5.1.999'};version='1.5.1';reject=$true;reason='This package cannot replace registered product version*'},
+        @{state=-1;related=@{$script:other='1.10.0'};version='1.9.9';reject=$true;reason='This package cannot replace registered product version*'},
+        @{state=-1;related=@{$script:other='broken'};version='1.5.1';reject=$true;reason='MSI version cannot be compared safely.'},
+        @{state=2;related=@{};version='1.5.1';mode='/i'},
+        @{state=2;related=@{};version='1.5.1';all_users='';mode='/i'},
+        @{state=2;related=@{};version='1.5.1';all_users='1';reject=$true;reason='MSI product registration cannot be safely recovered*'},
+        @{state=2;related=@{};version='1.5.1';all_users='2';reject=$true;reason='MSI product registration cannot be safely recovered*'},
+        @{state=2;related=@{$script:other='1.5.7'};version='1.5.1';reject=$true;reason='This package cannot replace registered product version*'},
+        @{state=0;related=@{};version='1.5.1';reject=$true;reason='MSI product registration cannot be safely recovered*'},
+        @{state=-1;related=@{};version='1.5.1';missing='ProductCode';reject=$true;reason='MSI property is missing: ProductCode.'}
+    )
+    $caseIndex=0
+    foreach($case in $cases){
+        $script:state=$case.state;$script:related=$case.related
+        $script:properties=@{ProductCode=$script:code;UpgradeCode='{A4374699-436F-4917-9A4E-223F62A9E634}';ProductVersion=$case.version}
+        if($case.ContainsKey('all_users')){$script:properties.ALLUSERS=$case.all_users}
+        if($case.ContainsKey('missing')){$script:properties.Remove($case.missing)}
+        $global:SwanMsiModeFixture.properties=$script:properties
+        $global:SwanMsiModeFixture.state=$case.state;$global:SwanMsiModeFixture.related=$case.related
+        $failed=$false;$mode=$null
+        $reason=$null
+        try {$mode=& (Join-Path $PSScriptRoot 'Get-MsiInstallMode.ps1') -Package $fixture}catch {$failed=$true;$reason=$_.Exception.Message}
+        if([bool]$case.reject -ne $failed -or (-not $failed -and $mode -cne $case.mode)){throw "Incorrect installation/repair/downgrade decision in case ${caseIndex}: failed=$failed, mode=$mode, reason=$reason"}
+        if($failed -and $reason -notlike $case.reason){throw "Unexpected rejection reason in case ${caseIndex}: $reason"}
+        $caseIndex++
+    }
+    @{passed=$true;cases=$cases.Count;scope='Read-only catalog decision tests; inert fixture and COM substitute; no MSI actions or registration changes'}|ConvertTo-Json -Compress
+} finally {Remove-Item -LiteralPath $fixture -Force;Remove-Variable -Name SwanMsiModeFixture -Scope Global}
diff --git a/deployment/windows/test_msi_metadata.ps1 b/deployment/windows/test_msi_metadata.ps1
new file mode 100644
index 00000000000..cabea88dee8
--- /dev/null
+++ b/deployment/windows/test_msi_metadata.ps1
@@ -0,0 +1,57 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)][string]$FirstMsi,
+    [Parameter(Mandatory=$true)][string]$SecondMsi,
+    [Parameter(Mandatory=$true)][string]$WorkDirectory,
+    [Parameter(Mandatory=$true)][long]$SourceDateEpoch,
+    [string]$SignedMsi
+)
+$ErrorActionPreference='Stop'
+$FirstMsi=(Resolve-Path -LiteralPath $FirstMsi).Path
+$SecondMsi=(Resolve-Path -LiteralPath $SecondMsi).Path
+if (Test-Path -LiteralPath $WorkDirectory) { throw 'Use a fresh test directory to preserve earlier evidence.' }
+[void](New-Item -ItemType Directory -Path $WorkDirectory)
+$before=@((Get-FileHash -LiteralPath $FirstMsi).Hash,(Get-FileHash -LiteralPath $SecondMsi).Hash)
+$normalizer=Join-Path $PSScriptRoot 'Set-ReproducibleMsiMetadata.ps1'
+$first=Join-Path $WorkDirectory 'first-unsigned.msi'
+$second=Join-Path $WorkDirectory 'second-unsigned.msi'
+$repeat=Join-Path $WorkDirectory 'repeat-unsigned.msi'
+$different=Join-Path $WorkDirectory 'different-unsigned.msi'
+$a=& $normalizer -InputMsi $FirstMsi -OutputMsi $first -SourceDateEpoch $SourceDateEpoch
+$b=& $normalizer -InputMsi $SecondMsi -OutputMsi $second -SourceDateEpoch $SourceDateEpoch
+if ($a.sha256 -ne $b.sha256 -or $a.package_code -ne $b.package_code) { throw 'Independent unsigned MSI bytes still differ after metadata preparation.' }
+$c=& $normalizer -InputMsi $first -OutputMsi $repeat -SourceDateEpoch $SourceDateEpoch
+if ($c.sha256 -ne $a.sha256) { throw 'Metadata preparation is not idempotent.' }
+$d=& $normalizer -InputMsi $FirstMsi -OutputMsi $different -SourceDateEpoch ($SourceDateEpoch+2)
+if ($d.sha256 -eq $a.sha256 -or $d.package_code -eq $a.package_code) { throw 'Changed metadata reused the package identity.' }
+$changedInput=Join-Path $WorkDirectory 'changed-input.msi'
+[IO.File]::Copy($FirstMsi,$changedInput,$false)
+$installer=$null; $database=$null; $view=$null
+try {
+    $installer=New-Object -ComObject WindowsInstaller.Installer
+    $database=$installer.OpenDatabase($changedInput,1)
+    $view=$database.OpenView("INSERT INTO ``Property`` (``Property``, ``Value``) VALUES ('SWAN_METADATA_TEST', 'changed')")
+    [void]$view.Execute()
+    [void]$database.Commit()
+} finally {
+    foreach($com in @($view,$database,$installer)) { if ($null -ne $com) { [void][Runtime.InteropServices.Marshal]::FinalReleaseComObject($com) } }
+}
+$changed=& $normalizer -InputMsi $changedInput -OutputMsi (Join-Path $WorkDirectory 'changed-unsigned.msi') -SourceDateEpoch $SourceDateEpoch
+if ($changed.sha256 -eq $a.sha256 -or $changed.package_code -eq $a.package_code) { throw 'Changed installer tables reused the package identity.' }
+$rejected=$false
+try { & $normalizer -InputMsi $FirstMsi -OutputMsi $first -SourceDateEpoch $SourceDateEpoch | Out-Null } catch { $rejected=$true }
+if (-not $rejected -or (Get-FileHash -LiteralPath $first).Hash.ToLowerInvariant() -ne $a.sha256) { throw 'Existing output was not protected.' }
+if ((Get-FileHash -LiteralPath $FirstMsi).Hash -ne $before[0] -or (Get-FileHash -LiteralPath $SecondMsi).Hash -ne $before[1]) { throw 'Original evidence was modified.' }
+$signedRejected=$null
+if ($SignedMsi) {
+    $signedHash=(Get-FileHash -LiteralPath $SignedMsi).Hash
+    if ((Get-AuthenticodeSignature -LiteralPath $SignedMsi).Status -eq 'NotSigned') { throw 'Signed rejection fixture is unsigned.' }
+    $signedOutput=Join-Path $WorkDirectory 'signed-rejected-unsigned.msi'
+    $signedRejected=$false
+    try { & $normalizer -InputMsi $SignedMsi -OutputMsi $signedOutput -SourceDateEpoch $SourceDateEpoch | Out-Null }
+    catch { if ($_.Exception.Message -eq 'Only unsigned MSI inputs may be normalized.') { $signedRejected=$true } else { throw } }
+    if (-not $signedRejected -or (Test-Path -LiteralPath $signedOutput) -or (Test-Path -LiteralPath ($signedOutput+'.partial')) -or (Get-FileHash -LiteralPath $SignedMsi).Hash -ne $signedHash) { throw 'Signed input protection failed.' }
+}
+[pscustomobject]@{same_bytes=$true;idempotent=$true;epoch_changes_package=$true;table_change_changes_package=$true;overwrite_rejected=$true;originals_unchanged=$true;signed_input_rejected=$signedRejected;first=$a;second=$b} |
+    ConvertTo-Json -Depth 4 | Set-Content -LiteralPath (Join-Path $WorkDirectory 'result.json')
+Write-Host 'Unsigned MSI metadata checks passed; installation and signing qualification remain separate.'
diff --git a/deployment/windows/test_msi_service_guard.ps1 b/deployment/windows/test_msi_service_guard.ps1
new file mode 100644
index 00000000000..b33e7da184f
--- /dev/null
+++ b/deployment/windows/test_msi_service_guard.ps1
@@ -0,0 +1,24 @@
+$ErrorActionPreference = 'Stop'
+# Load only the pure guard function. Do not execute the recovery script, query
+# services, open MSI databases, or invoke installation/removal on this host.
+$tokens=$null; $errors=$null
+foreach ($source in @('Restore-ReleaseMsi.ps1','Restore-CustomerExe.ps1')) {
+$ast=[System.Management.Automation.Language.Parser]::ParseFile((Join-Path $PSScriptRoot $source),[ref]$tokens,[ref]$errors)
+if ($errors.Count) { throw 'Recovery script failed parsing.' }
+$function=$ast.Find({param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Assert-CustomerServiceRecord'},$true)
+if ($null -eq $function) { throw 'Service identity guard missing.' }
+. ([ScriptBlock]::Create($function.Extent.Text))
+$expected='"C:\IsolatedFixture\Swan Remote Support.exe" --service'
+$valid=@{PathName=$expected;StartName='LocalSystem';State='Running';StartMode='Auto'}
+Assert-CustomerServiceRecord $valid $expected $true
+foreach ($change in @(@{PathName='"C:\OtherInstallation\Swan Remote Support.exe" --service'},@{StartName='OtherAccount'},@{State='Stopped'},@{StartMode='Manual'},@{PathName=($expected+' --other')})) {
+    $record=$valid.Clone()
+    foreach ($key in $change.Keys) { $record[$key]=$change[$key] }
+    $rejected=$false
+    try { Assert-CustomerServiceRecord $record $expected $true } catch { $rejected=$true }
+    if (-not $rejected) { throw 'Unsafe service identity or startup state accepted.' }
+}
+$stopped=$valid.Clone();$stopped.State='Stopped'
+Assert-CustomerServiceRecord $stopped $expected $false
+}
+Write-Output 'Service guard component checks passed; no native service or installer operations executed.'
diff --git a/deployment/windows/test_msi_staging.ps1 b/deployment/windows/test_msi_staging.ps1
new file mode 100644
index 00000000000..c5a9d802edf
--- /dev/null
+++ b/deployment/windows/test_msi_staging.ps1
@@ -0,0 +1,42 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$WorkDirectory)
+$ErrorActionPreference='Stop'
+if (Test-Path -LiteralPath $WorkDirectory) { throw 'Use a fresh staging test directory.' }
+$WorkDirectory=[IO.Path]::GetFullPath($WorkDirectory)
+$source=Join-Path $WorkDirectory 'source'
+$hidden=Join-Path $source 'hidden'
+[void][IO.Directory]::CreateDirectory($hidden)
+[IO.File]::WriteAllBytes((Join-Path $source 'binary.dat'),[byte[]](0,255,42,13,10))
+[IO.File]::WriteAllText((Join-Path $hidden 'nested.txt'),'nested input')
+[IO.File]::SetAttributes($hidden,[IO.FileAttributes]::Hidden)
+$originals=@{}
+foreach($file in Get-ChildItem -LiteralPath $source -Recurse -Force -File) {
+    [IO.File]::SetLastWriteTimeUtc($file.FullName,[datetime]'2020-01-02T03:04:05Z')
+    [IO.File]::SetAttributes($file.FullName,[IO.FileAttributes]::ReadOnly)
+    $file.Refresh()
+    $originals[$file.FullName]=@{hash=(Get-FileHash -LiteralPath $file.FullName).Hash;time=$file.LastWriteTimeUtc.Ticks;attributes=$file.Attributes}
+}
+$copy=Join-Path $PSScriptRoot 'Copy-ReproducibleMsiInput.ps1'
+$destination=& $copy -InputPath $source -Destination (Join-Path $WorkDirectory 'staged') -SourceDateEpoch 1792648409
+$expected=[DateTime]::SpecifyKind([DateTimeOffset]::FromUnixTimeSeconds(1792648409).UtcDateTime,[DateTimeKind]::Unspecified)
+foreach($name in $originals.Keys) {
+    $relative=$name.Substring($source.Length+1)
+    $staged=Get-Item -LiteralPath (Join-Path $destination $relative) -Force
+    $original=Get-Item -LiteralPath $name -Force
+    if ((Get-FileHash -LiteralPath $staged.FullName).Hash -ne $originals[$name].hash -or $staged.LastWriteTime -ne $expected) { throw 'Staged bytes or timestamps differ.' }
+    if ((Get-FileHash -LiteralPath $name).Hash -ne $originals[$name].hash -or $original.LastWriteTimeUtc.Ticks -ne $originals[$name].time -or $original.Attributes -ne $originals[$name].attributes) { throw 'Original bytes, timestamps or attributes changed.' }
+}
+foreach($invalid in @($destination,(Join-Path $source 'child-output'))) {
+    $rejected=$false
+    try { & $copy -InputPath $source -Destination $invalid -SourceDateEpoch 1792648409 | Out-Null } catch { $rejected=$true }
+    if (-not $rejected) { throw 'Unsafe staging destination was accepted.' }
+}
+# Junction targets are also disposable fixtures; never traverse a host folder.
+[void](New-Item -ItemType Junction -Path (Join-Path $source 'junction') -Target $hidden)
+$rejected=$false
+try { & $copy -InputPath $source -Destination (Join-Path $WorkDirectory 'rejected-link') -SourceDateEpoch 1792648409 | Out-Null }
+catch { if ($_.Exception.Message -eq 'Reparse points are not valid installer inputs.') { $rejected=$true } else { throw } }
+if (-not $rejected) { throw 'Junction input was accepted.' }
+[pscustomobject]@{files=$originals.Count;bytes_preserved=$true;timestamps_staged=$true;originals_unchanged=$true;overwrite_rejected=$true;nested_destination_rejected=$true;junction_rejected=$true} |
+    ConvertTo-Json | Set-Content -LiteralPath (Join-Path $WorkDirectory 'result.json')
+Write-Host 'Installer staging checks passed.'
diff --git a/deployment/windows/test_msvc_determinism.ps1 b/deployment/windows/test_msvc_determinism.ps1
new file mode 100644
index 00000000000..387520a8004
--- /dev/null
+++ b/deployment/windows/test_msvc_determinism.ps1
@@ -0,0 +1,134 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$WorkDirectory)
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+$root=[IO.Path]::GetFullPath($WorkDirectory)
+if(Test-Path -LiteralPath $root){throw 'Preserve existing compiler fixture evidence'}
+$vswhere=Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+$vs=(& $vswhere -latest -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath|Out-String).Trim()
+if($LASTEXITCODE -ne 0 -or -not $vs){throw 'MSVC installation unavailable'}
+$version=([IO.File]::ReadAllText((Join-Path $vs 'VC\Auxiliary\Build\Microsoft.VCToolsVersion.default.txt'))).Trim()
+if($version -notmatch '^14\.[0-9]+\.[0-9]+$'){throw 'Unexpected MSVC version'}
+$vc=Join-Path $vs ('VC\Tools\MSVC\'+$version)
+$bin=Join-Path $vc 'bin\Hostx64\x64'
+$compiler=Join-Path $bin 'cl.exe'
+$sdk=(Get-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots').KitsRoot10
+$sdkVersion=Get-ChildItem -LiteralPath (Join-Path $sdk 'Include') -Directory|Where-Object {$_.Name -match '^10\.0\.[0-9]+\.0$'}|Sort-Object {[version]$_.Name} -Descending|Select-Object -First 1 -ExpandProperty Name
+if(-not $sdkVersion){throw 'Windows SDK unavailable'}
+$include=@((Join-Path $vc 'include'))+@('ucrt','shared','um','winrt'|ForEach-Object {Join-Path $sdk ('Include\'+$sdkVersion+'\'+$_)})
+$libraries=@((Join-Path $vc 'lib\x64'))+@('ucrt','um'|ForEach-Object {Join-Path $sdk ('Lib\'+$sdkVersion+'\'+$_+'\x64')})
+foreach($path in @($compiler)+$include+$libraries){if(-not(Test-Path -LiteralPath $path)){throw 'Selected compiler input missing'}}
+New-Item -ItemType Directory -Path $root|Out-Null
+$source=@'
+#include <cstdint>
+#include <cstdio>
+#include <functional>
+#include <typeinfo>
+int main() {
+  unsigned calls = 0;
+  auto consumer = [&calls](const std::uint8_t* data, std::size_t size) {
+    calls += (data != nullptr && size != 0) ? 1 : 0;
+  };
+  std::function<void(const std::uint8_t*, std::size_t)> callback = consumer;
+  const std::uint8_t data = 1;
+  callback(&data, 1);
+  std::printf("%s\n%s\n%u\n", __FILE__, typeid(consumer).name(), calls);
+  return calls == 1 ? 0 : 1;
+}
+'@
+function Build-Fixture([string]$label,[string]$folder,[bool]$deterministic,[string]$mode='default') {
+ $directory=Join-Path $root $folder
+ if(-not(Test-Path -LiteralPath $directory)){New-Item -ItemType Directory -Path $directory|Out-Null}
+ $cpp=Join-Path $directory 'fixture.cpp'
+ $body=$source
+ if($mode -ceq 'named'){
+  $body=$body.Replace('int main() {',@'
+namespace SwanCompilerFixture {
+struct Consumer {
+  unsigned* calls;
+  void operator()(const std::uint8_t* data, std::size_t size) {
+    *calls += (data != nullptr && size != 0) ? 1 : 0;
+  }
+};
+}
+int main() {
+'@)
+  $lambda=@'
+  auto consumer = [&calls](const std::uint8_t* data, std::size_t size) {
+    calls += (data != nullptr && size != 0) ? 1 : 0;
+  };
+'@
+  if(-not $body.Contains($lambda)){throw 'Named callable fixture preimage differs'}
+  $body=$body.Replace($lambda,'  SwanCompilerFixture::Consumer consumer{&calls};')
+ }
+ if($mode -ceq 'sdk-reply'){
+  & python3 (Join-Path $PSScriptRoot 'emit-flutter-reply-fixture.py') --output $cpp
+  if($LASTEXITCODE){throw 'Actual SDK reply callable fixture generation failed'}
+ }else{[IO.File]::WriteAllText($cpp,$body,[Text.UTF8Encoding]::new($false))}
+ $arguments=@('/nologo','/WX','/std:c++17','/O2','/EHsc','/MT','/GR','/DNDEBUG')+@($include|ForEach-Object {'/I'+$_})
+ if($deterministic){$arguments+=@('/experimental:deterministic',('/pathmap:'+$directory+'=C:\swan-repro-fixture'))}
+ if($mode -ceq 'brepro'){$arguments+='/Brepro'}
+ if($mode -ceq 'trim'){$arguments+=('/d1trimfile:'+$directory+'\')}
+ $sourceArgument=if($mode -ceq 'relative'){'fixture.cpp'}else{$cpp}
+ $arguments+=@(('/Fo'+(Join-Path $directory 'fixture.obj')),('/Fe'+(Join-Path $directory 'fixture.exe')),$sourceArgument,'/link','/Brepro','/INCREMENTAL:NO','/PDBALTPATH:fixture.pdb','/MANIFEST:NO')+@($libraries|ForEach-Object {'/LIBPATH:'+$_})
+ if(@($arguments|Where-Object {$_ -ceq $sourceArgument}).Count -ne 1 -or @($arguments|Where-Object {$_ -ceq '/link'}).Count -ne 1){throw 'Compiler argument boundaries invalid'}
+ $arguments|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $root ($label+'.arguments.json')) -Encoding utf8
+ $start=[Diagnostics.ProcessStartInfo]::new()
+ $start.FileName=$compiler
+ $start.WorkingDirectory=$directory
+ $start.UseShellExecute=$false
+ $start.RedirectStandardOutput=$true
+ $start.RedirectStandardError=$true
+ $start.Environment['PATH']=$bin+';'+$env:PATH
+ foreach($argument in $arguments){$start.ArgumentList.Add($argument)}
+ $process=[Diagnostics.Process]::Start($start)
+ $stdout=$process.StandardOutput.ReadToEndAsync();$stderr=$process.StandardError.ReadToEndAsync()
+ if(-not $process.WaitForExit(120000)){$process.Kill($true);throw 'Compiler fixture timed out'}
+ $log=$stdout.GetAwaiter().GetResult()+$stderr.GetAwaiter().GetResult()
+ [IO.File]::WriteAllText((Join-Path $root ($label+'.log')),$log)
+ if($process.ExitCode -ne 0){throw ('Real MSVC fixture failed: '+$label)}
+ $process.Dispose()
+ $exe=Join-Path $directory 'fixture.exe'
+ $runStart=[Diagnostics.ProcessStartInfo]::new()
+ $runStart.FileName=$exe
+ $runStart.UseShellExecute=$false
+ $runStart.RedirectStandardOutput=$true
+ $runStart.RedirectStandardError=$true
+ $run=[Diagnostics.Process]::Start($runStart)
+ $runOutput=$run.StandardOutput.ReadToEndAsync();$runError=$run.StandardError.ReadToEndAsync()
+ if(-not $run.WaitForExit(30000)){$run.Kill($true);throw 'Compiled callback fixture timed out'}
+ $result=@($runOutput.GetAwaiter().GetResult().Split([char[]]"`r`n",[StringSplitOptions]::RemoveEmptyEntries))
+ [IO.File]::WriteAllText((Join-Path $root ($label+'.runtime.log')),$runError.GetAwaiter().GetResult())
+ if($run.ExitCode -ne 0 -or $result.Count -ne 3 -or $result[2] -cne '1'){throw 'Compiled callback fixture did not run correctly'}
+ $run.Dispose()
+ $saved=Join-Path $root ($label+'.exe')
+ Copy-Item -LiteralPath $exe -Destination $saved
+ return @{label=$label;sha256=(Get-FileHash -LiteralPath $saved).Hash.ToLowerInvariant();bytes=(Get-Item -LiteralPath $saved).Length;source_sha256=(Get-FileHash -LiteralPath $cpp).Hash.ToLowerInvariant();embedded_source_path=$result[0];lambda_type=$result[1];callback_passed=$true;compiler_arguments=$arguments}
+}
+$runs=@(
+ (Build-Fixture 'link-only-same-path-first' 'repeat-control' $false),
+ (Build-Fixture 'link-only-same-path-second' 'repeat-control' $false),
+ (Build-Fixture 'link-only-relocated-first' 'control-a' $false),
+ (Build-Fixture 'link-only-relocated-second' 'control-b' $false),
+ (Build-Fixture 'deterministic-relocated-first' 'fixed-a' $true),
+ (Build-Fixture 'deterministic-relocated-second' 'fixed-b' $true),
+ (Build-Fixture 'compiler-brepro-first' 'brepro-a' $true 'brepro'),
+ (Build-Fixture 'compiler-brepro-second' 'brepro-b' $true 'brepro'),
+ (Build-Fixture 'trimfile-first' 'trim-a' $true 'trim'),
+ (Build-Fixture 'trimfile-second' 'trim-b' $true 'trim'),
+ (Build-Fixture 'relative-source-first' 'relative-a' $false 'relative'),
+ (Build-Fixture 'relative-source-second' 'relative-b' $false 'relative'),
+ (Build-Fixture 'named-callable-first' 'named-a' $true 'named'),
+ (Build-Fixture 'named-callable-second' 'named-b' $true 'named'),
+ (Build-Fixture 'sdk-reply-first' 'sdk-a' $true 'sdk-reply'),
+ (Build-Fixture 'sdk-reply-second' 'sdk-b' $true 'sdk-reply')
+)
+$controlDiffers=$runs[2].sha256 -cne $runs[3].sha256
+$fixedMatches=$runs[4].sha256 -ceq $runs[5].sha256
+$candidates=@{experimental_and_pathmap=$fixedMatches;compiler_brepro=($runs[6].sha256 -ceq $runs[7].sha256);trimfile=($runs[8].sha256 -ceq $runs[9].sha256);relative_source=($runs[10].sha256 -ceq $runs[11].sha256);named_callable=($runs[12].sha256 -ceq $runs[13].sha256);actual_sdk_reply_callable=($runs[14].sha256 -ceq $runs[15].sha256)}
+$report=@{scope='Real standalone MSVC callback/RTTI/path fixture; not the Flutter app or complete native release';compiler_sha256=(Get-FileHash -LiteralPath $compiler).Hash.ToLowerInvariant();toolset=$version;windows_sdk=$sdkVersion;same_path_link_only_matches=($runs[0].sha256 -ceq $runs[1].sha256);relocated_link_only_control_differs=$controlDiffers;relocated_compiler_deterministic_matches=$fixedMatches;candidate_raw_byte_matches=$candidates;shipping_binary_normalization=$false;runs=$runs;full_native_reproduction_required=$true;production_approved=$false}
+$report|ConvertTo-Json -Depth 8|Set-Content -LiteralPath (Join-Path $root 'report.json') -Encoding utf8
+if(-not $controlDiffers){throw 'Relocation control did not demonstrate the embedded path difference'}
+if(-not $candidates.named_callable -or $runs[12].lambda_type -cne $runs[13].lambda_type){throw 'Named callable did not produce identical raw relocated fixture bytes and type identity'}
+if(-not $candidates.actual_sdk_reply_callable -or $runs[14].lambda_type -cne $runs[15].lambda_type){throw 'Actual SDK reply callable behavior or raw relocated bytes failed'}
+Write-Output 'Real MSVC relocated callback/RTTI fixture passed with original bytes; full native reproduction remains required.'
diff --git a/deployment/windows/test_native_build_comparison.py b/deployment/windows/test_native_build_comparison.py
new file mode 100644
index 00000000000..0f828de824c
--- /dev/null
+++ b/deployment/windows/test_native_build_comparison.py
@@ -0,0 +1,252 @@
+import hashlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+from unittest.mock import patch
+import urllib.error
+import zipfile
+
+spec = importlib.util.spec_from_file_location("native_comparison", Path(__file__).with_name("compare-native-builds.py"))
+comparison = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(comparison)
+
+
+class NativeBuildComparisonTests(unittest.TestCase):
+    def repository(self, root, source=b"public source\n"):
+        root.mkdir()
+        hooks = root / "empty-hooks"
+        hooks.mkdir()
+        args = ["git", "-C", str(root), "-c", "core.autocrlf=false", "-c", "core.hooksPath=" + str(hooks),
+                "-c", "commit.gpgsign=false", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid"]
+        subprocess.run(args + ["init", "-q"], check=True, capture_output=True)
+        (root / "source.txt").write_bytes(source)
+        (root / "Cargo.toml").write_bytes(b'[package]\nversion = "1.5.0"\n')
+        subprocess.run(args + ["add", "source.txt", "Cargo.toml"], check=True, capture_output=True)
+        subprocess.run(args + ["commit", "-q", "-m", "fixture"], check=True, capture_output=True)
+        revision = comparison.git(root, "rev-parse", "HEAD").decode().strip()
+        return revision, int(comparison.git(root, "show", "-s", "--format=%ct", revision))
+
+    def package(self, path, revision, epoch, source=b"public source\n", binary=b"MZ executable\n", bad_sum=False, omit=None):
+        files = {"source.txt": source, "Cargo.toml": b'[package]\nversion = "1.5.0"\n', **{n: ("generated:" + n).encode() for n in comparison.BRIDGE}}
+        manifest = {"repositories": {".": revision}, "source_date_epoch": epoch,
+                    "generated_bridge_files": list(comparison.BRIDGE),
+                    "files": {n: {"sha256": hashlib.sha256(v).hexdigest(), "mode": "100644"} for n, v in files.items()}}
+        memory = io.BytesIO()
+        with zipfile.ZipFile(memory, "w") as z:
+            z.writestr("BUILD-SOURCE.json", json.dumps(manifest))
+            for name, data in files.items():
+                z.writestr("source/" + name, data)
+        shipping = {n: b"MSI fixture" if n.endswith(".msi") else b"MZ fixture" for n in comparison.shipping_names("1.5.0")}
+        shipping["SwanRemoteSupport-1.5.0-x64-unsigned-install.exe"] = binary
+        if omit is not None:
+            shipping.pop(omit)
+        with zipfile.ZipFile(path, "w") as z:
+            z.writestr("SwanRemoteSupport-build-source.zip", memory.getvalue())
+            for name, data in shipping.items():
+                z.writestr(name, data)
+            sums = "\n".join(("0" * 64 if bad_sum else hashlib.sha256(v).hexdigest()) + "  " + n for n, v in shipping.items())
+            z.writestr("SHA256SUMS.txt", sums)
+
+    def test_source_checkout_line_endings_do_not_normalize_shipping_bytes(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            revision, epoch = self.repository(root / "source")
+            a, b = root / "first.zip", root / "second.zip"
+            self.package(a, revision, epoch)
+            self.package(b, revision, epoch, source=b"public source\r\n", binary=b"MZ executable\r\n")
+            report = comparison.compare(a, b, root / "source", revision)
+            self.assertFalse(report["all_shipping_bytes_identical"])
+            self.assertEqual(report["source_proofs"][1]["declared_source_text_checkout_conversions"], ["source.txt"])
+            self.assertFalse(report["normalization_applied_to_shipping_files"])
+            self.assertFalse(report["executables_run"])
+
+    def test_original_source_cannot_be_replaced_by_a_self_consistent_manifest(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            revision, epoch = self.repository(root / "source")
+            a, b = root / "first.zip", root / "second.zip"
+            self.package(a, revision, epoch)
+            self.package(b, revision, epoch, source=b"altered source\n")
+            with self.assertRaisesRegex(comparison.VerificationError, "public source blob"):
+                comparison.compare(a, b, root / "source", revision)
+
+    def test_binary_source_checkout_bytes_are_not_normalized(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            revision, epoch = self.repository(root / "source", b"binary\0\n")
+            a, b = root / "first.zip", root / "second.zip"
+            self.package(a, revision, epoch, source=b"binary\0\n")
+            self.package(b, revision, epoch, source=b"binary\0\r\n")
+            with self.assertRaisesRegex(comparison.VerificationError, "public source blob"):
+                comparison.compare(a, b, root / "source", revision)
+
+    def test_declared_shipping_hash_mismatch_rejected(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            revision, epoch = self.repository(root / "source")
+            a, b = root / "first.zip", root / "second.zip"
+            self.package(a, revision, epoch)
+            self.package(b, revision, epoch, bad_sum=True)
+            with self.assertRaisesRegex(comparison.VerificationError, "artifact file hash"):
+                comparison.compare(a, b, root / "source", revision)
+
+    def test_exact_original_shipping_bytes_pass(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            revision, epoch = self.repository(root / "source")
+            a, b = root / "first.zip", root / "second.zip"
+            self.package(a, revision, epoch)
+            self.package(b, revision, epoch)
+            report = comparison.compare(a, b, root / "source", revision)
+            self.assertTrue(report["all_shipping_bytes_identical"])
+            self.assertEqual(len(report["outputs"]), 8)
+            self.assertFalse(report["production_approved"])
+
+    def test_matching_incomplete_output_sets_are_rejected(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            revision, epoch = self.repository(root / "source")
+            a, b = root / "first.zip", root / "second.zip"
+            self.package(a, revision, epoch, omit="swan-management.exe")
+            self.package(b, revision, epoch, omit="swan-management.exe")
+            with self.assertRaisesRegex(comparison.VerificationError, "output sets"):
+                comparison.compare(a, b, root / "source", revision)
+
+    def test_untrusted_download_origin_rejected_before_storage_request(self):
+        revision = "a" * 40
+        metadata = [
+            {"head_sha": revision, "status": "completed", "conclusion": "success", "path": ".github/workflows/swan-windows-build.yml"},
+            {"artifacts": [{"name": "candidate", "expired": False, "id": 5, "workflow_run": {"head_sha": revision},
+                            "digest": "sha256:" + "0" * 64, "size_in_bytes": 1}]},
+        ]
+        with tempfile.TemporaryDirectory() as directory, patch.object(comparison, "api_json", side_effect=metadata), patch.object(comparison.urllib.request, "build_opener") as factory:
+            factory.return_value.open.side_effect = urllib.error.HTTPError("https://api.github.com/example", 302, "redirect", {"Location": "https://untrusted.example/archive"}, None)
+            target = Path(directory) / "original.zip"
+            with self.assertRaisesRegex(comparison.VerificationError, "download origin"):
+                comparison.fetch("owner/repository", 1, revision, "candidate", "not-a-real-token", target)
+            self.assertFalse(target.exists())
+            self.assertEqual(factory.call_count, 1)
+
+    def test_download_digest_mismatch_retains_rejected_original_bytes(self):
+        revision = "a" * 40
+        metadata = [
+            {"head_sha": revision, "status": "completed", "conclusion": "success", "path": ".github/workflows/swan-windows-build.yml"},
+            {"artifacts": [{"name": "candidate", "expired": False, "id": 5, "workflow_run": {"head_sha": revision},
+                            "digest": "sha256:" + hashlib.sha256(b"expected").hexdigest(), "size_in_bytes": 8}]},
+        ]
+        with tempfile.TemporaryDirectory() as directory, patch.object(comparison, "api_json", side_effect=metadata), patch.object(comparison.urllib.request, "build_opener") as factory:
+            factory.return_value.open.side_effect = [
+                urllib.error.HTTPError("https://api.github.com/example", 302, "redirect", {"Location": "https://example.blob.core.windows.net/archive"}, None),
+                io.BytesIO(b"tampered"),
+            ]
+            target = Path(directory) / "original.zip"
+            with self.assertRaisesRegex(comparison.VerificationError, "archive digest"):
+                comparison.fetch("owner/repository", 1, revision, "candidate", "not-a-real-token", target)
+            self.assertEqual(target.read_bytes(), b"tampered")
+            storage_argument = factory.return_value.open.call_args_list[1].args[0]
+            self.assertIsInstance(storage_argument, str)
+
+
+class ClientWrapperInputTests(unittest.TestCase):
+    expected = {"script_sha256": "a" * 64, "original_canonical_sha256": "b" * 64,
+                "patched_source_sha256": "c" * 64}
+
+    def receipt(self):
+        return {"engine_revision": "a18df97ca57a249df5d8d68cd0820600223ce262",
+                "patch_script_sha256": self.expected["script_sha256"],
+                "original_canonical_sha256": self.expected["original_canonical_sha256"],
+                "engine_binaries_changed": False, "shipping_pe_normalization": False,
+                "files": [{"path": "bin/cache/artifacts/engine/common/cpp_client_wrapper/core_implementations.cc",
+                           "patched_sha256": "c" * 64}]}
+
+    def verify(self, value):
+        memory = io.BytesIO()
+        with zipfile.ZipFile(memory, "w") as archive:
+            if value is not None:
+                archive.writestr("flutter-client-wrapper-repro.json", json.dumps(value))
+        memory.seek(0)
+        with zipfile.ZipFile(memory) as archive:
+            return comparison.verify_client_wrapper(archive, self.expected)
+
+    def test_reviewed_source_patch_identity_is_retained(self):
+        self.assertEqual(self.verify(self.receipt())["patched_source_sha256"], ["c" * 64])
+
+    def test_missing_receipt_does_not_qualify_new_source(self):
+        with self.assertRaises(comparison.VerificationError):
+            self.verify(None)
+
+    def test_unreviewed_engine_preimage_script_and_binary_rewrites_rejected(self):
+        for key, value in (("engine_revision", "other-engine"), ("patch_script_sha256", "d" * 64),
+                           ("original_canonical_sha256", "e" * 64), ("engine_binaries_changed", True),
+                           ("shipping_pe_normalization", True)):
+            with self.subTest(key=key):
+                receipt = self.receipt()
+                receipt[key] = value
+                with self.assertRaises(comparison.VerificationError):
+                    self.verify(receipt)
+
+    def test_unsafe_and_duplicate_source_paths_rejected(self):
+        for path in ("../core_implementations.cc", "C:/cache/cpp_client_wrapper/core_implementations.cc",
+                     "bin/cache/artifacts/engine/../cpp_client_wrapper/core_implementations.cc"):
+            receipt = self.receipt()
+            receipt["files"][0]["path"] = path
+            with self.assertRaises(comparison.VerificationError):
+                self.verify(receipt)
+        receipt = self.receipt()
+        receipt["files"] *= 2
+        with self.assertRaises(comparison.VerificationError):
+            self.verify(receipt)
+
+    def test_self_consistent_but_unreviewed_patched_source_rejected(self):
+        receipt = self.receipt()
+        receipt["files"][0]["patched_sha256"] = "f" * 64
+        with self.assertRaises(comparison.VerificationError):
+            self.verify(receipt)
+
+
+class MsvcInputIdentityTests(unittest.TestCase):
+    def manifest(self):
+        paths = ["bin/Hostx64/x64/" + n for n in ("cl.exe", "c1xx.dll", "c2.dll", "link.exe")]
+        paths += ["include/typeinfo", "include/memory"]
+        files = [{"path": p, "bytes": 1, "sha256": hashlib.sha256(p.encode()).hexdigest()} for p in paths]
+        canonical = "".join(e["path"] + "\0" + e["sha256"] + "\n" for e in sorted(files, key=lambda e: e["path"]))
+        return {"files": files, "input_identity_sha256": hashlib.sha256(canonical.encode()).hexdigest()}
+
+    def verify(self, manifest):
+        stream = io.BytesIO()
+        with zipfile.ZipFile(stream, "w") as archive:
+            if manifest is not None:
+                archive.writestr("native-msvc-toolchain.json", b"\xef\xbb\xbf" + json.dumps(manifest).encode())
+        with zipfile.ZipFile(stream) as archive:
+            return comparison.verify_msvc_inputs(archive, True)
+
+    def test_original_identity_does_not_depend_on_record_order(self):
+        manifest = self.manifest()
+        manifest["files"].reverse()
+        self.assertEqual(self.verify(manifest)["input_identity_sha256"], manifest["input_identity_sha256"])
+
+    def test_missing_or_changed_compiler_evidence_is_rejected(self):
+        with self.assertRaises(comparison.VerificationError):
+            self.verify(None)
+        manifest = self.manifest()
+        manifest["files"][0]["sha256"] = "0" * 64
+        with self.assertRaisesRegex(comparison.VerificationError, "digest differs"):
+            self.verify(manifest)
+
+    def test_duplicate_unsafe_and_malformed_records_are_rejected(self):
+        for entry in ({"path": "../escape", "bytes": 1, "sha256": "0" * 64},
+                      {"path": "INCLUDE/MEMORY", "bytes": 1, "sha256": "0" * 64},
+                      {"path": "include/invalid", "bytes": 1, "sha256": []}, []):
+            with self.subTest(entry=entry):
+                manifest = self.manifest()
+                manifest["files"].append(entry)
+                with self.assertRaises(comparison.VerificationError):
+                    self.verify(manifest)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_network_probe.ps1 b/deployment/windows/test_network_probe.ps1
new file mode 100644
index 00000000000..a4014144808
--- /dev/null
+++ b/deployment/windows/test_network_probe.ps1
@@ -0,0 +1,27 @@
+param([Parameter(Mandatory=$true)][string]$ManagementExecutable,[Parameter(Mandatory=$true)][string]$OutputDirectory)
+$ErrorActionPreference='Stop'
+$executable=(Resolve-Path -LiteralPath $ManagementExecutable).Path
+$directory=[IO.Path]::GetFullPath($OutputDirectory)
+if(Test-Path -LiteralPath $directory){throw 'Use a new network-probe test directory.'}
+New-Item -ItemType Directory -Path $directory | Out-Null
+$authority=$null;$certificate=$null
+try {
+    # Disposable issuer only; never install it into a trusted root store.
+    $authority=New-SelfSignedCertificate -Type Custom -Subject 'CN=Swan disposable probe CA' -CertStoreLocation Cert:\CurrentUser\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -NotAfter (Get-Date).AddDays(2) -KeyUsage CertSign,CRLSign,DigitalSignature -TextExtension @('2.5.29.19={critical}{text}ca=1')
+    $certificate=New-SelfSignedCertificate -Type Custom -Subject 'CN=localhost' -DnsName localhost -Signer $authority -CertStoreLocation Cert:\CurrentUser\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -NotAfter (Get-Date).AddDays(1) -KeyUsage DigitalSignature,KeyEncipherment -TextExtension @('2.5.29.19={critical}{text}ca=0','2.5.29.37={text}1.3.6.1.5.5.7.3.1')
+    $password=[Guid]::NewGuid().ToString('N')
+    $pfx=Join-Path $directory 'localhost.pfx';$ca=Join-Path $directory 'root.cer'
+    Export-PfxCertificate -Cert $certificate -FilePath $pfx -Password (ConvertTo-SecureString $password -AsPlainText -Force) | Out-Null
+    Export-Certificate -Cert $authority -FilePath $ca | Out-Null
+    $environment=Join-Path $directory 'test.private.env'
+    [IO.File]::WriteAllText($environment,"SWAN_TEST_TLS_PFX=$pfx`nSWAN_TEST_TLS_PASSWORD=$password`nSWAN_TEST_CA_FILE=$ca`n")
+    & node (Join-Path $PSScriptRoot 'test-network-probe.js') $environment $executable (Join-Path $directory 'verified.json')
+    if($LASTEXITCODE -ne 0){throw 'Compiled connection checker regression failed.'}
+} finally {
+    if($certificate){Remove-Item -LiteralPath ('Cert:\CurrentUser\My\'+$certificate.Thumbprint)}
+    if($authority){Remove-Item -LiteralPath ('Cert:\CurrentUser\My\'+$authority.Thumbprint)}
+    foreach($name in @('localhost.pfx','test.private.env')){
+        $file=Join-Path $directory $name
+        if(Test-Path -LiteralPath $file){Remove-Item -LiteralPath $file}
+    }
+}
diff --git a/deployment/windows/test_payload_manifest.py b/deployment/windows/test_payload_manifest.py
new file mode 100644
index 00000000000..44f265b2786
--- /dev/null
+++ b/deployment/windows/test_payload_manifest.py
@@ -0,0 +1,51 @@
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+SCRIPT = Path(__file__).with_name("generate-payload-manifest.py")
+SPEC = importlib.util.spec_from_file_location("payload_manifest", SCRIPT)
+MODULE = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(MODULE)
+
+
+class PayloadManifestTests(unittest.TestCase):
+    def test_customer_manifest_maps_executable_and_covers_libraries_and_assets(self):
+        with tempfile.TemporaryDirectory(prefix="swan-manifest-") as directory:
+            root = Path(directory)
+            for name in ["rustdesk.exe", "librustdesk.dll", "flutter_windows.dll", "data/assets.json"]:
+                file = root / name
+                file.parent.mkdir(parents=True, exist_ok=True)
+                file.write_bytes(name.encode())
+            files = {file["path"]: file["sha256"] for file in MODULE.manifest("customer", root)}
+            self.assertEqual(len(files), 4)
+            self.assertEqual(files["Swan Remote Support.exe"], MODULE.digest(root / "rustdesk.exe"))
+            self.assertIn("data/assets.json", files)
+            (root / "flutter_windows.dll").unlink()
+            with self.assertRaises(ValueError):
+                MODULE.manifest("customer", root)
+
+    def test_technician_manifest_covers_complete_packed_executable(self):
+        with tempfile.TemporaryDirectory(prefix="swan-manifest-") as directory:
+            file = Path(directory) / "technician.exe"
+            file.write_bytes(b"portable packed executable fixture")
+            self.assertEqual(MODULE.manifest("technician", file), [{"path": "SwanRemoteSupport-Technician.exe", "sha256": MODULE.digest(file)}])
+
+    def test_cli_generates_json_without_overwriting_previous_output(self):
+        with tempfile.TemporaryDirectory(prefix="swan-manifest-") as directory:
+            file = Path(directory) / "technician.exe"
+            output = Path(directory) / "manifest.json"
+            file.write_bytes(b"portable fixture")
+            command = [sys.executable, str(SCRIPT), "--edition", "technician", "--source", str(file), "--output", str(output)]
+            self.assertEqual(subprocess.run(command, capture_output=True).returncode, 0)
+            original = output.read_bytes()
+            self.assertEqual(json.loads(original)[0]["sha256"], MODULE.digest(file))
+            self.assertNotEqual(subprocess.run(command, capture_output=True).returncode, 0)
+            self.assertEqual(output.read_bytes(), original)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_pinned_archive.ps1 b/deployment/windows/test_pinned_archive.ps1
new file mode 100644
index 00000000000..6f4e9e89146
--- /dev/null
+++ b/deployment/windows/test_pinned_archive.ps1
@@ -0,0 +1,47 @@
+$ErrorActionPreference = 'Stop'
+$base = [IO.Path]::GetFullPath($env:TEMP).TrimEnd('\')
+$root = [IO.Path]::GetFullPath((Join-Path $base ('swan-pinned-download-'+[Guid]::NewGuid().ToString('N'))))
+if (-not $root.StartsWith($base+'\',[StringComparison]::OrdinalIgnoreCase)) { throw 'Test directory escaped temporary storage.' }
+New-Item -ItemType Directory -Path $root | Out-Null
+if(Test-Path variable:global:SwanPinnedArchiveTestContext){throw 'Test context already exists'};$global:SwanPinnedArchiveTestContext=@{calls=0;mode='transient';delays=@()}
+$global:SwanPinnedArchiveTestContext.reviewed=[Text.Encoding]::UTF8.GetBytes('reviewed complete archive fixture')
+$hasher=[Security.Cryptography.SHA256]::Create()
+try {$expected=[BitConverter]::ToString($hasher.ComputeHash($global:SwanPinnedArchiveTestContext.reviewed)).Replace('-','').ToLowerInvariant()} finally {$hasher.Dispose()}
+function Invoke-WebRequest {
+    param($Uri,$OutFile,[switch]$UseBasicParsing,[int]$TimeoutSec)
+    $global:SwanPinnedArchiveTestContext.calls++
+    if ($global:SwanPinnedArchiveTestContext.mode -eq 'permanent' -or ($global:SwanPinnedArchiveTestContext.mode -eq 'transient' -and $global:SwanPinnedArchiveTestContext.calls -eq 1)) {
+        [IO.File]::WriteAllBytes($OutFile,[byte[]](1,2,3));throw 'Simulated connection reset'
+    }
+    [byte[]]$body=if ($global:SwanPinnedArchiveTestContext.mode -eq 'corrupt') {[byte[]](7,8,9)}else{$global:SwanPinnedArchiveTestContext.reviewed};[IO.File]::WriteAllBytes($OutFile,$body)
+}
+function Start-Sleep {param([int]$Seconds);$global:SwanPinnedArchiveTestContext.delays+= $Seconds}
+$helper=Join-Path $PSScriptRoot 'Get-PinnedArchive.ps1'
+try {
+    $protocol=[Net.ServicePointManager]::SecurityProtocol
+    $path=Join-Path $root 'valid.zip'
+    $null=& $helper -Uri https://example.invalid/reviewed.zip -Sha256 $expected -Output $path
+    if ($global:SwanPinnedArchiveTestContext.calls -ne 2 -or -not (Test-Path -LiteralPath $path) -or [Net.ServicePointManager]::SecurityProtocol -ne $protocol) { throw 'Retry or protocol restoration failed.' }
+    $global:SwanPinnedArchiveTestContext.mode='permanent';$global:SwanPinnedArchiveTestContext.calls=0
+    $null=& $helper -Uri https://example.invalid/reviewed.zip -Sha256 $expected -Output $path
+    if ($global:SwanPinnedArchiveTestContext.calls -ne 0) { throw 'A verified existing archive was downloaded again.' }
+    $failed=$false
+    try {$null=& $helper -Uri https://example.invalid/reviewed.zip -Sha256 ('0'*64) -Output $path} catch {$failed=$true}
+    if (-not $failed -or $global:SwanPinnedArchiveTestContext.calls -ne 0) { throw 'Mismatched existing evidence was replaced.' }
+    $failed=$false;$missing=Join-Path $root 'missing.zip'
+    try {$null=& $helper -Uri https://example.invalid/reviewed.zip -Sha256 $expected -Output $missing} catch {$failed=$true}
+    if (-not $failed -or $global:SwanPinnedArchiveTestContext.calls -ne 3 -or (Test-Path -LiteralPath $missing)) { throw 'Failed transfer was published or retry bound was ignored.' }
+    $global:SwanPinnedArchiveTestContext.mode='corrupt';$global:SwanPinnedArchiveTestContext.calls=0;$failed=$false;$corrupt=Join-Path $root 'corrupt.zip'
+    try {$null=& $helper -Uri https://example.invalid/reviewed.zip -Sha256 $expected -Output $corrupt} catch {$failed=$true}
+    if (-not $failed -or $global:SwanPinnedArchiveTestContext.calls -ne 1 -or (Test-Path -LiteralPath $corrupt) -or @(Get-ChildItem -LiteralPath $root -Filter '*.unverified').Count -ne 1) { throw 'Corrupt bytes were retried, published or discarded.' }
+    $global:SwanPinnedArchiveTestContext.calls=0;$failed=$false
+    try {$null=& $helper -Uri http://example.invalid/reviewed.zip -Sha256 $expected -Output (Join-Path $root 'http.zip')} catch {$failed=$true}
+    if (-not $failed -or $global:SwanPinnedArchiveTestContext.calls -ne 0) { throw 'Plain HTTP was accepted.' }
+    Write-Output 'Pinned download retry, hash rejection, existing evidence, HTTPS and atomic publication checks passed. Network failures were simulated; supplier end-to-end download is separate.'
+} finally {
+    $resolved=(Get-Item -LiteralPath $root).FullName
+    if (-not $resolved.StartsWith($base+'\',[StringComparison]::OrdinalIgnoreCase) -or ((Get-Item -LiteralPath $root).Attributes -band [IO.FileAttributes]::ReparsePoint)) { throw 'Refusing unsafe test cleanup.' }
+    Remove-Variable -Name SwanPinnedArchiveTestContext -Scope Global
+    Remove-Item -LiteralPath $resolved -Recurse -Force
+}
+
diff --git a/deployment/windows/test_pinned_flutter_sdk.py b/deployment/windows/test_pinned_flutter_sdk.py
new file mode 100644
index 00000000000..fda6cea7d01
--- /dev/null
+++ b/deployment/windows/test_pinned_flutter_sdk.py
@@ -0,0 +1,44 @@
+"""Reject SDK drift and tampering before extraction or CI environment changes."""
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+@unittest.skipUnless(shutil.which("pwsh"), "PowerShell 7 is required")
+class PinnedFlutterSdkTests(unittest.TestCase):
+    def reject(self, version, message):
+        script = Path(__file__).with_name("install-pinned-flutter.ps1")
+        with tempfile.TemporaryDirectory(prefix="swan-sdk-negative-") as folder:
+            root = Path(folder)
+            archive = root / "untrusted.zip"
+            archive.write_bytes(b"An altered or unrelated SDK must not be extracted")
+            destination = root / "sdk"
+            environment = os.environ.copy()
+            exports = [root / "environment", root / "path"]
+            for name, path in zip(("GITHUB_ENV", "GITHUB_PATH"), exports):
+                path.write_text("unchanged\n")
+                environment[name] = str(path)
+            result = subprocess.run(
+                ["pwsh", "-NoProfile", "-NonInteractive", "-File", str(script),
+                 "-Destination", str(destination), "-Archive", str(archive),
+                 "-ExpectedVersion", version],
+                env=environment, capture_output=True, text=True, timeout=30,
+            )
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn(message, result.stdout + result.stderr)
+            self.assertFalse(destination.exists())
+            self.assertEqual(archive.read_bytes(), b"An altered or unrelated SDK must not be extracted")
+            self.assertTrue(all(path.read_text() == "unchanged\n" for path in exports))
+
+    def test_untrusted_archive_cannot_install_or_export_environment(self):
+        self.reject("3.24.5", "Pinned Flutter archive hash mismatch")
+
+    def test_other_version_cannot_fall_back_to_latest(self):
+        self.reject("3.47.8", "Requested Flutter version differs from the pinned SDK")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_reproducible_pe.py b/deployment/windows/test_reproducible_pe.py
new file mode 100644
index 00000000000..b7ea58302d2
--- /dev/null
+++ b/deployment/windows/test_reproducible_pe.py
@@ -0,0 +1,57 @@
+import importlib.util
+from pathlib import Path
+import struct
+import tempfile
+import unittest
+
+spec = importlib.util.spec_from_file_location("repro_pe", Path(__file__).with_name("verify-reproducible-pe.py"))
+pe = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(pe)
+
+
+def fixture():
+    data = bytearray(1024)
+    data[:2] = b"MZ"
+    struct.pack_into("<I", data, 60, 0x80)
+    data[0x80:0x84] = b"PE\0\0"
+    struct.pack_into("<HH", data, 0x84, 0x8664, 1)
+    struct.pack_into("<HH", data, 0x94, 240, 0x2000)
+    struct.pack_into("<H", data, 0x98, 0x20b)
+    struct.pack_into("<I", data, 0x98 + 108, 16)
+    struct.pack_into("<II", data, 0x98 + 160, 0x1000, 56)
+    struct.pack_into("<IIII", data, 0x98 + 240 + 8, 512, 0x1000, 512, 512)
+    struct.pack_into("<IIII", data, 512 + 12, 16, 0, 0, 0)
+    codeview = b"RSDS" + b"0" * 16 + struct.pack("<I", 1) + b"WindowInjection.pdb\0"
+    struct.pack_into("<IIII", data, 540 + 12, 2, len(codeview), 0x1040, 576)
+    data[576:576 + len(codeview)] = codeview
+    return data
+
+
+class ReproduciblePeTests(unittest.TestCase):
+    def test_marker_and_pdb_basename_do_not_claim_a_rebuild(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "helper.dll"
+            path.write_bytes(fixture())
+            result = pe.verify(path, True)
+            self.assertTrue(result["repro_marker"])
+            self.assertEqual(result["pdb_names"], ["WindowInjection.pdb"])
+            self.assertFalse(result["independent_rebuild_verified"])
+
+    def test_missing_marker_absolute_paths_and_malformed_pe_are_rejected(self):
+        changes = []
+        data = fixture(); struct.pack_into("<I", data, 524, 14); changes.append(data)
+        data = fixture(); data[600:602] = b"C:"; changes.append(data)
+        data = fixture(); struct.pack_into("<H", data, 0x84, 0x14c); changes.append(data)
+        data = fixture(); struct.pack_into("<II", data, 0x98 + 160, 0x2000, 56); changes.append(data)
+        changes.extend((fixture()[:300], b"not a PE"))
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "helper.dll"
+            for value in changes:
+                with self.subTest(length=len(value)):
+                    path.write_bytes(value)
+                    with self.assertRaises(ValueError):
+                        pe.verify(path, True)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_server_directory.ps1 b/deployment/windows/test_server_directory.ps1
new file mode 100644
index 00000000000..32c5dd40e0f
--- /dev/null
+++ b/deployment/windows/test_server_directory.ps1
@@ -0,0 +1,42 @@
+param([Parameter(Mandatory=$true)][string]$ManagementExe)
+$ErrorActionPreference='Stop'
+if($env:GITHUB_ACTIONS -cne 'true' -or $env:RUNNER_OS -cne 'Windows'){throw 'This canonical-directory fixture requires a disposable Windows CI runner.'}
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+if(-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Administrator fixture required.'}
+$exe=(Resolve-Path -LiteralPath $ManagementExe).Path
+$root=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanCompanyServer'
+if((Test-Path -LiteralPath $root) -or (Get-Service SwanCompanyServer -ErrorAction SilentlyContinue)){throw 'Existing server state must not be changed.'}
+function Invoke-Preparation([string]$Path){
+    $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=$exe
+    $start.Arguments='prepare-server-directory "'+$Path+'"';$start.UseShellExecute=$false;$start.CreateNoWindow=$true
+    $start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+    $process=[Diagnostics.Process]::Start($start)
+    try{
+        $stdout=$process.StandardOutput.ReadToEndAsync();$stderr=$process.StandardError.ReadToEndAsync()
+        if(-not $process.WaitForExit(30000)){$process.Kill();$process.WaitForExit();throw 'Directory preparation exceeded its deadline.'}
+        $null=$stdout.GetAwaiter().GetResult();$null=$stderr.GetAwaiter().GetResult()
+        return $process.ExitCode
+    }finally{$process.Dispose()}
+}
+$created=$false
+try{
+    $wrong=Join-Path ([IO.Path]::GetTempPath()) ('swan-wrong-server-'+[Guid]::NewGuid().ToString('N'))
+    if((Invoke-Preparation $wrong) -eq 0 -or (Test-Path -LiteralPath $wrong)){throw 'Management command accepted a noncanonical path.'}
+    if((Invoke-Preparation $root) -ne 0){throw 'Fresh private server directory creation failed.'};$created=$true
+    $acl=Get-Acl -LiteralPath $root;$before=$acl.Sddl
+    if(-not $acl.AreAccessRulesProtected -or $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -cne 'S-1-5-32-544'){throw 'Server directory owner or protection differs.'}
+    $rules=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]))
+    if($rules.Count -ne 2){throw 'Unexpected server directory rules.'}
+    foreach($sid in @('S-1-5-18','S-1-5-32-544')){
+        $rule=@($rules|Where-Object {$_.IdentityReference.Value -ceq $sid -and $_.AccessControlType -eq 'Allow' -and $_.FileSystemRights -eq 'FullControl'})
+        if($rule.Count -ne 1){throw 'Server directory permissions differ.'}
+    }
+    if((Invoke-Preparation $root) -eq 0 -or (Get-Acl -LiteralPath $root).Sddl -cne $before){throw 'Fresh server setup adopted or changed existing state.'}
+    if(@(Get-ChildItem -LiteralPath $root -Force).Count -or (Get-Service SwanCompanyServer -ErrorAction SilentlyContinue)){throw 'Preparation created data or a service.'}
+    Write-Output 'PASS: compiled management creates canonical private state atomically, rejects wrong paths and refuses existing state without changing permissions; no server started.'
+}finally{
+    if($created -and (Test-Path -LiteralPath $root)){
+        $item=Get-Item -LiteralPath $root
+        if($item.PSIsContainer -and -not ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -and @(Get-ChildItem -LiteralPath $root -Force).Count -eq 0){[IO.Directory]::Delete($root,$false)}
+    }
+}
diff --git a/deployment/windows/test_server_removal_plan.ps1 b/deployment/windows/test_server_removal_plan.ps1
new file mode 100644
index 00000000000..05c92b1ff66
--- /dev/null
+++ b/deployment/windows/test_server_removal_plan.ps1
@@ -0,0 +1,44 @@
+$ErrorActionPreference = 'Stop'
+$root = Join-Path ([IO.Path]::GetTempPath()) ('swan-server-removal-'+[guid]::NewGuid().ToString('N'))
+$install = Join-Path $root 'Swan Company Server'
+$data = Join-Path $root 'SwanCompanyServer'
+New-Item -ItemType Directory -Path $root,$install,$data | Out-Null
+$receiptPath = Join-Path $data 'installation.json'
+$database = Join-Path $data 'management.sqlite3'
+$binary = '"'+(Join-Path $install 'swan-management.exe')+'" --service'
+$receipt = @{schema=1;service_name='SwanCompanyServer';install_directory=$install;data_directory=$data;full_stack=$true;firewall_rules=@('SwanCompanyServer-TCP','SwanCompanyServer-UDP')}
+function Save-Receipt { [IO.File]::WriteAllText($receiptPath,($receipt | ConvertTo-Json -Depth 4)) }
+function Plan { & (Join-Path $PSScriptRoot 'Get-ServerRemovalPlan.ps1') -InstallDirectory $install -DataDirectory $data -ServiceBinary $binary }
+function Reject-Plan { $rejected=$false; try { Plan | Out-Null } catch {$rejected=$true}; if (-not $rejected) {throw 'Unsafe removal plan accepted'} }
+try {
+    [IO.File]::WriteAllText($database,'identity preservation fixture')
+    Save-Receipt
+    $plan = Plan
+    if ($plan.Files.Count -ne 9 -or @($plan.Files | Where-Object {$_ -like ($data+'*')}).Count) {throw 'Removal includes company data or omits expected binaries'}
+    $saved=$binary; $binary='"C:\Windows\System32\svchost.exe" --service'; Reject-Plan; $binary=$saved
+    $binary=$saved+' --unexpected'; Reject-Plan; $binary=$saved
+    $receipt.firewall_rules=@('Unrelated-Firewall-Rule'); Save-Receipt; Reject-Plan
+    $receipt.firewall_rules=@('SwanCompanyServer-TCP','SwanCompanyServer-TCP'); Save-Receipt; Reject-Plan
+    $receipt.firewall_rules=@('SwanCompanyServer-TCP','SwanCompanyServer-UDP'); $receipt.data_directory=Join-Path $root 'other-company'; Save-Receipt; Reject-Plan
+    $receipt.data_directory=$data; $receipt.full_stack='false'; Save-Receipt; Reject-Plan
+    $receipt.full_stack=$false; $receipt.firewall_rules=@(); Save-Receipt; $plan=Plan
+    if ($plan.Files.Count -ne 1 -or $plan.FirewallRules.Count) {throw 'Management-only removal owns component resources'}
+    $executableDirectory=Join-Path $install 'swan-management.exe'
+    New-Item -ItemType Directory -Path $executableDirectory | Out-Null
+    try { Reject-Plan } finally { [IO.Directory]::Delete($executableDirectory) }
+    if ($env:OS -eq 'Windows_NT') {
+        $target=Join-Path $root 'unrelated-directory'
+        $junction=Join-Path $install 'components'
+        New-Item -ItemType Directory -Path $target | Out-Null
+        try {
+            New-Item -ItemType Junction -Path $junction -Target $target | Out-Null
+            try { Reject-Plan } finally { [IO.Directory]::Delete($junction) }
+            if (-not (Test-Path -LiteralPath $target -PathType Container)) {throw 'Planning or junction cleanup removed its target'}
+        } finally { [IO.Directory]::Delete($target) }
+    }
+    if ([IO.File]::ReadAllText($database) -ne 'identity preservation fixture') {throw 'Planning changed company identity'}
+    Write-Output 'PASS: removal ownership checks reject wrong executable/arguments, company, rule names, duplicates, policy types, directories and junctions; company data is excluded.'
+} finally {
+    foreach ($file in @($receiptPath,$database)) {if (Test-Path -LiteralPath $file) {Remove-Item -LiteralPath $file}}
+    foreach ($directory in @($install,$data,$root)) {Remove-Item -LiteralPath $directory}
+}
diff --git a/deployment/windows/test_server_setup_reproducibility.ps1 b/deployment/windows/test_server_setup_reproducibility.ps1
new file mode 100644
index 00000000000..e3fc9201b68
--- /dev/null
+++ b/deployment/windows/test_server_setup_reproducibility.ps1
@@ -0,0 +1,59 @@
+[CmdletBinding()]
+param(
+ [Parameter(Mandatory)][string]$ManagementExecutable,
+ [Parameter(Mandatory)][string]$ComponentsDirectory,
+ [Parameter(Mandatory)][string]$CompilerPackage,
+ [Parameter(Mandatory)][string]$FrameworkReferencesPackage,
+ [Parameter(Mandatory)][string]$PowerShellReferencesPackage,
+ [Parameter(Mandatory)][string]$WorkDirectory
+)
+$ErrorActionPreference='Stop'
+if(Test-Path -LiteralPath $WorkDirectory){throw 'Use a fresh reproducibility evidence directory.'}
+[void][IO.Directory]::CreateDirectory([IO.Path]::GetFullPath($WorkDirectory))
+$builder=Join-Path $PSScriptRoot 'Build-ServerSetup.ps1'
+$shell=Join-Path $env:WINDIR 'System32/WindowsPowerShell/v1.0/powershell.exe'
+$first=Join-Path $WorkDirectory 'first';$second=Join-Path $WorkDirectory 'second'
+& $shell -NoProfile -NonInteractive -File $builder -ManagementExecutable $ManagementExecutable -ComponentsDirectory $ComponentsDirectory -CompilerPackage $CompilerPackage -FrameworkReferencesPackage $FrameworkReferencesPackage -PowerShellReferencesPackage $PowerShellReferencesPackage -OutputDirectory $first -UnsignedTest | Out-Host
+if($LASTEXITCODE -ne 0){throw 'First server setup compilation failed.'}
+& $builder -ManagementExecutable $ManagementExecutable -ComponentsDirectory $ComponentsDirectory -CompilerPackage $CompilerPackage -FrameworkReferencesPackage $FrameworkReferencesPackage -PowerShellReferencesPackage $PowerShellReferencesPackage -OutputDirectory $second -UnsignedTest | Out-Host
+$a=Join-Path $first 'SwanServerSetup-UNSIGNED-TEST.exe';$b=Join-Path $second 'SwanServerSetup-UNSIGNED-TEST.exe'
+$hash=(Get-FileHash -LiteralPath $a).Hash.ToLowerInvariant()
+if((Get-FileHash -LiteralPath $b).Hash.ToLowerInvariant() -cne $hash){throw 'Actual unsigned server installer bytes differ.'}
+$sourceHash=(Get-FileHash -LiteralPath (Join-Path $first 'SOURCE.json')).Hash
+if((Get-FileHash -LiteralPath (Join-Path $second 'SOURCE.json')).Hash -cne $sourceHash){throw 'Server source manifests differ.'}
+$wrong=Join-Path $WorkDirectory 'wrong-package.nupkg';[IO.File]::WriteAllText($wrong,'Not the pinned Microsoft compiler package.')
+$rejected=Join-Path $WorkDirectory 'rejected-compiler';$blocked=$false
+try{& (Join-Path $PSScriptRoot 'Expand-ServerCompiler.ps1') -Package $wrong -OutputDirectory $rejected | Out-Null}
+catch{if($_.Exception.Message -eq 'Pinned server compiler package mismatch.'){$blocked=$true}else{throw}}
+if(-not $blocked -or (Test-Path -LiteralPath $rejected)){throw 'Wrong compiler package was not rejected before extraction.'}
+$source=Get-Content -LiteralPath (Join-Path $first 'SOURCE.json') -Raw|ConvertFrom-Json
+$referencePins=Get-Content -LiteralPath (Join-Path $PSScriptRoot 'server-references.json') -Raw|ConvertFrom-Json
+foreach($kind in @('framework','powershell')){
+ foreach($file in $referencePins.$kind.reference_files.PSObject.Properties){
+  $name=[IO.Path]::GetFileName($file.Name)
+  if($source.reference_sha256.$name -cne $file.Value){throw 'Build used a reference outside the reviewed pins.'}
+ }
+ $rejectedReference=Join-Path $WorkDirectory ('rejected-'+$kind);$blocked=$false
+ $framework=if($kind -eq 'framework'){$wrong}else{$FrameworkReferencesPackage}
+ $powershell=if($kind -eq 'powershell'){$wrong}else{$PowerShellReferencesPackage}
+ try{& (Join-Path $PSScriptRoot 'Expand-ServerReferences.ps1') -FrameworkPackage $framework -PowerShellPackage $powershell -OutputDirectory $rejectedReference|Out-Null}
+ catch{if($_.Exception.Message -eq 'Pinned server reference package mismatch.'){$blocked=$true}else{throw}}
+ if(-not $blocked -or (Test-Path -LiteralPath $rejectedReference)){throw 'Wrong reference package was not rejected before extraction.'}
+}
+$preview=[IO.Path]::GetFullPath((Join-Path $WorkDirectory 'packaged-preview.png'))
+$start=[Diagnostics.ProcessStartInfo]::new()
+$start.FileName=[IO.Path]::GetFullPath($a)
+$start.Arguments='--render-preview "'+$preview+'"'
+$start.UseShellExecute=$false
+$start.CreateNoWindow=$true
+$start.WindowStyle=[Diagnostics.ProcessWindowStyle]::Hidden
+# Own the process handle directly so Windows PowerShell retains ExitCode even
+# when a short-lived child has already exited by the next observation.
+$process=[Diagnostics.Process]::Start($start)
+@{pid=$process.Id;executable_sha256=$hash;mode='preview-only'}|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $WorkDirectory 'preview-process.json')
+if(-not $process.WaitForExit(60000)){throw 'Packaged preview is still running; inspect its recorded PID before retrying.'}
+if($process.ExitCode -ne 0 -or -not(Test-Path -LiteralPath $preview)){throw 'Packaged preview runtime failed.'}
+$png=[IO.File]::ReadAllBytes($preview)
+if($png.Length -lt 24 -or [BitConverter]::ToString($png,0,8) -cne '89-50-4E-47-0D-0A-1A-0A'){throw 'Packaged preview did not produce a PNG.'}
+@{passed=$true;sha256=$hash;source_sha256=$sourceHash.ToLowerInvariant();compiler=$source.compiler;reference_packages=$source.reference_packages;reference_sha256=$source.reference_sha256;setup_source_revision=$source.setup_source_revision;working_tree_dirty=$source.working_tree_dirty;wrong_compiler_rejected=$true;wrong_references_rejected=$true;packaged_preview_passed=$true;executables_installed=$false;scope='Two actual local unsigned server launcher compilations with pinned compiler/reference packages and preview-only runtime. No independent CI, deployment, signing, or complete server acceptance claim.'}|ConvertTo-Json -Depth 5|Set-Content -LiteralPath (Join-Path $WorkDirectory 'result.json')
+Write-Host 'Server installer repeat-build and compiler rejection checks passed.'
diff --git a/deployment/windows/test_service_bootstrap.ps1 b/deployment/windows/test_service_bootstrap.ps1
new file mode 100644
index 00000000000..f1280b27bd6
--- /dev/null
+++ b/deployment/windows/test_service_bootstrap.ps1
@@ -0,0 +1,78 @@
+[CmdletBinding()]
+param([Parameter(Mandatory=$true)][string]$BuildDirectory,
+      [Parameter(Mandatory=$true)][string]$OutputDirectory,
+      [switch]$OwnedDisposableLab)
+$ErrorActionPreference='Stop';$ProgressPreference='SilentlyContinue'
+$admin=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent())
+if(!$admin.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Disposable service tests require administrator access.'}
+if(!$OwnedDisposableLab -and ($env:GITHUB_ACTIONS -ne 'true' -or $env:RUNNER_OS -ne 'Windows')){throw 'Use a disposable Windows CI runner or explicitly select an owned lab VM.'}
+$build=(Resolve-Path -LiteralPath $BuildDirectory).Path
+$output=[IO.Path]::GetFullPath($OutputDirectory)
+if(Test-Path -LiteralPath $output){throw 'Preserve existing test output.'}
+New-Item -ItemType Directory -Path $output|Out-Null
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+icacls.exe $output /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' ('*'+$sid+':(OI)(CI)F')|Out-Null
+if($LASTEXITCODE){throw 'Fixture directory must be private.'}
+$records=@()
+foreach($case in @(
+ @{name='normal';exe='bootstrap-check.exe';core='core-fast.dll';service='SwanLabBootstrapFixture';expected=0},
+ @{name='slow-loader';exe='bootstrap-check.exe';core='core-slow.dll';service='SwanLabBootstrapFixture';expected=0},
+ @{name='missing-core';exe='bootstrap-check.exe';core=$null;service='SwanLabBootstrapFixture';expected=126},
+ @{name='missing-export';exe='bootstrap-check.exe';core='core-missing-export.dll';service='SwanLabBootstrapFixture';expected=127},
+ @{name='bounded-loader-timeout';exe='bootstrap-timeout-check.exe';core='core-timeout.dll';service='SwanLabBootstrapTimeoutFixture';expected=1460}
+)){
+ $name=$case.service
+ if(Get-Service -Name $name -ErrorAction SilentlyContinue){throw 'Preserve existing fixture service.'}
+ $directory=Join-Path $output $case.name;New-Item -ItemType Directory $directory|Out-Null
+ $exe=Join-Path $directory $case.exe;Copy-Item -LiteralPath (Join-Path $build $case.exe) -Destination $exe
+ if($case.core){Copy-Item -LiteralPath (Join-Path $build $case.core) -Destination (Join-Path $directory 'librustdesk.dll')}
+ $binary='"'+$exe+'" --service';$created=$false;$passed=$false;$snapshots=@();$timer=[Diagnostics.Stopwatch]::StartNew()
+ try{
+  New-Service -Name $name -BinaryPathName $binary -StartupType Manual|Out-Null;$created=$true
+  $null=& sc.exe start $name
+  do{
+   $service=Get-CimInstance Win32_Service -Filter ("Name='"+$name+"'")
+   $snapshots+=@{elapsed=$timer.Elapsed.TotalSeconds;state=$service.State;checkpoint=$service.CheckPoint;wait_hint=$service.WaitHint;pid=$service.ProcessId;exit_code=$service.ExitCode}
+   if($service.State -in @('Running','Stopped')){break}
+   if($timer.Elapsed.TotalSeconds -gt 100){throw 'Original service initialization exceeded the fixture deadline.'}
+   Start-Sleep -Milliseconds 500
+  }while($true)
+  if($case.expected -eq 0){
+   if($service.State -ne 'Running'){throw 'Core did not enter Running.'}
+   if($case.name -eq 'slow-loader'){
+    $pending=@($snapshots|Where-Object state -eq 'Start Pending')
+    if($timer.Elapsed.TotalSeconds -lt 30 -or @($pending.checkpoint|Select-Object -Unique).Count -lt 3){throw 'Long DLL initialization did not show genuine SCM pending checkpoints.'}
+   }
+   $null=& sc.exe interrogate $name;if($LASTEXITCODE){throw 'Interrogate forwarding failed.'}
+   Stop-Service -Name $name
+   $controller=Get-Service $name;try{$controller.WaitForStatus('Stopped',[TimeSpan]::FromSeconds(20))}finally{$controller.Dispose()}
+  }elseif($service.State -ne 'Stopped' -or $service.ExitCode -ne $case.expected){throw 'Failed initialization did not report the expected stopped/error state.'}
+  $deadline=[DateTime]::UtcNow.AddSeconds(10)
+  do{
+   $remaining=@(Get-CimInstance Win32_Process -Filter ("Name='"+$case.exe+"'")|Where-Object ExecutablePath -ieq $exe)
+   if(!$remaining.Count){break};if([DateTime]::UtcNow -gt $deadline){throw 'Owned fixture process survived service shutdown.'};Start-Sleep -Milliseconds 200
+  }while($true)
+  $passed=$true
+ }finally{
+  $record=@{case=$case.name;passed=$passed;expected_error=$case.expected;elapsed_seconds=$timer.Elapsed.TotalSeconds;snapshots=$snapshots;real_windows_service=$true;simulated_core_only=$true}
+  $record|ConvertTo-Json -Depth 6|Set-Content (Join-Path $directory 'result.json');$records+=$record
+  if($created){
+   $owned=Get-CimInstance Win32_Service -Filter ("Name='"+$name+"'")
+   if($owned -and $owned.PathName -cne $binary){throw 'Fixture ownership changed; no cleanup performed.'}
+   if($owned -and $owned.State -ne 'Stopped'){
+    foreach($process in @(Get-CimInstance Win32_Process -Filter ("Name='"+$case.exe+"'")|Where-Object ExecutablePath -ieq $exe)){Stop-Process -Id $process.ProcessId -Force}
+   }
+   $null=& sc.exe delete $name;if($LASTEXITCODE){throw 'Owned fixture service removal failed.'}
+   $deadline=[DateTime]::UtcNow.AddSeconds(10)
+   while(Get-Service -Name $name -ErrorAction SilentlyContinue){if([DateTime]::UtcNow -gt $deadline){throw 'Fixture service deletion remains pending.'};Start-Sleep -Milliseconds 250}
+  }
+ }
+}
+# Exact service-argument handling must not divert desktop or ambiguous commands.
+foreach($test in @(@{args='--not-service';exit=7},@{args='--service unexpected';exit=87})){
+ $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=Join-Path $build 'bootstrap-check.exe';$start.Arguments=$test.args;$start.UseShellExecute=$false;$start.CreateNoWindow=$true
+ $process=[Diagnostics.Process]::Start($start)
+ try{if(!$process.WaitForExit(10000)){$process.Kill();$process.WaitForExit();throw 'Argument fixture did not exit.'};if($process.ExitCode -ne $test.exit){throw 'Service argument handling differs.'}}finally{$process.Dispose()}
+}
+@{utc=[DateTime]::UtcNow.ToString('o');cases=$records;argument_checks_passed=$true;scope='Real SCM/loader boundary with a simulated DLL; no native Rust core, signing, enrollment, session, cold reboot or complete product acceptance.'}|ConvertTo-Json -Depth 8|Set-Content (Join-Path $output 'verified.json')
+Write-Host 'Actual Windows SCM bootstrap cases passed; simulated DLL scope only. No native product or cold-boot acceptance inferred.'
diff --git a/deployment/windows/test_service_imports.py b/deployment/windows/test_service_imports.py
new file mode 100644
index 00000000000..b0a241131e8
--- /dev/null
+++ b/deployment/windows/test_service_imports.py
@@ -0,0 +1,73 @@
+import importlib.util
+from pathlib import Path
+import struct
+import tempfile
+import unittest
+
+spec = importlib.util.spec_from_file_location("service_imports", Path(__file__).with_name("verify-service-imports.py"))
+imports = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(imports)
+
+
+def fixture(eager=b"KERNEL32.dll", delayed=b"flutter_windows.dll"):
+    data = bytearray(2048)
+    data[:2] = b"MZ"
+    struct.pack_into("<I", data, 60, 0x80)
+    data[0x80:0x84] = b"PE\0\0"
+    struct.pack_into("<HH", data, 0x84, 0x8664, 1)
+    struct.pack_into("<H", data, 0x94, 240)
+    struct.pack_into("<H", data, 0x98, 0x20b)
+    struct.pack_into("<I", data, 0x98 + 108, 16)
+    struct.pack_into("<IIII", data, 0x98 + 240 + 8, 1536, 0x1000, 1536, 512)
+    struct.pack_into("<II", data, 0x98 + 120, 0x1000, 40)
+    struct.pack_into("<IIIII", data, 512, 0, 0, 0, 0x1080, 0)
+    data[640:640 + len(eager) + 1] = eager + b"\0"
+    struct.pack_into("<II", data, 0x98 + 112 + 13 * 8, 0x1100, 64)
+    struct.pack_into("<IIIIIIII", data, 768, 1, 0x1180, 0, 0, 0, 0, 0, 0)
+    data[896:896 + len(delayed) + 1] = delayed + b"\0"
+    return data
+
+
+class ServiceImportTests(unittest.TestCase):
+    def test_delay_loaded_engine_does_not_claim_cold_boot_acceptance(self):
+        with tempfile.TemporaryDirectory() as directory:
+            bundle = Path(directory)
+            (bundle / "flutter_windows.dll").touch()
+            path = bundle / "app.exe"
+            path.write_bytes(fixture())
+            result = imports.verify(path, bundle)
+            self.assertTrue(result["no_eager_bundled_desktop_dlls"])
+            self.assertFalse(result["cold_boot_runtime_verified"])
+
+    def test_eager_engine_plugins_and_missing_delay_engine_are_rejected(self):
+        with tempfile.TemporaryDirectory() as directory:
+            bundle = Path(directory)
+            for name in ("flutter_windows.dll", "window_manager_plugin.dll"):
+                (bundle / name).touch()
+            path = bundle / "app.exe"
+            for data in (fixture(eager=b"FLUTTER_WINDOWS.dll"),
+                         fixture(eager=b"window_manager_plugin.dll"),
+                         fixture(delayed=b"other.dll")):
+                with self.subTest(data=data[640:665]):
+                    path.write_bytes(data)
+                    with self.assertRaises(ValueError):
+                        imports.verify(path, bundle)
+
+    def test_bad_delay_descriptors_and_file_rvas_are_rejected(self):
+        values = []
+        data = fixture(); struct.pack_into("<I", data, 768, 0); values.append(data)
+        data = fixture(); struct.pack_into("<I", data, 772, 0x9000); values.append(data)
+        data = fixture(); struct.pack_into("<I", data, 0x98 + 112 + 13 * 8 + 4, 32); values.append(data)
+        values.append(fixture()[:600])
+        with tempfile.TemporaryDirectory() as directory:
+            bundle = Path(directory)
+            (bundle / "flutter_windows.dll").touch()
+            path = bundle / "app.exe"
+            for data in values:
+                path.write_bytes(data)
+                with self.assertRaises(ValueError):
+                    imports.verify(path, bundle)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/deployment/windows/test_setup_ui_broker.ps1 b/deployment/windows/test_setup_ui_broker.ps1
new file mode 100644
index 00000000000..9f0be9f5134
--- /dev/null
+++ b/deployment/windows/test_setup_ui_broker.ps1
@@ -0,0 +1,121 @@
+$ErrorActionPreference='Stop'
+$ProgressPreference='SilentlyContinue'
+$root=Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'
+$prefix='Swan Explicit UI '
+if(Test-Path -LiteralPath $root){throw 'This broker test requires an empty disposable Windows runner; preserve existing company storage.'}
+if(@(Get-ScheduledTask|Where-Object {$_.TaskName.StartsWith($prefix,[StringComparison]::Ordinal)}).Count){throw 'Preserve existing setup UI tasks.'}
+$id=[guid]::NewGuid().ToString('N');$madeRoot=$false;$ownedNames=@();$source=$null
+$scratch=Join-Path ([IO.Path]::GetTempPath()) ('swan-ui-broker-'+$id)
+$broker=Join-Path $PSScriptRoot 'Run-SetupUiTask.ps1'
+function Require([bool]$Condition,[string]$Message){if(-not $Condition){throw $Message}}
+function Rejected([scriptblock]$Action){$rejected=$false;try{& $Action}catch{$rejected=$true};Require $rejected 'Unsafe broker request was accepted.'}
+try {
+    & (Join-Path $PSScriptRoot 'Prepare-CustomerDirectory.ps1') -Directory $root -Existing reject
+    $madeRoot=$true
+    [IO.File]::WriteAllText((Join-Path $root 'broker-test.guard'),$id)
+    New-Item -ItemType Directory -Path $scratch|Out-Null
+    $stage=Join-Path $root ('setup-ui\'+$id)
+    New-Item -ItemType Directory -Path $stage|Out-Null
+    $source=Join-Path $scratch 'BrokerFixture.cs';$exe=Join-Path $stage 'swan-agent.exe'
+    # This inert fixture proves Task Scheduler boundaries and SYSTEM execution,
+    # not signing, actual UI recovery, or a successful product installation.
+    [IO.File]::WriteAllText($source,@'
+using System;
+using System.IO;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Security.Principal;
+using System.Threading;
+class BrokerFixture {
+ static string Hash(string path){using(var h=SHA256.Create())return BitConverter.ToString(h.ComputeHash(File.ReadAllBytes(path))).Replace("-","").ToLowerInvariant();}
+ static int Main(string[] args){
+  if(!WindowsIdentity.GetCurrent().IsSystem || args.Length!=4 || args[0]!="setup-ui")return 91;
+  string stage=Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);
+  string counter=Path.Combine(stage,"starts.txt");
+  File.WriteAllText(counter,(File.Exists(counter)?int.Parse(File.ReadAllText(counter))+1:1).ToString());
+  string mode=File.ReadAllText(Path.Combine(stage,"mode.txt"));
+  if(mode=="slow")Thread.Sleep(10000);
+  if(mode=="fail")return 7;
+  if(mode=="missing")return 0;
+  string id=mode=="wrong"?new string('0',32):args[3];
+  string json="{\"schema\":1,\"operation_id\":\""+id+"\",\"operation\":\""+args[1]+"\",\"marker_sha256\":\""+Hash(Path.Combine(args[2],"pending-install.json"))+"\",\"agent_sha256\":\""+Hash(Assembly.GetExecutingAssembly().Location)+"\",\"system_context\":true}";
+  File.WriteAllText(Path.Combine(stage,args[1]+"-result.json"),json);
+  return 0;
+ }
+}
+'@)
+    $csc=Join-Path $env:SystemRoot 'Microsoft.NET/Framework64/v4.0.30319/csc.exe'
+    & $csc /nologo /target:exe (('/out:')+$exe) $source
+    if($LASTEXITCODE -ne 0){throw 'SYSTEM fixture compilation failed.'}
+    [IO.File]::WriteAllText((Join-Path $root 'pending-install.json'),'isolated broker marker fixture; no device or company')
+    $agentHash=(Get-FileHash $exe).Hash.ToLowerInvariant()
+    $markerHash=(Get-FileHash (Join-Path $root 'pending-install.json')).Hash.ToLowerInvariant()
+    $mode=Join-Path $stage 'mode.txt';$counter=Join-Path $stage 'starts.txt';$receipt=Join-Path $stage 'prepare-result.json'
+    [IO.File]::WriteAllText($mode,'normal')
+    $name=$prefix+'prepare '+$id;$ownedNames+=$name
+    function Run-Broker([int]$Seconds=20){& $broker -Directory $root -Operation prepare -OperationId $id -AgentSha256 $agentHash -MarkerSha256 $markerHash -WaitSeconds $Seconds}
+    Rejected {& $broker -Directory $root -Operation prepare -OperationId $id -AgentSha256 ('0'*64) -MarkerSha256 $markerHash}
+    Rejected {& $broker -Directory $root -Operation prepare -OperationId $id -AgentSha256 $agentHash -MarkerSha256 ('0'*64)}
+    Require (-not (Test-Path $counter) -and -not (Get-ScheduledTask $name -ErrorAction SilentlyContinue)) 'Rejected hashes started a SYSTEM job.'
+    $foreign=New-ScheduledTaskAction -Execute (Join-Path $env:SystemRoot 'System32/notepad.exe')
+    $principal=New-ScheduledTaskPrincipal -UserId 'S-1-5-18' -LogonType ServiceAccount -RunLevel Highest
+    Register-ScheduledTask $name -Action $foreign -Principal $principal|Out-Null
+    Rejected {Run-Broker}
+    Require ((Get-ScheduledTask $name).Actions[0].Execute -ceq $foreign.Execute -and -not (Test-Path $counter)) 'Foreign action was changed or started.'
+    Unregister-ScheduledTask $name -Confirm:$false
+    $expectedAction=New-ScheduledTaskAction -Execute $exe -Argument ('setup-ui prepare "'+$root+'" '+$id) -WorkingDirectory $stage
+    Register-ScheduledTask $name -Action $expectedAction -Principal $principal|Out-Null
+    $scheduler=New-Object -ComObject Schedule.Service;$scheduler.Connect()
+    ($scheduler.GetFolder('\').GetTask($name)).SetSecurityDescriptor('O:BAG:BAD:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FRFX;;;BU)',0x10)
+    Rejected {Run-Broker}
+    Require (-not (Test-Path $counter)) 'A task with untrusted account access was started.'
+    Unregister-ScheduledTask $name -Confirm:$false
+    Run-Broker
+    Require ((Get-Content $counter) -eq '1' -and -not (Get-ScheduledTask $name -ErrorAction SilentlyContinue)) 'Positive SYSTEM task did not execute once and clean up.'
+    $completion=Get-Content $receipt -Raw|ConvertFrom-Json
+    Require $completion.system_context 'Fixture did not run as SYSTEM.'
+    Run-Broker
+    Require ((Get-Content $counter) -eq '2') 'Retry reused a stale success receipt.'
+    [IO.File]::WriteAllText($mode,'fail');Rejected {Run-Broker}
+    Require ((Get-ScheduledTaskInfo $name).LastTaskResult -eq 7 -and (Get-Content $counter) -eq '3' -and -not (Test-Path $receipt)) 'Nonzero result or old receipt was accepted.'
+    [IO.File]::WriteAllText($mode,'missing');Rejected {Run-Broker}
+    Require ((Get-ScheduledTaskInfo $name).LastTaskResult -eq 0 -and (Get-Content $counter) -eq '4' -and -not (Test-Path $receipt)) 'Exit0 without a completion receipt was accepted.'
+    [IO.File]::WriteAllText($mode,'wrong');Rejected {Run-Broker}
+    Require ((Get-ScheduledTask $name).State -notin @('Running','Queued') -and (Get-Content $counter) -eq '5' -and (Get-Content $receipt -Raw|ConvertFrom-Json).operation_id -ceq ('0'*32)) 'Wrong-receipt fixture did not actually execute.'
+    [IO.File]::WriteAllText($mode,'slow');Rejected {Run-Broker 1}
+    Require ((Get-ScheduledTask $name).State -in @('Running','Queued') -and (Test-Path (Join-Path $root 'pending-install.json'))) 'Timeout destroyed the live attempt or recovery marker.'
+    $startsBefore=[int](Get-Content $counter)
+    Run-Broker 25
+    Require ([int](Get-Content $counter) -eq $startsBefore) 'Continuing a live attempt started a duplicate SYSTEM job.'
+    [IO.File]::WriteAllText($mode,'fail');Rejected {Run-Broker}
+    $foreignName=$prefix+'invalid '+$id;$ownedNames+=$foreignName
+    Register-ScheduledTask $foreignName -Action $foreign -Principal $principal|Out-Null
+    [IO.File]::WriteAllText((Join-Path $root 'pending-uninstall'),'')
+    Rejected {& $broker -Directory $root -Operation cleanup}
+    Require ([bool](Get-ScheduledTask $name -ErrorAction SilentlyContinue) -and [bool](Get-ScheduledTask $foreignName -ErrorAction SilentlyContinue)) 'Cleanup partly deleted tasks before rejecting a foreign entry.'
+    Unregister-ScheduledTask $foreignName -Confirm:$false
+    & $broker -Directory $root -Operation cleanup
+    Require (-not (Get-ScheduledTask $name -ErrorAction SilentlyContinue)) 'Uninstall cleanup left an owned broker task.'
+    $result=@{actual_system_execution=$true;wrong_hash_and_marker_rejected=$true;foreign_action_preserved=$true;untrusted_task_acl_rejected=$true;nonzero_and_missing_or_wrong_receipt_rejected=$true;new_attempt_does_not_reuse_stale_receipt=$true;timeout_preserved_live_task_and_marker=$true;continuation_did_not_duplicate_task=$true;foreign_cleanup_rejected_before_deletion=$true;owned_uninstall_task_cleanup=$true;signed_agent_or_actual_installer_qualified=$false}
+} finally {
+    if($madeRoot){
+        foreach($taskName in $ownedNames){
+            $task=Get-ScheduledTask $taskName -ErrorAction SilentlyContinue
+            if($task){
+                if($task.State -in @('Running','Queued')){
+                    $task|Stop-ScheduledTask;$deadline=[DateTime]::UtcNow.AddSeconds(10)
+                    while((Get-ScheduledTask $taskName).State -in @('Running','Queued')){if([DateTime]::UtcNow -ge $deadline){throw 'Preserve the fixture while its SYSTEM job is still live.'};Start-Sleep -Milliseconds 100}
+                }
+                Unregister-ScheduledTask $taskName -Confirm:$false
+            }
+        }
+        $expected=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'))
+        $rootItem=Get-Item -LiteralPath $root
+        if($rootItem.FullName -ine $expected -or ($rootItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -or [IO.File]::ReadAllText((Join-Path $root 'broker-test.guard')) -cne $id){throw 'Refusing cleanup of an unverified fixture path.'}
+        if(@(Get-ChildItem -LiteralPath $root -Force -Recurse|Where-Object {$_.Attributes -band [IO.FileAttributes]::ReparsePoint}).Count){throw 'Refusing fixture cleanup through a reparse point.'}
+        Remove-Item -LiteralPath $root -Recurse
+    }
+    if($source -and (Test-Path -LiteralPath $source)){Remove-Item -LiteralPath $source}
+    if(Test-Path -LiteralPath $scratch){Remove-Item -LiteralPath $scratch}
+}
+$result|ConvertTo-Json -Compress
diff --git a/deployment/windows/test_technician_launcher.ps1 b/deployment/windows/test_technician_launcher.ps1
new file mode 100644
index 00000000000..93502665ae0
--- /dev/null
+++ b/deployment/windows/test_technician_launcher.ps1
@@ -0,0 +1,66 @@
+$ErrorActionPreference='Stop'
+$root=Join-Path ([IO.Path]::GetTempPath()) ('swan-launcher-test-'+[guid]::NewGuid().ToString('N'))
+$installation=Join-Path $root 'SwanRemoteSupport-Technician'
+New-Item -ItemType Directory -Path $installation|Out-Null
+$oldLocal=$env:LOCALAPPDATA;$oldState=$env:SWAN_STATE_DIR
+$oldTrace=$env:SWAN_TEST_TRACE;$oldDeny=$env:SWAN_TEST_DENY
+$oldChild=$env:SWAN_TEST_CHILD
+try {
+    $code=@'
+using System;
+using System.IO;
+public class LauncherFixture {
+ public static int Main(string[] args) {
+  var mode=args.Length==0?"application":args[0];
+  File.AppendAllText(Environment.GetEnvironmentVariable("SWAN_TEST_TRACE"),mode+"\n");
+  if(mode=="child") {
+   Console.Out.Write(new string('o',131072));
+   Console.Error.Write(new string('e',131072));
+   System.Threading.Thread.Sleep(200);
+   File.AppendAllText(Environment.GetEnvironmentVariable("SWAN_TEST_TRACE"),"child-completed\n");
+   return 0;
+  }
+  if(mode=="sync") { Console.Error.WriteLine("fixture network unavailable"); return 7; }
+  if(mode=="verify-installed" && Environment.GetEnvironmentVariable("SWAN_TEST_DENY")=="1") { return 9; }
+  if(mode=="application" && Environment.GetEnvironmentVariable("SWAN_TEST_CHILD")=="1") {
+   System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo {
+    FileName=System.Reflection.Assembly.GetExecutingAssembly().Location,
+    Arguments="child",UseShellExecute=false
+   }).Dispose();
+  }
+  return 0;
+ }
+}
+'@
+    $agent=Join-Path $installation 'swan-agent.exe'
+    Add-Type -TypeDefinition $code -OutputAssembly $agent -OutputType ConsoleApplication
+    Copy-Item -LiteralPath $agent -Destination (Join-Path $installation 'SwanRemoteSupport-Technician.exe')
+    $env:LOCALAPPDATA=$root
+    $env:SWAN_TEST_TRACE=Join-Path $root 'trace.txt'
+    # This isolated fixture tests launcher control flow, not Authenticode trust.
+    function Get-AuthenticodeSignature { param([string]$LiteralPath) [pscustomobject]@{Status='Valid'} }
+    $launcher=Join-Path $PSScriptRoot 'Open-Technician.ps1'
+    $env:SWAN_TEST_DENY='0'
+    $env:SWAN_TEST_CHILD='0'
+    & $launcher
+    if((Get-Content $env:SWAN_TEST_TRACE -Raw) -cne "sync`nverify-installed`napplication`n"){throw 'Offline launcher did not verify before starting application'}
+    [IO.File]::WriteAllText($env:SWAN_TEST_TRACE,'')
+    $env:SWAN_TEST_DENY='1'
+    $rejected=$false
+    try { & $launcher } catch { if($_.Exception.Message -cne 'Technician installed identity or pinned publisher verification failed.'){throw};$rejected=$true }
+    if(-not $rejected -or (Get-Content $env:SWAN_TEST_TRACE -Raw) -cne "sync`nverify-installed`n"){throw 'Invalid installed package was launched'}
+    [IO.File]::WriteAllText($env:SWAN_TEST_TRACE,'')
+    $env:SWAN_TEST_DENY='0';$env:SWAN_TEST_CHILD='1'
+    & $launcher
+    if((Get-Content $env:SWAN_TEST_TRACE -Raw) -cne "sync`nverify-installed`napplication`nchild`nchild-completed`n"){throw 'Portable child did not finish with live drained output handles'}
+    Write-Output 'Offline launch, installed-verification rejection and child output lifetime passed (fixture scope).'
+} finally {
+    Remove-Item Function:\Get-AuthenticodeSignature -ErrorAction SilentlyContinue
+    $env:LOCALAPPDATA=$oldLocal;$env:SWAN_STATE_DIR=$oldState
+    $env:SWAN_TEST_TRACE=$oldTrace;$env:SWAN_TEST_DENY=$oldDeny
+    $env:SWAN_TEST_CHILD=$oldChild
+    # Delete only the unique fixture directory after checking its absolute parent.
+    $resolved=[IO.Path]::GetFullPath($root)
+    if([IO.Path]::GetDirectoryName($resolved) -ine [IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\') -or [IO.Path]::GetFileName($resolved) -notmatch '^swan-launcher-test-[a-f0-9]{32}$'){throw 'Fixture cleanup path changed'}
+    Remove-Item -LiteralPath $resolved -Recurse -Force
+}
diff --git a/deployment/windows/test_technician_msi_lifecycle.ps1 b/deployment/windows/test_technician_msi_lifecycle.ps1
new file mode 100644
index 00000000000..7a24988f001
--- /dev/null
+++ b/deployment/windows/test_technician_msi_lifecycle.ps1
@@ -0,0 +1,54 @@
+[CmdletBinding()]
+param([Parameter(Mandatory)][string]$Package,[Parameter(Mandatory)][string]$TechnicianExecutable,[Parameter(Mandatory)][string]$AgentExecutable)
+$ErrorActionPreference='Stop'
+if($env:GITHUB_ACTIONS -ne 'true' -or $env:RUNNER_OS -ne 'Windows' -or -not $env:RUNNER_TEMP){throw 'This destructive repair fixture is restricted to disposable Windows CI runners.'}
+$packagePath=(Resolve-Path -LiteralPath $Package).Path
+if($packagePath -notmatch '-unsigned\.msi$'){throw 'Select an explicitly unsigned test MSI.'}
+$packageHash=(Get-FileHash -LiteralPath $packagePath -Algorithm SHA256).Hash.ToLowerInvariant()
+$expected=@{
+ 'SwanRemoteSupport-Technician.exe'=(Get-FileHash -LiteralPath $TechnicianExecutable -Algorithm SHA256).Hash
+ 'swan-agent.exe'=(Get-FileHash -LiteralPath $AgentExecutable -Algorithm SHA256).Hash
+}
+$registry='HKCU:\Software\SwanRemoteSupport\Technician'
+if(Test-Path -LiteralPath $registry){throw 'Existing technician registration must be preserved.'}
+$root=Join-Path ([IO.Path]::GetFullPath($env:RUNNER_TEMP)) ('swan-msi-lifecycle-'+[guid]::NewGuid().ToString('N'))
+$installation=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'SwanRemoteSupport-Technician'
+if(Test-Path -LiteralPath $installation){throw 'Existing technician installation must be preserved.'}
+New-Item -ItemType Directory -Path $root | Out-Null
+function Invoke-Msi([string[]]$Arguments,[string]$LogName){
+ if($Arguments.Count -ne 2 -or $Arguments[0] -notin @('/i','/fa','/x') -or $Arguments[1] -cne $packagePath -or $LogName -notmatch '^(install|repair|uninstall)\.log$'){throw 'Invalid MSI lifecycle command binding.'}
+ if((Get-FileHash -LiteralPath $packagePath -Algorithm SHA256).Hash.ToLowerInvariant() -cne $packageHash){throw 'MSI changed between lifecycle operations.'}
+ $log=Join-Path $root $LogName
+ $all=@($Arguments)+@('/qn','/norestart','/l*v',$log)
+ if(@($all|Where-Object {$_ -match '["\r\n]'}).Count){throw 'Unsupported MSI argument'}
+ $start=[Diagnostics.ProcessStartInfo]::new()
+ $start.FileName=Join-Path $env:SystemRoot 'System32\msiexec.exe'
+ $start.UseShellExecute=$false
+ $start.Arguments=($all|ForEach-Object {if($_.StartsWith('/')){$_}else{'"'+$_+'"'}}) -join ' '
+ [ordered]@{executable=$start.FileName;arguments=$start.Arguments;package_sha256=$packageHash;fixture_revision=$env:GITHUB_SHA;installer_service=(Get-Service msiserver).Status.ToString();started_utc=[DateTime]::UtcNow.ToString('o')}|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $root ($LogName+'.invocation.json'))
+ $process=[Diagnostics.Process]::Start($start)
+ try{
+  if(-not $process.WaitForExit(120000)){throw 'MSI still running; inspect its process and retained log before retrying.'}
+  if($process.ExitCode -ne 0){throw ('MSI failed with '+$process.ExitCode+'; retained log '+$log)}
+  if((Get-FileHash -LiteralPath $packagePath -Algorithm SHA256).Hash.ToLowerInvariant() -cne $packageHash){throw 'MSI changed during a lifecycle operation.'}
+ }finally{$process.Dispose()}
+}
+function Verify-Payload {
+ foreach($name in $expected.Keys){
+  if((Get-FileHash -LiteralPath (Join-Path $installation $name) -Algorithm SHA256).Hash -ne $expected[$name]){throw 'Installed MSI payload hash mismatch.'}
+ }
+ if(-not(Test-Path -LiteralPath $registry)){throw 'Technician MSI registration missing.'}
+}
+Invoke-Msi -Arguments @('/i',$packagePath) -LogName 'install.log'
+Verify-Payload
+$repairTarget=[IO.Path]::GetFullPath((Join-Path $installation 'SwanRemoteSupport-Technician.exe'))
+if(-not $repairTarget.StartsWith([IO.Path]::GetFullPath($installation)+'\',[StringComparison]::OrdinalIgnoreCase)){throw 'Repair target escaped owned installation.'}
+Remove-Item -LiteralPath $repairTarget
+Invoke-Msi -Arguments @('/fa',$packagePath) -LogName 'repair.log'
+Verify-Payload
+Invoke-Msi -Arguments @('/x',$packagePath) -LogName 'uninstall.log'
+foreach($name in $expected.Keys){if(Test-Path -LiteralPath (Join-Path $installation $name)){throw 'MSI payload remains after uninstall.'}}
+if(Test-Path -LiteralPath $registry){throw 'MSI registration remains after uninstall.'}
+$version=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
+[ordered]@{passed=$true;windows=$version.ProductName;build=$version.CurrentBuildNumber;installation_type=$version.InstallationType;fixture_revision=$env:GITHUB_SHA;package_sha256=$packageHash;payload_sha256=$expected;unsigned_test=$true;install=$true;repair=$true;uninstall=$true;scope='MSI payload lifecycle under the CI account; no enrollment, standard-user GUI, signature acceptance or remote session'}|ConvertTo-Json|Set-Content -LiteralPath (Join-Path $root 'result.json')
+Write-Output ('Technician MSI lifecycle passed; evidence: '+$root)
diff --git a/deployment/windows/test_uninstall_commit.ps1 b/deployment/windows/test_uninstall_commit.ps1
new file mode 100644
index 00000000000..69cdbe1cbdc
--- /dev/null
+++ b/deployment/windows/test_uninstall_commit.ps1
@@ -0,0 +1,50 @@
+$ErrorActionPreference='Stop'
+$script=Join-Path $PSScriptRoot 'Commit-Uninstall.ps1'
+$tokens=$null;$errors=$null
+$ast=[System.Management.Automation.Language.Parser]::ParseFile($script,[ref]$tokens,[ref]$errors)
+if ($errors.Count) { throw 'Uninstall commit script failed parsing.' }
+$function=$ast.Find({param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Complete-Uninstall'},$true)
+if ($null -eq $function) { throw 'Commit cleanup function missing.' }
+. ([ScriptBlock]::Create($function.Extent.Text))
+$root=Join-Path ([IO.Path]::GetTempPath()) ('swan-uninstall-commit-'+[Guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $root|Out-Null
+$marker=Join-Path $root 'pending-uninstall';$cancellation=Join-Path $root 'uninstall-cancellation-rollback.json'
+$task=Join-Path $root 'configuration-task-rollback.json';$state=Join-Path $root 'managed-state.json';$agent=Join-Path $root 'swan-agent.exe'
+try {
+    [IO.File]::WriteAllText($state,'identity and consent fixture: preserve exactly')
+    & (Join-Path $PSScriptRoot 'Update-UninstallCancellation.ps1') -Directory $root -Operation cancel
+    $rejected=$false
+    try { & (Join-Path $PSScriptRoot 'Update-UninstallCancellation.ps1') -Directory $root -Operation cancel } catch { $rejected=$true }
+    if (-not $rejected) { throw 'Active cancellation rollback was overwritten.' }
+    [IO.File]::WriteAllText($task,'{"enabled":true,"running":false}')
+    [IO.File]::WriteAllText($agent,'inert installed agent fixture')
+    $rejected=$false
+    try { Complete-Uninstall -Directory $root } catch { $rejected=$true }
+    if (-not $rejected -or -not (Test-Path $cancellation)) { throw 'Commit ran before agent removal.' }
+    Remove-Item -LiteralPath $agent
+    # The real entrypoint must reject arbitrary directories even though the
+    # pure cleanup function is exercised here against private temporary files.
+    foreach($edition in @('customer','technician')) {
+        $rejected=$false
+        try { & $script -Directory $root -Edition $edition } catch { $rejected=$true }
+        if (-not $rejected -or -not (Test-Path $cancellation)) { throw 'Canonical edition state-directory guard failed.' }
+    }
+    [IO.File]::WriteAllText($task,'{"enabled":"invalid","running":false}')
+    $rejected=$false
+    try { Complete-Uninstall -Directory $root } catch { $rejected=$true }
+    if (-not $rejected -or -not (Test-Path $cancellation) -or -not (Test-Path $marker)) { throw 'Invalid task record partially cleared cancellation.' }
+    [IO.File]::WriteAllText($task,'{"enabled":true,"running":false}')
+    Complete-Uninstall -Directory $root
+    Complete-Uninstall -Directory $root
+    if ((Test-Path $cancellation) -or (Test-Path $task) -or -not (Test-Path $marker)) { throw 'Commit did not preserve cancellation while clearing rollback records.' }
+    # A later removal can now create its own rollback; rollback must retain
+    # the earlier completed uninstall's cancellation rather than enabling support.
+    & (Join-Path $PSScriptRoot 'Update-UninstallCancellation.ps1') -Directory $root -Operation cancel
+    & (Join-Path $PSScriptRoot 'Update-UninstallCancellation.ps1') -Directory $root -Operation restore
+    if (-not (Test-Path $marker)) { throw 'Later uninstall rollback lost earlier cancellation.' }
+    if ([IO.File]::ReadAllText($state) -cne 'identity and consent fixture: preserve exactly') { throw 'Commit changed identity/consent state.' }
+} finally {
+    foreach ($path in @($agent,$marker,$cancellation,$task,$state)) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path } }
+    Remove-Item -LiteralPath $root
+}
+Write-Output 'Uninstall commit regression checks passed for both editions; no installed application or task changed.'
diff --git a/deployment/windows/test_update_download.ps1 b/deployment/windows/test_update_download.ps1
new file mode 100644
index 00000000000..cbe28bdb400
--- /dev/null
+++ b/deployment/windows/test_update_download.ps1
@@ -0,0 +1,30 @@
+param([Parameter(Mandatory=$true)][string]$OutputDirectory)
+$ErrorActionPreference='Stop'
+$directory=[IO.Path]::GetFullPath($OutputDirectory)
+if(Test-Path -LiteralPath $directory){throw 'Use a new private HTTPS test directory.'}
+New-Item -ItemType Directory -Path $directory | Out-Null
+$certificate=$null;$authority=$null
+try {
+    # Disposable CI identity only. Never add it to a trusted root store.
+    $authority=New-SelfSignedCertificate -Type Custom -Subject 'CN=Swan disposable download test CA' -CertStoreLocation Cert:\CurrentUser\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -NotAfter (Get-Date).AddDays(2) -KeyUsage CertSign,CRLSign,DigitalSignature -TextExtension @('2.5.29.19={critical}{text}ca=1')
+    $certificate=New-SelfSignedCertificate -Type Custom -Subject 'CN=localhost' -DnsName localhost -Signer $authority -CertStoreLocation Cert:\CurrentUser\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -NotAfter (Get-Date).AddDays(1) -KeyUsage DigitalSignature,KeyEncipherment -TextExtension @('2.5.29.19={critical}{text}ca=0','2.5.29.37={text}1.3.6.1.5.5.7.3.1')
+    $password=[Guid]::NewGuid().ToString('N')
+    $pfx=Join-Path $directory 'localhost.pfx';$ca=Join-Path $directory 'localhost.cer'
+    Export-PfxCertificate -Cert $certificate -FilePath $pfx -Password (ConvertTo-SecureString $password -AsPlainText -Force) | Out-Null
+    Export-Certificate -Cert $authority -FilePath $ca | Out-Null
+    $environment=Join-Path $directory 'test.private.env'
+    [IO.File]::WriteAllText($environment,"SWAN_TEST_TLS_PFX=$pfx`nSWAN_TEST_TLS_PASSWORD=$password`nSWAN_TEST_CA_FILE=$ca`n")
+    $lines=& cargo +1.90.0 test --manifest-path product/Cargo.toml --locked -p swan-agent --lib --no-run --message-format=json
+    if($LASTEXITCODE -ne 0){throw 'Agent test compilation failed.'}
+    $executables=@($lines | ForEach-Object { $item=$_ | ConvertFrom-Json; if($item.reason -eq 'compiler-artifact' -and $item.target.name -eq 'swan_agent' -and $item.profile.test -and $item.executable){$item.executable} })
+    if($executables.Count -ne 1){throw 'Expected exactly one compiled agent library test executable.'}
+    & node (Join-Path $PSScriptRoot 'test-update-download.js') $environment $executables[0] (Join-Path $directory 'verified.json')
+    if($LASTEXITCODE -ne 0){throw 'Real HTTPS download verification failed.'}
+} finally {
+    if($certificate){Remove-Item -LiteralPath ('Cert:\CurrentUser\My\'+$certificate.Thumbprint)}
+    if($authority){Remove-Item -LiteralPath ('Cert:\CurrentUser\My\'+$authority.Thumbprint)}
+    foreach($name in @('localhost.pfx','test.private.env')){
+        $file=Join-Path $directory $name
+        if(Test-Path -LiteralPath $file){Remove-Item -LiteralPath $file}
+    }
+}
diff --git a/deployment/windows/test_update_recovery_task.ps1 b/deployment/windows/test_update_recovery_task.ps1
new file mode 100644
index 00000000000..6338bcb9bd8
--- /dev/null
+++ b/deployment/windows/test_update_recovery_task.ps1
@@ -0,0 +1,86 @@
+$ErrorActionPreference='Stop'
+# Validate ownership first, then exercise one isolated real task lifecycle.
+$tokens=$null; $errors=$null
+$ast=[System.Management.Automation.Language.Parser]::ParseFile((Join-Path $PSScriptRoot 'Update-RecoveryTask.ps1'),[ref]$tokens,[ref]$errors)
+if ($errors.Count) { throw 'Recovery task script failed parsing.' }
+$guard=$ast.Find({param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq 'Assert-RecoveryTask'},$true)
+if ($null -eq $guard) { throw 'Recovery task ownership guard missing.' }
+. ([ScriptBlock]::Create($guard.Extent.Text))
+$helper='C:\IsolatedFixture\updates\2\swan-agent.exe'
+$action=@{Execute=$helper;Arguments='recover-update-task'}
+$valid=@{TaskPath='\';Actions=@($action);Principal=@{UserId='S-1-5-18'}}
+Assert-RecoveryTask $valid $helper 'S-1-5-18'
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+foreach ($account in @($identity.User.Value,$identity.Name,($identity.Name -split '\\')[-1])) {
+    $ownTask=$valid.Clone();$ownTask.Principal=@{UserId=$account}
+    Assert-RecoveryTask $ownTask $helper $identity.User.Value
+}
+foreach ($account in @('SYSTEM','NT AUTHORITY\SYSTEM')) {
+    $systemTask=$valid.Clone();$systemTask.Principal=@{UserId=$account}
+    Assert-RecoveryTask $systemTask $helper 'S-1-5-18'
+}
+foreach ($change in @(
+    @{TaskPath='\OtherProduct\'},
+    @{Actions=@(@{Execute='C:\OtherInstallation\swan-agent.exe';Arguments='recover-update-task'})},
+    @{Actions=@(@{Execute=$helper;Arguments='watch'})},
+    @{Actions=@($action,$action)},
+    @{Principal=@{UserId='OtherAccount'}},
+    @{Principal=@{UserId='S-1-5-19'}},
+    @{Principal=@{UserId=$identity.Name}}
+)) {
+    $record=$valid.Clone()
+    foreach ($key in $change.Keys) { $record[$key]=$change[$key] }
+    $rejected=$false
+    try { Assert-RecoveryTask $record $helper 'S-1-5-18' } catch { $rejected=$true }
+    if (-not $rejected) { throw 'Recovery task ownership mismatch was accepted.' }
+}
+Write-Output 'Recovery task account aliases resolve to the exact SID; foreign identities and actions rejected.'
+$taskFixture=Join-Path ([IO.Path]::GetTempPath()) ('swan-recovery-principal-'+[Guid]::NewGuid().ToString('N'))
+$updates=Join-Path $taskFixture 'updates';$staged=Join-Path $updates '42';$stagedHelper=Join-Path $staged 'swan-agent.exe'
+$taskName=$null
+try {
+    $null=New-Item -ItemType Directory -Path $staged
+    # A signed OS binary is only a registration fixture; never start this task.
+    Copy-Item -LiteralPath (Join-Path $env:SystemRoot 'System32\whoami.exe') -Destination $stagedHelper
+    $script=Join-Path $PSScriptRoot 'Update-RecoveryTask.ps1'
+    $inspection=& $script -Operation register -Directory $taskFixture -Edition technician -Sequence 42 -InspectOnly | ConvertFrom-Json
+    $taskName=$inspection.task_name
+    & $script -Operation register -Directory $taskFixture -Edition technician -Sequence 42
+    $registered=Get-ScheduledTask -TaskName $taskName
+    Assert-RecoveryTask $registered $stagedHelper $identity.User.Value
+    $inspection=& $script -Operation remove -Directory $taskFixture -Edition technician -Sequence 42 -InspectOnly | ConvertFrom-Json
+    if ($inspection.task_mutated -or -not (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue)) { throw 'Read-only inspection changed the task.' }
+    & $script -Operation remove -Directory $taskFixture -Edition technician -Sequence 42
+    if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) { throw 'Owned task was not removed after principal normalization.' }
+} finally {
+    if ($taskName) {
+        $remaining=Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
+        if ($remaining) { Assert-RecoveryTask $remaining $stagedHelper $identity.User.Value; $remaining | Unregister-ScheduledTask -Confirm:$false }
+    }
+    if (Test-Path -LiteralPath $stagedHelper) { Remove-Item -LiteralPath $stagedHelper }
+    foreach ($directory in @($staged,$updates,$taskFixture)) { if (Test-Path -LiteralPath $directory) { Remove-Item -LiteralPath $directory } }
+}
+Write-Output 'Real technician recovery task registration, read-only inspection and removal passed; helper never executed.'
+$fixture=Join-Path ([IO.Path]::GetTempPath()) ('swan-uninstall-cancellation-'+[Guid]::NewGuid().ToString('N'))
+$null=New-Item -ItemType Directory -Path $fixture
+$marker=Join-Path $fixture 'pending-uninstall'
+$rollback=Join-Path $fixture 'uninstall-cancellation-rollback.json'
+try {
+    $script=Join-Path $PSScriptRoot 'Update-UninstallCancellation.ps1'
+    & $script -Directory $fixture -Operation cancel
+    if (-not (Test-Path -LiteralPath $marker)) { throw 'Uninstall did not cancel recovery.' }
+    & $script -Directory $fixture -Operation restore
+    if (Test-Path -LiteralPath $marker) { throw 'Uninstall rollback did not restore recovery eligibility.' }
+    [IO.File]::WriteAllText($marker,'earlier explicit cancellation')
+    & $script -Directory $fixture -Operation cancel
+    & $script -Directory $fixture -Operation restore
+    if ([IO.File]::ReadAllText($marker) -cne 'earlier explicit cancellation') { throw 'Uninstall rollback lost earlier cancellation.' }
+    [IO.File]::WriteAllText($rollback,'{"marker_existed":"invalid"}')
+    $rejected=$false
+    try { & $script -Directory $fixture -Operation restore } catch { $rejected=$true }
+    if (-not $rejected -or -not (Test-Path -LiteralPath $marker)) { throw 'Invalid rollback state cleared cancellation.' }
+} finally {
+    foreach ($file in @($marker,$rollback)) { if (Test-Path -LiteralPath $file) { Remove-Item -LiteralPath $file } }
+    Remove-Item -LiteralPath $fixture
+}
+Write-Output 'Uninstall cancellation file checks passed in an isolated temporary directory.'
diff --git a/deployment/windows/test_worker_configuration.ps1 b/deployment/windows/test_worker_configuration.ps1
new file mode 100644
index 00000000000..8fbac8f414a
--- /dev/null
+++ b/deployment/windows/test_worker_configuration.ps1
@@ -0,0 +1,74 @@
+param([Parameter(Mandatory=$true)][string]$WorkerExecutable,[Parameter(Mandatory=$true)][string]$ResultPath)
+$ErrorActionPreference='Stop'
+$worker=(Resolve-Path -LiteralPath $WorkerExecutable).Path
+$root=[IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanInstallerWorker'))
+if((Test-Path -LiteralPath $root) -or (Get-Service SwanInstallerWorker -ErrorAction SilentlyContinue)){throw 'Only a fresh isolated worker fixture is allowed.'}
+if(Test-Path -LiteralPath $ResultPath){throw 'Preserve prior test evidence.'}
+$fixtureToken='fixture-worker-credential-not-a-real-company-secret-000000'
+$key='11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo='
+$nonce=[Guid]::NewGuid().ToString('N');$created=$false;$checks=[Collections.Generic.List[string]]::new()
+function Invoke-Fixture([string]$Mode,[string]$Argument,[bool]$Configured,[bool]$Success) {
+ $start=[Diagnostics.ProcessStartInfo]::new();$start.FileName=$worker;$start.Arguments=$Mode
+ if($Argument){$start.Arguments+=' "'+$Argument+'"'}
+ $start.UseShellExecute=$false;$start.CreateNoWindow=$true;$start.RedirectStandardOutput=$true;$start.RedirectStandardError=$true
+ foreach($name in @('SWAN_WORKER_CONFIG','SWAN_WORKER_TOKEN','SWAN_MANAGEMENT_URL','SWAN_RELEASE_PUBLIC_KEY','SWAN_PROFILE_PUBLIC_KEY','SWAN_ARTIFACT_DIR')){[void]$start.EnvironmentVariables.Remove($name)}
+ if($Configured){$start.EnvironmentVariables['SWAN_WORKER_CONFIG']=(Join-Path $root 'worker.json')}else{
+  $start.EnvironmentVariables['SWAN_WORKER_TOKEN']=$fixtureToken;$start.EnvironmentVariables['SWAN_MANAGEMENT_URL']='https://example.invalid'
+  $start.EnvironmentVariables['SWAN_RELEASE_PUBLIC_KEY']=$key;$start.EnvironmentVariables['SWAN_PROFILE_PUBLIC_KEY']=$key;$start.EnvironmentVariables['SWAN_ARTIFACT_DIR']=$root
+ }
+ $process=[Diagnostics.Process]::Start($start)
+ try {
+  $stdout=$process.StandardOutput.ReadToEndAsync();$stderr=$process.StandardError.ReadToEndAsync()
+  if(!$process.WaitForExit(300000)){$process.Kill();$process.WaitForExit();throw 'Owned configuration verifier exceeded its deadline.'}
+  $text=$stdout.GetAwaiter().GetResult()+$stderr.GetAwaiter().GetResult()
+  if($text.Contains($fixtureToken)){throw 'Worker fixture credential was reflected into diagnostics.'}
+  if(($process.ExitCode -eq 0) -ne $Success){throw 'Compiled worker configuration result differs from the expected access policy.'}
+  return $text
+ }finally{$process.Dispose()}
+}
+function Set-PrivateFileAcl([string]$Path) {
+ $acl=[Security.AccessControl.FileSecurity]::new();$acl.SetOwner([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'));$acl.SetAccessRuleProtection($true,$false)
+ foreach($sid in @('S-1-5-18','S-1-5-32-544')){$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),'FullControl','Allow'))}
+ Set-Acl -LiteralPath $Path -AclObject $acl
+}
+try {
+ Invoke-Fixture 'prepare-worker-directory' $root $false $true|Out-Null;$created=$true
+ [IO.File]::WriteAllText((Join-Path $root 'test-owner-marker'),$nonce)
+ $configuration=Join-Path $root 'worker.json'
+ $json=@{management_url='https://example.invalid';worker_token=$fixtureToken;release_public_key=$key;profile_public_key=$key}|ConvertTo-Json -Compress
+ [IO.File]::WriteAllText($configuration,($json+(' '*8192)),[Text.UTF8Encoding]::new($false));Set-PrivateFileAcl $configuration
+ # The migration reads old and new input files in one Windows PowerShell 5
+ # process. Reusing the reader must not fail on its embedded helper type.
+ foreach($attempt in 1..2){
+  $privateRead=& (Join-Path $PSScriptRoot 'Read-WorkerConfiguration.ps1') -Path $configuration -Scope input -Output pipeline
+  if($privateRead -cne ($json+(' '*8192))){throw 'Private input reader changed fixture bytes.'}
+ }
+ $privateRead=$null;$checks.Add('private input reader can validate both migration inputs in one PowerShell process')
+ Invoke-Fixture 'check-configuration' '' $true $true|Out-Null;$checks.Add('compiled worker accepts protected configuration larger than the Windows pipe buffer without revealing credentials')
+ $acl=Get-Acl -LiteralPath $configuration
+ $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new('S-1-15-2-1'),'Read','Allow'))
+ Set-Acl -LiteralPath $configuration -AclObject $acl
+ Invoke-Fixture 'check-configuration' '' $true $false|Out-Null;$checks.Add('app-container read permission rejects configuration before any job is claimed')
+ Set-PrivateFileAcl $configuration
+ $owner=[Security.Principal.WindowsIdentity]::GetCurrent().User
+ if($owner.Value -notin @('S-1-5-18','S-1-5-32-544')){
+  $acl=Get-Acl -LiteralPath $configuration;$acl.SetOwner($owner);Set-Acl -LiteralPath $configuration -AclObject $acl
+  Invoke-Fixture 'check-configuration' '' $true $false|Out-Null;$checks.Add('unexpected file owner rejected');Set-PrivateFileAcl $configuration
+ }
+ [IO.File]::WriteAllText($configuration,('x'*16385))
+ Invoke-Fixture 'check-configuration' '' $true $false|Out-Null;$checks.Add('oversized configuration rejected')
+ [IO.File]::WriteAllText($configuration,('{"worker_token":"'+$fixtureToken+'"'))
+ Invoke-Fixture 'check-configuration' '' $true $false|Out-Null;$checks.Add('malformed private JSON rejected without echoing credentials')
+ $text=Invoke-Fixture 'check-configuration' '' $false $false
+ if($text -notmatch 'require protected file configuration'){throw 'Legacy environment was not explicitly refused.'}
+ $checks.Add('complete legacy environment cannot substitute for the service private file')
+ @{passed=$true;utc=[DateTime]::UtcNow.ToString('o');worker_sha256=(Get-FileHash $worker).Hash.ToLowerInvariant();checks=@($checks);only_fixture_credentials=$true;service_installed=$false;company_request_or_build_claimed=$false}|ConvertTo-Json -Depth 4|Set-Content -LiteralPath $ResultPath
+}finally{
+ # This explicitly named canonical root was absent before this test and contains
+ # only our marker and fake settings. Never clean an installed worker's state.
+ if($created -and [IO.Path]::GetFullPath($root) -ceq [IO.Path]::GetFullPath((Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanInstallerWorker')) -and !(Get-Service SwanInstallerWorker -ErrorAction SilentlyContinue)){
+  if([IO.File]::ReadAllText((Join-Path $root 'test-owner-marker')) -cne $nonce){throw 'Fixture ownership changed; preserve all files.'}
+  Remove-Item -LiteralPath $root -Recurse -Force
+ }
+}
+Write-Host 'Compiled private worker configuration checks passed; no worker service or job was started.'
diff --git a/deployment/windows/verify-portable-payload.py b/deployment/windows/verify-portable-payload.py
new file mode 100644
index 00000000000..59778dbc8db
--- /dev/null
+++ b/deployment/windows/verify-portable-payload.py
@@ -0,0 +1,106 @@
+"""Verify the bytes embedded in a portable EXE against its signed-inner manifest.
+
+This reads the package; it never runs or extracts its executable payload.
+"""
+import argparse
+import hashlib
+import json
+from pathlib import Path, PurePosixPath
+import re
+import struct
+
+import brotli
+
+
+def read_payload(raw, start):
+    position = start + 8
+    files = {}
+    folded = set()
+    total = 0
+    while raw[position:position + 8] != b"rustdesk":
+        length = struct.unpack_from(">I", raw, position)[0]
+        position += 4
+        if not 0 < length <= 240:
+            raise ValueError("Invalid portable path length")
+        name = raw[position:position + length].decode("utf-8").replace("\\", "/")
+        position += length
+        if name.startswith("./"):
+            name = name[2:]
+        path = PurePosixPath(name)
+        if (not name or name != path.as_posix() or path.is_absolute() or ":" in name or name.casefold() in folded
+                or any(part in (".", "..") or part.endswith((" ", "."))
+                       or not re.fullmatch(r"[A-Za-z0-9 _\-.@+]+", part) for part in path.parts)):
+            raise ValueError("Unsafe or duplicate portable payload path")
+        folded.add(name.casefold())
+        size = struct.unpack_from(">I", raw, position)[0]
+        position += 4
+        if not 0 < size <= 512 * 1024**2 or position + size + 32 > len(raw):
+            raise ValueError("Invalid portable compressed size")
+        decoder = brotli.Decompressor()
+        digest = hashlib.sha256()
+        checksum = hashlib.md5()
+        count = 0
+        for offset in range(0, size, 64):
+            part = decoder.process(raw[position + offset:position + min(size, offset + 64)])
+            count += len(part)
+            total += len(part)
+            if count > 128 * 1024**2 or total > 512 * 1024**2:
+                raise ValueError("Portable payload exceeds limits")
+            digest.update(part)
+            checksum.update(part)
+        position += size
+        if not decoder.is_finished() or checksum.hexdigest().encode() != raw[position:position + 32]:
+            raise ValueError("Portable payload checksum differs")
+        position += 32
+        files[name] = digest.hexdigest()
+        if len(files) > 4096:
+            raise ValueError("Too many portable files")
+    entrypoint = raw[position + 8:]
+    # The linked PE contains data after the embedded container.
+    names = (b"Swan Remote Support.exe", b".\\Swan Remote Support.exe",
+             b"./Swan Remote Support.exe")
+    if not entrypoint.startswith(names):
+        raise ValueError("Unexpected portable entry point")
+    return files
+
+
+def verify(package, manifest):
+    if package.stat().st_size > 512 * 1024**2:
+        raise ValueError("Portable installer exceeds limit")
+    expected = {item["path"]: item["sha256"] for item in manifest}
+    if len(expected) != len(manifest) or not {
+            "Swan Remote Support.exe", "librustdesk.dll", "flutter_windows.dll"} <= set(expected):
+        raise ValueError("Incomplete installed manifest")
+    raw = package.read_bytes()
+    position = 0
+    while True:
+        position = raw.find(b"rustdesk", position)
+        if position < 0:
+            raise ValueError("No embedded payload matches the signed-inner manifest")
+        try:
+            actual = read_payload(raw, position)
+        except (ValueError, UnicodeDecodeError, struct.error, brotli.error):
+            position += 8
+            continue
+        if actual == expected:
+            return {"package_sha256": hashlib.sha256(raw).hexdigest(),
+                    "embedded_files": len(actual), "embedded_payload_matches_manifest": True,
+                    "payload_executed": False}
+        position += 8
+
+
+def main():
+    p = argparse.ArgumentParser(description=__doc__)
+    p.add_argument("--package", type=Path, required=True)
+    p.add_argument("--manifest", type=Path, required=True)
+    p.add_argument("--output", type=Path, required=True)
+    a = p.parse_args()
+    record = verify(a.package, json.loads(a.manifest.read_text(encoding="utf-8-sig")))
+    with a.output.open("x", encoding="utf-8") as stream:
+        json.dump(record, stream, indent=2)
+        stream.write("\n")
+    print(json.dumps(record))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/deployment/windows/verify-reproducible-pe.py b/deployment/windows/verify-reproducible-pe.py
new file mode 100644
index 00000000000..ba80e5bfcfa
--- /dev/null
+++ b/deployment/windows/verify-reproducible-pe.py
@@ -0,0 +1,75 @@
+"""Check Windows x64 build metadata; a REPRO marker alone is not a rebuild comparison."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import struct
+
+
+def verify(path, require_dll=False):
+    if not 0 < path.stat().st_size < 512 * 1024 * 1024:
+        raise ValueError("Unexpected Windows binary size")
+    data = path.read_bytes()
+
+    def unpack(fmt, offset):
+        if offset < 0 or offset + struct.calcsize(fmt) > len(data):
+            raise ValueError("Truncated Windows binary metadata")
+        return struct.unpack_from(fmt, data, offset)
+
+    if data[:2] != b"MZ":
+        raise ValueError("Expected a Windows PE binary")
+    pe, = unpack("<I", 60)
+    if data[pe:pe + 4] != b"PE\0\0":
+        raise ValueError("Missing PE signature")
+    machine, sections = unpack("<HH", pe + 4)
+    optional_size, characteristics = unpack("<HH", pe + 20)
+    optional = pe + 24
+    magic, = unpack("<H", optional)
+    if machine != 0x8664 or magic != 0x20b or optional_size < 168 or not 0 < sections <= 96:
+        raise ValueError("Expected Windows x64 metadata")
+    if require_dll and not characteristics & 0x2000:
+        raise ValueError("Expected a DLL")
+    directories, = unpack("<I", optional + 108)
+    if directories < 7:
+        raise ValueError("Missing PE debug directory")
+    rva, size = unpack("<II", optional + 112 + 6 * 8)
+    if not rva or not size or size % 28 or size > 28 * 128:
+        raise ValueError("Invalid PE debug directory")
+    debug = None
+    for index in range(sections):
+        section = optional + optional_size + index * 40
+        virtual_size, virtual_address, raw_size, raw_pointer = unpack("<IIII", section + 8)
+        if virtual_address <= rva and rva + size <= virtual_address + max(virtual_size, raw_size):
+            delta = rva - virtual_address
+            if delta + size > raw_size:
+                raise ValueError("Debug directory exceeds file-backed section")
+            debug = raw_pointer + delta
+            break
+    if debug is None or debug + size > len(data):
+        raise ValueError("PE debug directory is outside the binary")
+    types, pdb_names = [], []
+    for index in range(size // 28):
+        kind, length, _, pointer = unpack("<IIII", debug + index * 28 + 12)
+        types.append(kind)
+        if length and (pointer + length > len(data) or pointer < 0):
+            raise ValueError("Debug payload is outside the binary")
+        if kind == 2:
+            if length < 25 or data[pointer:pointer + 4] != b"RSDS":
+                raise ValueError("Expected CodeView debug information")
+            name = data[pointer + 24:pointer + length].rstrip(b"\0").decode("utf-8")
+            if not name.lower().endswith(".pdb") or any(character in name for character in ("/", "\\", ":", "\0")):
+                raise ValueError("Debug information embeds a build-machine PDB path")
+            pdb_names.append(name)
+    if 16 not in types:
+        raise ValueError("Missing IMAGE_DEBUG_TYPE_REPRO build marker")
+    return {"sha256": hashlib.sha256(data).hexdigest(), "machine": "x64",
+            "is_dll": bool(characteristics & 0x2000), "repro_marker": True,
+            "pdb_names": pdb_names, "independent_rebuild_verified": False}
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("path", type=Path)
+    parser.add_argument("--dll", action="store_true")
+    arguments = parser.parse_args()
+    print(json.dumps(verify(arguments.path, arguments.dll)))
diff --git a/deployment/windows/verify-service-imports.py b/deployment/windows/verify-service-imports.py
new file mode 100644
index 00000000000..5d0a624155b
--- /dev/null
+++ b/deployment/windows/verify-service-imports.py
@@ -0,0 +1,88 @@
+"""Reject desktop DLLs eagerly loaded by the Windows service launcher."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import re
+import struct
+
+
+def verify(path, bundle):
+    if not 0 < path.stat().st_size < 512 * 1024 ** 2:
+        raise ValueError("Unexpected launcher size")
+    data = path.read_bytes()
+
+    def unpack(fmt, at):
+        if at < 0 or at + struct.calcsize(fmt) > len(data):
+            raise ValueError("Truncated PE imports")
+        return struct.unpack_from(fmt, data, at)
+
+    if data[:2] != b"MZ":
+        raise ValueError("Expected PE launcher")
+    pe, = unpack("<I", 60)
+    if data[pe:pe + 4] != b"PE\0\0":
+        raise ValueError("Missing PE signature")
+    machine, sections = unpack("<HH", pe + 4)
+    size, = unpack("<H", pe + 20)
+    optional = pe + 24
+    magic, = unpack("<H", optional)
+    directories, = unpack("<I", optional + 108)
+    if machine != 0x8664 or magic != 0x20b or size < 224 or directories < 14 or not 0 < sections <= 96:
+        raise ValueError("Expected x64 import directories")
+
+    def raw(rva, length):
+        for index in range(sections):
+            section = optional + size + index * 40
+            virtual_size, address, raw_size, pointer = unpack("<IIII", section + 8)
+            if address <= rva and rva + length <= address + max(virtual_size, raw_size):
+                delta = rva - address
+                if delta + length <= raw_size and pointer + delta + length <= len(data):
+                    return pointer + delta
+        raise ValueError("Import points outside file-backed sections")
+
+    def name(rva):
+        at = raw(rva, 1)
+        end = data.find(b"\0", at, min(at + 257, len(data)))
+        if end < 0:
+            raise ValueError("Unterminated import name")
+        raw(rva, end - at + 1)
+        value = data[at:end].decode("ascii")
+        if not re.fullmatch(r"[A-Za-z0-9_.-]+", value):
+            raise ValueError("Invalid import name")
+        return value.lower()
+
+    def imports(directory, width, delayed=False):
+        rva, length = unpack("<II", optional + 112 + directory * 8)
+        if not rva and not length:
+            return set()
+        if not rva or length < width or length > 1024 * 1024:
+            raise ValueError("Invalid import directory")
+        result = set()
+        for index in range(min(length // width, 512)):
+            row = unpack("<" + "I" * (width // 4), raw(rva + index * width, width))
+            if not any(row):
+                return result
+            if delayed and row[0] != 1:
+                raise ValueError("Expected RVA-based delay imports")
+            result.add(name(row[1] if delayed else row[3]))
+        raise ValueError("Unterminated import descriptors")
+
+    eager = imports(1, 20)
+    delayed = imports(13, 32, True)
+    packaged = {p.name.lower() for p in bundle.glob("*.dll") if p.is_file()}
+    if "flutter_windows.dll" not in packaged or "flutter_windows.dll" not in delayed:
+        raise ValueError("Flutter engine must be packaged and delay loaded")
+    if eager & packaged:
+        raise ValueError("Service launcher eagerly loads bundled desktop DLLs: " + ", ".join(sorted(eager & packaged)))
+    return {"sha256": hashlib.sha256(data).hexdigest(),
+            "normal_imports": sorted(eager), "delay_imports": sorted(delayed),
+            "no_eager_bundled_desktop_dlls": True,
+            "cold_boot_runtime_verified": False}
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("path", type=Path)
+    parser.add_argument("--bundle", type=Path, required=True)
+    args = parser.parse_args()
+    print(json.dumps(verify(args.path, args.bundle)))
diff --git a/deployment/windows/win10-lab-account-repair-evidence.json b/deployment/windows/win10-lab-account-repair-evidence.json
new file mode 100644
index 00000000000..6b89b0f7aa7
--- /dev/null
+++ b/deployment/windows/win10-lab-account-repair-evidence.json
@@ -0,0 +1,24 @@
+{
+  "date": "2026-10-26",
+  "scope": "Repair of one disposable Windows10 standard-user lab credential; no application binary or company deployment changed.",
+  "administrator_reset_completed": true,
+  "new_credential_accepted": true,
+  "recorded_old_credential_rejected": true,
+  "recorded_old_credential_already_rejected_before_reset": true,
+  "account_identity_preserved": true,
+  "administrator_membership_not_added": true,
+  "host_and_guest_credential_records_updated": true,
+  "host_credential_record_protected": true,
+  "guest_credential_record_protected": true,
+  "guest_one_time_inputs_removed": true,
+  "host_one_time_inputs_removed": true,
+  "permanent_execution_policies_unchanged": true,
+  "execution_note": "Owned repair script ran with process-only execution policy; permanent policy settings retained.",
+  "credential_values_or_hashes_published": false,
+  "private_original_record_sha256": "1c8bb786f8ec11ebee681db1dda2e3100a089bf493707805610fbfd26acf9e0e",
+  "limitations": [
+    "Does not establish the cause or recovery of the earlier Windows10 guest hang.",
+    "Does not qualify standard-user installation, native sessions or automatic updates."
+  ],
+  "full_product_acceptance": false
+}
diff --git a/deployment/windows/win10-standard-desktop-bounded-failure.json b/deployment/windows/win10-standard-desktop-bounded-failure.json
new file mode 100644
index 00000000000..df94cbb44d9
--- /dev/null
+++ b/deployment/windows/win10-standard-desktop-bounded-failure.json
@@ -0,0 +1,18 @@
+{
+  "date": "2026-10-26",
+  "application_source": "da0c621845057bed321a98a1886ef15891e431a9",
+  "edition": "technician",
+  "os": "Windows 10 Pro x64 build 19045.3803",
+  "lab_signed_msi_sha256": "9e339a4140c204846c7b51c33068da9502593fcdd79e6351691426d7fe1319e3",
+  "actual_standard_user_console_login_verified": true,
+  "task_logon_type": "InteractiveToken",
+  "task_run_level": "LeastPrivilege",
+  "task_execution_limit_minutes": 10,
+  "task_terminal_result": 267014,
+  "first_driver_observation_created": false,
+  "msi_execution_started": false,
+  "test_task_disabled": true,
+  "passed": false,
+  "scope": "The original task reached its execution limit before creating its first driver observation. This is a failed lab execution attempt, not evidence of installer success or an established installer defect. Its startup stall requires investigation.",
+  "full_windows_qualification": false
+}
diff --git a/docs/ACCEPTANCE.md b/docs/ACCEPTANCE.md
new file mode 100644
index 00000000000..b8491850fa4
--- /dev/null
+++ b/docs/ACCEPTANCE.md
@@ -0,0 +1,8487 @@
+# Configurable product acceptance report
+
+Evidence through 6 November 2026. **The product is not complete or approved for
+production publication.** A passing component test is not evidence of a working
+native support session or a clean-machine installation.
+
+For the current candidate and remaining release gates, start with the compact
+[release-readiness index](RELEASE-READINESS.md). The older checkpoints below
+remain source-specific historical evidence.
+
+The first published endpoint release now targets **Windows 11 x64 only**.
+Windows 10 and Windows Server endpoint releases are deferred. This changes the
+first-release OS matrix, not the consent, authorization, update, recovery or
+signing requirements. Existing results on other systems remain scoped historical
+evidence and do not qualify Windows 11. Company-hosted infrastructure remains
+required; there is no project-operated service.
+
+## Current direct TCP authorization denial, 5 November
+
+The installed **1.5.21+89** customer rejected a real direct TCP/protobuf login
+with `Company session authorization denied`. The test temporarily enabled the
+owned lab receiver's direct listener, verified its native executable owner,
+and received a fresh native password salt/challenge through a loopback forward.
+It sent a legacy-style password response using that challenge, with no company
+credential or signed session grant. The response was the explicit company
+authorization error, not a connection timeout or a blocked network route.
+
+No company grant or enrolled control device was created. Customer and technician
+identity, device credentials, trust, consent and exact native binaries were
+preserved. The timed rollback restored the exact original direct option and
+removed its task; the listener and owned forwarding rule are absent afterward.
+The separate publisher-signed stock client's window stayed black, so its
+graphical result is **inconclusive**, not a denial pass. Its owned processes
+were stopped. The earlier genuine stock ID-connection denial remains linked,
+with six complete receiving/authorization source files verified unchanged
+between that test's source and the current runtime source. See the
+[direct-wire and preservation receipt](evidence/1521-native-direct-ip-denial-and-preservation-20261105.json).
+This does not qualify external public connectivity or the Windows release matrix.
+
+## Current standard-user session and interrupted transfer, 5 November
+
+Native **1.5.21+89**, source `bd331ca`, passed attended desktop access on the
+existing Windows10 customer / Server2022 technician pair using standard accounts.
+The technician completed genuine MFA; the customer received the named approval
+request and accepted it before the remote desktop was observed. File transfer
+required its own customer approval.
+
+During a real256MiB transfer, only the customer's virtual network was disconnected
+for45 seconds. The original transfer showed41% and automatically entered fresh
+authorization. After reconnection both approval requests arrived. Accepting the
+desktop first left the approval window visible beyond seven seconds, and the
+pending file request remained accessible through its existing tab. No taskbar
+restoration was needed. Accepting file access completed the original transfer
+without another Send action, an application/service restart or a VM restart.
+The received268435456 bytes matched the independently retained source hash;
+transfer sidecars were absent. This verifies the previously failing consent
+visibility fix on the current native build; it does not measure exact resumed
+offsets or the precise send-timeout deadline.
+
+The customer's Stop control then ended both live sessions. The same two server
+records closed, the technician lost desktop/file access, and native technician
+history displayed those records as Closed. Unattended consent remained off.
+See the [scoped receipt](evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json).
+No new VM or build was created. Other desktop features, automatic updates,
+external connectivity and the final advertised-Windows matrix retain their
+separate acceptance gates.
+
+## Customer EXE packaging and setup wait, 4 November
+
+The corrected customer EXE was compiled and lab-signed on Windows 10 using
+runtime source `a3fedd9` and producer source `dbab5fb`. Ten packaging tests,
+six compiled packer tests, exact verification of all 95 embedded filenames and
+hashes, and corresponding-source checks passed. A real clean Windows 10 install
+then copied the stable executable name correctly and started the service, but
+setup stalled because PowerShell's process-tree wait included the persistent
+tray. Stopping only that verified tray allowed enrollment and release recording
+to finish; this assisted result **does not pass clean installation acceptance**.
+Setup now waits for the launched process handle, preserving its exit code.
+A real Windows regression returns installer failure7 while its tray-like child
+remains alive; setup-entry trust/elevation tests pass. A newly generated bundle
+and another unassisted clean installation are still required. See the
+[scoped receipt](evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json).
+
+After that assistance, the real standard-user customer GUI displayed company
+branding and working Stop/Resume controls. The pending device was hidden from
+technicians and a valid-proof grant request returned403. Only this lab device
+was then approved: explicit GUI opt-in synchronized unattended consent to the
+server, and GUI revocation closed the unused unattended grant and rejected a
+new request. A normal reboot preserved identity, trust and revoked consent,
+started the service/watcher, and passed shipping verification. Post-reboot GUI
+login remains unqualified because console input rejected a credential that
+Windows' own credential check accepted. These are scoped lifecycle results,
+not a successful unassisted install or native support session. See the
+[standard-user receipt](evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json).
+
+## Candidate 1.5.19 independent native reproduction, 4 November
+
+Runs41628177194 and41744919308 independently built public source `a3fedd9`.
+The original downloaded archives passed digest/source checks, and all eight
+unsigned shipping files were byte-identical with matching recorded MSVC
+inputs. No shipping binary was normalized or executed by comparison. This
+includes the original customer EXE; the separately corrected signed-inner EXE
+producer and fresh installation still have their own open gates. See the
+[comparison receipt](evidence/1519-independent-native-reproduction-20261104.json).
+
+## Coordinated setup-recipe deployment and recovery, 4 November
+
+The process-wait fix is embedded in both management and worker bundle recipes.
+Windows/Linux component CI passed at source `332af85`; the actual Windows CI
+merge has an identical public tree, and all 256 packaged source files were
+verified. Its canonical Linux image passed fresh-company setup, MFA replay,
+enrollment policy, persistence and backup/restore tests.
+
+A fresh 1,478,222,994-byte encrypted company backup authenticated and restored
+offline. The wrong passphrase created no restore destination; company/transport
+keys, settings, all 48 generated installer files and six TLS identity files
+matched. Updating the existing management image preserved profile44, accounts,
+permissions, device consent, releases/jobs/history and HTTPS/transport container
+identities. The lab-signed Windows worker then updated with its private credential,
+configuration, registry and ACLs preserved. Original binaries and recovery copies
+remain available. The updated pair generated both editions as EXE and MSI; all
+four bundles passed signature, hash, public-bootstrap and exact-recipe checks.
+Customer downloads returned200 and anonymous technician downloads returned401.
+An unassisted clean EXE installation and canonical source332 independent
+reproduction remain separate gates.
+See the [deployment receipt](evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json).
+
+## Windows10 customer real interrupted update recovery, 31 October
+
+The [source-scoped1.5.12 receipt](evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json) records complete local native archive/source verification, both real company-generated lab-signed bundles, a genuine standard-user attended session against the canonical Linux company, and update deferral while that session held the actual Windows activity lock. Customer Stop closed the session and revoked technician access. A subsequent real MSI installation was interrupted by power loss in a disposable disk overlay. Normal boot recovered automatically to1.5.12 and passed shipping installed-file, publisher and MSI-registration checks while preserving identity, trust, branding and disabled unattended consent. Its recovery task removed itself; paused rollout policy32 synchronized. No manual installer, recovery or service-start command repaired the result. This proves interruption after actual MSI client startup and a durable installing receipt, without claiming interruption during a particular file copy. The technician endpoint remained1.5.11; its console account was the built-in Administrator, so this is standard-user customer evidence only. Other OS/edition, external-connectivity and production-signing gates remain open.
+
+## Linux live recovery and current-data migration, 30 October
+
+The encrypted restore subsequently served the company over its existing HTTPS
+identity and migrated its management database from schema2 to schema3. Fresh
+administrator and technician MFA, device/group permissions, consent, profile
+trust, revoked/current worker credentials and customer/technician download
+hashes passed against the restored data and after actual rollback. The automatic
+encrypted pre-migration backup also authenticated and restored to schema2.
+
+The final upgrade used the latest original data, preserving audit events created
+since the earlier backup. A fresh quiesced schema2 checkpoint was retained;
+source361 upgraded the current data in place. The old binary then ran against
+that checkpoint for an actual rollback test, followed by successful rollforward
+to the current schema3 data. Fresh authentication, permissions, downloads and
+20 recent pre-upgrade audit events passed in all three phases. Transport and
+HTTPS container identities/volumes were preserved. The final deployment recipe
+matches the local recipe and no longer passes the one-time migration password
+to the container. All recovery copies remain private and retained, with only
+one company copy running at a time.
+
+The initial live test had a harness error: installation reporting is paginated,
+not a bare list. Its guarded rollback completed; the corrected test resumed the
+retained restored containers and passed. These results cover same-host recovery,
+not different-host disaster recovery or a native desktop session against the
+upgraded Linux company. See the
+[live migration receipt](evidence/361d7c3-linux-live-migration-recovery-20261030.json).
+
+## Linux pre-upgrade encrypted recovery, 30 October
+
+The source361 management CLI was built offline with the existing pinned lab
+Rust1.90 toolchain image and the pinned canonical Debian runtime. This cached
+builder recipe is recorded separately from canonical production Docker-image
+reproduction. The original source67/schema2 Linux company was stopped for a
+consistent encrypted full snapshot, then the same four containers and images
+were restarted. HTTPS trust, signed profile14 and paused update policy matched.
+
+The661,268,962-byte SWANBK2 archive restored offline into a new private volume.
+The wrong passphrase failed before its destination was created. The profile and
+transport key files, setup token, actual proxy recipe, deployment settings, all21
+generated installer files and six TLS key/certificate files matched. Both restored
+SQLite headers were valid. No restored server was started or exposed, and no
+plaintext private key was exported to the host. At this offline checkpoint,
+live service and migration were pending (the subsequent results are above);
+external release-mirror files in
+the existing lab bind mount are outside this archive. See the
+[offline recovery receipt](evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json).
+
+## Candidate 1.5.10 independent Windows reproduction, 30 October
+
+Native runs40988690083 and40997460699 both succeeded at public source `b1fbe1e`
+with the same pinned engine. Comparison run41005323442 verified the original
+archives and corresponding source, then compared eight unsigned shipping files:
+both MSIs, customer and technician EXEs, server setup, agent, management service
+and worker. All eight were byte-identical, and recorded MSVC inputs matched.
+No shipping files were normalized or rebuilt for comparison, and no executable
+was run by it. The downloaded comparison report matched its artifact digest and
+its first archive/output hashes matched the independently verified local original.
+Runtime, signing, complete OS qualification and canonical Linux Docker image
+reproduction have separate gates. See the
+[reproduction receipt](evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json).
+
+## Candidate 1.5.10 company bundles, enrolled upgrade and three reboots, 30 October
+
+Both lab-signed MSI packages, agent and native executables passed fresh publisher
+checks with the existing non-exportable Windows10 lab key. The original final
+verification stalled; its tasks and logs remain retained and are not reported
+successful. Already committed outputs were not rebuilt or re-signed. The final
+read-only checks passed with normal task priority and pinned Windows built-in
+modules, including verification that all original inputs remained unchanged.
+
+The source361 Linux company rejected invalid release signatures, request-supplied
+trust overrides and builds of unapproved releases. Its unchanged source1c43
+private Windows worker generated both approved sequence13 test bundles. The
+customer bundle downloaded anonymously; technician download required login.
+Both bundles' installer/agent hashes, seven exact source texts, public-only
+bootstrap and signed profile/release verified. Company policy stayed paused.
+
+The enrolled Server2019 customer then upgraded explicitly from1.5.9 to1.5.10,
+preserving device identity, credential, bootstrap trust, consent and branding.
+Three subsequent normal guest reboots passed automatic SYSTEM-service startup,
+with no service timeout events or manual service starts. The real native core
+loaded without desktop engine/plugins; installed-file/publisher verification
+and the private worker's HTTPS authorization passed after each boot. An initial
+compound reboot observer exceeded its observation timeout; the VM was left
+untouched and its corrected read-only observer passed before the next reboot.
+
+This is one Server2019 VM, not physical cold-power-on or all-Windows reliability
+qualification. Current native GUI/session tests, technician runtime and automatic
+rollout remain open. Both native builds succeeded; exact byte comparison was
+subsequently verified in the separate receipt above. See the
+[scoped runtime receipt](evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json).
+
+## Candidate 1.5.10 complete native build and MSI lifecycle, 30 October
+
+Corrected run40988690083 succeeded at public source `b1fbe1e`. The downloaded
+256,197,933-byte archive matched GitHub's SHA256 digest. Its complete corresponding
+source, six generated bridge files, pinned SDK, independently reproduced engine
+identity, shipping hashes and required native regression conclusions verified.
+The separately retained CI lifecycle archive also matched its digest; both MSI
+receipt hashes match the actual downloaded packages. The unsigned customer MSI
+started its real native service automatically without desktop engine/plugins,
+then uninstalled. Technician installation, repair and uninstall passed on
+Server2022 CI. These are unenrolled administrative CI tests, with no cold reboot,
+signed installation or support session. Full native reproduction and installed
+lab qualification remain pending. See the
+[build and lifecycle receipt](evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json).
+
+## Candidate 1.5.10 service bootstrap, 30 October
+
+The managed Windows launcher now connects to SCM before loading its native core,
+reports bounded initialization checkpoints, and forwards normal status/control
+through the new Rust service entry point. Core DLL loading is restricted to the
+installed executable directory and System32 dependencies. Missing exports are
+rejected without a legacy-dispatcher fallback; stalled initialization terminates
+its own not-yet-running service process. Company defaults and the existing
+receiving-device authorization are retained. Global Windows service timeout and
+company startup policy are unchanged.
+
+Five actual SCM/loader cases passed on Windows Server2022 CI and the existing
+Server2019 VM: normal startup/control/stop, a35-second DLL load with advancing
+pending checkpoints, absent DLL, absent bootstrap export, and a bounded stalled
+loader. Exact argument checks also passed. All fixture services were removed;
+the Server2019 customer's identity, credential, trust, consent and sequence,
+and both original customer/worker process IDs remained unchanged. The fixture
+DLLs are simulated unsigned cores: these results do **not** establish native
+integration, signing, enrolled support or reliable cold boot. Full native build
+and installed-machine retests remain pending. See the
+[boundary receipt](evidence/1510-service-bootstrap-scm-boundary-20261030.json).
+
+The first full native run40984115696 reached branded-client compilation but
+failed with E0432 because the new Rust bridge referenced `winapi::um::winsvc`
+without enabling that dependency feature. The existing Windows dependency now
+explicitly enables `winsvc`. No installer was qualified by that failed run;
+the corrected native build and installed cold-boot tests remain required.
+
+## Server 2019 upgrade and unresolved automatic startup, 30 October
+
+The existing Linux-company Server 2019 customer upgraded explicitly from
+1.5.1+69/sequence1 to 1.5.9+77/sequence11. Its identity, device credential,
+bootstrap trust, consent and branding were preserved and the installed-file
+verifier passed. The original worker was separately migrated to a new private-file
+credential; both old registrations remain revoked. An actual standard-user token
+read a public control file but could not read the new credential file. Both queued
+customer and technician bundles completed and passed independent signature,
+source-text and payload-hash checks; anonymous customer access succeeded and
+anonymous technician access returned401.
+
+After one normal reboot, the worker started automatically but the customer did
+not: Windows recorded service events7000/7009 and a 30-second connection timeout.
+A single manual warm start succeeded in about6.11 seconds. The recovered process
+loaded neither the Flutter engine nor desktop plugin DLLs. The earlier delay-load
+fix is present, but reliable customer automatic boot remains a **failed acceptance
+gate**, with its cause unproven. This is not full Server 2019 qualification or an
+automatic-update rollout test. See the [scoped upgrade and failure receipt](evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json).
+
+A second normal reboot, with a bounded Microsoft WPR startup trace, started both
+services automatically. The original customer identity, credential, trust and
+consent still matched; the installed-file verifier passed. The private worker
+also completed a newly queued customer build after reboot, whose public bundle,
+signed profile/release and package hashes were checked independently. The trace
+saved privately and its automatic stop task disabled itself. It records about
+4.54 seconds between the customer executable and core DLL image loads on this
+successful boot. It does not explain the earlier failed boot or establish a fix;
+reliable automatic startup remains unqualified.
+
+## Native branding synchronization, 30 October
+
+Both installed 1.5.9 editions automatically accepted signed company profile
+revision 2 and displayed changed names, SVG logos, colors, contacts, consent text
+and shortcut labels. Restoring the original content created revision 3; both
+editions automatically accepted it and displayed the original branding again.
+Device identity, credential hash, bootstrap trust, consent, installation identity,
+release sequence and executable hashes matched the pre-test baseline throughout.
+No manual synchronization, reinstallation or enrollment was used for these changes.
+
+The initial offline display check came after automatic recovery and did not
+qualify offline behavior. A separate revision 3 repeat restarted both original
+shipping apps under narrowly scoped management blocks, observed their cached
+native branding, then verified both blocks remained enabled and HTTPS requests
+still failed. Both blocks were disabled afterward; signed cache, identity,
+consent and executable invariants passed again. The customer restart helper hit
+a stale process-path race after stopping Home; read-only inspection and a guarded
+launch of the same original limited task completed the fixture, without product
+changes. Software upgrades, key rotation and other Windows versions remain
+separate gates.
+See the [native branding receipt](evidence/159-windows-native-branding-sync-20261030.json).
+
+## Latest source checks, 28–29 October
+
+The Windows company lab now has a real native1.5.9 attended session through the
+maintained Windows relay. A standard-user technician completed MFA and saw only
+its approved customer; the customer accepted the authenticated technician name.
+Matching receiver/relay connection IDs, live video, remote pointer/keyboard input,
+lease renewal and customer disconnect were verified. The original disconnected
+grant rejected renewal with403. Customer MSI setup and standard-user technician
+EXE setup also passed; standard-user MSI remains blocked by OS policy1625. The
+maintained Windows company/worker stack passed a normal reboot, and the existing
+customer identity, approval, consent and installed bytes survived a separate lab
+runtime interruption. These are scoped lab results, not public connectivity or
+complete Windows feature qualification. See the
+[Windows company runtime receipt](evidence/159-windows-company-install-enrollment-20261029.json).
+
+A second native1.5.9 attended session tested management unreachability from the
+customer while leaving relay ports available. A narrow lab-only outbound rule
+had an automatic restore task registered first. The native receiver closed for
+unavailable authorization about seven seconds after the rule took effect; the
+technician showed only an authorization error and OK. Restoring verified HTTPS
+preserved the original device credential, policy and consent and did not revive
+the desktop. After the original lease actually expired, renewal returned403 and
+there was no replacement live lease. The history displayed Ended. During the
+outage, the server could not receive the close report, so its stored closed bit
+remained false until normal lease-based expiry; this test does not establish
+instant server-side close reporting during a network partition.
+
+The same native1.5.9 Windows lab then passed ASCII clipboard transfer in both
+directions and a 1,343,488-byte file roundtrip through the native file manager.
+Both host VNC clipboard directions were disabled on both viewers. The technician
+copied a known text fixture inside its standard-user desktop; the customer saved
+the received text, added a return marker, and copied it back. Independent saved
+file hashes matched both expected values. File transfer required its own customer
+approval, and the destination/returned file hashes matched the original fixture.
+Both sessions were closed afterward and no live authorization lease remained.
+The first pre-session clipboard paste was empty; source explicitly makes initial
+clipboard synchronization opt-in. Copy events during the active session passed.
+This does not qualify Unicode/image clipboard, large/interrupted transfers,
+denied file permissions, UAC, logon-screen access or multiple monitors. See the
+[native clipboard/transfer receipt](evidence/159-windows-native-clipboard-transfer-20261029.json).
+
+A receiving-side negative test then removed only the real lab group's file
+permission. A newly approved desktop still connected, with file access disabled
+on the receiving consent dialog. The technician's Transfer file action remained
+available and opened a separate connection, but the receiver rejected its signed
+grant with `Company grant denies file transfer`. The remote directory listing
+stayed empty; the denied connection was claimed and closed in server history,
+while the permitted desktop remained live. Both connections were closed and the
+exact original group policy restored. This is native protocol enforcement rather
+than a hidden button. It does not qualify every malicious packet/client variant.
+See the [receiving denial receipt](evidence/159-windows-receiving-file-permission-denial-20261029.json).
+
+Native1.5.9 also passed lock/unlock of the existing customer Administrator desktop
+through its original customer-approved session. The technician's Insert lock
+action reached the actual Windows lock screen, whose video remained visible.
+Swan's Insert Ctrl+Alt+Del action opened the Windows password field; masked input
+of the owned lab password restored the desktop. The same original attended grant
+remained live afterward, with no replacement grant or reconnect. Closing the test
+then closed that grant and left no live lease. This is attended lock/unlock, not
+unattended reboot-to-logon qualification. At that checkpoint, UAC was inspected:
+EnableLUA and secure-desktop prompting are enabled, while the built-in
+Administrator account has no configured token filtering. A standard-user desktop
+is required for the separate meaningful UAC test. See the
+[lock/unlock receipt](evidence/159-windows-attended-lock-unlock-20261029.json).
+
+The subsequent native1.5.9 UAC test passed on a newly created standard customer
+account, with the technician also running under its standard account. The
+customer approved the session on its current desktop after a normal user switch;
+the prior Administrator desktop remained available. A limited interactive probe
+verified that its actual customer token had no Administrators SID, then requested
+RunAs for Microsoft Notepad. The genuine credential UAC prompt was visible on the
+secure desktop through Swan. Masked input of the owned lab Administrator password
+and approval launched Notepad in the same customer session. Independent token
+queries verified elevation and high integrity (`S-1-16-12288`). Remote input into
+that elevated app produced a saved 33-byte marker with the expected hash. The
+original attended grant stayed live across elevation and input. The standard
+customer then disconnected successfully; the original grant closed, no live
+lease remained, and the elevated probe was closed. UAC settings, device
+credential/approval, release/profile revisions and consent were preserved.
+An initial test-helper token query used an oversized buffer and failed with
+Windows error24; the corrected four-byte query verified the existing process
+without repeating elevation. This qualifies this credential-prompt scenario on
+Server 2016, not all UAC scenarios or Windows versions. See the
+[standard-customer UAC receipt](evidence/159-windows-standard-customer-uac-20261029.json).
+
+Native1.5.9 unattended support then passed a planned Windows reboot and actual
+sign-in-screen connection. The standard customer explicitly enabled ongoing
+support in the company consent dialog; the existing signed company profile
+already allowed it, so no server policy change was needed. Before consent, an
+unattended request returned403. The automatic System service came back after a
+normal Windows reboot with user apps forcibly closed, preserving the original
+identity, credential, bootstrap, consent and binaries. Windows autologon and saved
+passwords were absent. After fresh native technician MFA, one new unattended
+grant reached the real Windows sign-in screen through the maintained Windows
+relay before any user desktop was logged on. Remote secure-attention and masked
+lab password input then logged on the standard customer through that session.
+The standard customer revoked ongoing support in its own app. The receiver
+closed about30seconds later and the technician showed an authorization error
+with only OK. The server closed the original grant and cleared its lease; renewal
+and a new unattended request returned403, while replaying consent revision1
+returned409. Consent revision2 persisted off, the service remained running, and
+identity, trust and binaries were preserved. This qualifies this Server2016 lab
+scenario, not every Windows version, public connectivity, power-loss recovery or
+multiple monitors. See the
+[unattended reboot/logon/revocation receipt](evidence/159-windows-unattended-reboot-logon-revocation-20261029.json).
+
+Native1.5.9 then passed two-monitor switching and remote mouse/keyboard input.
+The same installed Server2016 customer booted normally with two signed QXL
+adapters and two active 1024x768 displays; device identity, credential, trust,
+binaries and consent-off revision2 were independently preserved. After fresh
+technician MFA and explicit standard-customer approval, the native monitor
+selector showed distinct blue/green test windows on DISPLAY7 and DISPLAY5.
+Input through the technician app produced two 35-byte files whose independent
+hashes matched the exact expected markers. Returning to the first monitor showed
+its original saved marker, with no replacement grant. Closing the session closed
+its original authorization; renewal returned403 and no live authorization
+remained. The history retains its last lease timestamp on a closed row, so this
+is not a claim that close clears that stored timestamp. Only the owned test
+windows were stopped; support remained running and unattended consent stayed
+off. An initial unaccepted request was canceled while the customer display was
+asleep; waking the display restored its console, without bypassing consent.
+This qualifies two equal-resolution displays on this Server2016 lab, not mixed
+DPI, hot-plug, additional monitors, combined/individual-window modes, other
+Windows versions or public connectivity. See the
+[two-monitor native receipt](evidence/159-windows-native-two-monitor-20261029.json).
+
+A further Windows recovery check found that the maintained rendezvous build's
+Windows default stores its peer database in the RustDesk LocalService profile,
+outside company transport storage. The populated-database backup preflight
+stopped without producing an archive, and both company/worker services resumed.
+Earlier backup receipts correctly recorded the database as absent; they qualify
+key/configuration recovery, not recovery of the actual external peer records.
+The candidate launcher now supplies an explicit company `DB_URL`; startup and
+full transport export refuse an unmigrated legacy database. An explicit offline
+migration command preserves source files and keys, recovers committed WAL data
+in private staging, checks integrity and refuses an existing destination or
+running management process. Six Linux transport/storage regressions passed
+after a clean package rebuild; an earlier cached test run was not counted.
+The component workflow at `361d7c3` subsequently passed Windows/Linux checks,
+maintained transport and Linux deployment. Its Windows job explicitly passed the
+four named migration/storage regressions, including refusal of a source still
+open for writing; the downloaded archive verified all 242 public source files.
+The actual Server 2016 company then passed an encrypted backup and isolated
+restore of its populated legacy database/WAL. SQLite integrity, schema and every
+committed row matched, including the real peer record. Its lab-signed `361d7c3`
+manager subsequently migrated that database while the owned services were
+stopped, preserved the original files and trust keys, and restarted rendezvous
+with the canonical company database reported in its log. External HTTPS and
+administrator MFA, approved device, revoked unattended consent, signed profile,
+release approvals and worker identity remained valid. Corresponding source was
+retained with the installation. A second full encrypted backup from the canonical
+location then passed isolated restore and actual running-company data replacement.
+The restored server and subsequent rollback both passed HTTPS/MFA, unchanged
+profile/device/consent/release/worker checks, all five installer download hashes,
+a public customer download and rejection of an anonymous technician download.
+The peer database actually used by the restored running stack also passed
+integrity, schema and all-row comparison after it was stopped for rollback.
+The original company data is active again and the recovered copy is retained.
+A fresh native connection subsequently passed after rollback to the retained
+original company data: technician MFA matched the independent audit, the same
+enrolled standard customer explicitly accepted, video and remote mouse/keyboard
+worked, and a new 52-byte saved fixture matched its expected hash. One new
+claimed attended grant correlated with the receiving device and maintained
+Windows relay. Customer Disconnect closed that grant, original device-credential
+renewal returned403, and the shipping installed verifier still passed. No
+re-enrollment or unattended consent change was needed. This connection does not
+qualify a native session while the restored data copy is active. These checks
+use the same disposable company VM, not recovery onto a different host. See the
+[post-recovery native connection receipt](evidence/361d7c3-windows-native-after-populated-recovery-20261029.json).
+The restored populated copy was subsequently activated again for that missing
+native test. HTTPS/MFA, unchanged company state and all five download hashes
+passed again, with the newer original data retained. The native technician then
+showed an unresponsive window before fresh MFA could be completed. The lab also
+had substantial disk waits and intermittent SSH/HTTPS timeouts; these observations
+do not establish the hang's cause. The idle customer exited normally, verified
+HTTPS responded again, and only the owned limited technician launcher was
+restarted after checking its account SID. At the last check that launcher was
+running without a native GUI. No new support request was issued and this native
+retest has not passed. See the
+[incomplete restored-data retest](evidence/361d7c3-restored-data-native-retest-pending-20261030.json).
+A follow-up on 30 October completed that missing native session while the
+restored populated company data was active. A diagnostic copy of the installed
+launcher added only stage timestamps; original signature, sync and installed
+verification checks remained intact, and startup reached the portable GUI in
+about ten seconds. Fresh native technician MFA matched the restored database's
+audit. The same enrolled standard customer accepted the authenticated request;
+video, mouse/keyboard input and a distinct 52-byte saved fixture hash passed.
+One attended grant correlated with the receiver and maintained Windows relay.
+Customer Disconnect closed it, renewal with the original device credential
+returned403, and installed verification still passed. The newer original company
+data was then reinstated and HTTPS/MFA, company state and five download hashes
+rechecked. Both data copies and saved input proof were retained. The diagnostic
+launcher and owned input fixture were stopped, and the unchanged normal launcher
+returned to its empty sign-in screen. The earlier stall's cause remains
+unestablished; this successful retest does not retrospectively classify it as
+solely hardware-related. See the
+[active restored-data native receipt](evidence/361d7c3-windows-native-active-restored-data-20261030.json).
+The storage-fix components also passed a byte comparison using existing
+successful push run40930580611 and PR run40930590508; no extra build was
+dispatched. All three original Windows and all three original Linux binaries
+matched without normalization. Each archive's 242 preserved component source
+files matched `361d7c3`, with checkout text conversions verified against Git
+blobs. The PR's actual checkout was public merge `b13de18`, not the head itself;
+that identity and the matching component-source scope are recorded explicitly.
+This comparison does not qualify native Flutter/engine outputs or installation
+packages. See the
+[storage-fix component reproduction receipt](evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json).
+See the [populated running recovery receipt](evidence/361d7c3-windows-populated-running-recovery-20261029.json),
+[actual migration receipt](evidence/361d7c3-windows-populated-transport-migration-20261029.json),
+[component checks](evidence/361d7c3-windows-transport-storage-component-checks.json)
+and the
+[Windows transport storage finding](evidence/windows-transport-database-storage-finding-20261029.json).
+
+Independent builds 40865719332 and 40925349725 of source `9fa5e8a` also completed.
+All three original Windows and all three Linux component binaries matched
+byte-for-byte, with both source archives checked against the pinned public tree
+and matching Rust 1.90.0 compiler identities. No shipping bytes were normalized
+and no downloaded executable was run for the comparison. This qualifies that
+baseline build, not the later storage fix, native application matrix or production
+signing. See the [component reproduction receipt](evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json).
+
+Installation reporting is now being implemented after the completed recovery
+checkpoint. The new shared report contract, authenticated management endpoints,
+paginated status page and schema3 migration are source changes under verification;
+the running Linux lab remains on source67/schema2. Browser contract checks passed
+for escaping, progress, pagination and sign-out response isolation. The four named
+report/ownership/migration regressions passed on both Windows and Linux, and all
+six component/deployment jobs passed on push and PR at `a96cd4c`. See the
+[component receipt](evidence/a96cd4c-installation-reporting-component-checks.json).
+Customer/technician senders and updater phase hooks are now connected in the
+working source for native1.5.9. Their protected cache retains installation identity
+and report revision; signed installed metadata supplies the reported version.
+Best-effort reporting cannot change support permissions or updater verification.
+All32 Linux agent tests passed; after the nonblocking-cache refinement, the four
+reporter tests passed again, including eight concurrent reporters and a real
+loopback HTTP conflict/retry fixture that cancels stale phase replacement. These
+are component tests; that conflict fixture does not use TLS. Separately, the actual
+compiled debug senders passed against a fresh isolated company over verified HTTPS:
+approval, restart identity/revisions, MFA reporting, group filtering, replay,
+logout and revocation all passed. The fixture has no recorded installed release;
+Linux update attempts intentionally fail as unsupported. Its services were stopped
+and the original company stayed healthy. This proves HTTPS reporting, not native
+Windows installation or rollout progress. See the [HTTPS receipt](evidence/e47f614-compiled-sender-https.json).
+All six Windows/Linux verification and deployment jobs passed on push and PR at
+`3bcc884`. The explicit Docker allowlist omission caught at `e47f614` is corrected;
+the actual Docker context exports all50 required public files and excludes private
+canaries. The current Windows component archive and all234 public source inputs
+were independently checked against Git without running its executables. See the
+[component receipt](evidence/3bcc884-reporting-component-checks.json). See
+[installation reporting](INSTALLATION_STATUS.md).
+
+The current Linux company management service now runs source `67b5c69` after
+an actual upgrade, rollback and roll-forward with its unchanged schema2 database.
+Each phase preserved the signed company profile/trust, all five device records,
+consent, authorized technician inventory, release approvals and group capabilities.
+An unassigned technician saw no devices and received403 for a session request in
+every phase. Existing MFA sessions survived; a fresh administrator MFA login passed
+after the final upgrade. HTTPS and maintained rendezvous/relay containers stayed
+unchanged. A preflight guard caught a stale local Compose copy referring to stock
+transport; it stopped before mutation. Both originals were preserved, and the
+active Linux recipe became the baseline for both upgrade and rollback. Endpoint
+VMs stayed off and their installed software was not changed by this maintenance.
+
+A separate copy of the restored company subsequently passed an actual schema2-to3
+upgrade and encrypted pre-upgrade rollback. Missing backup configuration stopped
+the upgrade before schema change. The configured upgrade created one SWANBK2
+archive and accepted a schema3 report. The previous server refused schema3; the
+new restorer recovered schema2 into different storage, and the previous server
+served it through the original HTTPS trust. Profile identity, branding, policy,
+five approved devices, consent, group permissions, release approvals and fresh MFA
+were verified against the original. A login created after the backup correctly
+returned401 after restore; an initial test assumption was corrected accordingly.
+All copied services are stopped. The original lab remains on schema2. See the
+[migration receipt](evidence/e47f614-schema3-upgrade-and-rollback.json).
+
+Both the preceding legacy full-company backup and a new SWANBK2 full-company
+backup restored independently through the new image. Each recovered the active
+signing key, original HTTPS trust/configuration, MFA, five devices, consent,
+approvals and all16 service-readable installers. Actual customer downloads were
+public200, technician downloads401 without login and200 with login, matching the
+original bundle hashes; withdrawn downloads remained404. Both recovery copies
+were stopped and retained without cloned transport. The new encrypted backup is
+502,466,702 bytes, SHA-256
+`7863932fc3d4b9cebdb6e4d1ee4e07892b680adf191bdc8de951246ff7cb826d`;
+its passphrase remains separate and private. The original company is healthy.
+
+The real management CLI also passed a generated513MiB incompressible backup and
+restore under a512MiB address-space cap. A real per-file-size write failure left
+no completed archive or ordinary staging. SIGKILL after authenticated plaintext
+reached private restore staging left the destination unpublished; a retry preserved
+the file hash and identity. Forced-stop remnants stayed private until the fixture
+explicitly removed them. This is process-interruption and write-limit evidence,
+not host power-loss or filesystem-exhaustion qualification. Corrected Windows,
+Linux and complete Linux deployment checks at `26aea83` all passed on push and
+PR runs. See the [backup/rollback receipt](evidence/67b5c69-company-backup-and-rollback.json).
+
+Two independent CI builds at `67b5c69` produced byte-identical management, agent
+and worker executables on each of Ubuntu24.04 and Windows2022. All230 archived
+public source files per build were verified against Git objects across the four
+builds; shipping binaries were never normalized. The source67 deployment workflow
+had a test-header assertion failure, fixed separately before the later deployment
+checks passed. Binary reproducibility is scoped separately from deployment and
+runtime acceptance. See the [component comparison](evidence/67b5c69-component-reproduction.json).
+The native Windows67 build passed. Its254,845,617-byte archive was verified
+against SHA-256 `51e0dea72204ff3d21ced7fc2c03db514d4b3b05732b6ec02fbb60ea0d4aede6`;
+all1238 tracked source files and six generated bridges matched pinned inputs.
+The95-file customer payload matched its unsigned MSI manifest. The existing Win10
+signing guest booted normally with identity, consent, services, shipped-file
+verification and its nonexportable key preserved. Seven outputs, including both
+default1.5.8 MSIs, received verified timestamped lab signatures; all original inputs
+and collected outputs matched their receipts. The private key stayed in that guest,
+which then shut down normally. Test payloads, agent, public certificate and exact
+source were staged and HTTPS hash-verified with automatic updates paused. Actual
+server-generated customer and technician bundles upgraded the Server2016 and
+Server2019 lab endpoints from1.5.7 to1.5.8, preserving identity, trust and consent.
+A live attended session used the maintained relay and showed the authenticated
+company technician name. Authorization renewed beyond its initial300 seconds.
+Customer Stop closed the grant, renewal returned403, and the technician received
+an OK-only closure dialog. Resume preserved identity without reviving that grant.
+This does not qualify ordinary-user control, UAC, multiple monitors or public
+Internet connectivity. A stale sign-in frame after a long idle interval remains
+unattributed. See [native1.5.8 runtime evidence](evidence/67b5c69-native158-runtime.json).
+The approved independent native build40819351377 succeeded. All eight original
+shipping outputs matched build40782677653 byte-for-byte, with public source and
+generated bridges verified and no shipping-file normalization. See the
+[independent comparison](evidence/67b5c69-native-independent-rebuild.json).
+No recurring controller or duplicate build was started. Runtime audit-network
+tracing remains open.
+
+The streamed backup implementation at `67b5c69` passed both Windows and Linux
+component verification on push and PR jobs. Windows explicitly exported and
+restored a 513 MiB incompressible artifact with matching size/hash and retained
+identity material. Linux ran the actual release management CLI for both commands
+with a 512 MiB virtual-address-space limit; its encrypted backup exceeded 512 MiB,
+and restored artifact, keys, setup token, SQLite integrity and private file modes
+passed. Reordering, truncation, altered headers, wrong passwords, legacy archive
+compatibility, invalid paths, CRC failure and ordinary failure cleanup are also
+covered. The original image context check caught the new source missing from the
+Docker allowlist; that is fixed. The corrected image built locally. A deployment
+rehearsal then stopped at its obsolete SWANBK1-header assertion, updated at
+`eaa30b6`; the corrected deployment rehearsals passed at `26aea83`. See the
+[streamed backup component receipt](evidence/67b5c69-streamed-backup-component-checks.json).
+The component checks alone did not establish full-company recovery or an interrupted restore; the subsequent bounded runtime results are recorded above.
+
+The current company was backed up before any management upgrade, retaining all
+16 installer bundles (502,388,268 bytes). Its encrypted legacy archive is
+502,458,804 bytes, SHA-256
+`06c5ba80a5d15b9037e0f81d76e199c4200ef1424d6d54f547eaaa4f65203e0c`.
+Its passphrase remains separate and private. The original company was restarted
+and passed health checks. Both previously active endpoint VMs shut down normally;
+their test files and disks remain available. The subsequent isolated restores and guarded management upgrade are recorded
+above; no cloned native transport was started.
+The identity-only native build `649682a` succeeded; the newer `67b5c69` native
+build, including the retry/audit guards, remains in progress.
+
+The installed 1.5.7 technician on Server2019 and customer on Server2016 passed
+real bidirectional file transfer on 29 October local time. The technician opened
+the transfer window from its authorized desktop session; the customer separately
+approved File Transfer. Two different 1 MiB binary fixtures were copied, each
+through the native Send/Receive controls into a previously empty receiving
+folder. Both native interfaces reported completion, and independent reads of
+the actual destination files matched their original source sizes and SHA-256
+hashes. The company showed two independently claimed attended grants with current
+leases. Customer Stop closed both; actual receiving-device renewal requests for
+both old grants returned403. The same service and configuration watcher remained
+running, consent stayed off and shipping verification passed.
+
+This test also found a client retry bug: the authorization-expired/revoked close
+reason was treated as retryable and led to a rejected reconnect attempt. The
+receiver logs confirmed managed authorization closure; access was not restored.
+The new source makes authorization closure/denial and grant permission denial
+non-retryable, while retaining ordinary network fallback. The receiving logs also
+showed failed inherited audit POST attempts to an HTTP address derived from the
+transport host. Managed builds now return no legacy audit destination; company
+claim/close events continue through authenticated HTTPS management. Dedicated
+native regressions were added for both guards. Their execution and real runtime
+recheck are pending; the completed identity-only build649682a does not include
+them. No large/interrupted/directory transfer, remote UAC or multi-monitor proof
+is inferred. See the
+[file-transfer and stop receipt](evidence/07bb8d0-native-file-transfer-and-pause.json).
+
+
+Installed 1.5.7 now has a real text-clipboard and keyboard checkpoint between
+the Server2019 technician and Server2016 customer. Both VM viewers were
+reconnected with clipboard acceptance and sending disabled; their running
+arguments were checked before and after. With no Swan session open, independent
+interactive probes kept different clipboard markers after both setters finished.
+A new customer-approved Swan session then copied exact multiline Unicode text in
+both directions, verified by matching UTF-8 hashes in the two desktop sessions.
+The technician typed a separate marker through Swan into a new, initially empty
+customer Notepad file and saved it with remote Ctrl+S. An independent read matched
+the file exactly; the customer viewer also showed it. No marker text was written
+to that file through the management connection.
+
+The customer stopped the session and its claimed grant closed. A new customer
+clipboard marker did not reach the technician after closure. The technician
+sample instead matched an earlier marker; preservation of the last clipboard
+value across disconnection is not claimed. An initial customer Set probe exited1
+before recording its result; the failure was preserved, and a separate read-only
+source check confirmed the same value already seen on the technician. A later
+probe added bounded clipboard-read retries and error-type records. The first
+post-stop checker also failed because it expected the last technician marker;
+its original hash-only result establishes non-arrival of the newly changed
+customer marker, not that unsupported preservation expectation. These tests use
+owned Administrator desktops and text clipboard only. Large/interrupted and clipboard-file
+transfer, remote UAC, multiple monitors and public connectivity remain open.
+See the [native clipboard and keyboard receipt](evidence/07bb8d0-native-text-clipboard-and-keyboard.json).
+
+
+A new blank-disk Windows Server 2016 Standard Evaluation Desktop Experience
+10.0.14393 x64 fixture installed the actual generated 1.5.7 customer bundle
+(sequence9). Windows setup initially skipped a failed lab-access bootstrap;
+the installed OS was preserved and the original seed scripts were verified and
+run through its existing management connection. Before any Swan installation,
+absence of a Swan footprint and Tailscale, disabled automatic logon and exact
+restricted SSH-key access were verified. The guest shut down normally and its
+clean disk was preserved read-only with a new writable overlay. The setup media
+was detached. This is separate from the older endpoint with a retained uninstall
+cancellation marker, which was preserved.
+
+On the new fixture, the shipping verifier accepted all 96 signed files, profile14,
+enrollment, service/watcher startup and default unattended-consent-off. A real
+company check hid the pending device from technician inventory and rejected its
+grant (403). After explicit approval, the authorized technician could see it;
+an unassigned technician still could not see it or obtain a grant, and unattended
+access without consent was denied. Other company device records were unchanged.
+These results establish this clean customer installation and enrollment policy,
+not native remote sessions, GUI controls, product reboot/repair/upgrade/uninstall
+or complete Server2016 compatibility. See the
+[clean Server2016 installation and enrollment receipt](../deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json).
+
+
+The maintained Linux transport now has a real two-machine native relay
+checkpoint: installed 1.5.7 technician on Server2019 passed native MFA, showed
+five approved devices and requested the new Server2016 customer. The customer
+received and accepted the actual prompt; the technician displayed its live
+desktop and pointer input changed the customer's Server Manager page, separately
+confirmed on the receiving VM. Receiver and relay logs have the same connection
+ID and matching times; both running transport container image IDs match the
+independently built maintained image. The receiver's new video service and a
+subsequently renewed, claimed attended authorization lease were verified.
+
+The customer's actual Stop support control then disconnected the live technician
+with "Closed manually by the peer." Independent checks found persisted pause,
+the same running service and watcher, no new Swan MSI events, and passing shipping
+verification. The company marked the original grant closed and denied actual
+renewal (403). Resume preserved identity, credential, trust and consent-off and
+still denied renewal of that old grant. The initial checker incorrectly expected
+a zero historical lease timestamp; that failed check is retained, and the corrected
+check uses the closed flag and actual denial. These controls used owned
+Administrator desktops, so ordinary-account active-session termination remains
+unqualified. The incoming customer prompt also displayed the legacy peer name
+"Administrator" rather than an authenticated company technician identity; that
+UI finding is addressed in the new 1.5.8 source: the receiving app replaces the
+peer label with the account identity returned by its authenticated company claim,
+bound to the technician ID in the signed grant. Older servers fall back to that
+signed ID. Wrong-account and malformed identities are rejected. The signed grant
+format and database schema are unchanged. New handler and agent regressions cover
+spoofed names, account mismatch, replay, wrong-device access and compatibility;
+the named tests passed in the Windows2022 and Ubuntu24.04 component jobs.
+Both push40772301701 and PR40772312125 also completed the Linux deployment job.
+The new native build40772456579 is running; the rebuilt prompt still requires
+installation and visual verification. See the
+[identity component-check receipt](evidence/649682a-authenticated-technician-identity-component-checks.json).
+Clipboard, file transfer, remote UAC, multiple
+monitors, direct/public connectivity and authorization-outage expiry are not
+proved by this checkpoint. See the
+[maintained transport and live customer pause receipt](../deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json).
+
+The Server2022 endpoint installed the actual generated 1.5.4 customer bundle
+again after its prior uninstall. The original zero-byte cancellation marker was
+retained for shipping setup to resolve. Enrollment, all 96 signed files, service
+and watcher passed; pending-device, unassigned-technician and unattended-without-
+consent grants were denied. Its installed verifier accepted the exact repair MSI
+and rejected changed bytes, invalid metadata signatures, wrong publishers,
+wrong certificates and replayed release metadata without an installation handoff.
+A standard user then opened the actual customer interface, saw company branding,
+and enabled/revoked unattended consent; independent server checks matched and a
+new unattended grant was denied after revocation. This is a reinstall checkpoint,
+not a new pristine-OS or complete remote-feature qualification. See
+[the Server2022 evidence](../deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json).
+
+That standard-user test also found two release blockers. The advertised shortcut
+started MSI repair because detection could not inspect the deliberately private
+configuration-agent keypath (MsiInstaller event1004). The UI eventually opened,
+but ordinary startup must not invoke that uncoordinated repair. “Stop support”
+also requested administrator credentials through the inherited service-uninstall
+path; the prompt was canceled. The 1.5.5 source disables advertised shortcut
+generation and changes managed Windows stop/resume to service IPC with receiver-
+enforced pause, generation-bound authorization and cancellation of in-flight
+renewal. A native regression and installed-shortcut check were added. Its consent
+dialog also becomes scrollable after long policy text was visibly clipped.
+A subsequent source audit found the remote toolbar still handing file-transfer
+windows a legacy password token. Managed windows now return only a current,
+target/company/login-bound opaque request handle, which the toolbar passes as
+the managed preset so native authorization obtains a fresh grant and proof for
+each file-transfer connection. A native regression checks stale login, wrong
+company, wrong target and expiry; no signing proof or reusable credential is
+returned to Dart. Real file-transfer operation was unverified at that source checkpoint; installed 1.5.7 has now passed the bounded bidirectional test recorded above.
+Both 1.5.5 native builds passed. Comparison run 40616863517 verified identical
+original bytes for all eight shipping outputs, matching compiler inputs and exact
+public source/bridges. The native pause and transfer-handle regressions passed.
+The existing nonexportable lab key signed seven outputs; the Windows worker
+generated both company bundles, whose source texts, signatures, hashes and public
+customer/protected technician downloads verified. Automatic rollout remains
+paused. The actual Server2019 technician upgraded from 1.5.4, opened its native
+UI and passed MFA login with three approved devices and history visible; the
+server audit independently matched that login. See the
+[build/source receipt](../deployment/windows/e95010e-first-build-and-source-verification.json)
+and [distribution/technician receipt](../deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json).
+
+The actual Server2022 customer also upgraded from 1.5.4 with identity, credential,
+trust and revoked consent preserved. Its ordinary-user shortcut directly opens
+the app and is not advertised. The first real ordinary-user stop test persisted
+native pause without elevation; independent checks verified that the GUI token
+has no Administrators SID, the same Windows service process remains running,
+the configuration watcher remains running, and no new Swan MSI event occurred.
+A normal kernel reboot then preserved pause, identity and revoked consent;
+the service and watcher started automatically and the shipping verifier passed.
+Normal restart/clean event-log shutdown were verified with no new unexpected-
+shutdown event. The ordinary user reopened the actual shortcut and resumed
+support without elevation; persisted state, the same post-boot service process,
+all installed files and zero new MSI events verified. The consent dialog scrolled
+to the complete policy with both buttons available; cancel preserved consent-off
+and a fresh unattended grant was denied. See the
+[ordinary-user controls evidence](../deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json).
+Ordinary-account active-session termination and broader/interrupted transfer qualification remain pending. This test also exposed an inherited
+footer that incorrectly calls paused support a stopped Windows service and
+offers a duplicate legacy start link. The next 1.5.6 source labels managed pause
+correctly and leaves resume to the acknowledged company control. Its first
+[native build passed](https://github.com/rijff24/SwanRemoteSupport/actions/runs/40628082360),
+and this footer change was subsequently visually verified in installed 1.5.7
+as described below. No complete
+ordinary-user/remote-feature or clean Windows compatibility matrix is claimed.
+
+The fresh Windows 11 Enterprise Evaluation 26300.9457 installed the actual
+1.5.5 customer company bundle. All 96 signed files, company profile, enrollment,
+automatic service/watcher startup, default consent-off and absence of Tailscale
+verified. Company approval and negative pending-device, unassigned-technician
+and unattended-without-consent checks passed. No native session is claimed.
+The genuine ordinary-user technician setup failed closed before MSI launch:
+publisher verification exceeded its 120-second budget. A separate read-only
+ordinary-user diagnostic accepted the same MSI hash and Authenticode certificate;
+cold PowerShell startup and hashing together exceeded two minutes, while the
+actual signature query returned Valid promptly. The source increases only that
+bounded verification budget to five minutes; all trust checks and timeout
+cleanup remain. The new 1.5.7 candidate also includes the prior footer fix.
+Windows/Linux component workflow 40647664923 passed for fix source
+`07bb8d0b99e2be002a30e5d97eebe67a9c2794ad`; five local source-archive and six
+installer-metadata tests also passed. Native builds 40647688419 and 40655578504
+both passed; comparison 40663413228 verified identical original bytes for all
+eight shipping outputs, 618 matching MSVC inputs per build, and exact source
+plus six generated bridge files in each archive. The existing nonexportable lab
+key signed seven outputs. The Windows worker then generated both 1.5.7 company
+bundles (test sequence9); source texts, signed profiles/releases, installer and
+agent hashes, public customer download and protected technician download all
+verified. Tampered metadata and request-supplied trust overrides were denied;
+unapproved builds created no jobs. Company policy is unchanged and automatic
+rollout remains paused. The same Windows 11 ordinary user subsequently installed
+1.5.7 from the preserved pre-MSI bootstrap, with no Administrators SID and no
+AlwaysInstallElevated policy. The signed per-user MSI, installed hashes,
+publishers and shipping verifier passed. Its actual company-branded technician
+UI then passed username/password/TOTP login, displayed four authorized devices
+and session history, and matched the independent server login audit. The native
+process owner and desktop session verified; customer identity, credential and
+consent remained unchanged. After normal sign-out and closure, the exact signed
+MSI restored a deliberately missing executable under that ordinary user; the
+original file was retained outside the installation directory, trust/release
+state survived and no recovery marker remained. This is not a pristine second
+profile, Start menu shortcut, complete remote-feature or full Windows matrix
+qualification. The Windows 11 customer then explicitly upgraded from 1.5.5
+sequence8 to 1.5.7 sequence9, preserving identity, credential, bootstrap trust
+and default consent-off revision0. The ordinary user opened its actual common
+shortcut without MSI repair or elevation, paused support and saw the corrected
+“Support paused” footer with one Resume control. The service process and watcher
+continued running. A normal kernel reboot preserved pause and identity; clean
+restart events and no unexpected-power-loss event verified. The service and
+watcher started automatically, no Flutter/desktop plugin module was loaded in
+the service, and the shipping verifier passed. The user reopened the shortcut
+and resumed support without elevation; the same post-boot service process,
+zero new Swan MSI events, trust/consent and shipping verification passed. This
+is not active-session termination or remote-feature qualification. See the
+[Windows 11 customer upgrade and controls receipt](../deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json),
+the
+[Windows 11 installation, repair and native MFA receipt](../deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json)
+and the
+[1.5.7 reproduction/distribution receipt](../deployment/windows/07bb8d0-reproduction-and-lab-distribution.json). The original timeout and guarded pre-MSI continuation are preserved separately;
+customer identity, credential and consent remained unchanged. See the
+[Windows 11 findings](../deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json).
+
+The maintained Linux transport now has two-run binary reproduction evidence:
+independent successful CI jobs produced identical original `hbbs` and `hbbr`
+bytes from identical project trees and all 140 matching archived source entries.
+The tracked upstream/shared inputs, reviewed UDP patch and six public recipe
+files were independently checked; OCI images and ZIP timestamps are outside
+this comparison. A separate private runtime used those verified binaries,
+checked embedded source, private-key permissions and TCP startup, then stopped
+without changing the company. Before moving the owned company lab to that
+runtime, a current 439,647,643-byte encrypted backup retained all 14 installers.
+Its independent restore verified HTTPS/profile trust, administrator MFA, all
+four devices and consent, release approvals, the complete TLS/configuration
+files, service-account readability of all artifacts, matching current customer
+and technician downloads, anonymous-technician rejection and withdrawn-package
+denial. Only the two transport image references were then changed in the owned
+Linux lab. Private/public keys, transport pin, management/HTTPS container IDs,
+devices, consent and release approvals verified unchanged. Normal production
+Compose pins are unchanged. This is not proof of native direct/relay sessions,
+UDP traversal or public Internet operation through the new runtime; those
+qualifications remain pending. See the
+[maintained transport and current restore receipt](../deployment/linux/maintained-transport-and-current-restore-20261028.json).
+
+The current Linux management, configuration agent and worker also matched
+byte-for-byte across independent CI runs 40647659405 and 40647664923. Both
+component source archives verified all 221 expected public files, with identical
+Rust 1.90.0 compiler identities and no shipping-file normalization. The PR merge
+and push commits have identical project trees; their distinct source labels are
+retained. This comparison does not qualify endpoint runtime behavior or claim
+identical ZIP metadata. See the
+[Linux component comparison](../deployment/linux/07bb8d0-component-reproduction.json).
+
+## Earlier source checks, 27 October
+
+The staged customer update exposed another real compatibility failure: Windows
+servicing replaced System32's RuntimeBroker, leaving the endpoint's generated
+privacy-helper copy stale. All 96 signed project files remained unchanged, but
+strict installed-payload verification correctly rejected that stale OS copy.
+A guarded lab-only refresh from the current Windows file allowed the unchanged
+installed verifier to pass and the automatic update to reach its helper. The
+temporary diagnostic watcher action then triggered the helper's task-ownership
+guard; its original native action was restored without launching another
+installer. Existing durable recovery then completed the actual 1.5.1/sequence4
+to 1.5.3/sequence6 upgrade. Independent checks verified all 96 project files,
+publisher signatures, MSI registration, original enrollment credential, trust
+and consent, restored native watcher/service, and recovery cleanup. The excluded
+Server 2019 customer stayed on 1.5.1. Further lab rollout is paused.
+The upgraded Windows 10 VM then passed one normal kernel reboot: its automatic
+LocalSystem service and native watcher started without intervention, and all
+96 signed files, MSI registration, trust, identity and consent verified again.
+
+The 1.5.4 source adds narrowly scoped OS-cache maintenance under installation
+and session exclusion. It retains project signature/hash checks, rejects links,
+defers locked files and active recovery, and never takes its source from company
+configuration. Linux/Windows component checks passed for a6670d6. Both complete
+native runs 40520718494 and 40534403214 passed; comparison run 40549751275
+verified identical original bytes for all eight shipping outputs, matching
+compiler inputs and exact public source/bridges. The first full archive and
+all public source objects were also verified locally. The company worker then
+generated both lab-signed bundles. A real 20% rollout automatically upgraded
+Windows 10 to 1.5.4/sequence7 without a manual installer, cache refresh or task
+repair. All 96 signed files, MSI registration, publisher, enrollment and consent
+verified; a normal kernel reboot started the service and watcher automatically.
+With rollout paused, replacing only the generated helper with an older genuine
+Microsoft RuntimeBroker exercised the installed native watcher: it restored the
+current System32 bytes and timestamp automatically, while all 96 project files
+and identity/trust/consent remained unchanged. The shipping verifier passed.
+The Server2019 technician also upgraded to 1.5.4, opened its actual native UI,
+and passed MFA login with two approved devices and history visible; its process
+and loaded libraries matched the reproduced payload, with no new crash event.
+These bounded checks leave fresh installs, the full OS/feature matrix and
+production signing open. See
+[the lab runtime evidence](../deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json) and
+[the original-byte 1.5.4 comparison](../deployment/windows/a6670d6-native-independent-comparison.json).
+
+An actual 1.5.3 technician on Server 2019 connected to the upgraded Windows 10
+customer after its visible Accept prompt. Desktop pixels and a remote pointer
+selection were independently observed on the customer console. Revoking that
+technician's group access closed the exact claimed server session and the native
+connection required fresh company authorization. Original group access was
+restored without reviving the old grant. This session does not qualify its
+transport path, clipboard, transfer, UAC, reboot or multiple monitors. See
+[the bounded update and session evidence](../deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json).
+
+The same two 1.5.3 apps also demonstrated explicit unattended consent, native
+desktop access without another Accept prompt, and remote Windows sign-in after
+the owned guest was signed out. The customer then revoked consent from its own
+UI: the company disabled consent and closed all five outstanding unattended
+leases, the native connection required new authorization, and a fresh grant
+request from an authorized technician with a valid proof key returned 403.
+Consent was left disabled. Multiple reconnect records during the sign-in
+transition require session-history cleanup review; this does not qualify
+clipboard, transfer, UAC, multiple monitors or public transport. See
+[the bounded unattended evidence](../deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json).
+
+**1.5.3 now passes installed native technician startup and MFA login on the
+Server2019 lab endpoint.** The generated company bundle upgraded 1.5.2/sequence5
+to 1.5.3/sequence6, preserving bootstrap, branding and the separate customer
+identity/consent. Actual MSI registration, installed signatures and hashes were
+verified independently. The visible native app showed both approved lab devices
+and history, and its MFA login matched the server audit. Its running child and
+loaded Rust/Flutter libraries matched the reproduced payload, with no new
+application crash event. A path-only verifier initially rejected the native
+launcher's equivalent `/./` path; canonical inspection passed while retaining
+exact-byte and process-creation checks. The later Windows 10 session and normal
+reboot are recorded above; other OS qualification remains pending. See
+[the bounded startup and distribution evidence](../deployment/windows/7bfce49-lab-distribution-and-technician-startup.json).
+
+Both native runs 40468079337 and 40489196703 passed. Comparison run 40499642535
+verified identical original bytes for all eight shipping outputs, exact public
+source and six bridge files per build, and matching recorded compiler inputs.
+The first full archive and source were also verified locally; the runner-side
+comparison avoided a second large host download. All seven new lab signatures
+and original receipts were checked against the existing nonexportable guest key.
+Public customer and protected technician bundle downloads passed. The lab
+completed a 20% staged rollout to the eligible Windows 10 customer while Server
+2019 was excluded, and is now paused. Closed-window checks passed on both
+installed agents. Failed 1.5.2 downloads remain withdrawn. See
+[the original-byte comparison](../deployment/windows/7bfce49-native-independent-comparison.json).
+
+The first 1.5.3 workflow, run 40468079337 from pinned source `7bfce49`, now
+passed its native DLL-search regression and headless service installation gates.
+The later evidence above supersedes its then-pending archive, reproduction and
+GUI checks; real customer reboot qualification remains pending. Both installed Server2019 agents
+also honored paused updates: no installation was handed off, executable hashes
+were unchanged, and enrollment, consent and trust were preserved. Separately,
+the existing 1.5.1 Windows10 customer failed service auto-start after a full
+restart and needed one manual service start. Its identity and lab signing key
+survived. Windows10 was two hours behind externally checked host time; its clock
+was corrected forward before further expiry-sensitive tests. No application
+expiry checks were changed. See [the bounded pause and restart evidence](../deployment/windows/lab-restart-and-paused-updates-20261027.json).
+
+A fresh encrypted Linux company backup and separate restore now preserve both
+current enrolled devices, their approvals and revoked unattended consent,
+administrator MFA, the active profile signing key, original HTTPS trust, and
+release approvals including the withdrawn 1.5.2 downloads. The recovery
+management and HTTPS containers were stopped, and the original company
+remained healthy with signed profile revision 5 and updates paused. This does
+not qualify Windows company restore or a native session against the restored
+copy. The installed Server2019 customer also authenticated to the restored
+company with its unchanged credential, which stayed inside the original guest.
+Windows10 initially stalled at SSH command startup; after normal shutdown and
+boot of the same disk, its unchanged credential also authenticated to the
+restored company. The original failure is retained. No credentials left their
+guests, and neither customer was reenrolled. The customer service was running
+automatically after this recovery, but Windows retained its earlier kernel boot
+time, so a full restart remains a separate test.
+See [the current recovery checkpoint](../deployment/linux/pre-153-company-backup-restore-evidence.json).
+
+**1.5.2 failed native technician startup and both sequence-5 lab releases were
+withdrawn.** The generated installer upgraded the existing Server2019 technician
+from 1.5.1 to 1.5.2, with registered MSI state 5, matching new hashes/signatures,
+and preserved bootstrap, branding and customer identity/consent. A wrapper
+postcheck path error and a later property-helper check were retained; direct
+inspection verified the installation without repeating it. However, the actual
+GUI then crashed with application events 1000/1001 and exception `0xc06d007e`.
+The unpacked executable and required DLLs matched the reproduced build. The
+outer portable launcher returned success despite the native child crash; that
+exit status is not accepted as a startup pass.
+
+Startup's hardened DLL search omitted the executable directory, so the newly
+delayed desktop DLLs could not resolve after bootstrap. An actual isolated
+Windows loader fixture reproduced error 126 with the old flags and loaded the
+application-directory probe with corrected flags, while continuing to reject
+CWD and PATH probes. The source now adds only application-directory search,
+retains delay loading, and adds a real child-process native Windows regression.
+Unreleased binaries advance to 1.5.3; its installed technician GUI retest now
+passes as described above, while customer upgrade and reboot tests remain open.
+See [the failed runtime and withdrawal evidence](../deployment/windows/9ba592c-technician-startup-failure.json).
+Both generated 1.5.2 downloads now return 404. Updates remain paused; existing
+baseline customer services and release evidence were preserved.
+
+Native source `9ba592ca0431ce734a1edf7391aec183f5c100fa` built successfully in
+run 40435586938. Its full corresponding source archive matched 1,203 pinned public
+Git files and all six generated bridge files matched that run's retained bridge
+artifact. See [exact-source evidence](../deployment/windows/9ba592c-native-source-evidence.json).
+The technician helper rejection and actual unsigned customer MSI service-start
+checks also passed; [their evidence](../deployment/windows/9ba592c-native-startup-ci-evidence.json)
+states the limits. Independent runs 40435586938 and 40442895972 now produced
+identical original bytes for all eight shipping EXE/MSI outputs and identical
+618-file MSVC input proofs. Each source archive matched all 1,203 public Git files
+and its own six retained generated bridge files. No shipping bytes were
+normalized or executed for this comparison. See
+[the independent comparison](../deployment/windows/9ba592c-native-independent-comparison.json).
+These results do not qualify
+installed technician startup, customer cold-boot recovery, automatic upgrades,
+the complete Windows matrix or production signing. The source-specific runtime
+and historical sections below retain the earlier results and failures.
+
+The same verified source subsequently produced new lab-signed 1.5.2 customer
+and technician MSIs, with signed application, agent, management and worker
+executables. Both MSI builds used the pinned default recipes and 219 verified
+inputs. All seven output signatures and transferred original hashes were
+independently checked, including timestamp receipts and the new machine-local
+key's nonexportable policy. The existing customer service remained running.
+[Lab signing evidence](../deployment/windows/9ba592c-lab-signed-msi-evidence.json)
+does not establish installation or update acceptance. The preserved Windows
+company VM and its signing identity were untouched; these signatures do not
+represent production signing approval.
+
+The company then served the exact 1.5.2 MSI payloads, agent and full corresponding
+source archive over HTTPS with matching hashes. Its existing worker verified the
+new public lab publisher; identity, credential, consent and both running services
+were preserved. Bad signatures and request-supplied trust overrides returned 403;
+unapproved build requests returned 409 without creating jobs. Explicit approval
+produced both company bundles: anonymous customer download returned 200,
+anonymous technician download returned 401, and authenticated technician download
+returned 200. Both envelopes, payload hashes and seven bundled source texts
+verified. The deployed worker and installer recipe paths are unchanged in the
+new source; the new worker binary has not been deployed. Signed policy fields
+remain at revision 5 with updates paused; only normal signature lifetime renewal
+changed the envelopes. See [distribution evidence](../deployment/windows/9ba592c-company-bundles-evidence.json).
+No 1.5.2 installation, automatic rollout, session coordination or interruption
+recovery is established by these distribution checks.
+
+On a newly created standard Windows10 Pro 22H2 x64 VM, build 19045.3803, the
+existing lab-signed da0c621 technician MSI passed administrative installation,
+repair after retaining and removing its verified executable, and uninstall.
+All three phases returned 0, installed executable and agent signatures matched
+the explicit lab publisher, and 14 original records matched their guest hashes.
+See [the bounded fresh Windows10 evidence](../deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json).
+The initial certificate-cmdlet and script-policy failures occurred before MSI;
+the full administrator token was independently confirmed, exact public lab
+trust was verified, and the successful test used a dedicated child process
+without changing persistent execution policies. A timed-out evidence-helper
+transfer was also retained; direct collection subsequently succeeded. These
+results do not qualify standard-user installation, native technician login,
+sessions, customer behavior, software upgrades or full Windows10 acceptance.
+
+The independent Linux company subsequently generated a Windows10 customer bundle
+from its existing signed 1.5.1 baseline. Anonymous download returned 200; both
+signed envelopes, public-only bootstrap fields, payload hashes and seven bundled
+source texts were verified. On the fresh Windows10 VM, that generated installer
+created a unique enrolled identity, accepted profile revision 5 and release
+sequence 4, retained unattended consent off, and started its automatic LocalSystem
+service. Installed executable and agent hashes and publishers matched, no setup
+recovery marker remained, and five original setup records matched their guest
+hashes. No Tailscale service was present. The private laboratory DNS mapping and
+public CA were provisioned separately, with HTTPS verification retained; this
+does not prove public Internet hosting.
+
+Before company approval, the new device was absent from authorized technician
+inventory and its grant request returned 403. Explicit approval added it to the
+authorized group inventory; unassigned access and unattended access without
+consent remained denied. The original Server2019 device record was unchanged.
+See [the bounded installation and enrollment evidence](../deployment/windows/da0c621-win10-company-customer-evidence.json).
+The idle-MSI guard and its subsequent path-regex error were retained as preflight
+failures before setup. No installer or service was terminated to proceed. These
+results do not qualify a Windows10 native session, cold reboot, customer repair
+or uninstall, desktop features, 1.5.2 upgrades or full Windows10 acceptance.
+
+## Lab continuation, 26 October
+
+The current da0c621 customer and technician lab-signed MSIs passed bounded
+administrative lifecycle checks on a newly created Server2019 Standard Evaluation
+Desktop Experience VM, build 17763.3650 x64. Customer install, repair and uninstall
+returned 0; a real reboot preserved all 96 packaged files and valid publishers,
+and the LocalSystem customer service started automatically. Technician install,
+missing-executable repair and uninstall also returned 0 in its first application
+context after the customer test. Thirty-one original records were collected and
+hash-verified. See [the bounded evidence](../deployment/windows/da0c621-server19-fresh-msi-evidence.json).
+
+The OS setup's lab bootstrap command had returned 1 and left the test tools
+absent. Its original cause is unproven. The pinned bootstrap was run manually
+after reaching the administrative console, lab access was verified, automatic
+login disabled, and setup media detached before Swan testing. This is not proof
+of unattended OS provisioning. These MSI checks do not establish enrollment,
+sessions, standard-user installation, software-version upgrades or automatic
+updates on Server2019; company-approved test metadata still targets Server2016.
+
+The company VM's private lab HTTPS binding was subsequently enabled with its
+rollback backup retained. Company HTTPS recovered and device identity and
+consent were preserved. From the separate Server2019 VM, normal HTTPS validation
+accepted the explicitly trusted public lab CA, the public profile returned 200,
+its signature verified against the original configuration pin, and anonymous
+device inventory returned 401. Profile 18 remains paused. See
+[the bounded peer connectivity evidence](../deployment/windows/server19-company-peer-https-evidence.json).
+No private TLS key was transferred. This removes the private HTTPS connectivity
+block for subsequent tests, while public reachability remains unproven.
+
+The saved lab transport profile still points to parallel-test ports with no
+active parallel listeners; installed transport processes use their normal ports.
+The maintained transport candidate remains separate from shipping component
+pins. Current native enrollment and direct/relay sessions still require testing.
+The single Windows10 standard lab account was subsequently reset by its
+administrator. The new credential was accepted and the recorded old value
+rejected; that saved old value had also failed before the reset. Account identity
+and standard-user status were preserved, both credential records are protected,
+and one-time guest and host inputs were removed. Permanent execution policies
+were retained. See [the bounded repair evidence](../deployment/windows/win10-lab-account-repair-evidence.json).
+This resolves the lab credential repair; it does not establish the cause of the
+earlier guest hang or complete Windows10 product acceptance.
+
+The additional dedicated lab drive removed the Windows11 storage shortage. The
+large local source, media and VM files were moved with SHA256 content verification
+of 49,822 files (327,044,501,570 bytes), preservation of access restrictions, and
+runtime checks of the existing company services and signed paused profile 18.
+Machine paths and private migration receipts remain outside this repository.
+The frozen client distribution was not booted; its earlier unresolved integrity
+question is not closed by verification of this move.
+
+The Server2022 standard-user console was reached and the desktop test task
+launched PowerShell in console session 1. It stalled before writing the first
+driver observation or starting Windows Installer. The bounded attempt was
+terminated and disabled; its process was confirmed absent and no msiexec process
+was running. This is an inconclusive harness startup failure, not a passing MSI
+test or an established product defect. Original event and final-state records
+are retained privately. The earlier batch-context failure remains unresolved.
+
+No application binary changed for these lab operations. All current release
+gates below remain open except the shortage of lab storage.
+
+## Current status, 24 October
+
+The latest tested application source is `da0c621845057bed321a98a1886ef15891e431a9`.
+Later evidence/documentation commits do not change those application binaries.
+The product remains incomplete and is not approved for production publication.
+
+- **Reproduction:** two independent da0c621 native builds produced identical
+  original bytes for all eight shipping outputs and the same 618 recorded MSVC
+  inputs. SDK/actual CMake command provenance and production signing remain
+  separate gates. See [the comparison](../deployment/windows/native-da0c621-rebuild-comparison.json).
+- **Distribution:** the existing company worker generated lab-signed customer
+  sequence 14 and technician sequence 15 bundles. Public customer and protected
+  technician downloads and independent content checks passed. The generated
+  technician setup passed explicit sequence 13-to-15 upgrade in an administrative
+  profile. That is not an automatic software-version upgrade. Company profile 18
+  remains paused; approved test metadata targets Server2016 only. See
+  [distribution evidence](../deployment/windows/da0c621-lab-distribution-evidence.json).
+- **Fresh Server2022:** on 20348.587 x64 Desktop Experience, the current customer
+  MSI passed administrative install, repair, a real reboot with automatic
+  LocalSystem service startup, and uninstall. All 96 payload hashes and installed
+  publishers passed. Technician administrative install/repair/uninstall also
+  passed after customer testing on that VM. See
+  [the bounded fresh-VM evidence](../deployment/windows/da0c621-server22-fresh-msi-evidence.json).
+- **Standard-user technician:** the Server2022 batch-context test failed with
+  MSI1601/Windows Installer connection denial 0x80070005. A non-admin token and
+  separate profile were verified. Temporary batch-logon rights were restored and
+  test tasks disabled. An actual desktop-context test is staged but has not run;
+  console activation failed twice and awaits restored UI access. See
+  [the original failure](../deployment/windows/da0c621-server22-standard-batch-failure.json).
+- **Windows10:** bounded current MSI/reboot checks passed, but a later guest hang
+  has no established cause. A legacy lab password disclosure still requires the
+  separately requested reset and cleanup; automatic approval review blocked
+  those actions. The affected VM remains offline. These are unresolved failures,
+  not complete Windows10 acceptance. See
+  [the bounded evidence and incident](../deployment/windows/da0c621-win10-bounded-evidence.json).
+
+Current cross-machine enrollment/sessions and public direct/relay transport,
+customer consent/revocation and desktop features, current branding/key-rotation
+runtime checks, approved automatic rollout/interruption recovery, the remaining
+clean-machine Windows matrix, full Windows TLS/transport backup/restore and
+production signing remain release gates. Existing partial and older-source
+results below do not close those requirements. Private company HTTPS binding
+and full Windows restore approval remain pending; Windows11 awaits additional
+storage. A read-only observation after the Server2022 tests confirmed the company
+server, worker and original customer process still running and the public profile
+endpoint returning HTTP200. No working-company rollout was unpaused for these tests.
+
+## Historical status, 23 October
+
+The preserved company VM now runs the lab-signed `f84ffb0` management service
+and worker after a verified encrypted management-only backup and coordinated
+upgrade. Identity, consent, HTTPS binding, transport trust, paused profile 18,
+customer process/watcher and interrupted customer setup evidence were preserved.
+The new worker's generated bundle installed the already-approved signed
+`d8fad20` technician payload in a second administrative account while preserving
+the first account: real MSI state 2 became state 5. Exact new installer texts,
+signed profile/release and installed identity were independently checked.
+
+The signed `d8fad20` customer MSI passed Server 2016 reinstall, damaged-license
+repair and uninstall. A real standard-user desktop technician MSI attempt was
+blocked by effective Windows Installer policy (1625); no policy or privileges
+were relaxed. These are bounded installation results, not native session tests.
+Independent `d8fad20` native builds reproduced all eight shipping files. New
+`f84ffb0` component checks/source verification and both native builds passed.
+Their independent comparison failed for the client packages; the server setup,
+management, worker and agent matched. Client reproducibility remains a release
+gate. The later `7928f87` generic Flutter feature-guard correction compiled
+successfully for Windows and Linux x64; the broader workflow remains incomplete.
+
+Current receiving-device/session features, separate-machine and public transport,
+fresh matching Windows deployment, the complete Windows matrix, current automatic
+rollout/recovery, full Windows TLS/transport restore and production signing remain
+release gates. Private HTTPS binding and full Windows backup/restore approval
+blocks remain unresolved. Management-only backups do not prove full restore.
+Latest successful graphical sessions still use the earlier technician and older
+receiver on one VM, as detailed below. No complete-product acceptance is claimed.
+
+The following early-23-October summary and 22-October snapshot are historical;
+the final dated sections contain subsequent source-specific evidence.
+
+**Earlier Windows company-lab state:** after explicitly approved cold migration of
+the existing company disk to KVM, all three services and the HTTPS API were
+observed healthy. Original customer identity and consent, profile revision 18,
+paused updates and the existing HTTPS binding were preserved. Both original
+sequence-9 bundle jobs completed; public customer download, protected technician
+download, file hashes and independent bundle-content verification passed.
+The original bundles contain unsigned CI application payloads and are not complete
+release packages. The later corrected technician bundle passed explicit setup
+recovery in an administrator profile; customer installation and end-to-end support
+acceptance remain open. Earlier guest unresponsiveness, Caddy faults and the separate endpoint-lab
+storage hash discrepancy remain recorded below; recovery is not proof that their
+causes have been resolved. No production or full compatibility acceptance is claimed.
+
+The subsequent generated-technician installation test reached final verification
+and correctly rejected the unsigned application inside the lab-signed MSI.
+Its release sequence stayed zero until a corrected sequence-10 package, built
+from signed payloads, completed explicit recovery. The old pending marker was
+archived unchanged, installed signatures/hashes passed, and sequence 10 was
+recorded. This is an existing Server 2016 administrator-profile recovery result,
+not fresh-machine, standard-user, graphical-session or automatic-update acceptance.
+
+The correctly signed customer sequence-11 bundle also passed generation, public
+download and independent content verification. Its in-place installation was
+correctly refused because the existing lab MSI is registered as 1.5.7 although
+its application binary reports 1.5.0. The original application, identity and
+consent remain intact; configuration syncing was restored after the failed setup.
+A pending sequence-11 setup marker remains preserved. A source fix now checks
+related MSI versions earlier and restores the previous configuration-task state
+on later failures. Targeted Windows PowerShell checks pass; matching rebuilt
+binaries and fresh-client qualification are still required.
+
+The latest accepted-desktop lab run used technician source `e6b87b9` against the
+preserved older `bd13500` customer on Server 2016 with the parallel transport
+candidate and experimental `9f97ef0` source-built engine. Standard-user MFA, inventory/history, customer approval, desktop
+capture, claimed/closed server history and logout passed. Both editions were on
+the same guest: this does not verify a corrected receiver, separate-machine
+input, relay fallback or Internet connectivity. An earlier relay attempt selected
+a local direct connection and the guest later became unresponsive; it recovered
+with identity and consent preserved, but that earlier failure's cause is unproven.
+Two runtime configuration fixes are in native build `39600988305`; its build
+and artifact/source checks passed, but complete corrected-customer runtime
+acceptance remains open. Subsequently, technician source `c0bf4b4` passed
+standard-user graphical MFA, inventory/history, customer refusal, live name sync
+and offline cached-branding checks against the existing lab service. That does
+not establish an accepted desktop session with both corrected editions. See
+the final dated sections for exact scope and failures.
+Earlier entries below retain their original source-specific observations;
+later evidence does not retroactively validate older packages or every Windows
+version. The full release gates remain open.
+
+## Earlier release-gate snapshot, 22 October
+
+The dated evidence below is source-specific. Earlier passing packages do not
+qualify the current candidate. Native source `ebef5a6` passed workflow
+`39704802586`, including the managed-policy and view-only control regression
+tests and the unsigned technician MSI lifecycle under the CI account. Its
+downloaded archive, 1,122 tracked source files, six generated bridge files and
+95 native payload files passed independent provenance/hash checks. Its
+authorization-log and control-permission corrections still need receiving-device
+runtime verification. The earlier `becf3cd` standard-user tampered-cache GUI check
+confirms the legacy upgrade card is absent. Its separate standard-user native
+`--update` run logged the managed-update refusal and preserved the installed
+customer/profile; GUI installation callbacks remain to verify at runtime.
+This does not prove binary reproducibility.
+
+The application still pins the reviewed upstream Windows Flutter engine by
+archive hash, whose source-to-binary mapping remains unverified. A separate
+source-built candidate completed CI at `9f97ef0` and passed artifact, public
+source-tree and generated-command verification. Its isolated test with the
+older app bundle failed before GUI startup because the snapshot formats differed.
+Experimental build `39730064190` recompiles that bundle with a matching compiler;
+build `39730660383` additionally checks the new recorded UTC build-date input.
+Both workflows completed successfully, including native policy/control
+regressions, package creation and the CI-account technician MSI lifecycle.
+The latter also passed the deterministic build-metadata regressions. Its
+original artifact `12406886407` passed independent archive, 1,138 tracked source,
+six generated bridge and pinned engine-evidence verification. All 95 extracted
+payload files matched the installed-file manifest. Its source-specific GUI
+smoke test passed MFA, inventory/history, customer approval, desktop capture,
+session close and logout against the preserved older receiver on the same VM;
+this does not qualify a corrected receiver or the complete runtime matrix.
+An independent application build, `39741804606`, uses the exact same
+`e6b87b91cbdb413a64a306add7df733aa31a9795` commit and experimental engine
+selection through the pinned `codex/rebuild-native-e6b87b9` branch. Original
+application/installer output comparison remains pending.
+The timestamp-controlled engine build at `b1d62b2` completed CI and passed
+artifact/source/command/link-response and PE metadata verification. Its
+independent same-recipe build is
+`39730890327`, whose original artifact `12407033745` passed source/evidence
+verification. The original DLL and import library are byte-identical across
+the two builds. Their original PDBs differ, so complete engine-output
+reproducibility remains open. The successful GUI test used the earlier
+`9f97ef0` engine, not this timestamp-controlled DLL. Broader runtime
+qualification remains open. The public upstream
+source/patch reconstruction candidate and evidence limits are recorded in
+[Source availability and licensing](SOURCE_AND_LICENSE.md#patched-windows-flutter-engine-provenance).
+
+| Area | Latest established evidence | Still required for release |
+| --- | --- | --- |
+| Company setup | First-run branding/policy form contract and real Axum/SQLite setup tests pass on Windows/Linux; Linux deployment rehearsals pass. | Matching fresh Windows service/worker setup and equivalent full deployment acceptance. |
+| Native technician | `e6b87b9` with the experimental source-built engine passed standard-user MFA, authorized inventory/history, customer-approved desktop capture, session close and logout against the older customer on the same VM. Earlier `c0bf4b4` also passed live branding and offline refusal/cache. | Accepted support session with both corrected editions and a separate receiving machine. |
+| Receiving authorization | Older `bd13500` customer rejected a real stock client's legacy-password request. Native `c0bf4b4` and current `becf3cd` GUIs refused a tampered cached profile; the current UI also hides legacy upgrade cards. | Corrected receiver runtime, unauthorized direct connections, packet permissions, lease expiry and revocation. |
+| Customer session features | Current technician/older customer same-VM approved desktop session; earlier graphical refusal. | Corrected receiver, separate-machine input, transfer, clipboard, UAC, logon screen, multiple monitors, unattended consent/revocation and relay fallback. |
+| Installers | Source-specific administrator MSI lifecycle evidence is listed in the Windows matrix below. Current `becf3cd` technician MSI also passed standard-user install, missing-file repair and uninstall as a functional diagnostic on an expired Windows 10 evaluation. | Current-source company-generated EXE/MSI flow, standard-user qualification on valid Windows installations and the complete upgrade/recovery matrix. |
+| Updates and recovery | Earlier signed lab update evidence, component rejection tests and real MSI rollback fixtures. | Current-source approved automatic rollout, session coordination, interrupted-update recovery and identity/consent preservation. MSI rollback alone does not prove these. |
+| Public transport | Maintained transport candidates built; two Linux transport builds reproduced identical binaries with verified public source. | External direct/relay/negative-access tests without Tailscale and accepted production transport pins. |
+| Publication | Corresponding-source/artifact verification and private lab signing are available. Management, agent and worker binaries matched across two independent jobs on each of Windows Server 2022 CI and Ubuntu 24.04 after the Windows linker correction. | Native app/engine and installer reproducibility, broader toolchain qualification, production signing approval/signatures and every release gate above. |
+
+## Evidence obtained
+
+### Corrected native Windows build inputs, 3 October
+
+Native Windows x64 workflow `37083233120` completed successfully for exact source
+`4768d530ebc79f84e84260bed42db608dd439c9c`, including the MSI registration,
+watcher quiescence and durable restart-recovery changes. Artifact `11259832707`
+was downloaded and verified: 109,625,027 bytes, archive SHA-256
+`9419bbb73e3a99514e794e6684f3fd5884483dd7dbf6f0b5e1cd1df55abc737f`.
+All 18 entries passed path/size/CRC and published payload-checksum checks.
+These are unsigned build inputs. Signing, installation and corrected automatic
+upgrade/interruption tests have not yet passed for this source. Its management
+binary predates the HTTPS-recipe backup correction at `b6d7f78`.
+
+The corrected agent was subsequently signed in the disposable Server 2016
+guest using its private nonexportable lab certificate. SDK verification
+`/pa /all /tw` passed with an RFC3161 timestamp; unsigned input hash
+`e9ec48b545204f5ad8a4f0e3cb2816189a42b49e7144fe8187e1ce92782b580b`
+remained unchanged, and signed output hash is
+`1e02bdc3dd0302dc7cfd6a6d9b5c65512e46c0ed3fa2dbeb4e977c98659b113b`.
+This proves private lab signing only. The corrected agent is not yet installed,
+and no production signing approval or corrected automatic upgrade is claimed.
+
+### Restricted technician account on installed Windows server, 3 October
+
+The installed Server 2016 company service created a separate technician-role
+account, with credentials and TOTP material retained only in protected lab
+files. Actual HTTPS MFA login passed. Before group assignment, raw inventory
+was empty, a grant for the approved customer device was denied, and the
+administrator account-list endpoint rejected the technician. Assignment to
+the lab support group exposed exactly its one approved device. The technician
+session then signed out. An initial PowerShell fixture assertion counted an
+empty JSON array as one pipeline item; inspection of the raw `[]` response
+corrected that harness error. These are real server-role checks, not proof of
+login or a remote session in the installed graphical technician app.
+
+The installed technician agent from native source `6840d91`, verified against
+its package hash and private lab Authenticode publisher, subsequently passed
+actual HTTPS MFA login as that technician, authorized device inventory,
+session-history retrieval and logout. Reusing its logged-out session was
+rejected. Its company-state file remained byte-for-byte unchanged, so this
+flow persisted no credentials there. Execution used the Administrator Windows
+lab harness while the company account had technician permissions. Standard-user
+CLI authentication, graphical login and native remote connections remain
+unverified; earlier standard-user installation/rendering evidence is separate.
+
+Fresh private unattended media for Server 2025 Standard Evaluation Desktop
+Experience selects image 2 after reading the official ISO's WIM metadata.
+Its credentials and SSH keys are distinct from the Server 2016 fixture. The
+older uninitialized boot-only Server 2025 VM was retired with its disk preserved
+to prepare this setup. The new fixture remains stopped: the host had about
+2.5 GiB available, below its 4 GiB allocation plus host reserve. The working
+Server 2016 VM and host production services remain running. This is preparation,
+not a Server 2025 installation or compatibility pass.
+
+### HTTPS configuration backup correction, 3 October
+
+Review of the installed Windows server found that its company-data `Caddyfile`
+was omitted from encrypted backups, even when certificate storage was included.
+Export now includes that optional configuration, rejects links/reparse points,
+and restore accepts its fixed filename in the protected replacement directory.
+The complete backup test verifies its exact contents alongside transport keys,
+environment and nested TLS storage. All three backup tests passed, including
+wrong-password, tampering, nonempty-target and unsafe archive rejection.
+Existing archives without the configuration remain supported.
+
+The actual Windows GNU development CLI from `b6d7f78` then exported the
+disposable Server 2016 management database and restored it into a separate
+protected directory. A wrong password failed before creating its target.
+Restored profile-signing material, setup token and Caddy recipe matched the
+original files; the management database was restored. The original HTTPS
+service remained healthy throughout, and no service control was performed.
+A separately protected, hash-verified copy of the restored SQLite snapshot
+passed `quick_check` and `foreign_key_check`, retained schema 2 and company
+profile revision 7, and derived the original public profile trust from its
+active signing key. Its enabled administrator retained password/MFA material;
+the approved device retained unattended consent off. All four imported release
+envelopes verified with the original release trust, including approved sequence
+3. These checks output no credentials or private keys.
+
+A protected copy of those restored management files subsequently started the
+same Windows GNU development CLI as an isolated loopback HTTP backend on the
+test host, with transport components disabled. Its signed profile verified under
+the original pinned key. Actual administrator MFA login, TOTP replay rejection,
+approved-device inventory, preserved unattended consent off, anonymous inventory
+and grant denial, denial of an unattended grant without consent, retained release
+approval and logout invalidation all passed. The owned rehearsal process stopped
+afterward. The original VM service was not modified. This proves restored
+management behavior; it does not prove a restored Windows SCM deployment,
+HTTPS front end or transport, and transport/TLS storage was not included in
+this narrower rehearsal. The coordinated full-server
+rehearsal command was rejected by automatic approval review with only
+“blocked by policy”; it was not executed. Full Windows deployment restore
+using this correction remains unverified.
+
+### Automatic MSI update failure and focused corrections, 3 October
+
+The signed Server 2016 customer fixture approved release sequence 3 (MSI
+1.5.2) after verifying pause, zero-percent rollout and closed maintenance
+window rejection. Its agent committed sequence 3 and removed the pending
+receipt, but Windows Installer still registered MSI 1.5.1. Both packages
+contained the same signed native binaries: checking executable hashes alone
+incorrectly skipped installation. The helper also failed to restart the
+already-running configuration watcher. **This automatic upgrade failed
+acceptance; a committed sequence is not proof of an installed MSI upgrade.**
+
+The correction checks the signed package's product code and version against
+Windows Installer before skipping installation, after installation and during
+explicit completion recovery. A read-only test on the actual guest accepted
+its registered 1.5.1 and rejected 1.5.2. The restart script now stops only the
+validated installation-owned SYSTEM task before its bounded wait. Executing
+that script in the disposable guest replaced exactly one watcher and preserved
+device identity, credentials and consent. Agent tests passed (21 passed,
+two explicitly gated integration fixtures ignored). These focused checks do
+not prove a corrected signed automatic upgrade or durable post-commit recovery;
+both still require end-to-end verification. At the failure, the registered MSI
+was 1.5.1 while agent state claimed sequence 3.
+
+The existing authenticated Windows worker then generated a public repair bundle
+for the exact already-approved sequence 3 package (job
+`07e60da5-3900-4453-91bc-334dadbd7f7f`, bundle SHA-256
+`a8e2c3a76c18fbbbac18822cfae7be60688ef04ed10fa66283bd365cfe654bc8`).
+Normal bundled `Install-Company.ps1 -Repair` completed in the disposable guest.
+Windows Installer now registers MSI 1.5.2 and agent state remains sequence 3.
+Device identity, credential, consent and consent revision were preserved,
+the setup marker was removed, and both customer service and watcher run.
+This reconciles the earlier failure using the historical `6840d91` signed
+payload; it does not prove the corrected agent's automatic-update behavior.
+
+The subsequent recovery change writes a signed `configuration-restart.json`
+marker before committing a customer update. Successful restart removes it;
+the staged recovery task retries it after validating the committed release,
+installed payload and MSI registration. Support sessions remain blocked while
+the marker exists, including after the updater's process lock disappears.
+The agent suite passed again, and the extended session-exclusion regression
+passed. A newly built, signed native agent and an interrupted-update VM test
+are still required to prove this recovery behavior end to end.
+
+The updater now quiesces the validated configuration task before replacing
+customer files, including updates launched independently of the watcher.
+The disposable Server 2016 test confirmed that stop-only left no installed
+watcher process, then restart created exactly one watcher and preserved
+identity and consent. Explicit setup completion also checks MSI registration
+and retires a previous restart marker only after verifying its installation;
+another automatic update is rejected while restart recovery remains pending.
+The Windows GNU agent build passed. These changes still need verification in
+the signed native update flow.
+
+### Windows full-stack company server and technician worker, 3 October
+
+The disposable Windows Server 2016 Standard Evaluation guest (Desktop
+Experience, build 14393) installed the native management service from source
+`6840d910c252d8fb7d5c34ca7dffbc2a2ddffb4b` using the installer at `c27e9b7`.
+Its mandatory publisher verification passed with a private, guest-trusted lab
+code-signing certificate. The installer deployed the pinned rendezvous, relay
+and HTTPS components. Stopping the management service stopped all three owned
+children; restarting it restored service. This does not prove crash recovery
+or product behavior after reboot.
+
+A private HTTPS fixture deliberately disabled automatic CA trust installation.
+TLS 1.2 requests rejected its untrusted certificate, then succeeded after
+explicitly importing its public CA into the guest's root store. Fresh company
+setup, separate customer/technician branding, administrator TOTP login,
+rejection of the consumed setup code, and worker registration passed over
+HTTPS. Host trust, DNS, production services and firewall were not changed.
+
+The real outbound Windows worker consumed an administrator-approved,
+Ed25519-signed test release, downloaded and verified its company-signed
+technician EXE and agent, and uploaded a completed ten-entry installation
+bundle. Anonymous technician download was rejected. An authenticated download
+matched SHA-256
+`8308a3842d1536150585097b019acb77f4219a0cd19246778ff9c743bdfacbc6`.
+The bootstrap contained only schema, edition, company identity, HTTPS endpoint
+and public profile/release verification keys. Credentials and signing private
+keys remain in the isolated lab, outside the repository.
+
+These results prove a technician **EXE bundle generation and access-control
+flow** on that guest. They do not prove installation of that bundle, customer
+package generation, MSI signing, automatic updates, native sessions, public
+Internet reachability, other Windows versions, or production signing approval.
+
+The subsequent standard-user bundle installation passed HTTPS company setup
+and profile pinning, then failed package verification with Windows access
+denied: the agent attempted to write its verifier beside the package in the
+administrator-extracted bundle's protected verifier file. The agent now runs its
+embedded verifier as an encoded PowerShell command with quoted literal
+arguments, without creating or trusting a helper in that directory. A rebuilt
+GNU development agent passed package verification under the same standard
+account against the same signed package and protected verifier file. Its agent
+suite passed 21 tests with two explicit integration fixtures ignored. This is
+verification regression evidence only: the replacement development agent is
+unsigned, was not published in a bundle, and has not completed installation.
+
+### Customer package signing, installation and explicit setup recovery
+
+On the same Server 2016 guest, the worker generated a customer MSI bundle and
+the server served it without authentication. Its downloaded hash matched the
+worker result. Signing only that MSI container was deliberately insufficient:
+setup enrolled the device but final installed-publisher verification rejected
+the unsigned embedded customer executable. The durable setup marker remained
+and the configuration task was not enabled; this was a failed acceptance test,
+not a successful installation.
+
+The customer executable was then signed and timestamped in the guest. The
+other native files were compared with the original 96-file source manifest
+before export. Pinned WiX built a lab-only replacement MSI with that signed
+executable and the signed agent. The host used the explicit test-input build
+mode because the private signing root was installed only in the guest; no
+host trust bypass was introduced. The replacement MSI was separately signed,
+timestamped and verified in the guest, imported as signed test metadata,
+approved, bundled by the worker, and downloaded publicly. Its bundle SHA-256
+was `2e7a4fe91820f2b67b2220cdc545fab3434a85987e966e51fdd6eab1941cf27d`.
+Package version 1.5.1 is a private fixture built from the unchanged native
+`6840d91` payload with a newly signed executable, not a published software release.
+
+Explicit recovery now requires a strictly newer, same-edition release from the
+pinned issuer, retains the original failed setup receipt, and atomically replaces
+the blocking marker under session/update exclusion. Tests reject another issuer,
+another edition and an older sequence while retaining state and the old marker.
+The actual guest recovery used a separately rebuilt, unsigned GNU development
+agent to exercise this new preparation command, followed by the worker bundle's
+normal installer and its signed agent. This is not yet proof of the new
+`-ReplaceFailedSetup` switch in a newly generated native release bundle.
+
+The corrected company installation completed all package, installed-payload
+and publisher checks. Both native customer and company services run, and the
+SYSTEM `watch` task runs from its exact installed agent path. The setup marker
+cleared, sequence two was recorded, and the original failed receipt was retained.
+Device identity, device credential, consent revision and default attended-only
+consent were unchanged. The server still reports the device as pending approval.
+The guest has no Tailscale service. This proves local company installation and
+enrollment recovery; it does not prove Internet transport, reboot, desktop
+sessions, UAC, automatic-update recovery, fresh signed installation on another
+guest, or compatibility on the other advertised Windows versions.
+
+The installed signed customer agent also fetched branding revision two over
+HTTPS without reinstallation. Device identity/credential, consent and software
+sequence stayed unchanged. With the owned company service stopped, the agent
+validated its cached profile and installed release; the service was restored
+afterward. Separate protected copies of state rejected a tampered profile
+signature, an older genuinely signed profile, and a mismatched company identity.
+The actual installed state remained unchanged by those negative tests. This
+proves agent cache behavior while management is unavailable, not visual branding
+in Flutter, operation on a completely disconnected network, or offline permission
+to establish a support session.
+
+### Standard-user technician installation and read-only verification
+
+The actual worker-generated technician EXE bundle from `6840d91` completed
+installation from the standard account's Downloads directory. Package,
+installed application and signed-agent verification passed; sequence one was
+recorded and the pending marker cleared. The Start menu shortcut targets the
+installed launcher. That launcher refreshed branding to revision two and
+started the native app in the standard desktop session. Its rendered Flutter
+screen shows the updated company name/logo, company HTTPS domain, username,
+password and authenticator fields, plus product/upstream/AGPL attribution.
+This proves installation and login-screen rendering, not successful GUI login,
+inventory interaction or a remote session.
+
+Further inspection showed that the earlier verifier regression covered an
+administrator-owned helper file, rather than a directory denying every write.
+Compatibility, MSI identity and MSI mode helpers still wrote beside inputs.
+They now execute embedded scripts with encoded commands and literal arguments.
+A new guest fixture explicitly grants the standard account read/execute only;
+an attempted new file was denied. A rebuilt unsigned development agent verified
+both the signed technician EXE and signed customer MSI from that fixture, without
+changing any directory inputs. The customer verification fixture contains only
+public bootstrap/profile information and no device credential. The agent suite
+passed 21 tests with two integration fixtures ignored, including rejection of
+a publisher string attempting to execute a command; no injection file appeared.
+These changes still require a new native build and signed bundle verification.
+
+The [native build at `82c8c65`](https://github.com/rijff24/SwanRemoteSupport/actions/runs/37076900806)
+passed. Its 18-entry unsigned artifact was downloaded, checked against GitHub's
+SHA-256 `9f9728adfda93a9cf15f8ade9338ae5986f3ebfc83d6c49c305c9f6ce6db697f`,
+and extracted with path, size, CRC and published payload checksum verification.
+It predates setup-replacement recovery and the remaining read-only helper fixes.
+No production signing, new package installation or compatibility claim follows
+from this build alone.
+
+### Earlier component evidence
+
+- Public baseline tag `swan-single-company-baseline-1.4.9` preserves the original
+  Swan deployment and build instructions. Its source was not replaced.
+- Thirty-three product tests pass on the local Windows development host at `6438ce2` (18 agent, eight management, seven protocol), including
+  enrollment/trust preservation across stale writes, trusted key rotation, refusal to automatically reinstall a removed endpoint, and explicit consent changes surviving older refreshes. Consent API tests also reject delayed enable requests and older revocation retries; same-revision revocation takes precedence.
+  The preceding eleven-test component source passed tests and release compilation on
+  [Windows 2022 and Ubuntu 24.04 CI](https://github.com/rijff24/SwanRemoteSupport/actions/runs/36856716860)
+  at commit `411269b`.
+- A fresh, isolated company passed real HTTPS tests against newly built agent
+  and management executables: setup/TOTP, enrollment, pending-device denial,
+  technician login and group inventory, own-session history, logout token
+  revocation, unattended-consent denial, single-use grants, signed branding
+  revision synchronization and device revocation. Exact executable hashes and
+  private results stay under the Git-ignored local test data directory. This
+  test uses a test RustDesk ID and proves **no native remote desktop behavior**.
+- Flutter bridge generation passed for the technician request stream. Native
+  Rust parsing and changed PowerShell parsing passed. The graphical technician
+  interface and in-memory ticket broker compile in the shared endpoint source;
+  native use remains unverified.
+- Native lockfile resolution at `75632a2` adds managed-agent dependencies while
+  preserving every pre-existing package version, checksum and Git commit. A
+  [pinned Windows x64 build at `c78a471`](https://github.com/rijff24/SwanRemoteSupport/actions/runs/36873808239)
+  passed Rust/Flutter compilation, unsigned customer package generation, and
+  product-component compilation. It predates the capability-policy changes.
+  The [build at `31b13aa`](https://github.com/rijff24/SwanRemoteSupport/actions/runs/36967791061)
+  also passed and produces a distinct technician portable artifact. It predates
+  subsequent native file/audio capability guards, consent ordering, complete
+  backup and installation/repair changes. These builds are historical evidence;
+  their results do not establish acceptance of later changes.
+- The unsigned Windows artifact from `31b13aa` downloaded successfully. Its
+  digest matches GitHub's artifact digest and both endpoint package checksums
+  match `SHA256SUMS.txt`. Both endpoint packages and all three product-component
+  executables report `NotSigned`; no downloaded executable was launched on the
+  production host. This proves artifact integrity, not trusted publication.
+- A fresh-company HTTPS test at `71ebbec` passed with rebuilt agent and server
+  executables. It additionally verifies enrollment-preserving repair, rejection
+  of a changed transport identity, explicit consent opt-in/revocation,
+  administrator-only group policy changes, capability fields in signed grants,
+  and denied lease renewal after policy reduction. This is API/agent evidence,
+  not proof of native receiver enforcement or installer repair.
+- Existing RustDesk, hbbs and hbbr services remained running. Only the isolated
+  development management process was rebuilt and restarted.
+- Windows hypervisor API probing reports an available hypervisor. QEMU 11.1.0
+  passed its published SHA-512 checksum and runs from the separate local lab.
+  Official Server 2025 evaluation media downloaded successfully; its size and
+  SHA-256 are recorded outside Git. Guest boot attempts and failures are
+  documented in `deployment/windows/VM-TESTING.md`. No evaluation guest
+  installation has passed yet.
+
+## Requirements still to demonstrate
+
+A fresh-company HTTPS lifecycle run at `d6f1665` passed with clean source and
+newly built executables. It additionally verifies saved-target network
+diagnostics, management certificate/company-signature validation, and refusal
+to claim external or UDP reachability. Enrollment, permissions, branding and
+offline-consent recovery checks also passed in that run; native transport and
+clean-machine installation remain unverified.
+
+Initial setup now verifies installed endpoint and agent hashes/publishers against
+signed release metadata and records the release sequence before enabling the
+customer watcher. Technician setup copies its portable executable, agent and
+launcher to a durable per-user directory and creates a Start menu shortcut;
+launch no longer installs opportunistically from the extracted download. Rust
+compilation/component tests and PowerShell parsing pass. Actual signed setup,
+signed same-release repair, launcher use and uninstall remain unverified or incomplete.
+The explicit repair trust gate passes component tests and requires exact pinned
+metadata without allowing automatic-update replay; see INSTALLER_REPAIR.md.
+
+The built product executables at `20f88e3` additionally passed a fresh-company
+HTTPS lifecycle test with an offline-consent fault injected through the local
+proxy. Revocation remained durable locally during HTTP 503 responses; the
+server retained its older choice until the real agent watcher synchronized it,
+then denied unattended grant requests. Executable hashes, exact harness source
+dirty-state and the recovery result are recorded privately. Native sessions
+remain unverified.
+
+### Configuration-recovery native build verified (2026-10-21)
+
+Native Windows run `39600988305` completed successfully for exact public source
+`bd1350012227f226db168be51bc823d3f086e493`, containing both configuration-refresh
+fixes. Artifact `12349480599` was downloaded once and verified against its
+authenticated archive digest: 141,973,242 bytes, SHA-256
+`31bf6a8905de084dfe837afa5efaafc87f1e14a196b3d7acbace2e6fd5cc6c0b`.
+Its 24 entries passed bounded extraction, path and published checksum checks.
+The corresponding-source archive matched 1,111 public Git files and all six
+generated bridge files. The bridge input was independently fetched as artifact
+`12344994676`, SHA-256
+`d979023c7c01202fb93470a899cc2fdf7bf1d7825fd7151cb505a1ac6143930f`.
+Six server-setup source inputs and the existing component pins also matched.
+The build receipt still marks the checkout dirty; these source comparisons do
+not establish a clean build or binary reproducibility.
+
+Retained MSI lifecycle artifact `12349770219`, SHA-256
+`b1313134dafac51a8758a1958861b374dc5113c11dd59534a93fb78acce21246`,
+passed authenticated digest and ZIP checks. Its result records successful
+installation, repair and uninstall on Server 2022 Datacenter build 20348.
+The actual tested technician MSI, portable payload and agent hashes matched
+the main archive. This is unsigned payload lifecycle under the CI account,
+not company enrollment, standard-user GUI, signed upgrades, native sessions
+or a complete Server 2022 acceptance pass. The configuration fixes' native
+runtime recovery tests remain pending.
+
+### Clean Server 2025 MSI lifecycle and Server 2016 recovery (2026-10-21)
+
+A fresh official Windows Server 2025 Standard Evaluation Desktop Experience
+guest completed installation as x64 build 26100.32230. Its independent guest
+identity check passed. Provisioning disabled automatic sign-in and removed its
+stored automatic sign-in password. A lab SSH-key ACL error was diagnosed and
+corrected before product testing; Windows-provided SSH then passed the pinned
+host-key check. Setup used 4 GiB RAM; the controlled runtime boot used 3 GiB,
+retaining the host's 1.5 GiB reserve. Setup media was detached for that boot.
+A clean pre-product disk checkpoint passed an offline qcow2 integrity check.
+
+The independently verified `bd13500` customer and technician MSIs were staged
+with exact-source test helpers and verified again inside the guest. All six
+actual Windows Installer phases passed: install, repair and uninstall for each
+edition, each returning 0 without requesting a reboot. Installed package and
+agent hashes, MSI registration and technician shortcuts were checked. Customer
+checks additionally verified its complete installed-files manifest and running
+LocalSystem service. Customer repair replaced a deliberately damaged packaged
+license file with its expected bytes. Uninstall checks verified removal of the
+packaged files, relevant registration and customer service.
+
+The six results and raw MSI logs were exported over pinned SSH to protected
+host storage. Independent verification matched source revision, package and
+agent hashes, the exact test-runner hash and OS build; every log contained the
+zero-return completion marker without `Return value 3`. This establishes bare
+unsigned MSI lifecycle as Administrator on this particular Server 2025 build.
+Standard-user installation, company enrollment/branding, publisher acceptance,
+upgrades and native sessions on Server 2025 remain unverified. It is not a
+complete compatibility-matrix pass or production release approval.
+
+The previously hung Server 2016 guest was powered off after its normal shutdown
+request did not complete. This QEMU backend rejected memory snapshots. A full
+stopped-disk copy was therefore retained privately and verified against the
+original SHA-256; the original disk then passed its qcow2 integrity check.
+After boot, device identity/token, consent and release sequence matched the
+pre-reboot state, profile revision 16 remained accepted, and the customer,
+management and worker services were Running. Management HTTPS and configured
+status passed. The manually started candidate transport remained stopped as
+designed. The event log recorded an unclean shutdown; it did not establish
+the cause of the earlier unresponsiveness. This is crash-recovery evidence,
+not a complete encrypted deployment-restore or migration rehearsal.
+
+The following table preserves an earlier checkpoint. Use the current release
+gates above and the later dated evidence for current status.
+
+| Requirement | Historical checkpoint evidence and remaining work |
+| --- | --- |
+| Reproducible server, customer, technician and worker builds | Product components pass pinned builds. Native Windows build/package run 36998413349 passed at exact source `2eec008`. Later native source, including consent/reconnect/version and rollback changes, still needs CI and VM verification. Baseline rebuild and clean-machine installation are not newly proved. |
+| Fresh-company Windows/Linux setup | HTTPS/API setup works. The pinned Linux management image passes actual non-root/read-only fresh company setup, MFA, approval/policy rejection and restart persistence. Administrator network settings and server-vantage DNS/TCP/HTTPS company-signature diagnostics are implemented with access tests. Equivalent full setup wizards, transport provisioning, certificate management and external reachability checks remain incomplete; see NETWORK_DIAGNOSTICS.md. |
+| Roles, groups, permissions and revocation | MFA/group/device denial tests pass. Signed capability fields, administrator group policy APIs, and receiver capability bounds are implemented in source. Policy reduction denies lease renewal in component tests. Administration controls, native enforcement and direct-connection bypass tests remain unverified. |
+| Configurable customer and technician apps | Installed customer profile sync/cache and identity/consent preservation through signed explicit/automatic upgrades and reboot pass in the Server 2016 lab. Technician GUI branding/sign-in rendering and native CLI MFA/inventory/history/logout pass. Graphical login/session flows, full visual branding, shortcuts and the remaining Windows matrix are unverified. |
+| Signed profiles and rotation | Component tests reject tampering, wrong-company, expired and older profiles and untrusted key changes. Trusted cached key/endpoint rotation preserves enrollment in tests. Real isolated HTTPS trusted key rotation, missed-transition rejection and restored rotated trust pass for both CLI agents. Graphical installed-app behavior remains unverified. |
+| Approved managed sessions without password/direct bypass | Grant signature, target, challenge and replay checks pass component/API tests. Actual receiving-device enforcement, direct/relay paths, lease expiry and live revocation are unverified. |
+| Customer approval and unattended consent | API consent denial and durable local revocation tests pass. Server 2016 reboot preserves enrollment and consent and starts background services/watcher without desktop login. Real attended prompts, native unattended sessions, stop/uninstall, remote sign-in-screen access and UAC are unverified. |
+| Transfer, clipboard, multiple monitors | Native end-to-end tests pending. |
+| Public company transport without Tailscale | Source uses company transport and fails closed before setup. External NAT traversal, relay fallback and negative-access tests pending; no public endpoint has been changed. |
+| Windows worker and public/protected downloads | Real authenticated signed Windows worker jobs generated customer and technician bundles. Public customer download, protected technician download denial, customer MSI installation/repair/explicit upgrade, and standard-user technician EXE installation pass in the isolated Server 2016 lab. Current-source packaging, production website deployment and the full EXE/MSI/Windows matrix remain unverified. |
+| Signing and exact corresponding source | Certificate/hash/publisher pins and source metadata are implemented. Provider approval, production signatures, company signing integration and production release checks remain gates. |
+| Approved automatic updates | Signed customer MSI automatic upgrades, matching-payload MSI registration, rollout controls, no-op for installed/unapproved releases, interrupted-helper scheduled forward recovery and post-upgrade reboot persistence pass on Server 2016 with private lab trust. Metadata tamper/expiry and lock/snapshot/quarantine component checks pass. Active-session coordination, power loss during MSI, signed rollback, technician automatic upgrades, production signing and other Windows versions remain unverified; see RELEASE_PAYLOAD.md and the detailed evidence below. |
+| Backup, restore and migrations | Encrypted round-trip/tamper checks cover management, transport trust keys, SQLite, private deployment configuration and complete TLS storage trees. Real CLI export/restore and isolated HTTPS rehearsals preserve signing trust, MFA, accounts, devices, groups, consent and rotated keys; revoked grants remain denied. Restored SQLite quick_check passes. Schema upgrade requires encrypted pre-upgrade backup in component tests. Live transport/ACME renewal, post-backup reconciliation and full migration rollback remain unverified; see SERVER_BACKUP.md. |
+
+## Clean Windows matrix
+
+All rows remain intended release targets, not full compatibility claims. Passes
+below cover only the stated source, package, privileges and OS build. Later
+dated sections record package/media hashes and original failures; latest-source
+full acceptance remains open on every row.
+
+| Operating system | Clean installation | Repair/upgrade/recovery | Native session behavior |
+| --- | --- | --- | --- |
+| Windows 10 x64 | Standard Pro 19045.3803: administrator and standard-user technician tests, plus administrator customer MSI tests at `3bad169`; unactivated, license status 5, zero grace. Earlier LTSC evidence remains separately scoped. | Both accounts pass real technician 1.5.0-to-1.5.1 upgrade, missing-executable repair and uninstall. Customer install succeeds; repair returns 3010, actual reboot restores verified payload/service, then uninstall succeeds. Automatic updates and full qualification remain open. | Unverified. |
+| Windows 11 x64 | Fresh activated Enterprise Evaluation 26300.9457: both unsigned MSI 1.5.0 editions from `9e4ea6d` install as Administrator; Secure Boot and TPM 2.0 verified. | Nine install/repair/uninstall operations return 0 across administrator customer/technician and standard-user technician tests; customer license repair and technician missing-executable repair pass. Upgrade and interruption tests remain open. | Unverified. |
+| Server 2016 Desktop Experience | Existing 14393.693 customer deployment retained; fresh current-source company/customer setup unverified. | Administrative technician 1.5.0-to-1.5.1 upgrade, repair and uninstall at `699c9e0` pass; standard-user install returns policy error 1625. Full lifecycle/recovery remains open. | Older same-guest accepted session and `bd13500` receiver legacy-password denial. Later GUI/MFA/inventory checks include `699c9e0` technician-role API authorization and `3bad169` history-label regression. Separate-machine/full-feature acceptance open. |
+| Server 2019 Desktop Experience | Latest `4c5accb` technician MSI installs in a fresh administrator profile on retained 17763.3650. Preserved insecure customer state is not replaced for a positive install. | Technician real 1.5.0-to-1.5.1 upgrade, missing-file repair and uninstall pass. Latest customer MSI rejects original insecure state through its deferred preparation action before payload copy; positive current-source clean customer lifecycle remains open. Historical signed fixtures remain separately scoped. | Unverified. |
+| Server 2022 Desktop Experience | Both original unsigned `4c5accb` MSI editions install as Administrator on retained 20348.587. | Seven operations return 0: technician install/real 1.5.0-to-1.5.1 upgrade/repair/uninstall and customer install/repair/uninstall. Prior standard-user policy rejection and automatic update interruption remain open. | Unverified. |
+| Server 2025 Desktop Experience | Both original unsigned `4c5accb` MSI editions install as Administrator on retained 26100.32230. | Seven analogous lifecycle/major-upgrade operations return 0. Prior standard-user technician policy rejection remains separately recorded; automatic update and full recovery qualification remain open. | Unverified. |
+
+See [VM testing](../deployment/windows/VM-TESTING.md) and
+[local HTTPS testing](../deployment/windows/LOCAL-TESTING.md). Test credentials,
+signing keys, certificates with private keys, VM images and raw operational logs
+must remain outside public source. The project provides no shared company VPS.
+
+First-run branding now reads the protocol defaults from the management service,
+including the bundled swan/gear SVG and teal primary color. The server keeps its
+Swan wordmark and mark; existing company profiles are not rewritten. Product
+workspace tests (23) and administration JavaScript syntax checks pass. Graphical
+rendering and installed-app behavior remain to verify.
+
+Update recovery now retains session exclusion after process exit through the
+pending-update receipt. A new regression test verifies rejection after the
+exclusive process lock has closed; all 24 workspace tests pass. Installed-agent
+hash/publisher and Windows compatibility are included in recovery validation.
+Full signed agent replacement, retry/rollback and VM recovery remain unverified
+or incomplete.
+
+Staged signed-agent handoff and agent replacement are now implemented in source,
+including receipt-based retry and validation of the customer SYSTEM task before
+restart. Windows Rust compilation and existing 24 product tests pass; signed
+self-replacement, interrupted installer retry, scheduled-task restart and
+technician handoff require actual VM tests. Rollback remains incomplete.
+
+Recovery trust regression checks and shared validation pass with 25 Windows
+product workspace tests. Durable retry delay and failed-helper task restart are
+implemented in source and PowerShell parsing passes. These checks do not prove
+signed installation, power-loss recovery or rollback on clean Windows guests.
+
+Technician MSI authoring and a pinned WiX extraction/build recipe now produce
+an actual unsigned package locally. MSI tables and build-input hashes were
+inspected; no installer ran on the host. Technician setup/update support MSI
+containers and explicit external bootstrap input. Clean-guest install/upgrade,
+signing, customer MSI and complete uninstall cleanup remain acceptance gates;
+see deployment/windows/TECHNICIAN-MSI.md.
+
+Customer MSI authoring and the CLI recipe now build an actual unsigned package
+from the verified native 31b13aa payload, without executing product installers.
+The package includes the complete Flutter payload, local license and agent;
+service and Windows-owned broker copy/removal tables were inspected. Three new
+authoring tests and the existing three manifest tests pass. Clean-machine
+installation, signing, service/task lifecycle and recovery remain unverified;
+see deployment/windows/CUSTOMER-MSI.md. Native CI includes both MSI recipes.
+
+Explicit MSI repair now requests forced replacement and source re-caching
+through `/fvamus`, while retaining the exact pinned-release trust gate. Native
+x64 compatibility preflight and technician MSI launch conditions now reject
+ARM64; the preflight identifies the current host as windows_11. Clean-machine
+repair and ARM64 rejection still require runtime validation on those guests.
+
+Customer MSI registration now records its current product code and installation
+location. The customer app validates that registration against the installed
+Windows Installer product before requesting removal, resolves the Windows-owned
+msiexec executable directly, and refuses malformed registrations. Three MSI
+authoring tests and Rust parsing pass. Native compilation and clean-guest
+uninstall, service removal and complete scheduled-task/state cleanup remain
+unverified or incomplete.
+
+Native CI run 36982373150 compiled the apps but failed MSI packaging because
+the WiX extractor emitted COM return values alongside its executable path.
+Those values are now suppressed. A real pinned-package extraction verifies
+exactly one string result and WiX version 5.0.2; the CI rerun remains pending.
+
+All 25 existing product workspace tests passed on Windows after the MSI
+registration change. Shared key parsing additionally rejects weak Ed25519
+public keys; six protocol tests pass, including rejection of identity and
+zero encodings and acceptance of a generated key. Native packaging-fix CI
+run 36992817681 was confirmed queued; completion is not yet established.
+
+MSI update recovery now reads the verified staged package's product identity
+and queries Windows Installer registration before choosing installation or
+forced repair. An installed product uses `/fvamus`; an unknown or advertised
+product uses `/i`. Other-user and corrupt registrations fail closed. The real
+uninstalled lab MSI read-only probe returns `/i`, and all 26 product workspace
+tests pass. Installed-product repair, interruption recovery and rollback still
+require clean-guest tests. Product state meanings follow
+[Microsoft's Installer API](https://learn.microsoft.com/en-us/windows/win32/msi/installer-productstate-property).
+
+The installer worker now isolates claim parsing, build, upload and completion
+errors from its polling loop. Transient job failures are logged without exiting
+the worker; existing server claim expiry retains recovery. Windows cargo check
+passes. Immediate upload retry, idempotent completion and a real signed worker
+job with network fault injection remain incomplete or unverified. Native runs
+36992580109 and 36992817681 were confirmed in progress and queued respectively.
+
+Worker completion reporting now permits exact repeated terminal results from
+the original active worker and refuses conflicting results or revoked workers.
+A real management-handler regression test passes for initial completion, lost
+response retry, conflict and revocation, with saved-result integrity checked.
+The worker retries completion reporting up to three times for transport errors,
+server failures or rate limits; Windows compilation passes. Signed upload retry
+and full network-fault recovery still require implementation and verification.
+
+Artifact upload persistence now accepts an identical retry from the owning
+worker while the job is uploaded, and refuses changed bytes, another worker
+or uploads after completion. The storage regression test checks preserved
+bytes and state; all 28 product workspace tests pass. The worker uses bounded
+transient retries with a cloned buffered request body. This is storage-level
+evidence, not a signed end-to-end worker fault test. QEMU reports running but
+a fresh Server 2025 screenshot still shows boot; clean installation is unproven.
+
+The administrator branding/policy form now exposes stable/test channel and UTC
+maintenance start/end controls, saving through the existing authenticated signed
+profile API. Equal-hour and overnight descriptions match protocol semantics.
+JavaScript syntax and diff checks pass. Rendered form interaction and installed
+client rollout behavior remain unverified.
+
+Administrator account controls now expose technician disable and group-access
+revocation. Group removal closes affected grants transactionally; re-granting
+access cannot revive them. Account disable removes login sessions and closes
+all account grants in the same audited transaction. Expanded real API lifecycle
+checks pass for administrator-only removal, inventory/grant/renewal denial,
+re-grant non-revival and disabled-token rejection. JavaScript syntax passes.
+Native active-session termination on lease expiry and rendered controls remain
+unverified; no live company account was changed by these tests.
+
+Customer and technician branding forms now edit their logo and consent text
+independently. Saving no longer overwrites technician values with customer
+values. Both use the existing signed, validated edition profile fields;
+JavaScript syntax passes. Rendered interaction and installed edition branding
+synchronization remain unverified. Native runs 36992580109 and 36992817681 are
+still confirmed in progress; no completion result is inferred.
+
+At clean source 5be190d, the Windows GNU release workspace build succeeds.
+A release-profile local-CA rehearsal stops at the expected TLS trust check:
+release binaries ignore the debug-only test CA, and that protection was retained.
+A separately built development rehearsal profile then passes the actual isolated
+HTTPS lifecycle with fresh data and built agent/server executables, including
+group removal, inventory and new-grant denial, non-revival after re-grant, prior
+MFA/enrollment/branding checks and offline consent recovery. Exact binary hashes
+and private result records remain in ignored test data. This does not verify
+production certificate deployment, native sessions, signed installers or VMs.
+
+Device revocation/pending transitions and device group moves now close existing
+grants in the same audited transaction, preventing re-approval or moving back
+from reviving them. Unattended consent revocation permanently closes unattended
+grants while preserving attended grants. All 28 workspace tests pass, and the
+expanded API lifecycle additionally verifies re-consent non-revival, attended
+authorization preservation, device re-approval denial and group move/back denial
+including administrator grants. Native session shutdown on lease expiry remains
+unverified. Current native CI was confirmed building the branded client, with
+no terminal result yet.
+
+Group capability reductions now close incompatible grants transactionally.
+Restoring capabilities does not revive withdrawn authorization. Grant creation
+checks device/user/group access, snapshots permissions and inserts its grant
+and audit event in one transaction, avoiding a stale permission insertion
+after reduction. The expanded API lifecycle test passes, including restored
+policy non-revival and separate attended-consent preservation. Concurrent fault
+injection and native session termination remain unverified.
+
+Disabling company-wide unattended support now closes all unattended grants in
+the profile-update transaction. Restoring that setting cannot revive them, and
+attended authorization is preserved. Grant creation reads company policy within
+the same transaction as access checks and permission snapshots. Expanded API
+lifecycle tests pass for global disable/restore non-revival, attended renewal
+and a fresh grant followed by local consent revocation. Concurrent fault tests
+and native termination behavior remain unverified.
+
+Signed edition branding now supports public support-contact text and up to eight
+named HTTPS website shortcuts. Administration edits each edition independently;
+both native endpoint pages use a shared contact/link component. Shortcuts cannot
+execute shell commands, local files or non-HTTPS schemes. Empty fields preserve
+existing serialized branding, and old profiles deserialize with defaults. All
+29 workspace tests pass, including credential-bearing/unsafe URLs, invalid
+labels, excessive links and control characters. JavaScript syntax and native
+Rust parsing pass. Flutter compilation, rendering and installed synchronization
+remain unverified. Upgrade clients to compatible builds before publishing new
+nonempty branding fields; older strict clients will reject unfamiliar fields.
+
+Optional local company artifact signing now has an explicit pinned-input helper
+using a company certificate's local private-key provider and Microsoft-signed
+SDK SignTool. It signs separate copies, requires trusted publisher/certificate
+verification and a timestamp, and records final hashes. PowerShell parsing and
+wrong-input-hash rejection pass against a real unsigned agent with no source
+change or output. No actual signature was made. Provider/certificate signing,
+worker consumption, signed installs/updates and release-issuer migration remain
+unverified or incomplete; see deployment/windows/COMPANY-SIGNING.md.
+
+Technician approved-release discovery now uses its authenticated Rust session
+and shares signature, edition, channel, expiry and sequence validation with the
+installer. The GUI receives only public release identity; bearer credentials
+remain in Rust. Installed sequences are not offered again, and pause/maintenance
+policy applies. All 29 workspace tests and native Rust parsing pass. Flutter
+compilation and end-to-end authenticated discovery remain unverified. This is
+discovery only: automatic GUI shutdown, session-safe installation handoff and
+full interrupted-update recovery/rollback remain incomplete.
+
+Outgoing managed connection loops now own their activity locks from before
+transport establishment until loop exit. Closing one window does not permit an
+update while another connection remains active, and the last disconnected
+connection no longer keeps a process-wide lock forever. Proof generation also
+checks the installation guard before consuming its ticket. All 30 workspace
+tests pass, including simultaneous independent locks and Windows installer byte
+lock exclusion. Native Rust parsing passes. Native connection lifecycle and
+GUI shutdown/restart during signed installation still require end-to-end tests.
+
+Portable technician and configuration-agent replacements now write and flush a
+complete, hash-verified staging file on the destination volume before replacing
+the installed file. Replacement failures retain the previous destination and
+remove staging files; Windows sharing conflicts use a bounded retry. All 31
+workspace tests pass, including hash rejection, successful replacement, unchanged
+source and failed-replacement cleanup on Windows. This reduces partial-write
+failure exposure; power-loss testing, signed executable replacement, MSI rollback
+and complete interrupted-upgrade recovery remain unverified or incomplete.
+
+Technician refresh now requests automatic update handoff through its Rust login.
+Open connection windows defer the request; native locks and signed recovery
+receipts coordinate other processes. The GUI closes only after a verified helper
+has been launched, and the helper restarts the verified technician executable
+without credentials after success. Existing pending handoffs use bounded retry.
+All 31 workspace tests and native Rust parsing pass. GUI compilation, signed
+end-to-end shutdown/install/restart, offline pending recovery and full rollback
+remain unverified or incomplete; this flow is not yet release acceptance.
+
+New update installation now refreshes signed company configuration and queries
+current release approval after downloads. Withdrawn or changed selections defer
+handoff; the newest saved pause/maintenance policy is checked again under session
+exclusion before writing the receipt. All 32 workspace tests pass, including a
+persisted signed-policy change that pauses or moves the window after an older
+snapshot was eligible. Real HTTP withdrawal during downloads and signed Windows
+installation still require end-to-end evidence. Existing installation receipts
+retain recovery semantics rather than starting a new policy-controlled upgrade.
+
+Technician refresh now attempts pending signed-installation recovery before
+network sync, login or inventory. The local native action cannot choose a new
+release; it retains receipt signature, sequence, staged helper, publisher and
+session-exclusion checks, and runs blocking verification outside the async
+executor. Cached branding is displayed before these operations. Native Rust
+parsing passes; the existing 32 component tests remain the last workspace
+evidence. This new GUI path still needs native compilation and a real offline
+interrupted-installation test. The QEMU process is confirmed live; no completed
+clean Windows installation is demonstrated and VirtualBox remains uninstalled.
+
+Automatic updater Windows compatibility checks, publisher verification, pending
+recovery and final receipt/helper handoff now run in blocking workers. Final
+session exclusion is acquired and released wholly within one worker, without
+holding its file lock across an async wait. All 32 workspace tests pass. Native
+GUI executor responsiveness and signed update handoff remain unverified.
+
+Administrators can now withdraw individual release approval from the release
+page or DELETE its approval endpoint. Approval withdrawal and its audit event
+commit atomically; technicians are denied. Eight management tests pass, including
+withdrawal stopping update selection, edition/channel separation, pause and
+zero-percent rollout. Web JavaScript syntax passes. Browser interaction and real
+HTTP withdrawal during client downloads remain unverified. Previously generated
+bundles and already-started installation recovery are not removed by withdrawal.
+
+Release withdrawal now also fails matching queued/running/uploaded build jobs
+within its transaction and refuses new downloads of completed bundles while
+approval is absent. Existing files are retained; already downloaded copies and
+started installation recovery are unaffected. Build creation keeps its approval
+check and queue insertion under the same database lock. All eight management
+tests pass, including three job states and completed-bundle download denial.
+Worker/network race fault injection and browser behavior remain unverified.
+
+The withdrawal regression now exercises a real authenticated worker claim and
+stored fixture artifact: late persistence, failure completion and success
+completion are rejected after withdrawal, stored bytes remain unchanged, and
+restoring approval does not revive or requeue cancelled claims. Eight management
+tests pass; the final expanded withdrawal test also passes independently. This
+uses handler/storage fixtures, not a signed installer worker end-to-end run;
+simultaneous network faults and production package publication remain unverified.
+
+Technician inventory/history now display before optional update discovery and
+handoff. Update errors have a separate visible status and no longer discard
+fresh inventory. The native recovery response exposes a public pending flag;
+pending/failed recovery is visible and disables new connection controls while
+native receipt and file-lock enforcement remains authoritative. Native Rust
+parsing and diff checks pass. Flutter compilation, rendering and responsiveness
+during long downloads remain unverified. The branding native run is confirmed
+live in dependency installation; later native runs remain queued.
+
+Technician update preparation now runs as one native background task instead
+of holding the refresh request open through downloads/signature verification.
+The UI polls public running/failed/handoff flags independently, keeps login
+credentials in Rust, and closes only after verified handoff. Recovery avoids
+launching another helper while that task is active. Final native session locks,
+fresh server approval and pending receipts remain installation gates. Rust
+parsing and diff checks pass; source inspection confirms the task uses the
+existing persistent Tokio runner. Native compilation, task responsiveness and
+GUI/session races still require end-to-end validation.
+
+Consumed native technician ticket handles now retain bounded, login-generation
+bound reconnection context without grants or proof keys. A reconnect requests a
+new server grant and ephemeral proof key, verifies the original device/peer and
+consent mode, and rejects logout or login changes. Attended sessions still need
+customer approval; reconnection never upgrades them to unattended access.
+Logout/login/update handoff clear the context. Native Rust parsing and diff
+checks pass. Reboot reconnection, concurrent-window behavior, revocation during
+reconnect and full native compilation remain unverified.
+
+Managed peer-information handling now clears inherited peer passwords and skips
+upstream password/address-book synchronization. Legacy UI password submission
+is refused before constructing a network login; managed challenge proofs still
+use their separate native path. These guards apply only to the managed build,
+preserving baseline source behavior. Rust parsing and diff checks pass. Native
+compilation, saved-settings inspection and negative legacy-UI tests remain
+unverified; receiver-side signed authorization remains the access boundary.
+
+Customer consent changes now use acknowledged asynchronous service IPC through
+the existing company request bridge. Enable acknowledges only after server
+acceptance and local persistence. Revoke persists locally first, then reports
+whether server sync succeeded; the UI distinguishes pending sync and refuses to
+claim success after an error/timeout. Consent buttons prevent overlapping UI
+requests. Existing consent revision checks still reject a delayed enable after
+revocation. Rust parsing and diff checks pass. Full Windows service IPC, offline
+revocation feedback, persistence failures and UI rendering remain unverified.
+
+An independent official Windows Server 2016 evaluation VM is now provisioned
+and running with a separate 64 GB disk, 2 GB memory, one CPU and user NAT without
+forwarded ports. Its fresh screenshot confirms the Windows Setup language page.
+The evaluation download completed with recorded origin/hash; private VM metadata
+and screenshots remain outside the repository. The existing Server 2025 VM is
+still running at its boot screen and was not restarted. No clean Windows install
+or product installation has passed yet. Native build 37002003558 is queued at
+0c71544, covering the acknowledged customer-consent source.
+
+The Server 2016 VM has now selected Standard Evaluation with Desktop Experience
+and started installation on its empty virtual disk. File preparation reached
+81%; this is provisioning progress, not a completed OS or product test.
+
+Management backup accepts `--tls-directory` for the complete HTTPS storage tree.
+Nested certificate-key and ACME account fixtures survive authenticated encrypted
+export/restore. Restore rejects traversal, Windows filename collisions and
+file/directory conflicts before creating its target. Nine management tests pass;
+the three backup tests also pass after adding malformed encrypted archive cases.
+Live certificate renewal, transport restore and migration rollback remain open.
+
+Server 2016 has completed file preparation, features and its first reboot. It
+is now at the initial administrator-password screen; desktop provisioning and
+product tests are pending. The computer-use authentication boundary requires
+user completion of that screen.
+
+Customer MSI now schedules a SYSTEM configuration-task cleanup action before
+file removal, with paired rollback and exclusion during major upgrades. It
+checks exact task ownership, preserves company state, and records the previous
+enabled/running state for rollback. Windows agent compilation, script parsing,
+three MSI authoring tests and real unsigned WiX packaging pass. Installer-table
+inspection verifies action order. This does not establish actual uninstall,
+rollback, task cleanup or service behavior; clean-guest tests remain open.
+
+Configurable endpoint source now identifies itself as 1.5.0 (Flutter build 68),
+separately from the tagged 1.4.9 Swan baseline. Cargo, portable packer, lockfile,
+Flutter and Windows artifact versions agree in a local source check. Native CI
+checks app/packer/Flutter/artifact version agreement before building. This is a
+development version change; no release tag or signed production publication has
+been made, and native build/upgrade behavior must still be demonstrated.
+
+Management now provides offline prepare/activate profile-key commands. They
+publish a replacement under the existing key before activation, require
+operator confirmation of client synchronization, and atomically update active
+key/profile state in SQLite. Activation closes grants and invalidates installer
+jobs with old bootstrap trust. A process lock prevents simultaneous upgraded
+management instances. Schema-1 migration requires an encrypted pre-upgrade
+backup; restored active keys and revisions survive component tests. Eleven
+management tests pass, including rotation, migration and backup recovery.
+Installed-app HTTPS rotation and live migration rollback remain unverified.
+
+An isolated real HTTPS rehearsal with management/agent binaries built at
+7843334 now passes trusted profile-key rotation for both agent editions.
+Enrollment, device token and revoked consent persist; a client missing the
+transition rejects the new key; activation without explicit confirmation fails;
+restart retains the active key. Renewal of a claimed, still-unexpired grant is
+denied after activation. Private results record binary hashes and note the
+uncommitted harness in the worktree. Owned fixture listeners stopped afterward.
+Graphical installed apps, actual session termination, production certificates
+and full migration rollback remain separate unverified acceptance gates.
+
+The HTTPS rotation harness now exercises actual management CLI encrypted export
+and restore of rotated company data, private configuration and real HTTPS
+PFX/certificate storage. A replacement HTTPS proxy uses those restored files;
+the active profile key and device credential remain valid and the closed grant
+stays denied. The rehearsal passes again after rebuilding startup and rotation
+operations onto blocking worker threads. Private results record the binary
+hashes and dirty source state; both fixture listeners stop. Live ACME renewal,
+hbbs/hbbr restoration and Windows native acceptance remain unverified.
+
+The administration branding form now uses separate shortcut name/HTTPS-address
+fields with add/remove controls and an eight-entry limit. Valid names and URLs
+containing pipe characters survive editing without delimiter ambiguity. A local
+JavaScript regression check verifies exact pipe/whitespace preservation, blank
+row omission, incomplete-entry rejection and HTML attribute escaping. JavaScript
+syntax and diff checks pass. Browser interaction, accessibility and installed-app
+shortcut rendering remain unverified.
+
+The Windows installer worker now stages downloaded files through asynchronous
+filesystem operations and runs Authenticode verification, ZIP compression,
+artifact hashing and immutable publication in a blocking worker task. Windows
+compilation passes. Real signed worker packaging, upload faults and publication
+remain unverified. After company profile-key activation, operators must update
+the worker's privately configured profile-key pin before rebuilding packages;
+automatic worker trust-pin rotation is not implemented.
+
+At source `7335010`, all 37 product workspace component tests pass on the local
+Windows GNU toolchain. Update downloads now flush unique staging files before
+atomic publication rather than overwriting a complete staged artifact in place.
+
+The subsequent recovery change re-downloads missing or hash-damaged artifacts
+from the exact signed pending receipt, rechecks the publisher and unchanged
+receipt, and retains session exclusion at handoff. Technician recovery runs in
+the background with the existing native progress guard. The agent Windows build
+and its 20 ordinary component tests pass. A separate explicitly ignored real
+HTTPS download test passes through `test-update-download.js`: an HTTPS redirect
+carries no authorization or cookie headers, and tampered or interrupted responses
+leave complete staging intact. Private evidence records the executable hash and
+dirty source state. This transport regression does not execute a native installer,
+prove successful signed recovery, or complete automatic rollback. Native Rust
+syntax parses locally; the changed Rust/Flutter integration requires CI and VM
+verification.
+
+GitHub native build run 36998413349 at `2eec008` is confirmed successful.
+Run 37005806648 at `4164964` remains queued as of the latest direct API check;
+neither run proves the subsequent online recovery implementation.
+
+The superseded queued run 37005806648 was subsequently cancelled after checking
+its current queued status. Replacement native build 37010780710 targets
+`111abe3`, covering online recovery and background technician handoff; it was
+confirmed queued when dispatched.
+
+New update preparation now requires a recorded signed installed release and
+preserves its full endpoint manifest and configuration agent in a verified,
+immutable rollback snapshot before writing the update receipt. The receipt
+includes the exact previous signed envelope. The helper rejects a mismatched or
+damaged snapshot before changing installed files. Branding, credentials, identity
+and consent remain outside the software snapshot. Windows agent compilation and
+21 ordinary agent tests pass (the separate real-HTTPS transport test is explicitly
+ignored in this ordinary run). Further targeted tests pass for complete snapshots,
+tampered and missing sources, unsafe paths, cleanup, immutable publication, and
+previous-release signature/edition/sequence checks after metadata expiry. This is
+verified rollback preparation, not completed automatic rollback: restoration,
+failed-release suppression, MSI/service consistency and native power-loss testing
+remain unfinished.
+
+Portable technician EXE rollback is now implemented for a previous release whose
+signed metadata declares `rollback_protocol: 1` and whose verified agent confirms
+that support. It preserves the old installed sequence, writes a durable pending
+rollback phase before restoring signed snapshot files, verifies the restored
+identity, and publishes a signed-envelope failed-release quarantine before
+removing the pending marker. New discovery/installation suppresses that sequence
+and older ones; later approved releases remain eligible. Current branding,
+enrollment and consent are not restored from software snapshots. Customer/MSI
+restoration and service/registration consistency remain unfinished.
+
+All 39 ordinary product workspace tests pass for this change. The real-HTTPS
+download test is explicitly ignored in that ordinary run. Targeted quarantine
+and receipt tests additionally pass after initial receipt publication became
+atomic and unable to overwrite an existing receipt. The Windows agent build
+passes, and its read-only capability command returns protocol 1 without creating
+company state. Native Rust syntax parses locally; native Rust/Flutter compilation
+and actual signed rollback, reboot/interruption and installer tests remain gates.
+
+Update discovery now filters approved releases by the installed EXE/MSI format.
+Clients derive the query from the verified signed installed-release envelope and
+independently reject a mismatched server response. Server component regressions
+select the older matching MSI despite a newer EXE, select the EXE when requested,
+retain legacy unfiltered discovery, reject unsupported formats and unauthenticated
+requests, and stop offering a withdrawn matching release. These checks use valid
+release metadata. The targeted management test and Windows product workspace
+compilation pass. Real signed mixed-format rollout and native upgrades remain
+unverified.
+
+Installer retention now preserves exact hash/publisher-verified installation
+packages during setup, repair and completed update/recovery. New software
+snapshots include the previous installer alongside the verified files, allowing
+future MSI registration restoration to use its actual original package. Missing
+old caches can re-fetch only the exact recorded artifact before update handoff.
+Wrong hashes and unsigned installers are rejected before cache publication in a
+local Windows negative test; actual signed Swan installer retention remains unverified.
+
+The same retention regression subsequently passes a positive Authenticode check
+using a Windows-signed executable copied to the private temporary fixture, with
+the actual publisher and certificate fingerprint. Wrong publisher and certificate
+pins retain the previous valid cache. That executable is never executed and no
+certificate is created or installed. Actual signed Swan installation packages
+and MSI registration recovery remain unverified.
+
+Review also corrected the misplaced installing-only phase check that prevented
+rollback handoff after restart. Completion-only recovery now owns that check;
+pending rollback remains eligible for helper handoff. The shared phase/quarantine
+regression passes, but native reboot/rollback still needs testing. Windows agent
+and worker builds and workspace compilation pass. Their Windows PowerShell
+commands now use the OS system directory and built-in module path; actual built-in
+hash/signature command availability and unsigned-package rejection pass when
+invoked from the PowerShell 7 development environment. Company installer script
+syntax passes. No signed installer, MSI restoration or clean Windows acceptance
+is implied by these component checks.
+
+After these corrections, all 39 ordinary product workspace component tests pass
+again on Windows. The separate HTTPS download test is explicitly ignored in that
+run. This includes actual Authenticode positive retention and wrong-certificate
+rejection for the copied OS fixture, not execution of an installation package.
+
+MSI installation, repair, update commands and Windows worker packaging now
+check the package database identity after signature validation. The edition's
+fixed UpgradeCode, canonical ProductCode, exact signed ProductVersion and x64
+summary template must match. The database is opened read-only; inspection does
+not run installer actions. Explicit fixture tests passed against the actual
+unsigned customer and technician 1.4.9 MSIs, rejecting the opposite edition and
+wrong version and confirming unchanged artifact hashes. Synthetic checks also
+reject malformed product identifiers and non-x64 packages. These identity-only
+fixture tests do not bypass publication signature requirements. Agent and worker
+Windows builds pass; signed installation and native MSI rollback remain gates.
+
+Technician rollback now includes MSI registration recovery using the verified
+previous installer. Recovery validates edition-specific related registrations
+and their cached product identities before narrowly removing the failed product
+and reinstalling or repairing the previous one. Unexpected registrations fail
+closed. Durable rollback retries re-fetch only the exact signed failed MSI when
+its staged copy is missing, because its ProductCode is needed for narrow removal.
+Previous software identity must verify before failed-release quarantine clears
+session exclusion; enrollment and consent remain current. All 21 ordinary agent
+tests pass (two fixture tests excluded); the actual technician MSI read-only
+planning fixture separately passes, including incorrect previous-version
+rejection and no installer execution. Script syntax and Windows compilation
+pass. Native MSI rollback, reboot/interruption, customer service rollback and
+the complete clean Windows matrix remain unverified.
+
+Customer MSI recovery now shares the verified registration path, with exact
+customer service executable/account checks before removal, automatic/running
+service verification after restoration, and owned configuration-task recreation
+after signed installed-file verification. Task startup is deferred until helper
+completion. Component tests reject another installation's service, a different
+account, stopped/manual service and unexpected executable arguments without
+querying or modifying any native service. Both actual MSI fixtures pass
+read-only planning and reject incorrect previous versions. Rollback eligibility
+regressions accept both MSI editions and reject cross-edition, protocol-0,
+format-changing and customer-EXE rollback. Windows compilation, script syntax
+and customer MSI authoring tests pass. No installer or service operation ran on
+the host. Customer EXE rollback and autonomous reboot recovery between removal
+and restoration remain unfinished; native MSI/service/task restoration and all
+clean-machine acceptance remain unverified.
+
+Durable update task handoff now registers the verified staged helper outside
+MSI-owned installed files. Customer startup/SYSTEM and technician logon/limited
+user tasks retry every five minutes, derive state from their staged location,
+and revalidate signed pending metadata and helper identity. Own-task cleanup
+refuses mismatched task path, actions, arguments or principal. Explicit MSI
+uninstall cancels recovery and sessions before file removal; paired uninstall
+rollback preserves any earlier cancellation. Signed MSI recovery excludes
+those cancellation actions. This implements the reboot retry mechanism but
+does not demonstrate native reboot recovery.
+
+All 21 ordinary agent tests pass again, including cancellation session rejection;
+agent and worker Windows builds pass. Task ownership and isolated cancellation
+file tests pass, including malformed rollback rejection. Read-only task planning
+and Scheduled Task object creation confirm intended principals and five-minute
+repetition without registering any task. Both unsigned MSI recipes compile
+against historical 1.4.9 native inputs; read-only tables confirm cancellation
+rollback at 3498, cancellation at 3499 and file removal at 3500, excluded during
+upgrades and signed recovery. No product installer, service or native task
+mutation ran on this host. Signed task registration, startup/logon, reboot,
+explicit cancelled-update reinstall handling and customer EXE rollback still
+need implementation/verification as applicable; the full clean Windows matrix
+and current native build remain gates.
+
+Explicit setup now handles cancelled pending updates after incoming package
+validation: it takes the activity lock, atomically prepares an immutable setup
+marker and archives the exact old receipt without changing identity, consent or
+sequence. Active recovery, tampered/foreign metadata, sequence replay,
+conflicting archives and competing setup markers are rejected. Identical
+preparation retries preserve evidence; exact committed setup metadata can finish
+interrupted marker cleanup without allowing ordinary replay. The wrapper checks
+the prepared marker instead of truncating it. A Windows component rehearsal
+passes actual hash/publisher verification using a copied Windows-signed OS
+executable, without executing it; bad bytes leave both pending evidence and
+setup state unchanged. Targeted signed-recovery regressions, script parsing and
+Windows agent/worker compilation pass. The MSI mode inspector reads an actual
+unsigned uninstalled technician package and selects installation without running
+it. Company bundles now include the inspector, and installer execution resolves
+the OS system directory. Actual Swan-signed setup, MSI repair, cancelled-update
+uninstall/reinstall and complete clean Windows acceptance remain unverified.
+
+Customer EXE rollback now uses its retained verified original package, refuses
+MSI-managed and unrelated registrations/services, verifies automatic service
+startup and full installed identity, then applies the existing quarantine without
+restoring enrollment or consent. Explicit EXE uninstall embeds a fixed encoded
+cancellation/task-ownership script in its elevated uninstall batch; no profile
+field provides commands. Stable native service/process names containing spaces
+are quoted. SYSTEM install command execution avoids the interactive elevation
+route. Silent portable packages now wait for their extracted installer and
+propagate its exit status instead of racing installed-file verification.
+
+Targeted signed recovery regressions and Windows agent/worker builds pass. Pure
+service ownership tests pass for both MSI and EXE scripts without querying or
+modifying services. Three standalone Windows portable-wait tests pass, including
+actual child completion/failure and launch failure; these test the exact wait
+module used by the packer, not a packaged application install. New scripts and
+native Rust syntax parse. Full current native app/packer compilation, EXE
+uninstall/service restoration, signed rollback, reboot and clean Windows matrix
+acceptance remain unverified. No native uninstall/cancellation script, installer
+or service operation executed on this development host.
+
+Linux deployment now has a Dockerfile-specific deny-by-default context for named
+public build inputs; Git-ignored company environment files, keys, databases and
+build caches cannot intentionally be copied by the deployment recipe. A new CI
+check uses Docker's scratch exporter against tracked public source and synthetic
+configuration/key/cache canaries, and rejects missing or unexpected exported
+files. A separate real-image rehearsal exercises non-root/read-only operation,
+private storage permissions, fresh company setup, MFA/replay rejection, pending
+enrollment, unattended-policy denial, graceful Docker SIGTERM shutdown, persisted
+identity/approval/consent and logout after restart. Linux management now handles
+SIGTERM as well as Ctrl+C.
+
+Python syntax and fixture assembly (38 required public inputs and 11 exclusion
+canaries), Compose schema/configuration and Windows GNU management compilation
+pass locally. Neither new Docker execution check has passed yet: the local
+Docker Desktop startup reports an inference-service socket error before its
+Linux engine is usable. Existing Docker data was not reset. The new CI job must
+pass before claiming this Linux deployment evidence. Public HTTPS, native
+transport, full backup/restore/migration recovery, real package installation and
+the complete clean Windows matrix remain separate acceptance gates.
+
+Distribution validation now accepts the complete ten-file worker recipe for both
+editions and EXE/MSI formats. It rejects changed scripts, hidden duplicate ZIP
+entries, inconsistent archive headers, altered metadata and wrong company trust.
+The worker verifies both artifact signatures and applies MSI identity checks only
+to the installer. Nineteen management/protocol tests and the worker verification
+regression pass; these fixtures do not demonstrate signed native installation.
+
+A disposable Debian 12 VM now runs Docker. Its real scratch-export check passed:
+all 38 required public inputs were included and all 11 synthetic private-data
+canaries were excluded. Older Docker required root exclusion rules and explicit
+child exclusions after directory allowances; both shipped ignore files now agree.
+The complete management image and container lifecycle rehearsal remain pending.
+
+At source `9988038`, the complete Windows GNU product-workspace test run passed
+41 tests with zero failures. Two explicitly fixture-dependent tests were skipped:
+the isolated HTTPS download-recovery harness and read-only MSI identity check.
+These skips do not prove those requirements at this source. The agent suite
+exercised actual read-only Authenticode checks and expected rejection paths;
+no native installer, service installation or desktop session was executed.
+
+Installer upload validation now hashes expanded binaries through a fixed 64 KiB
+buffer instead of allocating a complete expanded binary. The 512 MiB per-entry
+limit, signed hash comparison and ZIP CRC rejection remain enforced. Seven
+management worker/distribution regressions pass, including a real compressed ZIP
+fixture that verifies exact-boundary success, expansion-limit rejection and CRC
+corruption rejection. Full native package generation remains unverified.
+
+At clean source `059f675`, the dedicated HTTPS recovery harness also passed
+against the current agent test executable. It verified redirect handling,
+artifact tamper/interruption rejection, retention of complete staged bytes,
+cleanup and absence of credentials in artifact requests. Both customer and
+technician unsigned 1.4.9 MSI fixtures passed the current read-only edition,
+version and recovery-plan checks, including wrong-identity rejection and unchanged
+package bytes. These checks close the ordinary suite's two skipped fixture tests
+for their stated scope; they do not establish current native MSI installation,
+trusted production signing, service/task changes or upgrade restoration.
+
+The first Linux management image built and its intermediate container rehearsal
+passed fresh company setup, non-root/read-only execution, private storage, MFA
+and replay rejection, pending enrollment and unattended-policy rejection, clean
+SIGTERM shutdown, persisted company/device/consent state and logout denial.
+The rehearsal exposed a test bug: Docker changed its dynamically assigned
+loopback port after restart. The harness now refreshes and validates that mapping
+on every start. This intermediate image required an explicit SSL_CERT_FILE test
+environment; the exact `059f675` image and its default certificate environment
+remain pending. This evidence does not prove public HTTPS or native transport.
+
+The Linux management image built from required inputs at exact source `059f675`
+is `sha256:d4308f1b5714a1cd56987af5aa0c3f51db31e64b33c104e2e610638a0786129a`.
+Its management executable hash is
+`db7716c7dc61a13af14de68dbd4e197b30ca8b565966638e9e8303ec069b5d9b`;
+the public certificate bundle matches the pinned builder. The corrected test
+driver, maintained separately from the image build inputs, passed default
+certificate-path checks, non-root/read-only startup, fresh setup, MFA/replay
+rejection, approval/consent policy, graceful SIGTERM and restart persistence.
+The expanded driver then passed actual encrypted management CLI export and
+restore to a separate volume, wrong-password authentication rejection with no
+target writes, private key permissions, retained branding/policy/device/consent,
+fresh MFA login, replay/logout denial and revoked-device rejection. Revocation
+in the restored deployment did not mutate the original volume. No backup
+passphrase was placed in command arguments or Docker container metadata.
+These results prove management-container recovery only. Full transport/TLS
+volume recovery, public HTTPS/ACME, native sessions, installers and the clean
+Windows matrix remain required acceptance gates.
+
+The pinned Caddy `2.10.2` and RustDesk server `1.1.15` images now pass an actual
+isolated component-stack rehearsal with the exact `059f675` management image.
+The proxy recipe uses a disposable internal issuer with trust installation
+disabled; HTTPS validates through an explicit test CA, while default system
+trust rejects it. Fresh company setup, MFA replay rejection, pending enrollment
+and logout denial pass through HTTPS. OpenSSL verifies actual management profile
+signatures and rejects modified payloads and wrong keys. Both rendezvous TCP
+ports return real native TestNatResponse messages before and after restart;
+relay TCP accepts a local connection. Company signing identity, transport public
+key and the configured HTTPS endpoint survive restart. The test removes only
+its uniquely named containers, volumes and network. Production recipes, DNS,
+firewall and host trust stores were not modified for this rehearsal.
+These results do not prove UDP or external NAT traversal, native remote-session
+authorization, public ACME issuance/renewal or full transport/TLS-volume restore.
+
+The extended Linux stack rehearsal now passes complete encrypted CLI export of
+management, actual transport keys/database, private deployment settings and
+Caddy certificate storage, followed by restore into separate volumes. Incorrect
+passwords fail before target writes; recovered transport keys, environment and
+every TLS file match the originals. Replacement management, rendezvous, relay
+and HTTPS containers start using the restored data. The original CA validates
+HTTPS, company profile signatures and transport identity persist, and fresh
+MFA login, replay/logout denial, pending enrollment, consent and device
+revocation pass. The restarted original retains its pending device after the
+replacement revokes its own copy. The compiled management image still uses
+exact required source inputs at `059f675`; only excluded test drivers changed.
+This establishes isolated component recovery, including actual transport and
+TLS storage. It does not establish public ACME, external traversal, authorized
+remote desktop sessions, populated transport-peer recovery, migration rollback,
+native Windows installation or the compatibility matrix.
+
+Windows server component preparation now passes with the actual pinned
+RustDesk server 1.1.15 and Caddy 2.10.2 Windows archives. Both archive SHA-256
+values match upstream release asset metadata; extraction produces only the
+expected component executables and the public manifest. Read-only PE inspection
+confirms x64 executables. An invalid archive is rejected before output creation.
+All three supplier executables report `NotSigned`; hash pinning does not supply
+production Authenticode trust. No supplier installer or component was executed,
+and no services or firewall settings changed. Combined Windows server setup,
+service supervision, HTTPS provisioning, signing and native lifecycle tests
+remain incomplete.
+
+Windows management now supports supervised packaged rendezvous, relay and
+HTTPS children. The full-stack install script pins their executable hashes,
+retains license/source notices, validates the company hostname, rejects
+occupied ports and existing data, configures the proxy and private storage,
+and checks management startup. Windows GNU management tests pass: 18 ordinary
+tests, with two child-process fixtures invoked by lifecycle tests. Actual
+Windows child processes are reaped on stop and partial startup failure;
+component exit stops management. A process-owner crash test observes its
+assigned child terminate through Windows job-object cleanup. Private preflight
+with the actual supplier binaries accepts their hashes, and changing one byte
+of the relay rejects it without starting services. PowerShell scripts parse,
+and preparation preserves upstream licenses/source references.
+The privileged installer itself has not run on a clean Windows VM. SCM startup,
+firewall rollback, reboot/service recovery, public HTTPS/ACME, live Windows
+transport sessions, repair/uninstall and the graphical setup wrapper remain
+unverified or incomplete. These process tests do not satisfy those gates.
+
+Server installation now records public ownership metadata in protected company
+storage. `Uninstall-Server.ps1` validates that receipt and exact service command,
+refuses redirected directories/files and unexpected firewall ownership, then
+removes the company service, its rules and known packaged files while retaining
+all company data. Removal-plan checks pass under both PowerShell 7 and Windows
+PowerShell 5.1, including wrong executable/arguments, company paths, rule names,
+duplicate rules, invalid policy types, a directory substituted for a file and
+an actual directory junction. The fixtures preserve their identity data and do
+not run SCM or firewall operations. The installer additionally requires a valid
+management signature matching an explicit trusted certificate thumbprint.
+Native privileged install/uninstall, retained-data reinstallation and full
+Windows compatibility remain unverified; receipt planning is not their proof.
+
+The Windows server setup form now collects company hostname, public release
+trust, expected publisher, signed management and prepared components, then
+invokes the installer with structured parameters in a background PowerShell
+instance. It disables installation without administrator rights and prevents
+closing during installation. Successful completion enables HTTPS company
+setup; failures show the installer error. Its Windows PowerShell 5.1 preview
+renders and was visually inspected, without displaying the form or starting
+services. This proves layout construction only. Privileged wizard actions,
+interactive setup, backend completion/error events and a signed packaged
+launcher remain unverified or incomplete.
+
+The exact `8cfdd8f` required public source inputs now build the pinned Linux
+management image `sha256:0410d99dd9995bf95854dff50621030aeefa567f73b07e5b4f4dd381cdfd5fb3`.
+The source archive SHA-256 is `3b40abde298095bad99347aad1bf5ee3a9b5ed855ea1788d8926038cc81cd72a`;
+the management binary SHA-256 is `c0182c6785480dc47b5220689146da3bee7d00362f17ee1f400233e39c0199a6`.
+The context check includes all 39 required inputs and excludes every private
+configuration/key/cache canary. Both deployment drivers from the same source
+pass: fresh setup, MFA/replay, approval, restart, management encrypted restore,
+and complete transport/TLS replacement recovery using the original trust.
+This is exact-source isolated Linux deployment evidence, not public ACME,
+external traversal, native sessions or clean Windows compatibility proof.
+
+The exact `8cfdd8f` Linux management executable also passes a separate offline
+rebuild comparison. The rebuild reused the pinned toolchain and downloaded
+locked dependency sources; old target artifacts were hidden by a new `volume-nocopy` volume
+and verified empty before compilation. A full 84-second release compilation
+without network access produced the same `c0182c6785480dc47b5220689146da3bee7d00362f17ee1f400233e39c0199a6`
+SHA-256. The first attempt exposed Docker's default volume population and was
+discarded as cache reuse, not reproducibility proof. This proves the Linux
+management binary in that pinned environment, not byte-identical OCI images,
+native Windows binaries, signed packages or all product components.
+
+An x64 Windows .NET Framework test launcher now packages the setup wizard,
+installer, management executable, pinned rendezvous/relay/HTTPS binaries and
+license/source metadata into one EXE. Its first package compiled and rendered
+the bundled form using Windows PowerShell in-process; the window shows
+`UNSIGNED TEST`. Non-elevated preview exited successfully and removed its known
+temporary payload, without registering services or changing firewall/trust
+settings. Implicit production builds and a modified relay input are rejected
+before output creation. The builder verifies compiled resource hashes; the
+installer rechecks the copied management signature before registering its
+service. Final package verification and elevated extraction/installation on
+clean Windows VMs remain necessary. Test packaging is not signing approval,
+production publication or clean-machine compatibility evidence.
+
+The final test server package from clean source `eb1d580` passed compiled
+resource verification and its non-elevated, noninteractive preview, leaving no
+temporary payload. Its SHA-256 is
+`db5a93275f277222b51719b01b2d0d6a909c4e3a556f34d86c691485625a5c25`;
+its management input is the existing debug test binary, and the package remains
+unsigned. Separately, [Windows x64 build 37030567046](https://github.com/rijff24/SwanRemoteSupport/actions/runs/37030567046)
+completed successfully for source `215dfef3fc80799f7077cfe314ecad7b1c1ebc30`,
+including the native app and company components. The resulting
+`SwanRemoteSupport-1.5.0-x64-unsigned` artifact is a build result, not installation,
+session, reproducibility or signing proof. Later source changes still require
+their own applicable validation.
+
+Server installer preflight now aborts if TCP, UDP, firewall or service inspection
+fails, and checks the management port for management-only installations too.
+Enumeration is checked before filtering, so a missing named resource is not
+confused with an inspection failure. Windows PowerShell 5.1 and PowerShell 7
+parse the updated installer; read-only host endpoint and firewall enumeration
+succeeded. No privileged installation or host configuration was performed.
+
+The Windows build artifact above was downloaded and verified against GitHub's
+published archive digest
+`d61e9589d671d10db286cf7007e6cf2c3e58627b34ce1df75c184c8420509d87`.
+Safe extraction validated entry paths, duplicates, sizes and ZIP CRCs; all four
+EXE/MSI checksums match the included checksums. Read-only MSI inspection confirms
+both packages report version `1.5.0`, `x64;1033` and their distinct stable upgrade
+codes. The customer MSI SHA-256 is
+`b8268332cd61d26c37fd4a2aa8c56fa9c84648b5dd7dc9484a0b04b3d216f47d`;
+the technician MSI SHA-256 is
+`e997dc9afa490155b9bf9be1c54645cea1ff9fe5a2d73d3e2461454d3bbd8184`.
+Both remain unsigned and were not installed on the host.
+
+A separate fresh Server 2016 Standard Evaluation Desktop Experience VM accepted
+private unattended media and completed file preparation, then failed while
+processing the `specialize` pass. Its disk is preserved for read-only setup-log
+diagnosis. This is a lab provisioning failure, not a product installation result;
+the Windows compatibility row remains unverified.
+Read-only inspection of its Panther logs identified `Microsoft-Windows-Deployment`
+`RunSynchronousCommand/Path` as the invalid value (`0x80220005`). The setup
+command was 280 characters; Microsoft's documented limit is
+[259 characters](https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-deployment-runsynchronous-runsynchronouscommand-path).
+A new private provisioning seed uses a 192-character command and validates this
+bound before generation. The failed disk remained hardware read-only throughout
+diagnosis. The corrected seed still requires an actual successful installation.
+
+The corrected private VM subsequently completed installation of Windows Server
+2016 Standard Evaluation with Desktop Experience, x64 build `14393`. Encrypted
+NTLM WinRM verified the guest identity and administrator context without changing
+host trust settings. Both unsigned `1.5.0` MSIs identified above passed actual
+`msiexec` install, repair and uninstall with exit code `0` and no requested reboot.
+The harness SHA-256 was
+`26ad362ee1d5d1793ee3ee35548d18ab84efc2973f4a663a3d62de50a53bf385`.
+Customer installation and repair verified all 96 manifest files, the agent hash,
+and the running LocalSystem service's exact executable. Repair restored a
+deliberately damaged packaged license file. A subsequent read-only cleanup audit
+confirmed all 96 files were absent and Windows Installer reported the customer
+product unregistered (`ProductState=-1`). Technician checks verified its main
+executable and agent hashes; repair did not deliberately damage a technician
+file. Both lifecycle tests ran under the guest administrator account.
+
+This is bare MSI lifecycle evidence for one Windows build. Standard-user
+technician installation, upgrade, reboot, company bootstrap/enrollment, trusted
+publisher validation, automatic updates, remote sessions and the remaining
+Windows compatibility matrix are still unverified. VM credentials and raw
+installation logs remain in the private lab outside the repository.
+
+A separate standard account was tested on the same Server 2016 VM. Initial
+batch launch was denied by the guest's batch-logon rights; granting only that
+right allowed the task to execute without administrator membership. SSH and
+batch MSI attempts returned `1601` because they could not connect to Windows
+Installer. After an actual standard-user desktop logon, the MSI instead returned
+`1625`. Its log reports effective `DisableMsi=1`, rejects a non-assigned
+application for a non-admin account, and confirms the package is marked for
+installation without elevation. No installer policy was changed. The denied
+installation left the product unregistered and endpoint/agent absent. This
+does not establish successful standard-user installation; company-managed
+assignment and client Windows editions still need testing. See Microsoft's
+[DisableMSI policy](https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi).
+The temporary private VM logon password was removed automatically, with cleanup
+and disabled auto-logon verified after reboot. This reboot provisioned the test
+desktop; it is not product reboot acceptance.
+
+The lifecycle runner now records actual account elevation, supports an explicit
+standard-user technician requirement, and checks installer registration plus
+packaged-file, shortcut and component-registration cleanup. It reads OS version
+from the registry so standard-user reports do not require WMI permission, and
+writes a failed result even if process creation fails. The failed interactive
+test recorded runner SHA-256
+`4c70cfe5a4f8ce60e599460febb7bfab5a166860af995e9260df13f12be96396`.
+
+[Native Windows build 37065751842](https://github.com/rijff24/SwanRemoteSupport/actions/runs/37065751842)
+completed successfully for source
+`6840d910c252d8fb7d5c34ca7dffbc2a2ddffb4b`, including the later company
+management and transport-supervision source. Its unsigned artifacts still
+require their own integrity, installation, company setup and session checks.
+
+That newer artifact was subsequently downloaded and checked against GitHub's
+published SHA-256
+`4099acc0e992e8369738515c74a34d26625e51fc567ba5e3955f82b76d28a813`.
+Safe ZIP extraction checked all 18 entry paths, sizes, CRCs and included payload
+checksums. Its unsigned management, agent and worker binaries remain separate
+from the earlier MSI lifecycle results.
+
+Actual optional company signing now passes on the private Server 2016 VM using
+Microsoft Windows SDK SignTool from the Microsoft-owned NuGet package
+`Microsoft.Windows.SDK.BuildTools 10.0.26100.1`. The package matched its published
+SHA-512; the x64 tool SHA-256 is
+`38da9179b56d88adc0694ebf7393b9c44727c344e2df8dfa32399a4c9694715c`.
+Its Microsoft Authenticode signature was verified on the host and guest before
+execution. A non-exportable software-provider lab key and a certificate trusted
+only in the disposable guest signed a new copy of the source `6840d91` agent.
+The original agent SHA-256
+`d36cc9e4fea3b3331d64013a9c8a25f17e80f1456c84be16aef074b4d2bdd526`
+stayed unchanged; the signed copy is
+`956ecc4462841cfb94372429be6d33dfe1b82a25069213693b601aca4f9722cf`.
+
+The first SDK attempt rejected the HTTPS timestamp URL. The integration now
+accepts the operator's explicit HTTP or HTTPS RFC3161 URL, without automatic
+fallback, and rejects credentials, queries and fragments. DigiCert's documented
+HTTP endpoint returned a timestamp that SDK verification accepted. Server 2016
+PowerShell nevertheless returned a null `TimeStamperCertificate`; the integration
+now relies on SDK `/pa /all /tw` verification rather than that unreliable field.
+An otherwise trusted signature with no timestamp produced warning exit `2` and
+was rejected by the same verification gate. The valid signed agent passes the
+pinned publisher/certificate verifier under both administrator and standard
+accounts. Wrong publisher, wrong certificate and a one-byte tamper are rejected;
+the tampered fixture reports `HashMismatch`. Unsafe timestamp URLs created no
+artifact or signing receipt. The tested signing-script SHA-256 is
+`2c1baf6d00fe7e876f553341d221389b97dbd10fe6a4eeed6c5b3801aa2d1f4c`.
+
+No lab signing key was exported, no host trust store changed, and no production
+signing approval was obtained. This validates one EXE signing integration, not
+signed MSI publication, worker consumption, complete company installation,
+automatic updates or native sessions. Raw logs and test artifacts stay private.
+
+### Corrected customer upgrade candidate: source 4768d53
+
+The complete customer payload from successful native CI run `37083233120`
+was extracted read-only from its MSI with 7-Zip; no MSI action was executed.
+All 96 installed-file hashes matched the CI manifest. The native application,
+which embeds the agent library, is included alongside the standalone corrected
+agent; this avoids retaining the older application's session-lock behavior.
+
+A separate payload copy was built into lab MSI `1.5.3` with pinned WiX
+`5.0.2+aa65968c`. The build used `UnsignedTest` because the private disposable
+publisher is trusted only inside the guest, not on the host. The main executable,
+agent, and final MSI were independently signed in Server 2016 build `14393`
+using the non-exportable lab certificate and explicit RFC3161 timestamp endpoint.
+The signing integration required successful SDK `signtool verify /pa /all /tw`.
+
+- Signed native main SHA-256: `89a92acab159d2b34ddaf3e99ebcaa6ad1a45c6450876598b48237c1fc531a2b`.
+- Signed agent SHA-256: `1e02bdc3dd0302dc7cfd6a6d9b5c65512e46c0ed3fa2dbeb4e977c98659b113b`.
+- Unsigned MSI SHA-256: `5ae64da9b413994e94bee388c15c06142d5ac00e633f158aef490df8e91af3c2`.
+- Signed MSI SHA-256: `ed87625128fe6c84738cf7b6fd084da25413ddd538dd8896bac0af74efcbd6f1`.
+- Installed manifest SHA-256: `0f9e04800d770eeda45eadb043468923fc57e71e5b4d6a5e75711dec4eaef568`.
+
+This is a private upgrade candidate, not an approved production release.
+It has not yet been imported, installed, or tested through automatic rollout.
+The existing repaired installation remains version `1.5.2`; full automatic
+upgrade and interruption/recovery acceptance remain outstanding.
+
+The corrected candidate was subsequently imported as `4-Customer-test`, approved
+while automatic rollout was paused, and bundled by the existing authenticated
+Windows worker (PID `3568`). Build `9506bd95-b3da-4119-877b-06255a2a9e60`
+completed; public bundle SHA-256 is
+`e28a2f73f79d9e86342f2ca0a817498b32d1d58859ca5e68693fee5dc6fc6c52`.
+The public download's hash was checked before extracting and invoking its normal
+bundled installer, without repair mode. On Server 2016 build `14393`, the explicit
+upgrade completed with registered MSI version `1.5.3` and release sequence `4`.
+The installed main and agent match the corrected signed hashes listed above.
+Device identity, enrollment token, unattended consent and consent revision were
+compared privately and remained unchanged; the pending setup marker was absent,
+and both customer service and configuration watcher were running. This used the
+existing source `6840d91` server/worker packaging recipe with source `4768d53`
+endpoint binaries. It proves this explicit lab upgrade, not automatic rollout,
+interrupted recovery, current-source worker packaging or the Windows matrix.
+
+### Corrected automatic MSI upgrade: Server 2016
+
+A new lab MSI `1.5.4` was built from the same signed source `4768d53` endpoint
+payload as `1.5.3`, specifically exercising the case where executable hashes
+match but registered MSI version must change. The final signed MSI SHA-256 is
+`c1dad7360fd47a4eb773b4405b55caa217558f49b47341e4d3b3940b690d6ea0`;
+SDK timestamp verification passed. Signed release `5-Customer-test` was imported,
+approved, and enabled with full rollout and open maintenance window. An expired
+administrator session stopped the first harness attempt before release approval
+or update task creation; a fresh private MFA login allowed the actual attempt.
+
+The installed corrected agent's `update` command ran as SYSTEM through task
+`SwanLab-CustomerUpdate5`; it downloaded and launched its signed staged helper.
+While helper PID `3384` was live, the receipt moved through installation and
+configuration restart. Windows Installer changed from `1.5.3` to `1.5.4` before
+release sequence committed from `4` to `5`. Final inspection found no pending
+setup, update, or configuration-restart markers, one installed agent process,
+a running configuration watcher and customer service, and task exit `0`.
+Device identity, enrollment token, unattended consent and consent revision were
+compared privately and preserved. No helper was restarted because of observation
+timeouts. This demonstrates the corrected matching-payload automatic MSI upgrade
+on Server 2016 build `14393`, using private lab publisher trust. It does not prove
+interrupted recovery, active-session coordination, reboot behavior, automatic
+technician upgrades, other Windows versions or production signing approval.
+
+A subsequent invocation of the installed signed agent's `update` command returned
+`Update handed off: false` while release `5` remained the highest approved release
+and newer `6-Customer-test` was imported but unapproved. Sequence stayed `5`, no
+pending-update marker appeared, and private identity/token/consent comparisons
+passed. This verifies the installed-release no-op and that the unapproved newer
+candidate did not reach installation; it is not a forged-metadata replay test.
+
+The private interrupted-upgrade candidate is MSI `1.5.5`, source `4768d53`,
+signed SHA-256 `c1d8d2f937e047b424fb68077c61beb83dd5da59aedd1a5d40821768f52107dd`.
+Its SDK timestamp verification passed and its signed metadata was accepted as
+`6-Customer-test`, unapproved. No interruption or recovery test has yet run for
+this candidate. The recovery task source validates its exact staged helper,
+principal and command, with startup and five-minute retry triggers; runtime
+recovery still requires direct evidence.
+
+Release `6-Customer-test` was then approved and the installed updater started as
+SYSTEM. The intended interruption harness incorrectly interpreted receipt phase
+`installing` as evidence that MSI execution had begun; this phase is assigned
+before helper execution. Its guard failed without terminating any process. A
+follow-up guarded interruption attempt found installation already completed and
+also terminated nothing. The original update was neither restarted nor replaced.
+Final inspection showed registered MSI `1.5.5`, sequence `6`, no recovery markers,
+running customer service and configuration watcher, one installed agent process,
+and preserved identity/token/consent comparisons. This is a second completed
+automatic upgrade, **not interrupted-update recovery evidence**. The interruption
+harness must observe a reliable execution boundary on a new candidate.
+
+### Interrupted staged helper: recovery pending
+
+A new private signed MSI `1.5.6` (SHA-256
+`426995bfa864ea0081b3acee7ad544baadb5763291f467bcd688f8563c2aea0b`)
+was imported and approved as `7-Customer-test`. The guarded lab harness observed
+its live staged `apply-update` helper, verified its exact executable hash,
+release/previous sequence and registered SYSTEM recovery action, then terminated
+only helper PID `772`. This interruption was intentional; no MSI child, service,
+worker or host process was terminated. Immediate inspection found MSI `1.5.5`,
+sequence `6`, the retained pending-update receipt, unchanged enrollment/consent,
+and the original running customer service and configuration watcher. The staged
+helper was absent and its recovery task was Ready with the normal retry scheduled
+for `2026-10-03T02:25:25Z`. Recovery completion is not yet demonstrated.
+
+Source now offloads final configuration verification/restart from async `main`
+to `spawn_blocking`, preserving existing error propagation. Windows GNU
+`cargo check --manifest-path product/Cargo.toml -p swan-agent --locked` passed.
+This change is not part of the installed source `4768d53` test binary.
+
+The normal scheduled retry ran at approximately `2026-10-03T02:25:25Z` without
+manual task start or helper relaunch. Its result was `0` and one staged helper
+was observed live. Subsequent inspection found registered MSI `1.5.6`, committed
+sequence `7`, no pending setup/update/restart markers, running customer service
+and configuration watcher, one installed agent process, and preserved private
+identity/token/consent comparisons. The staged helper had exited. This demonstrates
+automatic forward recovery after terminating the verified pre-install staged
+helper on Server 2016 build `14393`, using private lab signing trust. The completed
+recovery task was still Ready with its next normal cleanup check scheduled for
+`02:30:30Z`; self-removal has not yet been observed. Power loss during MSI,
+rollback after installer failure, reboot/startup recovery, active remote sessions
+and other Windows versions remain separate acceptance requirements.
+
+### Reboot persistence after recovered update
+
+The disposable Server 2016 guest was rebooted through its own `shutdown.exe`,
+after verifying no active update helper or recovery marker remained and saving
+protected private state/hash comparisons. The host and production services were
+not rebooted or changed. A different guest boot time was observed. At inspection,
+no `explorer.exe` desktop session existed, while `SwanCompanyServer`, the customer
+service and `Swan Company Configuration` watcher were Running. MSI registration
+remained `1.5.6`, release sequence `7`, both endpoint hashes matched the pre-reboot
+snapshot, and identity/token/consent comparisons passed. No recovery marker was
+present. The completed release7 recovery task removed itself at startup (zero
+matching tasks). Nothing was manually launched to satisfy these startup checks.
+This demonstrates reboot persistence and automatic background startup on Server
+2016 build `14393`; it does not demonstrate a remote logon-screen session, UAC
+control, recovery from power loss during MSI, or other Windows versions.
+
+### Installed native consent synchronization
+
+On Server 2016 build `14393`, installed signed agent source `4768d53` rejected
+`allow-unattended` without `--confirm-unattended`; local consent/revision and
+identity/token comparisons remained unchanged. With the isolated company policy
+temporarily allowing unattended support, `sync` followed by explicit
+`allow-unattended --confirm-unattended` enabled consent locally and in the actual
+HTTPS server inventory with an increased consent revision. `revoke-unattended`
+then disabled both local and server consent with another revision increase.
+Enrollment comparisons passed. Cleanup revoked consent and restored/synchronized
+the original company policy. Credentials and raw state remained private.
+This tests the installed native CLI consent path; graphical consent controls,
+actual unattended sessions and termination/rejection of live session grants
+still require separate evidence.
+
+The installed native consent rehearsal also exercised actual HTTPS grant/lease
+APIs: an authorized administrator obtained an unattended signed grant after
+explicit consent, the device claimed it and renewed its live lease, and a second
+claim of the same grant was denied (`403`). After native consent revocation,
+renewal of that claimed grant and issuance of a new unattended grant were both
+denied (`403`). Original company policy and disabled local consent were restored;
+enrollment comparisons passed. Grant bodies, device tokens and account sessions
+were kept private. These are real server authorization checks, not an established
+native remote session: receiver termination after lease expiry and graphical
+technician/customer interaction still require end-to-end verification.
+
+The actual HTTPS group-permission API was tested against the enrolled Server 2016
+device: after claiming an attended grant with the original support permissions,
+removing keyboard and clipboard permission from `lab-support` caused renewal of
+that existing broader grant to be denied (`403`). A newly issued signed grant
+contained both capabilities disabled. Test grants were closed and the original
+group policy restored. This verifies live server policy reduction and grant
+capability issuance; it does not prove receiving-device input/clipboard denial
+or termination of an established native session.
+
+### Windows worker SCM installation rehearsal
+
+The worker service source `03a8739` built with the pinned Windows GNU debug
+ toolchain (`cargo build --manifest-path product/Cargo.toml -p swan-worker --locked`).
+Unsigned SHA-256 is `04f361a9b9c25521041f0482ced1870fa079295cb18abd88a53bc9a22ab8ae6d`;
+its separately timestamped lab-signed copy is
+`f5a4dfb3528ea9794b148dabc2edd80f1c61b1d033cb869fdd20b4411038df8f`.
+The new installer initially stopped before mutation because PowerShell 5 hides
+`C:\ProgramData` without `Get-Item -Force`; the corrected parent check allowed
+installation. On Server 2016 build `14393`, `SwanInstallerWorker` started as
+LocalSystem with automatic startup (PID `1020`). A real standard-user SSH session
+could read neither the service registry environment nor its protected installation
+receipt. Credentials were never printed. Signed build completion under this new
+service, stop/restart, reboot, removal and log collection remain unverified or
+unfinished. This GNU fixture is not a production release or MSVC matrix result.
+
+Controlled SCM stop/restart of the signed GNU worker service passed: the verified
+installed worker process PID `1020` exited after Stop-Service, and Start-Service
+created a new owned process PID `1856` with the same service executable identity.
+This is service lifecycle evidence, not an authenticated completed build or
+reboot-startup result. Native build artifacts now include `Install-Worker.ps1`
+alongside the worker binary for matched-source deployment testing.
+
+The signed GNU worker service also passed guest reboot startup. A new Server 2016
+boot time was observed, SCM automatically launched the owned worker as PID `1556`,
+and no desktop session was logged in. Protected service environment values and
+worker executable hash matched private pre-reboot comparisons. The company and
+customer services were Running; customer enrollment/token/consent were preserved.
+No manual worker start was used. Authenticated build completion by this new worker
+service and its MSVC release remain pending. Current-source native CI run
+`37090939153` (`6bd54c21fab4ec8d3203f513c616060af3fd2d26`) was confirmed in progress;
+its result is not yet known.
+
+Worker removal ownership validation and `-WhatIf` were exercised against the
+installed signed GNU service on Server 2016. The original running process ID
+and executable remained unchanged; no service or file was removed. Actual
+removal, retained-data reinstallation and server credential revocation remain
+pending. Native CI run `37090939153` was still in progress on the latest check;
+no duplicate build was dispatched.
+
+Worker service logging source `148eae7` was built with the pinned Windows GNU
+ toolchain and separately lab-signed (SHA-256
+`facfd31f73a1949031523e88ad0213d65c973f71fe37c4fcd453749e97dceea5`).
+The disposable service's previous executable and receipt were preserved privately
+before controlled replacement. Temporarily substituting an invalid worker token
+produced `Worker polling failed: 401` in the protected service log. A private
+comparison confirmed the real token was absent from the log. Cleanup restored
+the original service environment and restarted the logging-enabled worker.
+This proves runtime stderr capture for this GNU service fixture; standard-user
+log denial, rotation and authenticated build completion remain to verify.
+
+A real standard-user SSH session on Server 2016 was denied reading the created worker-service.log. Native CI run 37090939153 remains in progress; no replacement run was dispatched. Runtime log rotation and authenticated service build completion remain unverified.
+
+Actual owned-worker removal and reinstallation passed on Server 2016 with signed GNU source 148eae7. The service and executable were removed, the unchanged protected receipt and artifacts were retained, and the lab explicitly archived that owned data directory before reinstalling. The worker, company server and customer services were Running afterward. Removal now disposes its ServiceController before SCM deletion to avoid retaining a deletion-blocking handle. This is not automatic retained-data migration or server-side credential revocation evidence.
+
+Administrator worker listing and revocation now have management handler coverage.
+The locked worker-completion test group passes all eight tests, including
+credential-free listing, rejected technician revocation, atomic cancellation of
+running/uploaded jobs, denied revoked claims/completion, rejected late uploads,
+preserved unrelated/completed jobs, and audit records. This is local backend
+coverage; the new endpoints still require paired-server VM verification. Native
+run 37090939153 has progressed to Build branded client for source 6bd54c2.
+
+Worker revocation is now available in the installer administration view. JavaScript syntax validation passed. The eight locked worker-completion tests passed again with real Axum route checks for unauthenticated and technician denial, administrator list/revoke, unknown-worker 404 and revoked claim/upload 401. Claims recheck credential status inside their database transaction to close the authentication-to-claim revocation race. These route tests do not replace paired-server VM acceptance.
+
+Source `11fd72a` management was built with locked dependencies and tested as a
+separate process on disposable Windows Server 2016 Desktop Experience, build
+14393. Test binary SHA-256:
+`3ad52ad04c4af5be55e29a1bef036d2b5a9dbc2a0f7832931ccb880117b5959a`.
+A fresh private data directory and guest loopback HTTP listener passed company
+setup, subsequent MFA login, worker creation, enabled claim, unauthenticated
+worker-list denial, credential-free administrator listing, administrator
+revocation, disabled status, audit event, and revoked claim/upload 401 responses.
+The owned test process was stopped afterward; existing company, worker and
+customer service statuses remained unchanged. Credentials, logs and test data
+stay outside Git. This unsigned GNU fixture does not establish production
+MSVC signing, HTTPS deployment, cancellation of a real in-flight worker build,
+or the complete fresh-company installer workflow.
+
+Native Windows CI run `37090939153` completed successfully for exact source
+`6bd54c21fab4ec8d3203f513c616060af3fd2d26`. Installer artifact `11263621948`
+was downloaded outside Git and verified against GitHub's archive SHA-256
+`e91bfb162cc8ac5bf1428fadffd057b1741514c505ae987c68f41d7b605a9c7a`
+(109,618,735 bytes). All 19 flat ZIP entries passed bounded extraction, CRC and
+published payload checksum checks. This includes customer/technician EXE and MSI
+test packages and matching MSVC management, agent and worker executables.
+Management SHA-256: `58dc0db9e3aaaf1cf3fda3a4552ce5b8e4766721c5877d59d840d1d85a31531e`;
+worker: `c33a766574a5a91ff57fc1661af2ace7c3799aace8df3490c599fd96cf375f7c`;
+agent: `870ead5b2307c289d3e94542b53756488ea0ae6e2a558ed4131e9e49e6eaa9ee`.
+These are unsigned build outputs, not production releases or installation/session
+acceptance. Changes after this source, including worker logging, removal and
+administrator revocation, require separate native verification.
+
+The matching native MSVC management, worker and agent from `6bd54c2` were signed
+inside disposable Server 2016 using its private, nonexportable lab certificate.
+All three passed Authenticode plus `signtool verify /pa /all /tw` timestamp
+verification. Signed SHA-256 values: management
+`27285aa8b371f38d26ab91c16a00c3a27fbc90e42c03085ab8e358e4b8ef8ef7`, worker
+`f147d31480e40d436f32c160cd47b22c821129c2a39652bcbe81e8d11b42bc13`, agent
+`68cef92acfc983445c59fc43da7e5817096ae76cde2e6260c2f8bc47113c01fd`.
+The signed MSVC management executable then passed a fresh isolated company setup,
+MFA login, worker creation, authenticated empty-queue claim, unauthenticated
+claim denial and worker creation audit test over guest loopback HTTP. Cleanup
+stopped that owned test process and verified existing service statuses unchanged.
+This is native server runtime and lab signing evidence; it does not prove HTTPS
+worker build completion, Windows service installation of these binaries, client
+sessions, the wider Windows matrix, or production signing approval.
+
+The signed native `6bd54c2` management fixture also passed trusted HTTPS access
+through a separately launched Caddy instance on a guest loopback port. Its
+company signing identity was distinct from the existing disposable deployment.
+The proxy reused the existing guest-only lab certificate read-only, with its
+admin API and automatic HTTPS management disabled and separate proxy storage.
+Both owned test processes were stopped after verification; existing service
+statuses remained unchanged. No host DNS, trust, firewall or service setting was
+changed. This establishes isolated HTTPS management runtime, not public
+reachability or completed worker generation.
+
+Matching lab-signed native MSVC management and worker source `6bd54c2` completed
+real customer and technician build jobs on isolated Server 2016 over trusted
+guest HTTPS. The administrator configured the isolated company endpoint,
+imported and approved signed test releases, created a worker credential and
+queued both jobs through the API. The foreground worker verified signed inputs,
+generated bundles, uploaded them and reported successful completion. Downloaded
+bundles matched the reported hashes and each contained the exact ten-file recipe
+with the correct company endpoint, profile trust pin and edition in bootstrap.
+Customer job `4ebc6935-83ff-4214-9763-257b354346e2`:
+`7b6d797dfe3a7bf7095a65293025995067d715cd73c5777ab6bf5cb1bf3d4e9c`.
+Technician job `1604fde0-6007-4af7-8994-04cdcf21b706`:
+`73783c1d987691bec8ca802a2b443c98a00619b1fa2980b049443fceb342f4be`.
+Customer download succeeded without authentication; technician download returned
+401 without authentication and succeeded with the administrator session. Cleanup
+stopped the owned foreground worker, proxy and management processes and checked
+existing service statuses. Test credentials and artifacts remain outside Git.
+Payloads were earlier signed lab releases from `4768d53` (customer MSI) and
+`6840d91` (technician EXE), not newly signed `6bd54c2` client packages. This proves
+the matching native server/worker generation path, not worker service completion,
+fresh client installation, production publication, or remote-session acceptance.
+
+A second real generation test used matching `6bd54c2` native management, worker,
+technician executable and configuration agent. The technician executable was
+lab-signed with verified timestamp, SHA-256
+`cb1d7cfcf4d429a1ecf59d9e5018e2686c40f04c477a420bda7e4106524461da`.
+Signed test release sequence 8 named the exact public source and matching signed
+agent. The isolated administrator imported/approved it and queued job
+`de8d3b0a-e3ab-42ce-a322-4ed6c686b6e0`; the worker completed the ten-file bundle
+with SHA-256 `345920e00869e3a6488c4867a16c25c493ee904db9cd3a71189d7da38b013579`.
+Unauthenticated download returned 401; authenticated download, hash verification
+and company/edition bootstrap checks passed. Owned test processes were stopped
+and existing service statuses checked. This removes the earlier technician
+payload source mismatch for generation evidence. Standard-user installation,
+technician login and real sessions remain unverified for this new bundle.
+
+The generated current technician bundle then passed portable installation through
+its actual `Install-Company.ps1` as a real nonadministrator on Server 2016. The
+test explicitly isolated LOCALAPPDATA/APPDATA beneath the user's disposable test
+directory to preserve the existing technician setup; the previous Start menu
+shortcut was restored afterward. The company domain confirmation was supplied
+explicitly. Signed configuration bootstrap, package verification, installed
+technician and agent hashes, `verify-installed`, online signed-profile sync,
+company/edition identity, release sequence 8 and cleared installation marker
+checks passed. The technician state contained no customer device enrollment or
+unattended consent. The isolated management/proxy processes were stopped after
+the user result, with existing service statuses unchanged. This is standard-user
+portable installation evidence using isolated application data, not default-path
+MSI installation, rendered branding, graphical MFA login or an actual session.
+
+The installed `6bd54c2` technician agent passed real standard-user CLI
+authentication against the isolated HTTPS management server. An administrator
+created a technician role with a private authenticator secret. MFA login,
+empty fresh-company device inventory and session history succeeded. Reusing the
+same MFA code was rejected; the technician token could not create a worker;
+logout revoked subsequent inventory access. The managed-state hash remained
+unchanged and contained no returned session token. Test credentials were held
+outside Git, removed after use, and cleared from the child process environment.
+Owned proxy/server processes were stopped after the result. This proves the
+installed agent's authentication API path only: graphical MFA login, nonempty
+authorized inventory, device selection and native remote sessions remain open.
+
+With the isolated HTTPS listener confirmed stopped, the installed `6bd54c2`
+technician agent's `verify-installed` succeeded as the standard user using its
+cached signed company profile. The managed-state hash was unchanged. This is
+offline agent/installed-identity evidence; rendered offline branding remains
+untested. Desktop-control capability was revalidated against the existing
+disposable QEMU viewer and its Windows lock screen observed. No graphical
+technician login or native session was established. Host free memory remained
+approximately 2.5 GiB, below the second-VM launch guard.
+
+Graphical test preparation encountered a desktop-tool limitation: the existing
+TigerVNC lab viewer accepted mouse/keyboard input and exposed the VM lock screen,
+but its menu key did not expose the guest secure-attention command. A second
+viewer connection dialog exposed its owned options dialog to observation; both
+coordinate input and subsequent Escape input failed with `failed to activate
+captured window`. No guest login, credential entry or technician UI test was
+completed. The existing VM/services remained running. This is a UI-tool blocker
+for that viewer path, not evidence of a Swan application failure or session pass.
+
+The installed signed MSVC `6bd54c2` technician agent passed a positive cached
+profile/bootstrap control and rejected eight disposable altered copies:
+invalid profile signature, modified signed payload, accepted-revision rollback,
+wrong installer company, edition, management domain, profile trust pin, and
+changed cached profile trust pin. Tests ran as the standard user through actual
+`verify-bootstrap`; JSON was written without a BOM so parser failures did not
+stand in for trust checks. The original installed managed-state hash remained
+unchanged. This is native cached-profile/bootstrap rejection evidence, not
+expired signed-profile, live endpoint rotation, package or session-grant testing.
+
+Installed signed native `6bd54c2` technician and matching management passed live
+company branding and profile signing-key rotation over isolated trusted HTTPS.
+The administrator changed technician display name/color; the installed agent
+synchronized them with a higher revision and unchanged trust pin. With only the
+owned test management process stopped, native `prepare-profile-key` published a
+transition signed by the old key. The client synchronized the authorized next
+key while retaining its current pin. Native activation after that sync switched
+the server key; the next client sync committed the replacement pin and a higher
+revision. Company/edition, release trust, endpoint, consent, device fields and
+installed release sequence 8 remained unchanged. After both isolated listeners
+stopped, installed identity verification succeeded offline and the old bundle's
+bootstrap pin was rejected. Existing service statuses were checked unchanged.
+The first harness attempt stopped before rotation because the optional empty
+support-contact field was omitted from serialized JSON and PowerShell attempted
+to assign a missing property. Source inspection confirms `6bd54c2` supports that
+field; the corrected harness tested display-name/color fields. This does not
+establish rendered branding, contact-field sync, customer key rotation or a session.
+
+The installed native `6bd54c2` technician subsequently passed signed management
+endpoint migration between two guest-only HTTPS listeners on the same lab DNS
+name. It learned the new URL through the existing signed profile, committed a
+higher revision, and synchronized again after the old listener was retired.
+Company/edition, both trust pins, installed release sequence 8, device fields
+and consent remained unchanged. Offline installed-identity verification then
+succeeded with the new endpoint persisted. Existing service statuses were
+checked unchanged. This verifies HTTPS URL/port migration, not DNS hostname
+migration, transport endpoint migration or a native session.
+
+Native CI run `37095431510` completed successfully for exact source
+`0a541c78609e8e3438e3c577abb352d714812b18`, covering implementation changes after
+the earlier verified native build. All four jobs, including the branded Windows
+x64 build, passed. Its outputs remain unverified until download, provenance and
+artifact checks complete; build success alone does not establish native runtime
+acceptance. Subsequent verification and runtime evidence is recorded below.
+
+The Windows workflow now includes pinned transport/HTTPS archive preparation,
+unsigned company-server setup compilation, source-manifest publication and its
+SHA-256 checksum alongside endpoint installers. YAML parsing and both upload
+entries passed local validation. The setup builder was exercised under Windows
+PowerShell 5 using verified `6bd54c2` native management and existing pinned
+components: all eleven embedded resource hashes passed, and the unsigned
+64,093,696-byte package SHA-256 is
+`14c2c794de937a20b16dc52f37b6238968c3fcaa6c3378fa80b5287838a0cb93`.
+Its source receipt records recipe revision `4071147` and the dirty working tree;
+it is a local test package, not a corresponding-source production release.
+The already-running `0a541c7` CI build predates this workflow addition; a subsequent
+full run must verify the new server packaging step. At that stage no setup
+executable was run on the host; no host service, firewall, DNS or trust setting
+was changed.
+
+Installed native `6bd54c2` technician then passed live signed synchronization of
+support contacts, a validated HTTPS shortcut, logo SVG and consent text from the
+isolated administrator profile API. The harness explicitly added omitted
+optional JSON properties before publication. The client committed a higher
+profile revision while preserving bootstrap ownership/trust, release sequence 8
+and consent. After the isolated management/proxy listeners stopped, offline
+installed-identity verification accepted the signed cache without changing its
+hash. Existing service statuses were checked unchanged. This is installed-agent
+metadata synchronization evidence, not visual rendering or shortcut interaction.
+
+The same hash-verified unsigned server setup package subsequently passed its
+explicit `--render-preview` path on the unelevated Windows 11 host. The packaged
+launcher extracted its bundled native management/components, loaded its embedded
+wizard and exited successfully. Visual inspection of the generated 836-by-779
+PNG confirmed Swan branding, the unsigned-test title, hostname and trust inputs,
+bundled component paths and the preview-only status without clipped labels or
+overlapping controls. The PNG SHA-256 is
+`ca0e06e43bba6c841076015b667671895923cb252ba518f8c39ca42672883f53`.
+The owned temporary payload directory was removed and no setup process remained.
+Preview code disables installation and browser actions and does not show the
+interactive form. This verifies packaged extraction and offscreen rendering,
+not elevated installation, interactive setup, production signing or a supported
+Windows compatibility result. No host service, firewall, DNS or trust was changed.
+
+The hash-verified native `6bd54c2` configuration agent also passed
+`deployment/windows/test-native-profile-time.py` on the Windows 11 host using
+four isolated synthetic-company cached profiles. An ephemeral Ed25519 key signed
+each profile and Python independently verified each signature before invoking
+the actual native `verify-bootstrap` command. The valid control passed; expired,
+future-issued and invalid-lifetime profiles were rejected with the profile-time
+validation error, and all fixture state files remained byte-identical. Agent
+SHA-256 was
+`870ead5b2307c289d3e94542b53756488ea0ae6e2a558ed4131e9e49e6eaa9ee`.
+The key was never serialized, the synthetic HTTPS address was never contacted,
+and installed company state was not used. This proves native cached-profile time
+rejection, not live expiry during a remote session or refresh of an expired cache.
+
+Native `6bd54c2` portable technician recovery was exercised in a separate
+standard-user-owned directory on Server 2016 using private lab-signed binaries.
+The harness cloned the sequence-8 installation, prepared verified signed
+rollback snapshots and a synthetic sequence-9 `rolling_back` receipt, then
+damaged only its disposable canonical endpoint and agent. The signed staged
+helper restored both exact binaries, removed the pending receipt and recorded
+`failed-update.json` with phase `rolled_back`, failed sequence 9 and previous
+sequence 8. An independent read-only verifier confirmed both restored hashes,
+byte-identical company state and installed metadata against the source
+installation, retained sequence 8, unchanged empty technician device fields and
+disabled unattended consent. The native `verify-installed` command accepted the
+restored installation and its pinned publisher.
+
+The original SSH harness has not returned a terminal result; its post-recovery
+app restart and cleanup command remain unresolved. Therefore this is verified
+post-recovery state for a prepared rollback, not a complete automatic-update
+failure/rollback test, replay-rejection test, GUI acceptance, MSI recovery or
+power-loss evidence. The synthetic receipt SHA-256 is
+`f3e7059dfd47309c406b2bbe0e988ee697bbc8cd8d8ed92bd3ba8aab1b2ce126`;
+fixture files and signing material remain outside Git.
+
+The restored Server 2016 technician fixture subsequently passed native
+`verify-package` quarantine checks. Correctly signed metadata for failed sequence
+9 was rejected specifically as quarantined; correctly signed sequence-10
+metadata for the same trusted lab package passed signature, hash and publisher
+verification as a positive control. Company state, installed metadata and the
+quarantine receipt remained byte-identical before/after both commands. No
+installer was executed and no sequence advanced. This proves native explicit
+package verification enforces the recorded failed-release watermark; automatic
+discovery, rollout of a later release and the original harness terminal result
+remain unverified.
+
+Using the same sequence-10 metadata and restored native agent, a Server 2016
+negative package check flipped one byte at offset 4096 in a disposable copy of
+the real lab-signed technician EXE. Native `verify-package` rejected the damaged
+copy with a hash-validation error. The preceding intact-package positive control
+had passed. The original package, company state, installed metadata and rollback
+quarantine stayed unchanged, and no installer was executed. This verifies native
+package-byte tamper rejection; it does not establish interrupted installation or
+automatic-update acceptance.
+
+Native run `37095431510` artifacts for exact source
+`0a541c78609e8e3438e3c577abb352d714812b18` subsequently passed authenticated
+GitHub provenance checks, the authoritative archive SHA-256
+`1e77ecd393173b0a10cababc01b39d0d28bc177c5fbe8a5406bfc1148b17229b`,
+bounded flat-file extraction, ZIP CRC checks and published payload checksums.
+Twenty files were verified outside Git. These remain unsigned build artifacts.
+
+The verified native MSVC management binary (SHA-256
+`9046b27c9e7b6afdb581ee84a2c4d8a3c1128b34a138daf354cbd3603c2ab3e6`)
+then passed a fresh isolated Server 2016 company setup and MFA login, worker
+creation and enabled claim, administrator-only credential-free worker listing,
+revocation, subsequent claim/upload authentication denial, persisted disabled
+status and revocation auditing. The harness used guest-loopback HTTP and stopped
+only its owned management process; existing service statuses stayed unchanged.
+This verifies compiled native revocation behavior, not HTTPS/public transport,
+signed distribution, job cancellation during active upload or a real session.
+
+The verified `0a541c7` native management, agent and worker inputs were then signed
+inside the Server 2016 guest using the existing non-exportable private lab
+certificate and pinned company-signing recipe. Every original input hash was
+rechecked, Authenticode status and certificate identity passed, and
+`signtool verify /pa /all /tw` confirmed RFC3161 timestamps without warnings.
+Signed hashes are management
+`bf52a32557e96990616de28380c386b4eae7ece0b523f9677685e8f6c359c8bc`,
+agent `1226def2eee9ade11d4fabd5b49321de5de4744973999fd517c85645086f0ca0`
+and worker `6610f507d02ab4f02dc1080142f113f0c2aab7ec0b10564573216dcb861cad51`.
+The key was not exported; host trust and installed service binaries were not
+changed. These are lab fixtures, not production-signed releases or evidence that
+the new worker has completed a service-mode build.
+
+Matching lab-signed `0a541c7` native management and foreground worker then passed
+real customer and technician bundle generation over the isolated guest HTTPS
+endpoint. The administrator imported/approved earlier signed lab payloads from
+`4768d53` and `6840d91` and queued both jobs. Customer job
+`2d2fd057-850f-4d56-9340-8d51644d3cf1` completed with bundle SHA-256
+`fd374569c890dc48aedcabd37d44f1b70f64e5d3b197e84e5d9b5db71b71522e`;
+technician job `48303891-6097-4dbc-b09a-3e2b6cedbab1` completed with
+`b7bbd3a197c2aba4c18e61645d9497bddc711f5009070667f478cf44d2cee648`.
+Both downloaded hashes, ten-entry bundle recipes and company HTTPS URL/profile
+pin/edition bootstraps matched. Customer download was public; technician download
+required authentication and the unauthenticated request returned 401. Owned test
+processes were stopped and existing service statuses were preserved. No bundle
+was installed. This verifies current native server/worker generation using earlier
+payloads, not newest-client installation, worker service-mode completion, public
+Internet connectivity or production signing.
+
+Matching `0a541c7` technician distribution then passed using the newly lab-signed
+technician EXE and matching agent, signed release metadata sequence 11, and the
+same native management/worker pair. Technician EXE SHA-256 is
+`fe29807746ec9f406031f10f5872083b13e1374a7fa2f35b0d077a8221fb8722`;
+its signature, pinned lab certificate and RFC3161 timestamp were verified in the
+guest. Job `456c3b0a-dfa4-48ad-8cf7-1ae24024abef` produced bundle
+`64d7b7b3119ec794b08d1cee8e205f2ed81b687062b1490c19883a8caedec019`.
+Authenticated download, hash, ten-entry recipe and HTTPS/profile-pin/edition
+bootstrap checks passed; unauthenticated download returned 401. This package
+contains matching current native payloads, but was not installed in this test.
+Production signing, service-mode completion and rendered technician/session
+behavior remain open.
+
+The matching `0a541c7` technician bundle subsequently passed its actual
+`Install-Company.ps1` setup under the non-administrator `swanlabtech` account on
+Server 2016. Separate fresh application-data directories preserved the earlier
+installation. Installed EXE and agent hashes matched the approved signed inputs,
+native installed-identity verification and HTTPS signed configuration sync passed,
+sequence 11 was recorded and the pending-install marker cleared. No customer
+device identity, enrollment token or unattended consent was created. The existing
+Start-menu shortcut was restored, owned management/proxy processes stopped, and
+existing service statuses remained unchanged. This is real portable technician
+installation evidence; rendered login, authorized inventory, native sessions,
+MSI installation and the remaining Windows matrix are still unverified.
+
+Installed `0a541c7` technician CLI authentication then passed under the same
+standard user against the matching native HTTPS management fixture. A new local
+technician account completed MFA login; inventory/history requests succeeded
+with empty results, replay of the consumed MFA code was denied, and worker
+administration privileges were denied. Logout invalidated subsequent inventory
+access. Managed identity stayed unchanged and no login token was stored in managed
+state. Temporary account credentials were removed by the harness. This verifies
+installed-agent authentication and role enforcement, not rendered login, populated
+authorized inventory or a native remote session.
+
+The installed `0a541c7` technician also passed standard-user offline
+`verify-installed`: a loopback TCP probe confirmed the isolated company endpoint
+refused connections, the native agent accepted its cached profile and signed
+installed release/publisher, and managed state stayed byte-identical. The first
+harness attempt used an administrator-only CIM query and failed before native
+verification; replacing it with the unprivileged connection-refused probe
+preserved the offline precondition. This does not authorize offline remote access.
+
+The VM viewer became targetable again after refreshing and activating its
+returned window. Its screenshot showed the disposable Server 2016 desktop is
+locked. Graphical tests await manual unlock under the computer-use skill; no
+authentication dialog or security setting was automated.
+
+Standard-user portable repair passed for the installed `0a541c7` technician on
+Server 2016. After preserving a hash-verified backup, the harness replaced only
+the disposable installed EXE with four invalid bytes and ran the actual bundle
+`Install-Company.ps1 -Repair`. The signed executable was restored to its exact
+expected hash, native installed-identity verification passed, managed state stayed
+byte-identical at sequence 11, and the pending-install marker cleared. The prior
+Start-menu shortcut was restored. This proves damaged portable EXE repair, not
+MSI repair, agent-loss repair or remote-session behavior.
+
+A separate standard-user test then damaged only the installed `0a541c7`
+configuration agent with four invalid bytes and ran the same trusted portable
+bundle repair. The bundle's staged signed agent completed repair, native
+installed-identity verification passed, managed state stayed byte-identical at
+sequence 11 and the pending-install marker cleared. Protected fixture backups
+and the previous Start-menu shortcut were retained/restored. This establishes
+explicit portable-bundle repair of a corrupt agent, not automatic recovery from
+a missing canonical agent or MSI/service repair.
+
+The portable technician uninstaller added in `e9cda62` passed as a standard user
+on the disposable Server 2016 machine using the existing signed `0a541c7`
+installation. `-WhatIf` left files and recovery state unchanged. Confirmed removal
+cancelled update recovery and removed the fixed application files while retaining
+company state. Reinstall through the trusted existing bundle restored the payload,
+passed native installed-identity verification, cleared the uninstall marker and
+preserved managed state byte-for-byte. This verifies the new source script with
+an older ten-entry bundle; generation and installation of the new eleven-entry
+recipe, graphical uninstall confirmation, MSI removal and complete cleanup remain
+unverified. The matching native build for source `e9cda62` has been dispatched.
+
+The lab-signed native `0a541c7` management server passed an encrypted backup and
+restore rehearsal in separate protected Server 2016 directories. Signing/setup
+file hashes and the complete signed profile remained identical. Original and
+replacement guest-loopback servers returned identical account, device, worker
+and approved-release state; MFA login and replay denial passed independently.
+Backup overwrite and restore into a nonempty directory were denied. Wrong-password
+and byte-tampered archives failed authentication before creating target files.
+Only owned foreground test processes were stopped; existing services retained
+their prior status. The first harness expected the wrong authentication error text
+and stopped; the corrected fresh-directory rehearsal passed. This is management-only
+native recovery evidence, not transport/TLS restoration or migration rollback.
+
+Deployment backup now has an explicit `--installer-artifacts-directory` option.
+It includes canonical build-UUID ZIP files in the authenticated archive and
+restores them under the replacement data directory, retaining files needed by
+published installer links. Four compiled backup tests passed, including byte-exact
+installer-file recovery, rejection of unfinished uploads, tampered archives,
+unsafe restore paths and prior transport/TLS behavior. This component evidence
+does not demonstrate native installer-download availability after deployment
+restore; that check requires a rebuilt server with this option.
+
+That installer-download check subsequently passed with native Windows source
+`b0cb74045487003b2ba179f210ebfcc700e7b537`, built with locked dependencies using
+Rust 1.90.0 GNU. Unsigned management SHA-256 was
+`fbaaa1c0611734b42e8362c323fe7bdab241f294e6b89ddf5b690bd92705048a`;
+the lab-signed fixture was
+`645d17ab2dac1fad4789ee629cc23353d6e1af2ccd219bd959bdb7fc8c1953a6`
+and passed Authenticode and required RFC3161 timestamp verification. Encrypted
+export/restore of the isolated company's database and generated installer files
+produced a replacement Server 2016 server that served the customer bundle publicly,
+denied unauthenticated downloads of both technician bundles with 401, and served
+both after MFA authentication. All three downloaded hashes matched the retained
+build records. Trust, signed profile, accounts, devices, workers, releases and
+MFA/replay behavior passed the prior comparison and negative checks. Existing
+services retained their status. This supersedes the component-only installer
+restore limitation above, but remains guest-loopback HTTP and lab signing evidence;
+native transport/TLS recovery, migration rollback and production publication remain
+unverified.
+
+Native eleven-entry technician MSI generation passed with the lab-signed GNU
+management build `b0cb740` and worker `8ec66d2`. The worker's signed SHA-256 is
+`ce86aebf44178f93a981b4c296c3eecebb01cd8da923e75e7799884c01051117`;
+the signed MSI fixture is
+`bef611e1904bb0b6ecb183da38aa502cf52a68c66589f208408bba17824cddea`.
+Both passed publisher and required RFC3161 timestamp verification. The MSI uses
+recipe `8ec66d2`, version 1.5.7 and the retained signed `0a541c7` technician/agent
+payloads; this is a mixed-source lab fixture, not a production source release.
+Build `7373f93d-e7d3-40e8-b1e6-9e31dda99081` completed over trusted guest HTTPS;
+the generated bundle SHA-256 is
+`5c4b2f105e4afe6f238aa659d5a505c4e617aa4c808ec2d9e219dd305ff26957`.
+Its eleven entries, company bootstrap and downloaded hash passed, and public
+technician download returned 401. The later installation attempts below failed.
+
+A new disposable standard account was prepared for MSI lifecycle testing, with
+its password confined to the protected guest fixture. Initial harness failures
+used a reserved PowerShell variable, assumed a nonexistent public-key location,
+and generated a password that failed Windows complexity checks. The last failure
+partially created the specifically marked account; its unset password was repaired
+without changing another account. WinRM alternate-user process creation was denied;
+a scheduled probe never ran, and the alternate-user SSH probe subsequently exited
+with `0xC0000142` before either success or error markers were written. Its profile
+directory exists, but no successful unprivileged process or MSI lifecycle result
+was demonstrated. The specifically owned probe task was subsequently verified
+idle/never-run and removed; the disposable account and profile fixtures remain.
+These are test-environment failures, not proof of technician MSI installation,
+repair, upgrade or uninstall.
+
+CI run `37097192689` for `9c6bdbb9e2923d0b6dae50076a99670ee76013e6`
+completed successfully. Artifact `11265830031` was downloaded with authenticated
+provenance and archive SHA-256
+`a01d6eab9a21b7c9e4b4ebd07ed51aa77fbdc744c48dcb9b9789972a6a9f1699`;
+all 22 flat entries passed bounded ZIP/CRC extraction and published payload checksums.
+The included server setup SHA-256 is
+`63846db80c82c29ad0ac3f0f5984d9deb6cba9ea708255c2f12b62192dca891d`.
+Reflection-only inspection verified its exact twelve-resource recipe, all eleven
+payload hashes, matching embedded/external source receipt and matching standalone
+management binary. Six fixed setup source inputs matched the public commit, allowing
+normal Git checkout line endings; transport/HTTPS component hashes matched their
+pins. The receipt declares a dirty CI working tree, so these checks do not establish
+whole-tree source cleanliness, production signing or actual server installation.
+The later `e9cda62` native CI run `37099948400` also completed successfully. Its
+archive SHA-256 was
+`f80696b2705ab43e550a5e5eb8c5dc6802e35ecc72ef1ac50b8abad6f7fb46b0`;
+all 23 flat entries passed bounded ZIP/CRC extraction and published checksums.
+
+A separately owned, loopback-forwarded SSH listener subsequently demonstrated
+execution as the new standard Windows user with its actual LocalAppData profile
+and no administrator membership. The original SSH listener was retained. The
+generated eleven-entry bundle reached native technician MSI installation, which
+returned `1601`. Its failed-setup marker was retained. Starting the guest Windows
+Installer service without changing its Manual startup mode and explicitly retrying
+the failed setup returned `1601` again. The isolated management/proxy processes
+were stopped after both failed attempts, and existing company service statuses
+were preserved. This supersedes the unsuccessful standard-user process probes
+above, but does not demonstrate MSI installation, repair or uninstall. Earlier
+noninteractive MSI attempts also returned `1601`; an interactive desktop test is
+still required before attributing this failure to the product or environment.
+Read-only inspection after both attempts confirmed sequence 0, a retained
+failed-setup marker and no installed technician executable or configuration agent.
+The event-log summary did not establish a specific installer-service root cause.
+After those attempts, ownership checks confirmed no established sessions on the
+temporary SSH listener. Its task, guest firewall rule and QEMU host forward were
+removed. The original SSH banner and SSH/WinRM forwards were verified, existing
+company service statuses were preserved, and private account/profile/failure
+evidence was retained. No host firewall or production service was changed.
+
+Native Windows CI run `37103083258` for
+`11faae30b0dac275c7d8c795ca3c3c134ded36c9` completed successfully in all four jobs.
+Artifact download and verification are in progress. CI success does not establish
+clean-machine installation, native remote sessions or Windows matrix acceptance.
+
+That download subsequently completed. Archive `5cb668d823167a5516020ec395289eff067cc10d29f5e4ba1a940e789e44d7b5`
+(134,259,819 bytes) passed authenticated provenance, bounded ZIP/CRC extraction
+and published checksums for all 23 entries. The server setup hash is
+`fd604e329d444d201c59c4feb41fbd477cb63eb17488285b7e8627e1fb39f886`.
+Reflection-only inspection verified its exact twelve-resource recipe, all eleven
+payload hashes, embedded/external source receipt equality and matching standalone
+management executable. Six fixed source inputs matched public commit `11faae3`,
+allowing Git checkout line endings, and component pins matched. The receipt still
+reports a dirty CI working tree; whole-tree cleanliness, production signing and
+actual setup installation remain unproven.
+
+The same archive's native MSVC agent
+`cd2bdbc5c14cca1b9b24c16fe22f590cca96eb92cf45465085b3880dcd109631`
+passed the expanded offline profile harness on the development Windows host.
+Harness SHA-256 was
+`2844f6148f7d2304010f6a74a0fa03871538fa10a2e8b9d0612576c5cce68fd7`.
+All twelve cases passed: a valid cached profile was accepted; expired, future,
+invalid-lifetime, tampered-branding, wrong-signing-key, wrong-company and older
+revision profiles were rejected; company, edition, trust-key and endpoint
+substitution in installer bootstrap were rejected. Each negative case matched
+its specific expected error, and both state and bootstrap bytes remained unchanged.
+Keys were ephemeral and not serialized. This is native CLI trust verification
+against synthetic local fixtures, without network, installation, rendered branding
+or remote-session evidence.
+
+The current MSVC management executable from `11faae3` subsequently passed the
+native encrypted installer-backup rehearsal on Server 2016 build 14393. Its
+unsigned hash is `de623e216e4ef2b81785c18615fc23e83e4716c894225ed620a860e2aea9f817`;
+the disposable lab-signed hash is
+`194c837babd6a07f51b37743fb11400e37cfa6a41e48c16e2701032f2d921f3d`.
+Authenticode and required RFC3161 timestamp verification passed. The restored
+server served one customer bundle publicly and three technician bundles after
+authentication, including the eleven-entry MSI bundle. Every download hash
+matched its retained build record, and unauthenticated technician requests
+returned 401. Trust files, signed profile, users/devices/workers/releases,
+administrator MFA and replay checks passed; backup overwrite, nonempty restore,
+wrong passwords and ciphertext modification were rejected. Both isolated
+processes stopped and existing company service statuses were preserved. This
+extends the GNU result to the current MSVC management runtime, over guest-loopback
+HTTP; transport/TLS restore, migration rollback and production signing remain
+separate unverified requirements.
+
+The matched-source MSVC server and worker from `11faae3` then completed a real
+technician MSI bundle job over trusted guest HTTPS. The worker's unsigned hash is
+`73ce8e09c6473f9c32c7cd8c22d5eb0c75e68c448e1829a462df42e3843d5bd9`;
+its timestamp-verified lab-signed hash is
+`fa6bb94be7a44a4e2148b428af3fe1a0ca93045d0961aefd54e8c2188bb92c0c`.
+Job `3444e8fd-4e4a-4624-887c-1e1b370afbd3` produced bundle
+`478f2d3af2838f26245ed0723b5a009fd80ae53b58bd57418a8e2bf76e6832a9`.
+All eleven entries, company/edition/endpoint bootstrap and downloaded hash passed;
+unauthenticated technician download returned 401. The owned worker credential
+was revoked and listed disabled, the administrator session logged out, all three
+isolated processes stopped, and existing company service statuses were preserved.
+This uses retained lab MSI recipe `8ec66d2`, signed endpoint/agent inputs `0a541c7`
+and a newly signed test release sequence 13; it is mixed-source packaging evidence,
+not installation or production source-release acceptance.
+
+Two preceding attempts failed and remain separate evidence. The first isolated
+Caddy startup crashed with `fatal: morestack on g0` before login/job creation; a
+version probe of the same pinned binary succeeded. The second started HTTPS but
+its worker could not fetch the older signed release's artifacts: the retained
+port-443 lab endpoint had no listener. No existing endpoint was restarted. The
+successful run instead used newly signed metadata pointing to the isolated
+port-24442 endpoint, which served only the two named lab inputs alongside its
+management proxy. Company policy was not implicitly changed, unrelated active
+jobs were checked before enqueue, and component pins were unchanged. The startup
+crash's cause and wider Windows server stability remain unresolved.
+
+Five further validations of the same pinned Caddy executable and isolated
+configuration passed on Server 2016, each returning exit code 0 and `Valid
+configuration`. An initial harness used `Start-Process` process objects whose exit
+codes were unavailable; those observations were not counted as passes. Direct
+native exit-code capture produced the verified results. No listeners were opened
+and existing company service statuses were preserved. This does not resolve the
+earlier startup crash or prove long-running service stability.
+
+Review of service failure handling found that management and worker report
+`Stopped` with nonzero Win32 exit codes, while their installers configured recovery
+actions without enabling recovery on those reported failures. Both installers now
+set `sc.exe failureflag SERVICE 1` and fail setup if that configuration fails.
+Microsoft documents the required flag in
+[SERVICE_FAILURE_ACTIONS_FLAG](https://learn.microsoft.com/en-us/windows/win32/api/winsvc/ns-winsvc-service_failure_actions_flag).
+A separate unsigned, protected Server 2016 fixture demonstrated actual SCM restart
+after a non-crash error stop, plus no restart after a successful requested stop.
+The fixture service was disabled/stopped/deleted during cleanup and existing product
+service statuses were preserved. Installer parsing and diff checks passed. This
+proves the native recovery mechanism, not installation or reboot of the changed
+product packages; no existing product service recovery settings were changed.
+
+A fresh unsigned server setup package was subsequently compiled from clean
+installer checkout `87a1b7f85881d31d7f43d61c5fe7bfe0ffd1048a`. All eleven embedded
+payload hashes passed the builder's verification; reflection confirmed twelve
+resources including the source receipt and the updated service recovery flag.
+Package SHA-256:
+`a5ef288f8747c44e7a3e44b9dfea027bfc207aebd428a53054186afa91107b13`.
+The management executable remains the unchanged CI build from `11faae3`, hash
+`de623e216e4ef2b81785c18615fc23e83e4716c894225ed620a860e2aea9f817`.
+The clean installer receipt does not establish full runtime reproducibility.
+The package was inspected without launching its wizard or installing services.
+
+The new Windows corresponding-source archive was exercised against clean checkout
+`c7d118c4b655d401c14fd95672ae2aff3b5ed679` and the six generated bridge inputs from
+its running native CI build. GitHub artifact provenance and SHA-256 verified those
+inputs before writing the previously absent ignored generated source files.
+The archive included 1,107 source files and pinned `hbb_common` revision
+`7e1c392c62d39c364127307cd408421dd5f8cfb0`. Every archived file hash and ZIP CRC
+passed; two independently written archives had identical SHA-256
+`74a7de90d0b3bc17782203b53605c917be3811dced1eefbc5ad1d2be64a4163c`.
+Four focused fixture checks separately verified private/untracked file exclusion,
+generated input completeness, matching/mismatched submodule pins and link denial.
+This proves the source archive operation with real build inputs, not complete
+native compilation, binary reproducibility, signing or release acceptance.
+
+### Technician MSI lifecycle on a disposable Windows CI runner
+
+Independent run `37112721733` completed successfully using fixture source
+`76e89b6fffc9acd602679b8049a7520b6739ba08` and the pinned unsigned technician
+MSI/application/agent from successful native build `11faae3`. Build provenance,
+installer checksums and the independently verified agent hash were checked before
+execution. The downloaded evidence artifact passed its GitHub SHA-256 and ZIP CRC.
+Its result identifies Windows Server 2022 Datacenter, build 20348, installation
+type `Server`. Native MSI install, forced repair after removal of the owned
+technician executable, and uninstall all returned 0. Installed/repaired executable
+and agent hashes matched the inputs; technician registry registration existed
+after installation/repair and was absent after uninstall. Uninstall also removed
+both payload executables, and the actual update-cancellation custom action passed.
+
+Earlier CI fixture attempts stopped at a missing agent checksum or timed out
+without installer logs. Named array binding and quoting only file arguments
+corrected the command invocation; the final run retained invocation records and
+all three native MSI logs. Those failed fixtures are not installation passes.
+No host installation or existing lab-service change occurred. This is unsigned
+MSI payload lifecycle evidence under the CI account, not standard-user company
+setup, enrollment, signature acceptance, a graphical session, or the full Server
+2022 compatibility matrix. The separate Server 2016 standard-user error 1601
+remains unresolved.
+
+### Published native build and corresponding source integrity
+
+Native Windows run `37110881152`, source
+`c7d118c4b655d401c14fd95672ae2aff3b5ed679`, passed all four jobs. The downloaded
+24-file artifact matched GitHub's authenticated SHA-256
+`c08f556d0ba316754886559e03dae33980f66cc832503e00b14c25b553336cc4`;
+ZIP CRC, bounded extraction and published checksums passed. Its corresponding
+source archive independently matched 1,101 public Git files, including the pinned
+submodule, and six verified generated bridge files. All source manifest hashes
+passed. The server setup's exact resource recipe, eleven payload hashes, embedded
+source receipt, six packaging source inputs and component pins also passed.
+The receipt truthfully records a dirty build working tree. This verifies supplied
+build inputs and artifact integrity; it does not establish bit-for-bit binary
+reproducibility, production signing or the outstanding Windows acceptance tests.
+
+### Technician MSI lifecycle on Server 2025
+
+Run `37115402384`, fixture source `908b447f7117c08f63315a8fbdff924b1edd4cd0`,
+passed on a disposable Windows Server 2025 Datacenter runner, build 26100,
+installation type `Server`. It consumed the same pinned unsigned build `11faae3`
+as the Server 2022 lifecycle fixture. Actual installation, forced repair after
+deleting the owned executable, and uninstall each returned zero. Payload hashes
+and registry presence/removal checks passed. The retained invocation records,
+result and native MSI logs were downloaded only after checking the successful
+run/source; the evidence artifact matched its authenticated GitHub digest and ZIP
+CRC. This covers MSI payload lifecycle under the CI account, not company setup,
+standard-user installation, graphical sessions, signing or full Server 2025
+acceptance. The local Server 2025 VM remains unbooted because available host
+memory is below its configured safety reserve; existing services were preserved.
+
+The fixture was then advanced to independently verified native build `c7d118c`
+(run `37110881152`), including its current agent hash. Run `37115549339`, fixture
+`8ad9b17c75405da0d0363635f7ba19a901c29c3a`, passed the same actual MSI install,
+repair and uninstall checks on Server 2025 Datacenter build 26100. Its retained
+result and logs passed authenticated artifact digest and CRC verification. This
+provides current-package lifecycle evidence with the same limited scope above.
+
+### Standard-user technician offline launcher failure and correction
+
+After authorized manual-equivalent lab sign-in, an isolated interactive task
+ran the installed launcher as `SwanLabTech`, session 1, administrator false.
+With management unreachable, Windows PowerShell 5 converted the agent's sync
+stderr into terminating `NativeCommandError`. The launcher stopped before its
+documented cached-branding warning and installed-package verification. Native
+process invocation now observes the actual sync exit code independently of
+PowerShell's stderr handling. A Windows PowerShell fixture demonstrates offline
+startup ordering and denies application launch when installed verification fails;
+its mocked signature gate is control-flow evidence only.
+
+The existing signed lab agent/application independently passed real signature,
+hash and pinned-publisher verification. With only the launcher development fix
+applied, the same owned task reached the offline warning, passed real installed
+verification and started the technician executable under the standard account.
+Its original launcher and failed diagnostic logs remain preserved privately.
+The executable subsequently exited without a visible technician window. This
+fixes the observed launcher failure; graphical startup and native sessions remain
+unverified and require further investigation. No host production service changed.
+
+The subsequent Application Error event identifies the portable technician EXE
+itself, exception `0xc0000409`, offset `0x2ab55`. An owned interactive diagnostic
+launched the unchanged signed EXE with explicit standard input/output/error pipes.
+It returned zero and spawned `rustdesk.exe` in the same standard-user session;
+the actual window displayed the cached company technician name, teal swan/gear
+mark, company HTTPS domain, support link, username/password/TOTP fields and
+product/license attribution. No technician login or native connection passed.
+
+The launcher now supplies and asynchronously drains the portable wrapper's
+standard handles, keeping the readers alive until inherited child pipes close.
+The Windows PowerShell fixture additionally spawns a child that writes 128 KiB
+to each output stream after its parent exits, and verifies child completion
+before launcher return. All three launcher control-flow cases pass. The final
+combined launcher still needs a newly generated package and native lifecycle
+verification; the observed GUI used the isolated handle diagnostic with the
+existing signed lab package. Original failure evidence and existing services
+remain preserved.
+
+### Combined launcher and deployment-check follow-up (2026-10-03)
+
+The final combined launcher ran in the owned Server 2016 interactive task as
+SwanLabTech, session 1, administrator false. Real installed-publisher verification
+passed; the company-branded technician frontend remained open without a recorded
+launcher failure. The task remains running while it drains inherited GUI output
+pipes. This used the existing signed lab binaries with the development launcher,
+not a newly generated release. GUI MFA login and native connections remain
+unverified: the computer-use helper could not activate the TigerVNC options modal,
+and its documented selection/activation recovery failed. No credentials were
+entered into an uncertain field and no alternative UI injection was used.
+
+The existing guest management service started after its signed executable and
+loopback-only proxy configuration were verified. Normal guest HTTPS validation
+returned 200 for the company profile; the customer process and installer worker
+were preserved. No host service, DNS, firewall or trust settings changed.
+
+Native Windows build 37120044435 was dispatched once from 01d24ab to embed both
+launcher fixes. It is pending; build completion, artifact integrity and generated
+package verification must be recorded separately.
+
+Component run 37120224142 at 6b23cca passed Ubuntu and Windows workspace tests
+and builds, including all three Windows PowerShell technician-launcher cases.
+The Docker context check, image build, company setup and persistence passed after
+adding the three required public inputs to both deny-by-default allowlists.
+The later stack probe failed with a reset on the NAT-test socket. The probe now
+uses the owned container's private bridge address because upstream hbbs treats
+loopback peers on that port as administrative text connections. Published host
+sockets retain separate connection checks. The KeyExchange protobuf tag was also
+corrected to field 25. Actual stack verification of this change is pending; this
+is not public NAT traversal or remote-session evidence.
+
+### Native launcher packaging and Linux export follow-up (2026-10-03)
+
+Native build [37120044435](https://github.com/rijff24/SwanRemoteSupport/actions/runs/37120044435)
+passed all four jobs from `01d24ab97cef1c7d9d29da252c55ea33a747c18f`,
+including both MSIs and company server setup. Its technician lifecycle evidence
+artifact `11273971224`, SHA-256
+`ba8e4a0d4967cb0f0dfdaf068578cc75b89736c622e2f3687f0928bbb825ba42`,
+passed authenticated digest verification and ZIP CRC. The actual retained native
+logs show zero returns for install, repair and uninstall and no `Return value 3`.
+The fixture's payload and registration checks passed on Windows Server 2022
+Datacenter build 20348. This is unsigned MSI payload lifecycle under the CI
+account; standard-user company enrollment, GUI authentication, signed upgrades
+and native remote sessions remain separate requirements. Main package download
+and independent payload/source verification are still pending.
+
+The new run's six-file generated bridge artifact `11273340217`, SHA-256
+`79f58d06a556f10da21d83d064e13c7de81a160c236299f70b5f61bfbfa46264`,
+passed source-revision, digest, recipe and CRC verification. This is generated
+build-input integrity, not binary reproducibility.
+
+Both component runs at `d724321` passed: push `37121916090` and pull request
+`37121918050`. Their Linux deployment checks include the corrected private-bridge
+NAT protocol probe, bounded readiness of the same owned container, three distinct
+complete exports from stopped read-only transport/TLS volumes, authentication
+failure without restore writes, actual restore, and retained company, transport,
+TLS, MFA, device and consent identity. Host-published sockets retain separate
+checks. This remains an isolated deployment rehearsal, not external NAT traversal
+or an authorized remote desktop session.
+
+Earlier parallel Linux runs intermittently failed complete export with SQLite
+error code 14 (`SQLITE_CANTOPEN`). They remain failed evidence despite subsequent
+passing exports. Distinct management/transport open and snapshot error contexts
+and redacted error-category reporting were added; no captured backup output or
+credentials are printed. The precise failed operation has not yet been reproduced
+with those contexts. Backup reliability remains an open concern.
+
+### Read-only transport WAL defect reproduced and corrected (2026-10-03)
+
+The Unix regression `readonly_transport_wal_export_preserves_committed_peers`
+failed in run `37123006043` at source `8fc7ed0`: transport snapshot returned
+SQLite code 14 when committed WAL frames existed, the source directory was
+read-only, and no shared-memory file existed. This reproduces a concrete defect
+with the same error code as the earlier intermittent exports; those earlier
+logs did not identify the precise failed operation.
+
+Transport export now copies the stopped database and its WAL/rollback journal
+into private writable staging, lets SQLite recover and snapshot that copy, and
+removes fixed temporary files and the owned directory afterward. Copies are
+bounded to the declared file length plus one byte and a combined 512 MiB limit;
+regular-file/reparse checks reject unsafe sources. The original transport
+storage is untouched. Transport must remain stopped for a consistent multi-file
+copy, as documented in `SERVER_BACKUP.md`.
+
+The regression passed at `f71773bd54190d14ad0332ff1ac6e5213f3f879b`, verifying
+restored committed peer data, unchanged source database/WAL bytes and cleanup of
+plaintext snapshots/staging. Both full component runs passed: push `37123392820`
+and pull request `37123395298`, including Windows tests/builds and the complete
+Linux deployment/export/restore rehearsal. Local Windows GNU type checking also
+passed; local test execution was unavailable because that toolchain lacked
+`libgcc_eh`, and is not counted as a test pass.
+
+A new full native build `37123744363` was dispatched once from the verified
+`f71773b` source to package this runtime fix. It is still pending. The earlier
+`01d24ab` installer archive remains in its original live download process;
+no partial download was replaced or treated as verified.
+
+### Native package provenance and failed-export cleanup (2026-10-03)
+
+The original download of native run `37120044435` completed successfully.
+Its 24-file archive passed authenticated artifact SHA-256
+`61a7618abd11fa1a60138f7ec944499e7d18460f1a86ff1fc6153c884d77f452`,
+ZIP CRC and published payload checksums. Independent checks verified all 11
+embedded server setup resources, embedded/external source receipt agreement,
+standalone management payload agreement, six public setup source inputs and
+pinned transport/proxy hashes. The published source archive matched 1,103
+public Git files at `01d24ab` plus six independently verified generated bridge
+files. Its working-tree-dirty flag is retained; matching archived inputs is
+source provenance, not proof of a clean checkout or binary reproducibility.
+
+The packaged technician launcher matched its exact public source after line
+ending normalization. The technician MSI, portable executable and agent hashes
+matched their build manifest. The retained CI lifecycle receipt does not include
+an independent hash of the tested MSI; its successful install/repair/uninstall
+evidence remains scoped to that CI job and must not imply fresh-company or
+standard-user acceptance. These artifacts predate the `f71773b` backup fix.
+
+At `5ae76f3`, `failed_transport_snapshot_removes_private_staging_without_changing_source`
+passed in actual Windows MSVC and Linux test logs. The fixture verifies that
+an invalid transport database fails export, leaves no archive or private plaintext
+staging, and preserves the source bytes. Both complete component runs passed:
+pull request `37124053449` and push `37124051532`, including the isolated Linux
+deployment rehearsal and Windows launcher checks. This test-only commit does
+not change the runtime currently being built in native run `37123744363`.
+
+### MSI evidence bound to tested artifacts (2026-10-03)
+
+The lifecycle fixture at `940c64f` now records the package SHA-256, expected
+installed payload hashes and fixture revision in its retained receipt. Each
+native invocation records the package hash, and the fixture checks that the
+package remains unchanged before and after each operation. Fixture revision
+identifies the test code; it does not imply that older downloaded binaries were
+built from that revision.
+
+Disposable Server 2022 run `37124891111` passed installation, deliberate payload
+removal followed by repair, and uninstall against the pinned `c7d118c` package.
+Evidence artifact `11275180118` passed authenticated SHA-256
+`9940004bb6893f8cade24d18667bc0ebe5cd3140c84aa72ec37d23b3e8c93def`
+and CRC verification. The receipt and all three invocation hashes matched the
+independently retained MSI SHA-256
+`5083a718a1b7f367fe680ada622ca8ce6a55c99f55bf80224c7841d3c257979b`;
+expected executable/agent hashes matched the retained native build. All three
+native logs contained successful zero returns and no `Return value 3`.
+This strengthens artifact-specific lifecycle evidence for that older package;
+it does not cover the new backup runtime, standard-user enrollment, production
+signature acceptance, GUI login or remote desktop sessions.
+
+### Authorization expiry boundary (2026-10-03)
+
+Review identified that an in-flight renewal response could extend an already
+expired device-side lease. At `391541e`, renewal rejects an expired lease before
+the request and again before applying the response. The request timeout is
+bounded by the remaining lease time and the normal 15-second limit. The receiving
+native app also closes an authorized connection on an incoming packet when its
+lease has expired, instead of relying only on the next periodic timer tick.
+
+`delayed_renewal_cannot_resurrect_expired_authorization` passed in independently
+read Linux and Windows MSVC logs from pull-request run `37125172883`. Both full
+component runs passed, including push `37125170016` and the isolated Linux
+deployment rehearsal. Local Windows GNU type checking passed. These prove the
+renewal validation regression, not a live native session or its termination.
+Native build `37125194672` is running from this exact source; build `37123744363`
+contains the earlier backup fix and cannot validate the new expiry behavior.
+
+### Native backup runtime verification (2026-10-04)
+
+Native runs `37123744363` (`f71773b`, backup fix) and `37125194672`
+(`391541e`, authorization expiry fix) completed successfully. The latter's
+package download remains pending independent verification. The former's archive
+`11275251202` passed SHA-256
+`bb99ad350b2f633cf738fc91028e2e80794b77575229e688a3a84322ee841125`,
+CRC and payload checksum verification. Independent checks matched 11 embedded
+server resources, six setup source inputs, component pins, 1,103 public Git
+files and six generated bridge files. The dirty-checkout flag remains retained;
+this is source provenance, not binary reproducibility.
+
+The verified native management executable SHA-256
+`f193918d1c089172c5de88ca62fd7d56323498f36050b53619ccc4693aa5fa55`
+passed a synthetic Windows CLI export/restore rehearsal. Its stopped transport
+fixture contained committed WAL frames and no SHM, with a read-only directory
+ACL verified by a denied write probe. Restore retained the committed peer row
+and management trust files. Source bytes stayed unchanged, no SHM appeared in
+the source, and plaintext staging was removed. Invalid transport export left no
+archive or staging; tampered restore created no destination. Fixture setup first
+failed because Windows PowerShell inherited incompatible module paths; correcting
+only the child process environment allowed the actual runtime test to execute.
+No existing service, company database or host security setting was changed.
+This is native CLI behavior with synthetic data, not service deployment or a
+real-company disaster recovery test.
+
+The build's retained MSI lifecycle artifact `11274617033` independently passed
+SHA-256 `659aa1ee0a18f18dcb30494e4a13937aeeeeb4eb4cec5c0f859d74aa37cdead2`,
+CRC and native successful install/repair/uninstall log checks on Server 2022
+build 20348. Its older fixture lacks package hashes in the receipt; standard-user
+enrollment, GUI login and native remote sessions remain unverified.
+
+The authorization-expiry native build's MSI evidence artifact `11274947759`
+also passed authenticated digest
+`4dc584d2a4cbdc62f1e247ff76395173ead5364b4ffc0e12555e2091e533ab60`,
+CRC and successful native install/repair/uninstall log checks. Its receipt and
+all invocation records identify fixture `391541e` and MSI SHA-256
+`91b63c8cb2f164d25955c10ae82b8e5bc7dc2d10ac9ae3b99680a42f4132d33f`.
+Comparison of that recorded package/payload identity with the main downloaded
+archive remains pending; the archive's original process is still running.
+This evidence remains limited to unsigned Server 2022 CI payload lifecycle.
+
+### Expiry-fix artifact and native backup checks (2026-10-21)
+
+The interrupted `391541e` download was found stopped with 111,149,056 bytes
+retained and no live downloader. Resume requested only the remaining byte range
+of the authenticated artifact; the complete 24-file archive passed SHA-256
+`b627e5369fff25f0555159577b14956e06f983facd963e3c059a1cc3fe14eb37`,
+ZIP CRC and published payload checksums. Independent verification matched the
+11 server setup resources, six source inputs, pinned components, 1,103 public
+Git files and six generated bridge files. The MSI, technician executable and
+agent matched the hashes recorded by the CI lifecycle test. This resolves the
+pending artifact comparison above; dirty-checkout and binary reproducibility
+limits remain unchanged.
+
+Native management SHA-256
+`c2b3cc3c20ab5199777d1bacddedf2d31deff0bef4a6ea311ac77975afd9b0c1`
+passed the same synthetic Windows read-only WAL export/restore, unchanged-source,
+staging cleanup, invalid-transport failure and tampered-restore checks. This
+verifies backup CLI behavior in the current packaged runtime; it does not verify
+native session expiry, company disaster recovery or deployment lifecycle.
+
+The existing disposable Server 2016 VM was restarted through its verified
+launcher without changing its memory guard or network settings. An encrypted
+management probe confirmed `SWAN-LAB-16V2`, Server 2016 Standard Evaluation,
+64-bit build 14393. Boot and guest identity are readiness evidence only; no new
+GUI login or remote-session acceptance is claimed.
+
+### Native technician login and failed rendezvous attempt (2026-10-21)
+
+The existing signed lab technician installation launched as unelevated
+`SwanLabTech` in session 1 after configuration sync and two successful package
+signature checks. File preparation was slow but showed changing read/CPU
+counters; the original process was retained until its frontend opened. The
+native company-branded form accepted the restricted `lab-technician` account
+and a fresh TOTP, then displayed the approved lab device in its authorized
+inventory. Credentials and the authenticator secret were kept private. This
+uses the existing older signed lab payload, not the newly downloaded release.
+
+Requesting attended support opened the native connection window for the
+enrolled device, then failed with `Failed to connect via rendezvous server`.
+No customer-consent prompt or desktop session was demonstrated. Client logs
+recorded three TCP punch attempts; the lab hbbs log recorded Windows UDP error
+10014 and UDP-loop restarts at the same three times. Both endpoint state files
+had accepted profile revision 15, whose transport addresses resolve to the
+loopback-only lab server. This is failed transport acceptance, with diagnosis
+pending; it is not evidence of working NAT traversal or relay fallback.
+
+After the long lab downtime, the TLS front end initially served an expired
+internal leaf certificate. A normal restart of the verified guest company
+service restored validated HTTPS; customer and worker services stayed running.
+No invalid certificate was accepted. The viewer's relative mouse mapping also
+misplaced clicks; full-screen keyboard capture allowed verified keyboard-only
+form navigation. Adding a USB controller live was rejected by the VM's PCI bus,
+so no live USB hardware change succeeded.
+
+### Candidate Windows UDP correction (2026-10-21)
+
+An isolated Winsock probe on Server 2016 build 14393 reproduced error 10014
+when an IPv4 destination was passed to a dual-stack IPv6 UDP socket. The same
+probe delivered its datagram when the destination used an IPv4-mapped IPv6
+address. No existing service or network configuration changed for this probe.
+
+Commit `e7953c9` provides pinned public transport inputs, two reviewed patches,
+and workflow run `39596805961`. The Windows 2022 baseline reproduced error
+10014 in the actual shared Rust UDP message path while the IPv4 and IPv6
+controls passed. After destination normalization, all three real socket tests
+passed on Windows and Ubuntu 24.04. The tests cover protobuf message delivery,
+raw datagram delivery, IPv4 sockets, and native IPv6 destinations. An earlier
+test fixture used the wrong protobuf field; its correction exposed interleaved
+parallel test output. The final fixture runs sequentially and retains strict
+failure and control checks; a compilation failure does not count as reproduction.
+
+Both candidate executable builds succeeded. The four downloaded candidate and
+regression artifacts passed their authenticated archive digests, ZIP integrity,
+receipt, patch, lock, and public recipe checks. The Windows candidate artifact
+`12344418248` has SHA-256
+`be388753b8b3edf3530dceea59137b1477300cb67eb46d6cc1a12a584c4e3049`.
+The source receipt identifies PR merge `c09c4bd8ac85f86e1f0fd10d2853a09b266545a4`;
+its parent includes `e7953c9`, and archived recipe files match that reviewed
+revision. This is input provenance, not binary reproducibility.
+
+On the existing Server 2016 build 14393 guest, candidate `hbbs.exe` SHA-256
+`83d402b48cec61513b6a0e3a6277c648b31a6ccbce0b87eee022b96ca746a443`
+and `hbbr.exe` SHA-256
+`8ba65379f7a025cad6ec0520d481af62c135e117ac58ac7b460c7b1afbf751cd`
+both started and reported version 1.1.14, as specified by the pinned upstream
+Cargo package. The candidate rendezvous server then answered real IPv4 and
+IPv6 `RegisterPeer` datagrams with a request for a public key. It used separate
+ports and a fresh database/key directory, logged no UDP failure, and was stopped
+after the test. The temporary loopback artifact transfer server was also stopped.
+Existing company, worker, customer and technician processes remained running.
+
+Existing distribution pins and lab services have not been replaced. These
+unsigned candidate checks establish startup and basic registration on Server
+2016; they do not establish a native authorized session, relay operation,
+external NAT traversal, complete Windows compatibility, or release readiness.
+
+### Native attended session through parallel patched transport (2026-10-21)
+
+The candidate ran alongside the original lab company services on rendezvous
+32116 and relay 32117, using a separate database and a protected copy of the
+lab transport keys. A normal authenticated profile change published revision
+16 with those addresses and paused lab updates. Both endpoint state files
+accepted the signed revision; customer identity, release sequence and unattended
+consent (`false`) were preserved. Original component pins and services stayed
+intact. No host DNS, firewall, trust store or Tailscale setting changed.
+
+This exposed two runtime configuration defects. The running technician accepted
+the new profile but continued selecting port 21116. Commit `74c3449` applies
+transport defaults after synchronization and before a new outgoing request.
+The customer, booted after its cached profile expired, kept resolving the
+fail-closed `unconfigured.invalid` address: DNS failed before either transport's
+refresh timer could run. Commit `bd13500` also reloads signed settings before
+each outer rendezvous retry. Native build `39600988305` is verifying both fixes;
+neither fix's runtime acceptance is claimed yet. The initial suspicion of a
+transport-ID mismatch was disproved: native and enrolled IDs matched.
+
+Restarting the existing signed lab technician and customer service consumed
+revision 16 without changing identity or consent. The customer registered its
+public key with the parallel server. The technician's actual branded GUI login
+with the restricted account and fresh TOTP obtained a grant, punched a secure
+local TCP connection, and reached the customer's Accept/Cancel prompt. Explicit
+customer acceptance at 14:43:23 lab time opened a VP8 desktop stream and the
+clipboard loop. The desktop was visibly rendered; the recursive image is
+expected because both editions ran in the same VM. The management service
+recorded the grant as claimed and renewed its lease.
+
+Device-authenticated closure of that specific grant stopped clipboard, video
+and audio at 14:45:21. The client requested a fresh grant but returned to the
+customer approval prompt. Closing that pending reconnect also closed its grant;
+no continuing desktop access was observed. Viewer relative-pointer offset made
+consent input difficult; measured pointer correction eventually selected Accept.
+The existing signed endpoint payloads were used, not the pending native build.
+This establishes an attended local session and enforced grant closure with the
+candidate transport. It does not establish natural lease-expiry behavior, data
+transfer or clipboard-content correctness, unattended access, separate-machine
+input, external NAT traversal, relay fallback, or the full Windows test matrix.
+
+### Reboot and relay-test follow-up (2026-10-21)
+
+The disposable Server 2016 guest was shut down and relaunched with a USB tablet.
+The company server, installer worker and customer service started automatically;
+HTTPS worked, and device identity, consent and release sequence were preserved.
+The manual parallel transport task was restarted separately. The viewer's
+connection-refused dialog during shutdown cleared after reconnecting. Absolute
+pointer input subsequently selected the actual customer Accept button without
+the previous relative-pointer compensation. Windows displayed Shutdown Event
+Tracker, so clean shutdown-event logging is not claimed.
+
+The existing customer payload again remained on `unconfigured.invalid` after
+startup despite accepting profile revision 16. Restarting only that lab service
+recovered registration. This reproduces the pending configuration-retry fix;
+it is not evidence that the new native build has passed. Build `39600988305`
+reached the branded-client compilation step after its prerequisite jobs passed.
+
+The parallel server reported `ALWAYS_USE_RELAY=Y`, but the subsequent accepted
+session still logged a secure local TCP connection (`is_local: true`). The
+server preference therefore did not make this same-machine test a relay test.
+Desktop video appeared after customer approval at 15:04 lab time. Later the
+guest display stopped changing, both WinRM probes timed out, and SSH timed out
+during banner exchange while QEMU reported the VM running. Attempts to close
+the native connection through its window were not confirmed. The guest state
+was preserved for diagnosis; the cause of the unresponsiveness is unproven.
+Relay operation, session closure for this attempt, and post-failure recovery
+remain unverified.
+
+### Private signed packages and standard-user attempt, 21 October
+
+Source `bd1350012227f226db168be51bc823d3f086e493` now has private-lab
+customer and technician 1.5.7 MSI wrappers, plus signed agent and worker inputs.
+Authenticode publisher, pinned certificate and RFC3161 timestamp checks passed
+in the signing guest. This is company lab signing, not project signing approval.
+Signed release metadata for test channel sequence 8 was prepared and locally
+verified; it has not been imported, approved or rolled out.
+
+On the disposable Server 2025 build 26100 guest, a new non-administrator account
+verified the signed technician MSI's expected hash, publisher and certificate.
+Its background scheduled-task installation then failed with MSI exit 1601:
+the raw log reports access denied (0x80070005) connecting to Windows Installer.
+Repair and uninstall were not attempted. The account needed an explicit batch
+logon right to start the task; it was never added to Administrators. This failed
+background test does not establish interactive standard-user install behavior.
+The result, wrapper and raw MSI log were exported and retained privately.
+The VM console subsequently showed a black display while administrative remote
+access remained available; an interactive rerun is still outstanding.
+
+The second guest cannot yet reach the company HTTPS service because that
+service binds only to the first guest's loopback address. Automatic approval
+review rejected the proposed private-NIC listener addition and service restart
+with only "blocked by policy." No listener change was applied. A reviewable
+private draft and an explicit approval request remain pending. The initial peer
+HTTPS request timed out; this is not a passing negative certificate test.
+Cross-machine native sessions and the runtime configuration fixes remain
+unverified. Host RustDesk and its transport servers were not stopped.
+
+### Matched worker and interactive MSI follow-up, 21 October
+
+The Server 2025 console recovered to its normal logon screen. The same signed
+technician MSI was then tested as the non-administrator account in interactive
+session 1. Publisher verification passed, but installation returned 1625. The
+raw MSI log says `DisableMsi` is 1 and rejects non-assigned applications for
+non-admin users; repair and uninstall were not attempted. This independently
+reproduces the Server 2016 policy limitation documented in INSTALLER_REPAIR.md.
+No Windows Installer policy was changed. Both failed attempts remain evidence;
+neither is a passing standard-user MSI lifecycle test.
+
+The `bd1350012227f226db168be51bc823d3f086e493` worker was privately signed and
+installed over the isolated lab worker with a rollback binary/receipt retained.
+The service runs with its existing protected configuration. After administrator
+MFA login, both sequence-8 releases were imported and approved with rollout
+still paused. Unapproved build requests did not change the queue, but returned
+500. The source now returns 404 for unknown releases and 409 for unapproved
+releases, with regression assertions covering anonymous/technician denial and
+an unchanged build count. CI verification of this correction is pending.
+
+The new worker verified the signed packages and generated both ZIP bundles,
+but upload to the older installed management service returned 400. The worker's
+embedded launcher differs from the older server's expected launcher. Neither
+job reached completed state; generated files alone do not demonstrate server
+publication. The matching management binary was signed and timestamp-verified
+(private lab hash `cf7b5077a633f8ff9ad830d2e2a9847d16b35494bbeaf061645abbe8c37c07d4`),
+but has not been installed.
+
+Automatic approval review rejected the proposed management-backup preparation
+with only "blocked by policy" before any command ran. No release withdrawal,
+backup, restore or management-service change occurred. A separate reviewable
+private draft and approval request remain pending. This is distinct from the
+previously rejected private-NIC HTTPS listener change. Host services were not
+changed; latest native runtime, cross-machine and update acceptance remain open.
+
+### Latest component checks and local customer upgrade, 21 October
+
+Component workflow `39629396018` passed for exact source
+`8c321705e0b3450f440e3c1a7ade6a328aad47ec`: locked Rust tests and release builds
+on Linux and Windows, Windows setup/launcher/removal checks, and the Linux
+HTTPS/transport deployment rehearsal. The new release-request assertions passed
+on both operating systems. The first attempt failed because the test expected
+403 instead of the existing administrator-only authentication response 401;
+the test was corrected without changing authentication policy.
+
+Both `bd13500` worker ZIP files passed independent path/count/CRC, exact source
+script/license, signed profile/release and package/agent hash checks. Bootstrap
+company identity, endpoint and both public trust keys matched the independently
+installed customer state. These checks do not turn the rejected server uploads
+into completed publication jobs.
+
+Using that verified local customer bundle, an explicit Server 2016 upgrade from
+1.5.6 sequence 7 to 1.5.7 sequence 8 passed. Device identity/token, unattended
+consent and its revision were preserved, expected native/agent hashes matched,
+recovery markers cleared, and the support service and configuration watcher
+ran afterward. This was local explicit setup, not automatic rollout or a public
+download test. The separate transport candidate was restarted after preserving
+its previous logs; the upgraded native receiver contacted the configured
+32116 endpoint and received a public-key registration request and NAT response.
+This is not a separate-machine or relay desktop-session test.
+
+Runtime logs also showed legacy RustDesk Pro HTTP heartbeat/sysinfo attempts.
+The source now disables that endpoint and ignores unsigned legacy strategy
+options for `swan_custom` editions. The native Windows workflow includes an exact
+regression-test gate requiring one executed passing test. Native compilation
+and runtime verification of this guard remain pending; no unauthorized desktop
+session through legacy strategy was demonstrated. The installed `bd13500`
+candidate predates this guard and is not approved for production.
+
+A new isolated Server 2019 evaluation VM was created from the verified official
+ISO, with a unique NIC address and private credentials/seed outside Git. The idle
+Server 2025 guest shut down normally before launch. Server 2019 installation is
+in progress, not yet a passing product compatibility test. Host RustDesk and
+its server remain running. The rejected management backup and HTTPS listener
+operations remain unchanged pending explicit approvals.
+
+### Clean signed Server 2019 MSI lifecycle, 21 October
+
+The new VM installed Windows Server 2019 Standard Evaluation Desktop Experience
+x64, exact build `17763.3650`, from the verified Microsoft evaluation ISO. Its
+unattended lab bootstrap did not run; authenticated remote administration verified
+the guest before the hash-pinned private seed bootstrap was run manually. SSH
+provisioning completed, automatic logon was disabled and readiness was recorded.
+This was lab OS preparation, not a product installer failure.
+
+After verifying staged source/package hashes, the unique NIC address and absence
+of Swan product services, Windows shut down normally. The stopped QCOW2 disk
+passed its integrity check and received clean checkpoint
+`swan-clean-server2019-bd13500`. It then booted with installation media detached.
+
+Both privately signed 1.5.7 MSI packages from exact native source
+`bd1350012227f226db168be51bc823d3f086e493` passed install, repair and uninstall
+as `SWAN-LAB-19\Administrator` (administrator true, session 0). Each package
+passed its pinned publisher/certificate/hash verifier before its lifecycle phases.
+The public lifecycle runner verified Windows Installer registration, installed
+payload identities, customer service ownership/state, technician shortcut and
+registry entries, damaged customer license repair, and uninstall cleanup.
+All six MSI exit codes were 0, with no reboot required. Exported reports matched
+the pinned runner and package inputs; independent raw-log checks found successful
+engine returns and no `Return value 3`. The machine's trust changes were limited
+to the public private-lab publisher certificate in the disposable guest.
+
+Private receipt `windows-server2019-results-bd13500/verified-lifecycle.json`
+retains hashes for all six reports and raw logs. This is signed administrator MSI
+lifecycle evidence, not standard-user installation, company enrollment, native
+sessions, approved automatic rollout or complete Server 2019 acceptance.
+
+The native Windows build for the legacy-sync guard is workflow `39631663952`,
+exact source `c0bf4b40ff8257c9fb69e4c5f6aceb2394f1adc0`. Bridge/helper jobs passed;
+its native build and exact regression gate are still running. Do not substitute
+the older `bd13500` installed candidate for runtime verification of that guard.
+The lab management-backup and private-NIC HTTPS operations remain unapplied
+pending the explicit approvals requested after automatic review rejected them.
+
+### Company bundle entry point implementation, 21 October
+
+The company bundle recipe now includes `Install-SwanRemoteSupport.cmd` as an
+exact server-validated file. It starts 64-bit Windows PowerShell from the
+extracted bundle, including from a 32-bit calling environment. Customer setup
+can request elevation before enrollment or installation state is created;
+technician setup retains the current user's context. Explicit repair, failed
+setup replacement and consent flags survive a customer elevation handoff, while
+the elevated child still performs the existing company and package checks.
+A cancelled or failed handoff returns failure. The default entry point does not
+opt into unattended access.
+
+Local Windows PowerShell 5.1 checks passed: malformed/HTTP bootstrap rejection,
+no technician elevation or state writes on signature rejection, argument/error
+routing fixtures for a non-admin customer caller, and a real CMD-to-PowerShell
+run with LF bundle text and spaces, ampersand, apostrophe and exclamation mark in
+the folder name. That real entry-point run rejected an unsigned inert agent and
+returned failure without installation or enrollment. The elevation broker was
+replaced only in the routing fixture; these checks do not demonstrate a real
+successful UAC handoff or a complete installed company bundle.
+
+Windows CI now runs the entry-point checks, and bundle validation tests reject
+missing or changed entry-point bytes. Both Docker context allowlists include
+only this new required public script. CI builds and actual company-generated
+bundle acceptance for this recipe remain pending. Server and worker must use
+the matching updated recipe. The customer installation guide now describes the
+configurable company flow and links the Tailscale instructions to the preserved
+baseline rather than presenting them as current setup.
+
+### Real setup elevation handoff and native guard build, 21 October
+
+The actual Server 2016 UAC broker was exercised from the existing standard lab
+account in interactive session 1 using setup source
+`0d17a30cd2e323f87e798eabab5aa53918096d3f`. The expanded prompt showed the exact
+pinned setup path, bootstrap path and confirmed test domain. Authentication used
+only the disposable VM's administrator. The parent received elevated exit code 1
+from the unsigned inert-agent fixture and correctly reported failure. Its task
+completed successfully as a test, with the parent still non-administrator.
+An independent fingerprint comparison preserved installed customer identity,
+credential, unattended consent/revision and installed release. This verifies
+actual elevation and failed-child propagation; it is not successful installation
+or remote-session control of a UAC secure desktop.
+
+The native guard workflow `39631663952` completed successfully. Its native log
+records exactly one executed passing
+`hbbs_http::sync::managed_sync_tests::managed_sync_rejects_legacy_endpoint_and_unsigned_options`
+test (0 failures, 71 filtered out). Artifact `12365255815` is 141,969,478 bytes,
+with GitHub SHA-256 `8de1a2b18ffffa86106d24dbbc2f641dec225c802b9f7d18afa5417282a3c391`.
+The existing download is live and progressing; archive/source validation,
+private signing and installed runtime rejection of legacy traffic remain open.
+This build predates the new company-bundle CMD entry point.
+
+Hosted Windows CI exposed a setup-test input bug: .NET Framework flushed a UTF-8
+byte-order mark into redirected stdin at process creation, before a replacement
+writer could be attached. Setup safely rejected the resulting hostname mismatch.
+That failure was reproduced locally with a BOM-emitting console input encoding.
+The fixture now selects a BOM-free encoding during process creation and restores
+the previous encoding immediately; both the reproduced environment and normal
+Windows PowerShell run pass. Production hostname confirmation was not relaxed.
+Hosted Windows CI subsequently passed in push run `39642194595` and PR run `39642203316` for source `43e5b37dc09fa0ed04bb5e602ca07dc19d705592`. Both runs also passed Linux component and Linux deployment verification.
+
+The component workflow now preserves corresponding component/deployment source
+before compilation and exports unsigned test binaries with source/compiler
+metadata and hashes after successful checks. The source archiver's component
+mode omits unrelated client bridges/submodules and private untracked files while
+preserving actual file bytes; all five source archive tests pass locally.
+The successful push run exported Windows and Linux component artifacts, each with corresponding source and hashes. Independent downloaded artifact/source verification and runtime acceptance remain pending. Production
+signing, matching company server/worker runtime, public connectivity, complete
+Windows coverage and the remaining session/update/restore gates remain open.
+
+### Downloaded component provenance and fresh management runtime, 21 October
+
+Windows component artifact `12366376059` from successful workflow `39642194595`
+was downloaded and checked against GitHub's SHA-256
+`6cb1a4f73f8fd601b26b2530b7cb393ead02ac7b17f79955895ea0ce21a60963`.
+All five entries passed CRC and declared hash verification. An independent check
+compared all 114 component source files, modes and manifest hashes with public
+Git revision `43e5b37dc09fa0ed04bb5e602ca07dc19d705592`, accounting for checkout
+line endings. These checks prove corresponding build inputs, not bit-for-bit
+binary reproducibility or production signing.
+
+That exact management executable ran against a fresh, protected company directory
+and an ephemeral host loopback HTTP listener. Seventy-four assertions passed:
+one-time setup, setup/MFA replay rejection, signed branded profile revision,
+technician role and group restrictions, pending enrollment denial, target-bound
+signed grants, tampered and repeated claim rejection, permission reduction,
+unattended opt-in/revocation and stale consent rejection, build rejection without
+queue mutation, worker authentication/revocation, audit history, user disable and
+logout. A process restart preserved company key, branding revision, device
+enrollment, closed grant history and revoked access. The isolated test process
+was stopped afterward; existing company and transport services were untouched.
+This is executable/SQLite/HTTP API evidence, not HTTPS deployment, native desktop
+authorization, installer generation, migration, backup/restore or update evidence.
+
+The earlier worker/server bundle upload rejection motivates a compatibility
+handshake before claiming jobs: the worker checks an authenticated recipe endpoint
+and the server checks the matching versioned digest on every claim before queue
+mutation. Old or different recipes are rejected explicitly. Source regression
+checks cover preserved queued/expired claims on mismatch and preflight responses
+from old/incompatible servers. Push workflow `39644529161` and PR workflow
+`39644541313` passed for revision
+`481439d62af5189706a1b83263af53d603f7de19`. Windows and Linux logs confirm the
+recipe normalization/content regression, management claim-compatibility regression
+and real loopback HTTP worker preflight regression executed and passed. Linux
+deployment checks also passed. Independently downloaded executable and installed
+worker verification of this change remain pending.
+
+### Verified compatibility runtime and next signed lab candidate, 21 October
+
+Windows component artifact `12366189203` from workflow `39644529161` passed
+independent archive verification against SHA-256
+`155e077843dedf212be655d122c57d00bbea034d100af4c4b064f6418f1b2100`, all five
+payload entries and all 114 corresponding source files at revision `481439d`.
+Its actual management executable passed 80 isolated loopback HTTP assertions,
+including a recipe digest independently recomputed from its verified source and
+rejection of missing/wrong claim digests. A second fresh-company run passed 85
+assertions, adding naturally elapsed grant expiry and authorization-lease expiry:
+an unclaimed ticket was rejected after its 60-second lifetime, and an existing
+lease could not be renewed after more than 300 seconds. No host clock changes,
+mock timers or database expiry edits were used. Both test processes stopped.
+These remain management API results; active native desktop disconnection on
+lease expiry still requires separate evidence.
+
+Native artifact `12365255815` finished downloading and matched its GitHub digest.
+Independent validation compared 1,111 tracked source files and six generated
+bridge inputs with pinned public Git/CI inputs. All 95 extracted customer payload
+files matched the published installed-file manifest. The technician MSI and both
+payload hashes also matched the separately verified successful Server 2022 CI
+install/repair/uninstall evidence. This does not prove enrolled native sessions.
+
+A private lab candidate combines native source `c0bf4b4` with component source
+`481439d`; the separate origins are retained in its input/signing records. The
+native applications and three component executables received verified timestamped
+signatures from the existing nonexportable disposable-VM publisher. New customer
+and technician MSI version `1.5.8` packages were built with the pinned WiX recipe
+and separately signed/verified using that same private lab publisher. No private
+key was exported, host trust imported, installed service replaced or production
+publication performed. These packages still require installation, enrollment,
+upgrade and native-session verification.
+
+### New candidate uninstall regression, 21 October
+
+The signed composite `1.5.8` candidate was exercised on the same Server 2019
+guest after the prior `1.5.7` lifecycle. Customer installation and deliberate
+license-damage repair passed. Customer uninstall failed with MSI 1603 / custom
+action 1722 at `RemoveCompanyConfigurationTask`; technician cases were not
+reached. The full failing report and raw log were preserved. This is a failed
+acceptance gate, not a six-case success. Windows Installer rollback retained
+the installed customer executable/agent and running service.
+
+The existing cancellation helper rejects a retained uninstall rollback record.
+Successful prior bare MSI uninstall left that record until explicit verified
+company setup, making a later bare reinstall/removal encounter stale state.
+The fix adds a commit-only cleanup action using an embedded copy of the release
+agent, since its installed copy has already been deleted at commit. Cleanup is
+restricted to the canonical customer directory, validates both rollback records
+before removal, rejects reparse points and an agent still present, and preserves
+the uninstall cancellation marker, identity and consent. Rollback data remains
+available until transaction commit. Local Windows PowerShell 5 regression checks
+and all three MSI-authoring tests pass; CI, rebuilt signed packages and actual
+repeated uninstall/rollback verification remain pending. The failed candidate
+has not been published or approved for production.
+
+An independent technician-only `1.5.8` lifecycle attempt was subsequently stopped
+by the fresh-install guard before installation: the earlier successfully
+uninstalled technician product had left its cancellation marker, cancellation
+rollback JSON and helper script in the per-user directory. No technician MSI was
+registered. This is a blocked test precondition, not a passed or failed technician
+MSI execution. The commit cleanup now covers both editions: SYSTEM/canonical
+ProgramData for customer, impersonated user/canonical LocalApplicationData for
+technician. Both use an embedded agent so removal does not delete the executable
+needed for commit. Local fixture checks reject arbitrary paths for either edition;
+MSI-authoring tests also assert the technician action retains user context.
+Subsequent verified package results are recorded below; interrupted-transaction
+rollback still needs separate verification.
+
+### Verified two-edition uninstall fix on Server 2019, 21 October
+
+Push workflow `39649347086` and PR workflow `39649354472` passed for source
+`053a52e3ac29cb0f7e9686da9c626f94bf153005`, including Windows PowerShell 5
+commit/rollback-state fixtures and all four MSI-authoring checks. Windows artifact
+`12368667260` matched GitHub SHA-256
+`b3bdf363098173d49efb4665ef6204f47d5e4ed0ac20512f1932ee5ef3fc4193`.
+All five archive entries and 116 corresponding source files passed independent
+hash/CRC/public-Git verification. These are build-input checks, not bit-for-bit
+binary reproducibility.
+
+The fixed component agent was privately signed and combined with the previously
+verified native `c0bf4b4` payload. Both rebuilt MSI `1.5.9` packages received
+verified timestamped signatures from the existing nonexportable disposable-VM
+publisher; no host trust or production signing was added. The signed customer
+MSI SHA-256 is `8a64ca8a90573af75cfcc8e247e6c4d5999b7d488c1a5a9b2202f988b595f678`;
+technician is `8caf16d8fcfa5e47e2ed153cc2d094154c3de8d098109863572c68d70a2bbbcc`.
+
+All 12 operations passed as Administrator on Server 2019 Standard Evaluation
+Desktop Experience `17763.3650`:
+
+| Edition | Verified operations |
+| --- | --- |
+| Customer | Upgrade failed `1.5.8` candidate to `1.5.9`, repair, uninstall, reinstall, repair, uninstall |
+| Technician | Install, repair, uninstall, reinstall, repair, uninstall |
+
+Every raw MSI log independently showed exit 0 with no `Return value 3`. The
+guarded repair checks verified the installed agent, full customer payload and
+license repair, or technician executable/shortcut/registration before and after
+repair. Reinstalls retained their existing cancellation marker. Both editions'
+uninstall commit actions executed, clearing obsolete rollback records after
+removal. The earlier technician directory contained exactly its three known
+legacy cancellation files and no registered product; those files were preserved
+under the protected lab test directory before the first new technician install.
+They were not discarded to make the repeated-install cases pass: subsequent
+reinstalls used the new retained state in place.
+
+A separate read-only guest check confirmed no customer or technician product
+registration, no installed configuration agents, no customer service or watcher,
+both uninstall cancellation markers retained, both cancellation rollback records
+absent, and unchanged hashes for all preserved legacy files. The native and
+component source origins remain separate in the evidence. These tests used the
+existing guest after prior package tests, not a new clean snapshot. Company
+enrollment/identity preservation, standard-user technician installation, automatic
+updates, interrupted-removal rollback and native desktop sessions remain separate
+acceptance gates.
+
+### Actual MSI rollback and customer state permissions, 21 October
+
+Two private `1.5.10` fault-injection MSIs were built from native `c0bf4b4` and
+component `053a52e` inputs. Their only injected behavior was an opt-in deferred
+failure after `RemoveFiles`; the fixtures were lab-signed, not approved or
+published as releases. Both editions passed installation and baseline repair,
+the deliberately failing uninstall returned the expected 1603, full installed
+payload/registration were restored, subsequent repair passed, and normal
+uninstall succeeded. Independent raw-log checks verified actual deferred file
+removal before `LabFailRemoval` returned 1, followed by rollback. Ten operations
+matched their expected outcomes, including exactly two intentional failures.
+
+The customer test created an owned, disabled SYSTEM configuration watcher before
+fault injection. Rollback restored its exact agent path, `watch` argument,
+SYSTEM principal and disabled state. Both editions retained the prior uninstall
+cancellation marker and cleared temporary rollback records after restoration;
+the final normal removal committed. These are installer rollback results on
+Server 2019 `17763.3650`, not management database backup/restore, migration,
+enrollment or native-session results.
+
+A read-only post-uninstall ACL inspection found that the bare-MSI customer state
+directory retained inherited standard-user write access. Earlier company setup
+applied an ACL, but bare installation/removal also needs an independent trust
+boundary. No unauthorized session or privilege escalation was demonstrated.
+This is nevertheless a release-blocking permissions finding: cleanup must not
+execute mutable scripts from a directory that another user can populate, and
+setup must not adopt an untrusted existing state directory merely by changing
+its ACL.
+
+The fix adds atomic private-directory creation and owner/ACL/reparse inspection
+before MSI folder creation/service startup and before explicit setup reads saved
+trust. It rejects unsafe existing objects unchanged and checks for existing
+writable directory handles. Both MSIs use embedded agent copies for cleanup;
+the agent executes its embedded PowerShell helpers directly instead of writing
+and executing mutable helper files beside configuration data. All four MSI
+authoring checks, five source-archive checks and entry-point/commit fixtures pass
+locally. The directory helper's real administrator filesystem cases passed on
+Server 2019, including private creation, trusted reuse, rejection of a foreign
+file owner and rejection of a writable existing directory without changing it.
+The first harness run correctly rejected unsafe state but Windows PowerShell
+treated its redirected stderr as a terminating native error; the harness now
+observes bounded child exit codes directly. Compilation/CI and new signed MSI
+positive and standard-user negative tests were pending at that checkpoint.
+Existing company services and their enrollment were not modified by these changes.
+
+### Hardened MSI clean Server 2022 lifecycle, 21 October
+
+Component source `650361413543baf7ef150f5960544154ec77ddeb` passed Windows/Linux
+component CI and Linux deployment CI. The downloaded Windows artifact's SHA-256
+was `33e13a86ad51ae5a1d094ad31e0256f7d1a3644df97c2efb9298a2c14fdf340a`;
+independent inspection matched all 118 component source files against public Git.
+This verifies source provenance, not bit-for-bit binary reproducibility.
+
+Private test version `1.5.11` combined that agent with the previously verified
+native `c0bf4b40ff8257c9fb69e4c5f6aceb2394f1adc0` inputs. Both MSIs were signed
+and timestamp-verified with the disposable lab publisher. Signed package hashes:
+
+- Customer: `ef55865a3c6db2a8411aa686e77b863588f7cb7419f4494282a8d7cfbfb0362c`.
+- Technician: `eab4e4e6f872d0bc986e0feb0a28e6bb3fe98b78b669403dc726cdbbdba9d3ae`.
+- Agent: `2fd0bcc199741a6ce2ffad4c5249ed47705a521ced32ddc157f22378f4db06e1`.
+
+A fresh Windows Server 2022 Standard Evaluation Desktop Experience guest,
+`20348.587`, was provisioned from Microsoft evaluation media and saved as an
+offline clean OS checkpoint before product installation. The lab publisher was
+trusted only inside that guest. Root-store import succeeded; the additional
+Trusted Publisher import returned access denied. Both Authenticode signatures
+were independently observed as valid without that additional store entry; the
+unchanged package verifier still required valid signatures and the exact
+publisher, certificate and package hashes. No Windows trust policy was relaxed.
+
+Customer and technician installation, repair and uninstall all passed as the
+guest administrator: six operations returned 0 without requiring reboot. The
+pinned harness verified installed payload hashes, registration, customer service
+identity/running state and removal. Independent inspection of all six raw MSI
+logs found successful completion and no `Return value 3`. Private evidence is
+retained in `windows-server2022-results-c0bf-6503614/verified-lifecycle.json`
+alongside the phase reports and raw logs; machine credentials remain outside Git.
+
+The proposed standard-account read/write/create denial test was blocked by
+automatic approval review before execution, with reason `blocked by policy`;
+specific user approval is pending. Actual compiled-MSI negative tests, repeated
+uninstall rollback with this hardened agent, enrollment, approved automatic
+updates and native remote sessions remain unverified. These six lifecycle passes
+do not complete the Server 2022 acceptance matrix or qualify a production release.
+
+### Hardened MSI rollback on Server 2022, 21 October
+
+The same native `c0bf4b4` and hardened agent `6503614` were used in private
+`1.5.12` uninstall fault fixtures, explicitly named `LAB ROLLBACK FIXTURE`.
+They add an opt-in deferred failure after `RemoveFiles`; no distributable
+installer or production behavior was changed. The signed fixture hashes were
+`f614883f22eecc70055a351308eb3e688af58af6508b68372a16d45974ba5d30`
+(customer) and
+`024fbf1ab80b778af8ad098c1e214817752d234e4d7968be96e08310a9c99eb3`
+(technician), using the disposable lab publisher only.
+
+On the Server 2022 `20348.587` guest after the preceding lifecycle tests, both
+editions installed and repaired, the injected uninstall returned the expected
+1603, subsequent repair succeeded, and normal uninstall committed. Ten operations
+matched their expected results, including exactly two deliberate failures.
+Independent raw-log checks proved actual file removal preceded each injected
+error. Full payload hashes and installed registration were restored; cancellation
+markers survived; temporary rollback records cleared. The customer's owned,
+disabled SYSTEM watcher was restored with its exact action and disabled state,
+then removed during successful final uninstall. Evidence is retained privately
+in `windows-server2022-rollback-6503614/verified-rollback.json` with all phase
+reports and logs. This verifies MSI transaction recovery, not interrupted
+automatic updates, company database recovery, native sessions or standard-user
+file-access denial.
+
+### Maintained Linux transport integration, 21 October
+
+Source `143cd645f50de787edde0e3eb67027b84015fe35`, workflow run `39664079574`,
+passed Windows/Linux components and the Linux deployment job `119444360250`.
+The new candidate image used the pinned public transport and shared-submodule
+sources, reviewed patches and Rust toolchain. Its independent public recipe
+revision was `6503614`; the build archived 140 exact source/recipe files inside
+the image. Source archive SHA-256 was
+`a0d56be100851d183eab986533fe9028c2c8a52c8bd31691f92facca14d2cb68`.
+
+The real Docker rehearsal passed with the maintained image's immutable ID:
+HTTPS trust validation/untrusted-CA rejection, profile signatures, MFA,
+enrollment/logout, local NAT-test protocol responses and complete encrypted
+management/transport/TLS recovery into replacement containers retaining original
+trust. Both the previous upstream stack and maintained stack passed. These
+checks do not prove native desktop sessions, UDP NAT traversal, public ACME,
+Internet direct/relay access or production readiness. The explicit candidate
+Compose override supports fresh isolated deployments; normal distribution pins
+remain unchanged pending those acceptance checks. A subsequent change exports
+candidate binaries and corresponding source as a retained CI artifact; that
+new export step subsequently passed CI, but independent source inspection found
+the archive discrepancy described below.
+
+### Windows server state creation hardening, 21 October
+
+Inspection found that fresh Windows server setup created its ProgramData folder
+before restricting access. A source change replaces that interval with atomic
+private creation through the signed, reverified management copy in Program Files.
+The shared embedded directory helper now has a canonical server scope and an
+explicit reject-existing mode, including a directory that appears after the
+initial precheck. Existing state is not adopted by rewriting permissions. Server
+preparation has a 30-second deadline; a matching management build is required.
+Current management also rejects unknown commands before opening data or starting
+a listener. No exploit or unauthorized session was demonstrated by this review.
+
+Four MSI-authoring checks, five source-archive checks and PowerShell parsing
+passed locally. Actual administrator filesystem tests on the Server 2022 lab
+passed private creation, trusted reuse, reject-existing without changing its
+ACL, rejection of foreign-owned content and writable existing directories.
+The first run exposed a PowerShell case-insensitive variable-name collision in
+the new helper parameter; that was corrected before the successful rerun. These
+tests used temporary private fixture paths, not the live company server state.
+Source `8f4c4ef51710c0749dd7b86d02e89b4738fe7734`, Windows CI job `119454688771`,
+subsequently passed the compiled management command test: canonical private
+creation succeeded, a noncanonical path was rejected, and a second invocation
+refused existing state without changing its ACL or starting a server. The helper
+administrator filesystem cases also passed there. Full clean-VM server setup
+remains unverified. Existing company services were not upgraded or changed.
+
+### Independent maintained transport source discrepancy, 21 October
+
+Source `2e704f2` passed component/deployment CI, including artifact export and
+the maintained stack rehearsal. Artifact `12378445188` (6,338,877 bytes) was
+downloaded and its GitHub SHA-256
+`823e68c9189266a03b8e3ddc8fdfbcf2a0c8c1baad8556ce085be51a56164d5b`
+verified. All six files matched the export manifest, and both executables had
+Linux x86-64 ELF headers. This did not prove every source file matched Git.
+
+Independent comparison against immutable upstream/project Git objects rejected
+the tracked `db_v2.sqlite3`: its archive SHA-256 was
+`a269b1bcb604d32ef120ce8d8e4fd3ec2b58ddb1c9fa24445f256826a1dc7dbd`,
+whereas the public Git blob was
+`071be773254bb18a6ec9b60bac0d000d78a75f2b2c783d13aeff9e81462f37f0`.
+Both were 24,576-byte SQLite files. Source capture had run after compilation,
+which uses compile-time SQLx queries against the schema database. The artifact
+is therefore not accepted as an exact copy of the pinned source inputs.
+
+The Docker and standalone transport workflows now capture source before the
+rendezvous/relay build. A regenerated artifact must pass the independent
+whole-archive Git comparison before its source-provenance gate can close. The
+existing integration results remain limited to their recorded runtime scope;
+they do not override this failed source check or qualify production publication.
+
+### Corrected transport source verification and Linux reproduction, 21 October
+
+Source `adf437ee181bd3f1455df14e07d06b4a2b8b50a1`, workflow `39668437572`,
+passed the component/deployment checks with source captured before compilation.
+Artifact `12378089575` (6,338,856 bytes) was downloaded and verified against
+GitHub's SHA-256
+`516bdc2236271ebdcc440a9e2da5e5c14b162097070c80a4631519b8122bbcf2`.
+Independent whole-archive comparison now passes all 140 files against immutable
+upstream/shared/project Git objects, except the UDP file whose complete content
+matches the explicitly reviewed patch hash. The previously mismatched SQLite
+file now matches its public Git blob. This closes the recorded source-input
+discrepancy for this artifact; it does not validate the earlier archive.
+
+Actual unsigned Linux executables from the separate `39665690071` and
+`39668437572` builds also match byte-for-byte:
+
+- `hbbs`: `6bacfa973533248aa24c2917469149d3e08246140f5423160a6da521c3dd018a`.
+- `hbbr`: `132ab0c989a110a3335220d1afbbdf022afa559cf9bec23b8419f473d04388a3`.
+
+This is reproduction evidence for those two executables under the common
+recorded transport recipe and base-image/toolchain pins. It does not establish
+bit-identical OCI images, Windows payloads or the entire product. Independent
+receipts remain in `maintained-transport-adf437e/published-source-verification.json`
+and `verified-binary-reproduction.json` in the private lab evidence.
+
+Source `f955874c4b777e58fa708401cc71abf52f868f28`, run `39670081266`, subsequently
+passed Windows/Linux components and the maintained deployment rehearsal with
+additional input guards. Source capture rejects unexpected tracked changes and
+accepts only the hash-verified UDP modification. A fresh local clone test
+archived all 140 expected files successfully, then deliberately changed a byte
+in the public schema fixture and confirmed rejection before any negative archive
+was written. No company database was used in this guard test.
+
+### Actual insecure-existing-state MSI rejection, 21 October
+
+The private lab-signed `1.5.11` customer MSI (native `c0bf4b4`, agent `6503614`)
+was run on Server 2019 `17763.3650` against the original post-uninstall state
+folder with inherited Users-write permissions. No replacement folder or new
+standard account was created. Installation correctly returned 1603. Independent
+raw-log inspection confirmed `PrepareCustomerState` failed before any payload
+copy; the existing cancellation marker, old helper bytes and all ACLs remained
+unchanged. No product registration, application, agent or service remained.
+Evidence is retained in `windows-server2019-unsafe-state-6503614/verified-rejection.json`
+with the original metadata and MSI log. This proves refusal to adopt insecure
+existing state, not the separately blocked standard-user read/write/create test.
+
+### Clean Windows 10 LTSC installer lifecycle, 21 October
+
+Microsoft's Windows 10 Enterprise LTSC 2021 Evaluation x64 media was verified
+against its published SHA-256 before installation. The installed guest is
+`19044.1288`, edition `EnterpriseSEval`. A guarded preflight confirmed no Swan
+product registrations, services or customer state and disabled provisioning
+autologon. After normal shutdown, an offline internal clean OS checkpoint passed
+disk-integrity checks before both editions were tested.
+
+The same private lab-signed `1.5.11` packages used on Server 2022 (native
+`c0bf4b4`, agent `6503614`) passed customer and technician install, repair and
+uninstall: six operations, all returning 0 without a requested reboot. Independent
+verification checked each raw MSI log, package and installed payload hashes,
+product registration, the customer's SYSTEM service and removal assertions.
+Evidence is retained in `windows10-results-c0bf-6503614/verified-lifecycle.json`
+alongside the original reports and logs.
+
+The initial test-driver launch was refused by Windows 10's default PowerShell
+execution policy before any product installation. The reviewed, hash-pinned
+driver then ran in a separate process with an explicit process-only policy.
+MachinePolicy and UserPolicy were undefined; all five parent policy scopes were
+identical before and after the successful run. The initial failure is preserved
+in the private lab diagnostics. No persistent execution-policy setting changed.
+
+This proves the administrator MSI lifecycle on this Windows 10 LTSC build only.
+It does not establish other Windows 10 editions/builds, standard-user technician
+operation, enrollment, native sessions, installed-application reboot behavior,
+upgrades or automatic updates. The VM's clock was independently checked against
+the host before the installer run; the future RTC boot-setting correction still
+requires its own reboot verification. Production signing remains unqualified.
+
+### Native standard-user technician GUI and live branding, 22 October
+
+The private lab-signed technician portable from native source
+`c0bf4b40ff8257c9fb69e4c5f6aceb2394f1adc0` ran as the existing non-administrator
+lab user on Server 2016 Standard Evaluation Desktop Experience `14393.693`.
+Its outer executable matched SHA-256
+`6aa3c048827e2ad8e4414cc0c09476be9dff9bc8ad02fc46bcfc207d843eda40`.
+All 95 extracted native/Flutter payload files matched the pinned CI manifest,
+including the actual running executable, libraries and `app.so`. The portable
+uses the user's shared extraction cache; its managed state was isolated from
+the installed technician state, which remained byte-for-byte unchanged.
+
+Live console observations confirmed company name, signed SVG logo, support link
+and product/license attribution, then successful graphical password/TOTP login,
+the authorized approved-device inventory and session history. Requesting attended
+support reached the existing customer's approval prompt. The technician waited
+without a desktop view. Cancelling on the customer side produced "Closed manually
+by the peer" and an ended history entry. Independent server history confirmed
+the corresponding target-bound grant was claimed, attended and closed. This
+checks refusal, not an accepted desktop or separate-machine session. The existing
+customer remained the older `bd13500` installation.
+
+An administrator published only a temporary technician display-name change at
+profile revision 17. The open app displayed it through its normal periodic
+refresh, without a manual refresh click, process restart or reinstall. Restoring
+the original name published revision 18, which appeared automatically in the
+same process. Independent Ed25519 verification checked revisions 16, 17 and 18
+under the original pinned public key; other policy, transport and trust fields
+matched the baseline. Software sequence and local consent fields were preserved.
+Graphical logout cleared inventory/history, and its server audit event matched
+the technician account. Password and TOTP secret were absent from managed state.
+
+The app then closed cleanly and restarted with an unreachable proxy confined to
+that test process's environment. An agent probe first synchronized successfully
+online, then returned a proxy-tunnel connection refusal with that environment.
+After restart the native GUI retained cached company branding, but a fresh
+credential/TOTP login attempt failed and cleared the password/code fields. The
+company HTTPS service remained reachable outside the isolated process, and its
+audit contained no successful technician login during the offline run. All 95
+running payload files were checked again. Both app runs closed cleanly; the
+company and customer services remained running. No firewall, listener, service
+installation or transport process was changed.
+
+Private evidence, raw audit/history, signed state snapshots, proxy diagnostics
+and independent verification are retained in
+`technician-c0bf-gui-20261021/verified-gui-acceptance.json` and its `evidence/`
+directory. UI observations were made through the live VM console and are
+corroborated by those runtime records; they are not a substitute for the remaining
+protocol and Windows-matrix tests. This isolated portable fixture used copied
+public technician configuration and a lab publisher. Complete company bundle
+installation, accepted remote control, cross-machine/Internet/relay operation,
+secure-desktop behavior, key rotation and approved automatic updates remain open.
+
+### First-run branding and policy collection, 22 October
+
+The shared web setup page now collects customer/technician names, colors, SVG
+logos, support contacts, website shortcuts and consent wording, plus unattended
+support eligibility, update pause/channel/cohort and UTC maintenance settings.
+Previously these controls were available only after company creation, so initial
+setup silently used product defaults. Initial setup and subsequent profile edits
+now use the same field renderer and collector. This shared page is used after
+both Windows installation and Linux first-run deployment. Initial device approval
+remains mandatory; allowing unattended support does not grant customer consent.
+
+For PR head `066c6d91b0f35f304f1a546c6f3ebeceb79cfc05`, component workflow
+`39686752599` passed Windows, Linux and both Linux deployment rehearsals.
+The tested merge checkout was `272f9da7287f9428d5db86366f6f74c44c0c808a`.
+Windows job `119522655784` and Linux job `119522655449` explicitly passed
+`first_run_preserves_company_branding_and_update_policy_atomically` and the new
+front-end form contracts. The real router/SQLite test verifies that invalid
+initial policy creates no company, account or setup audit entry; a valid request
+persists every supplied branding/policy field and returns a verifiable signed
+profile with a server-assigned company identity. The form contract also checks
+subsequent editing and rejection of incomplete shortcuts before submission. A
+negative control using the preceding public source correctly detects the missing
+first-run branding fields.
+
+A static browser preview verified the new controls and exposed a collapsed color
+swatch caused by generic input padding. The swatch layout was corrected and
+visually rechecked. This preview used public sample data, could not submit setup,
+and was closed along with its temporary loopback static-file process. No existing
+company deployment was changed. These checks establish the new form/API behavior,
+not a completed fresh Windows service installation, generated company bundles,
+production signing or the remaining full-product acceptance gates.
+
+### Stock client legacy-password rejection, 22 October
+
+A separate, Authenticode-valid PURSLANE RustDesk 1.5.0+68 control
+(`7f6d1e09e5a9924f567962aa57a6b126b409bed4775d98074c727420438768dc`)
+ran as the existing non-administrator lab technician on Server 2016
+14393.693. Its independently probed ID was 880000042, absent from company
+enrollment. With only public transport configuration and a deliberately invalid
+legacy password, it connected to approved customer 1193046 and displayed
+“Company session authorization denied.” No desktop or customer consent prompt
+appeared; management audit history contained zero session requests since the
+attempt began. This is an observed native protocol denial, not a simulated UI.
+
+The receiving customer was the older `bd13500` build
+(`60d15651c583537bcaaf25df2b838ca594f5855b2d2b0f416b690645ef107cfc`).
+This same-VM lab result does not validate the newer receiver, direct-IP paths,
+all permissions, relay selection, or public Internet access. Port 21118 belonged
+to hbbs rather than the customer; it was not used as a customer-listener proof.
+No separate receiver-log denial was established. The control exited normally
+with code 0, its scheduled task returned Ready/result 0, and the process was
+absent. Customer and company services remained running and HTTPS returned 200.
+Local raw evidence is retained under the private lab `legacy-control-1.5.0-build68`
+directory; credentials and generated client private keys are excluded from this
+repository. Host RustDesk services were not stopped or reconfigured.
+
+The subsequent receiver change adds a fixed local warning for rejected managed
+login attempts, identified only by local connection number. Credentials and
+underlying error details are deliberately excluded. Compilation and runtime log
+verification of this new change remain pending; the stock-client observation
+above predates it and does not prove the new warning is emitted.
+
+### Receiver system-control permission correction, 22 October
+
+Source inspection found that the virtual-monitor handler could reach the
+monitor driver without checking keyboard/control permission. Elevation and
+resolution changes already had handler checks. Managed receiving connections
+now filter virtual-monitor on/off, elevation, resolution and Windows desktop
+session-switch requests before dispatch whenever either the company grant or
+customer's current keyboard/control permission denies control. Existing monitor
+selection, capture and refresh remain available to view-only sessions.
+
+A native regression test serializes and parses the control packets, checking
+rejection with control disabled and acceptance with control enabled, and checks
+that ordinary viewing packets remain allowed. The Windows build workflow runs
+this test explicitly and requires one executed passing test. Compilation,
+test results and real driver/session behavior remain pending. This is a source
+correction, not a claim of completed packet-injection acceptance or an updated
+installed customer app.
+
+### Native tampered-cache check and legacy-install UI correction, 22 October
+
+The existing lab-signed technician `c0bf4b4` portable ran as standard user
+SwanLabTech on Server 2016 14393.693 with a separate cached-state fixture.
+Only the decoded technician display name was changed, retaining the original
+signature. Independent Ed25519 verification accepted the original envelope and
+rejected the modified one. The GUI showed “Company setup is not complete,” no
+company branding, no technician login or device inventory. The untrusted name
+did not appear. It closed normally (exit/task result 0); the native process was
+absent, both working services stayed running, and the source fixture hash was
+unchanged. Local evidence/verifier are under `technician-c0bf-gui-20261021` and
+`Verify-Lab16C0bfTamper20261022.py`. Network isolation used only the test process's
+proxy environment; no firewall or server settings changed. This verifies local
+cached-profile rejection, not hostile-HTTPS sync or the other profile negatives.
+
+The test also exposed a legacy “Click to upgrade” card because another version
+was installed in the guest. The button was not clicked. Source now hides legacy
+installation/download cards for both stable managed application identities,
+including an invalid company configuration. Managed UI installation entry points
+and the legacy `--update` command refuse the operation; the company agent and
+explicit bundle's silent-installer path remain available. Compilation and native
+verification of this correction remain pending. The previously dispatched
+`3c4fb57` build predates this correction and cannot validate it.
+
+### Verified current native build and corresponding source, 22 October
+
+Windows workflow `39690742314` passed at source
+`becf3cd861275e5100e2b86c3c26ad53be18cd00`. Raw job logs confirm both exact
+native regressions executed with one pass and zero failures each:
+`managed_sync_rejects_legacy_endpoint_and_unsigned_options` and
+`managed_view_only_packets_cannot_change_system_control`. Their scope is the
+legacy-policy guard and parsed packet permission classification, not a live
+malicious-peer or monitor-driver test.
+
+Artifact `12390656897` is 146,651,249 bytes, SHA-256
+`cf0109e9b9ccc7366fc6995228855e66a198fc8c932d998b9d09d1d4ce05a6bd`.
+The first transfer failed with ChunkedEncodingError. After that process exited,
+127,926,272 retained bytes were resumed using an exact validated HTTP 206 range.
+The entire final archive passed the authoritative size/digest and all 24 entry
+CRC/path/payload-checksum checks. The corresponding source archive matches
+1,122 public tracked files/submodule objects and all six separately verified
+CI-generated bridge files. All 95 extracted native/Flutter payload files match
+the installed manifest; the native EXE hash is
+`5bdfcbf7d464511c51470e4a773ea583a853c2124cb4d83ab644acd0782d58e8`.
+No downloaded executable was launched during these checks.
+
+The independently checked MSI evidence artifact `12390213470` is 34,872 bytes,
+SHA-256 `84ffe55bfa20fea974c6c3f0aad662fa103076007a298ffb2ed5c18011721531`.
+All three original installer logs report successful completion without a failed
+action, and their source/package invocations agree. The downloaded technician
+MSI hash `a6ad6b59af1e953e84239fdc5eb1ad6d07fdcdc5b819adc6c85b2cb1c60479b3`
+matches the package actually installed, repaired and uninstalled under the CI
+account on Windows Server 2022 Datacenter build 20348. This is an unsigned
+CI-account lifecycle, not clean-machine, standard-user, enrollment, signature
+acceptance or remote-session verification. Private lab signing and latest-native
+GUI/receiver verification remain next; production signing, full reproducibility
+and the complete acceptance gates remain open.
+
+### Current lab signing and tampered-cache GUI regression, 22 October
+
+Five verified `becf3cd` inputs were copied to a separate private directory in
+Server 2016 and signed using its existing nonexportable disposable lab key.
+Each Authenticode signature and RFC3161 timestamp passed `/pa /all /tw`, pinned
+to certificate DER SHA-256
+`d5d4567bf67622ae8bda75e22db7b72b278c0eaa58450427bf8bf0e0bba3f94e`.
+The signed technician portable hash is
+`db903307fde776513ea1830a97843c23414b88e58239e213d11830a042135931`;
+the signed agent hash is
+`f31d217bacdc6a3234c417d8acb9e96abe7ac75541e106b5999df2d54d72b4b8`.
+All original input hashes were preserved. This is private lab signing only;
+none of the company server, worker or installed customer binaries was replaced.
+
+The new portable ran as the existing non-administrator SwanLabTech in desktop
+session 1, with a new public-only technician state fixture. Independent signature
+verification accepted the untouched original profile and rejected the fixture
+whose only decoded change was the technician display name. All 95 actual
+running native/Flutter files matched the verified CI manifest, including native
+EXE `5bdfcbf7d464511c51470e4a773ea583a853c2124cb4d83ab644acd0782d58e8`.
+A strict fixture path comparison initially rejected the executable's `\.\`
+segment; canonicalizing that observed path resolved the harness mismatch without
+changing the app or relaxing the expected extraction root.
+
+The GUI showed “Company setup is not complete,” with no forged branding,
+technician login, or device inventory. The legacy install/upgrade card exposed
+by the older build was absent. Closing this fallback incoming window kept the
+native process alive in the background. After independently checking its PID,
+path, hash, owner and desktop, only that test process was force-stopped. The
+first cleanup command stalled at cross-user confirmation; its exact pending
+PowerShell process was cancelled before explicit forced cleanup. The launcher
+then returned 0 and the task became Ready, with no native test process left.
+This is **not** a normal native-exit acceptance result. No VM reboot or existing
+service stop was used. The installed customer hash and both running services,
+original public profile, and unsigned build inputs were checked again afterward
+and preserved.
+
+Local evidence is in `candidate-becf3cd-inputs/signing-evidence` and
+`technician-becf-tamper-evidence-20261022/verified-runtime.json`, with independent
+verifiers retained outside the repository. This establishes the current local
+corrupted-cache/UI regression only. Ordinary technician login, legacy command
+refusal, hostile-HTTPS profile sync, corrected receiving-device permissions,
+automatic updates, clean-machine installers and the full release gates remain
+open.
+
+### Live legacy update command refusal, 22 October
+
+The actual `becf3cd` native EXE ran with `--update` as the existing standard-user
+SwanLabTech in Server 2016 desktop session 1. A separate fixture contained the
+unaltered signed public technician profile. All 95 native/Flutter files were
+verified against the CI manifest before launch, and the reviewed launcher hash
+was checked before its limited interactive task was registered.
+
+The command exited normally with code 0. A newly changed original native log
+contained the exact warning “Managed updates require the approved company update
+agent.” The collected raw log hash matched its receipt. The installed customer
+EXE hash remained
+`60d15651c583537bcaaf25df2b838ca594f5855b2d2b0f416b690645ef107cfc`, and
+the public test profile hash remained
+`1fc8663de5b64b350de940b15067d6c5bc2ae9ab8b3f07d52111462e5c19776e`.
+A post-test check found the recorded native process absent, task Ready/result 0,
+original source profile unchanged and customer/company services Running. No
+forced cleanup, UAC acceptance, service stop or package installation was used.
+
+The exact refusal marker, raw log, source/payload identity and before/after hashes
+are independently checked in the private
+`technician-becf-legacy-update-evidence-20261022/verified-command.json` evidence.
+This is runtime evidence that the legacy native command refuses the managed
+update path, including its observed zero exit code. It does not verify approved
+automatic updates, GUI installation callbacks, publisher checks, interruption
+recovery, or the full release criteria.
+
+### Current technician MSI standard-user diagnostic, 22 October
+
+The exact public `becf3cd861275e5100e2b86c3c26ad53be18cd00` packaging
+recipe was extracted from its verified source archive and used with WiX 5.0.2.
+Its unchanged project binaries were signed with the existing disposable company
+lab publisher. The resulting technician MSI version 1.5.0 hash was
+`61be6e524adbfbe164a47281cad04fe033debcf3e033d334c2e657946cc191f6`.
+This was a manually prepared private test package, not a live company worker job
+or a production-signed release. Host certificate trust was not changed.
+
+On Windows 10 Enterprise LTSC Evaluation 19044.1288, a newly created standard
+user logged on to the desktop. A limited interactive task installed the MSI,
+moved only its newly installed and hash-checked native executable into the
+owned evidence directory, repaired the missing executable, and uninstalled.
+All three Windows Installer operations returned 0. Independent checks verified
+the original verbose log hashes, the repair log's missing-file entry, restored
+payload signatures/hashes, and removal of payload files and per-user
+registration. No administrator token, UAC approval or persistent execution-policy
+change was used. The reviewed runner used process-scoped Bypass only; all other
+execution-policy scopes remained Undefined.
+
+The OS displayed an expired evaluation watermark. Its licensing provider
+reported status 5 and zero grace. One normal Microsoft activation attempt failed
+with a general activation error and left that state unchanged. No product key,
+KMS configuration, evaluation rearm or clock change was used to bypass expiry.
+The results therefore establish a functional installer diagnostic only, not a
+qualified Windows 10 release. A valid Windows 10 test environment remains required.
+This run does not establish company enrollment, technician GUI authentication,
+native sessions, upgrades or automatic updates.
+
+The guest's final check completed normally over SSH at 00:57:09 UTC: task
+Ready/result 0, payload and user registration removed, OS restart pending.
+Its stdout was preserved as an explicitly labeled observation; the separate
+original JSON transfer subsequently failed with a closed connection. The VM
+stopped answering management connections and showed a black screen after an OS
+update restart had been scheduled. A single normal ACPI shutdown request was
+sent at 01:21:19 UTC; completed shutdown is not established. Passive QEMU disk
+counters at 01:24:04 and 01:25:01 UTC recorded 610,982,912 additional written bytes
+and 10,217 additional write operations. This establishes ongoing disk activity,
+not successful Windows update/reboot or the cause of the black screen. The guest
+has not been forcibly powered off.
+
+Private evidence is in
+`windows10-standard-becf3cd-results/verified-diagnostic.json`, including the
+three original MSI logs and their receipts, runner/task identity, licensing
+result, activation failure, and labeled final-check stdout observation.
+The report explicitly records `full_windows_qualification: false`. Separate
+receipts retain the first final-check transfer failure and subsequent recovery;
+the labeled stdout observation is not presented as an original downloaded file.
+
+After Windows update processing, the guest returned to its sign-in screen and
+SSH recovered. The original final-check file was then downloaded successfully:
+SHA-256 `ddec9a7cfa33749ca3df61f1904390147b8c9a2a264d615c0fcb8d4f12728390`
+matched the guest's hash and the previously preserved stdout contents. The
+independent diagnostic verifier now uses that original file. A separate
+post-update check recorded build `19044.7725`, no OS restart pending, task
+Ready/result 0, and the technician payload still removed. Windows licensing
+remained status 5/zero grace. These later observations do not establish MSI
+qualification on the updated OS; the three installer operations ran on
+`19044.1288`. The guest acknowledged a normal shutdown request, QEMU exited 0,
+and only its disconnected viewer was closed. No forced power-off was used.
+
+A separate boot of this updated guest checked normal Microsoft activation once
+more after the OS update. The existing evaluation's activation attempt at
+03:20:52 UTC failed again, leaving license status 5, zero grace and reason
+`0xC004F009`. No keys, KMS configuration, clock or rearm state were changed.
+The collected local activation receipt has SHA-256
+`06bf83d0307684e8cb27d2ed5c37a5a1005a68c8e770c3ecd57ef298bd637bc9`.
+The guest acknowledged normal shutdown and its QEMU process exited 0. No
+installer operations were repeated during this licensing check. A valid
+Windows 10 test installation remains required for final qualification.
+
+### View-only Windows session acknowledgement correction, 22 October
+
+Source inspection after the `becf3cd` diagnostic found that the managed control
+filter rejected every `SelectedSid` packet when keyboard/control permission was
+absent. The client sends this packet to acknowledge the current Windows session;
+the receiver then starts monitor/camera subscriptions or completes delayed
+file-directory reads. Rejecting that acknowledgement could prevent legitimate
+view-only or file-only sessions from initializing on hosts with session selection.
+
+The receiver now compares the requested session with its own OS-reported process
+session ID. Acknowledging that same session is allowed; selecting a different
+session still requires both receiver control permission and the signed grant's
+keyboard permission. An unavailable OS session ID fails closed. Other system
+control packets retain their existing permission checks. The wire-message
+regression test now covers same-session acknowledgement, another-session denial
+and failed OS lookup, alongside elevation, resolution and virtual-display checks.
+Native workflow `39704802586` is building exact correction source
+`ebef5a610cd2b020a02363aa218a401f771fdad7`. Both bridge-generation jobs passed;
+the downloaded six-file bridge artifact `12394472703` passed provenance,
+size, CRC and SHA-256 checks (archive
+`c3629a2fcf5984eb414fddd6806211affc6da1341313e9fe42ca61f364df799b`).
+The completed native build passed compilation, both exact managed regression
+tests and the unsigned technician MSI lifecycle under the CI account. Raw job
+`119583130305` logs show each exact regression test ran once and passed with
+zero failures. In particular, the control test covers acknowledging the current
+Windows session without keyboard permission while denying another session or
+an unknown current session. Receiving-device runtime acceptance remains pending.
+
+The downloaded native artifact `12396855453` was 146,667,282 bytes and matched
+SHA-256 `479ee43e8bfa6ccbb78b212f567b009776e8427f5e3a8083ff13d585d11b1bc8`.
+All 24 entries passed path/CRC/published-checksum verification. The published
+source archive matched 1,122 tracked public Git files and all six separately
+verified generated bridge files. All 95 extracted native payload files matched
+the CI installed-file manifest; the inner unsigned native EXE hash was
+`33925b581e6b118a87c095dc89778767d0dd1e5dc9738abc4aa87ab64c109ec7`.
+No executable was launched during these static checks.
+
+MSI evidence artifact `12396935044` matched archive SHA-256
+`bcdf87b1ef308a7c6495ab228f1f5cd018db6f184b7a2ca85c2287c41a72244c`.
+Its three original Windows Installer logs report success and no Return value 3.
+The tested package SHA-256
+`7c31ea534bec14519be7c30ffb31eb86b1b0878d23e1353f1432de7da1559595`
+matches the downloaded technician MSI. This is unsigned lifecycle evidence under
+the Windows Server 2022 CI account, not standard-user enrollment, clean-machine
+qualification, signature verification or a new native receiving session.
+Private verification receipts are in `native-ebef5a6`,
+`customer-payload-ebef5a6.verified.json` and `technician-msi-ci-ebef5a6`.
+
+### Independent patched engine source build, 22 October
+
+The engine reconstruction recipe added in `b79d57f` pins engine source
+`db49896cf25ceabc44096d5f088d86414e05a7aa`, depot tools
+`580b4ff3f5cd0dcaa2eacda28cefe0f45320e8f7`, the original DEPS hash and
+original/patched hashes for exactly two source files. A real sparse checkout of
+that public engine commit passed the patch check. Changed DEPS, either changed
+source file, a wrong revision and attempting to patch the already modified
+checkout were all rejected. These checks establish source/patch validation,
+not engine compilation, binary equivalence or runtime acceptance.
+
+Workflow `39707585793` failed before checkout because the pinned depot tools'
+normal Windows bootstrap had been skipped when automatic updates were disabled.
+The explicit pinned bootstrap fixed that failure. Workflow `39707908369` then
+reached dependency checkout but failed fetching tinygltf commit
+`9bb5806df4055ac973b970ba5b3e27ce27d98148` from the old Flutter mirror.
+That mirror's commit endpoint returned 404; the declared canonical upstream
+repository exposes the exact commit. Source `670e2ac` adds a single explicit
+repository override retaining that original DEPS revision, leaves DEPS bytes
+unchanged, and requires both the actual dependency revision and repository URL
+to match before packaging. Workflow `39708643178` is testing that source.
+
+That run subsequently passed dependency checkout and the reviewed source patch,
+generated its GN build, and reached C++ compilation. It failed because the
+runner's Microsoft C++ 14.44.35207 library requires Clang 19 or newer while the
+engine dependency recipe pins an older Clang. A compatible pinned Microsoft
+toolset still needs to be selected and tested; the compiler compatibility check
+was not disabled. There is no successful source-built engine artifact yet.
+
+The next recipe pins MSVC tools `14.38.33130` and SDK `10.0.22621.0`, explicitly
+selects the older toolset through a hash-checked patch to pinned buildroot
+`e265c359126b24351f534080fb22edaa159f2215`, and verifies the generated compile/link
+commands before compilation and packaging. Three local guard tests passed,
+including mixed/wrong toolsets, SDK drift, changed patch/dependency pins and
+compiler/STL compatibility suppression. A real sparse checkout of the public
+buildroot commit accepted the reviewed patch and rejected changed source,
+a wrong revision and repeated patching. These are provenance/guard checks;
+successful engine compilation and runtime qualification are still required.
+
+Source `5a5e4f2` ran in workflow `39711188710`. Its three provenance guard
+tests, side-by-side Microsoft toolset provisioning and generated-command checks
+passed on the Windows runner. All 4,900 compile/build steps reached the final
+DLL link, which failed with LNK1104 because `atls.lib` was missing. The compiler
+compatibility failure is resolved, but this is not a successful engine build.
+Diagnostic artifact `12398238710` retains the actual toolchain, dependency
+revisions and generated commands (archive SHA-256
+`230ced36cdfddb7be630dc84d45709c50c63affd301fbb59e4b09e98b500a637`).
+Source `9f97ef0` adds the matching MSVC 14.38 ATL component, checks its headers
+and library before building, and records its library hash. Workflow
+`39716739857` passed the provenance tests and pinned toolchain/ATL installation
+and entered the source-build step. This is an in-progress observation, not a
+successful build result. Engine linking,
+artifact verification, independent rebuild comparison and runtime acceptance
+remain pending.
+
+The earlier failed build's downloaded diagnostics passed their published archive
+hash and CRC checks. Inspection found no `/Brepro` in its generated compiler
+commands. The final link command delegates flags to a response file, so its
+command listing alone does not establish the effective linker flags. Following
+the LLVM guidance linked in the source document, the next recipe adds release
+COFF/PE timestamp controls, relative debug paths and a stable PDB basename. It
+retains the final linker response file and rejects missing timestamp/path
+controls or enabled incremental linking. Four local guard tests pass; a separate
+checkout of the exact public buildroot accepted the expanded hash-checked patch
+and rejected both a repeated patch and changed compiler source. These are source
+and guard checks only. The patched engine has not compiled or demonstrated
+reproducible bytes yet; the existing `9f97ef0` build is left running unchanged.
+
+The local source-verification fixture also matched complete public Git blob/mode
+listings against pinned Git tree objects: 5,604 engine files under tree
+`934b9064b5bc6814984734eb223acc23dfc42ef8` and 145 buildroot files under tree
+`22cdad9ffd0a6d8d91256d89d19f4ed338aa4786`. The artifact collector is prepared
+to compare its original-source archives against every one of these files after
+a successful build. Preparing this check does not count as a passing artifact.
+
+Engine results remain separate candidates with explicit unverified binary
+rebuild/runtime/production flags. The application workflow still uses its
+previously reviewed engine archive hash. No source-built engine has been
+promoted or counted as a reproducibility pass.
+
+### Current technician GUI and approved desktop smoke test, 22 October
+
+Five verified `ebef5a6` build inputs were signed and timestamped with the existing
+non-exportable disposable lab publisher. Original inputs, installed customer
+hash and running customer/company services were preserved. Signing receipts
+identify each public build input and signed output; this is private test signing,
+not production signing or a live company worker publication.
+
+The technician portable and agent were placed in a new fixture with only the
+unchanged signed public technician profile at revision 18. A limited interactive
+task launched it as existing standard user `SWAN-LAB-16V2\SwanLabTech` in session
+1. The running native PID `1216` and all 95 extracted payload files matched the
+verified CI manifest, including native EXE SHA-256
+`33925b581e6b118a87c095dc89778767d0dd1e5dc9738abc4aa87ab64c109ec7`.
+The portable's actual extraction cache was the user's default
+`AppData\Local\rustdesk`; the managed state was in the new fixture. This does
+not establish complete isolation of every native per-user configuration/cache.
+
+The actual GUI displayed company branding and its HTTPS domain, accepted the
+lab technician's password/TOTP login, and showed the authorized approved device
+and session history. A support request produced the preserved customer's consent
+prompt. Clicking Accept displayed an actual desktop capture stream. The session
+window was then closed through its titlebar; a refreshed history showed Ended.
+Sign out removed inventory/history and left password/authenticator fields empty.
+The native process was absent after closing the signed-out app, with no forced
+termination. The launcher exited 0; an independent native exit code was not captured.
+
+Backend audit records scoped to this task confirm technician login, one session
+request and logout. The matching server history row is claimed, closed and
+customer-approved (`unattended: false`). Independent checks verified the public
+profile's signature against the earlier trusted bootstrap, correlated the audit
+target and GUI request timestamp, and matched original evidence hashes. The
+provided lab password and MFA seed were absent from the 35 examined runtime text
+files and the collected evidence. Original installed/source profiles and both
+services remained unchanged/running.
+
+Private evidence is in
+`technician-ebef-gui-20261022/verified-gui-smoke.json` and
+`candidate-ebef5a6-inputs/signing-evidence`. This test used the existing reviewed
+engine, the older `bd13500` receiver and the same VM for both peers. It does not
+qualify the source-built engine, new receiving guards, separate-machine input,
+clipboard/transfer, public direct/relay, automatic updates, fresh company setup
+or the complete Windows installation matrix.
+
+### Independent company component binary comparisons, 22 October
+
+Component build jobs in workflows `39716739878` and `39716743778` were compared
+using the downloaded binary bytes, not just their declared hash lists. All four
+platform-specific jobs completed successfully; the second workflow's separate
+Linux transport job was cancelled, so the entire second workflow is not counted
+as successful. The reviewed branch revision is `9f97ef0`; the pull-request job
+recorded merge revision `01a344a99bb488d131714767b372f3ce65cdeab1`. Each artifact's
+130 corresponding source files matched that reviewed public source, allowing
+checkout line endings, and were byte-identical between the two builds on each
+platform. Both builds recorded Rust `1.90.0 (1159e78c4 2025-09-14)`.
+
+The Ubuntu 24.04 jobs `119620529061` and `119620541102` produced identical
+unsigned component binaries:
+
+| Component | SHA-256 from both independent jobs |
+| --- | --- |
+| Management | `d6dc94f8558b9bfd962bca8a98d84ce9e2cb1785cebc22f57305863eb7eaa393` |
+| Agent | `1391e389a7e6cf3329fa42bd866be2b263df66fd05a6594c02ceac45fafe6f22` |
+| Worker | `476c451519f240dec68eb5edbc105289df8d3f7af7772d5837676d91f8346c7c` |
+
+Their GitHub artifacts `12399761385` and `12399437062` passed archive size,
+SHA-256, CRC, declared payload hashes and complete corresponding-source checks.
+The archive digests are respectively
+`b6f4e4fce0bb32d031587b816ee9c63213fa136bf79c84748ef4abc290ce3ebf`
+and `fe47e9f103a9d49693077c5ab2c3242ba447382e42311ca7d9c0e36c49f48261`.
+This establishes these three component binaries on this CI platform only. It
+neither qualifies Linux endpoint GUIs nor proves arbitrary-host, native Windows
+app, installer, signing, container-image or complete-product reproducibility.
+
+The Windows jobs `119620529016` and `119620540922` produced different bytes for
+all three components. Their artifacts `12399696985` and `12399173780` passed the
+same integrity/source checks, with archive digests
+`963935d51ee58d10f680d8f22fdac2fda3d3cfc6422b50238c8dc183ab7ffac8`
+and `a779c0e1b6f075a4a67e1d7a26eb2d6dc3eb9e8614ca1fdfef461873b6aa8a1e`.
+Read-only PE inspection found different COFF/debug timestamps and CodeView
+identifiers. Masking those fields in memory for diagnosis made each pair match;
+the original artifacts were not modified, and this is not a reproducibility
+pass. The Windows x64 Rust linker configuration now adds `/Brepro` while keeping
+the static C runtime. The workflow also watches this configuration so a change
+triggers verification. Corrected builds and an actual binary comparison remain
+required; parsing the updated configuration is not a build result.
+
+Local original archives and detailed evidence are retained under
+`component-rebuild-comparison-9f97ef0`, including `comparison.json`, each
+`verified-provenance.json`, and `windows-pe-differences.json`. No downloaded
+component executable was run during this comparison, and no installed lab
+service was replaced.
+
+### Corrected Windows and Linux component comparisons, 22 October
+
+The `/Brepro` correction at reviewed branch source `a413ab5` passed a new
+independent comparison. Workflows `39719130453` and `39719134640` completed their
+Windows/Linux verification and Linux deployment jobs successfully. The second
+run used public PR merge commit `aab258b3db45ec5cfe19b5e7f4bb61b218612ae2`.
+Its public parentage includes `a413ab5`, and its component workflow bytes match
+the reviewed branch workflow (SHA-256
+`3ff0b0c6c36d0855a09d157193d083715434c93653f889e8e6060367b45e1983`).
+All 130 source files in each artifact matched the reviewed public source and
+were byte-identical within each platform's pair. Both jobs on each platform
+recorded identical Rust compiler identities.
+
+Windows jobs `119628269995` and `119628283105` produced exactly matching original
+unsigned EXE bytes, without masking or rewriting any timestamp/debug field:
+
+| Component | SHA-256 from both independent Windows jobs |
+| --- | --- |
+| Management | `7a982a93819b164ca4e7d5fb7887a97726b4d0facb39475e00d4de1d243db905` |
+| Agent | `a1bc8f814cd28d0cbcaaf0cab28ff7d0f0dc157badf3d77fc04f44ec1a86758f` |
+| Worker | `775b3dcaa3ab79cef39a6f70199189d49423736f8d55f627e577089ac32cddd0` |
+
+Their verified artifacts are `12400462478` (archive SHA-256
+`b4582a927bbe53c5187857b586dcee0330bde5019a29edbf640a110dfd1c73f1`)
+and `12400666985` (archive SHA-256
+`ac69874f6b456e930040ee22a663b2e915a970e563e1dc09814249ffd5735749`).
+
+Linux jobs `119628269626` and `119628283243` again matched all three component
+binaries, with the same binary hashes as the earlier Linux comparison above.
+Their verified artifacts are `12400402279` (archive SHA-256
+`6e9ed5381a37fe7331a11cb09edd2cbdf34482553b87ce6dd4b2c42bd7aa81a7`)
+and `12400068589` (archive SHA-256
+`4187cc747b2afac5056db579fad2bd8644ca4c1c8afca683b3d31474a66f94e7`).
+
+The original archives, per-build provenance receipts and merge-recipe correlation
+are retained locally under `component-rebuild-comparison-a413ab5`. Its complete
+`comparison.json` has SHA-256
+`8a5789ecf664c462495c5042ea2f625340cebf5ec533707d1a0584f422480c0e`.
+These are successful component comparisons on the recorded hosted CI platforms,
+not universal host/toolchain reproducibility or complete product qualification.
+The native graphical customer/technician apps, Flutter engine and installers
+still need their own comparisons and runtime checks. No downloaded executable
+was run by the artifact verifier and no installed lab service was upgraded.
+
+### Portable package cache identity correction, 22 October
+
+Inspection during the independent native builds found that the portable packer
+embedded the current wall clock into `app_metadata.toml`, making otherwise
+identical package builds differ. Its existing runtime uses this integer to
+refresh the extraction cache. The generator now derives a nonzero, TOML-safe
+cache identity from the complete `data.bin` payload, preserving the metadata
+format and changing the identity whenever the packaged payload or startup
+executable changes. Directory/file entries are sorted and the existing Python
+Brotli dependency is pinned to the locally tested `1.1.0` version.
+
+Four local tests pass for identical/changed content, dictionary insertion order,
+real compression and executable selection, and directory restoration on failure.
+The first real-compression test exposed an existing generator bug: it retained
+`os.curdir` rather than the caller's absolute current directory and left input
+files open, causing Windows temporary-directory cleanup to fail. The generator
+now closes inputs and restores the caller's directory in a `finally` block. The
+corrected test run also passed with resource warnings treated as errors. The
+Windows packaging workflow runs these tests before creating the portable EXE.
+
+These changes are not present in the already-running native builds
+`39720429487` and `39720432071`, both pinned to earlier source `50c08fd`. Those
+builds are intentionally retained for comparison of the original artifacts and
+inner payloads. A subsequent native build, full binary comparison and actual
+extraction-cache/restart/upgrade checks remain required for the corrected packer.
+This marker does not authorize sessions or replace signed package verification.
+
+### Native bridge and helper input comparisons, 22 October
+
+The consumed `bridge-artifact` inputs from native workflows `39720429487` and
+`39720432071` passed published archive hash/size/CRC checks. All six generated
+Rust/Dart/header files were byte-identical. Their producer jobs were
+`119632380801` and `119632388574`; artifacts were `12400298300` and
+`12401035923`. This validates those generated source inputs, not compiled apps.
+
+Their helper producer jobs `119632380451` and `119632388297` also completed
+successfully, but the original `WindowInjection.dll` bytes differed: SHA-256
+`b11015224b6d4d5964042b085447e76b835373d84b5bcccdf88355cead1292de`
+versus `628bf38d93d43f9e2ec5562b45c812a96aa2651371833921a167ee0042842f99`.
+Both 56,320-byte DLLs passed artifact integrity checks. Read-only PE diagnosis
+found different COFF/debug timestamps and CodeView identifiers; masking those
+fields in memory made the remaining bytes match. No artifact was modified or
+counted as reproducible. Local evidence is in `native-dependencies-50c08fd`.
+
+The helper x64 release workflow now requests reproducible compiler/linker
+metadata and retains exact original upstream source and build/verification
+scripts separately from installed payload files. Its PE guard requires x64/DLL
+metadata, a REPRO marker and a PDB basename. Two parser guard tests pass locally,
+including malformed/truncated metadata and build-machine path rejection; the
+verifier also accepts the already independently reproduced Windows management
+binary. This does not yet establish a corrected helper build, independent
+helper binary comparison, code injection/session behavior or runtime acceptance.
+The ongoing native builds remain pinned to the earlier helper workflow.
+
+### Corrected helper binary and source comparison, 22 October
+
+Independent helper workflows `39722213586` and `39722215742` at source
+`f887ddc` completed successfully. Producer jobs `119638032242` and
+`119638038048` produced identical original `WindowInjection.dll` bytes:
+SHA-256 `0a739c4e0bb61b979103b0b2ca864f129c7ba51f5706ea8faccf1b8ef53a57c3`.
+Both DLLs passed x64/DLL, REPRO marker and PDB-basename checks; no timestamp or
+identifier was masked for this successful comparison. The recorded hosted image
+was `win22`, version `20261012.333.1` in both jobs.
+
+Binary artifacts `12401362042` and `12401129411` both had archive SHA-256
+`d7c92fab6677938e4453551e2ad6e87c57d3b15ead79b06b3d7bd04f513dcc8c`.
+Their separate source artifacts `12400968332` and `12401164054` passed published
+hash/size/CRC checks and contained the exact public build workflow and verifier
+sources, allowing checkout line endings. All 25 original upstream source files
+mapped to public Git blobs at `ecd8d6a139eee76845ea66423fb739af450fda90`.
+The original source ZIPs were byte-identical with SHA-256
+`21a4a67590a1a2128b019794f9da4d1e2a5130bd411f63a6450361893bf2a732`.
+
+The initial independent verifier rejected seven text files because Windows Git
+exported CRLF while their public Git blobs used LF. Inspection proved these
+were line-ending conversions only; the resumed verifier revalidated the retained
+original archives against their published hashes and checked every source blob
+with this conversion explicitly allowed. No artifact was modified or live
+transfer restarted. Local evidence, including the failed check's investigation,
+is retained under `helper-rebuild-comparison-f887ddc`.
+
+This establishes the helper DLL comparison on these two recorded CI jobs.
+It does not establish complete native payload/installer reproducibility or
+runtime injection, UAC or support-session behavior with the corrected helper.
+
+### First successful source-engine build, 22 October
+
+Workflow `39716739857`, source `9f97ef0`, completed successfully. Its raw job log
+records reviewed engine/buildroot patch verification, pinned generated-command
+checks and final build step `[4900/4900] LINK(DLL) flutter_windows.dll` at
+04:13:39 UTC. This confirms the matching ATL correction resolved the previous
+link failure. Source reconstruction artifact `12401286693` was published at
+109,172,797 bytes with archive SHA-256
+`e2f2e4c312fdbc47afb1de5871a117b1dffdebde40cc0fa97bfcc0db1d7dcb11`.
+
+The existing download/verification process is still running; neither downloaded
+artifact integrity nor source-archive equivalence is counted as passed yet.
+The later timestamp-controlled recipe `b1d62b2` is building separately in
+workflow `39718232889`. The successful first build did not contain that recipe's
+new deterministic flags, so it is not an independent reproducibility pass.
+The application's reviewed upstream engine pin remains unchanged and no
+source-built engine has been run in a native app or approved for production.
+
+### Engine verifier line-ending failure and evidence preservation, 22 October
+
+The first engine artifact transfer completed, and its declared size, archive
+hash, CRC and recorded evidence-file hashes passed before the local verifier
+stopped on a build-script byte comparison. The original archive had not yet been
+saved by that verifier, so its in-memory bytes were lost on failure. This was
+an evidence-handling defect in the local verifier, not a successful complete
+artifact/source verification.
+
+Comparison of the completed CI build log's recorded hashes against public source
+`9f97ef0` established that both PowerShell build scripts and the workflow matched
+public source after CRLF checkout conversion; the lock, patches and Python
+verifier matched exact public Git bytes. No other source change was established
+by that check. The repository now explicitly keeps these engine recipe files in
+LF form, supplementing the existing engine patch/lock/Python attributes.
+
+The replacement local collector saves and hashes the original ZIP before recipe
+checks, retains resumable partial bytes with an immutable artifact identity,
+and records byte progress without saving credentials or signed download URLs.
+Its recipe comparison explicitly permits the established script/workflow
+line-ending conversion. The replacement transfer remains active; complete engine
+source-archive and binary verification are still not counted as passed. The
+previous failed verifier and CI-log hash investigation remain available locally.
+
+The native artifact upload list also explicitly includes the separate helper
+source capsule. Merely downloading it into the build's artifacts directory did
+not include it in the workflow's previous explicit upload list. This correction
+keeps source material outside installed payloads while retaining it for release
+review. Its inclusion still needs verification in a subsequent native build.
+
+### Native build outcomes and independent artifact retention, 22 October
+
+Native workflow `39720429487` at source `50c08fd` completed successfully.
+Its independent companion `39720432071` built both apps and MSIs and passed the
+managed-policy/control regression tests and technician install/repair/uninstall
+checks, but the overall run failed during server packaging. Raw job
+`119633063832` reports a remote connection reset while downloading the pinned
+Caddy archive. This is a failed complete build, not an application/runtime pass
+or an independent complete-package comparison. Its completed technician MSI
+lifecycle artifact was retained; its final combined app artifact was skipped by
+the then-current success-only upload step.
+
+The workflow now retains explicitly named, completed client inputs before the
+independent server-packaging step. The earlier upload is gated on successful MSI
+creation, is clearly marked unsigned test input, and does not imply later
+lifecycle or server packaging passed. The complete combined artifact remains
+success-only. Source ZIP checksums are recorded before the early upload, without
+duplicating checksum entries during server packaging.
+
+Pinned server archive downloads now use at most three transfer attempts with
+bounded delays, HTTPS/TLS 1.2 support and SHA-256 validation before atomic file
+publication. A verified existing archive is reused; a mismatched existing file
+is preserved and rejected. Hash-mismatched downloaded bytes are retained for
+inspection and are not retried or published. Fault-injected tests for interrupted
+transfers, retry bounds, existing evidence, corruption, HTTPS enforcement and
+atomic publication passed locally under PowerShell 7 and Windows PowerShell
+5.1. These are transfer/integrity tests with simulated network failures; actual
+supplier download and early artifact retention still need a subsequent native
+build. No live download was restarted to make these changes.
+
+### Source-engine integrity and failed isolated runtime test, 22 October
+
+The preserved `9f97ef0` engine artifact passed its outer hash, ZIP integrity,
+all recorded evidence-file hashes and public recipe comparison. The original
+engine and buildroot archives mapped to all 5,604 and 145 public Git blobs.
+Fifty-five engine `third_party/txt/` files required explicitly verified Windows
+line-ending conversion; this did not modify the original artifact or binaries.
+
+An isolated fixture combined that engine with the previously verified `ebef5a6`
+native app and app bundle. All 95 payload files were checked before launch;
+the executable used the existing disposable lab signature. The actual native
+process ran as the existing non-administrator `SwanLabTech` in session 1 and
+exited with code 255 before displaying its interface. Its fatal message reports
+snapshot version `80a49c7111088100a233b2ae788e1f48` expected by the runtime,
+versus `ccfc17e3575a1ecc23c0d7bf8ff6f6cc` in the app bundle. Task completion
+code zero is only the wrapper result and does not turn this into a passed test.
+
+The public Dart `88c9758ef131d430d8ce595c6bfb4c90574d3ddd` snapshot-version
+algorithm and its 15 original VM files independently produce the runtime's
+`80a49...` value. A CRLF diagnostic produces a different value, so the observed
+mismatch has not been attributed to checkout line endings. Flutter 3.24.5's
+public engine revision is `a18df97ca57a249df5d8d68cd0820600223ce262`; its DEPS
+still specifies this same Dart revision. Merely changing the engine tag is
+therefore not established as a fix. The existing application build replaces
+the SDK's whole Windows release-engine directory with the reviewed upstream
+archive; its compiler/runtime inputs need to be treated together.
+
+The Windows build now offers a separate explicit `source-candidate-9f97ef0`
+experiment. It downloads the exact prior engine build, checks the reviewed
+inner archive and each binary hash, requires the matching SDK snapshot-version
+marker, and replaces only the DLL/import library/symbols. The SDK snapshot
+compiler remains unchanged and its hash is recorded. Three local tests cover
+compiler preservation and rejection of incompatible compilers or tampered
+archives before modifying the SDK cache. Actual candidate CI compilation and
+native runtime qualification remain pending. The default upstream selection
+has not changed.
+
+Original runtime receipts and logs are retained locally under
+`engine-9f97-gui-ebef-inputs/runtime-evidence`. Both installed company/customer
+services remained running, the installed customer executable and fixture public
+profile hashes remained unchanged, and the experimental native process exited.
+Host RustDesk and rendezvous/relay processes were left running.
+
+The timestamp-controlled engine workflow `39718232889` at `b1d62b2` also
+completed successfully. Its original artifact is being preserved by the
+existing streaming download; complete verification and an independent
+same-recipe binary comparison remain pending. It was not substituted into the
+incompatible older bundle or counted as a runtime pass.
+
+### Native application date input, 22 October
+
+Inspection found that the pinned upstream `hbb_common::gen_version()` writes
+the machine's current local minute into the native application's `BUILD_DATE`.
+This is a separate source of nondeterministic executable data, beyond linker
+timestamps and the portable packer's cache marker.
+
+Managed application builds now render version metadata from Cargo's package
+version and a required `SOURCE_DATE_EPOCH` in UTC. The Windows workflow uses the
+source commit timestamp, and the application source capsule records that epoch
+so exported sources can reproduce the input without a Git checkout. Ordinary
+upstream builds retain their existing path. No submodule revision was changed.
+The five source-capsule tests passed locally, including repeatable archives,
+private-file exclusion and the recorded epoch's equality to its source commit.
+Three native Rust regressions cover fixed UTC output, invalid date rejection
+and Rust string-literal escaping. They passed in workflow `39730660383` at
+`e6b87b9`; actual independent native binary comparison remains pending in
+workflow `39741804606`. The earlier `5777ee1` engine experiment predates this
+correction.
+
+### Timestamp-controlled engine artifact verified, 22 October
+
+The original artifact from engine workflow `39718232889` completed its existing
+transfer and passed verification without a restart. Artifact `12403616067` is
+109,003,646 bytes with SHA-256
+`73a49daf109caff8180c21b31cedd83b438c4c368ae7ee095c54fdcac976ca9c`.
+The original ZIP was saved before checking its contents. All 19 evidence files,
+public recipe bytes, all 5,604 engine and 145 buildroot source mappings,
+generated compiler commands and final linker response passed their checks.
+The already investigated text checkout conversions remain explicitly declared.
+
+The source-built DLL SHA-256 is
+`ef120f74ffc05de1397bcbbf01c601af3a5452aa6a9d6939e410c41a774199ba`.
+Read-only inspection confirms Windows x64 DLL format, the REPRO debug marker,
+the basename `flutter_windows.dll.pdb` rather than an absolute build path, and
+the expected Dart snapshot-version marker. No DLL was executed by these checks.
+The original inner binary ZIP has SHA-256
+`6da1e7d46774fbb1164351e85e9fa439ee84a380b5a45c80d4720d1c97d6e67e`.
+Original artifacts and verification receipts remain in the private lab folder
+`engine-source-b1d62b2`.
+
+Independent workflow `39730890327` uses reviewed source `e6b87b9`. All eight
+public engine recipe/workflow/test files are byte-identical in Git to `b1d62b2`;
+this correlation is recorded locally. Its actual exported inputs and binaries
+still require verification and comparison after completion. Different source
+commits elsewhere in the app do not establish or disprove engine reproducibility.
+Neither runtime qualification nor production approval is claimed.
+
+### Licensed Server 2022 standard-user fixture prepared, 22 October
+
+The preserved Server 2022 Desktop Experience guest booted normally at build
+`20348.587`. Read-only licensing inspection reports the evaluation licensed,
+with approximately 180 days remaining. A new disposable local standard account
+completed an actual graphical Windows logon. An owned limited interactive task
+then verified its identity, non-administrator token and session 1. Its new user
+profile has no technician installation or registration. Execution policy stayed
+at machine `RemoteSigned`, with no process/user override; no explicit
+`DisableMSI` policy value was present. No customer or company service was started.
+
+The public two-field lab identity marker remains System-owned and unchanged;
+only that marker gained read access for the test account. Credential storage
+remains protected, and product private-state permissions were not changed or
+tested. This fixture is for the positive current-source technician MSI lifecycle,
+separate from the previously blocked private-state access test. No new MSI phase
+or full Windows qualification is counted as passed yet.
+
+The disposable MSI runner now makes technician repair remove a previously
+verified installed executable by moving it into the new owned evidence directory,
+then requires the MSI to restore it. This distinguishes missing-file recovery
+from repair of an intact installation and preserves the original test bytes.
+Windows PowerShell parsing passed; execution against the pending current
+package and independent result/log verification remain required.
+
+### Current matching-engine runtime and installer policy, 22 October
+
+The original `e6b87b9` native archive is 256,143,913 bytes, SHA-256
+`7fc4840057d82c94fa49d3dfb2a97542247e1f398b6d26016cf2aa21bef5fb7e`.
+After complete source and payload verification, three copied executables were
+signed and timestamp-verified with the disposable lab publisher. No signing
+key was exported. The isolated standard-user native process matched all 95
+original payload files and the experimental source-built engine. Its branded
+login, MFA, authorized inventory/history, customer approval and actual desktop
+capture were observed. After session close, history showed Ended; sign-out
+cleared inventory, password and authenticator fields. Server audit/history
+confirmed one claimed, closed, customer-approved session and login/logout.
+The native process exited, both preserved services stayed running, and original
+customer/technician profile hashes stayed unchanged. This was the same Server
+2016 VM and the older `bd13500` receiver: separate-machine control, relay,
+Internet connectivity and corrected-receiver acceptance remain unproven.
+
+The current lab-signed technician MSI has SHA-256
+`cf886b50bbe91344e05bfa863a78cee49163a13c8ad37773b4f52603363238e1`.
+An actual limited interactive user on licensed Server 2022 evaluation build
+`20348.587` ran the public MSI harness from `eecf985`. Signature/publisher checks
+passed, but installation returned 1625. The original MSI log records effective
+`DisableMsi=1` and blocks unmanaged per-user installation, despite the absent
+explicit registry value. No installed payload, shortcut or per-user registration
+remained. Repair and uninstall did not run. Policy was not weakened. This is
+a failed standard-user test, not a full Windows compatibility pass. Company
+setup now explains error 1625 and directs users to an administrator; parsing
+passed, but this new message has not been exercised through a company bundle.
+
+Independent timestamp-controlled engine build `39730890327` retained and
+verified all 19 evidence files, 5,604 original engine files and 145 buildroot
+files. Its DLL SHA-256 equals the first build's
+`ef120f74ffc05de1397bcbbf01c601af3a5452aa6a9d6939e410c41a774199ba`,
+and the import libraries also match. The PDBs differ: the second has SHA-256
+`ebd4d4341d313cc2e353beaad9fc5ef72d21439ffbc96aa3256a7d677d7a621e`.
+Read-only MSF parsing found differences in 4,108 of 4,124 streams, so this is
+not established as a timestamp-only difference. Three exported text recipes
+differ only by independently checked CRLF/LF checkout conversions; original
+PDB and binary bytes were never normalized. Complete engine-output and native
+application/installer reproducibility remain open.
+
+The original engine/buildroot source archives, dependency revision records,
+generated commands, link response, applied patches and GN arguments match
+between the two timestamp-controlled builds; recorded toolchain fields differ
+only in the source commit and workflow identifiers. The next public recipe
+tests the pinned DEPS LLVM linker with single-threaded integration. Patch/hash
+validation, four provenance/flag regression tests and PowerShell parsing pass
+locally. Its compilation, independent PDB comparison and native runtime behavior
+remain unverified. The previous successful GUI smoke test does not qualify this
+new linker experiment.
+
+The first LLVM-linker experiment (`39747929292`, source `57e7f0a`) passed the
+recipe guards and toolchain setup, then failed GN generation before compilation:
+the clang toolchain no longer consumed the unconditionally declared `expname`.
+The patch now constructs that Microsoft-only output name inside its conditional
+branch. Patch reconstruction and four local guard tests pass after correction;
+actual GN generation, linking, reproducibility and runtime tests remain required.
+
+The corrected-variable build (`39750471521`, source `b72c61f`) advanced to GN's
+generated-input validation and failed because Flutter's Windows archive target
+still listed `flutter_windows.dll.exp`. The engine patch now removes that
+obsolete intermediate from the archive list as well as from the LLD outputs.
+The three-file engine patch is hash-pinned and its reconstruction and local
+guard tests pass. Compilation and independent output/runtime verification
+remain pending; neither failed attempt produced a qualified engine.
+
+### Rebuilt MSI product identity, 22 October
+
+Two local technician builds using the same verified `e6b87b9` executable/agent
+and original WiX 5.0.2 recipe generated different ProductCodes and MSI hashes.
+Both builders now derive ProductCode from their existing edition UpgradeCode
+namespace and `windows-x64|<version>` using UUIDv5. Five local tests pass,
+including cross-checking PowerShell against Python's standard UUIDv5 for both
+editions and two versions. Two actual technician builds then retained identical
+ProductCode `{A6857EBE-9FD4-52DE-B899-454C2F066E52}` for version 1.5.0.
+Their package codes/timestamps and raw MSI hashes still differ; complete MSI
+reproducibility and actual stable-identity upgrade/recovery tests remain open.
+
+### Prepared MSI metadata, timestamps and administrative lifecycle, 22 October
+
+Subsequent changes `d7375b5` and `67786dd` prepare deterministic unsigned MSI
+metadata and stage byte-verified input copies with consistent cabinet timestamps.
+Two full builds per edition produced identical MSI bytes even when identical
+input payloads had different 2020/2025 timestamps. Technician SHA-256 was
+`96d33dd08f5f30a49d9d318017e7ff343f4e20f87f837ad0499b5ae4c4c709e5`;
+customer SHA-256 was
+`839b41f2d17645bfc69eb6f44901f5ce97d6433c59cc8addf49598b8ea3e51c3`.
+The actual technician builder also produced the same bytes under PowerShell
+5.1 and 7. Six authoring tests and native staging/metadata guards pass locally.
+This is local repeatability evidence, not independent CI reproducibility.
+
+A separate disposable administrative account on Server 2022 Standard Evaluation
+build `20348.587` then ran the public lifecycle harness against a newly built
+version 1.5.0 technician MSI using installer recipe `67786dd` and verified
+`e6b87b9` lab-signed executable/agent inputs. The MSI itself was unsigned:
+SHA-256 `f3cb6e56229488b9d6d4dec0e07318a5520b82ee66177435ae358c98faf348e7`,
+ProductCode `{A6857EBE-9FD4-52DE-B899-454C2F066E52}`. Install, missing-executable
+repair and uninstall each returned zero and passed payload/registration checks.
+The task completed with result zero; execution policy was unchanged. Nine
+original records, including all three installer logs, were transferred and
+hash-verified outside Git under the private lab's
+`technician-stable-admin-20261022/lifecycle-evidence` directory.
+
+This qualifies only those administrative bare-MSI operations. It does not
+supersede the standard-user error 1625 result, demonstrate a signed MSI or a
+company-worker bundle, exercise an interactive desktop, establish upgrades or
+automatic updates, or qualify the full Windows matrix. Independent builds,
+cross-time-zone repeatability, signed publication and the remaining end-to-end
+acceptance gates are still required.
+
+The same isolated administrative profile subsequently passed reinstall after
+that uninstall, an MSI major upgrade from 1.5.0 to 1.5.1, and uninstall of 1.5.1.
+All three operations returned zero. The old ProductCode became unregistered;
+new ProductCode `{D32FA420-4F84-50A6-BAB2-CBFDA73F87C9}` became installed, the
+shortcut remained available, and an explicitly unowned fixture file survived
+the upgrade unchanged. The new unsigned MSI SHA-256 was
+`8d80925e0c05717d062d4e868b31258cfa58a55449c664c8d10c6a9bed68ca8b`.
+Seven original records, including reinstall/upgrade/uninstall logs, were
+transferred and hash-verified under the private lab's
+`technician-stable-upgrade-20261022/upgrade-evidence` directory. Execution policy
+was unchanged. Both MSI versions contained the **same** verified `e6b87b9`
+application payload: this proves that installer-version transition only, not
+an application update, signed automatic rollout, interrupted-upgrade recovery,
+or preservation of real device identity, consent or company configuration.
+
+### Independent native rebuild comparison, 22 October
+
+The second exact-source `e6b87b9` native build, run `39741804606`, was downloaded
+once and verified against artifact digest
+`274f2ce79b5210ea6cb401cb1b6c9a0113653b8036d5c933cae2bfe0802b1fb8`.
+Its 1,138 public Git/submodule source files, six generated bridge files, retained
+engine evidence and source epoch `1792648409` verified before comparison with
+run `39730660383`. Both original archives and decoded payloads remain outside
+Git; no comparison rewrote a binary.
+
+The original unsigned `swan-agent.exe`, `swan-management.exe` and
+`swan-worker.exe` matched byte-for-byte. Of 95 decoded customer payload files,
+83 matched, including `librustdesk.dll` and the AOT application data. The desktop
+launcher and 11 Flutter plugin DLLs differed by two or four bytes each. PE
+inspection confirmed every differing byte lies in the COFF or debug-directory
+timestamp fields. All 12 lacked `IMAGE_DEBUG_TYPE_REPRO`. Consequently the
+portable packages, both old-recipe MSIs and server setup package also failed
+the complete-byte comparison. Full native reproducibility is **not achieved**.
+
+The Windows CMake configuration now requests `/Brepro`, non-incremental linking
+and PDB basenames for non-Debug runner/plugin targets before their creation.
+The Windows build workflow checks those actual outputs using the existing PE
+metadata verifier and retains its receipt. All 12 actual failing old binaries
+were rejected by that verifier; its two parser tests pass, and the original
+Rust native DLL passes its metadata check. Corrected C++ compilation, independent
+raw-byte comparison, runtime qualification and server-setup reproducibility
+remain unverified. A REPRO marker by itself will not satisfy those gates.
+
+### Server launcher compiler repeatability, 22 October
+
+The two original `e6b87b9` server setup executables had matching resource/source
+manifests but different generated .NET module IDs. The legacy Framework compiler
+does not provide a deterministic-compilation option. The recipe now uses the
+hash-pinned, Microsoft-signed Roslyn 4.12.0 compiler package, ordered compact source
+metadata, deterministic compilation and explicit, hash-recorded references.
+It verifies all embedded resources, including `SOURCE.json`, after compilation.
+
+Two actual local builds with the final revised recipe produced identical unsigned
+server setup SHA-256
+`3a7d1b17c8ed4028a73c1fc03a2669fa6b8e6445e086085934a0f6c4fbaabf4d`.
+One build used Windows PowerShell 5.1 and the other PowerShell 7. A wrong compiler
+package was rejected before extraction. The receipt and original outputs remain
+under the private lab's `server-setup-roslyn-20261022/final-validation` directory.
+This was a dirty working-tree experiment over revision `49ced68`, using the
+verified `e6b87b9` management executable and retained pinned transport/HTTPS
+resources; it is not an independent CI build of the complete current server.
+No setup executable was installed or run as an application during these checks.
+The updated CI tests, reference-assembly pinning across images, production signing,
+actual server deployment and the remaining acceptance gates are still unverified.
+
+The next server recipe revision also pins all five .NET/PowerShell reference
+assemblies through two hash-verified Microsoft SDK packages and checks each
+selected DLL hash before compiling. It no longer reads the host's runtime/GAC
+assemblies as compiler references. Two actual local builds of that revision,
+again using PowerShell 5.1 and 7, produced identical unsigned server setup
+SHA-256 `0489bfd78caae185edab646f72a74f84c063056e82d23c2e523cb929774774ab`.
+Both wrong-reference-package cases were rejected before extraction; the receipt
+verified every compiler reference against the published pins. Original outputs
+and the receipt remain under the private lab's
+`server-pinned-references-validation-20261022` directory. This was a dirty-tree
+experiment over `e3721a7`, using the retained `e6b87b9` management executable.
+Independent CI, cross-image comparison, native runtime/deployment and signing
+qualification remain pending; the local result does not satisfy those gates.
+
+The pinned-reference executable also returned zero from its packaged
+`--render-preview` path on Windows 11 Home build `26200`, and the rendered form
+was visually inspected. This exercises launcher loading, resource extraction,
+Windows PowerShell runtime binding and preview rendering. Installation and
+browser actions were disabled; no company services were installed. The CI
+repeat-build test now exercises this preview mode and retains the PNG. This is
+preview-only runtime evidence, not actual server setup or deployment acceptance.
+
+The same pinned-reference launcher was exercised in preview-only mode on the
+existing Server 2016 Standard Evaluation VM, build `14393.693`, with .NET
+Framework release `394802`. It rendered a PNG and returned zero when observed
+through an owned `System.Diagnostics.Process` handle. The company server,
+installer worker and customer services remained running before and after.
+The PNG and original report were transferred and hash-verified under the private
+lab's `server-preview-pinned-refs-16-20261022/repeat-observation` directory.
+The headless SSH render omits some native window/border decoration; interactive
+appearance is not qualified by this image. No management process was started
+and no server installation was attempted.
+
+The first preview observation rendered an image but did not expose an exit code
+through Windows PowerShell's redirected `Start-Process` result. Its inconclusive
+report remains preserved; it was not counted as a pass. The original PID was
+confirmed absent before the repeat. The public preview test now owns the child
+process handle directly; its full repeated-compilation, package-rejection and
+preview checks also passed under Windows PowerShell 5.1 on the host, with records
+under `server-preview-process-ps5-validation-20261022`. This addresses test-result
+capture only and does not qualify deployment, upgrades or the full Windows matrix.
+
+### LLVM-linked engine artifact and startup smoke, 22 October
+
+The corrected engine recipe at `05d5369` completed in run `39753153773`.
+Artifact `12416969754` (107,382,139 bytes) was preserved and verified against
+SHA-256 `5629a63868421d17ac00a6cdd4215cda852c59b8bcf9efb802482d6248751d53`.
+All 19 evidence files, 5,604 original public engine files, 145 original public
+buildroot files, pinned recipe inputs and generated compile/link commands
+verified. The DLL SHA-256 was
+`c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204`.
+An independent same-source rebuild later completed; its original-byte comparison
+is recorded in the independent LLVM engine result below.
+
+An isolated Server 2016 `14393.693` standard-user experiment combined this engine
+with the matching `e6b87b9` application payload and its existing lab-signed native
+main executable. Live process-module inspection confirmed the candidate engine
+and expected Rust DLL were loaded from that isolated payload. Computer-use
+inspection showed the company-branded technician login, username/password/MFA
+fields and product/license attribution. No credentials were entered. The window
+was closed through its title bar and the process exited zero. All 95 payload
+files verified afterward with the two declared engine/signed-main substitutions;
+the original bootstrap and installed receiver hash stayed unchanged, and all
+three existing Swan services remained running. Six original run/log/input
+records were transferred and hash-verified under the private lab's
+`engine-05d5369-gui-20261022/evidence` directory.
+
+This is engine startup/rendering/clean-exit evidence only. It does not prove
+authentication, remote-session behavior, public connectivity, independent PDB
+reproducibility, installer/updater compatibility, production signing or the full
+Windows matrix. The default application engine remains unchanged.
+
+### Fresh standard Windows 10 Pro MSI lifecycle, 22 October
+
+A new disposable VM was installed from Microsoft's Media Creation Tool standard
+Windows 10 x64 ISO, selecting Pro. The ISO SHA-256 is
+`ac6f8bd452c476f07f2ca14d85622e7c8723af6517aa27a014ddc4831e38b693`.
+First interactive logon and the guarded provisioning report completed. Tests
+recorded Windows 10 Pro x64 `19045.3803`. This is a standard unactivated
+installation: the read-only licensing observation recorded status 5 and zero
+grace. No activation bypass, rearm, clock change or licensed-trial claim applies.
+
+The previously verified unsigned technician MSI 1.5.0, SHA-256
+`f3cb6e56229488b9d6d4dec0e07318a5520b82ee66177435ae358c98faf348e7`,
+contains lab-signed application `e6b87b9` and uses installer recipe `67786dd`.
+Under the VM's Administrator account, installation, repair of a deliberately
+missing technician executable, and uninstall each returned 0. The public harness
+checked installed executable hashes, registration, shortcut and removal. Nine
+original result/driver/log records were collected and hash-verified under the
+private lab's `technician-win10-admin-20261022/lifecycle-evidence` directory.
+
+The first unsigned test-script invocation was rejected by the default PowerShell
+policy before installation; that failed observation remains retained. The
+verified test driver then ran in a child process with `-ExecutionPolicy Bypass`.
+Its reported process policy is explicit. No machine/user PowerShell or Windows
+Installer policy was configured for this test; machine/user PowerShell policy
+snapshots matched. The child process exited 0 and the
+original phase reports independently recorded each MSI result. This is an
+administrator bare-MSI functional result for this exact package and OS build,
+not standard-user, customer, company-worker, enrollment, update, licensed-Windows
+or complete Windows 10 qualification.
+
+### Complete component/deployment CI observation, 22 October
+
+The manual company-product run
+[39766139184](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39766139184)
+at exact source `fa188bcfe78152bef9504fca41a161a0679587bc` completed successfully.
+Windows 2022 and Ubuntu 24.04 component verification jobs passed, including the
+pinned server compiler/references reproducibility and packaged preview checks on
+Windows. The Linux deployment job passed its fresh setup/persistence, isolated
+HTTPS/transport rehearsal, maintained transport source build, and backup recovery
+checks. The optional technician MSI lifecycle job was skipped; this run supplies
+no evidence for that job. These CI checks do not replace the outstanding real
+Windows server deployment, public-network, interactive session, signing and full
+compatibility acceptance requirements.
+
+### Independent LLVM engine original-byte comparison, 22 October
+
+The same public engine recipe `05d5369c04804b9a9b2dc06df0cb85b0efe6f274`
+completed independently in runs
+[39753153773](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39753153773)
+and [39761977920](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39761977920).
+The second artifact `12420939008` (107,382,134 bytes) verified against SHA-256
+`f1e6df169a68c3cc470d68522d7ea997ade549f2c07b621566f76bc07192b258`.
+Both retained archives independently passed the 19-file evidence verification,
+5,604 public engine source mappings, 145 public buildroot source mappings,
+pinned recipe checks, generated commands and final link-response checks.
+
+All three uncompressed outputs matched original bytes: `flutter_windows.dll`
+(18,156,544 bytes), `flutter_windows.dll.lib` (30,436 bytes), and
+`flutter_windows.dll.pdb` (239,464,448 bytes). No timestamps, debug records or PDB
+streams were normalized. This establishes independent reproducibility for these
+exact engine outputs and recorded inputs. It does not establish equality to the
+historical upstream binary, complete application reproducibility or runtime
+acceptance. Both original artifacts remain preserved privately; the public
+[comparison record](../deployment/windows/engine-05d5369-reproducibility.json)
+contains both artifact identities and all output SHA-256 hashes.
+
+The native workflow now offers this explicitly pinned engine as the additional
+`source-candidate-05d5369` lab choice. Five selector regression tests passed,
+including unknown-choice and wrong-generation rejection. A separate local
+selection check accepted the actual first archive and all three binary pins
+while preserving a non-executed snapshot-compiler fixture; that fixture check is
+not a real SDK/application runtime test. Runtime and production approval remain
+false, and the default engine selection remains unchanged. The previously
+recorded standard-user login-screen startup smoke remains the only runtime scope
+qualified for this engine so far; full remote-session checks remain outstanding.
+
+### Standard-user technician MSI on standard Windows 10 Pro, 22 October
+
+The same unsigned 1.5.0 technician MSI recorded in the administrator result
+above also passed installation, missing-executable repair and uninstall as
+`SwanTechMsi10` on the standard Pro `19045.3803` VM. The original phase reports
+each recorded `administrator: false`, `standard_user_required: true` and exit 0.
+The task ran with a limited interactive token in session 3 and completed with
+last result 0. Ten original task, safety-marker, result and MSI log files were
+transferred and hash-verified under the private lab's
+`technician-win10-standard-marker-20261022/lifecycle-evidence` directory.
+
+The initial password task was registered but never ran and was disabled before
+an alternate launch. A direct credentialed process launch was denied before it
+created a driver PID. After normal interactive login, the first driver attempt
+failed before MSI results because the independently provisioned safety marker
+allowed only SYSTEM and Administrators to read it. Its failed records remain
+preserved. The corrected fixture grants this owned standard account read-only
+access to that single lab marker, preserving its contents and SYSTEM ownership;
+it grants no product-state permissions. A fresh fixture and separate task then
+produced the passing result. None of the failed driver starts is counted as an
+MSI execution or pass.
+
+The verified driver used process-only PowerShell Bypass, with the original
+machine/user policies remaining undefined. No Windows Installer policy was
+configured. The OS remains unactivated with the licensing state recorded above.
+This is standard-user bare-MSI evidence for the exact old application/installer
+inputs, not current-source, company enrollment, customer installation, approved
+updates, remote-session behavior or complete Windows 10 qualification.
+
+### Corrected desktop artifact verification and comparison tooling, 22 October
+
+The complete `49ced68` native artifact from run `39760022829` was preserved:
+256,166,945 bytes, SHA-256
+`c1ed67f599910d9d94e58caa1635761521c1f91d140fe3c435ea1716646710d8`.
+Its 1,143 tracked public source files, six generated bridge files, source epoch
+and retained pinned engine evidence verified. All 95 decoded customer payload
+files matched the installed-file manifest. Independent inspection of the actual
+main executable and 11 plugins matched their retained PE guard receipts: each
+has a REPRO marker and no absolute PDB path. These markers do not establish
+independent reproducibility; that comparison and this build's runtime acceptance
+remain pending.
+
+A manual read-only native comparison workflow now verifies original archive
+digests, exact public source and all eight expected shipping executable/MSI
+outputs from two different successful runs. Eight trust-boundary regression
+tests passed, covering altered source with a self-consistent manifest, invalid
+file/download hashes, unsafe storage origin, incomplete output sets and binary
+differences that must not be hidden by source line-ending handling. The new
+source/hash verifier also accepted the actual preserved `49ced68` archive;
+that single-archive check was not an independent-build comparison. No completed
+pair-workflow result is claimed here. Runtime and production approval stay false.
+
+### Fresh activated Windows 11 administrator MSI lifecycles, 22 October
+
+Official Microsoft Windows 11 Enterprise 26H2 evaluation media completed and
+matched its published SHA-256
+`bc3f24086ebadc94489066b5ad78089e2cf5c3491e90e790bb81a2b199c10e38`
+(8,225,329,152 bytes). A new 64 GiB GPT guest with 4 GiB RAM and two virtual
+CPUs installed build **26300.9457 x64**. The isolated Alpine 3.24.2 WSL2 lab uses
+QEMU 11.0.3/KVM, secure-capable EDK2 firmware with Microsoft Windows boot
+certificates, and a swtpm 0.10.2 TPM 2.0 backend. The installed Windows OS
+reported Secure Boot enabled and TPM 2.0 present and ready. No Windows hardware
+requirement checks were bypassed. Its first logon completed, and the temporary
+automatic-logon password was removed. Normal Microsoft online activation then
+reported LicenseStatus 1 and 129,600 evaluation minutes remaining; no key
+replacement, rearm or clock change was used.
+
+Native run `39777271372`, exact source
+`9e4ea6dfce7dc1e66eccf6e1068780a23ae8fd59`, supplied the unsigned MSI inputs
+with the explicitly selected source-built `05d5369` engine. Original archive,
+1,149 tracked public files, six generated bridges and retained engine evidence
+verified. The 95 portable application files matched their manifest, and the
+main executable plus 11 plugins matched their PE metadata receipts. These
+checks do not establish complete native output reproducibility; see the
+[original build comparisons](SOURCE_AND_LICENSE.md#source-built-engine-application-comparison-22-october-2026).
+
+Under the guest Administrator, both editions passed actual install, repair and
+uninstall with exit code 0 in all six operations, without a required reboot:
+
+| Edition | Original unsigned MSI SHA-256 | Repair evidence |
+| --- | --- | --- |
+| Technician | `297265c102b0c94b5361c76b9873bc2b09fe3e76b2f98975a06b840452babeba` | A previously verified main executable was retained outside the install path; MSI repair restored the missing executable with its expected hash. |
+| Customer | `9ebb1d8e56248b9b6005ed1a884ff29ec5edd8421b60b00253ec743e875cac48` | The packaged license was deliberately damaged; repair restored it and all 96 manifested files. The service's executable path, LocalSystem identity and running state were checked. |
+
+MSI registration, installed executable/agent hashes, technician shortcut and
+component registrations, complete customer payload and uninstall removal were
+checked. Each edition's nine original phase/driver/MSI records were transferred
+and hash-verified in the private lab. Original machine/user execution policies
+were preserved; only the verified test driver used process-scoped Bypass.
+
+The initial customer driver used the portable manifest (95 files) instead of
+the MSI-specific manifest (96 files including `LICENSE.txt`). The harness
+rejected this fixture before invoking MSI; its five original failure records
+were preserved and hash-verified. A separate corrected fixture used the actual
+MSI build receipt's manifest hash
+`3453afe7fd075f1739bbbfa04980f21f5bcf6ba7dceda1d47333a94af7be485c`
+and produced the passing customer results. No MSI failure or pass is claimed
+for that first preflight-only attempt.
+
+The technician's original harness recorded the legacy registry ProductName
+“Windows 10 Enterprise Evaluation”; its build/platform checks and independent
+Win32_OperatingSystem observation identify Windows 11. Original records remain
+unchanged. The public harness now obtains caption, version, architecture and
+build from Win32_OperatingSystem while retaining the exact registry UBR; the
+customer run verified the corrected Windows 11 caption.
+
+This is **administrator bare-MSI evidence for those exact inputs**, not
+standard-user installation, company-generated bundles, enrollment, remote
+sessions, approved updates, interruption recovery, trusted production signing
+or complete Windows 11 qualification. Those release gates remain open.
+
+### Activated Windows 11 standard-user technician MSI, 22 October
+
+The same original unsigned technician MSI from source `9e4ea6d`, SHA-256
+`297265c102b0c94b5361c76b9873bc2b09fe3e76b2f98975a06b840452babeba`,
+passed actual install, missing-executable repair and uninstall under an owned
+local standard user on the activated Windows 11 Enterprise evaluation
+**26300.9457 x64** above. All three MSI exit codes were 0, with no required
+reboot. The account belongs to Users and not Administrators. A normal graphical
+login created its active console session 3; the manually started test task used
+that account's Interactive/Limited principal. The driver rejected a different
+SID, an administrator token or a non-interactive session, and each public
+harness phase required `RequireStandardUser`. Original phase records report
+`administrator=false` and `standard_user_required=true`.
+
+The fixture grants that account read access only to the independent lab safety
+marker and access to its own test directory. Marker bytes/owner were preserved;
+no customer product-state permissions or Windows Installer policies were
+changed. The verified driver used process-scoped PowerShell Bypass and preserved
+its original machine/user execution policies. The corrected public harness
+records the actual Windows 11 caption. Ten original task, marker, lifecycle and
+MSI records were transferred and hash-verified; the copied executable, agent,
+shortcut, component registration, missing-file restoration and uninstall
+removal checks passed. The first administrative technician records retain
+their original legacy registry caption as described above.
+
+These three standard-user operations plus the six administrative operations
+are **nine passing source-specific bare-MSI operations**, not complete Windows
+11 compatibility. Company bootstrap/enrollment, accepted remote sessions,
+approved updates, upgrade/interruption recovery, production signatures and the
+remaining feature/Windows matrix still require their own evidence.
+
+### Unpublished 1.5.1 inputs for real update tests, 22 October
+
+The application, Flutter build number, portable packer, workspace lock entries
+and native installer workflow now consistently select **1.5.1** (Flutter build
+69). This prepares a genuinely different application version for approved
+automatic-upgrade tests over retained 1.5.0 inputs. The baseline tag, existing
+1.5.0 build references, installed lab identities, company profile revisions,
+installer edition namespaces and publisher trust are unchanged. This is not a
+production release, an applied update, or evidence that any upgrade passed.
+Native build/source verification, signing policy, admin approval and actual
+interruption/session/identity-preservation tests remain required.
+
+### Complete unsigned native reproducibility, 22 October
+
+The original outputs from successful independent native builds `39807079997`
+and `39819129959` at source `e9d89ca97319590905a39663b76718ee53bcdd78` passed
+[comparison 39829786141](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39829786141).
+The [unchanged original report](../deployment/windows/native-e9d89ca-rebuild-comparison.json)
+verifies both original archive digests, public source and generated bridges,
+and all eight expected executable/MSI outputs are byte-identical. No shipping
+file was normalized or executed. This uses the explicitly selected independently
+reproduced `05d5369` engine; it does not establish the default engine's source
+reproducibility or extend this result to a different application revision.
+
+The first archive was also retained locally and passed source/artifact checks;
+all 95 extracted application files match the installed-file manifest (accounting
+for the documented portable `rustdesk.exe` to installed `Swan Remote Support.exe`
+name). The 12 native desktop metadata hashes and pinned engine DLL hash match.
+These are build-integrity checks, not runtime tests. Earlier failing original
+comparisons remain retained as historical evidence.
+
+The real 1.5.1 native build `39820151128` at `699c9e0` has now succeeded.
+Its subsequent independent comparison and local integrity checks are recorded
+below. Installation and applied automatic-upgrade evidence remain separate.
+Production signing and the full installation/session/update/Windows acceptance
+requirements remain open.
+
+### Unpublished 1.5.1 independent comparison, 22 October
+
+Successful native runs `39820151128` and `39832811268`, both at exact source
+`699c9e022ad71e4a409be52b56c9fe9697074bdf` with the selected `05d5369` engine,
+passed [comparison 39844492046](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39844492046).
+The [original report](../deployment/windows/native-699c9e0-rebuild-comparison.json)
+records eight byte-identical unsigned shipping outputs, both original archive
+digests and verified public source/generated bridges. Shipping files were not
+normalized or executed.
+
+Local collection also verified the first original archive, complete public
+source, six bridges, selected engine and all 95 decoded payload-file hashes.
+The application EXE and Rust DLL have different bytes from the preceding 1.5.0
+inputs. Actual major upgrade, approved automatic rollout, interruption recovery,
+identity/consent preservation and the remaining runtime/release gates still
+require explicit test results; build reproducibility does not prove them.
+
+### Actual technician 1.5.0 to 1.5.1 MSI upgrade, 22 October
+
+On the retained Windows Server 2016 Standard evaluation Desktop Experience
+**14393.693 x64**, an isolated new local administrator profile passed four real
+MSI operations: install 1.5.0, major-upgrade to 1.5.1, repair after retaining and
+removing the installed technician executable, and uninstall 1.5.1. All exit
+codes were 0; no reboot was required. These are original unsigned inputs from
+the independently reproduced builds above:
+
+| Input | Application/recipe source | Original MSI SHA-256 |
+| --- | --- | --- |
+| Technician 1.5.0 | `e9d89ca97319590905a39663b76718ee53bcdd78` | `f9bf6db54580945e4f588a84e95fffc77632f2a43d7c80881485dc8342d3ac33` |
+| Technician 1.5.1 | `699c9e022ad71e4a409be52b56c9fe9697074bdf` | `f09b59d42287b595548e6a894f6fb498f46106218d66fc6742e5f17eae8b8b4d` |
+
+The upgrade removed old ProductCode
+`{A6857EBE-9FD4-52DE-B899-454C2F066E52}` (ProductState -1) and installed
+`{D32FA420-4F84-50A6-BAB2-CBFDA73F87C9}` (ProductState 5), retaining technician
+UpgradeCode `{A4374699-436F-4917-9A4E-223F62A9E634}`. The public lifecycle
+harness then verified the new executable/agent hashes, shortcut and component
+registration before inducing and repairing a missing executable. Uninstall
+verified removal of the new payload, shortcut and registration.
+
+The existing administrator profile contained technician software; its preflight
+stopped without modification. A separate owned administrator account was used
+instead. A manually started Password/Highest scheduled task ran under that
+account's actual SID; no SSH access rule or Windows Installer policy was changed.
+Task-principal name normalization and null-trigger preflight issues were
+corrected before its first execution; the task was confirmed never previously
+run. The final task, wrapper and original phase reports all record success.
+Fourteen original driver, phase, invocation and MSI records were transferred
+and hash-verified in the private lab. Machine/user execution policies were
+preserved; the verified test process alone used PowerShell Bypass.
+
+The existing customer's device ID, device-token hash, unattended consent,
+consent revision and accepted release sequence were unchanged, and its customer,
+management and worker services remained running. No technician app was launched.
+This proves an **administrative bare-MSI major upgrade in that profile**; it is
+not standard-user/interactive acceptance, an enrolled technician identity test,
+an approved automatic update, interruption recovery, publisher validation,
+remote-session acceptance or complete Server 2016 qualification. The retained
+VM is not represented as a fresh clean-machine test.
+
+### Server 2016 standard-user MSI policy rejection, 22 October
+
+The same original unsigned technician 1.5.0 MSI at `e9d89ca` was tested under a
+separate owned standard account on Server 2016 Desktop Experience **14393.693**.
+A normal graphical login loaded that account's profile in active console
+session 1. An Interactive/Limited task ran the verified driver with the exact
+account SID; the public harness required `RequireStandardUser` and recorded
+`administrator=false` and `standard_user_required=true`.
+
+Initial installation returned **1625**, with the original MSI log explicitly
+reporting effective machine policy `DisableMsi=1` and installation forbidden by
+system policy. Read-only inspection found no explicit machine `DisableMSI`
+registry value; absence did not mean installation was allowed. The technician
+installation directory remained absent. The attempt stopped at installation:
+upgrade, repair and uninstall were not run, and no pass is claimed for them.
+Seven original wrapper, driver, phase and MSI records were transferred and
+hash-verified. This does not invalidate the separate administrator-profile
+upgrade result or establish that every Server 2016 deployment has this policy.
+Microsoft documents [DisableMSI's managed-application restriction](https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi).
+
+The initial Password/Limited task never executed: original Security 4625 events
+reported status `0xc000015b`, logon type 4 (batch logon denied), and its task
+retained never-run result 267011 with no wrapper/MSI output. That setup failure
+was retained separately. No batch-logon right or Windows Installer policy was
+changed; the later independent Interactive/Limited task produced the actual MSI
+rejection above. Only the independent lab safety marker received a read grant
+and the account's own fixture directory received Modify access. Marker bytes
+and owner were preserved; customer product-state permissions were untouched,
+and the standard-user driver did not access customer private ProgramData.
+
+Standard-user Server 2016 MSI/upgrade acceptance remains unproven. An approved
+administrator/IT deployment is required where Windows policy rejects unmanaged
+per-user MSI packages; the software must report that rejection and cannot
+silently elevate or weaken policy. Other Windows standard-user, interactive
+application and automatic-update requirements retain their separate gates.
+
+### Native 1.5.1 technician GUI and existing-company authorization, 22 October
+
+The verified 95-file application payload and agent from exact source
+`699c9e022ad71e4a409be52b56c9fe9697074bdf` ran under the owned standard user's
+active console session 1 on Server 2016 **14393.693 x64**. This was an explicitly
+unsigned runtime fixture with separate company state, not a company installer
+or a workaround recorded as a passing MSI test. The agent validated the existing
+lab company's HTTPS endpoint and signed profile; native UI rendered the updated
+technician display name, logo, support contact and product/license attribution
+from revision 18. The retained cached profile signature was independently
+verified after collection.
+
+A new company account with role `technician` completed actual GUI password/TOTP
+login. With no group access, its UI showed no authorized devices. A separate
+normal authenticated API session also returned an empty inventory and HTTP 403
+for a valid-proof, customer-approved grant request targeting the company's one
+approved device. A temporary group assignment made that device and its support
+button visible after refresh. An API request then returned a signed 60-second
+grant; its signature, company, technician, device, ephemeral proof-key binding
+and permissions were verified against the pinned company key and actual group
+policy. The request was never claimed and no remote session was started.
+
+Removing that temporary group access closed the unclaimed grant, cleared its
+lease, removed the device from UI/API inventory after refresh, and made another
+valid-proof request return HTTP 403. This proves server-side authorization
+alongside UI behavior; it does not test receiving-device enforcement or an
+active session's lease. The GUI signed out, cleared inventory/history, and
+closed with actual process exit 0. Its task also completed with result 0.
+Twelve original wrapper, setup, state and runtime records were transferred and
+hash-verified. The collected records contain neither the test password nor its
+TOTP secret. The temporary company account was disabled, its grants were closed,
+and the existing customer's identity, consent and three services were preserved.
+
+The old deployed application displayed an update-deferred warning in this
+fixture; no installed release was recorded and automatic updates are not
+qualified by it. The history row also incorrectly displayed `Requested` for the
+closed unclaimed grant. Current UI source now prioritizes `closed` and displays
+`Closed`; that correction requires its own rebuilt runtime verification.
+
+This evidence covers **native profile/GUI/MFA/inventory and existing-company API
+authorization** for those exact inputs. It does not establish fresh company
+deployment, standard-user MSI installation, production signatures, an approved
+software update, external/direct/relay connectivity, customer approval or
+receiving-device session behavior. Those acceptance gates remain open.
+
+The later technician-update diagnostic change at exact source
+`54931939887a0d2a376f1535082bd606254d6e9e` passed company-component push
+[39848503726](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39848503726)
+and PR [39848513299](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39848513299):
+Windows 2022 and Ubuntu component/security tests and builds, plus the Linux
+deployment job, succeeded. The optional technician MSI CI job was skipped;
+these results do not replace the separate native installer and runtime evidence.
+They do not include a rebuilt runtime test of the subsequent history-label fix.
+
+### Existing lab worker publication failure and corrected reporting, 22 October
+
+Read-only inspection of the retained Server 2016 deployment found two old build
+claims still running in the management database. The worker process had no
+active child build process; its protected log repeatedly recorded HTTP 400 after
+package signature verification. Its original signed-input ZIPs were preserved.
+An exact-hash upload reproduction received the server's JSON rejection
+`Unexpected ZIP footer`. The retained archive has a valid 11-entry ZIP32 footer.
+Installed-binary inspection found the technician-uninstall bundle helper in the
+worker but absent from the management executable. Neither old executable
+contains the newer recipe-discovery endpoint, which returned HTTP 404.
+
+This is evidence of an old mixed component deployment, not a passing installer
+publication test or a reason to relax ZIP validation. Current server/worker
+source already checks matching bundle recipes before claims. Coordinated lab
+maintenance remains pending: automatic approval review rejected preparation of
+the refreshed release-withdrawal/encrypted management-backup draft as
+`blocked by policy`; fresh human approval has been requested. That rejected
+preparation created no draft file and changed no services or releases.
+
+Current worker source now turns permanent upload-validation rejection into a
+failed completion report, preserving the original local output and publishing
+no download link. Auth/state conflicts and temporary network/server/rate-limit
+failures retain recovery. Diagnostics accept only fixed public error labels
+from a bounded response with a reading deadline. Wire regressions cover failed
+completion reporting, identical-byte transient retries, auth/conflict recovery
+and exclusion of arbitrary remote text/secrets. All four new regressions passed
+on Windows 2022 and Ubuntu at source
+`4c5accb7ae73615c799a43fa70dc2a49aeed0822` in
+[PR check 39855276940](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39855276940).
+The original two job logs were retained and their individual passing test lines
+verified. That full component/deployment check passed; the optional MSI job was
+skipped. These are HTTP/control-path regression tests, not a matched Windows
+worker/server publication test. Runtime publication and download authorization
+remain open while maintenance approval is pending.
+
+### Rebuilt native history-label regression, 23 October
+
+Native [run 39851990495](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39851990495)
+passed every job at exact source
+`3bad1697b0d744421ded6386cbcd091ea0b13e67`. Its original unsigned artifact
+`12461520673` was retained: 254,500,267 bytes, SHA-256
+`be54aa65b24e0e0ebd4a3bb3bd0cb880e2336d0acba910db9cf1a257fc386ce8`.
+Verification matched 1,157 tracked public source files, all six generated bridge
+files, and the original selected engine source/evidence. All 95 extracted
+portable payload files matched the installed-file manifest without modifying
+executable bytes. This particular source has not yet passed an independent
+native rebuild comparison; earlier source-specific comparisons do not prove it.
+
+The unchanged extracted app and agent ran with isolated technician state under
+the owned standard Windows account on the retained Server 2016 lab guest. HTTPS
+setup accepted company profile revision 18 and displayed its branding. Normal
+MFA login with the owned company **administrator** account displayed inventory
+and existing closed sessions. Those history rows now visibly say `Closed`.
+No support request was made and no account, group or permission was changed.
+Sign-out removed inventory/history and cleared password/authenticator fields;
+the process and interactive task subsequently exited with result 0. Nine
+original setup, state, fixture and runtime records were transferred with byte
+counts and SHA-256 verification; the test password and TOTP secret were absent
+from them. All three existing lab services remained running.
+
+This confirms the native history-label correction, signed-profile startup and
+MFA/sign-out for that bounded fixture. Administrator login does not replace the
+earlier technician-role authorization tests. The unpacked app displayed an
+update-deferred warning and had no installed release; neither automatic updates
+nor the Windows Installer policy diagnostic was exercised. Fresh deployment,
+MSI acceptance, receiving-device enforcement, separate-machine/public transport,
+production signing and update qualification remain open. This native source
+also predates the newer `4c5accb` worker rejection fix; that fix's component tests
+must not be attributed to these native binaries.
+
+### Windows 10 administrative technician major upgrade, 23 October
+
+The preserved standard Windows 10 Pro x64 guest, build `19045.3803`, passed a
+real bare-MSI upgrade from source `e9d89ca` version 1.5.0 to native source
+`3bad169` version 1.5.1. The latter original MSI SHA-256 is
+`185e37ff134d756c741ec81e68eb03d09a2ef230920357272481ff920f4715e9`.
+Initial install, major upgrade, missing-executable repair and uninstall all
+returned 0 without requiring reboot. Actual technician application bytes changed;
+the old ProductCode became absent, the new ProductCode became installed, and
+the technician UpgradeCode remained stable. Repair checked the new payload;
+the independent original report confirms missing-file recovery.
+
+The original administrator profile's unused-directory guard first stopped
+before installation because an earlier technician directory already existed.
+That directory and its original failure evidence were preserved. The passing
+run used a fresh owned administrator profile with a password-authenticated,
+highest-privilege task. The harness used a process-only execution-policy option;
+persistent policies were unchanged. No customer enrollment or company services
+were present in this Windows 10 fixture before or after the test. Fourteen
+original fixture, invocation, result and MSI-log records were retained and
+verified against guest byte counts and SHA-256 values. An initial collector
+field-name assertion failed after transferring those records; a separate
+metadata-only verification validated the originals without repeating any MSI.
+
+Windows activation remains status 5 with zero grace minutes; no activation
+bypass was attempted. These are functional **administrative MSI upgrade**
+results on the specified guest, not complete licensed Windows compatibility,
+standard-user installation, company-generated distribution, production signing,
+enrollment preservation or automatic/interrupted-update qualification.
+
+### Windows 10 standard-user technician major upgrade, 23 October
+
+The same original 1.5.0 `e9d89ca` and 1.5.1 `3bad169` technician MSIs subsequently
+passed install, real major upgrade, missing-file repair and uninstall under a
+fresh owned **standard** account on Windows 10 Pro `19045.3803`. Normal GUI
+sign-in initialized the account; the test used an interactive, limited task.
+The driver rejected administrator tokens, and the install/repair/uninstall
+reports independently recorded `administrator: false` and
+`standard_user_required: true`. All four operations returned 0. The upgrade
+removed old product registration and installed the new product with the stable
+technician UpgradeCode. Eighteen original fixture, task, marker, invocation,
+result and MSI-log records were retained and verified by byte counts and
+SHA-256 hashes.
+
+The first limited task failed before any MSI because the independent lab safety
+marker granted read access only to the older lab account. Its task record was
+preserved and disabled after confirming no instances, upgrade-start record or
+MSI result directory. Read-only access to that **lab marker** was added for the
+new account, preserving its bytes and owner; a separate guarded limited task
+then completed the actual tests. No customer product directory access probe or
+customer ACL change was performed. Persistent script policies and the lab
+marker remained unchanged during the passing test. A historical helper's
+plaintext disposable password was also rotated; its replacement stays in
+protected local storage and is not part of published evidence.
+
+This extends the exact-source functional MSI evidence to a standard Windows 10
+user. It does not qualify company bootstrap/enrollment, signed distribution,
+automatic updates, interruption/reboot recovery or remote sessions. The guest
+remains unactivated with zero grace minutes; licensed compatibility qualification
+and the remaining Windows matrix are still open.
+
+### Windows 10 customer MSI repair with a real reboot, 23 October
+
+The retained Windows 10 Pro `19045.3803` guest passed bare customer MSI
+installation at exact native source `3bad169`; package SHA-256
+`73d58b30997618347d19c560541909fbf0af24f00f9e72499e8382ac95d65b49`.
+All 96 MSI-packaged files and the agent matched their pinned hashes, and the
+customer service ran as LocalSystem from the expected executable path.
+
+Repair restored a deliberately damaged packaged license, passed its payload
+checks and returned **3010**, requiring a reboot. The original no-reboot driver
+therefore stopped and retained its failed overall result. Its original MSI log
+records deferred cached-installer file deletion and a requested restart. The
+test did not reinterpret that attempt as a zero-reboot pass or repeat the MSI.
+After retaining and hash-verifying its evidence and confirming no active MSI
+client, the disposable guest performed a normal requested restart. A changed
+operating-system boot timestamp proved the reboot. All 96 files and the agent
+still matched; the customer service automatically returned to Running with the
+expected LocalSystem account, automatic startup and exact executable path.
+
+A separate guarded continuation then uninstalled the same original package with
+exit 0 and no further reboot. The public harness verified removal of packaged
+files, agent, product registration and service; an independent final observation
+also found the service absent. Twenty-one original pre/post-reboot fixture,
+invocation, result and MSI-log records were retained with byte counts and
+SHA-256 verification. Persistent script policies were unchanged.
+
+This proves **bare customer MSI install, repair requiring reboot, post-reboot
+payload/service recovery and uninstall** in the specified lab. It does not prove
+company enrollment, consent/identity preservation, graphical support sessions,
+signed distribution or automatic update recovery. The unactivated Windows
+limitation and the other release gates remain open.
+
+### Latest worker-fix native reproducibility, 23 October
+
+Both native builds at exact source
+`4c5accb7ae73615c799a43fa70dc2a49aeed0822` passed every job:
+[first 39867952641](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39867952641)
+and [independent 39867956814](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39867956814).
+They include the worker permanent-upload-rejection fix as well as the earlier
+technician history/update-diagnostic changes. The pinned
+[comparison 39876756059](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39876756059)
+passed and its original [report](../deployment/windows/native-4c5accb-rebuild-comparison.json)
+was retained unchanged. All eight shipping outputs are byte-identical across
+the independent builds; no shipping-file normalization or execution occurred.
+Both public source proofs verified 1,157 tracked files and six generated bridge
+files at the exact source timestamp.
+
+Only the completed independent build's full original archive was downloaded
+locally: artifact `12467476411`, 254,512,609 bytes, SHA-256
+`58e48e54d33a4ebfe57e37d336c53bb6e8c993773d020fd23449a303855c3dd0`.
+The local collector separately verified its complete public source, bridge and
+original engine evidence. Its eight shipping file hashes/lengths match the
+comparison report's second build. All 95 extracted portable files match their
+original installed manifest. The original comparison-report archive was also
+retained: artifact `12469100351`, 17,454 bytes, SHA-256
+`730b91a56cd0c6999c1ab51ea077a1f7b749103898c958fdf8e37ba9a43b70d6`.
+
+This extends exact-source **unsigned build reproducibility** to the latest
+worker fix. It does not deploy that worker into the older mixed lab deployment,
+qualify company-generated publication/download permissions, extend earlier
+runtime/MSI results automatically to new binaries, or approve production signing
+and rollout. Those acceptance gates remain open.
+
+### Latest native MSIs on retained Server 2022, 23 October
+
+Original `4c5accb` native MSIs were tested on the retained Windows Server 2022
+Standard Evaluation Desktop Experience x64 guest, `20348.587`. A fresh owned
+administrator profile completed technician 1.5.0 `e9d89ca` install, real upgrade
+to 1.5.1 `4c5accb`, missing-executable repair and uninstall. All four returned 0.
+The new original technician MSI SHA-256 is
+`fb13e6f43656164b7d6d4f18601edb186e2f7d511791383e2a62fbd7e158acf8`.
+The old product registration was removed, the new registration installed, and
+the UpgradeCode remained stable. Fourteen original fixture/task/invocation,
+result and MSI-log/payload records were retained and verified by byte counts
+and SHA-256 values. The initial broad evidence transfer timed out; metadata-first
+SFTP collected the originals without repeating any MSI operation.
+
+The original customer MSI SHA-256 is
+`b7f98073f17e32d206e6026392f1f47f540adfc60a6dae5a5f03b75a634bdc5b`.
+It separately passed administrative install, damaged-license repair and uninstall,
+all with exit 0 and no reboot requirement. All 96 packaged files and the agent
+matched their original manifests; the harness checked the running service's
+exact executable path and LocalSystem ownership after install/repair. Uninstall
+removed packaged files, agent, registration and service; an independent final
+observation also confirmed the service absent. Twelve original fixture,
+invocation, result and MSI-log records were transferred and hash-verified.
+
+No customer enrollment or company services existed before the technician test.
+The test preserved that absence; it is not enrolled identity/consent evidence.
+Persistent script policies were unchanged. These are exact-source **bare MSI**
+results in retained lab installations and an owned administrator profile, not
+fresh company setup, standard-user qualification, signing, company-generated
+downloads, automatic updates or support-session acceptance. Server 2022's prior
+standard-user policy rejection remains separately documented.
+
+### Latest native MSIs on retained Server 2025, 23 October
+
+The original `4c5accb` technician and customer MSIs also passed on Windows Server
+2025 Standard Evaluation Desktop Experience x64, `26100.32230`, with the same
+package hashes recorded for Server 2022. A fresh owned administrator profile
+completed technician 1.5.0 `e9d89ca` install, real upgrade to 1.5.1 `4c5accb`,
+missing-executable repair and uninstall. All four returned 0; old registration
+was removed, new registration installed, and the UpgradeCode remained stable.
+Fourteen original fixture/task/invocation, result and MSI-log/payload records
+were retained and verified by byte counts and SHA-256 values.
+
+Customer administrative install, damaged-license repair and uninstall each
+returned 0 without requiring reboot. The harness verified all 96 packaged files,
+the agent and the service's exact path, Running state and LocalSystem account.
+Uninstall removed packaged files, agent, registration and service; a separate
+final observation confirmed the service absent. Twelve original fixture,
+invocation, result and MSI-log records were transferred and hash-verified.
+A local staging template initially pointed to the technician fixture; the
+existing-directory guard stopped it before file transfer or MSI execution. A
+separate corrected customer path was used for the actual tests.
+
+The fixture contained no customer enrollment or company services before these
+tests. Persistent script policies were unchanged; no company-server setup,
+configuration, group or authorization change was made. These are **bare MSI
+lifecycle/major-upgrade** results, not standard-user policy qualification,
+enrolled-device identity preservation, signed company distribution, automatic
+updates or remote-session acceptance. Activation was not collected in this
+bounded run. The prior Server 2025 standard-user policy rejection remains open
+as separately recorded; this administrator result does not supersede it.
+
+### Latest Server 2019 technician upgrade and unsafe-state rejection, 23 October
+
+On retained Server 2019 Standard Evaluation Desktop Experience x64
+`17763.3650`, a fresh owned administrator profile passed technician 1.5.0
+`e9d89ca` install, real upgrade to original 1.5.1 `4c5accb`, missing-executable
+repair and uninstall. All four returned 0; old registration was removed and the
+UpgradeCode remained stable. Fifteen original task, fixture, invocation,
+result, state and MSI-log/payload records were retained and hash-verified.
+Before/after customer-folder file hashes, owners and DACLs independently match;
+the pre-existing unsafe customer fixture was preserved. This is not enrolled
+identity/consent evidence or a fresh company-server setup test.
+
+The same original `4c5accb` customer MSI recorded for Server 2022/2025 was then
+run as Administrator against that existing inherited broadly writable state.
+It returned 1603, and rollback left no product registration, payload or service.
+The original cancellation marker/helper bytes and all captured owners/DACLs
+remained unchanged. Ten original records, including the raw MSI log, before/after
+state and the initially failed test assertion, were transferred and matched
+against independent guest hashes. Raw MSI log SHA-256:
+`2c026c4c8a66c5612bcbf0117f755a091a21b917978448d81230bb6961c1351a`.
+
+The initial assertion incorrectly treated `Action start/ended` scheduling
+entries as actual deferred execution. Independent inspection of the retained
+original log instead finds `CustomActionSchedule` for `PrepareCustomerState`
+with deferred action type 3074, followed by its **actual error code 1** and
+InstallFinalize failure. No actual FileCopy, FileMove, folder creation or service
+installation operation occurred. Scheduling an InstallFiles action therefore
+did not mean payload was copied. The MSI's embedded preparation agent was
+statically extracted and matched original native agent SHA-256
+`030c230b9ed43eec3eb4b4b857dd77f626b0ffe3ccf81835f63a4bc932b2606a`.
+Four local verifier controls using modified log copies reject missing failure,
+injected actual file copy, truncated deferred execution and an incorrect final
+return code. No original log or shipping bytes were altered and no MSI was rerun
+to obtain this corrected analysis; the initial failed assertion remains intact.
+
+This proves **compiled-MSI rejection of the original unsafe state before payload
+copy**, not positive customer installation on a clean current-source machine.
+No replacement customer folder, standard-account file-access probe, ACL change
+or company-server startup was performed. Positive clean customer lifecycle,
+enrollment, signing, automatic updates and remote sessions remain open.
+
+After the Server 2019 results and original evidence were collected, the retained
+guest stopped responding to SSH; the existing viewer remained black after wake
+and secure-attention input. QEMU still reported Running. The attempted normal
+guest shutdown connection failed before authentication, and a normal ACPI
+power-off request was sent at 01:20 UTC on 23 October. Power-off/recovery is not
+yet verified at that point; no force-stop, reset, disk replacement or fixture
+cleanup had been performed. After a 15-minute wait the guest was still
+unresponsive. The exact disposable QEMU instance was then closed through its
+monitor `quit` command after confirming its existing clean OS snapshot and all
+collected test evidence. This was an **unclean guest power-off**, not a successful
+Windows shutdown. Its original process completed with exit 0; read-only qcow2
+checks reported zero container errors and the clean snapshot remained present.
+
+One controlled restart subsequently restored the Windows lock screen and SSH
+on the same `17763.3650` guest. Independent checks found the original customer
+fixture's file bytes, owners and DACLs unchanged, the rejected product/services
+still absent, and a clear Windows NTFS dirty flag. This proves bounded **basic
+lab guest boot and fixture recovery** after that incident. The cause remains
+unproven; it does not qualify long-term guest stability, software update recovery,
+company backup/restore or complete Server 2019 acceptance. No original disk or
+snapshot was deleted or replaced.
+
+On a subsequent observation at approximately 02:10 UTC, SSH again timed out
+during banner exchange. The existing console still showed the lock screen at
+03:54 local time and did not advance after one viewer-provided guest secure
+attention action. The attempted normal shutdown after the earlier recovery had
+also failed before SSH authentication. The guest process remained present; no
+second forced power-off or restart was performed in this observation. The
+earlier bounded recovery result therefore does not establish sustained guest
+stability. Original disks, snapshots and collected installer evidence remain
+preserved.
+
+### Approved Server 2016 management maintenance, 23 October
+
+Following explicit human approval, the existing disposable Server 2016 company
+VM completed guarded management-only maintenance. A fresh MFA session and
+preflight found no active claimed support sessions. The installer worker was
+stopped, and only `8-Customer-test` and `8-Technician-test` were withdrawn using
+the normal `DELETE /api/v1/releases/{id}/approve` endpoint. The earlier review
+draft's POST withdrawal URL was incorrect and was not executed. Withdrawal
+closed the two obsolete running jobs through the server's existing behavior;
+no job status was edited manually. All other release approval flags and release
+metadata were verified unchanged.
+
+The previously retained, locally trusted lab-signed management CLI, SHA-256
+`cf7b5077a633f8ff9ad830d2e2a9847d16b35494bbeaf061645abbe8c37c07d4`,
+created a 125,096-byte encrypted management-only backup. Archive SHA-256:
+`00a0883277079052c2875aafd5167a6abf259267ed9d33d184823cde233e389c`.
+A newly generated random passphrase was stored in a separate protected guest
+directory, outside the archive directory. Both directories allow only SYSTEM
+and Administrators. Six original guest records were collected and independently
+matched against guest byte counts and hashes.
+
+Independent in-memory validation authenticated AES-GCM, rejected a changed
+ciphertext and an incorrect passphrase, checked ZIP CRCs, and matched backed-up
+management key/setup/HTTPS-recipe file hashes against their live counterparts.
+The database snapshot contained the expected withdrawals and closed jobs.
+SQLite `quick_check` returned `ok`. The first verifier could not deserialize a
+WAL-mode database into memory; its failed version was retained. The continuation
+adapted only the journal-mode header bytes in a disposable in-memory database
+copy. The original encrypted archive and collected records were unchanged;
+decrypted contents and passphrase were not saved on the host.
+
+The worker was restored in a `finally` block and independently observed Running.
+All three original lab services were Running; management and customer service
+process IDs were unchanged. Customer device identity, token hash, unattended
+consent/revision and accepted release sequence were unchanged. No server/worker
+upgrade, restore, transport/TLS-key export or live network change was performed.
+This closes the approved maintenance prerequisite, not full Windows deployment
+backup/restore, migration recovery or coordinated upgrade acceptance.
+
+### Coordinated Server 2016 management/worker upgrade, 23 October
+
+The same disposable deployment subsequently upgraded both management and worker
+to exact reproduced source `4c5accb7ae73615c799a43fa70dc2a49aeed0822`.
+Original unsigned input SHA-256 values:
+
+| Input | SHA-256 |
+| --- | --- |
+| Management | `43a0002c9c17372bf8958eb91ae27092b71434adc9441d9da4e6a19d30618bc3` |
+| Worker | `9624a05cae857d48d02270a7128992faa3522903801a7fce3cbbb32996f3ef12` |
+
+Both came from the previously verified independent native build `39867956814`;
+the earlier public comparison established all eight outputs identical to the
+first build. The existing private lab publisher signed these inputs without
+exporting its private key. The first signing attempt failed because the guest
+could not reach DigiCert's timestamp endpoint; the failed attempt and logs were
+preserved. Retrying with Sectigo's documented RFC3161 endpoint succeeded, with
+the unchanged signer requiring `signtool verify /pa /all /tw` and valid
+Authenticode. See [Sectigo timestamp documentation](https://www.sectigo.com/resource-library/time-stamping-server).
+These remain **private lab signatures**, not approved project production signing.
+Installed signed management SHA-256 is
+`8808af5c56b4e0c90b63a934f69c4f83f9816a4294b4a76f4a847848e96e08d0`;
+signed worker SHA-256 is
+`59e3d4354af0b529a10e061ebc39a0573226e44ea06ce356d44c491bd5742664`.
+
+Independent inspection of the encrypted pre-upgrade snapshot found schema
+version 2, matching the target, so no schema migration was needed. The guarded
+replacement retained both old binaries and the worker receipt, stopped the
+worker before management, and checked verified HTTPS health before starting the
+new worker. The first attempt falsely rejected a renewed signed profile because
+the harness compared the entire envelope: the profile endpoint refreshes issue
+and expiry timestamps on every request. That failure exercised binary rollback;
+both original hashes and all Running service states were independently observed
+after restoration. It was a harness assertion failure, not evidence of changed
+company settings or a shipping runtime fix.
+
+A separate retained second attempt compared all configuration fields apart from
+the validated renewable timestamps and completed at 09:47 UTC. The authenticated
+worker recipe endpoint returned
+`6c5691a926cdea242020ca10df46ba2ee4d4e3456a93fa4e14e64cb8831aadf0`,
+matching an independent calculation from the pinned source's seven bundled text
+files. Fourteen original signing, journal, script, result and profile records
+were collected and matched against independent guest hashes. Both original
+before/after profile signatures verified against the worker's existing pinned
+Ed25519 public key; their complete configuration matched, revision remained 18,
+and updates remained paused. The initial collector omitted explicit TLS 1.2
+selection for its observation; its failed version was preserved, and a corrected
+observation verified the already-collected originals without repeating transfer
+or the upgrade.
+
+All three original services were independently observed Running on the installed
+hashes, with no active builds. Customer identity/token hash, consent/revision and
+accepted release sequence were preserved, and its service process was unchanged.
+Release approvals, service environments, Caddy configuration and transport trust
+keys were unchanged. The transport/HTTPS component binaries were not replaced;
+management's normal component restart used the existing configuration. No host
+services, firewall/DNS settings, peer bind change or public endpoint was changed.
+
+This closes the **paired lab binary upgrade and recipe endpoint** prerequisite.
+It does not yet prove new company-generated bundles upload/download correctly,
+installation of those bundles, automated endpoint updates, full deployment
+restore, schema migration rollback or public direct/relay operation.
+
+### Current-source company bundle jobs, 23 October: completion unconfirmed
+
+The original independently reproduced `4c5accb` customer and technician MSIs
+and configuration agent were staged and signed using the existing private lab
+publisher and the same verified timestamp policy. Signing the outer MSIs did not
+alter their embedded payloads or actual MSI ProductVersion `1.5.1`. Signed input
+SHA-256 values:
+
+| Input | SHA-256 |
+| --- | --- |
+| Customer MSI | `e7387695be27942849fe345308dcf32260b439c79a12e00205f4e5173bcb0545` |
+| Technician MSI | `1b22ef4726db3cd0d8aad084afd564976c828565804cf49118d4a196086733bd` |
+| Configuration agent | `cfab98c90b1ae7ac5ba1ee2111d4381ce54de48fda8204806556d3d92aa973b7` |
+
+The existing owned lab release key signed exact metadata for sequence 9, test
+channel, version `1.5.1`, pinned public source `4c5accb`, and the original payload
+manifests (96 customer files and one packed technician executable). No private
+release key was transferred to the worker. These test declarations are scoped
+to Server 2016 for this run and do not qualify that OS or other Windows versions.
+Updates remained paused at company revision 18.
+
+Normal server import succeeded for both new releases. Before approval, build
+requests returned 409 for each; after approval, exactly one job per edition was
+queued: customer `23755146-ed3c-4577-8c80-e6efb16d1395`, technician
+`7b271526-963b-4f96-ac43-0ba66c550142`. The obsolete sequence-8 releases remained
+withdrawn. No installer was executed or endpoint update enabled.
+
+The first status observation subsequently exceeded its 240-second SSH observer
+timeout, and a separate small SSH probe timed out during banner exchange. The
+existing VM process remained present and its read-only monitor reported Running.
+The console woke to the desktop; a subsequent Task Manager shortcut had not
+produced its window by the next observation. This does not establish the cause
+or terminal state of either build. No duplicate job, service restart, VM reset,
+forced power-off or disk replacement was performed during these observations.
+Original jobs and retained outputs must be inspected after the wait before any
+recovery decision. Successful bundle upload, public customer download, protected
+technician download and installation of either generated bundle remain unproven.
+
+### Bundle-test interruption and same-disk recovery, 23 October
+
+After the explicit fifteen-minute observation wait, SSH still failed and the
+company guest display did not wake. A normal ACPI shutdown request at 10:20 UTC
+did not stop the existing VM during its grace period. Monitor `quit` was then
+requested, followed by termination of that exact owned emulator process when it
+also failed to exit. This was an **unclean guest power-off**. The original disk
+was retained; offline qcow2 checking reported zero container errors. No build
+record was edited, duplicate job submitted, database restored or disk replaced.
+
+The same company disk booted again at 10:42 UTC with a private lab allocation
+of 3 GiB RAM and two virtual processors, compared with the former 2 GiB/one
+processor. The old private settings and launcher were preserved. SSH returned,
+and an independent administrative check at 10:58 UTC matched device ID, token
+hash, unattended consent/revision and accepted release sequence against the
+pre-maintenance record. This proves bounded identity/consent persistence through
+this incident, not complete service recovery or an interrupted endpoint update.
+
+The company service was observed Stopped with Win32 exit code 1. The worker log
+repeatedly reported refusal at the HTTPS recipe endpoint. Original Caddy,
+rendezvous and relay logs were collected through SFTP. The 1,049,730-byte Caddy
+log, SHA-256
+`0f4f21d782fb2e55a64e63df9615d20febdfe03ba28dcf784597b0ac88b95a65`,
+contains access violations and Go runtime fatal faults in the pinned Caddy
+2.10.2 component, including TLS/runtime stack frames. It also contains older
+incidents; its contents do not by themselves establish the cause of the latest
+guest-wide communication interruption. A subsequent service-start SSH connection
+failed during banner exchange, before a verified service-start action. Job
+terminal states and generated downloads must still be observed through a healthy
+server. Increasing guest capacity has not established sustained stability.
+
+The separately retained, already unresponsive Server 2019 test guest was also
+powered off uncleanly after normal shutdown and emulator-exit attempts failed.
+Its original disk, clean snapshot and collected installer evidence were retained;
+offline qcow2 checking reported zero container errors. It was not restarted or
+replaced with another company deployment.
+
+Independent endpoint work prepared private latest-source Windows 11 fixtures for
+the actual technician 1.5.0-to-1.5.1 upgrade and customer MSI lifecycle; neither
+was executed at this point. A separate fresh Server 2016 endpoint-only seed was
+prepared with distinct lab access keys. Its KVM setup stopped at environment
+preflights before any Windows installation: the minimal owned Linux runtime
+lacked optional helper commands. A shell-only continuation preserves the partial
+fixture and equivalent kernel read-only-mount checks. This preparation is not
+Windows installation or compatibility evidence.
+
+A supported storage move of the stopped, owned endpoint-lab WSL distribution
+from D: to a protected C: directory is being verified separately. All emulators
+inside that distribution were checked absent first; other distributions and the
+default registration were not selected for modification. VM resume is gated on
+the completed move, unchanged registration and matching entire-VHD hashes. The
+prepared Windows 11 resume keeps its original 4 GiB guest allocation, 6 GiB host
+memory guard and 100 GiB reserve on the actual virtual-disk volume, and requires
+its existing TPM state file. A company-VM migration remains pending fresh human
+approval because the earlier automatic review blocked company backup/restore/
+migration work. No company disk was copied into a new hypervisor environment.
+
+### Approved cold migration preflight, 23 October
+
+The human subsequently explicitly approved migrating the existing disposable
+company VM to KVM, retaining the original disk and backup, preserving its company
+configuration and HTTPS binding, and never running both copies together. This
+approval does not establish that the migration succeeded.
+
+The original company emulator remained live after more than 30 minutes following
+the recorded normal shutdown request. A monitor exit request also failed to
+terminate it. After a further grace period, only that verified emulator process
+was stopped. Its original qcow2 disk remains on D:; a subsequent offline image
+check reported no errors. This was an unclean shutdown, not proof of guest
+filesystem or service health. The company disk has not yet been copied or booted
+under KVM.
+
+The separate endpoint-lab WSL storage move's command observer timed out. Windows
+now registers the original distribution identity at its C: destination, and the
+original VHD path is absent. The destination has the expected 25,041,043,456-byte
+length, but its full-file SHA-256 differs from the pre-move value. The VHDX image
+check reported no errors and its dirty flag was false; neither result explains
+the hash difference or proves the retained guest contents unchanged. All guests
+in that distribution remain stopped, its resume verification gate remains
+unsatisfied, and read-only offline investigation is in progress. No move was
+repeated, no registration was manually rewritten, and no hash guard was relaxed.
+The unrelated working host services remain untouched.
+
+Offline parsing of the relocated endpoint VHDX found ext4 state `1` (clean) and
+readable retained Windows 11 disk, firmware-variable and TPM-state files. Their
+current hashes were retained privately. No corresponding pre-move hashes of
+those individual files were available to prove equality, so the whole-VHD
+verification gate remains unsatisfied and that distribution was not booted.
+
+The approved company migration is proceeding separately in a newly imported,
+minimal owned Linux runtime on C:, using the already verified Alpine rootfs and
+pinned QEMU 11.0.3 packages. Existing distribution identities and the default
+registration were verified unchanged. This is storage for the existing company
+disk, not initialization of another company backend. The first streaming copy
+failed with a host `MemoryError`; its partial disk and diagnostics were retained,
+and it was never booted. A subsequent copy uses direct writes to bound Linux file
+cache growth. Native company launch scripts are guarded, and a Windows reader
+handle denies writable access to the original disk while copying. Independent
+source/target hash equality and an offline qcow2 check are required before the
+copy can be committed or booted. Copy completion, KVM boot, service recovery and
+post-migration identity checks remain unverified at this entry.
+
+### Company disk migration copy verified, 23 October
+
+The live pipe-based direct copy was deliberately stopped after its measured
+throughput proved unsuitable; its incomplete disk remains retained. A subsequent
+mount preflight correctly refused to copy when drvfs ignored `ro`. The continuation
+used a separate bind mount, verified the kernel mount's read-only flag, held the
+original disk against Windows writers, and retained all previous partial copies.
+
+The complete 29,104,275,456-byte company disk was copied into the separate protected
+Linux runtime on C:. Independent host-source and Linux-target SHA-256 values both
+equal `fbe14b2cf543e2c341bac8b87d1bd5cfc5c76f7dde265a7e886716b172381da2`.
+The copied qcow2 image check reported no errors before its final name was committed.
+The original disk and encrypted backup remain retained. The original native boot
+helpers have a migration guard; the KVM boot wrapper also holds the original disk
+against writable access for its entire lifetime.
+
+At 13:26 UTC, the verified copy was launched using pinned QEMU 11.0.3 under KVM,
+with 3 GiB memory, two virtual processors, the original default e1000 MAC, installed
+disk boot, and the existing loopback forwards. No company setup, key replacement,
+restore or HTTPS-binding change was performed. Successful guest boot, service
+health, preservation of live company state and the two original build-job results
+still require post-boot observation; a successful disk copy alone proves none of
+those acceptance requirements. The separate endpoint VHDX hash discrepancy remains
+unresolved and that distribution remains unused.
+
+### Migrated company API and original installer bundles, 23 October
+
+The same company guest responded over its existing pinned SSH access after KVM
+boot. At 13:28 UTC, customer, management and worker services were Running. Checks
+against the original pre-maintenance invariant preserved the customer device ID,
+token hash, unattended-consent value/revision and accepted release sequence. The
+Caddyfile retained its original loopback bind; its live SHA-256 was
+`72afc6ad51fffacc41e436de01bb819696c4870129725fa7850631b7b10f748a`.
+No company restore, new setup, transport-key replacement or endpoint-binding
+change was performed.
+
+A fresh login using the existing local administrator and TOTP created a session
+at 13:28:58 UTC. A subsequent bounded API-only observation at 13:33:55 UTC returned
+health `ok`, revision 18 with updates paused, all three services Running, and both
+original job IDs in `completed` state. No replacement jobs were queued.
+
+At 13:34 UTC, real HTTPS downloads verified:
+
+| Edition | Anonymous request | Authenticated download | Bytes | SHA-256 |
+| --- | --- | --- | --- | --- |
+| Customer | 200, downloaded | Not required | 32,481,317 | `d03f13ac895f3e1bb424b021628c31cb68357c34010199572887b6d777b73568` |
+| Technician | 401, denied | 200, downloaded | 30,276,919 | `c43f529426b7a1829d1a4bbe06ecd67b86851d3d70b299c96ce0ede09f1fd6c6` |
+
+Both downloaded hashes matched the corresponding completed job result. Customer
+identity, consent, release sequence and service process remained unchanged during
+these checks; revision 18 and paused updates were rechecked afterward. Six original
+guest records, including both ZIPs, were collected over pinned SFTP, with the ZIP
+sizes and hashes verified again on the host.
+
+Independent host verification of both original ZIPs established exactly 12 unique
+flat entries, valid CRCs, no directory or symlink entries, and seven bundled
+scripts/license texts byte-identical to normalized pinned source `4c5accb`.
+Bootstrap had exactly six public fields and matched the existing company and
+release trust pins. Both signed envelopes verified against those pre-existing
+pins; changing signed payload bytes failed verification. Profile revision 18,
+paused updates and valid lifetimes were checked. The release envelope matched the
+original imported envelope, version 1.5.1, sequence 9, test channel and Server 2016
+scope. MSI and agent hashes matched that signed metadata. The customer manifest
+contained 96 installed-file entries; technician contained one. The initial host
+verifier incorrectly assumed the import request itself was an envelope; its
+failure was retained, and the corrected check compares its actual `envelope`
+member. No package was rebuilt or changed to satisfy that check.
+
+The diagnostic helpers also exposed an observation problem: Windows PowerShell
+serialized filesystem metadata attached to log lines into a very large JSON
+response. A later compact observer encountered a live-log sharing violation. Both
+failed observations were retained. The successful API-only observer omits log
+objects and limits output size. These helper failures do not prove that the
+earlier Caddy faults or guest freezes share the same cause.
+
+These are company-lab-signed packages, not trusted production project releases.
+The generated bundles have not yet been installed on a fresh endpoint or a new
+technician profile. Internet reachability, separate-machine sessions, automatic
+rollout and the remaining Windows compatibility gates are still unproven.
+
+### Generated technician bundle: installed-signature rejection, 23 October
+
+The original technician ZIP was used unchanged in a newly created owned
+administrator profile on the existing Server 2016 guest. Its first scheduled
+attempt reached its time limit without a result. An earlier diagnostic SSH
+timeout had left the exact read-only MFA observer running inside the guest,
+expanding filesystem log metadata during JSON serialization. The orphan consumed
+over 2 GiB and approximately 579 CPU seconds. Its executable, PID and encoded
+command SHA-256 were checked against the retained helper before stopping only
+that observer. No product service was targeted. This establishes a diagnostic
+resource problem; it does not resolve the earlier Caddy access violations.
+
+Inspection retained the prepared technician state at profile revision 18 and
+release sequence zero. A guarded continuation ran the original bundle setup.
+It verified the installer, prepared the durable setup marker, installed the MSI
+files and copied the signed agent, then failed final installed-publisher
+verification. The MSI and agent both verified as trusted in the original and new
+profiles; Microsoft SignTool and the agent's separate `verify-package` command
+also passed. The failure was therefore not an MSI trust rejection: the installed
+packed executable still had its original unsigned source hash
+`cede4bad34a29a78a70d627b751e949b51db02cb95b324aaffa1173f2499fa0a`
+and Authenticode status `NotSigned`. The installed agent had the expected signed
+hash and status `Valid`. The pending-install marker remained and sequence zero
+was not advanced. A later guarded retry refused the changed, pending installation
+state before attempting another install. No marker was deleted and no signature
+requirement was bypassed.
+
+This exposed a lab-input preparation error: signing the original unsigned CI MSI
+wrapper did not sign its embedded application. Both existing MSI builders require
+signed payloads by default; the CI `UnsignedTest` artifacts remain unsuitable for
+a complete signed release. Seventeen original scripts, result records and logs
+were collected over pinned SFTP and independently hash-checked. The account
+password was excluded from collection. The original customer identity/consent,
+its service and the company/worker services still passed their separate checks.
+
+Corrective staging signed a separate copy of the pinned technician executable
+using the existing non-exportable company lab key and RFC3161 timestamp
+verification. Its signed SHA-256 is
+`12ce1f1cef84eb3c4c121b3b3922faf13fa6cf3aef4573d5f0d841daf67204e5`;
+the original failed-install file was unchanged. The planned MSI retains software
+version 1.5.1 and its existing stable product identity. Seventy-nine build inputs
+from exact source `4c5accb` and the pinned WiX 5.0.2 supplier MSI were transferred
+and hash-verified. Build preflight stopped before executing WiX because this VM
+has .NET Framework release 394802 (4.6.2), below WiX's 4.7.2 requirement. Microsoft's
+[.NET Framework 4.8 offline installer](https://dotnet.microsoft.com/en-us/download/dotnet-framework/thank-you/net48-offline-installer)
+is being prepared for this lab build prerequisite; installation and a corrected
+MSI build have not yet been verified. No signing key was exported and no
+production publication is approved.
+
+### Correctly signed technician bundle and explicit setup recovery, 23 October
+
+Microsoft's official .NET Framework 4.8 offline installer was downloaded once;
+its 121,346,568 bytes had SHA-256
+`0a3a390c47e639d0f7fc65b21195fee6b7f65b066f80f70c60fab191d14b7e40`.
+Its Microsoft Corporation Authenticode signature was verified on the host and
+again after transfer to the owned guest. It was not executed on the host. Guest
+preflight excluded active support sessions and worker jobs. The installer returned
+3010 and the old runtime registry value remained until the required normal guest
+reboot. Post-reboot observation verified .NET release 528049, all three Swan
+services Running, unchanged HTTPS configuration, and preserved original customer
+identity, consent and accepted release sequence. The pre-reboot result was retained
+rather than rewritten as a completed runtime verification.
+
+The pinned technician builder then ran with its default signed-input checks,
+without `UnsignedTest`, on exact source `4c5accb`, WiX 5.0.2 and release epoch
+1792703512. Both executable and agent were already signed by the same lab
+publisher. Prepared unsigned MSI SHA-256 was
+`208401a37ca44af99d4c1e4c50f35b397dc07bbcfe9b78939796d44acad446d4`.
+After signing and timestamp verification, MSI SHA-256 was
+`b777a37508aa4aab91c851274f645df9bd6b22cc997696090ebfd2f62b382e3b`.
+Software version remained 1.5.1, ProductCode remained
+`{D32FA420-4F84-50A6-BAB2-CBFDA73F87C9}`, and UpgradeCode remained
+`{A4374699-436F-4917-9A4E-223F62A9E634}`. No fake software-version increase or
+company-dependent product identity was introduced.
+
+A separately signed test release, sequence 10, referenced that MSI and its signed
+installed executable. The server rejected an unapproved build with 409, then
+approval and one build request created job
+`1a744e32-8439-45b1-a8f1-0e268efca717`. It completed normally. Anonymous technician
+download returned 401; authenticated download returned 200. The 30,296,131-byte ZIP
+had SHA-256 `97e397701511465e80c92386c91ee97c80e4115b83aa6ac5d11b069a8c518896`,
+matching the job result. Independent host inspection verified the 12-entry layout,
+CRCs, seven exact pinned-source texts, six public bootstrap fields, original trust
+pins, signed profile/release envelopes and artifact hashes. Profile revision 18
+and paused updates remained unchanged.
+
+At 14:50 UTC, the existing owned administrator profile invoked the original
+bundle's `Install-Company.ps1` with explicit `ReplaceFailedSetup`. Its preflight
+required the exact pending sequence-9 setup, zero recorded release sequence and
+existing MSI registration. The normal program archived that original marker
+unchanged, performed the same-version MSI repair with signed payloads, verified
+installed files and publishers, retained the signed installer cache, wrote the
+exact signed sequence-10 release envelope and removed the active setup marker.
+The installed agent's separate `verify-installed` command returned zero. MSI
+registration and the user shortcut were present. Twelve original records and
+installed/cache artifacts were collected over pinned SFTP and hash-checked;
+independent verification matched the exact bundle/cache/agent bytes, executable
+hash, both signed state envelopes and the byte-identical archived sequence-9
+envelope. An initial collection-query syntax error was retained and corrected;
+neither the installation nor its result was rerun for collection.
+
+The original customer identity, consent, service and company/worker services were
+rechecked afterward. This result proves recovery of this failed setup in an
+administrator profile with the lab publisher explicitly trusted. It does not prove
+a fresh-machine or standard-user installation, graphical technician login/session,
+customer enrollment, automatic update rollout, public reachability or production
+signing. A corrected signed customer package and the other release gates remain
+outstanding.
+
+### Signed customer bundle and failed downgrade attempt, 23 October
+
+The 95 unsigned customer payload files were verified against the independently
+reproduced `4c5accb` artifacts. The application was signed separately using the
+existing non-exportable lab key; signed application SHA-256 is
+`9ec538bc34b50f1f84fe48561f664f9f572eeaa41c5f2aa48a6ff39bb90138b3`.
+Python 3.12.10's official portable build runtime was checked against its published
+archive checksum and its core executable/DLL Authenticode publishers, then used
+only inside the lab build folder. The original payload was retained.
+
+The pinned customer builder ran without `UnsignedTest`, using the already signed
+application and agent. Its manifest covered 96 installed files. Compared with the
+original unsigned CI manifest, the application hash changed for signing, and the
+license used exact Git LF text where the CI copy used CRLF. The license texts were
+compared equal after that explicit conversion; no original shipping artifact was
+normalized or changed for a reproducibility comparison. An initial manifest check
+that assumed only one changed file was retained and corrected before metadata was
+signed or imported.
+
+Prepared unsigned MSI SHA-256 was
+`a8e9ba3d45d61d0d990468b5f7d641dc1b2c15356ef440e1b377a29793ddec74`;
+signed MSI SHA-256 was
+`78613eafa2cc56fed53b2a550b2aec7db10b82733d8cd6f781b26bb34218b47c`.
+Version 1.5.1 and stable customer product/upgrade identities were checked unchanged.
+The signed test release used sequence 11, unchanged company trust pins and Server
+2016 scope. Its unapproved build returned 409. After approval, original job
+`425fc1b5-cc46-49a1-9877-dd545cd9f61f` completed. Anonymous HTTPS download returned
+200 with 32,492,051 bytes and SHA-256
+`ec13dd18d1bb3b33da872966430ffd15c75932a4208e7d52801a85291b3cc64c`.
+Independent host verification checked the original ZIP's 12-entry layout, CRCs,
+seven pinned-source texts, public-only bootstrap, pre-existing profile/release
+pins, signatures and complete signed installed-file manifest. Eight original
+download/build records and the archive were retained.
+
+Pre-upgrade checks found Server 2016 Standard Evaluation Desktop Experience
+14393.693, approved enrollment, profile revision 18, release sequence 8, consent
+false at revision 6, no active support session or recovery marker, and no Tailscale
+service. The original generated setup was run as SYSTEM. At 15:29 UTC it failed
+with MSI 1603; Windows Installer's event identified its newer-version launch
+condition. Read-only inspection established that the old MSI is registered as
+1.5.7 with ProductCode `{32063221-0D0B-4749-B725-5E4504E5B2A9}`, despite application
+file version `1.5.0+68`. The new 1.5.1 product was not registered and the original
+application hash, identity, credential, consent and sequence were unchanged. No
+version was inflated and no downgrade condition was bypassed to force a pass.
+
+This failure exposed a separate installer defect: setup had already stopped and
+disabled its existing configuration task. The original validated action and signed
+agent were restored to Running, while the pending sequence-11 marker was retained
+unchanged. Customer, company and worker services were Running. Nine original
+failure/restoration records were collected over pinned SFTP and hash-checked;
+device credentials were excluded. This is a failed customer-upgrade test, not
+fresh enrollment, a successful upgrade or complete rollback.
+
+The source fix now rejects newer related MSI registrations, and incompatible
+same-version registrations with different product identities, before preparing a
+setup marker or stopping configuration syncing. If a later setup step fails, it
+restores the prior enabled/active task state only after validating the current
+task's action and SYSTEM principal again. Restoration failure is reported together
+with the original setup error; pending installation evidence is retained.
+Windows PowerShell 5.1 checks passed ten isolated read-only MSI catalog cases,
+seven actual-handler scheduler-substitute cases, and the existing real setup
+entry-point/trust-rejection checks. These are bounded regression checks, not
+successful product installations. The new preflight was also executed against
+the real lab MSI catalog: it rejected registered 1.5.7 versus candidate 1.5.1 with
+no MSI actions, unchanged pending-marker bytes and the original watcher Running
+before and after. Both Windows CI workflows now include the regression checks.
+Matching server/worker/agent builds must be regenerated because bundled source
+texts and their recipe changed.
+
+Fresh customer testing needs the previously reviewed private guest HTTPS binding
+change. A new explicit approval request is pending; the earlier automatic review
+blocked that change, and the separate approved migration preserved the binding.
+No replacement listener, proxy, host firewall change or DNS change was used to
+work around it. Other full release gates remain open.
+
+### Installer-fix build evidence and clean endpoint preparation, 23 October
+
+Company component run `39983860542` passed for source
+`d8fad20408281c5936425da0e37ccb7606f1d2f7`. Its Windows artifact archive was
+downloaded without execution and verified against GitHub's SHA-256 digest
+`16778d74d7a5b8c1338de45335ddcafaa3bbe002db77dfeeb70f24c5bba4e1d6`.
+All component and source-archive hashes matched `SOURCE.json`. The corresponding
+source archive contained exactly the expected 156 tracked inputs: 14 matched
+public Git blobs byte for byte, and 142 differed solely by Windows checkout CRLF
+line endings. Both raw hashes were retained for those differences; archived
+bytes were not rewritten. This verifies source correspondence, not independent
+component reproducibility, installed behavior or production signing.
+
+Independent Windows application runs `39984444925` and `39984452304` were still
+building at the observation. Their bridge jobs passed, but application binaries
+and a comparison of their shipping bytes were not yet available. The unrelated
+successful comparison-workflow trigger is not proof of these builds matching.
+
+General CI run `39983870640` failed because the installer-wait test spawned the
+standalone name `tests::child_fixture` inside the application crate, where the
+actual name includes `install_wait::`. The child therefore ran zero tests and
+returned success instead of the expected failure code. A test-only fix derives
+the module prefix in both contexts. Focused regression run `39988354836` then
+passed on Windows 2022 and Ubuntu 24.04: each platform compiled both standalone
+and embedded contexts and passed all three tests in each, using actual child
+processes and verifying failure status and the minimum wait. Full application
+CI and acceptance remain separate gates.
+
+A distinct endpoint-only Server 2016 evaluation VM was provisioned with a new
+32 GiB disk, separate lab credentials and pinned SSH keys in the healthy KVM lab
+runtime. The existing company VM and frozen Windows 11 storage were not replaced
+or booted respectively. Host storage reserved the full new disk plus 100 GiB
+before launch. Windows setup visibly reached 69% of file preparation; later
+disk activity continued, but the provisioned SSH endpoint and final Windows
+installation had not yet been verified. No company management service was
+started in this endpoint fixture. Its installation is not a passed product test.
+
+### Clean Server 2016 signed customer lifecycle, 23 October
+
+The separate endpoint reached the Windows desktop. Its original specialize
+command returned `0x1` before creating the lab directory; the original cause
+was not established. Default Windows management access, forwarded temporarily
+through loopback only, allowed the owned endpoint to be identified and its
+pinned seed scripts to be verified. A bootstrap recovery installed the existing
+pinned OpenSSH payload but stopped at its combined key-permissions command.
+The exact existing key bytes were retained, private key files were restricted
+to SYSTEM and Administrators, and key-only SSH was verified against the
+pre-provisioned host key. Automatic logon was disabled and its saved password
+removed. The temporary management forwarding was then removed. This repaired
+only endpoint lab access; the company VM HTTPS binding was not changed.
+
+On Server 2016 Standard Evaluation Desktop Experience 14393.693 x64, the
+corrected source-`4c5accb` company-lab-signed customer MSI
+`78613eafa2cc56fed53b2a550b2aec7db10b82733d8cd6f781b26bb34218b47c`
+passed fresh installation, repair of a deliberately damaged packaged license,
+and uninstall as SYSTEM. All three MSI exit codes were zero. Each installed
+phase verified all 96 manifest files, the exact agent hash, service executable
+and SYSTEM ownership, and valid application/agent signatures from the expected
+disposable lab publisher. Uninstall removed packaged files, product registration
+and the customer service. Thirteen original scripts, reports and MSI logs were
+collected through pinned SFTP and independently hash-checked, including hashes
+recorded by the phase results. This is a passed signed bare-MSI lifecycle on
+this exact Windows build, not company enrollment, interactive UAC, automatic
+update, remote desktop or complete Server 2016 qualification. No project signing
+approval or production publication is implied.
+
+The corrected signed technician MSI was also attempted from an owned standard
+account. Task Scheduler initially denied batch logon (`0x80070569`), so only that
+account's batch-logon right was added; before/after exports verified all other
+user rights unchanged and the account remained outside Administrators. The
+resulting actual standard-user install attempt failed with MSI 1601; its original
+log records connection to the installer service denied with `0x80070005`.
+Four original failure records were collected and hash-checked. A separate
+credential-based interactive-token process launch produced no lifecycle result;
+its launcher's null child exit code is not a pass. Installer policy was not
+relaxed. Standard-user technician installation on this VM remains unqualified
+and requires further diagnosis in a normal logged-on user session.
+
+### Installer-fix independent rebuild verified, 23 October
+
+Native Windows runs `39984444925` and `39984452304` both completed successfully
+for source `d8fad20408281c5936425da0e37ccb7606f1d2f7`, using the same pinned
+source-built Flutter engine candidate. Comparison run `39995075014`, executed
+from frozen comparison-tool source `89039772db027868eecb4de3217fa3dbd9fb8c79`,
+verified both corresponding source archives (1,160 tracked source inputs and
+six generated bridge files each) and found all eight original shipping files
+byte-identical. No shipping-file normalization or executable execution was used.
+The original report is retained in
+`deployment/windows/native-d8fad20-rebuild-comparison.json`. Its SHA-256 is
+`d339ad4e039af68e04f93da38c105bc21697f0fca418b9843ff28e4504caaec1`.
+The retained first-build archive additionally matched GitHub's digest
+`c67a287094a504220626c7f4d88a12e76fb67a607fdb4de955ffe68c240bc960`
+and every first-build output in the comparison report. This is reproducibility
+evidence for the exact unsigned candidate, not runtime or release approval.
+
+The same three management/worker/agent input files also matched the independently
+compiled Windows company-component run `39983860542` byte for byte. Copies were
+signed with the existing non-exportable disposable-lab publisher and verified
+using timestamp-required SignTool checks and Windows signature validation.
+Eight original signing/provenance records and signed files were retained and
+their signed binary hashes checked independently. Company services were not
+changed; coordinated installation and end-to-end testing remain outstanding.
+
+The original Linux deployment job `120517833123` in run `39983860542` was retained
+and its successful steps inspected. Actual isolated Docker tests passed fresh
+setup/persistence, MFA/replay checks, enrollment approval, HTTPS/profile signing,
+and complete encrypted backup recovery into replacement containers, with both
+pinned upstream and maintained transport components. Their logs explicitly leave
+native sessions, UDP traversal, external reachability and public ACME unverified.
+
+To investigate the standard-user MSI failure, the disposable endpoint was also
+prepared for loopback-only RDP lab control with NLA retained and the owned test
+account outside Administrators. No successful standard-user desktop login was
+demonstrated: Windows UI automation could observe owned login/file dialogs but
+did not reliably target their controls. Temporary host credential entries were
+removed after verifying their exact owned account, comment and session-only
+persistence; existing host credentials were not replaced. This lab-control path
+is not evidence of Swan connectivity. The standard-user technician test and the
+separately pending company HTTPS-listener approval remain open.
+
+### Existing company upgraded and matching bundles generated, 23 October
+
+A fresh authorized management-only backup was created before installing the
+`d8fad20` management/worker pair. Its encrypted archive is 160,757 bytes with
+SHA-256 `df03fdfe6c8d57e89517e8ff4ab8f717a1747471f030079c52fd2b62e9850876`.
+Independent in-memory verification authenticated AES-GCM, rejected tampering and
+the wrong passphrase, checked ZIP integrity and SQLite `quick_check`, and matched
+backed-up management material and release/job state. The original archive was
+unchanged; only a disposable in-memory SQLite copy's journal-mode header was
+adapted for deserialize. The passphrase remained separately protected in the VM
+and was not saved on the host. No transport/TLS export or Windows restore was
+performed, and no additional releases were withdrawn.
+
+The existing Server 2016 company VM then completed a guarded coordinated upgrade
+to the matching lab-signed `d8fad20` management service and installer worker.
+Independent observation verified installed hashes/signatures, the original
+profile trust pin and both before/after profile signatures, unchanged profile
+revision 18 with rollout paused, and the new matching bundle recipe
+`3c38e520a233282bd1ae06739b4bd6cdc8409439f7ac46c11edc837e1d71c2d5`.
+Customer identity/token hashes, consent, release sequence, process ID, running
+configuration watcher and the original pending sequence-11 marker were preserved.
+HTTPS configuration bytes, transport keys, service environments and release
+approvals were unchanged. All three services were Running; the previous signed
+management/worker binaries were retained and independently hash-verified for
+rollback. This successful upgrade did not exercise rollback or restore.
+
+Matching customer and technician MSIs were built using the exact public source,
+reproduced native payloads, and 213 verified inputs. The existing pinned WiX 5.0.2
+and Python 3.12.10 inputs were reused without downloading them again. Default
+signed-input checks were used, with the application and agent signed before MSI
+construction and the resulting MSIs separately signed and timestamp-verified.
+All original build inputs remained unchanged and no private key was exported.
+Fifteen original build/signing records and outputs were collected and checked.
+The customer's 96-file manifest matched all 94 unchanged native payloads, its
+new signed main executable, and the exact public-source license text. Read-only
+MSI inspection confirmed version 1.5.1, x64, and the stable product/upgrade IDs
+for both editions. The lab-signed MSI hashes are:
+
+- Customer: `1b804b8c008cc1e164f88791c2192c4acd1814b4c76446a812a6c995f1ae5d31`.
+- Technician: `d0bcede9234a90f272ef34a71f734cf4f1813b2fbcc2fbe376208061a5a84bda`.
+
+The upgraded server rejected build requests before release approval, then its
+worker completed customer sequence 12 and technician sequence 13. The customer
+bundle downloaded anonymously with HTTP 200; technician access returned 401
+without authentication and 200 with it. Both original ZIPs matched their completed
+job hashes. Each contained exactly 12 safe flat entries, the seven exact pinned
+bundle texts, only six public bootstrap fields, the original signed release
+envelope, and the expected signed MSI/agent hashes. Profile and release signatures
+were independently verified against preexisting pins; modified signed payloads
+were rejected. These are isolated company-server distribution checks with rollout
+paused and Server 2016 test-channel metadata, not external reachability, fresh
+customer enrollment, successful endpoint upgrade or production publication.
+
+The complete generated sequence-12 customer setup was also invoked once against
+the earlier contaminated 1.5.7 MSI fixture, with explicit failed-setup replacement
+requested. Its bundled MSI preflight rejected candidate 1.5.1 before preparing or
+replacing installation evidence. The initial harness expected the generic outer
+error, but Windows PowerShell surfaced the native child's version error first.
+That original error was preserved. A read-only continuation and independent
+collection confirmed identical before/after snapshots: identity/token hashes,
+consent, sequence 8, payload hashes, service process, Running watcher, pending
+marker, cancelled archives and MSI registration were unchanged. The candidate
+was not registered. Setup was not rerun. This verifies the actual generated
+installer's negative version guard; it does not resolve the old interrupted
+fixture or establish a successful customer upgrade. Positive endpoint installation,
+standard-user technician qualification and the other full release gates remain
+open.
+
+The original generated sequence-13 technician bundle subsequently completed an
+upgrade in its existing owned administrative Windows profile. Its accepted
+sequence advanced from 10 to 13, both installed executables and the cached MSI
+matched the signed bundle, and installed-state verification succeeded. Company
+bootstrap/trust, profile revision 18 and the earlier cancelled-setup archive
+were preserved; no pending marker remained. Thirteen original evidence files
+were independently collected and checked. The customer service, watcher and
+pending marker were unchanged. This is not standard-user, technician login or
+remote-session qualification.
+
+A separate Windows profile exposed another preflight defect: Windows Installer
+reported state 2 for the technician product installed under the other account.
+Microsoft documents this as INSTALLSTATE_ABSENT, not corrupt registration.
+The helper now allows installation in that state only for an ordinary per-user
+MSI (missing or empty ALLUSERS); machine-wide and dual-purpose packages still
+fail closed. Related-product downgrade and conflicting-version guards remain.
+Sixteen isolated catalog cases and seven watcher-recovery checks pass. A read-only
+probe against the actual signed MSI/catalog selected installation for the new
+profile, still rejected the newer customer fixture, and preserved both existing
+installations and customer evidence. No MSI action ran and no distributed bundle
+was patched during that probe. A rebuilt matching bundle and positive second-user
+installation remain required.
+
+The retained signed d8fad20 customer MSI also completed a bare-MSI reinstall,
+damaged-license repair and uninstall on SWAN-END-16, Server 2016 Standard
+Evaluation Desktop Experience 14393.693 x64, running as SYSTEM. Each operation
+returned 0; installed publishers and all 96 packaged file hashes were checked.
+Thirteen original logs/reports were collected and independently hash-verified.
+The endpoint had previously uninstalled the 4c5accb customer package: its only
+remaining customer state was the intentionally retained zero-byte
+pending-uninstall marker. The original clean-state preflight rejected that
+directory; a separate guarded preparation allowed exactly that existing marker
+without deleting it. This is repeated-install/removal evidence, not a first
+installation on a new disk. It does not demonstrate enrollment, cancellation
+clearance by complete company setup, GUI, updates, or the later f84ffb0 helper.
+
+The signed d8fad20 technician MSI was then attempted from the actual
+SWAN-END-16 standard-user desktop, session 2, using an Interactive/Limited
+scheduled task without stored task credentials. Installation returned 1625.
+The original MSI log accepted the package signature at the unrestricted
+software-restriction level, then reported effective DisableMsi=1 and explicitly
+rejected a non-assigned application for a non-administrator. Both
+AlwaysInstallElevated policies were 0. Four original failure records were
+collected and hash-verified. This establishes an installer policy restriction,
+distinct from the previous batch-logon 1601 failure; it is not a successful
+standard-user installation. No policy was relaxed and no administrator membership
+was granted. See [Microsoft DisableMSI documentation](https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi).
+Managed deployment under this policy, and current standard-user qualification
+on Windows client editions, remain open.
+
+For f84ffb0, push workflow 40003837369 completed its company-component checks.
+Its original Windows artifact (ID 12524175355) matched GitHub's SHA-256 digest
+2f6909f404f82823941454c9bfe4adcea7b4ff6732fddec1b8805b6f63b70efb.
+All three binary hashes matched SOURCE.json; the corresponding source archive
+matched 157 tracked public-source files, with 14 exact blobs and 143 differences
+limited to recorded Windows checkout line endings. No archive was normalized.
+The PR workflow's separate artifact identified its merge commit 00aefa5a, so it
+was retained separately and was not used as the f84ffb0 input. The exact push
+binaries were staged and signed with the existing nonexportable disposable lab
+publisher; timestamp and publisher checks passed, and eight original signing
+records/artifacts were collected and hash-verified. Services were unchanged.
+Independent native builds 40003860186 and 40003868465 were still running;
+matching release qualification and deployment were not established by these
+component/source/signing checks.
+
+The existing company server and worker were subsequently upgraded together to
+the lab-signed f84ffb0 components. A fresh management-only encrypted backup was
+authenticated independently, including wrong-passphrase/tamper rejection,
+SQLite quick_check and exact release/job snapshot checks. Six original backup
+records and eight original upgrade records were collected and hash-verified.
+The upgrade preserved customer identity/token, consent, sequence, pending
+installation evidence, Running watcher and service process, profile revision 18,
+paused rollout, HTTPS binding bytes, transport keys, service environments and
+release approvals. The live bundle recipe matched the pinned source calculation.
+Old binaries were retained and checked; neither rollback nor restore was run.
+This backup does not include the separate TLS/transport private material.
+
+The new worker then generated a protected technician bundle for the already
+approved d8fad20 sequence-13 release (job 805e52fe-b286-40d1-b90e-5c7535858534).
+Its seven installer/license texts matched f84ffb0 exactly after the documented
+line-ending conversion; the signed MSI, agent and release envelope were unchanged
+from the earlier pinned release. Public bootstrap/trust remained unchanged,
+profile/release signatures verified, and anonymous download returned 401 while
+authenticated download returned 200. No new release approval or rollout occurred.
+
+That exact generated bundle completed installation in the company's owned
+Administrator profile while the same ProductCode was installed in a different
+Windows account. The real catalog moved from state 2 to state 5 for the new
+account; the unmodified generated helper/setup, payload publishers, installed
+release, cached MSI and agent verification all passed. Sequence 13 and profile
+18 were recorded. The account's earlier uninstall cancellation and rollback
+marker were resolved by normal complete setup, without manual deletion. The
+other technician account and existing customer were unchanged. Nine original
+records/files were collected and independently verified, including cached signed
+state without device credentials. This verifies the actual per-user correction
+and setup cancellation recovery in an administrative profile, using f84ffb0
+packaging with d8fad20 endpoint payloads. It is not standard-user, first-install
+on a new disk, f84ffb0 native-payload, login or remote-session qualification.
+
+The same unmodified generated setup then passed explicit `-Repair` in that
+second administrative profile after its previously hash-verified technician
+executable was moved into protected test evidence. Repair restored the exact
+signed executable; the retained original hash, agent signature, MSI registration
+and final installed-identity verification passed. Managed state and installed
+release metadata remained byte-identical, with no setup/cancellation marker left.
+The other technician profile and customer process, pending marker and watcher
+were preserved. Four original files, including the retained executable, were
+collected and independently hash-checked. This remains f84ffb0 packaging with
+d8fad20 payloads and does not establish automatic-update recovery.
+
+Two subsequent real uninstall/explicit-repair reinstall cycles passed in that
+same technician profile. Both MSI removals returned 0, removed that account's
+payload, retained its cancellation marker and company state, and cleared obsolete
+uninstall rollback records. Because the product remained installed under the
+other account, the current account's catalog state became 2 rather than unknown.
+Each unmodified generated `-Repair` then reinstalled the exact signed payload,
+returned catalog state 5, cleared cancellation/setup markers, preserved managed
+state and release bytes, and passed agent verification. The other technician
+account and existing customer were unchanged. Eleven original records/logs were
+collected and hash-verified; independent post-test catalog, state hashes and
+marker checks also passed. This is administrative f84ffb0 packaging/d8fad20
+payload lifecycle evidence, not automatic-update or standard-user acceptance.
+
+The exact f84ffb0 push workflow 40003837369 also completed the actual Linux
+deployment job 120586573130. Its original log was retained with SHA-256
+c733aa743f6676cb514e22d2a6217b87234497cf51723b22b313e22d04ceef4f.
+Fresh non-root/read-only Docker startup, private storage, company setup,
+administrator MFA/replay denial, enrollment approval and restart persistence
+passed. Both pinned upstream and maintained transport stack rehearsals passed
+HTTPS trust/untrusted rejection, actual signed profiles, MFA/enrollment/logout,
+complete encrypted archive recovery and replacement startup with original trust.
+The three integration scripts matched their previously inspected d8fad20 source
+exactly. These are actual isolated Linux deployment tests; they do not establish
+native desktop sessions, UDP traversal, public ACME/external reachability or
+Windows TLS/transport restore. A fresh Windows 11 qualification environment also
+awaits additional lab storage while the older moved endpoint disk remains frozen.
+
+Both f84ffb0 native product builds, 40003860186 and 40003868465, completed
+successfully. Main CI, component, transport and portable wait checks also passed.
+The separate full Flutter workflow 40003844885 failed: its Windows/Linux x64
+non-company builds compiled TX_COMPANY's lazy_static expansion while CompanyTask
+was excluded, reporting E0573/E0574/E0412. The feature guard was moved around
+the entire company-only macro invocation; validation of that correction is
+pending a new run. The legacy 32-bit job separately selected a 32-bit compiler
+host that current rustup refused on its runner. Its pinned nightly now selects
+the runner host while keeping the i686 compilation target; this also needs CI
+validation and does not add 32-bit product support. Original failure logs are
+retained. Independent f84ffb0 artifact comparison and local download verification
+remain pending; these failures are not hidden by the dedicated product builds.
+
+The original f84ffb0 comparison subsequently failed in workflow 40016176888:
+four shipping outputs matched (server setup, agent, management and worker), while
+both client MSIs and both portable EXE outputs differed across
+the builds. The unmodified failed report is retained as
+[native-f84ffb0-rebuild-comparison.json](../deployment/windows/native-f84ffb0-rebuild-comparison.json).
+This is a failed reproducibility gate, not a passing rebuild with metadata ignored.
+Bounded ZIP manifest diagnostics isolated 12 differing packaged files: the native
+launcher and C++ Flutter plugins. A separate pinned diagnostic workflow
+40020904002 verified both original archive hashes, extracted the original
+payloads without execution and retained their byte/section/compiler/debug
+observations. All copied diagnostic payload hashes were checked independently.
+Compiler-generated lambda/anonymous-namespace identifiers differed; compiler
+Rich records and linker versions matched in the observed binaries. A controlled
+compile-only MSVC probe is pending; no normalization or speculative build-flag
+fix has been accepted as a successful reproduction.
+
+For the separate non-company build failure, the later 7928f87 workflow
+40017774069 passed its actual Windows x64 job 120636061516 and Linux x64 job
+120636061669. This verifies compilation after moving the feature guard around
+the company-only macro. The full workflow is still running; its legacy 32-bit
+job now passes compiler installation but fails at a later build step. Deferred
+platform compilation is not advertised product support, and the workflow is not
+reported green. No newer native product rebuild has yet qualified the C++ bytes.
+
+
+The full first f84ffb0 native archive subsequently downloaded and passed its
+provider digest, ZIP CRC, corresponding source and shipping checksum checks
+(artifact 12526383159, SHA-256
+9e450f89d14d2bbec9ea9505f44b57f42abc7b703c4e1a0eef71bf419b5b03cc).
+Downloaded executables were not run; the cross-build gate remains failed.
+
+Compiler probe 40027967521 at public tooling source 0fd6519 completed after its
+process-tree wait was corrected. Its original report is retained as
+[cpp-path-probe-0fd6519-observations.json](../deployment/windows/cpp-path-probe-0fd6519-observations.json).
+The provider archive digest verified as
+ dfdb62605446753e04bf560bff0a2e819bb02dc93f226989a72c8faee05fcccf.
+All four variants produced identical original DLL bytes when only source mtime
+changed at the same path, but differing lambda identifiers and DLL bytes when
+build paths changed. Compiler /Brepro, /experimental:deterministic and the
+initial /d1trimfile form did not remove path sensitivity. This compile-only
+experiment is not a product rebuild. No generated DLL was run or normalized.
+A follow-up tests relative source input and path mapping before selecting a
+product change. The prior timed-out probe's original partials remain retained.
+
+
+Follow-up compiler probe 40028879677 (d93b067) also passed its harness. Original
+[observations](../deployment/windows/cpp-path-probe-d93b067-observations.json)
+show that relative input and /pathmap did not make different-directory DLLs
+identical. No product flags were changed based on these experiments.
+
+Inspection of both full native job logs then established different hosted images
+(20261021.343.1 versus 20261012.333.1) and Visual Studio servicing versions
+(17.14.37806.7 versus 17.14.37710.0). Both logs name the same MSVC 14.44.35207
+installation directory. The original log digests and selected observations are
+retained in [native-f84ffb0-toolchain-observations.json](../deployment/windows/native-f84ffb0-toolchain-observations.json).
+Matching PE Rich records do not establish identical compiler binaries, libraries
+or headers. Toolchain drift is now a concrete difference to investigate; it is
+not yet established as the cause. A future passing reproduction must compare
+original shipping bytes with pinned toolchain identity as well as public source.
+
+
+Toolchain capture probe 40030510222 passed and retained 618 compiler, header and
+library input hashes under Visual Studio 17.14.37806.7, default MSVC directory
+14.44.35207. Its provider ZIP digest and CRC passed independent collection.
+The independent manifest identity calculation exposed culture-sensitive record
+ordering in the capture script. The script now explicitly sorts paths ordinally;
+that corrected identity format still requires an actual Windows run. The native
+product workflow now retains this manifest in both client and final artifacts.
+This adds provenance evidence; it does not establish a reproducible product,
+identify the historical mismatch's cause or pin Windows SDK inputs.
+
+
+Corrected ordinal capture then passed actual Windows probe 40031644530 at
+bc6eed56f0e3e6ac11d361fba50bd0e4415a080c. The retained provider archive digest
+and CRC verified; an independent Python calculation of all 618 original input
+records agreed with the captured identity. The actual comparison verifier also
+accepted those original manifest bytes, including their UTF-8 BOM. Its bounded
+[validation record](../deployment/windows/cpp-toolchain-ordinal-validation.json)
+records the original manifest and archive digests. Eleven focused comparison
+trust-boundary tests passed, including missing/changed input identity and unsafe
+or duplicate records. No generated DLL was executed and no shipping bytes were
+normalized. Independent product builds 40031742464 and 40031748532 at da0c621
+are still running; their provenance and shipping equality remain unverified.
+
+
+Independent native product builds 40031742464 and 40031748532 at exact public
+source da0c621845057bed321a98a1886ef15891e431a9 both completed successfully.
+Frozen comparator 4102bb36b02923bd12c297abf7d91c47bf638364, workflow 40040238668,
+verified both original provider archive digests, public source/bridge provenance,
+shipping checksums and required compiler manifests. All eight original unsigned
+shipping outputs matched byte-for-byte. Both compiler records independently
+validated the same 618-file identity
+cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47.
+The original [comparison report](../deployment/windows/native-da0c621-rebuild-comparison.json)
+was collected with provider digest and ZIP CRC verification, without executing
+payloads or normalizing any shipping bytes. The older f84 failed report remains
+preserved; this new passing pair does not retroactively explain that failure.
+This establishes bounded unsigned reproducibility for da0c621 and the recorded
+MSVC inputs. SDK/actual CMake command provenance, lab signing, clean-machine
+runtime qualification, public sessions and production signing remain separate.
+The first full archive is downloading locally for subsequent installer testing;
+its local completion has not yet been verified.
+
+
+The full first da0c621 native archive completed local download and passed its
+provider digest, ZIP CRC, exact source and shipping checksum checks. The packed
+customer payload was extracted without execution and all 95 files matched the
+native MSI manifest. Both company-lab-signed MSIs were built using 213 pinned
+inputs; originals and timestamp/publisher receipts were independently collected
+and checked, including the 96-entry signed customer manifest. The existing
+nonexportable lab key stayed inside the VM. Production signing is not approved.
+
+The existing company worker generated new sequence-14 customer and sequence-15
+technician bundles after unapproved build attempts were rejected. Customer
+download was public (200); technician anonymous access returned 401 and the
+authenticated download returned 200. Seven bundled texts matched exact public
+source da0c621, bootstrap contained only six public fields, both signatures
+validated against preexisting pins, and MSI/agent hashes matched. Profile 18 and
+paused rollout remained unchanged, as did the existing customer's identity,
+consent, sequence and service process. Exact job/artifact identities and bounded
+results are retained in
+[da0c621-lab-distribution-evidence.json](../deployment/windows/da0c621-lab-distribution-evidence.json).
+
+The complete generated technician bundle then passed explicit upgrade from
+sequence 13 to 15 in the existing administrative test profile. Installed signed
+EXE/agent, sequence-15 cached MSI, MSI registration, original trust/configuration,
+failed-setup archive and before/after native verification all passed. Thirteen
+original runtime evidence files were independently collected and hash-checked.
+The first collector mistakenly sampled the old sequence-13 MSI under a
+sequence-15 name; that failed collection was preserved and the corrected path
+was collected separately without rerunning installation. This does not establish
+standard-user installation, automatic updating, technician login or sessions.
+
+On the separate Server2016 endpoint (14393.693 x64), the current signed customer
+MSI passed administrative reinstall after retained uninstall cancellation,
+damaged-license repair and uninstall, all returning 0. All 96 payload hashes and
+installed publishers were checked; 13 original evidence files were collected.
+This reused a previously tested disk and is not fresh-disk enrollment, GUI,
+updates or complete OS qualification. Cross-VM HTTPS and session tests still
+require the pending guarded private-listener approval; Windows11 storage awaits
+the user's additional drive. No acceptance scope has been broadened from these
+bounded tests.
+
+
+Current lab-signed da0c621 customer MSI also passed administrative install,
+damaged-license repair and uninstall on the existing Windows10 Pro x64 disk
+(19045.3803), each returning 0. A real intervening reboot was independently
+established; all 96 payload hashes, installed publishers and automatic service
+startup under LocalSystem passed. Original test, MSI and reboot records were
+collected and hash-checked. The first post-reboot observation incorrectly mixed
+UTC and local DateTime values; its failure was retained, and the test driver was
+corrected to compare UTC instants and enumerate decoded PowerShell5 arrays.
+The correction did not rerun installation or the reboot. See
+[da0c621-win10-bounded-evidence.json](../deployment/windows/da0c621-win10-bounded-evidence.json).
+
+Later in that lab run, the Windows10 console went black and SSH/WinRM stopped
+responding while QEMU remained running. ACPI shutdown did not stop it. A recorded
+forced VM stop was followed by a qcow2 container check with zero errors and a
+successful cold-start recovery; event evidence includes a disk retry (153) near
+the stall, without an established cause. A subsequent normal shutdown completed.
+These bounded MSI checks are not complete Windows10 qualification, fresh-disk
+acceptance, enrollment, sessions or approved automatic-update evidence.
+
+A legacy private lab helper's password was inadvertently displayed during the
+run. Its embedded literal was removed from the helper; the original was retained
+privately. The first reset attempt stalled before changing the password, as
+confirmed by the account's original last-set timestamp after recovery. Automatic
+approval review then rejected both a combined reset/verification script and a
+simpler reset, and also rejected temporary-file cleanup, with "blocked by policy".
+Explicit approval is pending. The replacement was not displayed; its one-time
+transfer remains in a verified Administrator/SYSTEM-only directory inside the
+affected VM, which is now offline. This incident remains unresolved pending reset
+and cleanup and is not treated as a passing security check.
+
+The original Server2016 endpoint was restored on the same disk, MAC and memory,
+without setup media and with its prior loopback ports preserved. Its latest MSI
+task still reports success and the zero-byte cancellation marker remains. The
+company server/worker/watcher are running, legacy customer PID1924 is unchanged,
+profile18 remains paused, and the original Caddy binding/pending-install hashes
+are unchanged. The company VM and host RustDesk services were not stopped for
+these tests. Cross-VM HTTPS approval and additional Windows11 storage remain open.
+
+
+On a newly created endpoint-only Server2022 Standard Evaluation Desktop Experience
+VM (20348.587 x64), the current lab-signed da0c621 customer MSI passed
+administrative install, damaged-license repair, a real reboot with automatic
+LocalSystem service startup, all 96 installed payload hashes and publishers,
+and uninstall. Install, repair and uninstall each returned 0. A pre-install
+record established both product registrations absent and no prior endpoint data.
+The technician MSI then passed administrative per-user install,
+missing-executable repair and uninstall, each returning 0, in its first
+application context on that same VM after customer testing. Eighteen customer
+and thirteen technician original evidence files were independently collected
+and hash-checked. See
+[the fresh Server2022 MSI evidence](../deployment/windows/da0c621-server22-fresh-msi-evidence.json).
+
+Initial lab setup had reached the desktop but SSH was stopped: its copied host
+key inherited Authenticated Users read access, and the exact sshd diagnostic
+rejected that key. The two lab access files were restricted to Administrator and
+SYSTEM with explicit protected ACLs, preserving their bytes and the pinned host
+identity. The corrected local seed generator checks those ACLs. A temporary
+loopback management forward used for diagnosis was removed after pinned SSH
+worked, and both setup CDs were detached before Swan MSI execution. An optional
+TrustedPublisher store import returned access denied before any MSI ran; that
+attempt was retained, and subsequent tests used the already installed lab root,
+valid signatures and explicit publisher verification without retrying that store.
+
+These are raw administrative MSI lifecycle checks with lab signing. They do not
+establish standard-user technician installation, generated company enrollment,
+GUI login, sessions, public transport, software-version upgrades or automatic
+updates. The approved company test metadata remains Server2016-only. Production
+signing, the remaining OS matrix and full product acceptance remain incomplete.
+
+
+A subsequent non-administrator technician test on that Server2022 VM failed
+installation with MSI1601. Original evidence verifies the user's non-admin token
+and separate loaded profile. The Windows Installer log reports failure to
+connect to its service with 0x80070005, before the technician executable existed.
+This was a password-backed scheduled batch task, so it does not establish the
+result of an interactive desktop installation. The connection denial's root
+cause remains unproven; standard-user acceptance remains failed/incomplete.
+[The original failed test evidence](../deployment/windows/da0c621-server22-standard-batch-failure.json)
+retains 16 independently collected and hash-checked records.
+
+Earlier lab launch attempts were also preserved: password-free task registration
+was denied, secondary-logon process initialization failed before the harness,
+and scheduled startup initially lacked the batch-logon right (0x80070569).
+After confirming no explicit batch deny policy, only the owned test account was
+temporarily granted SeBatchLogonRight. That allowed the non-admin test to execute.
+The temporary right was then removed and the prior account rights verified;
+both test tasks are disabled with no running instance. Windows Installer policy
+and administrator group membership were not relaxed. Interactive installation
+and the failed standard-user requirement need further verification and any
+necessary product fix; the earlier administrative passes remain bounded.
+
+An independently configured Linux company lab built the pinned public source
+`761b5c5` using two Cargo jobs and started the published management, Caddy and
+transport components with loopback-only test ports. HTTPS certificate and
+hostname validation, signed custom branding, fresh inventory, administrator
+TOTP login, invalid-code/replay rejection, protected worker registration and
+logout revocation passed. [The bounded Linux evidence](../deployment/linux/fresh-company-lab-evidence.json)
+does not establish worker-generated packages, native sessions, public ACME,
+Internet reachability or Windows server setup/restore. New private lab inputs
+remain outside Git; the existing company's disk and keys were preserved.
+
+The Windows10 standard-user console login was verified, but its password-free
+interactive technician test task reached its ten-minute limit before the
+first driver observation or MSI execution. The task is disabled and its
+[failed bounded attempt](../deployment/windows/win10-standard-desktop-bounded-failure.json)
+is retained. No standard-user installer pass or root cause is claimed.
+
+The independent Linux company subsequently registered its own Windows2019
+installer worker, imported and approved new test-only release metadata, and
+completed one customer and one technician bundle. Both downloaded over validated
+HTTPS with matching server artifact hashes. Anonymous customer download returned
+200; anonymous technician download returned 401 and authenticated download 200.
+Independent ZIP checks verified the public-only bootstrap schema, company and
+release signatures against their existing pins, tamper rejection, all seven
+bundled source texts, and signed MSI/agent hashes.
+[Worker and bundle evidence](../deployment/linux/company-worker-bundle-evidence.json)
+remains limited to test signing and Server2019 release metadata. Rollout remains
+paused. Generated customer installation/enrollment and native sessions require
+separate evidence and are not implied by bundle generation.
+
+The generated Linux-company customer bundle was then downloaded anonymously by
+the Server2019 endpoint over validated HTTPS and installed using its original
+company setup script with explicit lab hostname confirmation. It automatically
+pinned company configuration and enrolled the native device without address
+editing or Tailscale. Installed identities and release sequence were recorded,
+the customer service ran, the existing installer worker was preserved, and no
+installation recovery marker remained. Unattended consent stayed false. The
+server inventory independently matched the enrolled device, retained pending
+approval, and rejected an administrator's pre-approval session grant with 403.
+[Generated customer enrollment evidence](../deployment/linux/generated-customer-enrollment-evidence.json)
+does not establish a native authorized session, UAC, Internet transport,
+automatic updates or the full Windows matrix.
+
+The generated technician bundle also completed per-user company setup in the
+owned Server2019 administrator profile. It pinned the independent company's
+identity, verified the installed publisher, recorded technician release sequence
+2, and fetched signed branding revision 2 published after the bundle was built.
+Its state held no customer device token and no pending installation marker.
+[Technician company-setup evidence](../deployment/linux/generated-technician-setup-evidence.json)
+is explicitly administrative: standard-user installation, technician MFA login,
+permissions and native sessions remain separate requirements.
+
+The installed customer's configuration watcher subsequently fetched the signed
+branding revision 2 automatically, without an explicit sync command, installer
+rebuild or reinstall. Its cached envelope independently verified against the
+original company signing pin. Device/company identity, unattended consent and
+software release sequence were preserved; the customer service and watcher
+remained running. [Automatic branding synchronization evidence](../deployment/linux/automatic-branding-sync-evidence.json)
+qualifies the installed configuration path only. Native visible branding,
+offline display, restart/upgrade persistence and trusted key rotation still need
+their separate acceptance evidence.
+
+Management authorization was then checked against that genuinely enrolled device
+after explicit lab approval. Two technician accounts authenticated using TOTP.
+The assigned technician could list the device and receive an independently
+verified signed attended grant bound to company, device, technician, proof key
+and short expiry. The unassigned technician saw no devices and grant requests
+returned 403. Technician attempts to create an administrator-only worker returned
+401. Unattended grants without consent returned 403. Removing group access hid
+the inventory and denied new grants; the lab assignment was subsequently restored.
+[Technician authorization evidence](../deployment/linux/technician-authorization-evidence.json)
+qualifies the management API only. Native receiver enforcement, customer consent,
+actual desktop sessions, lease expiry and in-session revocation remain open.
+
+The generated technician edition was launched through its original verified
+launcher on the owned administrator desktop. Its actual Flutter interface showed
+updated company branding and HTTPS origin, accepted username/password/TOTP,
+listed the authorized native-enrolled device and group, and displayed session
+history. An independent server audit matched this later GUI login, distinct from
+the earlier API tests. GUI sign-out cleared inventory and secret input fields.
+[Native technician interface evidence](../deployment/linux/native-technician-interface-evidence.json)
+does not qualify a remote desktop session: this was the same Windows2019 machine
+as the customer endpoint, and standard-user installation remains open.
+
+During a guarded five-minute outage of only the isolated management container,
+the native customer UI opened from its installed shortcut and displayed cached
+updated branding. Its window initially became unresponsive and later recovered
+while management was still offline. Customer Stop support eventually changed to
+Resume support; an independent query confirmed the customer service was absent
+and the installer worker remained running. Resume support restored the customer
+service without changing enrollment, consent, software sequence, signed executable
+or branding revision. The management restart safeguard restored healthy HTTPS
+and the original company identity/revision.
+[Offline customer/control evidence](../deployment/linux/customer-offline-controls-evidence.json)
+records significant delays. Their cause and acceptable responsiveness remain
+unresolved. No active remote session was present, so immediate disconnection,
+standard-user control and offline authorization denial are not qualified.
+
+The independent Linux company's coordinated encrypted deployment export included
+management data, transport keys/database, full TLS storage, the actual proxy
+recipe/deployment settings and both generated installer bundles. Wrong-password
+restore failed before creating files. Authenticated restore retained exact
+transport key bytes, the complete TLS file tree, settings and installer hashes.
+Separate recovered service volumes then started management, Caddy and transport.
+HTTPS validated against the original lab root/hostname; the signed profile
+verified against its original pin. Administrator MFA, device approval/consent,
+completed jobs, both existing download paths/hashes and logout revocation passed.
+The existing Windows customer's credential also authenticated to the recovered
+API over the same trust without changing its bootstrap or credential. Recovery
+containers were stopped afterward, original endpoints remained unchanged, and
+the verified encrypted archive/passphrase are stored separately outside Git.
+[Full Linux recovery evidence](../deployment/linux/company-full-backup-restore-evidence.json)
+retains the initial internal-network HTTPS timeout and corrected loopback bridge
+check. It does not qualify native desktop transport, public ACME/Internet access,
+or full Windows company-server recovery.
+
+The unreleased 1.5.2 candidate closes legacy updater entry points for managed
+editions. Background start/stop helpers do not initialize the upstream worker;
+manual requests and direct legacy checks reject before MSI inspection or upstream
+version requests. The company agent remains responsible for approved updates.
+A native regression checks all legacy entry points and verifies that no upstream
+worker starts. The Windows build workflow must compile and run that regression
+before producing candidate artifacts. Version metadata/lockfiles agree locally;
+the first native Windows workflow (40398269765) has now compiled and passed
+its regression and packaging steps. Artifact integrity/source verification, an
+independent rebuild (40410425646), and real 1.5.1-to-1.5.2 rollout/recovery remain
+pending.
+This candidate is not a production release or an accepted automatic-update test.
+
+Signed company policy revision 3 enabled unattended support as a company option,
+while the approved customer retained false device consent. An assigned technician's
+unattended grant remained denied with 403. The customer UI then displayed the
+company/domain and sign-in-screen implications in an explicit confirmation.
+Accepting it persisted local consent revision 1, updated the server and enabled
+an independently verified signed unattended grant bound to company, technician,
+device, proof and expiry. Native GUI revocation increased the local consent
+revision, cleared server consent and denied subsequent unattended grants with
+403 while leaving the customer service running. The prior unused grant was
+closed and its lease cleared, but it had expired before the final inspection.
+[Native unattended consent evidence](../deployment/linux/native-unattended-consent-evidence.json)
+does not qualify an active native session, unexpired-lease termination,
+standard-user consent, reboot/logon-screen access or public connectivity.
+
+The independent Linux company completed a profile-signing key rotation against
+both installed 1.5.1 editions on the Server 2019 lab endpoint. A fresh encrypted
+full deployment backup preceded preparation. Both apps cached old-key-signed
+transition revision 4 before activation, then adopted revision 5 and its new pin
+through their normal background refresh without manual agent sync or reinstall.
+Customer unattended consent remained revoked at consent revision 2; software
+release sequences stayed unchanged. A separate shipping-agent fixture that
+missed the transition rejected the replacement signature and retained its exact
+cached state. Old customer and technician download links returned 404. The worker
+pin was explicitly updated from the accepted transition, and replacement test
+bundles completed. Both replacement downloads verified against the rotated
+profile key, unchanged release key, package hashes and exact bundled source;
+customer downloads remained public and technician downloads required authentication.
+[Installed profile-key rotation evidence](../deployment/linux/installed-profile-key-rotation-evidence.json)
+does not qualify active native-session termination, interrupted activation,
+rotated server restore, the wider Windows matrix or public connectivity.
+
+The installed-release configuration agent was also executed against isolated,
+credential-free cached-state copies on Server 2019. Its verify-bootstrap command
+accepted the unchanged valid control, rejected a modified signed payload,
+rejected a wrong company, and rejected a revision below the stored minimum.
+Using a fresh disposable fixture issuer, it accepted a correctly signed fresh
+control and rejected a correctly signed expired policy. Every fixture remained
+byte-identical after validation, and no installed state or system clock changed.
+[Shipping-agent cached-policy evidence](../deployment/linux/shipping-agent-cached-policy-negative-evidence.json)
+is local validation evidence; incoming hostile HTTPS profiles, active native
+sessions and other Windows/account contexts remain separately unqualified.
+
+A separate encrypted backup taken after rotation was restored into fresh storage.
+The recovered management service used the rotated database key while its legacy
+seed remained unchanged, and the recovered HTTPS proxy validated with the
+original lab CA and hostname. Revision 5, administrator MFA, approved device
+identity, revoked unattended consent, both replacement bundle hashes and the
+withdrawn old links survived. The existing Windows customer credential also
+authenticated to this recovery endpoint without changing its bootstrap or token;
+its credential stayed on the guest. Recovery services were stopped afterward.
+This extends the installed-key rotation evidence above; no recovered transport
+or native session was started, and interrupted activation remains unqualified.
+
+The first 1.5.2 native artifact from d74a631 was downloaded and its complete
+archive digest and SHA256SUMS entries verified. All 1,186 tracked source files
+matched their public Git objects (allowing only declared text checkout newline
+conversion), and six generated bridge files matched that exact workflow's
+bridge archive. Native security regression logs and packaging steps passed.
+The independent attempt 40410425646 stopped before native compilation: the old
+Flutter installation action selected latest stable despite its requested
+version, and the engine selector rejected the missing pinned SDK. Its failure
+is retained; byte reproduction has not passed. The Windows workflow now uses a
+fixed official archive/hash and verifies framework/engine revisions, with local
+negative tests proving wrong versions and altered archives cannot extract or
+change the exported environment. The first fixed-SDK workflow 40415706839 passed
+fresh installation, native security regressions and packaging. Its archive and
+shipping hashes were verified; tracked source and six generated bridge files
+matched pinned public source and the exact workflow bridge archive. Independent
+reproduction and runtime upgrades remain separate gates.
+[Fixed-SDK build evidence](../deployment/windows/a1d67be-native-build-evidence.json)
+records the exact artifact digest and verified SDK identity.
+[First 1.5.2 artifact evidence](../deployment/windows/d74a631-native-build-evidence.json)
+is not a production release or a completed automatic-update qualification.
+
+On the newly installed Server 2025 Standard Evaluation Desktop Experience VM,
+build 26100.32230 x64, the da0c621 lab-signed technician MSI passed administrative
+installation, missing-executable repair and uninstall, each returning 0. This was
+the first Swan application installation context on that VM, before customer
+edition testing. A one-time administrator S4U task ran the pinned test scripts;
+no account password was supplied to task registration. All 13 original source,
+result and MSI-log records were collected and hash-verified.
+[Server 2025 technician MSI evidence](../deployment/windows/da0c621-server25-technician-msi-evidence.json)
+does not qualify standard-user execution, technician login, native sessions,
+software-version upgrades or automatic updates. Customer reboot verification
+and the wider release matrix remain separate.
+
+The same new Server 2025 VM subsequently passed the da0c621 lab-signed customer
+MSI installation, damaged-license repair and uninstall, each returning 0. A real
+Windows restart preserved all 96 packaged file hashes, the configuration agent
+and valid installed publishers. The customer service started automatically as
+LocalSystem; the verifier did not start it manually. The one-time startup task
+then uninstalled the package successfully and disabled itself against repeat
+execution. All 18 original customer source/result/log records were collected and
+hash-verified, alongside the 13 technician records above.
+[Server 2025 customer MSI evidence](../deployment/windows/da0c621-server25-customer-msi-evidence.json)
+qualifies this administrative lifecycle only. Managed enrollment, standard-user
+installation, native remote access including the logon screen, software-version
+upgrades and approved automatic rollout remain separate acceptance requirements.
+
+The isolated Linux company subsequently used a distinct protected Windows worker
+on Server 2025 to generate an authenticated technician bundle. Its protected
+local artifact matched the server result; anonymous technician download was
+rejected. The actual shipped company setup installed the lab-signed 1.5.1
+technician edition with current signed profile revision 5, release sequence 3
+and no device token. Native username/password/TOTP login showed company
+branding, the approved device/group and session history, independently matched
+by the server login audit.
+[Server 2025 generated company technician evidence](../deployment/windows/da0c621-server25-company-technician-evidence.json)
+qualifies administrative per-user setup and native login only. The customer
+was offline during login; separate-machine remote access, receiver permission
+enforcement, standard-user setup and automatic rollout remain unqualified.
+
+Subsequent separate-machine testing connected the Server 2025 technician to the
+Server 2019 customer through this independent Linux company. The native customer
+received and accepted an attended approval prompt; the technician saw its actual
+desktop. Remote mouse input minimized the customer window, verified separately
+on the receiving console. The receiver claimed the company grant and renewed
+its lease beyond the initial expiry. Customer-local Stop support disconnected
+the technician, removed the support service through the existing native stop
+path and prevented reconnect; the customer showed Resume support. Server-side
+closure of the retained lease record is not claimed.
+[Two-machine session evidence](../deployment/windows/da0c621-linux-company-two-machine-session-evidence.json)
+was subsequently correlated with the receiver and company relay logs using the
+same connection UUID: this successful session used the company relay. An earlier
+relay handshake failed to receive a public key before the second paired request
+succeeded. This does not qualify direct NAT traversal, separately forced-relay
+coverage, public Internet operation, hostile native connections, expired-lease termination, keyboard,
+clipboard, transfer, UAC, logon-screen or multi-monitor behavior.
+
+This run also exposed a failed automatic customer service start after the two
+VMs booted together on HDD storage: Windows recorded events 7000/7009 and a
+30-second service connection timeout. A single manual recovery succeeded before
+the session above. The original failure is retained; its cause is unproven and
+reliable cold-boot startup remains a failing acceptance gate. Earlier Server
+2025 administrative reboot evidence does not resolve this Server 2019 failure.
+
+Investigation confirmed that this headless service had loaded the Flutter engine
+and desktop plugins. The original da0c621 launcher normally imports the engine
+and eleven plugin DLLs, while its Rust core has no Flutter DLL import. The Windows
+build now delay-loads the engine and generated shared plugin targets, using
+[MSVC's supported delay-load mechanism](https://learn.microsoft.com/en-us/cpp/build/reference/linker-support-for-delay-loaded-dlls).
+A new CI verifier rejects an eager bundled DLL import or a missing delayed
+engine, and rejects malformed import descriptors; its local regression tests
+pass. Native run 40435586938 also passed the import gate and actual service module
+inspection described below. Repeated cold-boot tests are still required; this
+change is not yet proof that the startup timeout is fixed.
+
+A later technician relaunch remained inside `swan-agent verify-installed` while
+its publisher-verification child was pending. The agent now bounds that child to
+120 seconds, terminates and reaps it on timeout, and returns an error without
+authorizing launch or installation. It still requires the original signature,
+publisher, certificate and hash checks. New process tests cover actual successful
+and rejected child exits plus timeout cleanup. Windows and Linux component CI
+passed for 7407fa1, including the actual Windows child-process tests;
+[CI evidence](../deployment/windows/7407fa1-publisher-timeout-ci-evidence.json)
+does not yet qualify installed-app timeout behavior. The prior unbounded lab process is retained
+for diagnosis rather than counted as a successful relaunch.
+
+For source a1d67be, independent native runs 40415706839 and 40423647265 now pass
+the original-byte comparison: all eight shipping EXE/MSI outputs are identical,
+all 618 recorded MSVC inputs match, and each archive's 1,192 tracked source files
+match pinned public Git objects. Six generated bridge files in each archive
+also match that run's retained bridge artifact. Shipping binaries were not
+normalized or executed for this check.
+[Independent comparison](../deployment/windows/a1d67be-native-independent-comparison.json)
+does not qualify runtime upgrades, the newer startup changes, signing or release
+publication. The first Docker-context test for 06de236 failed because the new
+verifier source was missing from the source allowlist; both context allowlists
+now include that exact file. Run 40432863268 subsequently passed the Linux
+deployment check: 46 required public files were exported and all configuration,
+key and cache canaries excluded. The original failed run remains retained.
+
+The outgoing-only technician startup path also previously allowed automatic
+quick-support detection under an elevated account. That could enter the incoming
+portable helper's display discovery and shared-memory allocation. Outgoing-only
+editions now disable quick-support mode, reject direct helper CLI invocation and
+reject both direct and logon helper requests before runtime initialization. The
+native regression invokes the real helper entry point with outgoing-only policy
+and checks that startup state and shared memory remain unchanged. That exact
+test compiled and passed in native run 40435586938 for source 9ba592c. Installed
+technician startup and reconnection remain unqualified.
+
+The native workflow now includes an unsigned customer MSI smoke test on a
+disposable Windows runner: install, require automatic LocalSystem service startup
+without a manual start, inspect the service process for absence of Flutter engine
+and plugin DLLs, then uninstall. It refuses existing customer state and retains
+logs/results even when cleanup fails. Run 40435586938 passed this actual test:
+the MSI install completed in 4.65 seconds, its automatic service loaded the Rust
+core without the Flutter engine or plugin DLLs, and uninstall was verified.
+The retained original result and logs were independently hash-verified against
+artifact 12706347182; [evidence](../deployment/windows/9ba592c-native-startup-ci-evidence.json)
+records the exact source, package and artifact identities. This administrative,
+unsigned CI test does not qualify cold reboot, enrolled sessions, publisher
+acceptance or the complete Windows compatibility matrix.
+Windows PowerShell 5 also rejected the fixture on this host before resolving
+its nonexistent test package, confirming the disposable-runner guard.
+
+
+### 2026-10-29: Windows worker credential storage failed qualification
+
+A fresh Server 2016 company installation exposed an unsafe assumption in the
+development worker installer: its protected service registry ACL still acquired
+explicit ALL APPLICATION PACKAGES read permissions. No credential values were
+printed. The affected lab registrations were revoked (old credentials rejected
+with HTTP 401); the fresh worker was stopped, set to manual startup and its
+registry token removed. Older offline lab worker registrations were also revoked.
+
+The replacement source stores service credentials in a canonical private file,
+checks file and directory ownership/permissions before reading, refuses legacy
+service environment fallback, and protects the empty file before writing any
+credential bytes. Local locked agent/worker tests passed. These results do not
+qualify the Windows fix: compiled Windows permission checks, an authenticated
+build, restart/reboot and guarded migration preserving retained artifacts remain
+required. Production publication remains blocked by the outstanding acceptance
+and signing gates. Backup restores must reapply legacy worker revocations.
+
+
+### 2026-10-29: private worker reader and migration rejection on Server 2016
+
+The actual private configuration reader ran twice in the same Windows PowerShell
+5.1.14393.693 process on the owned Server 2016 build 14393 company VM, accepted
+private fixture input, and rejected an explicit ALL APPLICATION PACKAGES read
+ACE. Only a fake credential was used. The company service stayed running and
+the contained legacy worker stayed stopped.
+
+The migration preflight then verified a real HTTPS 401 for the previously revoked
+worker and rejected an unregistered replacement credential before creating a
+configuration or journal. The installed executable and receipt hashes remained
+unchanged. These are negative-path and reader checks, not a successful compiled
+worker migration, completed build, or reboot test. See
+[evidence](evidence/worker-private-configuration-server2016.json).
+
+Native 1.5.9 run 40828471470 completed successfully. Its complete artifact hash,
+1,254 tracked public source files, six generated bridge files, manifest hashes,
+and pinned SDK/engine identity were verified without running downloaded code.
+The recorded native security/MSI step conclusions passed; individual regression
+logs were not rechecked in this verification. This archive predates the private
+worker credential fix: do not deploy its legacy worker installer. Independent
+rebuild and runtime upgrade of 1.5.9 remain pending. See
+[source verification](evidence/aff8ff6-native159-source-verification.json).
+
+
+### 2026-10-29: compiled private-file worker checks passed on Windows
+
+Both component runs for `1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc`
+passed Windows, Ubuntu and Linux deployment jobs (six jobs total). The actual
+Windows executable accepted a protected configuration larger than the Windows
+pipe buffer and rejected app-container read access, unexpected ownership,
+oversized/malformed input and complete legacy environment fallback. Credentials
+were not reflected into captured diagnostics. The Windows PowerShell 5 input
+reader also validated two inputs in one process. The retained executable hash
+matches its test receipt; all 239 corresponding public source files were checked
+against Git before any local execution. See
+[evidence](evidence/1c43a38-private-worker-windows-checks.json).
+
+This supersedes the pending compiled-check status above. It does not yet prove
+successful migration of an installed service, authenticated package generation,
+standard-user file denial or reboot of the repaired worker. Those runtime gates
+and production signing remain outstanding.
+
+
+### 2026-10-29: repaired worker migrated, generated company packages and survived reboot
+
+The fresh Windows company retained its own HTTPS/profile/transport identity,
+branding, administrator MFA and technician accounts. The real shipped migration
+script from `f9322e5` migrated its stopped legacy worker to the lab-signed
+`1c43a38` executable, after the old credential returned 401 and the replacement
+returned 200 from the actual company HTTPS endpoint. The installed credential
+file is protected, Administrators-owned and readable only by SYSTEM and
+Administrators. The registry stores only its public path. The old executable,
+receipt and a clearly marked retention fixture survived migration.
+
+A temporary standard local account, using an actual Windows logon token, could
+read the public control file but received access denial for the worker credential
+file. The fixture account was removed; its password was neither persisted nor
+printed. The new worker generated customer and technician 1.5.9 bundles for this
+company. Anonymous customer download returned 200; anonymous technician download
+returned 401, and authenticated download succeeded. All twelve ZIP entries,
+seven fixed source texts, artifact hashes, signed bootstrap/profile/release
+content and visible company names matched their pinned inputs. Both old and new
+worker credentials were absent from both bundles. Tampered signatures and
+request-supplied release trust overrides were rejected, and unapproved releases
+could not create builds. Automatic updates remained paused.
+
+A normal Windows reboot preserved worker/server automatic startup, credential
+ACLs, the path-only registry, transport/profile/HTTPS trust, MFA, approvals,
+revocation state and the hashes of both completed installer files. The worker
+then authenticated and completed a third customer build; its public download
+passed hash verification and eleven payload entries matched the pre-reboot
+bundle. The newly signed company profile retained the same policy. A real
+technician MFA account could access the protected download but not worker,
+release or build administration; its logged-out token and anonymous access were
+rejected. HEAD checks transferred no existing bundle bytes again. See
+[runtime evidence](evidence/1c43a38-private-worker-server2016-runtime.json).
+
+This closes the specific Server 2016 worker credential-storage failure for the
+tested migration path. It does not establish fresh installation of the revised
+worker installer, other Windows worker versions, endpoint installation or native
+sessions with these new packages, automatic rollout, full Windows deployment
+restore, maintained Windows transport distribution or production signing.
+The five endpoint packages/signatures and repaired worker used only the existing
+nonexportable disposable lab key; no private signing key left its owning VM.
+The original Linux company configuration, device state and release approvals
+were retained; the frozen older company VM was not touched.
+
+The three original unsigned Windows component executables also matched byte for
+byte across the existing push and pull-request CI jobs. The PR merge tree equals
+public `1c43a38`; both corresponding-source archives verified all 239 public files.
+Shipping bytes were not normalized and no extra build was dispatched for this
+comparison. This is reproducibility evidence for these three components under
+those two jobs, not completion of the independent 1.5.9 native rebuild gate. See
+[component comparison](evidence/1c43a38-windows-components-independent.json).
+
+
+The next native artifact recipe now includes the private configuration reader,
+explicit worker migration script and directory helper beside the worker install
+and removal scripts in both retained artifact sets. The earlier 1.5.9 archive
+predates this addition and must not be used as a repaired worker distribution.
+This packaging correction is source-reviewed; the next complete native artifact
+must verify the shipped helper files before fresh-worker installation acceptance.
+
+
+### 2026-10-29: maintained Windows transport packaging integration in progress
+
+The development server component manifest now pins the twice-reproduced
+maintained Windows `hbbs`/`hbbr` executables instead of the stock upstream
+archive. Native/component workflows depend on a maintained Windows source build
+in the same run. The preparer validates the executable hashes, all 140 source
+archive entries (139 compiler/recipe files plus a separately checked build
+receipt), pinned HTTPS input and licenses before creating output. The complete
+corresponding transport source is retained through server setup and installation.
+The management supervisor, installer and package builder agree on the new
+executable pins. Source-only ZIP metadata/text endings are normalized; executable
+bytes are not modified.
+
+Ten inert-fixture verifier tests passed, including tampered binaries/source,
+forged/mismatched receipts, unsafe/duplicate names, wrong HTTPS input, existing
+output preservation and deterministic preparation across source ZIP timestamps
+and checkout endings. YAML and PowerShell syntax checks passed locally. These
+are packaging boundary tests, not a new transport compilation or Windows server
+upgrade. The next CI run must exercise newly compiled maintained inputs and the
+actual deterministic Windows server builder. The live Server 2016 company still
+uses its previously installed stock transport and original lab-signed management;
+its repaired worker and completed package evidence remain valid. Full backup,
+coordinated maintained-stack upgrade/rollback and Windows native relay pairing
+are still pending.
+
+
+The first integration run exposed a provenance regression caused by changing the
+shared recipe's descriptive scope field: the Linux transport Dockerfile fetches
+an immutable public recipe, and full receipt equality correctly rejected the
+changed local description. The shared recipe input has been restored exactly;
+Windows packaging qualification is now a separate manifest field. No provenance
+comparison was removed or weakened. Another run stopped before stack setup on a
+registry HTTP 500. Public pinned-image preflight now retries at most three times
+only after an explicit completed transient HTTP failure; authentication/missing
+manifests fail immediately and timeouts are never retried. Six boundary tests
+passed. Newly compiled maintained Windows transport succeeded in both first
+component runs; full Windows installer packaging and repaired Linux runs remain
+pending.
+
+
+The actual previously source-verified maintained Windows artifact also passed the
+new preparer with pinned Caddy and all 140 corresponding-source entries. Its
+executable bytes were unchanged. Substituting the real stock `hbbs` executable
+or modifying an archived Rust source file was rejected before output creation.
+No supplied executable ran. See
+[preparation evidence](evidence/windows-maintained-component-preparation.json).
+The first integration Windows component job then passed the actual maintained
+source build, private-worker checks and deterministic server installer compilation
+(job 123392802317, run 40856616732); its Linux deployment job failed as described
+above, so the overall integration is not yet green.
+
+The disposable Server 2016 company produced a full SWANBK2 deployment export:
+management database/configuration/keys, transport identity (its database had not
+yet been initialized), complete HTTPS storage, service environment and all three generated installers. Its
+95,990,779-byte ciphertext was collected and hash-verified; the strong passphrase
+stays separate and outside Git, and only the backup child received it in memory.
+Both services resumed. Original HTTPS/profile trust, administrator MFA, worker
+authentication, approvals/revocations and all three installer hashes remained
+valid; updates stayed paused. This proves export and resumed-service behavior,
+not full Windows deployment restore. See
+[export evidence](evidence/aff8ff6-windows-full-deployment-export.json).
+
+
+### 2026-10-29: isolated Windows recovery and missing ownership receipt fix
+
+The actual lab-signed MSVC `aff8ff6` management CLI rejected a wrong password and
+changed ciphertext without publishing targets or leaving plaintext staging. Its
+successful isolated restore recovered management signing/setup keys, HTTPS
+configuration, transport private/public keys, service environment, 13 HTTPS
+storage files (eight certificate/private-key files matched), and all three
+installer ZIPs with their recorded hashes. Restored state admits only the owning
+administrator, SYSTEM and Administrators. Original services remained running
+without restart and the worker credential was unchanged. The transport database
+had not yet been created, so its absence was correct; a test-harness check was
+corrected without repeating decryption. See
+[isolated recovery evidence](evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json).
+
+The exercise exposed a real coverage gap: the encrypted archive omitted Windows
+`installation.json`, used for safe service ownership/removal. The restored
+payload was not switched into the live service. Export now includes that receipt
+when present, requiring a nonempty regular file of at most 64 KiB and rejecting
+links/reparse points. The reader accepts it with the same size bound; older
+archives remain supported. An existing complete-backup regression now verifies
+exact receipt recovery, with added invalid-file/size and restore-publication
+boundary checks. Twelve local backup tests passed; the existing large-backup test
+remained explicitly ignored in this targeted run. Windows compilation, a new
+receipt-complete encrypted export and full running deployment restore remain
+required. Earlier SWANBK2 readers cannot restore the added entry; matching
+binary/source retention and rollback compatibility are documented.
+
+The preceding `0a95b2a` component push run 40860193687 passed Linux deployment,
+maintained Windows transport, Windows verification and Ubuntu verification.
+This establishes the transport packaging/provenance fix before the newly added
+receipt coverage; it does not qualify the new receipt reader on Windows yet.
+
+
+### Customer UI update recovery helper
+
+On a disposable Windows machine with the installed customer app open in a genuine standard-user desktop, run `deployment/windows/test_customer_ui_restart.ps1` as SYSTEM. Pass a fresh private `-Directory`, the installed `-Executable`, and a `-ResultPath` whose parent exists. The test uses real native process handles and Task Scheduler to check ownership rejection, interruption before stop and after stop/before launch, limited-user relaunch, idempotence and task cleanup. It preserves application files and the running service. It closes and reopens the test user’s customer UI.
+
+This helper result does not qualify a signed MSI automatic update or real power-loss recovery. Those require separate end-to-end receipts.
+
+
+### Native1.5.13 Unicode, RGB clipboard and interrupted file transfer
+
+A genuine Windows10 standard-user customer approved a native1.5.13+81 technician on Server2019 after fresh MFA. With both viewer clipboard directions independently verified disabled, native Notepad copy/paste/save preserved Latin accents/macron, Greek, Japanese, Arabic, emoji and symbols in both directions. A unique customer-side marker excludes a stale return clipboard. Native Paint transferred a128x96 RGB image in both directions; every pixel matched, including a single customer-side changed pixel on return. See [clipboard evidence](evidence/1513-native-unicode-and-image-clipboard-20261031.json).
+
+The separate customer-approved native file session completed a64MiB cryptographically random roundtrip. During a256MiB send, the owned customer VM virtual cable was disconnected only after2490368 actual partial bytes were observed, then restored after20 seconds. A9568256-byte partial remained. The old sender UI stayed at11% for over5 minutes without a timeout/error. Normal UI close/reopen, a fresh target-bound session and renewed customer approval allowed Send to recover the exact original268435456 bytes and remove partial sidecars. No file copying/editing/deletion, application/service restart or installation command was used for recovery. The final read-only hash verifier initially timed out; its original process was confirmed absent before collecting the subsequent durable result. See [large/interrupted transfer evidence](evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json).
+
+This qualifies the normal authorized retry boundary, not automatic transfer recovery or an independently measured resumed byte offset. Bounded stalled-send handling remains required. Technician standard-user, alpha-image, public-Internet and native1.5.14 automatic-update qualifications remain separate.
+
+### Native1.5.14 build and generated company packages
+
+[Exact-source build and bundle evidence](evidence/1514-native-build-and-company-bundles-20261102.json) records successful Windows CI, offline archive/checksum verification, 1,340 public tracked source files and all six generated bridge files. Both editions were signed with the retained nonexportable disposable lab key and generated by the existing Windows worker as company test release17. Public customer downloads and authenticated technician downloads passed, including anonymous technician rejection. Signed profiles, release metadata, payload hashes and bundled source texts matched. Automatic updates remain paused. The actual13-to14 customer update, standard-user frontend relaunch, independent rebuild and clean-OS matrix remain pending; this is not production signing approval.
+
+### Native1.5.14 real automatic update: installation passed, UI restart failed
+
+[Recorded Windows10 automatic-update result](evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json): the normal watcher installed signed release17, exact files and MSI registration passed, enrollment/trust/consent were preserved, and paused policy40 was restored without a manual installer or watcher restart. **UI recovery failed.** Both old standard-user processes survived: CIM retained the original executable path, but the held kernel image path pointed to an MSI rollback `.rbf`. The path guard correctly rejected termination. An advanced PowerShell script error nevertheless returned a successful outer status, allowing the restart marker to be removed and leaving one recovery task. A later normal reboot establishes a fresh lab fixture only. The draft pre-MSI shutdown and loader failure-propagation fixes require compiled and real automatic-update qualification.
+
+### Candidate1.5.16 pre-MSI UI recovery regression
+
+[Real SYSTEM helper evidence](evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json) passed on the existing native1.5.14 Windows10 standard-user desktop. Preparation rejected missing pending-update state and wrong signed executable hashes, retained disabled triggerless recovery before process shutdown, and closed only guarded old user processes. Injected pre-stop and post-stop/pre-launch failures preserved recovery; the original user received an unelevated GUI, temporary tasks self-deleted, fresh GUI retry was idempotent, and explicit uninstall cleanup preserved unrelated tasks. Installed files and service were unchanged. Three real PowerShell loader controls now return correct success/failure status. New Rust integration compilation and an actual14-to16 automatic MSI update remain required.
+
+### Clean Server2022 customer baseline and candidate1.5.16 component CI
+
+[Clean Server2022 installation](evidence/1514-clean-server2022-install-and-enrollment-20261102.json) passed the unchanged company1.5.14 customer bundle, all96 signed installed-file checks, automatic service/watcher startup, enrollment and default unattended-off policy without Tailscale. Pending devices were hidden and grants denied; explicit approval exposed only the permitted inventory. Unassigned technicians and unattended requests without consent were denied. This is a private-lab baseline, not public-NAT, native-session, technician or1.5.16 qualification.
+
+[Exact push-source1.5.16 company component CI](evidence/1516-company-components-and-loader-regression-ci-20261102.json) passed Windows/Linux workspace and deployment checks. The new advanced-PowerShell failure regression and interrupted-child cleanup test passed on Windows. The skipped technician MSI lifecycle job supplies no evidence; the separate native Windows build and real14-to16 automatic update remain pending.
+
+The same clean Server2022 baseline also passed controlled repair: the original signed `LICENSE.txt` was moved to a protected backup, shipping verification rejected the missing file, and the unmodified company `-Repair` restored its exact manifest hash. Shipping verification, running service/watcher, identity, credential, bootstrap trust, consent/revision and sequence17 were preserved, with no pending recovery. No interactive GUI was present; this does not qualify repair of an open customer UI.
+
+### Server2022 standard-user technician MSI: policy rejection
+
+[Real standard-user setup](evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json) failed with Windows Installer1625 on the clean Server2022 baseline. The limited interactive task used the actual non-administrator desktop owner, and the product returned an actionable policy error. No technician executable was installed; the original signed pending-setup marker was preserved and the customer service stayed running. No installer policy or AlwaysInstallElevated setting was changed. This does not qualify standard-user MSI installation on Server2022. A separately approved EXE bundle is the next distribution test; managed MSI deployment remains a distinct prerequisite/qualification. [Microsoft policy reference](https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi).
+
+### Candidate1.5.16 native build and test distribution
+
+[Native build and distribution preparation](evidence/1516-native-build-and-lab-distribution-preparation-20261102.json) verified the exact-source native artifact, manifest hashes, corresponding source archive and compiled file-transfer write-timeout regression. Five lab-signed outputs were collected with the retained nonexportable lab key. The technician EXE and both MSI test releases passed public HTTPS hash verification and release authorization negative checks, and were queued for company packaging with profile40 still paused. All three company bundles subsequently completed and passed source, signature, payload-hash and download-access verification. Customer16 installation, automatic GUI recovery, live sessions and an independent native16 reproduction remain pending. The customer EXE still requires signing its embedded executable before producing the signed outer installer; signing the outer archive alone does not qualify it. These are lab signatures, not production publisher approval.
+
+### Candidate1.5.16 standard-user technician EXE and MFA
+
+[Server2022 technician EXE](evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json) passed genuine standard-user installation through the unchanged company bundle, explicit replacement of the failed MSI setup and shipping installed-file verification. The original signed MSI failure was retained and installer policy was unchanged. The native application ran under the same unelevated desktop owner, displayed company branding and the HTTPS domain, accepted technician credentials plus TOTP, and displayed the authorized device inventory. The existing customer14 service and state were preserved. A separate-machine native connection and latest customer update remain pending; this result does not qualify the policy-rejected standard-user MSI path.
+
+### Candidate1.5.16 real automatic MSI update and UI recovery
+
+[Windows10 automatic14-to16 update](evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json) passed through the normal watcher with the real standard-user customer window open. Signed sequence19 installed exact1.5.16 files and MSI registration, preserved device identity, credential, bootstrap trust, branding and consent, and returned the running SYSTEM service/watcher. Both old user frontends stopped; fresh frontends opened under the same unelevated SID after release commit. Recovery markers and temporary UI tasks cleared, and the activity lock was available. No manual installer/update command, watcher restart or reboot was used. Company policy returned to paused revision42, and the relaunched branded window retained support-paused/unattended-off behavior. Real power interruption and latest native sessions remain separate requirements.
+
+### Candidate1.5.16 standard-user native session, transfer and interrupted recovery
+
+[Two-machine native16 evidence](evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json) passed technician16 on the actual standard Server2022 desktop connecting to the automatically upgraded Windows10 customer16. Customer approval preceded desktop access; remote keyboard and test-folder navigation were correlated on both consoles. The company recorded a claimed technician/device-bound lease. A separate file-transfer request required customer approval, and64MiB of incompressible data completed both directions with exact source hashes and no sidecars.
+
+A45-second disconnect of only the customer VM adapter followed a real2MiB partial write during256MiB transfer, and the adapter was restored automatically. Automatic reauthorization remained waiting without a visible file-transfer prompt after desktop reapproval: this is a failed recovery qualification, not a success. Cancelling only the file window and opening a fresh customer-approved transfer allowed a normal retry to finish with the exact256MiB source hash and no sidecars. No VM/app/service restart or manual data editing was used. Byte-resume offset and an exact live30-second send timeout were not independently measured. Customer Stop then left zero live authorization leases. Reauthorization recovery still needs a fix and retest.
+
+### Clean Windows11 candidate1.5.16 customer install and enrollment
+
+[Fresh Windows11 customer16](evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json) passed on the preserved product-free Enterprise Evaluation x64 build26300 fixture. After correcting a lab archive-filename reference before invoking the product installer, the unchanged company MSI bundle installed all96 signed files, enrolled a new device, and started the service/watcher with profile42, unattended consent off and no Tailscale. Pending inventory and grants were denied; explicit approval exposed only this new device to authorized technicians. Unassigned technicians and unattended requests without consent remained denied, and other device records were unchanged. The unchanged technician MSI also installed successfully under the genuine unelevated desktop owner, passed shipping verification, and opened the company-branded native app. Technician credentials plus TOTP displayed the authorized device inventory. A normal reboot, including Windows servicing, preserved enrollment, credential, trust, consent and native configuration. The SYSTEM service and configuration watcher started automatically; shipping verification passed, no unclean-shutdown events appeared, and the headless service loaded no Flutter or desktop plugins. Native Windows11 sessions and repair/upgrade/uninstall remain pending.
+
+
+### Candidate1.5.17 consent-window fix, company bundles and technician upgrade
+
+[Candidate17 evidence](evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json) verifies the complete public source, generated bridge, artifact hashes, two timed approval-window regressions and three compiled transfer backpressure tests. The current test output was retained from the GitHub job because the artifact upload omitted that log; the upload lists are fixed for subsequent builds. Windows x64 and company-component checks passed. The broader inherited matrix failed only its deferred i686 build because its old Cargo cannot read lockfile4. No independent native17 rebuild is claimed.
+
+The retained nonexportable lab identity signed five outputs; the real company worker generated technician EXE20 and both MSI21 bundles. Public customer and authenticated technician downloads, signed profile/release metadata, payload hashes and seven exact source texts passed verification. Bad signatures, request-supplied trust overrides and unapproved builds remained rejected. Automatic updates stayed paused at signed revision42. The genuine standard Server2022 account upgraded its technician16 EXE to17, preserved identity/trust, passed shipping verification, and signed in with MFA to the branded authorized inventory. Windows10 then completed a real watcher-driven16-to17 MSI21 update with the standard customer GUI open. Signed installed files, trusted publisher, MSI registration, original identity/credential/bootstrap/consent, SYSTEM service and normal-priority watcher all verified. The old frontends stopped, fresh frontends started under the same standard SID after release commit, recovery tasks/markers cleared and the activity lock was available. Signed paused policy44 synchronized through the normal watcher, with branding/support-paused/unattended-off behavior preserved. No manual installer/update command or watcher restart was used. Real interrupted-transfer consent recovery, remaining lifecycle/OS qualification and production signing are still pending.
+
+
+### Candidate1.5.17 live interruption: hidden-consent qualification still fails
+
+[Native17 live recovery evidence](evidence/1517-native-interruption-consent-visibility-failure-20261103.json) passed a customer-approved desktop between actual standard-user endpoints and a separately approved64MiB file roundtrip with exact hashes. A guarded45-second disconnect of only the Windows10 adapter followed an actual2490368-byte partial during a fresh256MiB transfer; restoration required no app/service/VM restart. Desktop and file reapproval prompts arrived. Approving only the desktop still minimized the approval manager with file consent pending. This is a failed17 visibility qualification despite the passing timer tests.
+
+Manually restoring the existing approval window and accepting its pending file request allowed the original transfer to finish with the exact256MiB hash and no sidecars. No file-session cancellation, reopening or fresh transfer retry was used. Resume byte offset and an exact live30-second send timeout were not measured. Customer Stop then left zero live authorization leases. The remaining cause is three direct minimize calls in approval/elevation button handlers, outside the timer guard. Candidate18 removes these calls and schedules the guarded controller after acceptance/elevation; a source-architecture regression now rejects these actual17 handlers. At this test checkpoint, candidate18 compilation, timed tests and the full live recovery retest remained required.
+
+### Native1.5.18 primary build and exact source verification
+
+[Native18 build evidence](evidence/1518-native-build-and-exact-source-verification-20261103.json) records the successful primary Windows build from source323d6ef, all shipping checksum matches, comparison of1,358 public tracked source files and all six generated bridge files, and the pinned SDK/engine identities. The archived native logs show all three approval-window regressions and all three compiled file-write timeout tests passing. Unsigned extraction verified95 customer payload files without executing them. This establishes build and source verification only: lab signing, the live interruption/consent test, independent native reproduction and production publication remain pending. Native17's failed visibility result is retained.
+
+### Native1.5.18 signed-inner customer EXE producer
+
+[Customer EXE producer evidence](evidence/1518-signed-inner-customer-exe-producer-20261103.json) records a real Windows compilation around the already signed native18 customer executable. All six native packer tests passed. The retained nonexportable lab key signed and timestamped the outer EXE; all95 embedded files matched the final manifest both in the guest and independently after collection. A deliberately wrong inner-executable hash was rejected on the actual signed artifact. The executed producer scripts match public commit77f0a19 exactly. The source bundle combines the exact runtime archive with that supplemental producer source and build provenance; it contains no company settings or private keys.
+
+The producer now handles ordinary Cargo stderr correctly in Windows PowerShell5.1, fails on nonzero exits and missing tools, requires pinned Git and a short source cache, and verifies the resource compiler actually selected by the registered Windows SDK. Eight Python packaging/security tests and real PowerShell command-boundary checks passed. This qualifies release-producer compilation and verification with lab signatures. Production signing approval, fresh EXE installation, lifecycle/OS qualification, independent reproduction and the native18 live consent-recovery test remain required.
+
+### Native1.5.18 company-generated EXE and MSI bundles
+
+[Four-bundle evidence](evidence/1518-company-generated-exe-msi-both-editions-20261103.json) verifies actual Windows worker generation of customer EXE24, customer MSI23, technician EXE22 and technician MSI23 bundles. Both customer downloads succeeded anonymously. Both technician downloads rejected anonymous requests and succeeded with authentication. Each bundle contained exactly the expected12 files, seven exact public source texts, public-only bootstrap fields, valid signed profile/release metadata and matching signed artifact/agent hashes. Invalid signatures, attempted request trust overrides and unapproved generation were rejected before approval. Company policy stayed unchanged and automatic updates stayed paused. Installation, native18 session behavior, OS/lifecycle qualification and independent reproduction remain separate requirements.
+
+### Native1.5.18 standard-user technician upgrade and graphical MFA
+
+[Technician18 evidence](evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json) records the shipping company EXE upgrade from sequence20 to22 on Server2022 build20348 under the existing standard account. Setup and the shipping installed-identity verifier passed; identity and bootstrap trust stayed unchanged. The running GUI reports1.5.18+86. Its executable and actually loaded protocol/Flutter libraries match the primary pinned build. Graphical MFA sign-in succeeded and displayed the authorized inventory with synchronized company branding. The original screenshot hash is retained. Two fixture annotation/pin errors were corrected using independent state and the verified release metadata; original failed evidence remains retained and product inputs were unchanged.
+
+A second actual native MFA login using the unassigned technician account showed no authorized devices or session history. An independent authenticated API check confirmed the empty inventory and rejected an attended grant for a real approved device with403 using a valid fresh proof key. Device approval/group/consent values and signed profile44 stayed unchanged; updates stayed paused. No successful grant or native session was created.
+
+This proves this technician upgrade, graphical login and this unauthorized grant boundary. Receiving-device bypass tests, fresh customer EXE installation, native18 interruption/consent recovery, the remaining Windows/lifecycle matrix, external transport, independent reproduction and production signing remain open.
+
+### Native1.5.18 explicit customer upgrade: existing-window failure
+
+[Open-window upgrade evidence](evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json) records the actual Server2022 customer MSI upgrade from14/sequence17 to18/sequence23 using the shipping explicit administrator setup while the standard user's customer status window was open. The installed payload verifier passed, service/watcher ran, and identity, credentials, consent, bootstrap and profile44 were preserved. Automatic updates stayed paused.
+
+Acceptance failed: the original customer GUI process survived. Kernel mapped-file metadata places its executable, protocol library and Flutter engine in MSI rollback storage, while the installed files report1.5.18+86. The visible window lost company branding, displayed “Company setup is not complete”, and became Not ready. No Swan file-renaming reboot operations were pending. Explicit setup needs the same safe preparation and durable user-interface restoration already used by automatic updates, including the administrator-to-SYSTEM handoff. This is a release gate; neither this upgrade nor same-release repair is qualified.
+
+### Native1.5.19 recovery candidate: build and source verification
+
+[Candidate19 build evidence](evidence/1519-native-build-and-source-verification-20261103.json) records the successful Windows build from public sourcea3fedd9, all shipping checksum matches, comparison of1,372 public tracked source files and all six generated bridge files, and the pinned SDK/engine. All95 extracted customer files match the verified MSI manifest. The Windows and Linux component gates passed before the version bump, including the actual Windows PowerShell SYSTEM task-broker test. The native build also passed its authorization regressions, headless customer MSI service test and unsigned technician MSI lifecycle checks.
+
+This candidate includes the explicit setup recovery described in [the recovery design](EXPLICIT_SETUP_UI_RECOVERY.md). The original native18 failure remains a failed acceptance result until a signed real upgrade and same-release repair replace the open standard-user window, restore company controls and verify the actually loaded files. Live pending-consent recovery, the full Windows matrix, external transport, independent reproduction and production signing remain required. Build and component results do not qualify those runtime or release gates.
+
+### Native1.5.19 customer MSI recovery, upgrade and same-release repair
+
+[Customer recovery evidence](evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json) records the first refused attempt and the subsequent real tests on Server2022 build20348. The original GUI left by native18 was still mapped into Windows Installer rollback storage. CIM reported its normal installed path, but the native process-image query reported the rollback path. Preparation refused that mismatch before MSI execution, retained its signed marker and left installed sequence23 unchanged. The process-identity guard was kept intact.
+
+A normal lab reboot preserved identity, bootstrap and consent. No state or marker was manually removed. With the verified installed native18 window open under the original standard account, the exact same company package completed the pending upgrade to native19/sequence25. The old process exited, a new limited-user window restored company branding, approval/stop/consent controls and Ready status, and recovery markers cleared. Kernel mapped-file metadata placed the executable, protocol library and Flutter engine in the installed directory; their hashes matched the signed main executable and pinned primary native build.
+
+A separate shipping `-Repair` run then replaced the open native19 window again, kept the exact release sequence25 and preserved identity, trust and consent. The new process and all three mapped images passed the same independent checks. Service and watcher remained running; profile44 stayed selected and unattended consent stayed off. These results qualify these explicit customer MSI scenarios on this one OS. They do not qualify the other Windows versions, fresh EXE19 installation, the remaining lifecycle/session cases, external transport, independent reproduction or production signing.
+
+
+### Candidate19 standard-user technician EXE upgrade and MFA (2026-11-03)
+
+On the existing Windows Server2022 build20348 lab desktop, the company-generated technician EXE24 upgraded EXE22 under the original non-administrator account. The shipping verifier passed, identity and bootstrap trust were preserved, and profile44 remained active with automatic updates paused. Actual native executable1.5.19+87 and loaded protocol/Flutter libraries matched the verified primary build from a3fedd94e38d902164db90321bcf397c85a6c12b. Graphical MFA sign-in displayed the authorized inventory and configured company branding.
+
+A separate native MFA sign-in using an unassigned technician displayed no devices or history. An independent authenticated request with a valid fresh proof key received403 for an attended grant to a real approved device. No successful grant or support session was created, and device approval, group and consent stayed unchanged. Evidence: [technician19 test](evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json).
+
+This verifies this upgrade/login and server authorization boundary only. Receiving-device bypass and live session tests, clean customer EXE19 installation, interrupted update recovery, the remaining Windows lifecycle matrix, external public transport, independent19 reproduction and production signing remain open.
+
+
+### Candidate19 clean Windows10 customer MSI installation and reboot
+
+A fresh standard Windows10 Pro22H2 x64 installation reached build19045 using the existing verified Microsoft media. First-logon provisioning completed; the stopped disk was inspected read-only and preserved as a hashed, read-only clean baseline with a separate test overlay. Before product setup, the networked overlay had no Swan installation, compiler, Tailscale, trusted lab publisher or VC runtime registration. Automatic logon was disabled and its saved password removed.
+
+After importing only the public disposable lab trust certificates, the existing company-generated customer MSI25 installed native1.5.19, enrolled automatically, synchronized profile44, verified all96 installed files and started the service and watcher with unattended consent off. A normal OS reboot preserved device identity, credential, bootstrap trust, consent and sequence25; service/watch and the shipping verifier passed again. [Evidence](evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json).
+
+Graphical runtime remains unqualified on this clean fixture: console keystrokes rejected a saved administrator password that a separate private Windows authentication check accepted. A genuine standard test account was created without changing administrator credentials; USB-only input diagnosis is pending on the same overlay. These installer/service results do not qualify graphical sessions, customer EXE19, the complete Windows10 lifecycle, the remaining OS matrix or production release signing.
+
+The newly enrolled customer remained pending approval with unattended consent off. The otherwise authorized technician could not see it in its authenticated inventory, and a grant request with a fresh valid proof key received403. Device approval/group/consent and session history stayed unchanged. This verifies this server-side enrollment boundary; receiving-device bypass and graphical runtime remain separate tests.
+
+
+### Candidate19 customer EXE producer and corresponding source (2026-11-04 local)
+
+The original retained Windows builder compiled the customer EXE from exact public sourcea3fedd9 around its already signed native19 executable. All six actual native packer tests and all95 embedded-file hashes passed. The existing nonexportable disposable publisher key signed and timestamped the outer EXE. After collection, an independent host parser verified the same95 embedded files and rejected a deliberately wrong inner manifest. The producer sources match the runtime commit exactly; the corresponding-source bundle includes that archive, producer files, toolchain pins, license and build provenance, with every entry verified. [Evidence](evidence/1519-signed-inner-customer-exe-producer-20261104.json).
+
+This establishes producer/signature verification with lab trust only. Clean EXE19 installation, independent producer reproduction, graphical/live session qualification and production signing remain separate requirements.
+
+
+### Candidate19 four company-generated installer formats
+
+The retained Windows worker generated the new customer EXE26 after explicit release import and approval. Its anonymous download passed; all12 bundle entries, seven exact public source texts, six public-only bootstrap fields, profile/release signatures and artifact/agent hashes were independently verified. Invalid signatures and trust-key overrides received403, and an unapproved build request received409 before approval. The worker then stopped normally. Together with the previously verified technician EXE24 and both MSI25 bundles, [this evidence](evidence/1519-company-generated-both-editions-exe-msi-20261104.json) covers all four candidate19 company bundle formats and their public/protected downloads. No prior bundle was downloaded again. Automatic updates remained paused. Fresh EXE installation, graphical/session qualification, the full Windows lifecycle matrix, independent reproduction and production signing remain open.
+
+
+### Candidate19 customer EXE26 fresh-install failure and producer correction
+
+The company-generated EXE26 failed its actual fresh installation on the separate clean Windows10 build19045 overlay: shipping setup could not find `Swan Remote Support.exe`. Read-only inspection found `rustdesk.exe` and the native libraries in the correct Swan program directory, with the signed pending-install marker retained and no installed-release record. The installer was not retried. [Failure evidence](evidence/1519-customer-exe26-fresh-install-failure-20261104.json) supersedes any interpretation of the prior packer/signature tests as installation qualification.
+
+The native Flutter installer copies the payload directory without renaming its executable. The producer incorrectly packed `rustdesk.exe`; its verifier also normalized that name into the installed manifest name, concealing the mismatch. The correction stages the unchanged signed main bytes under the stable installed name, selects that entry point, and compares embedded filenames literally. Ten packaging tests pass, including directory-copy installation semantics and rejection of the old layout; the corrected verifier also rejects the actual failed signedEXE26. The host PowerShell native-command boundary regression passes. A replacement Windows build, lab signature and fresh/recovery installation tests are still required.
+
+Approvals for customerEXE26 and the earlier same-producer customerEXE24 were withdrawn through the management API. Both release records and failed artifacts remain retained. Other approvals and signed policy44 stayed unchanged; automatic updates stayed paused. This withdrawal applies only to the disposable company lab.
+
+After normal shutdown, read-only disk collection independently hashed the wrongly named installed main file: it exactly matched the already signed native19 executable. The device was not enrolled, consent stayed off and signed pending-install26 remained intact. The withdrawn EXE24/26 bundle URLs both returned404, and new build requests for them returned409 without creating jobs. The host setup failure and original artifacts remain retained.
+
+
+### Candidate19 corrected customer EXE28 clean installation and reboot
+
+The corrected producer from dbab5fb and company setup recipe from332af85 generated customer EXE28 around the unchanged signed native19 runtime. On a separate product-free Windows10 Pro x64 build19045 overlay, a single elevated shipping setup invocation installed successfully without terminating the tray, renaming executables, starting services manually or retrying installation. All95 installed files passed shipping verification; the new device enrolled with unattended consent off, profile44 and sequence28. The service and configuration watcher ran without Tailscale. A real subsequent OS reboot preserved device identity, token, bootstrap trust and consent; verification, service and watcher passed again.
+
+The pending device remained absent from technician inventory, and a valid-proof grant request received403 without changing approval, consent or session history. [Clean-install evidence](evidence/1519-customer-exe28-unassisted-clean-install-20261104.json). This supersedes earlier pending clean-EXE statements for this particular OS and corrected package. Interactive elevation, the fresh standard-user graphical checks, full repair/uninstall/session lifecycle, other Windows versions and production qualification remain separate requirements.
+
+### Coordinated management and worker update to332af85
+
+The exact canonical Linux deployment recipe built source332af85 and passed fresh-company runtime tests. Before updating the existing lab company, an encrypted complete backup was authenticated in an isolated offline restore: a wrong passphrase was rejected, both databases were valid, configuration and keys were preserved, and48 installer artifacts plus six TLS identity files matched. The live management update preserved the existing company state. The Windows worker then upgraded to the matching lab-signed binary while preserving its protected configuration and customer identity/consent.
+
+That worker generated both customer and technician EXE/MSI bundles with the current seven public setup scripts. All four bundles passed independent profile, signature, hash, bootstrap and exact-source verification. Customer downloads were public; technician downloads required authentication. Updates stayed paused. [Coordinated update and recovery evidence](evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json). This does not qualify independent canonical binary reproduction, the complete Windows matrix or production signing.
+
+A separate shipping `-Repair` invocation on that EXE28 installation also passed. Device identity, token, bootstrap trust, consent and release sequence28 stayed unchanged; profile44, installed-file verification, running service/watcher and absence of pending recovery were confirmed. No manual tray termination or file changes were needed. Uninstall, interactive elevation and the remaining lifecycle/session cases are still unqualified.
+
+On the same clean EXE28 fixture, the created standard account reached its desktop and launched the actual native19 app. Independent mapped-image checks matched the signed main and both runtime libraries. Configured company name/logo and customer-approval status appeared; Stop changed the status to paused and Resume restored Ready. The explicit unattended prompt displayed the company domain and sign-in-screen scope; Cancel returned without accepting consent. Actual opt-in/revocation and live-session qualification on this fixture remain separate. The one-time lab sign-in fixture restored the original encrypted Windows setting and disabled automatic sign-in; its completed cleanup task required separate removal after its time limit. No credential was reset or published.
+
+
+### Candidate19 EXE28 uninstall failure and source correction
+
+The actual native EXE28 uninstall on the clean Windows10 fixture removed the main application, shortcut, service and configuration task, but retained `ProgramData/SwanRemoteSupport/swan-agent.exe`. No agent was running and the uninstall cancellation marker was retained. The bounded shipping removal test failed; it was not retried. This prevents full EXE28 uninstall acceptance.
+
+The correction embeds a fixed final completion script after native removal. It requires the main application, service and configuration task to be absent and the installed agent not running, then removes only the fixed agent executable. Identity/consent data and the uninstall cancellation marker remain. Windows PowerShell regression checks cover missing/invalid cancellation, invalid agent shape, exact-file removal, retained state and idempotence. The new source component removed the real leftover agent in the failed disposable installation while keeping managed-state bytes identical. That manual component run is not corrected shipping-installer acceptance: a rebuilt native executable and full uninstall retest are still required. [Failure and scoped correction evidence](evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json).
+
+After the source-component cleanup, the unchanged signed EXE28 company bundle passed an explicit shipping `-Repair` reinstall. It cleared uninstall cancellation, restored the verified payload and running service/watcher, and preserved identity, token, bootstrap trust and consent0/off at sequence28/profile44. This qualifies explicit reinstall from that retained lab state; it does not turn the failed original uninstall or manually applied completion component into a passing full shipping lifecycle.
+
+
+### Independent canonical Linux management binary reproduction
+
+A second no-cache compilation of exact public source332af85 used the unchanged canonical Dockerfile, identical verified source context and pinned official Rust1.90 builder, with a new build and no compiled layer reuse. Both original management executables have SHA256 `85f0c22fc09334711425662299a3d048e65591faebc64428a125d91f557369a0`; neither binary was normalized. The separate image then passed the actual shipped fresh-company harness for setup, MFA replay rejection, enrollment/policy, restart persistence and backup/restore including wrong-passphrase rejection. The existing company image stayed unchanged.
+
+The OCI image IDs differ; this verifies management executable reproducibility, not byte-identical container images. [Evidence](evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json). Native20 installer lifecycle, all-Windows session/upgrade qualification, external public transport and production signing remain open.
+
+
+### Independent corrected customer EXE producer reproduction
+
+The corrected dbab5fb producer independently rebuilt the customer EXE around the unchanged signed native19 payload from public runtime sourcea3fedd9. The new invocation used fresh source and target directories, the pinned original tools and verified dependency-source cache, without reusing compiled target outputs. Both original unsigned installer files have SHA256 `9cc4d6774927c45053f9ae8aafbfbbffad6a4dc0f68f59cc336a505b3732da2c`; no binary normalization or second outer signature was used.
+
+All collected bytes and executed public producer-source hashes were checked independently. Six real native packer tests and ten Windows packaging tests passed. A separate host parser verified all95 embedded files without executing the payload. The original installed customer, device identity, consent, keys and disks were preserved. [Evidence](evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json). This closes corrected candidate19 producer reproduction; it does not qualify the new native20 executable, its shipping uninstall, all Windows versions or production signing.
+
+The distinct native20 candidate is source `fdba6c0461bdfc2c62e3c62c3c2e6f28dd779ecc`, version1.5.20+88 with pinned engine `source-candidate-05d5369`. Its exact-source company component run41773268489 passed all required Windows/Linux jobs; optional technician MSI lifecycle was skipped. Manual native build41775985694 was submitted once and its actual head verified before these evidence-only documentation updates. Its build/signature and full shipping uninstall retest remain pending. The separate broad upstream Flutter matrix has an out-of-scope 32-bit job failure before compilation because its legacy toolchain cannot parse Cargo.lock version4; this is not evidence of a successful full Flutter matrix.
+
+
+### Managed-edition About entry (candidate21 source; runtime qualification pending)
+
+The dedicated customer and technician screens now expose a shared About button directly, including before technician sign-in. The scrollable dialog shows the company display name, actual native version, Swan Remote Support/RustDesk attribution, AGPL-3.0 notice and fixed HTTPS links to project source, the full AGPL text and upstream source/notices. Addresses remain selectable if a browser cannot open. This view receives only public company branding and a native version callback; it does not receive authentication credentials or device tokens.
+
+This UI addition is candidate1.5.21+89 source. It is not part of the already submitted, exact-source native20 uninstall test build. Compilation and genuine desktop checks of both editions, including small-window layout and dismissal, remain required before qualification. No claim of an already tested About dialog is made.
+
+
+### Candidate21 build and company packages; development checks first
+
+Native1.5.21+89 from exact sourcebd331ca completed its primary pinned-engine Windows build. Offline verification matched1390 tracked source files, six generated bridges and the95-file payload. Both MSIs, technician executable, agent and custom signed-inner customer EXE were lab-signed and collected with hash/signature checks. Six actual native packer tests and ten Windows packaging tests passed; an independent host parser verified every embedded file and rejected a wrong signed-inner manifest. This is lab signing, not production publisher approval.
+
+The existing company worker generated all four current customer/technician EXE/MSI bundles. Independent verification matched the signed company profile and release, unchanged public-only bootstrap, installer/agent hashes and seven exact public source texts. Anonymous customer downloads succeeded; technician downloads required authentication. The signed update policy stayed paused. [Build and package evidence](evidence/1521-current-build-and-company-packages-20261104.json).
+
+Development now reuses an existing customer/technician pair. Finish the app and these checks before the final Windows compatibility matrix; do not repeat every OS for each candidate. Keep one reusable VM configuration per OS and preserve only required backing files, signing keys and recovery evidence. No new VM was created for this candidate. About UI, the shipping EXE uninstall correction, current-candidate session/update lifecycle, independent reproduction and final compatibility qualification remain open.
+
+
+### Candidate21 independent build and standard-user technician checks
+
+Runs41779406214 and41798526036 built exact public sourcebd331ca independently. Both complete original artifact archives passed their published size/hash checks; the interrupted second transfer resumed only its missing range. The public comparison verifier matched1390 tracked source files, six generated bridges, recorded MSVC inputs and all eight original unsigned shipping outputs. No shipping bytes were normalized. [Independent native evidence](evidence/1521-independent-native-original-output-reproduction-20261104.json). The custom signed-inner customer EXE has a separate producer-reproduction gate.
+
+On the existing Server2022 development VM, the actual standard account upgraded its technician EXE from sequence24 to26, passed shipping installed-file verification and preserved identity/token/bootstrap. The mapped native executable and both runtime libraries matched the primary21 build. The actual About dialog showed the company name,1.5.21 version, attribution and three source/licence links before sign-in and returned correctly to login. Genuine native MFA then displayed authorized inventory. Sign-out removed inventory and cleared password/MFA fields. [Standard-user app evidence](evidence/1521-standard-technician-upgrade-about-mfa-20261104.json). This is app development verification, not the final OS matrix.
+
+No VM was created for these checks. The one-time lab logon restored its original encrypted secret and registry settings and removed its cleanup task; the temporary display timeout adjustment was also restored. The existing technician VM then shut down normally. Customer shipping uninstall, current desktop-session/update lifecycle and the remaining release gates stay open.
+
+
+### Candidate21 customer EXE30 lab metadata failure; correction in progress
+
+The real upgrade on the existing Windows10 development VM copied all95 correct EXE payload files, but shipping verification rejected a missing `LICENSE.txt`. The lab release preparation had mistakenly reused the96-file MSI installed manifest for the EXE. This is a release-preparation error: the signed installed manifest must come from the exact installer format. Setup retained pending30 and did not advance the committed sequence28; identity and disabled consent were preserved. The failure is not a passing installer upgrade. [Failure and correction evidence](evidence/1521-customer-exe30-lab-manifest-pairing-failure-20261104.json).
+
+Only customer30 approval was withdrawn. Corrected customer31 reuses the same signed app/agent/source and the exact95-file EXE manifest. The existing public embedded-payload verifier accepts that pairing and rejects the mistaken MSI manifest. Other approvals and paused profile44 remain unchanged. The existing worker is generating the corrected bundle; actual replacement recovery and shipping uninstall remain open. No additional VM or native build was created.
+
+
+### Candidate21 customer shipping recovery, uninstall/reinstall and compact About
+
+The existing Windows worker generated corrected customerEXE31 using the unchanged signed21 binary and exact95-file EXE manifest. Its public download, twelve ZIP entries, signatures, public-only bootstrap, exact setup texts and installed manifest passed independent verification. Shipping `-ReplaceFailedSetup` on the existing Windows10 build19045 VM then archived the exact signed failed30 receipt and completed sequence31. Installed verification, identity/token/bootstrap, consent0/off, service and watcher passed without manually modifying product files.
+
+The actual rebuilt native21 `--uninstall` removed the main application, service, configuration task **and agent**. It retained identity/consent and update cancellation. A separate shipping `-Repair` reinstall cleared cancellation, restored the verified payload/service/watcher and preserved the retained identity, token and trust. This closes the prior EXE28 agent-retention defect for this particular shipping21 package and OS; it does not qualify every advertised Windows version.
+
+After normal shutdown/startup on the same disk, the created standard account opened the actual installed21 app. Mapped main, protocol library and engine matched the current build. The compact About dialog wrapped the company title, displayed the version/attribution, scrolled to all three source/licence addresses and kept Close available; dismissal returned to customer controls. Stop displayed paused status and Resume confirmed success. Consent remained off. The guarded lab sign-in restored its original encrypted secret/registry settings and removed its cleanup task. [Scoped lifecycle and GUI evidence](evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json).
+
+These are focused app checks on the existing development pair. Interactive UAC, current live-session/permission and desktop-feature checks, independent custom EXE production, external transport and the final Windows matrix remain separate requirements. No new VM or native rebuild was created for the metadata correction.
diff --git a/docs/CODE_SIGNING_POLICY.md b/docs/CODE_SIGNING_POLICY.md
index 914fd819045..e5b889b43c8 100644
--- a/docs/CODE_SIGNING_POLICY.md
+++ b/docs/CODE_SIGNING_POLICY.md
@@ -1,57 +1,55 @@
 # Swan Remote Support code-signing policy
 
-## Scope
+Production publication requires provider approval, valid signatures and completed release checks. Project signing through an open-source program is an intended integration, not an approved service or a guarantee of free signing. Company signing is optional and requires its own publisher policy and keys.
 
-This policy covers Swan-authored Windows executables, DLLs, PowerShell deployment helpers, and the final Swan Remote Support installer distributed from this repository. The official Tailscale MSI is not part of the Swan build or release payload; the bootstrap downloads it from Tailscale and independently verifies its checksum and publisher.
+## Provider preparation, checked 28 October 2026
 
-Free code signing provided by SignPath.io, certificate by SignPath Foundation.
+[SignPath Foundation's current conditions](https://signpath.org/terms) require
+an existing documented release, verifiable public builds, participant MFA,
+identified reviewers/approvers and a published privacy/signing policy. Modified
+upstream code has additional visible-fork and signed-upstream requirements;
+third-party binaries cannot simply be signed as project-owned code. Approval
+remains the provider's decision. The certificate's publisher would be SignPath
+Foundation.
 
-SignPath Foundation eligibility and project approval are external gates. Until the project is accepted and the complete release passes this policy, all CI artifacts must remain clearly marked **unsigned** and must not be distributed as customer-ready software.
+GitHub currently identifies `rijff24/SwanRemoteSupport` as a public AGPL fork of
+`rustdesk/rustdesk`. This confirms the visible repository relationship, not full
+eligibility. Before [applying](https://signpath.org/apply), the repository owner
+must confirm actual contributor/reviewer/approver memberships and MFA, identify
+the eligible upstream release lineage, and supply the completed release and its
+build/source evidence. No account settings or signing roles have been changed,
+and no application or provider acceptance is claimed.
 
-## Source and responsibilities
+The existing [privacy description](PRIVACY.md) covers company-hosted data and
+support-session exposure; the hosting company supplies its operational policy.
+Publish provider attribution only after service activation. Official project
+releases and separately company-signed custom builds retain distinct trust
+policies; no company worker receives a project signing private key.
 
-- Canonical source: the public Swan-controlled GitHub fork and the immutable Git tag for the release.
-- Author/maintainer: Rijff Swanepoel (`@rijff24`).
-- Reviewer: the maintainer records a self-review while Swan is a one-person project. Security-sensitive or dependency changes should receive an independent review before signing whenever another qualified reviewer is available.
-- Signing approver: Rijff Swanepoel, using a separate MFA-protected SignPath approval step.
-- Build system: the pinned GitHub Actions workflow in `.github/workflows/swan-windows-build.yml`.
+The [official GitHub integration](https://docs.signpath.io/trusted-build-systems/github)
+requires a previously uploaded workflow artifact and, for OSS signing, hosted
+GitHub runners for the preceding build jobs. Provider organization/project/policy
+configuration, an authorized submitter credential and manual release approval
+are still prerequisites. Company-controlled installer workers are downstream
+packagers; they must not become a route to project signing keys or arbitrary
+company-build signing. Preserve existing upstream signatures or include permitted
+unsigned dependencies according to the provider's rules; our lab certificate
+exercise does not establish provider acceptance of the payload inventory.
+No application was submitted and no provider credentials or account permissions
+were changed during this review.
 
-The author and signing-approval actions must be separate auditable events even when performed by the same person. GitHub and SignPath accounts must use MFA. Shared accounts are prohibited.
+## Project releases
 
-## Approval requirements
+Use immutable public source tags, reviewed pinned build workflows/toolchains/dependencies and exact artifact/source hashes. Sign the project executables and DLLs before packaging, then sign and verify the final installer. Publish signed release metadata identifying edition, x64 architecture, supported Windows families, package/installed/agent identities, certificate fingerprint, publisher and corresponding source.
 
-A signing request may be approved only when all of the following are true:
+Keep project signing private keys with the approved signing provider. Never distribute them to company servers or workers. Company workers consume pinned unchanged project release binaries plus validated company profiles and assets. Profile text must never become a build script or shell command. Customized embedded EXE resources or publisher identity require newly signed company artifacts and corresponding public source.
 
-1. The source commit is in the canonical public repository and the release tag is immutable.
-2. The release contains no private server key, Tailscale auth key, API token, customer credential, signing key, PFX, password, or customer data.
-3. The build uses the reviewed workflow and pinned action commits, toolchains, and dependency lockfiles.
-4. The server address and Ed25519 **public** key match the documented public configuration.
-5. Automated format, parse, compile, and applicable test checks pass from a clean checkout.
-6. The inner Swan executables and DLLs are scanned, signed, timestamped, and signature-verified before packaging.
-7. The final installer is built from those signed inner files, then signed, timestamped, scanned, and signature-verified.
-8. A clean Windows 10/11 test confirms installation, Tailscale tag enforcement, numeric Swan ID registration, unattended connection, customer-visible stop/uninstall controls, reboot/logon-screen access, rollback, and uninstall.
-9. The release notes publish the final SHA-256, corresponding-source link, privacy link, known limitations, and rollback instructions.
-10. No unexplained files or unreviewed changes remain in the release tree.
+Verify Authenticode trust, publisher, signing-certificate SHA-256 and signed artifact hashes before executing installation or updates. Company administrators approve imported release metadata before rollout. Signing does not substitute for enrollment, receiver authorization or acceptance testing.
 
-An approver must reject a request if the source commit, workflow run, artifact hash, expected publisher, or test evidence cannot be matched exactly.
+## Release gate
 
-## Tailscale boundary
+The maintainer must match source commit, workflow run, artifact hashes, publisher policy and recorded test evidence. Complete clean-machine installation, repair/upgrade/recovery/uninstall and native authorization/session tests for every advertised Windows family. Preserve identity, enrollment, consent, branding and permissions. Publish source and known limitations with each release.
 
-Swan does not sign, modify, or represent the Tailscale Windows client as a Swan product. The deployment bootstrap accepts the official Tailscale package only if both the pinned hash and valid `Tailscale Inc.` Authenticode organization match. A mismatch is a hard failure. The temporary MSI is removed after the attempt.
+Until these gates pass, mark build artifacts as development/unsigned and do not publish them as customer-ready production software. Local test certificates and development release keys stay in isolated protected test environments. A test-signed package is not a trusted production release.
 
-This separation is intentional for licensing, provenance, update safety, and SignPath review. A future monolithic bundle must not be released unless Tailscale redistribution terms and SignPath's proprietary-component rules have been reviewed in writing.
-
-## Key protection and incident response
-
-No signing private key is stored in this repository or on a general-purpose developer PC. Signing is performed by the approved hosted service with MFA and auditable approval. Signing credentials may not be printed, copied to issue comments, or exposed to pull requests from forks.
-
-If a signing account, workflow, release artifact, maintainer device, or customer credential may be compromised:
-
-1. Stop publication and customer installation immediately.
-2. Revoke affected repository/session credentials and notify SignPath where signing trust may be affected.
-3. Remove or mark the release unsafe without rewriting the source history needed for investigation.
-4. Preserve hashes, workflow logs, and relevant security evidence without publishing customer secrets.
-5. Rotate affected Swan passwords, Tailscale node identities/tags, and server secrets as applicable.
-6. Publish a clear security advisory and a clean replacement release only after root-cause review and full revalidation.
-
-See [Security Policy](../SECURITY.md), [Privacy](PRIVACY.md), [Windows signing process](WINDOWS_CODE_SIGNING.md), and [Tailscale deployment](TAILSCALE_DEPLOYMENT.md).
+The original single-company signing and Tailscale deployment instructions remain in the tagged baseline. Tailscale is not a required component of new company packages. See [the acceptance report](ACCEPTANCE.md) for remaining signing, packaging and native test work.
diff --git a/docs/CONSENT_SYNC.md b/docs/CONSENT_SYNC.md
new file mode 100644
index 00000000000..d0d48c430fa
--- /dev/null
+++ b/docs/CONSENT_SYNC.md
@@ -0,0 +1,37 @@
+# Unattended consent synchronization
+
+The receiving device's durable consent is required for unattended access in
+addition to company policy and a valid server grant. Revocation is written
+locally before attempting HTTPS synchronization. An offline server cannot
+prevent local revocation.
+
+The customer agent's `watch` loop retries a disabled local consent choice every
+five minutes, after reloading the latest saved state. It never enables consent
+in the background. A pending device's request may be rejected until company
+approval; local unattended access remains disabled.
+
+`PUT /api/v1/device/consent` requires an authenticated device and JSON containing
+`unattended` (boolean) and `revision` (nonnegative integer within SQLite's signed
+integer range). The server records the revision transactionally with the choice.
+Lower revisions receive HTTP 409. Equal revisions are idempotent, with disabled
+consent taking precedence over a conflicting enable request. Repeated unchanged
+requests do not create audit events.
+
+Explicit enable requests propose the next local consent revision and must be
+accepted by the server before persisting enabled consent. Persistence rejects
+an enable response if another process changed consent while it was pending.
+The customer must confirm again in that case. A later revocation is durable
+locally and its retry cannot be overwritten by that older enable response.
+
+This changes the development API: older clients sending no revision are
+rejected rather than permitted to bypass ordering. Upgrade the server and
+endpoint components together before testing this development build. This is
+not a production compatibility promise. The additive consent-revision table
+is included in management database backups.
+
+Component tests cover ordering, same-revision conflicts, idempotency, and stale
+local enable responses. A real isolated HTTPS test with built agent/server
+executables also passes: simulated outage, durable local revocation, unchanged
+server consent during the outage, and background synchronization denying
+unattended grants after recovery. This uses a test transport ID; native Windows
+controls and actual unattended sessions remain unverified.
diff --git a/docs/CUSTOMER_EXE_PRODUCER.md b/docs/CUSTOMER_EXE_PRODUCER.md
new file mode 100644
index 00000000000..aac4dfa023d
--- /dev/null
+++ b/docs/CUSTOMER_EXE_PRODUCER.md
@@ -0,0 +1,125 @@
+# Customer EXE release producer
+
+`deployment/windows/Build-CustomerExe.ps1` rebuilds the portable outer installer
+after the installed customer executable has been signed. Signing the old outer
+installer alone leaves its embedded executable unchanged and does not produce a
+trusted customer installation.
+
+This tool is for project release maintainers or a company's explicitly controlled
+signing environment. The default company worker continues to consume approved,
+unchanged project artifacts and package their public bootstrap/profile assets.
+Company profile fields cannot select source code, compiler commands or scripts.
+Project signing keys must remain with the project's signing provider.
+
+The input payload may name its signed main executable `rustdesk.exe`. The
+producer stages those unchanged bytes as `Swan Remote Support.exe` and uses that
+name as the portable entry point. The native Flutter installer copies the
+payload directory without renaming its executable; the staged names must
+therefore match `installed_files` exactly. Verification must not translate an
+embedded `rustdesk.exe` into the expected installed name. A valid signature and
+matching content hash alone do not establish a usable installed service or
+shortcut.
+
+## Inputs
+
+Use a Windows x64 build environment with Rust/Cargo1.90.0, Microsoft C++ tools and
+a Windows SDK. Rust's [1.90.0 release](https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/)
+and Microsoft's [Build Tools component reference](https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools?view=vs-2022)
+identify the tools. Initialize the compiler's normal `PATH`, `LIB` and `INCLUDE`
+environment before invoking the producer. The Windows SDK must be registered:
+the pinned winres MSVC backend selects it through the 32-bit Installed Roots
+registry key, rather than searching `PATH`. The producer checks that the actual
+selected resource compiler matches the trusted Microsoft tool on `PATH` and
+records its hash. Python3.12.10, brotli1.1.0 and pinned
+Git2.x are required. Cargo resolves the complete public workspace lockfile,
+including Git dependencies, even when compiling the portable member. Provide
+network access to those pinned public sources; the producer keeps `--locked`.
+Use a protected, dedicated local Cargo cache with an absolute path of at most24
+characters, such as `D:\SwanCargo`. Git submodule paths in the full workspace can
+otherwise exceed Windows path limits before the portable crate compiles. Existing
+cached source objects may be reused; the pinned workspace lockfile still selects
+the exact commits and checksummed crate versions.
+The producer changes its own process environment and restores it on exit.
+
+Prepare these independently verified inputs:
+
+1. The native build's `SwanRemoteSupport-build-source.zip`, its SHA-256 and exact
+   public source revision. Verify its complete corresponding source against Git,
+   including pinned submodules and generated bridge files, before production use.
+2. The final Flutter payload directory, including a signed `rustdesk.exe` from
+   the intended release publisher. Retain the other native libraries and assets.
+   Build the final `installed_files` manifest from this directory **after** signing:
+
+   ```text
+   python deployment/windows/generate-payload-manifest.py --edition customer --source SIGNED_PAYLOAD --output customer-installed-files.json
+   ```
+
+3. The trusted publisher certificate's SHA-256, exact compiler/linker/Git executable
+   paths and their SHA-256 pins. Preserve the compiler, SDK, dependency and provider
+   identities used for the release. Do not take these pins from a company profile.
+
+Use a new work directory and output path. Existing work and artifacts are retained
+instead of overwritten. A representative invocation is:
+
+```powershell
+./deployment/windows/Build-CustomerExe.ps1 `
+  -SourceArchive $nativeSource -SourceArchiveSha256 $nativeSourceHash `
+  -SourceRevision $nativeRevision -SourceDirectory $signedPayload `
+  -PayloadManifest $customerManifest -PublisherCertificateSha256 $publisherHash `
+  -CargoExe $cargoExe -CargoSha256 $cargoHash `
+  -RustcExe $rustcExe -RustcSha256 $rustcHash `
+  -GitExe $gitExe -GitSha256 $gitHash `
+  -LinkExe $linkExe -LinkSha256 $linkHash -PythonExe $pythonExe `
+  -CargoHome $shortCargoCache `
+  -WorkDirectory $newBuildDirectory -Output $unsignedInstallExe
+```
+
+The output name must end in `-unsigned-install.exe`. The source archive and each
+declared source file are checked before staging. Payload links, undeclared files,
+hash changes and ambiguous Windows paths are rejected. The staged inner executable
+is checked again for the expected trusted publisher. The only resource
+transformation removes the `dpiAware` lines, matching the native portable-installer
+build workflow; its before/after hashes are recorded.
+
+The pinned portable generator compresses the exact staged payload and rebuilds
+the packer with `cargo build --locked --release`. Native packer tests must pass.
+An independent parser checks every embedded file against the final manifest
+without running the payload. Its result proves matching bytes; Authenticode trust
+is established separately by the PowerShell producer and final signing checks.
+Windows PowerShell 5.1 accepts normal native stderr progress and checks the actual
+exit code; a nonzero exit or missing tool fails the build. Run
+`test_customer_exe_native_output.ps1 -PythonExe PATH_TO_PYTHON` to check that boundary.
+
+## Signing and release approval
+
+The producer leaves the outer EXE unsigned. Sign a new copy through the approved
+provider or [company signing integration](../deployment/windows/COMPANY-SIGNING.md),
+then verify its signature, trusted publisher, timestamp and final SHA-256. Run the
+embedded-payload verifier again on that signed copy. Authenticode signing must not
+change the embedded payload:
+
+```text
+python deployment/windows/verify-portable-payload.py --package SIGNED_INSTALL_EXE --manifest customer-installed-files.json --output signed-exe-payload-verification.json
+```
+
+Use this EXE producer's final installed-file manifest as the signed release's
+`installed_files`. Run the command above against the exact list that will be
+signed in that release. The MSI recipe has a different installed-file list,
+including `LICENSE.txt`; reusing that list for an EXE can pass package signature
+and hash checks but fail installed-file verification. Preserve a failed receipt,
+withdraw that release approval, and use a newer corrected signed release with
+explicit `-ReplaceFailedSetup` recovery. Do not delete the blocking receipt or
+change already published metadata.
+
+Keep the build/signing receipts, final installed manifest, source archive and
+producer source revision/file hashes with the release evidence. Publish the
+corresponding source and producer scripts used for the release. Generate signed
+release metadata using the signed outer EXE hash and signed inner executable hash;
+the server administrator must import and approve it before company packaging or
+rollout. Any changed outer EXE also changes the technician portable artifact if
+that format is derived from it, so its release hash must be regenerated.
+
+Clean-machine installation, repair, update, reboot and uninstall tests are still
+required for every advertised OS. The producer does not attest production signing
+approval or independent reproducibility. Those gates must be demonstrated with
+the actual release artifacts. Lab signatures remain lab-only.
diff --git a/docs/CUSTOMER_INSTALL.md b/docs/CUSTOMER_INSTALL.md
index 93ba06a6e57..8758348db84 100644
--- a/docs/CUSTOMER_INSTALL.md
+++ b/docs/CUSTOMER_INSTALL.md
@@ -1,16 +1,46 @@
-# Swan Remote Support customer installation
+# Company customer installation
 
-This release is for an installation performed by Swan Computing with the computer owner's authorization. Do not proceed if the customer has not agreed to the support scope and whether access will be attended or unattended.
+The configurable product is still undergoing acceptance testing. See
+[the acceptance report](ACCEPTANCE.md) before publishing production downloads.
+Each company operates its own server and publishes its customer bundle from its
+verified HTTPS website. Customer setup does not require Tailscale or manual
+server-address changes.
 
-1. Extract the entire release ZIP to a normal local folder.
-2. Confirm Swan has published the same release version and SHA-256 on its HTTPS download page.
-3. Double-click `Install-SwanRemoteSupport.cmd` and approve the Windows administrator prompt.
-4. Complete the manual Tailscale login when the browser opens. Swan may need to approve the restricted customer-device tag in the Tailscale admin console.
-5. Wait while the installer verifies the network, installs Swan, and creates a unique device credential.
-6. Swan stores the one-time receipt in its password manager and clears the clipboard.
-7. Confirm the Swan tray icon is visible and ask Swan to demonstrate how to stop or uninstall the service.
-8. Test one authorized connection, restart Windows, and test again at the sign-in screen before considering installation complete.
+1. Download the complete customer ZIP from your support company's website.
+2. Extract the whole ZIP to a normal local folder. Keep its installer, scripts,
+   `bootstrap.json`, signed profile and signed release metadata together.
+3. Double-click `Install-SwanRemoteSupport.cmd`. Customer setup requests Windows
+   administrator approval; declining it leaves setup unstarted.
+4. Check the company's HTTPS hostname shown by setup and type that hostname to
+   confirm the company you intended to install.
+5. Setup verifies company configuration and the release's package hash and trusted
+   publisher, installs the app, and enrolls this device. No technician password or
+   reusable privileged enrollment secret is included in the public bundle.
+6. Wait for the company to approve the new device. Sessions require an authorized
+   technician and your approval by default.
+7. Ask the company to demonstrate support status, stop controls and uninstall.
+   Unattended support requires separate explicit consent; it is not enabled by
+   double-clicking the setup entry point.
 
-The installer must show a valid trusted publisher. Do not disable Microsoft Defender, SmartScreen, Windows Firewall, or another antivirus product to make the installation succeed. Stop and contact Swan through its verified business channel if the signature is missing, the publisher is unexpected, the hash differs, Tailscale requests the wrong account/tailnet, or any security product reports the release.
+Use the complete company bundle for setup. Running the generic EXE/MSI alone
+does not supply company configuration or complete managed enrollment. Managed
+deployment and explicit repair can use `Install-Company.ps1` with an explicit
+`-BootstrapPath`; see [installer repair](INSTALLER_REPAIR.md).
 
-Swan Remote Support is based on RustDesk and its corresponding source is linked from the release. The official Tailscale client is downloaded separately from Tailscale and remains a Tailscale product. See the public [privacy statement](PRIVACY.md), [security policy](../SECURITY.md), and [source/licensing information](SOURCE_AND_LICENSE.md).
+Technician bundles use the same double-click entry point and install for the
+current Windows user without requesting elevation. Obtain them through the
+company's authenticated internal download. Windows Installer policy still
+applies to technician MSI installation; company IT must arrange an approved
+deployment when unmanaged per-user packages are blocked. Technician login and
+device authorization happen in the installed app.
+
+The app retains product attribution and license information in About. Project
+binaries retain their certificate publisher even when the company customizes
+their visible branding. Missing or unexpected signatures and failed verification
+must be resolved through the support company; setup does not bypass those checks.
+See [privacy](PRIVACY.md), [security](../SECURITY.md), and
+[source/licensing information](SOURCE_AND_LICENSE.md).
+
+The original Swan-only Tailscale deployment is preserved in the
+[tagged baseline](https://github.com/rijff24/SwanRemoteSupport/tree/swan-single-company-baseline-1.4.9),
+with its original installation and build instructions.
diff --git a/docs/EXPLICIT_SETUP_UI_RECOVERY.md b/docs/EXPLICIT_SETUP_UI_RECOVERY.md
new file mode 100644
index 00000000000..5af3efc45df
--- /dev/null
+++ b/docs/EXPLICIT_SETUP_UI_RECOVERY.md
@@ -0,0 +1,40 @@
+# Explicit customer setup and UI recovery
+
+The native1.5.18 lab exposed an explicit MSI upgrade that verified its new files
+but left the customer's old window mapped into MSI rollback storage. That window
+lost its company configuration. The original failed test remains in
+[the acceptance evidence](evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json).
+
+Explicit customer preparation now reuses the automatic updater's durable,
+limited-user UI recovery. The agent holds exclusive session access, verifies the
+requested package, and writes the signed pending-install marker before closing
+an existing window. It copies only its exact release-pinned agent into canonical,
+protected customer storage and verifies that copy's publisher before a fixed
+SYSTEM task executes it. Company profile fields cannot supply commands or paths.
+
+The task broker validates the complete action, principal and task permissions.
+It continues an existing running attempt instead of starting a duplicate, and
+requires a completion receipt bound to the installation transaction, operation,
+marker and agent hashes. An old success receipt cannot complete a new attempt.
+A bounded timeout preserves the task and installation marker for recovery.
+
+After installed files and MSI registration are verified, recording restores the
+original users' windows through their existing limited interactive tokens. It
+does not collect passwords or start a user GUI as SYSTEM. The setup marker stays
+in place if restoration fails, including after installation metadata commits;
+retrying the exact verified setup can finish that transaction. Uninstall cancels
+UI restoration and removes validated broker tasks before removing user restart
+tasks. Completed helper files remain private with the existing recovery cache.
+
+The shared UI helper still requires SYSTEM. Explicit repair can prepare a missing
+executable only for a previously recorded installation and still checks each
+process's path, creation time and owner. An unrecorded existing executable must
+match the verified target; other existing software requires an explicit migration.
+
+The Windows component test uses an inert executable in empty, guarded company
+storage on a disposable runner. It tests actual SYSTEM execution, task tampering,
+hash and receipt rejection, timeout continuation and uninstall cleanup. It does
+not qualify signing or the real installer. The signed upgrade and same-release
+repair must still be repeated with an already-open standard-user customer window,
+and active-session, interruption, uninstall and Windows-version tests remain
+release gates until their actual results are recorded.
diff --git a/docs/INSTALLATION_STATUS.md b/docs/INSTALLATION_STATUS.md
new file mode 100644
index 00000000000..9b0fc4c5fd4
--- /dev/null
+++ b/docs/INSTALLATION_STATUS.md
@@ -0,0 +1,90 @@
+# Installation versions and update reports
+
+Work in progress: the management API, shared message contract, administration
+page and endpoint sender integration are implemented in source. Existing installed
+apps do not acquire reporting until upgraded. Compiled Linux agents passed real
+HTTPS reporting with approval, MFA, restart, revision and revocation checks; see
+[sender evidence](evidence/e47f614-compiled-sender-https.json). Native Windows
+update-phase qualification remains pending; this is not completed rollout acceptance.
+
+The customer watcher reports at its five-minute refresh. Technician sign-in and
+inventory refresh report using the current in-memory login. The Windows updater
+reports checking, download progress (at most once per five seconds), preparation,
+installation handoff, deferral and failure. A retained signed recovery receipt
+causes a heartbeat to report recovery rather than claim a completed installation.
+Progress for the package and replacement agent is reported separately.
+
+The protected installed-state directory holds `installation-report.json` and its
+separate lock file. These preserve the technician UUID and increasing revision
+across process restarts and upgrades, without storing authentication credentials.
+Customer identity remains the enrolled device UUID. An unreadable or conflicting
+cache defers reporting rather than silently creating another identity. Installed
+version comes from the signed recorded release matching the stored sequence;
+previously installed metadata may expire without changing that historical version.
+Missing or invalid metadata is never replaced by a guess from the agent version.
+
+Each report request has a three-second HTTP timeout. Reporting is best effort:
+failure does not stop login, inventory, updates or support. A revision conflict
+allows one bounded recovery attempt using the authenticated owner's previous
+report. The recovery checks that its local report has not already been superseded
+before persisting a higher revision. No disk lock is held during a network request.
+A busy cache lock defers the report immediately rather than waiting behind another
+process and delaying login or the updater.
+
+Reports go only to the configured company management server over its existing
+authenticated HTTPS connection. They contain installation identity, a monotonically
+increasing report revision, reported installed version/release sequence, update
+phase, optional target sequence and bounded byte progress. They contain no login
+passwords, MFA seeds, enrollment tokens, screen content or local file paths.
+
+Customer reports require an approved device credential and use that device's
+server-assigned identity. Technician reports require a current MFA-authenticated
+session and are bound to that account plus a persistent installation UUID.
+An installation's revision cannot go backward; a repeated identical message is
+idempotent and does not refresh the server's received time. Conflicting messages
+at the same revision fail. The authenticated owner can retrieve its previous
+report to recover the next local revision after an interrupted write.
+
+Administrators can read all reports. Technicians can read reports from their own
+technician installations and approved devices in their authorized groups. Device
+revocation, group removal and account disablement take effect through the same
+current permission queries used for inventory. The list is paginated, and the
+Update status page refreshes every ten seconds while open. Leaving the page or
+signing out stops refresh; an earlier response cannot repopulate the signed-out
+page. Reports older than fifteen minutes are marked as old, without claiming the
+device is disconnected.
+
+Status is informational and self-reported. It never approves a device, grants
+support access, records unattended consent, approves a release or proves the
+installed bytes are authentic. The updater must continue checking signed release
+metadata, hashes, trusted publishers, policy and session exclusion independently.
+“Installed” means the recorded version, not necessarily the latest company release.
+
+## Management storage upgrade
+
+The report table uses database schema3. A schema1/2 upgrade requires
+`SWAN_BACKUP_PASSPHRASE` in private process environment configuration. Management
+first exports an encrypted `pre-upgrade-vN-*.swan-backup`, then applies schema and
+key initialization in one transaction. A failed migration rolls back its DDL.
+Fresh companies start directly at schema3. Existing deployments still need their
+coordinated full deployment backup, including installer/TLS/transport data.
+
+To roll back to a schema2 server, stop management, use the retained new management
+binary to restore the pre-upgrade archive into an empty replacement directory,
+and only then run the older binary against that restored schema2 data. Releases
+before streamed backup support cannot consume SWANBK2; even a previous release
+that understands that envelope must refuse a newer unsupported database schema.
+Preserve the original upgraded data separately, keep public endpoints unavailable
+and reconcile revocations/consent changes made after the backup before exposure.
+The pre-upgrade archive preserves the original schema; it does not merge later
+changes automatically. See [backup and restore](SERVER_BACKUP.md).
+
+## Verification boundaries
+
+HTTP component tests cover owner binding, role/group filtering, report replay,
+revocation/disablement, pagination, foreign-company credentials and the fact that
+status writes cannot create grants or consent. Migration tests cover backup
+requirements, original schema/key recovery and rollback of failed DDL. Browser
+contract checks cover escaped names, progress display, pagination, refresh lifetime
+and late responses after sign-out. These do not replace real HTTPS reporting,
+native installation/update phase tests, restart recovery or upgrade compatibility.
diff --git a/docs/INSTALLER_REPAIR.md b/docs/INSTALLER_REPAIR.md
new file mode 100644
index 00000000000..59d7a172d12
--- /dev/null
+++ b/docs/INSTALLER_REPAIR.md
@@ -0,0 +1,72 @@
+# Explicit company installer repair
+
+Run `Install-Company.ps1 -Repair` from the company's installation bundle after
+reviewing the company HTTPS hostname. Customer installation requires
+administrator access. Technician installation uses the current user's local
+application directory.
+
+Windows Installer policy still applies to technician MSI setup and repair.
+On the tested Server 2016 build, a standard desktop account was blocked from
+installing the non-assigned MSI with error `1625`, while administrator lifecycle
+tests succeeded. Company IT must arrange an approved deployment in the intended
+user context when policy blocks unmanaged per-user packages. Setup does not
+change [Windows Installer policy](https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi).
+
+The 1.5.9 disposable Server 2016 test also exercised the company-generated
+technician EXE bundle under an actual standard token. After the MSI returned
+`1625`, a newer signed EXE bundle installed through the shipping
+`-ReplaceFailedSetup` path, preserving bootstrap trust and archiving the exact
+failed setup marker. The installed verifier and native MFA login passed without
+changing Windows Installer policy. This qualifies that EXE recovery path on the
+tested OS; it does not qualify standard-user MSI deployment. See the
+[scoped runtime evidence](evidence/159-windows-company-install-enrollment-20261029.json).
+
+Repair requires a previously recorded installation and its signed
+`installed-release.json`. The supplied release envelope must exactly match that
+record, and its sequence must equal the durable installed sequence. The agent
+verifies the company, edition, pinned signing key, release metadata expiry,
+Windows compatibility, package hash and publisher before installation. Older
+releases and a different package signed with the same sequence are rejected.
+Pending automatic-update recovery must be resolved first.
+
+After installation, the agent verifies installed endpoint and configuration
+agent identities, then records the same sequence. Device enrollment validates
+the existing device and transport identity; it does not issue new credentials
+or change existing unattended consent. Technician setup restores the portable
+application, local launcher and Start menu shortcut.
+
+Setup holds an exclusive Windows byte-range lock while replacing files; this
+overlaps the native session/update lock. Active sessions cause setup to refuse
+replacement. Customer setup disables and stops only the matching managed agent
+task before copying the agent, and refuses an unexpected task definition or an
+agent that did not stop.
+
+A flushed `pending-install.json` records the release before file replacement.
+It blocks managed sessions and automatic updates after an interrupted attempt.
+The agent removes that marker under the exclusive lock only after the marker
+matches the release and installed identity/sequence verification succeeds.
+Retry the same initial bundle if installation never recorded a sequence, or use
+`-Repair` with the pinned installed bundle. Do not manually clear the marker to
+restore access to a potentially partial installation.
+
+Automatic updates do not use the repair exception and still require an
+increasing release sequence. An automatic update cannot reinstall an application
+that was removed. Missing or expired repair metadata requires administrator
+recovery or a newer approved company bundle; do not delete device state or lower
+the recorded sequence to work around verification.
+
+Component tests cover the repair metadata trust gate, ordinary update replay
+rejection and interrupted-setup session denial. A real local Windows
+cross-process test confirms the PowerShell installer byte lock excludes native
+Rust session locks. Complete signed EXE/MSI repair, interruption recovery,
+scheduled-task behavior and clean-machine session coordination remain acceptance work.
+This document describes the development implementation, not tested production
+compatibility.
+
+For MSI bundles, explicit `-Repair` now invokes Windows Installer with
+`/fvamus` against the already verified pinned MSI: run from source/re-cache,
+force file replacement and restore registry entries/shortcuts. Normal setup
+continues to use `/i`. This does not loosen metadata, publisher, hash, company
+identity or session-lock checks. Actual clean-machine repair and interrupted
+MSI recovery remain unverified. See Microsoft
+[repair options](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec).
diff --git a/docs/NETWORK-CHECK.md b/docs/NETWORK-CHECK.md
new file mode 100644
index 00000000000..6557d40ecac
--- /dev/null
+++ b/docs/NETWORK-CHECK.md
@@ -0,0 +1,46 @@
+# Check a company's public endpoints
+
+Each company runs its own server and relay. Swan Remote Support supplies no
+shared connectivity service.
+
+In the administration interface, open **Network**, run **Check saved endpoints**,
+and download **Network configuration for outside checks**. This file contains
+public company information and trust keys. The `bootstrap.json` from a company
+installer bundle works too.
+
+Copy that file and the matching `swan-management` executable to a computer on a
+separate Internet connection. Run it as an ordinary user:
+
+```powershell
+.\swan-management.exe check-network .\company-network-bootstrap.json --outside-network
+```
+
+On Linux:
+
+```sh
+./swan-management check-network ./company-network-bootstrap.json --outside-network
+```
+
+For a company using its own certificate authority, add `--ca-file company-root.crt`.
+The checker still validates the HTTPS certificate, hostname, pinned profile key,
+company identity and profile lifetime. Obtain fresh public configuration after
+company endpoint or signing-key rotation.
+
+The command prints JSON and exits successfully when its requested checks pass.
+It verifies management HTTPS and TCP, the NAT-test/rendezvous/relay TCP ports, and
+a native rendezvous UDP rejection response for a deliberately empty device ID. It uses no company account, device
+enrollment, server data directory or private signing key. It creates no server
+listener. The pinned transport rejects this diagnostic request before device lookup or storage; it registers no device. Native UDP responses are connectivity diagnostics, not authentication.
+
+`--outside-network` records the operator's stated test location and additionally
+requires the connected addresses to be public candidates. The location is not
+independently attested. Private or special-use routes cannot pass that outside
+check. Without this flag the same command can diagnose a private deployment;
+those results describe connectivity from that computer only.
+
+Before publishing customer downloads, also complete real customer-approved
+sessions from the separate connection, testing direct traversal and relay
+fallback. A successful port check does not qualify those sessions or every
+HTTPS-only corporate proxy. Office hosting may need port forwarding; CGNAT may
+require a company-controlled public relay. The JSON report identifies which
+endpoint failed so the company can correct DNS, certificates or forwarding.
diff --git a/docs/NETWORK_DIAGNOSTICS.md b/docs/NETWORK_DIAGNOSTICS.md
new file mode 100644
index 00000000000..a0184b7b060
--- /dev/null
+++ b/docs/NETWORK_DIAGNOSTICS.md
@@ -0,0 +1,39 @@
+# Company network diagnostics
+
+The administration interface's Company network screen publishes the management
+HTTPS URL, rendezvous/relay endpoints and public transport trust key through the
+signed company profile. DNS, HTTPS provisioning, transport processes and firewall
+configuration must match those settings. Publishing a URL does not move the
+server or configure a reverse proxy.
+
+The Check saved endpoints button calls administrator-only
+`POST /api/v1/network/check`. It probes only the saved profile; request-body
+addresses are not accepted. Checks resolve rendezvous/relay DNS, connect to the
+ID TCP port, its preceding NAT-test TCP port, and the relay TCP port, and fetch
+the public management profile over certificate-validated HTTPS. The returned
+profile must validate against this company's signing key, identity and revision.
+The operation is rate-limited and audited.
+
+Results explicitly identify `company_server` as the vantage point and never
+claim external or UDP reachability. Private/local/shared-address classifications
+are diagnostic hints. A public-looking DNS address and successful TCP connection
+from the hosting server do not prove that clients elsewhere can reach it.
+
+Run actual native direct and relay tests from an outside network before
+distribution. Office hosting needs suitable port forwarding; CGNAT may require
+a company-controlled public relay. Test UDP on the ID port separately. No project
+VPS is assumed and compatibility with every HTTPS-only proxy is not promised.
+
+Component tests cover a real loopback TCP listener/closed port, address parsing,
+zero-port rejection and administrator access restrictions. Full external
+reachability, native transport trust, NAT traversal and relay behavior remain
+acceptance requirements.
+
+A fresh-company HTTPS lifecycle run at `d6f1665` also passed against actual built
+agent and management executables. It verifies the management HTTPS certificate
+and company signature, rejects unauthenticated checks, ignores request-body
+targets in favor of saved configuration, and reports external/UDP reachability
+as unverified. The debug server uses an explicit local DER certificate through
+the private `SWAN_TEST_CA_FILE` setting; release builds ignore this test setting.
+Exact executable hashes and clean source state are recorded privately. Its test
+transport ID is not a native remote-session test.
diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md
index 9e8ed12d1d8..d7a7a1ec6f0 100644
--- a/docs/PRIVACY.md
+++ b/docs/PRIVACY.md
@@ -1,36 +1,17 @@
-# Swan Remote Support privacy statement
+# Company deployment privacy information
 
-## Purpose
+This is the configurable product's technical privacy description. Each hosting company publishes its own support contact, consent wording, retention policy and customer request process before distributing its packages. The current development build is not a production release.
 
-Swan Remote Support is used only to provide support, maintenance, updates, and separately agreed backup work for Swan Computing customers. Installation and unattended access require the computer owner's informed authorization. The customer can see the tray/service presence and can stop or uninstall the software.
+The company server stores administrator/technician accounts, password hashes, TOTP authentication secrets, device enrollment records, group permissions, authorization/session history, audit events and update/build metadata. Devices keep their unique enrollment credentials and signed cached company configuration. Installer bootstrap files contain public company endpoint and trust information only.
 
-## Data handled
+Installed apps that support update reporting send their installation identity, reported version, update phase and bounded progress to their configured company server. The server records receipt time; administrators and authorized technicians can view status within their permissions. These reports are informational, contain no screen content, passwords or local file paths, and do not grant support access. See [installation reporting](INSTALLATION_STATUS.md) for the current implementation boundary.
 
-Depending on the support task, the service may process:
+Customer approval is the default session mode. Unattended support requires separate explicit consent and company policy permission. Revocation is saved locally before server synchronization; the receiver must deny subsequent unattended access when consent is absent. Customer-visible support status, stop controls and uninstall remain acceptance requirements. Session recording is disabled by default.
 
-- customer and device identification needed to associate a computer with its support agreement;
-- the Swan Remote Support device ID and its unique unattended password;
-- connection metadata and diagnostic logs from the self-hosted RustDesk server and client;
-- device and account metadata processed by Tailscale under Tailscale's own service terms and privacy documentation;
-- screen content, clipboard content, files, commands, or system information visible during an authorized support session; and
-- backup data only when a separate backup scope, destination, encryption, retention, and restore procedure has been agreed.
+An authorized remote session may expose screen content, input, clipboard contents, transferred files, audio and system information according to its permissions. Companies must explain the support scope to their customers. Technician authorization is verified by signed grants and receiving devices; a company download is not itself permission to access a device.
 
-The public source repository contains the RustDesk/Tailscale server address and the server's Ed25519 **public** key. These are routing and trust values, not customer records or private credentials. The repository and release artifacts must never contain the server private key, customer passwords, Tailscale auth keys, API tokens, signing keys, or customer data.
+Configuration and trust changes use signed profiles over HTTPS. Cached company branding may be shown offline, but expired or unverifiable policy cannot authorize a new managed session. No project-hosted shared company service is supplied, and the new package flow does not install Tailscale or collect legacy device passwords.
 
-## Storage and access
+Companies protect database/configuration/transport keys, enrollment credentials, TOTP seeds, signing material and backups. Private keys and customer records never belong in public source or installation bundles. Support contacts and deletion/retention procedures are the hosting company's responsibility. Complete backup, restore and deletion behavior must be verified before production use.
 
-Each customer computer receives a different cryptographically random Swan password. The one-time device ID/password receipt is copied during installation, transferred into Swan's organization password manager, and cleared from the clipboard automatically after 90 seconds when the GUI flow is used. The installer does not print the password unless an administrator explicitly chooses the higher-risk `-ShowCredentials` option.
-
-Access to customer device records is limited to authorized Swan support staff. Technician devices and service accounts must use MFA where supported. Passwords must not be reused or sent through ordinary email or unencrypted chat.
-
-## Retention and deletion
-
-Support credentials and operational records are retained only for the active support relationship and any legally or contractually required period. When support ends, Swan disables unattended access, removes the Tailscale node from the tailnet, deletes or archives the password-manager record according to the agreed retention policy, and helps the customer uninstall the software if requested.
-
-Backup retention is governed by the separate customer backup agreement. Ending remote support does not itself prove that every backup copy has been deleted; backup destinations and retention schedules must be reviewed separately.
-
-## Customer choices
-
-Customers may request attended support instead of unattended access, pause the Swan service, revoke authorization, uninstall Swan Remote Support, or ask what support records are held about their device. A customer-request process and business contact channel must be published on Swan Computing's customer download page before the first public release.
-
-This repository documents the technical privacy controls. It is not a substitute for a jurisdiction-specific privacy notice or customer contract. Swan Computing should obtain appropriate South African legal/privacy review before production use, especially where customer backups may contain personal information.
+The historical Swan-only privacy and password-manager flow is preserved in the tagged baseline. See [the acceptance report](ACCEPTANCE.md) for controls that still need native or clean-machine verification.
diff --git a/docs/PRODUCT_COMPLETION_ASSESSMENT.md b/docs/PRODUCT_COMPLETION_ASSESSMENT.md
new file mode 100644
index 00000000000..c7bb83fc6bb
--- /dev/null
+++ b/docs/PRODUCT_COMPLETION_ASSESSMENT.md
@@ -0,0 +1,124 @@
+# Swan Remote Support completion assessment
+
+**Historical baseline research, not current implementation status.** The findings
+below describe `9494a5a` before the configurable-product work. Management,
+configuration trust, enrollment, authorization, workers, installer authoring and
+update code have since been added on `codex/configurable-product`. Current
+verification and remaining release gates are recorded in [ACCEPTANCE.md](ACCEPTANCE.md).
+The original requirements remain in scope; the product is not production-ready.
+
+Research date: 1 October 2026. This assessment covers the company-configurable open-source product: a self-hosted server, public customer installer, internal technician installer, branding and policy synchronization, and automatic updates without requiring Tailscale.
+
+The remote desktop engine and a Swan-specific unsigned customer build exist. The reusable company administration and distribution system does not yet exist in this checkout. We should extend the RustDesk OSS foundation with our own open-source management service and company configuration protocol. The proposed architecture below is a recommendation, not implemented behavior.
+
+## Evidence and limits
+
+Inspected checkout: `SwanRemoteSupport-main`, branch `main`, commit `9494a5a`, initially clean. The outer workspace repository has no commits; `SwanRemoteSupport` contains only Git metadata. The substantive application is in `SwanRemoteSupport-main`.
+
+The GitHub API confirms the Swan Windows build [32726437306](https://github.com/rijff24/SwanRemoteSupport/actions/runs/32726437306) succeeded on 24 August 2026 from `0e400fd`. The API returned no published releases. A successful build is evidence of compilation and packaging, not acceptance testing or trusted signing. The local change log records verification of the unsigned artifact and preparation of a two-laptop test kit.
+
+Today, the local `RustDesk`, `hbbs`, and `hbbr` Windows services are running with automatic startup. Earlier server hardening and recovery records are documented evidence; public internet reachability, current firewall policy, customer consent flows, and remote session behavior were not revalidated in this research. No live network or service configuration was changed.
+
+The `libs/hbb_common` submodule is not initialized in this checkout. Cargo, Flutter, and CMake were not found on PATH in the research shell. No application build or end-to-end test was performed here.
+
+## What already exists
+
+| Area | Finding | Evidence |
+| --- | --- | --- |
+| Remote desktop foundation | RustDesk 1.4.9 client with upstream screen control, transfer, clipboard, service and relay code | `Cargo.toml`, `src/client.rs`, `src/server/`, `src/rendezvous_mediator.rs` |
+| Customer branding | Swan logos, light/dark assets, product text, icon and Windows metadata | `branding/`, `flutter/windows/runner/Runner.rc`, `flutter/lib/common.dart` |
+| Managed customer behavior | Incoming-only defaults, hidden ID/password panel and server settings, permanent-password setup | `src/common.rs:load_swan_client_defaults`, `flutter/lib/desktop/pages/desktop_home_page.dart` |
+| Customer setup | Express installer and PowerShell deployment; unique password generation, credential receipt, rotation and revocation helpers | `scripts/`, `docs/SWAN_CUSTOM_BUILD.md` |
+| Windows packaging | Manual x64 workflow producing an unsigned self-extracting EXE and checksum | `.github/workflows/swan-windows-build.yml` |
+| Technician test launcher | Copies the same unsigned customer binary under a different filename to avoid opening the installer | `scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd` |
+| Server transport | Existing RustDesk OSS rendezvous and relay services; August audit recorded version 1.1.15 | `docs/AI_CHANGELOG.md` |
+| Reliability | Windows service recovery and startup/hourly monitoring on this machine | `../rustdesk-reliability/README.md` |
+| Release governance | Source availability, privacy, signing policy and acceptance documentation | `docs/SOURCE_AND_LICENSE.md`, `docs/CODE_SIGNING_POLICY.md` |
+
+The technician launcher is not a separately configured technician product. It changes the filename, while `load_swan_client_defaults` still forces incoming-only settings and the Swan managed UI. Its ability to initiate the intended support sessions must be checked and corrected rather than assumed.
+
+## Gaps against the requested product
+
+| Requirement | Current gap |
+| --- | --- |
+| A company configures its own server | No company setup wizard, branding editor, technician administration, device enrollment service, or installer generator found |
+| Clients inherit company branding and setup | Swan name, assets, private-network address and public key are built into the app/workflow; no company profile synchronization found |
+| Website download and unattended configuration | Existing process expects an in-person technician, Tailscale login/tag approval, and manual credential collection |
+| Internal technician edition | Need authenticated technician login, outgoing support UI, permissions, device inventory and proper packaging |
+| Server generates installers | Current packaging runs in GitHub Actions; no server build queue or downloadable company packages |
+| Automatic updates | Swan explicitly overrides `allow-auto-update` to `N`; upstream updater is not a Swan/company release system |
+| All major Windows versions | Only the Swan x64 Flutter build is verified; no Swan ARM64, legacy x86, or Windows Server compatibility evidence |
+| No Tailscale requirement | Installer, defaults, customer text and existing server deployment depend on Tailscale |
+| Customer-ready publication | No published signed release or completed acceptance evidence found |
+
+Upstream custom configuration is not immediately usable as our company profile format: `read_custom_client` verifies `custom.txt` using a fixed upstream public signing key. We need our own explicitly trusted profile mechanism. Also, `API_SERVER` currently refers to the RustDesk Pro protocol; pointing it at a new generic REST service will not create compatible login or configuration sync.
+
+## Proposed company server and synchronization
+
+Use one self-hosted deployment per company initially. Keep `hbbs` and `hbbr` as the transport and add an open-source management service with a database, administration UI, configuration API, enrollment API, audit records, download endpoints and release management.
+
+Company setup should collect the public service hostname, transport addresses, server public key, company name, logos, theme, support contacts, consent wording, technician accounts, access policies and update channel. Provide backup and restore for configuration, device identity and server keys.
+
+Each company installer needs a small initial configuration containing the management URL, company identifier, intended edition, and a trusted public configuration key. The installer must contain no administrator credentials, shared unattended password, signing private key or reusable technician enrollment secret.
+
+On installation and subsequent refreshes, the app verifies and applies a versioned company profile, caches the last valid profile, and retries with backoff when offline. Protect against invalid signatures, expired metadata, older profile replay, and silent changes of company ownership. Plan trusted key rotation and address migration before shipping.
+
+Public customer downloads are public: their embedded values cannot grant technician privileges. Enrollment needs unique per-device credentials and appropriate approval or scoped invitation. Unattended access requires clear owner consent. Avoid the current need for customers to copy support passwords into a technician's password manager.
+
+Technicians authenticate separately with MFA and server-enforced device/group permissions. Hiding buttons or specifying an outgoing/incoming role is not authorization. Authorization must also protect direct and relayed sessions, device revocation and stolen credentials; implementing this likely requires transport/client changes in addition to the management API.
+
+Allow logo, contact, theme and policy changes to sync without reinstalling. Windows executable icons, publisher/version resources and installation identity are packaging concerns: changing these may require a newly generated signed package. Use stable internal application, service and configuration identifiers so a display-name change does not lose device identity or break upgrades.
+
+## Generating and publishing installers
+
+Recommended product behavior: the company administrator clicks **Generate installers** and receives customer EXE/MSI packages for its website and technician EXE/MSI packages for authenticated internal distribution.
+
+The server can orchestrate this, but Windows compilation should run on isolated Windows workers with pinned source/toolchains. A Linux-hosted company server can queue a Windows worker or CI job. Begin by adapting the working GitHub Actions build and upstream WiX MSI scaffolding in `res/msi/`; the latter is not already a finished Swan MSI pipeline.
+
+Build shared runtime binaries per version/architecture, then assemble company-specific configuration and branding. Where resource customization changes a PE binary, sign the final customized binary. Sign inner executables/DLLs before packaging and the final installer afterward. Do not modify a signed artifact to insert company configuration. Keep signing access separate from the publicly reachable runtime server.
+
+Each download should identify edition, architecture, version, publisher, hash and corresponding source. Keep an immutable release record; a stable website download link may point to the latest approved package. Protect technician downloads, but enforce technician authorization even if someone obtains that installer.
+
+[Windows Installer major upgrades](https://learn.microsoft.com/en-us/windows/win32/msi/major-upgrades) provide package upgrade mechanisms and downgrade prevention. Proposed installers must preserve device identity, enrollment and consent through upgrade/repair, and implement explicit uninstall and recovery behavior.
+
+## Automatic updates
+
+Do not simply enable the existing upstream updater. `src/common.rs` checks the upstream version service, and `src/updater.rs` constructs RustDesk release filenames. It does not implement a company-approved Swan release feed. Its size-based cached-download reuse is not a package integrity check.
+
+Implement a company-controlled feed identifying product, edition, architecture, OS compatibility, version, download URL, hash and metadata expiry. Verify signed metadata and artifact integrity, plus trusted Authenticode publisher policy, before privileged installation. Evaluate [The Update Framework](https://theupdateframework.io/docs/overview/) for the update trust design.
+
+Add stable/test channels, staged rollout, maintenance windows, pause controls, retry/backoff and explicit status reporting. Preserve enrollment and settings. Coordinate installation with both client roles so sessions cannot start while an update is being applied. Define recovery after interrupted installation and controlled rollback to an approved version without permitting arbitrary replay of old releases. Separate company configuration revisions from software versions.
+
+Clients can update automatically within company policy. Server updates should initially require an administrator maintenance action with database/key backups and tested migration rollback; a failed server upgrade could affect every customer.
+
+## Removing Tailscale
+
+This is feasible with the existing transport. [RustDesk self-hosting documentation](https://rustdesk.com/docs/en/self-host/) describes direct NAT traversal with relay fallback. Native clients need reachable server TCP 21115, 21116 and 21117, plus UDP 21116. Proposed management/download APIs use HTTPS 443.
+
+Recommended deployment is a server with a public address and DNS name. An office-hosted server needs working port forwarding and a reachable public address; CGNAT may require a public VPS or another reachable relay. Ordinary shared website hosting does not necessarily permit the required long-running TCP/UDP services. A website can host downloads while the transport runs elsewhere.
+
+Use DNS names rather than a Tailscale-only address. Validate direct and forced-relay sessions from independent external networks, including restrictive corporate networks; do not promise that the existing native transport works through every HTTPS-only proxy.
+
+Tailscale currently provides network restrictions as well as connectivity. A public OSS server does not automatically reproduce technician identities, MFA or company access policy. Implement and validate replacement authorization, rate limiting, abuse controls and auditability. The public server key is a trust value, not an access secret. Migrate through a parallel endpoint and tested rollback before removing the existing private access path.
+
+## Windows support and open source
+
+Recommended initial release target: Windows 10 and 11 x64. Add ARM64 after validating the project's Rust, Flutter engine, plugins and native dependencies together. [Flutter's current supported-platform matrix](https://docs.flutter.dev/reference/supported-platforms) lists Windows 10/11 x64 and ARM64 and excludes Windows 8 and earlier; it does not prove compatibility of our pinned Flutter 3.24.5 and custom RustDesk engine.
+
+Windows 7/8/8.1 and 32-bit Windows require a separate legacy UI/toolchain assessment and actual tests. Windows Server releases need explicit testing of interactive sessions, logon screen, UAC and service behavior. Installer format alone cannot make an unsupported runtime compatible. Do not advertise all Windows versions until the support matrix is tested.
+
+Retain AGPL notices and exact corresponding-source/build links for distributed modified binaries and assess the new management service's license obligations. The [GNU AGPL](https://www.gnu.org/licenses/agpl.en.html) includes obligations for modified network software. Company keys and customer data remain private. Existing [RustDesk branded client generation](https://rustdesk.com/docs/en/self-host/client-configuration/) is a Pro feature; our fully open-source design needs its own implementation.
+
+Signing remains unresolved. The existing SignPath policy documents an intended process, not proof of project approval. [SignPath Foundation terms](https://signpath.org/terms.html) have eligibility and provenance requirements; confirm coverage of company-specific generated builds. Publisher identity follows the actual certificate, not the company logo. Automatic per-company trusted signing cannot be assumed free.
+
+## Recommended completion order
+
+1. **Reproduce the baseline.** Initialize the pinned submodule in the development/build environment, rebuild the customer package, test the technician-role issue, and record current install/reboot/remote-session results. Correct stale documentation: the build has succeeded, and the spare-laptop guide uses `tag:swan-operator` where the policy uses `tag:swan-support-operator`.
+2. **Implement company management and trust.** Deliver setup, profiles, enrollment, technician authentication, device groups and enforced session permissions. Demonstrate one company's profile cannot authorize access to another deployment.
+3. **Create the two editions and sync.** Remove Swan-only assumptions, implement customer self-setup and technician login, and verify live profile refresh, offline caching and key rotation.
+4. **Validate public transport.** Prepare a parallel public endpoint, implement replacement access/abuse controls, and pass external direct/relay and negative-access tests without Tailscale.
+5. **Deliver signed packages.** Add company packaging jobs, proper MSI/EXE install/repair/uninstall, website downloads and protected technician distribution.
+6. **Deliver safe updates.** Test valid updates, invalid signatures/hashes, wrong company/edition/architecture, expired/replayed metadata, active sessions, interrupted installation and recovery.
+7. **Publish the supported release.** Complete clean-machine acceptance on every advertised OS/architecture; publish signed hashes, exact source, privacy and recovery instructions. Extend legacy compatibility only with separate evidence.
+
+Completion means a fresh company deployment can configure branding once, generate both installers, publish the customer package, enroll a consenting customer without manual network configuration, authenticate an authorized technician, connect without Tailscale, change branding centrally, and upgrade both apps without losing identity or access controls.
diff --git a/docs/PROFILE_KEY_ROTATION.md b/docs/PROFILE_KEY_ROTATION.md
new file mode 100644
index 00000000000..bd8d09edf26
--- /dev/null
+++ b/docs/PROFILE_KEY_ROTATION.md
@@ -0,0 +1,104 @@
+# Company profile signing-key rotation
+
+These commands operate on a company's private management data directory. They
+do not rotate RustDesk transport keys or software release-signing keys. Keep
+`SWAN_DATA_DIR` and `SWAN_BACKUP_PASSPHRASE` in private environment configuration.
+Stop the management service before either command. Upgraded servers hold an
+exclusive data-directory lock; older server versions must also be stopped.
+
+1. Create an encrypted deployment backup and retain its passphrase separately.
+2. Run `swan-management prepare-profile-key`. This generates a private pending
+   key in SQLite and advances the profile revision with its public replacement
+   key. The active signing key stays unchanged. The command prints public
+   information only.
+3. Restart management. Installed customer and technician apps must synchronize
+   this transition while the old key still signs it. Verify synchronization on
+   the intended devices, including technician installations, before activation.
+   A machine that misses this transition cannot independently trust the new key;
+   it needs explicit trusted reconfiguration. The server currently cannot prove
+   that every installation received the transition.
+4. Stop management again and run
+   `swan-management activate-profile-key --confirm-clients-synced`.
+   Activation checks the pending public key matches the published transition,
+   then atomically changes the active private key and advances the profile
+   revision in SQLite. The next process loads this key. Outstanding session
+   grants close, and old installer jobs/downloads become unavailable. Existing
+   device credentials, company identity, consent and release trust stay intact.
+5. Restart management. Verify the public key through its HTTPS status endpoint
+   and verify synchronized clients accept the new signed profile. Generate new
+   company installer bundles and replace website/internal distribution links.
+   Previously downloaded old bundles must also be withdrawn by the operator.
+   The worker currently pins `SWAN_PROFILE_PUBLIC_KEY` in its private operator
+   configuration. Update that pin to the key authorized by the prepared signed
+   transition and restart the worker before rebuilding; it deliberately rejects
+   jobs signed by an unrelated or unconfigured key. Automatic worker-pin rotation
+   is not implemented.
+
+Activation invalidates current sessions as their authorization is revalidated.
+Schedule rotation as a maintenance operation. This does not create an automatic
+trust reset or permit a profile signed by an unrelated key.
+
+Schema version 2 stores active and pending profile-signing keys in the protected
+management SQLite database. `profile-key.hex` remains the initial seed for
+legacy migration; it no longer identifies the active key after rotation. Do not
+edit that file to rotate keys. Encrypted backups must include the database.
+Restoring the database preserves active/pending keys and their profile revisions.
+
+When opening a version-1 management database, the upgraded server requires
+`SWAN_BACKUP_PASSPHRASE` and creates an encrypted `pre-upgrade-v1-*.swan-backup`
+before migration. It refuses migration without that password. Version-1 server
+binaries refuse the version-2 database; downgrade recovery uses the matching
+pre-upgrade backup in an empty directory, with public endpoints unavailable.
+Reconcile all changes made since that backup before exposing a restored server.
+
+Component tests cover process exclusion, authorized transition checks, restart,
+new-key signatures, encrypted restore and pre-upgrade backup recovery. The
+[independent Linux company rehearsal](../deployment/linux/installed-profile-key-rotation-evidence.json)
+also verified real HTTPS rotation through the normal background refresh of both
+installed 1.5.1 editions on Server 2019, rejection by a shipping agent that missed
+the transition, withdrawal of old downloads and verified replacement bundles.
+An encrypted post-rotation backup restored the active database key, original
+HTTPS identity, administrator MFA, approved device with revoked unattended
+consent and replacement downloads. The existing device credential authenticated
+to the recovered API without reconfiguration. These bounded checks do not
+qualify interrupted activation, active native-session termination, all Windows
+versions, public HTTPS deployment or complete server migration rollback.
+
+## Local HTTPS rehearsal
+
+`node deployment/windows/test-profile-rotation.js PRIVATE_ENV BINARY_DIRECTORY`
+owns fresh management and HTTPS proxy processes for a marked isolated fixture.
+It requires `rotation-fixture.marker`, a fresh data directory without a database,
+private TLS configuration and debug management/agent binaries. Use the local
+test certificate mechanism; do not import a test CA into production trust or
+point this harness at an existing company. All credentials/results stay in the
+protected fixture directory. Processes stop on completion or failure.
+
+The rehearsal passed with binaries built from `7843334`: real HTTPS customer and
+technician agent sync adopted the prepared key, retained enrollment and revoked
+consent, rejected a client that missed the transition, required activation
+confirmation, and preserved the active key through restart. A claimed grant was
+still unexpired when activation denied its renewal. This tests built agents and
+the management authorization API; it does not prove the graphical receiving app
+terminates a live remote session or that production HTTPS deployment passes.
+
+The harness also exports the rotated database, private deployment configuration
+and real local HTTPS storage through the management CLI, then restores them to
+an empty protected directory. The replacement HTTPS proxy uses the restored PFX;
+key/certificate bytes match the originals, the management public signing key and
+device credential survive, and the closed grant remains denied. Local certificate
+storage recovery does not prove ACME renewal or production Caddy recovery.
+
+The [current 1.5.10 installed rehearsal](evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json)
+verified automatic transition and replacement-key adoption on a Windows 10
+customer and both Server 2019 editions. The existing private worker required an
+explicit public-pin update; its credential, registry path and private ACLs stayed
+unchanged. A fresh customer-approved native desktop session worked after rotation
+and customer stop closed it. Real shipping-agent HTTPS checks rejected cached
+states that missed the transition. Old installer links were withdrawn. Fresh
+encrypted exports were retained before and after rotation. A subsequent
+[isolated restore and replacement-bundle check](evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json)
+recovered the active key, HTTPS identity, MFA, permissions and withdrawn-download
+state, then verified newly generated public customer and protected technician
+bundles. That archive predates the two replacement jobs. Offline installations
+were not silently reset to a new trust key.
diff --git a/docs/RELEASE-READINESS.md b/docs/RELEASE-READINESS.md
new file mode 100644
index 00000000000..880ebdc16d0
--- /dev/null
+++ b/docs/RELEASE-READINESS.md
@@ -0,0 +1,350 @@
+# Release readiness — 6 November 2026
+
+## First publication: Windows 11 x64
+
+**Technician uninstall also needs rebuilt acceptance:** the standard-user
+foreground test of technician MSI29 (native 1.5.22+93) returned installer exit 0
+and removed its registration and installed files, but left its extracted native
+GUI process running. That is a failed uninstall test, not a successful lifecycle
+result. Candidate 1.5.23+94 now registers every configured technician native
+process for its lifetime, exits those processes on explicit removal, and makes
+the remover wait for their registrations to close before deleting files. A
+bounded wait fails removal if a process does not exit. This uses a separate
+runtime lock and does not replace session authorization or its activity lock.
+The rebuilt Windows native application, foreground MSI/EXE uninstall and rollback
+still need real acceptance tests. The earlier customer-only candidate build
+42213325451 was cancelled; it must not be published as the combined fix.
+
+**Publication blocker found in current +93:** [real Windows11 MSI uninstall/reinstall regression](evidence/1522-fresh93-win11-msi-uninstall-ui-regression-20261106.json).
+MSI removed files, service, watcher and registration but left customer UI processes
+running from Windows Installer rollback storage. The next EXE setup retained its
+signed recovery marker and correctly refused those unexpected kernel image paths.
+Manual guarded lab cleanup allowed explicit EXE33 setup to finish with its exact
+95-file payload, original identity and consent intact. This is not an automatic
+lifecycle pass. Candidate **1.5.23+94** closes UI before removal and restores it on rollback. Its
+[real Windows11 standard-user helper regression](evidence/1523-win11-uninstall-ui-source-regression-20261106.json)
+passes, including refusal without cancellation, disabled restart tasks, rollback
+without an existing release record, preserved service/payload, and rejection of
+wrong process creation time, path, SID and foreign tasks. This is helper-level
+evidence; rebuilt native Rust glue, signed MSI uninstall/reinstall and release
+reproduction remain required. No newer installer is approved or published.
+
+The first endpoint release targets **Windows 11 x64 only**, following the revised
+release scope of 6 November. Windows 10 and Windows Server qualification is
+deferred to subsequent releases; historical tests below are evidence, not first
+release compatibility claims. Reuse the existing Windows 11 VM. Do not create
+additional OS guests or run the full Windows matrix before this release.
+
+The shortest release path is the existing company server and Windows worker,
+customer and technician packages, and approved automatic updates. Preserve the
+existing security and recovery gates. Before publication, verify the exact
+candidate on Windows 11: company setup and branding, public customer/protected
+technician downloads, enrollment and MFA, real authorized sessions and rejection
+of bypasses, customer consent and revocation, desktop features, signed profile
+sync and rotation, installer lifecycle and interrupted automatic-update recovery.
+Public direct/relay operation without Tailscale and valid production signatures
+remain required. Linux and Windows server deployment instructions remain in scope;
+deferring Windows endpoint versions does not remove company hosting.
+
+The [fresh-input +93 primary build evidence](evidence/1522-fresh-x64-primary-build-20261106.json)
+passed from exact public source `d5eeaa918fbb2510148d041297be99dbdc169360`.
+Its original unsigned archive SHA256 is
+`030303d1e0f736f68c2b238fb3ee0e15e71d9c7099c0bb608b20416b2d89e51a`.
+Local verification covered all 1,421 tracked source files, six original generated
+bridge inputs, artifact hashes and compiled branding/approval/transfer tests.
+The captured AV1 object is present byte-for-byte in the installed static library;
+the function prefix before its recorded terminal relocation is present once in
+the original packaged DLL. This traces build provenance, not reproducibility.
+The [independent exact-source build](https://github.com/rijff24/SwanRemoteSupport/actions/runs/42169429003)
+and [original-output comparison](evidence/1522-fresh-x64-independent-comparison-20261106.json)
+now pass. All eight original unsigned shipping outputs match byte-for-byte,
+including both endpoint formats, server setup and the three backend programs.
+Both 1,421-file source proofs, six bridge inputs, recorded MSVC inputs and SDK
+wrapper proofs match. No shipping-byte normalization was applied. The original
+comparison report is pinned by its GitHub artifact digest. The historical +92
+mismatch cause remains unexplained; this is a passing fresh-output +93 rebuild,
+not proof of that earlier cause. [Private lab signing and output collection](evidence/1522-fresh93-lab-signed-packages-20261106.json)
+now pass for both MSIs, the technician EXE and customer executable/agent inputs.
+Original bytes and timestamp receipts were checked; the existing key stayed
+non-exportable. The [customer EXE producer, separate-directory rebuild and all four company bundles](evidence/1522-fresh93-customer-exe-and-four-company-bundles-20261106.json)
+now pass. Both unsigned customer EXEs match, and the lab-signed outer package
+retains its exact signed 95-file payload. The existing Windows worker generated
+customer and technician EXE/MSI bundles. Anonymous customer downloads succeeded;
+anonymous technician downloads were rejected and authenticated downloads passed.
+Bundled signatures, six public bootstrap fields, seven exact source texts and
+package/agent hashes were verified. The EXE's 95-file manifest and MSI's 96-file
+manifest remain separate; a wrong manifest was rejected against the actual EXE.
+Four isolated test releases are approved for these bundle jobs, with the signed
+company update policy unchanged and paused during bundle generation. The
+[Windows11 customer automatic MSI upgrade](evidence/1522-fresh93-win11-customer-automatic-msi-upgrade-20261106.json)
+now passes from native1.5.16 sequence19 to native1.5.22+93 sequence32. Exact
+installed signatures and payload verification pass; enrollment, trust, credential
+and consent digests are unchanged. The standard-user customer frontend reopened
+automatically with company branding, and the system service is healthy. No manual
+installer, update command or watcher repair was used. The controlled window restored
+the original paused policy and every release approval at newer signed revision46.
+The [technician automatic MSI upgrade](evidence/1522-fresh93-win11-technician-automatic-msi-upgrade-20261106.json)
+also passes from sequence27/native1.5.21 to sequence29/native1.5.22: exact signed
+bytes, shipping verification, original trust/consent digest and automatic standard-user
+frontend relaunch pass. Company branding and About1.5.22 were observed in the real app.
+The original paused policy and all approvals are restored at signed revision50.
+An earlier lab selection mistake allowed the old approved MSI27 to upgrade sequence19;
+that attempt is retained separately and is not claimed as fresh93 qualification.
+[Current-candidate technician MFA login and authorized inventory](evidence/1522-fresh93-win11-current-technician-mfa-inventory-20261106.json)
+also pass in the real installed Windows11 app under the standard lab account.
+[Customer MSI missing-file repair](evidence/1522-fresh93-win11-customer-msi-missing-file-repair-20261106.json)
+now passes: the real installed-file verifier rejected a missing hashed licence file,
+and the generated company bundle restored it through `Install-Company.ps1 -Repair`.
+Full shipping verification, original enrollment/trust/consent and service/watcher
+health pass afterward. The initial harness stopped on expected native stderr before
+calling repair; its failure and original backup are retained, and the continuation
+uses the actual child exit code. This was a SYSTEM test, not interactive UAC proof.
+Current-candidate sessions and remaining Windows11 runtime qualification stay open. No production signing or publication has occurred.
+
+Current app candidate: **1.5.21+89**, public source `bd331ca`. Both technician formats and the customer MSI have package verification. Customer EXE30 was withdrawn after a lab MSI/EXE manifest pairing error; [corrected EXE31 shipping recovery, uninstall/reinstall and compact customer About now pass](evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json) on the existing Windows10 development VM. [Independent native comparison](evidence/1521-independent-native-original-output-reproduction-20261104.json) matches all eight original unsigned outputs; [existing standard-user technician checks](evidence/1521-standard-technician-upgrade-about-mfa-20261104.json) pass upgrade, About, genuine MFA/inventory and sign-out. Both endpoint About screens and the customer shipping uninstall fix now have genuine app evidence. Remaining permission, desktop-feature and update checks are open; current live-session results follow. Finish these on the existing development pair before the final advertised-Windows matrix. Reuse one VM per OS; do not create a VM for each candidate. This remains a development build, without production approval.
+
+Next candidate **1.5.22+91**, source `ca16998`, fixes company window and tray
+labels while preserving stable service/configuration names and device identity.
+It uses trusted signed cached branding for display only; expired policy still
+cannot authorize access. The single [native build](https://github.com/rijff24/SwanRemoteSupport/actions/runs/41964194947)
+passed. Its256,777,570-byte original archive, manifest,1,406 public source files
+and six generated bridges are verified. New compiled Rust branding and Flutter
+title/approval tests passed; the Rust branding log was omitted from the original
+artifact and is verified from the retained original completed job log instead.
+Future CI uploads include it. All95 customer payload files were extracted without
+execution and matched the verified manifest. The one [independent rebuild](https://github.com/rijff24/SwanRemoteSupport/actions/runs/41970609821)
+passed its build/tests from the exact same source, but the [original-byte comparison](https://github.com/rijff24/SwanRemoteSupport/actions/runs/41976573481)
+**failed**. Both source/bridge proofs and recorded MSVC inputs match. The server
+installer, management, agent and worker match; the customer/technician EXE and MSI
+outputs differ. Payload-level diagnosis is in progress. No candidate22 packages
+are signed, approved or installed. Native22+90 was also never approved or installed
+and is superseded. Reproduction, runtime branding, genuine byte-changing automatic
+updates and final qualification remain open.
+
+[Small real MSVC compiler fixtures](evidence/1522-msvc-lambda-path-controls-20261105.json)
+then isolated a source-path effect on lambda RTTI names. Same-path output matched
+across two CI jobs, but relocation changed original bytes. Experimental compiler
+determinism/path mapping, compiler-level Brepro, path trimming and relative input
+names did not restore raw equality in that fixture. These are failed hypotheses,
+not an application fix. A subsequent [actual SDK reply-callable fixture](https://github.com/rijff24/SwanRemoteSupport/actions/runs/41983906171)
+passed with identical raw executables at relocated source paths after replacing
+the anonymous callback with a named callable. Its stub C API checks lifetime,
+payload, duplicate replies, unavailable-engine handling and concurrent replies;
+it does not qualify real engine sessions. Candidate **1.5.22+92** integrates that
+source-only patch with exact upstream and patched-source pins, archived receipts,
+and independent comparison checks. Five source-trust and sixteen comparison
+tests pass locally. Actual cached SDK application, full native reproduction and
+installed runtime checks remain required. No candidate22 signing has started.
+
+The [full +92 primary build and original artifact verification](evidence/1522-named-wrapper-primary-build-20261105.json)
+now pass: the actual pinned SDK source patch compiled, all native jobs completed,
+and the original256,841,594-byte archive matches its GitHub digest. Verification
+covers1,417 public source files, all six original generated bridge inputs,
+the patch receipt and compiled branding/approval/transfer logs. CI technician MSI
+lifecycle and customer headless-service checks passed. The one [exact-source
+independent rebuild](https://github.com/rijff24/SwanRemoteSupport/actions/runs/41996756641)
+passed from the pinned source tag after retrying only its failed Windows job:
+the initial attempt hit an HTTP504 dependency download before app compilation.
+The [original-output comparison](https://github.com/rijff24/SwanRemoteSupport/actions/runs/42009952812)
+then **failed**: server setup and all three backend programs match, but the four
+endpoint packages differ. Public-source, bridge, MSVC and patched-wrapper input
+proofs match. The named-wrapper change alone has not fixed full-app reproduction.
+Both original archives were then retained and their customer payloads extracted
+without execution. All95 files per archive match their original MSI manifests;
+94 raw files now match between builds, including the launcher, plugin DLLs,
+engine and Dart payload. The sole mismatch is `librustdesk.dll`:73 bytes differ,
+including one code byte,68 bytes in `.rdata` and four header bytes. Its other
+six sections match. The code difference is isolated to RVA`0xddde2e`, but its
+object/function origin is not identified yet. No byte normalization is applied.
+Diagnosis continues; no further full build is started on a guessed fix.
+No +92 package is signed, approved or installed. Existing development VMs remain on21.
+
+The scoped follow-up repeated the original AV1 translation unit72 times,
+including independent Windows runners with different processors and images.
+All function code matched the first DLL variant; all109 actual source/header
+inputs matched between the independent runners. The second DLL variant remains
+unexplained. Unreleased **1.5.22+93** therefore adds capture of the actual AV1
+object/static library/compiler inputs inside the full endpoint build, verifies
+the original compiled DLL reaches the bundle unchanged, and requires fresh
+compiled outputs. No codec or compiler workaround is applied. This is an input
+provenance improvement, not a claim that reproduction or runtime checks passed.
+
+
+[Current management evidence](evidence/1522-management-reproduction-upgrade-and-probe-20261105.json)
+now records the corrected compiled Windows checker passing all15 public cases,
+including valid DER and PEM trust. Two separate Windows component builds also
+produced identical raw management, agent and worker binaries, with261 exact
+corresponding source files verified and the current checker fixture passing.
+The inherited32-bit Windows job fails because its legacy Rust1.75 toolchain
+cannot parse the version4 lockfile;32-bit Windows is deferred. This is not an
+x64 app pass: the dedicated pinned Rust1.90 native build remains required.
+Two cold canonical Linux builds produced
+identical raw management executables and source contexts using the pinned
+published recipe; full OCI identifiers differ. Real fresh-company setup, MFA,
+enrollment, persistence and backup/restore passed. After a fresh encrypted full
+backup, the existing company upgraded to the canonical image with real HTTPS/MFA,
+preserved company records and unchanged transport/TLS containers. Offline full
+restore matched all57 installer files,6 TLS identity files and deployment keys.
+The restored existing company then passed MFA/replay rejection, original-key
+profile signing and device/user/release/build persistence across restart in a
+network-disabled container. [Restored-company HTTPS and real MFA](evidence/1522-restored-company-https-mfa-20261105.json)
+subsequently passed in that isolated namespace using the original CA/hostname
+trust and profile signing key. MFA replay and anonymous export were rejected;
+authenticated public bootstrap export passed. Both restored services are stopped
+and retained; the original four live company services remain running unchanged.
+Native restored sessions and external transport remain separate. Updates remain paused. No production
+publication is implied.
+
+[Current standard-user live checks](evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json)
+now pass attended desktop access, separate file consent, a real45-second network
+interruption during a256MiB transfer, and original-window completion after fresh
+approval with exact received hashes. Accepting desktop access while file approval
+was pending kept the approval window visible, resolving the previously failing
+native17 regression. Customer Stop closed both live server records and access;
+native technician history displayed Closed. These results qualify this existing
+development pair. They do not close the other permission, desktop-feature,
+update, external-connectivity or final Windows-matrix gates. Exact resumed
+offsets and exact live30-second timeout timing were not measured.
+
+[Current direct TCP authorization](evidence/1521-native-direct-ip-denial-and-preservation-20261105.json)
+also rejects a real legacy-style password login before company authorization.
+The test reached the actual installed Windows10 receiver and obtained the
+explicit company-denial response. No grant or enrollment was created; identities,
+consent and native bytes were preserved, and the temporary listener/forward were
+removed. The stock graphical control stayed black and is not counted as passed.
+Its earlier genuine ID-based denial has separately verified unchanged receiving
+source; external routing and final OS qualification remain open.
+
+The new [company-run connection checker](NETWORK-CHECK.md) has
+[scoped Linux development evidence](evidence/company-network-probe-development-20261105.json):
+real trusted HTTPS, pinned signed profiles, four TCP ports and a stateless native
+UDP rejection response. Wrong profile keys, untrusted certificates and private
+paths presented as outside-network qualification are rejected. The initial CI
+build-context test caught an omitted source-file allowlist entry; both Docker
+filters now include that file, and an actual directory-context scratch export
+includes every required public input while excluding all private canaries.
+Canonical server builds, compiled Windows execution, and authenticated public-only
+bootstrap export now have the scoped evidence above. The live company is on the
+reproduced canonical server. New native sessions against that server remain to
+be checked; external direct/relay sessions are not qualified by this checker.
+
+The source-specific historical findings below retain their original scope and do not describe the current deployment policy.
+
+[Native1.5.14 real automatic update](evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json) installed and verified the exact signed MSI while preserving identity, trust and consent, but **failed customer UI recovery**. MSI renamed the mapped old image into rollback storage; the exact kernel-path guard rejected termination, and an advanced PowerShell failure returned an incorrect success status. Updates are paused at profile40. Pre-MSI process shutdown and explicit helper error propagation are draft fixes; production and full update acceptance remain blocked on their verification.
+
+**Not ready for production publication.** This index distinguishes current,
+scoped evidence from older checkpoints in [ACCEPTANCE.md](ACCEPTANCE.md).
+Passing one operating system or one component does not qualify the full product.
+
+[Windows10 customer1.5.10 to1.5.11 automatic update and normal reboot](evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json) passed with exact signed installed files, MSI registration, shipping verification, preserved identity/consent/branding and restored paused profile28. No manual update, installer invocation, watcher repair or controlled watcher restart was required. Fourteen isolated cases using the installed1.5.11 agent returned the expected profile signature/time/company/replay results. This does not qualify the remaining native-session, interruption or OS/edition matrix.
+
+[Server2019 technician1.5.10 to1.5.11 automatic update](evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json) passed exact installed-file/publisher checks, shipping verification, fresh native MFA/inventory and company reporting. Staged rollout included technician cohort27 while the same-VM customer cohort78 remained on sequence13 with no sequence14 staging. Original pause/20% policy was restored at profile30. **Recovery remains unqualified:** Windows returns a short task principal name that the shipping ownership guard rejects; an older recovery task has exit1. [Candidate1.5.12](evidence/1512-recovery-principal-sid-regression-20261031.json) resolves the principal to its exact SID. Local Windows PowerShell and actual Server2019 existing-task inspection plus isolated task registration/removal regressions passed. The built-in Administrator token was unfiltered despite a Limited task run level; this is not standard-user qualification. Interrupted installation recovery remains pending; the compiled standard-user cleanup result below covers only task cleanup.
+
+[The compiled1.5.12 recovery helper](evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json) now passed on a genuine Windows10 standard-user token: the old helper failed against the short account name, while the signed candidate wrote its pinned embedded guard and removed its exact self-owned task. The actual customer identity, credential, trust, consent, sequence and original installed agent were preserved. This qualifies no-pending task cleanup, not interrupted installation recovery.
+
+[Thirteen real shipping-agent package checks](evidence/1511-installed-windows-signed-package-rejection-20261031.json) accepted a valid1.5.11 MSI and rejected signature, replay, expiry, edition, architecture, channel, Windows compatibility, hash, publisher, certificate, MSI-version and invalid-package cases in isolated credential-free fixtures. No installer or online update was invoked.
+
+[The first canonical Linux image](evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json) built from source942 with the published Dockerfile and pinned official Rust image. Its real fresh-company/MFA/replay/enrollment/persistence/backup/restore harness passed. [A second independent canonical build](evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json) produced the identical management executable, and its real fresh-company harness passed. The existing Linux company subsequently upgraded to the canonical image after a fresh encrypted backup; HTTPS/MFA, company records, profile30, paused policy and unchanged transport/TLS containers passed. Current anonymous/unassigned grant denial, authorized inventory, consent enforcement and public customer/protected technician download routes passed. That backup also restored offline with wrong-password rejection and exact key/settings/TLS/installer-file equality. Full OCI image identifiers differ; live restored-company and external native transport remain separate gates.
+
+[The complete Windows1.5.12 native build and Windows/Linux component checks](evidence/1512-native-and-component-build-success-20261031.json) passed at source942. [Independent Windows build and original-output comparison](evidence/1512-independent-native-original-output-reproduction-20261031.json) passed: all eight unsigned outputs,1325 tracked source files, six generated bridges and618 MSVC input files per build matched. The original agent hash also matches the component agent used for the genuine standard-user recovery regression. Local full primary archive verification subsequently passed, including its complete hash, manifest,1325 tracked source files and six generated bridges; see the installed recovery evidence below. The second canonical Linux build completed from the identical source context with no compiled-layer reuse; its matching management bytes, runtime and live upgrade evidence are above. These build results do not qualify installed upgrades or production publication.
+
+[Real Windows10 customer session coordination and interrupted1.5.12 recovery](evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json) subsequently passed. Both company bundles were generated by the real Windows worker with lab-signed MSIs; anonymous customer downloads succeeded and anonymous technician downloads were rejected. A genuine standard-user customer approved a native1.5.11 session against the canonical Linux company, then stopped it and revoked the technician connection. During that actual desktop session, release15 downloaded but the Windows activity lock prevented installation. After the session ended, a guarded hypervisor power cut interrupted the real MSI client with its durable installing receipt. Normal boot automatically recovered to1.5.12, passed the shipping installed-file/publisher verifier, preserved identity/credentials/branding/consent and removed its recovery task. Unexpected-shutdown events41/6008 corroborated power loss. No manual update, installer, recovery or service-start command was used. The original paused policy was restored and accepted at profile32. This qualifies this Windows10 customer interruption boundary; technician recovery, other advertised systems, external transport and production signing remain open.
+
+[The Windows10 standard-user idle customer1.5.12 to1.5.13 test](evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json) verified the automatic MSI installation, exact signed files, service/watcher, preserved enrollment/consent and restored paused profile38, but failed the existing GUI check. The old pre-update frontend processes remained alive and displayed “Company setup is not complete” without the company branding. Closing only those exact old GUI processes and normally reopening the updated application restored branding and approval controls without re-enrollment, reinstalling or stopping the service. That manual diagnostic is not automatic-update acceptance. Customer GUI quiescence/restart needs implementation and a new genuine standard-user test before release.
+
+Candidate1.5.14+82 implements customer UI recovery after a verified update while retaining session exclusion and the signed restart marker. [The real standard-user helper regression](evidence/1514-customer-ui-restart-functional-helper-20261031.json) passed process/owner guards, foreign-task rejection, durable intent across two injected interruption boundaries, actual unelevated relaunch, task self-cleanup, fresh-process idempotence and uninstall task cleanup. Company branding and consent controls rendered after relaunch. [Windows/Linux component checks](evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json) passed at0aac973, including the real-child timeout/reaping regression, large-backup recovery and corrected private-file-excluding Linux context. The installed application in the helper test was1.5.13; the native1.5.14 build and actual13-to14 automatic MSI update are still required.
+
+## Sources and signing
+
+- Candidate `1.5.13+81` addresses a [real stale portable-runtime finding](evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json). Server2019 technician files upgraded automatically to1.5.12 and passed exact signed installed-file verification, but the shared extracted executable remained1.5.11 and the current installation report did not complete. The new wrapper isolates each embedded payload by its SHA256 and refuses launch after extraction errors. Four Python metadata tests and two standalone Linux Rust tests passed. Windows exclusive-file-lock and Linux cache regressions, the full native build and exact corresponding-source verification subsequently passed. [The actual Server2019 technician1.5.12 to1.5.13 automatic update](evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json) also passed: the sole running native process is1.5.13+81 in its new payload-specific cache and matches the verified original runtime hash; fresh MFA/inventory and the exact company installation report passed. Identity, consent, trust and the excluded customer remained unchanged, and paused profile36 was restored. Two obsolete pre1.5.12 lab recovery tasks were separately removed through exact ownership checks after their old helpers failed; this maintenance is not claimed as upgrade cleanup acceptance. The test used the owned built-in Administrator, so standard-user technician and current-candidate remote desktop/lifecycle qualification remain open. [Independent native reproduction](evidence/1513-independent-native-reproduction-20261031.json) passed: all eight original unsigned shipping outputs are byte-identical, with1334 tracked public files, six generated bridges and618 matching MSVC inputs per build. This supersedes any inference that successful MSI verification alone qualified technician restart.
+
+- Development candidate `1.5.11+79` gives configuration/recovery tasks and
+  noninteractive trust/update helpers normal scheduling priority. Restart and
+  restore migrate the validated existing configuration task without changing
+  its action or account. This source change follows a Windows10 lab repair;
+  [Windows/Linux component checks](evidence/1511-component-priority-and-recovery-ci-20261030.json)
+  passed, including the real Windows parent/child priority test and large-backup
+  recovery. The [full native build and local archive/source verification](evidence/1511-7b60309-native-build-and-source-ci-20261030.json)
+  also passed, including customer headless service startup and unsigned technician
+  install/repair/uninstall on CI. All1314 tracked source files and six generated
+  bridge files matched. [Independent build41093808835 and original-byte comparison](evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json) passed: all eight shipping outputs,1314 tracked source files, six bridge files and618 MSVC input files per build matched. Production signing and installed-endpoint qualification remain open.
+  [Owned lab signing](evidence/1511-7b60309-owned-lab-signed-packages-20261030.json)
+  subsequently produced verified customer/technician MSIs, their native programs,
+  the agent, management and worker using the retained nonexportable lab key.
+  These are test packages; no1.5.11 installation or live company upgrade is
+  qualified by signing alone. A matching
+  [Linux lab management build](evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json)
+  passed fresh-company setup, MFA/replay, enrollment, restart and backup/restore
+  checks using a verified cached toolchain and a new empty build path. The [owned company server and private Windows worker upgrade](evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json) subsequently passed with a fresh encrypted backup, real HTTPS/MFA and unchanged company profile26, consent, accounts, permissions, release/job records, private worker credentials and TLS/transport containers. Both release14 company bundles passed exact-source/signature/hash checks and public customer/protected technician downloads. Automatic rollout remains paused; native integration, installed1.5.11 qualification and canonical Docker image reproduction remain open. The exact 1.5.10 receipts
+  below remain scoped to their original source and lab settings.
+- Working candidate `1.5.10+78` adds an early service-manager connection before
+  loading the native core. The corrected complete build run40988690083 succeeded:
+  [exact source, input hashes, security regressions and unsigned MSI lifecycle](evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json)
+  verified. The actual customer service started without desktop modules on CI;
+  technician install/repair/uninstall passed. Broader enrolled-machine upgrade
+  and reboot reliability qualification remains pending. [Independent Windows reproduction](evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json)
+  verified all eight original unsigned shipping files byte-for-byte, with matching
+  recorded compiler inputs and no shipping-file normalization. The
+  [startup design and boundary tests](../deployment/windows/SERVICE-STARTUP.md)
+  passed actual SCM/loader tests on Windows Server 2022 CI and the Server 2019
+  lab using simulated core DLLs; see the [boundary receipt](evidence/1510-service-bootstrap-scm-boundary-20261030.json).
+  Actual lab-signed 1.5.10 subsequently passed an enrolled Server2019 upgrade and
+  three normal reboots with automatic native startup and no timeout events;
+  [distribution and reboot evidence](evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json)
+  retains the historical 1.5.9 failure and the remaining qualification limits.
+  The first native build failed on a missing `winsvc` dependency feature; the
+  feature is now explicit in source `b1fbe1e` used by that corrected run.
+- Earlier native customer/technician candidate: `aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521`,
+  version `1.5.9+77`.
+- Management storage/recovery candidate:
+  `361d7c362de7f67b7b7456d33bf0191736eec7d5`.
+- Migrated Windows installer worker:
+  `1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc`.
+- These Windows lab packages use a disposable lab publisher. Production signing
+  approval and production-signed release artifacts remain outstanding.
+- [Windows/Linux component reproduction](evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json)
+  establishes identical management, agent and worker bytes in the two recorded
+  component builds. The separate 1.5.10 Windows reproduction above covers the
+  native packages; canonical Linux Docker image reproduction remains separate.
+
+## Current acceptance boundaries
+
+| Requirement | Evidence and remaining gate |
+| --- | --- |
+| Independently hosted company setup, packages and enrollment | [Separate Windows company lab](evidence/159-windows-company-install-enrollment-20261029.json) has customer MSI enrollment, protected technician distribution and a real authorized native session. Linux company evidence is separate; neither deployment supplies hosted infrastructure for other companies. |
+| Customer approval and authorization loss | Windows company receipt records attended approval, grants, relay correlation, disconnect and management-outage lease termination. [Current 1.5.10 Linux-company outage and recovery](evidence/1510-linux-native-management-outage-recovery-20261030.json) ended native access early when authorization renewal failed, refused new requests, retained closure beyond the original deadline, rejected expired renewal, and recovered a fresh customer-approved desktop session after restoring the same management container. Customer stop then closed that new server record. The exact deadline-only termination branch, public network negative-access and all advertised OS combinations remain open. |
+| Clipboard and file transfer | Earlier [receiving permission denial](evidence/159-windows-receiving-file-permission-denial-20261029.json) passed. Native1.5.13 now passed [bidirectional Unicode and RGB-image clipboard](evidence/1513-native-unicode-and-image-clipboard-20261031.json) with independent saved-text/pixel hashes and viewer clipboard disabled. A [64MiB random-file roundtrip and256MiB interrupted-transfer retry](evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json) passed exact hashes and partial cleanup on the Windows10 standard-user customer. The old transfer UI stayed at11% after a real20-second network outage; a fresh customer-approved retry recovered the bytes. Bounded stalled-send handling remains open. These tests use an Administrator technician and do not qualify alpha-channel images, exact resumed offsets or automatic file-transfer recovery. |
+| Secure desktop and unattended consent | [Lock/unlock](evidence/159-windows-attended-lock-unlock-20261029.json), [standard-user UAC](evidence/159-windows-standard-customer-uac-20261029.json), and [unattended reboot/logon/revocation](evidence/159-windows-unattended-reboot-logon-revocation-20261029.json) passed in that lab. This is not universal Windows qualification. |
+| Multiple monitors | [Two real QXL displays](evidence/159-windows-native-two-monitor-20261029.json) passed native selection and input. Other display drivers and OS combinations remain open. |
+| Company branding and cache | [Both native editions](evidence/159-windows-native-branding-sync-20261030.json) automatically rendered changed branding and monotonic restoration, then rendered cached branding after restart during verified management outages. This test does not qualify software-upgrade preservation or key rotation/negative profile cases. |
+| Windows encrypted recovery and transport data | [Populated migration](evidence/361d7c3-windows-populated-transport-migration-20261029.json), [running recovery/rollback](evidence/361d7c3-windows-populated-running-recovery-20261029.json), and [native session with restored data active](evidence/361d7c3-windows-native-active-restored-data-20261030.json) passed. Different-host disaster recovery remains open; Linux migration has separate evidence below. |
+| Current Linux recovery and migration | [Encrypted offline restore](evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json) preserved keys, settings, all21 installers and six TLS identities. [Live restore, migration and rollback](evidence/361d7c3-linux-live-migration-recovery-20261030.json) then passed with fresh MFA, permissions and download checks. The latest original data was upgraded to schema3, rolled back using a fresh schema2 checkpoint, and rolled forward successfully. A subsequent [current native attended session](evidence/1510-linux-native-attended-session-20261030.json) passed against this deployment. The [profile26 archive restore](evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json) recovered the rotated signing key, exact HTTPS identity, MFA and permissions,23 installer files and six TLS identities in separate storage. It preserved withdrawn downloads and revoked workers; fresh replacement bundles subsequently passed public/protected downloads. Different-host recovery and a native session to that restored clone remain open. |
+| Installer worker credential protection | [Private worker checks](evidence/1c43a38-private-worker-windows-checks.json) cover the earlier Windows company migration. Every existing lab worker must be separately migrated; revoked legacy registrations must stay revoked. |
+| Server 2019 upgrade and startup | The [historical 1.5.9 timeout](evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json) is retained. [Actual 1.5.10 upgrade and three normal reboots](evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json) passed with automatic native startup, no timeout events, unchanged identity/consent, installed-file verification and private worker authorization. Physical cold-power-on, remaining desktop features and other OS startup qualification remain open. |
+| Server 2025 technician upgrade | [Existing 1.5.1 technician to 1.5.10](evidence/1510-server2025-technician-upgrade-20261030.json) passed exact signed-file, publisher and shipping verification, preserving company trust and consent while refreshing signed branding. The original observer used the customer version label and failed after setup; independent verification passed without repeating installation. The installed native app subsequently rendered company branding, completed MFA login and displayed authorized devices. The subsequent session has separate evidence below; standard-user deployment and the remaining lifecycle matrix remain open. |
+| Current native Linux-company session | [1.5.10 technician/customer session](evidence/1510-linux-native-attended-session-20261030.json) passed MFA, authorized inventory, named customer approval, real desktop rendering, correlated pointer/Escape input, a live lease beyond its initial 300 seconds and customer-initiated disconnect with the same server record closed. Other desktop features and external transport qualification remain open. |
+| Current authorization rejection | [Company and receiving-device HTTPS checks](evidence/1510-linux-authorization-negatives-20261030.json) rejected anonymous/unassigned access, pending-device grants, unattended access without consent, changed grant payload/signature, second claim and closed-grant renewal/replay before expiry. Existing devices and consent stayed unchanged. The native unassigned account completed MFA and showed no authorized devices or support controls. A separate [stock native client](evidence/1510-native-stock-client-legacy-denial-20261030.json) received an explicit company-authorization denial with a dummy legacy password and no grant. Current outage/recovery evidence is above. The current direct TCP denial is recorded above; remaining graphical route coverage and the Windows matrix retain separate gates. |
+| Approved automatic updates | [Actual Server 2019 technician automatic upgrade](evidence/1510-server2019-technician-automatic-upgrade-20261030.json) passed from 1.5.8 to 1.5.10. The same signed-in app deferred under pause, a closed maintenance window and zero-percent rollout, then downloaded and installed the approved MSI on its timer when policy opened. Exact signed files, shipping verification, identity/consent/trust preservation, automatic restart, fresh MFA/inventory and the exact company installation report passed. The original paused policy was restored. The [Windows10 customer1.5.12 receipt](evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json) now qualifies real active-session deferral and power-loss recovery on that endpoint. Technician interruption, remaining reporting/rejection cases and the OS/edition matrix remain open; older receipts remain source-specific. |
+| Public connectivity without Tailscale | Native maintained-relay tests currently use separate VMs with lab host port forwarding. External NAT traversal, external relay fallback and negative-access tests are not qualified by those results. |
+| Profile security and trust rotation | [Current compiled-agent rejection checks](evidence/1510-installed-agent-profile-rejection-20261030.json) passed 28 isolated public-fixture cases on Windows 10 and Server 2019. [Live installed key rotation](evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json) then passed automatic trusted transition/adoption on the Windows 10 customer and both Server 2019 editions, preserving identity and consent. Current shipping agents accepted new-key HTTPS controls and rejected missed-transition caches; old downloads were withdrawn. Fresh native MFA/approval/desktop and customer stop passed after rotation. The worker pin was changed explicitly, preserving its credential and ACLs. [Post-rotation restore and replacement bundles](evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json) also passed. Offline-client recovery, interrupted activation and the remaining live tamper cases stay open. |
+
+## Deferred Windows compatibility matrix
+
+Windows 11 is the first-release gate above. The other systems below are deferred.
+For any future advertised candidate, do not substitute older-version test results for
+clean installation, repair, upgrade, interrupted-upgrade recovery, reboot,
+uninstall and native behavior on each advertised operating system.
+
+| Operating system, x64 Desktop Experience | Current candidate status |
+| --- | --- |
+| Windows 10 | The [1.5.4 approval-manager pipe failure](evidence/154-win10-receiving-approval-pipe-failure-20261030.json) remains preserved. A subsequent [automatic upgrade and current native session](evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json) reached 1.5.10 with exact signed files, shipping verification and unchanged identity/trust/consent. The older watcher required a scoped task-priority repair and controlled restart; this does not qualify the unmodified default update flow. Current customer approval, desktop, correlated pointer/Escape, lease renewal and customer Stop support passed; the same server session closed and the technician lost access. Complete lifecycle and session/update coordination remain open. |
+| Windows 11 | Earlier candidate coverage exists. Current qualification remains open; the lab must stop the two smaller endpoint VMs before allocating the Windows11 memory reserve. |
+| Windows Server 2016 | Substantial 1.5.9 native, installation and recovery evidence above; full install/update/uninstall matrix still open. |
+| Windows Server 2019 | Explicit 1.5.9 to 1.5.10 customer upgrade and three normal reboots passed with identity/consent and private worker preserved. Current attended native session, pointer/Escape input and customer disconnect passed with the Server 2025 technician. The same-machine technician automatically upgraded from 1.5.8 to 1.5.10 after pause/window/cohort deferral checks, preserved trust and consent, restarted and completed fresh MFA/inventory and installation reporting. Remaining desktop, negative-access and installer/update cases remain open. |
+| Windows Server 2022 | Unsigned 1.5.10 CI lifecycle passed; complete enrolled-machine matrix remains open. |
+| Windows Server 2025 | Existing per-user technician 1.5.1 to 1.5.10 explicit upgrade passed on build26100, with exact signed files, trust and consent preserved. Native branded UI, MFA login, authorized inventory and an attended session to the Server 2019 customer passed. Standard-user installation, customer, remaining desktop and lifecycle cases remain open. |
+
+Production publication also requires valid signing, exact corresponding source,
+documented deployment/update/restore procedures and closure of the remaining
+acceptance gates. The preserved Swan baseline and the company's production
+RustDesk/Tailscale access paths are not replaced by these lab results.
diff --git a/docs/RELEASE_PAYLOAD.md b/docs/RELEASE_PAYLOAD.md
new file mode 100644
index 00000000000..9a5974f1b98
--- /dev/null
+++ b/docs/RELEASE_PAYLOAD.md
@@ -0,0 +1,213 @@
+# Signed installed payload identity
+
+Portable technician bundles now include `Uninstall-Technician.ps1` and install a
+dedicated Start-menu removal shortcut. The uninstaller verifies installed identity,
+acquires session exclusion, cancels automatic recovery and removes fixed application
+files while retaining company state for reinstall. MSI installations use Windows
+installed-app removal. The bundle recipe now contains eleven entries; rebuild
+management and workers together and regenerate packages. Compiled exact-recipe
+tests reject altered uninstall scripts. The new source uninstaller passed a
+standard-user Server 2016 dry run, removal and trusted-bundle reinstall using the
+signed `0a541c7` payload: company state remained byte-identical and recovery was
+cancelled. A freshly generated eleven-entry bundle remains a publication gate.
+
+Release metadata now requires `installed_files`, an array of objects containing
+relative `path` and SHA-256 `sha256`. Customer manifests cover the final Flutter
+payload: the installed Swan executable, native libraries and application assets.
+The installed main executable hash must also equal `installed_sha256`.
+Technician manifests contain one entry for `SwanRemoteSupport-Technician.exe`;
+that hash covers its complete self-extracting payload.
+
+Release metadata may declare `rollback_protocol: 1` only when both its endpoint
+and configuration agent implement the failed-release quarantine and pending
+rollback format described below. The release signer attests this compatibility;
+do not add the declaration to old binaries. Omitted values default to zero and
+permit forward recovery only. Unsupported protocol numbers are rejected.
+
+Generate release inputs after signing the final binaries:
+
+```text
+python deployment/windows/generate-payload-manifest.py --edition customer --source FINAL_FLUTTER_DIRECTORY --output customer-installed-files.json
+python deployment/windows/generate-payload-manifest.py --edition technician --source SIGNED_PORTABLE_EXE --output technician-installed-files.json
+```
+
+For customer packaging, the generator maps the build's `rustdesk.exe` to the
+installed `Swan Remote Support.exe`. Include the resulting array in release
+metadata and sign that metadata with the configured release-signing key.
+Unsigned CI manifest drafts identify unsigned build bytes only; regenerate them
+after signing. Do not relabel the drafts as signed release evidence.
+
+Release validation rejects duplicate Windows path aliases, traversal, alternate
+streams, reserved names, missing core native libraries and an inconsistent main
+executable identity. Initial installation, repair, update completion, installed
+metadata verification and recovery verify customer file hashes and reject
+unlisted DLLs or EXEs. Paths resolving outside the installed directory fail.
+The agent has its separate signed release hash and is checked during initial
+installation and replacement through the staged update helper.
+
+RustDesk's copied `RuntimeBroker_rustdesk.exe` is Windows-owned and cannot be
+listed in project metadata. Verification instead requires its bytes to match
+`RuntimeBroker.exe` in the Windows system directory returned by the OS API.
+Windows servicing can change those bytes, requiring the installed copy to be
+refreshed. Compatibility and repair behavior after Windows servicing still need
+clean-machine testing.
+
+This is a development metadata change. Previously generated releases without
+the mandatory manifest are rejected; do not weaken validation to import them.
+No production compatibility or signing approval is implied. Private lab-signed
+customer MSI installation and automatic replacement have passed on Server 2016.
+Rollback, the remaining Windows compatibility matrix and native session behavior
+remain acceptance requirements; see [ACCEPTANCE.md](ACCEPTANCE.md).
+
+Interrupted-update receipts also block new managed sessions after the updater
+process exits or releases its activity lock. Recovery rechecks Windows support
+and the installed agent hash and publisher as well as the endpoint payload.
+An old or missing agent cannot be accepted as a completed release. Agent replacement
+is implemented through a staged signed helper and has passed private lab-signed
+customer updates on Server 2016. Full rollback behavior remains unverified. A release
+stays pending until its full installed identity is restored and verified.
+
+Automatic updates now stage both the installer and agent and verify their
+signed hashes and pinned publishers before writing the pending receipt. The
+watcher hands off to the staged agent and exits. The helper acquires exclusive
+session exclusion, revalidates the receipt and staged artifacts, installs the
+endpoint, replaces the old agent, and verifies the complete installed identity
+before advancing the sequence or removing the receipt. Customer completion
+restarts only the existing SYSTEM task whose action matches the canonical agent
+and `watch` arguments. No credentials are passed to the helper.
+
+Downloaded installers and helpers are published through a unique temporary file
+on the destination volume, flushed before atomic replacement. Download staging
+and replacement run outside the async runtime threads. A failed replacement
+cleans its temporary file and retains the previous complete staged artifact;
+hash and publisher verification still precede execution. Component regression
+coverage checks complete replacement and a destination-conflict failure. This
+does not establish recovery from a power loss or a failed native installer.
+
+For the real HTTPS download regression, build the `swan-agent` test executable
+with `cargo test --manifest-path product/Cargo.toml --locked -p swan-agent --no-run`.
+Run `node deployment/windows/test-update-download.js PRIVATE_ENV TEST_EXE NEW_RESULT_JSON`.
+The private environment supplies `SWAN_TEST_TLS_PFX`, `SWAN_TEST_TLS_PASSWORD`
+and `SWAN_TEST_CA_FILE` for a verified localhost test identity. The harness binds
+an ephemeral loopback port, executes only the explicitly ignored download test,
+and closes its own listener. It checks an actual HTTPS redirect, absent artifact
+credentials, tampered bytes and an interrupted response. Evidence includes the
+test executable hash; no installer is executed. Do not commit private TLS files
+or the environment. Release builds do not accept the debug-only test CA input.
+
+A watcher can resume a pending update after restart; administrators can invoke
+`swan-agent resume-update` to hand off explicitly. `recover-update` continues to
+verify an already completed installation without rerunning its installer.
+Recovery may finish the previously selected signed release after metadata expiry;
+it cannot authorize a new release or relax the stored sequence. The helper log
+and previous agent/portable executable are retained in the protected update
+staging directory. Missing or hash-damaged staged installers and helpers are
+re-downloaded from the exact HTTPS URLs in the validated pending receipt. These
+downloads send no company credentials, must match the receipt's hashes and
+pinned publisher, and do not select a newer release. Intact staging remains
+usable offline. Recovery rechecks the unchanged receipt and session exclusion
+before handoff. Permission and other staging I/O errors remain errors rather
+than being treated as missing files. Complete customer/MSI rollback and canonical-agent
+recovery remain incomplete. Graphical technician update coordination and this
+staging recovery from missing or damaged files still require native end-to-end
+verification. A Server 2016 lab test interrupted the helper before MSI execution;
+the normal scheduled retry completed the selected signed customer MSI and agent
+update, preserving identity and consent. This demonstrates forward recovery for
+that interruption point, not power-loss recovery during MSI or technician updates.
+
+Recovery validation is shared by completion, retry and helper execution. Its
+regression tests reject wrong keys/editions, tampering, conflicting sequences
+and unknown phases, including the case where a crash occurred after sequence
+persistence. Automatic retries use a durable five-minute attempt delay. Explicit
+`resume-update` requests retry immediately while retaining all trust and locking
+checks. A failed helper requests restart of the matching customer task, provided
+its installed agent still has a valid signature; pending receipts continue to
+block sessions. Corrupt or missing canonical agents still require recovery from
+a verified staged helper or explicit setup/repair. Scheduled forward retry and
+post-upgrade reboot persistence have passed on Server 2016 with private lab trust.
+Power-loss behavior remains unverified.
+
+New automatic updates require a previously recorded signed installation. Before
+writing their pending receipt, they verify the current installed release and
+publish a complete rollback snapshot under `updates/SEQUENCE/rollback`: the
+signed installed-release envelope, every manifest-listed endpoint file (including
+customer libraries and assets), and the matching configuration agent. Snapshot
+files are hash checked while copying, flushed, and verified before the complete
+directory is renamed into place. The old metadata is accepted after expiry only
+for its exact recorded sequence and edition under the existing release trust key.
+Executable and agent publisher checks remain mandatory. The update receipt binds
+that previous envelope; a helper verifies its snapshot before changing the payload.
+Mutable branding, identity, credentials and consent are not copied into release
+snapshots or restored to older values. Legacy receipts without a snapshot can
+continue forward recovery, but do not gain rollback evidence retroactively.
+
+Portable technician EXE updates now restore those verified inputs after an
+installation or installed-identity failure, provided the previous signed metadata
+declares rollback protocol 1 and the verified previous agent's `rollback-protocol`
+command confirms support. A durable `rolling_back` receipt precedes restoration.
+Automatic upgrades retain the installed EXE/MSI format; changing formats requires
+explicit installation/migration so installer registrations are not silently lost.
+Clients derive that format from their exact signed installed-release metadata
+and send `format=exe` or `format=msi` when requesting an approved update. The
+management server selects the latest approved, unexpired release matching that
+format, edition and channel, while still applying rollout and maintenance policy.
+Legacy requests without a format retain discovery compatibility. New clients
+also reject a mismatched response, including one from an older server that ignores
+the format query. Missing or invalid installed metadata requires explicit repair.
+Retries finish that same rollback instead of attempting forward installation;
+rollback does not require the new installer package to remain available. The
+old EXE and agent are replaced through verified atomic staging, and their full
+installed identity is checked before the previous metadata becomes current.
+Deleted applications are not resurrected, and a committed newer installation
+cannot be downgraded by this recovery path. The unchanged state retains the
+previous installed sequence and current company identity and consent.
+
+Before removing the pending receipt, rollback durably records `failed-update.json`
+with the failed and previous signed envelopes. Discovery and fresh installation
+reject sequences at or below that watermark; only a later approved sequence can
+advance. Repair still requires the exact installed release. Invalid quarantine
+metadata, wrong trust or edition, unknown phases/protocols and I/O errors fail
+closed. Quarantine persists through subsequent successful installations. No
+technician login token is passed to or restored by rollback.
+
+Windows service/MSI registration restoration is implemented through the narrowly
+validated `Restore-ReleaseMsi.ps1` path, but signed native rollback and full
+power-loss acceptance remain unverified. Prepared portable technician rollback
+has restored lab-signed endpoint and agent binaries on Server 2016; native
+installed-identity and quarantine checks passed independently. The original
+SSH harness and app restart remain unresolved, and automatic failure selection
+has not been demonstrated. See [ACCEPTANCE.md](ACCEPTANCE.md) for the scope.
+Component tests cover complete file
+preservation, rejection of tampered/missing sources and unsafe paths, incomplete
+snapshot cleanup, immutable published snapshots, and previous metadata trust and
+sequence checks. Quarantine/receipt regressions cover replay suppression, eligibility
+of later releases, metadata expiry, old protocol exclusion, wrong edition/key,
+tampering, malformed storage and legacy forward recovery. Signed installed-app
+rehearsals remain required; these tests do not substitute for native rollback.
+
+Initial installation, explicit repair, completed updates and completion-only
+recovery now retain the exact installer under `releases/SEQUENCE/installer.exe`
+or `installer.msi`. Retention rechecks its size, signed hash and publisher before
+and after atomic copying. `record-installation` therefore requires the original
+installer path as well as `release.json`; the company setup wrapper supplies both.
+Installed sequence advancement and removal of recovery markers wait for this
+retention step. New snapshots also preserve the original installer in `package/`.
+Older installed versions without a cache can fetch only their exact previously
+recorded artifact through verified HTTPS before an update is prepared. Expiry
+does not authorize a different package. A missing, corrupt or unverifiable old
+artifact defers the update before installation; keep corresponding release files
+available on company-controlled storage. Retained packages are software artifacts,
+not copies of mutable enrollment or consent. MSI/service restoration still needs
+signed native end-to-end tests, including registration, service/task consistency
+and interruptions during restoration.
+
+The agent and Windows worker launch Windows PowerShell from the OS-resolved
+system directory and restrict module discovery to its built-in modules. This
+prevents inherited PowerShell 7 module paths from breaking hash/signature checks.
+Local regressions confirm the built-in commands are present and that an unsigned
+installer with a correct hash is rejected without publishing a retained package.
+An actual Windows-signed executable copied into the isolated fixture passes
+positive retention; wrong publisher and certificate pins are rejected while
+retaining the previous complete cache. The fixture is never executed and no
+certificate is installed. This checks Authenticode retention, not a signed Swan
+installer or Windows Installer registration recovery.
diff --git a/docs/SERVER_BACKUP.md b/docs/SERVER_BACKUP.md
new file mode 100644
index 00000000000..cfe3776a78a
--- /dev/null
+++ b/docs/SERVER_BACKUP.md
@@ -0,0 +1,263 @@
+# Company server backup and restore
+
+Supply `SWAN_DATA_DIR` and `SWAN_BACKUP_PASSPHRASE` to the management process
+through private environment configuration. Keep the passphrase separate from
+the backup file. It must contain at least 16 characters. These commands never
+accept a passphrase on the command line.
+
+Management-only export remains available:
+
+```text
+swan-management backup company.swan-backup
+```
+
+For a deployment export, replace the path placeholders with company-controlled
+paths. Omit `--tls-identity` only when HTTPS identity will be reissued separately.
+The TLS identity argument accepts one existing file, such as a PFX or PEM bundle.
+Use `--tls-directory HTTPS_STORAGE_DIRECTORY` for the complete certificate-service
+storage tree, including ACME account and certificate files. For Caddy, supply its
+persistent data directory. Stop certificate renewal and other writes to this tree
+for the duration of export. Export reads it without stopping or modifying services.
+
+```text
+swan-management backup company.swan-backup --transport-directory TRANSPORT_DATA --deployment-env PRIVATE_ENV_FILE --tls-identity TLS_IDENTITY_FILE
+```
+
+Alternatively, replace the final option with `--tls-directory HTTPS_STORAGE_DIRECTORY`.
+Both options can be included when the deployment uses separate storage and identity files.
+Add `--installer-artifacts-directory COMPANY_DATA/artifacts` to preserve generated
+customer and technician bundles and their existing download links. Pause builds
+and uploads, and keep management configuration changes stopped during this export.
+Only regular files named with canonical build UUIDs and `.zip` are accepted;
+unfinished `.partial` uploads cause export to fail. Installer files share the
+64 GiB expanded-content and 4096-file limits with the rest of the archive. If those
+limits are exceeded, keep the installer directory in a separate protected backup
+and restore it with the matching management database. Management-only export
+omits these files, so its restored build records alone cannot serve old downloads.
+Directory exports reject symbolic links, Windows reparse points, special files,
+unsafe paths, and more than 4096 total files. The 64 GiB total plaintext limit applies.
+When the company data directory contains `Caddyfile`, export also encrypts that
+HTTPS configuration and restore places it back in the replacement data directory.
+Keep configuration edits stopped during export. Older archives without this
+file remain supported; reconstruct and validate their HTTPS recipe before use.
+
+When present, the Windows service ownership receipt `installation.json` is also
+encrypted and restored. It must be a nonempty regular file no larger than 64 KiB;
+links, directories and oversized receipts fail export. Restore applies the same
+size bound before publishing files. This preserves the metadata needed by the
+owned server removal/maintenance checks. Restore does not register services,
+change firewall rules or trust the receipt's paths automatically. Validate its
+install/data paths and rule ownership against the actual replacement service;
+a different machine/layout can require a receipt from its matching installation.
+
+Backups containing this receipt require a management reader with receipt support.
+Earlier SWANBK2 readers reject the additional entry safely. Retain the matching
+management binary/source and an earlier compatible backup when planning rollback.
+Older archives without a receipt still restore, but their Windows service
+ownership metadata must be retained or reconstructed from a matching installation
+before maintenance/removal; they do not establish complete Windows recovery.
+
+
+Stop transport services before exporting their directory, and keep them stopped
+until export completes. The directory must contain both `id_ed25519` and
+`id_ed25519.pub`. When present, `db_v2.sqlite3` and its WAL or rollback journal
+are copied into private temporary storage, recovered there, and snapshotted using
+SQLite's backup API. This preserves committed WAL changes when the stopped
+source is mounted read-only and cannot create shared-memory files. Export does
+not write into that source. Transport database inputs share a 512 MiB copy limit.
+Management uses the same API for its database, including committed WAL data.
+Schema version 2 keeps active and pending profile-signing keys in that database;
+the original `profile-key.hex` file alone is insufficient after rotation. See
+[profile key rotation](PROFILE_KEY_ROTATION.md) for the migration and maintenance procedure.
+Stop configuration changes during the export when a coordinated snapshot of
+the separately stored environment, TLS identity and transport data is needed.
+The export does not stop or modify running transport services.
+
+Earlier Windows managed deployments could leave the rendezvous database in
+the RustDesk LocalService profile rather than this transport directory. Such an
+archive can preserve transport keys while omitting peer records. The corrected
+Windows launcher pins `DB_URL` inside company storage; startup and full transport
+export reject an unmigrated legacy database. Follow the stopped-service
+[Windows database migration procedure](../deployment/windows/SERVER-COMPONENTS.md)
+before upgrading an affected deployment, then create and restore-test a new
+backup. This correction does not add missing records to an older archive.
+
+New exports use the `SWANBK2` format: AES-256-GCM through RustCrypto's
+[STREAM implementation](https://docs.rs/aead/0.5.2/aead/stream/struct.Encryptor.html),
+an Argon2-derived key, a fresh random salt and nonce, and authenticated 1 MiB
+segments. A mandatory authenticated final segment rejects truncation; ordering
+is authenticated by STREAM. The complete format header is associated data.
+Existing backup files are never overwritten. Readers also accept `SWANBK1`
+archives within their original 1 GiB encrypted / 512 MiB expanded limits.
+**Older management binaries cannot restore SWANBK2.** Retain the exact matching
+management binary/source with backups, and retain a tested legacy backup when
+planning a downgrade.
+
+Export creates a private disk-backed plaintext ZIP inside the company data
+directory, then encrypts it in bounded chunks. Restore decrypts to a private
+sibling staging directory and checks every path, expanded size and ZIP CRC
+before renaming the fully extracted directory into the requested target. A
+wrong password, modified/truncated backup, invalid entry or extraction failure
+leaves the target untouched. Its parent directory must already exist.
+Temporary archives, database snapshots and partial encrypted output are removed
+on ordinary failure and success. A power loss or forced process termination can
+leave private `.swan-backup-*` staging or `backup-*.sqlite3` snapshots; inspect and
+remove only those owned remnants after confirming no backup/restore is active.
+Use encrypted storage, restricted directory permissions and adequate free disk
+space (allow the archive plus expanded contents during restore). Restored keys
+remain private to the invoking account, SYSTEM and Administrators on Windows,
+or mode 0700 directories / 0600 files on Unix. This is a company-state backup,
+not a general-purpose filesystem backup tool.
+
+The new format, legacy compatibility and above-limit recovery regressions must
+pass on Linux and Windows before deployment. Large tests explicitly generate
+and restore a 513 MiB incompressible installer fixture; their CI logs are retained.
+Full deployment restore and interrupted-operation rehearsals remain separate
+gates; the new implementation alone does not establish those results.
+
+Restore into an **empty directory** while the replacement management service
+is stopped and its public endpoints are unavailable:
+
+```text
+swan-management restore company.swan-backup
+```
+
+Set `SWAN_DATA_DIR` to that empty replacement directory before running restore.
+The restorer authenticates and validates the archive before publishing restored contents.
+It permits fixed management filenames and validated relative paths under
+`tls-storage/` and canonical build ZIPs under `artifacts/`, rejects duplicate or Windows-colliding names, file/directory
+conflicts and incomplete key pairs, and protects restored files with private Unix permissions or Windows
+ACLs for the invoking account, SYSTEM and Administrators.
+
+Management files restore directly. Deployment extras are staged in that same
+protected directory; restore never overwrites external service files:
+
+| Restored file | Destination to configure before exposing the server |
+| --- | --- |
+| `transport-id_ed25519` | Transport data directory as `id_ed25519` |
+| `transport-id_ed25519.pub` | Transport data directory as `id_ed25519.pub` |
+| `transport-db.sqlite3` | Transport data directory as `db_v2.sqlite3` |
+| `deployment.env` | Private deployment environment configuration |
+| `tls-identity` | Company HTTPS identity location, or replace through certificate reissuance |
+| `tls-storage/` | Complete HTTPS service data directory; copy while that service is stopped |
+| `Caddyfile` | HTTPS recipe in the replacement company data directory; validate paths and hostnames before starting |
+| `installation.json` | Windows ownership receipt; validate against actual service/install/data paths and owned firewall rules before maintenance/removal |
+| `artifacts/` | Generated installers in the replacement company data directory; verify stored hashes and both public/customer and protected/technician download behavior |
+
+Keep transport services stopped while placing their restored data. Preserve
+private ownership and permissions appropriate to the service accounts. Use the
+same application release first, then perform administrator-controlled upgrades.
+Current restores also accept older management-only three-file backups; older
+restorers cannot consume the extended deployment archive.
+
+Before exposing the restored deployment, verify the transport and profile trust
+keys, database integrity, MFA login, device identities, consent, permissions and
+release approvals. Reconcile any revocations made after the backup. Installed
+clients reject profiles older than their cached revision, so recover a profile
+revision newer than those clients have accepted before attempting normal sync.
+These restore rehearsals and migration rollback checks remain release gates.
+
+## Isolated restore rehearsal
+
+The Server 2016 MSVC CLI from `9fa5e8a` now has a separate
+[full Windows recovery receipt](evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json).
+It covers the Windows ownership receipt, management and transport keys, complete
+HTTPS storage, service environment and four installers. The authenticated restore
+was started at the existing canonical data path, verified over HTTPS with MFA and
+original public/protected downloads, then rolled back to the preserved original
+directory and verified again. No transport database existed in that source;
+this test does not prove recovery of a populated Windows transport database.
+It also does not establish different-machine recovery or schema migration rollback.
+
+The subsequent
+[maintained Windows stack upgrade](evidence/9fa5e8a-windows-maintained-stack-upgrade.json)
+retained that tested backup and switched management and pinned transport together.
+Normal binary/transport rollback and roll-forward preserved company trust and
+authorization. The database remained at schema 3; this was not a database downgrade.
+The final company stack runs the maintained transport, whose real IPv4/IPv6 UDP
+registration passes. Native relay sessions and public Internet reachability remain
+separate acceptance requirements.
+
+On29October local time, the actual Linux company at schema2 passed a management
+image upgrade, rollback and roll-forward. Its legacy archive and a new SWANBK2
+archive were each restored separately using the new binary, preserving trust,
+MFA, five devices, consent, all16 installers and actual public/protected download
+behavior. Restore copies were stopped without cloned transport. See the
+[scoped receipt](evidence/67b5c69-company-backup-and-rollback.json).
+
+The generated513MiB CLI fixture additionally passed a512MiB address-space cap,
+ordinary write-error cleanup, a real SIGKILL during authenticated restore staging,
+and successful retry. Interrupted contents were not published; leftover plaintext
+staging retained private permissions and was not silently deleted by the retry.
+The fixture explicitly cleaned its own remnants afterward. A file-size limit
+injected the write error; this was not a full-filesystem or host-power-loss test.
+Windows full-company restore and future schema-downgrade recovery remain separate.
+
+`node deployment/windows/test-server-restore.js ORIGINAL_PRIVATE_ENV
+RESTORED_PRIVATE_ENV` checks two separately running local HTTPS test servers.
+Use only the isolated fixture created by `test-company-lifecycle.js`; its private
+administrator credentials and customer state must remain in protected test
+directories. Never point this harness at a company production deployment.
+
+The actual management CLI at `20f88e3` exported and restored that fixture with
+its private deployment environment and TLS identity. Hash comparisons preserved
+the profile-signing material, setup token, environment and TLS identity. The
+restored SQLite database passed `PRAGMA quick_check`. The restored server passed
+real HTTPS verification of signed configuration, administrator MFA, accounts,
+device state, group capabilities, and denial of a revoked device and its session
+grant. Private results are recorded in the restored test directory.
+
+This does not demonstrate live hbbs/hbbr recovery, certificate renewal, recovery
+of changes after the backup, profile revision reconciliation or migration
+rollback. Those remain acceptance requirements.
+
+The extended storage component test additionally preserves nested certificate
+private-key and ACME account fixtures through encrypted export and restore.
+It does not demonstrate a running Caddy service restoring or renewing certificates.
+
+The extended HTTPS rotation rehearsal additionally passed actual CLI export and
+restore of a rotated management database, deployment environment and the local
+HTTPS PFX/certificate storage. Its replacement HTTPS proxy serves using the
+restored identity; rotated profile trust, device credentials and closed-grant
+denial survive. Both original/restored fixture processes stop afterward. This
+remains isolated local TLS evidence; ACME renewal and live transport restore
+are still unverified.
+
+The Linux `test_container_stack.py` rehearsal now additionally restores actual
+pinned RustDesk transport keys/database and Caddy storage, alongside management
+and private deployment settings, from one encrypted archive. It starts replacement
+management, rendezvous, relay and HTTPS containers on separate volumes. The
+original CA still validates HTTPS, signed company configuration and transport
+identity remain unchanged, and enrollment, consent, MFA replay protection,
+logout and device revocation survive. The original deployment starts again and
+retains its pending device despite revocation in the replacement. Private key
+contents never leave the volumes. This supersedes the earlier local transport
+restore limitation above; remote desktop sessions, public ACME renewal,
+post-backup reconciliation and migration rollback remain unverified.
+
+The compiled, lab-signed `0a541c7` Windows management executable also passed an
+isolated Server 2016 management-only export/restore rehearsal. The restored
+server retained identical signed profile bytes, signing/setup files, accounts,
+devices, worker revocation state and approved releases. Administrator MFA worked
+on both servers and replay was denied. Existing-backup overwrite, nonempty restore,
+wrong passwords and a changed ciphertext byte were rejected; authentication failures
+created no target files. This rehearsal used guest-loopback HTTP for API comparisons
+and did not exercise transport, TLS restoration or database migration rollback.
+
+The updated native Windows management build at `b0cb740` then passed the same
+rehearsal with `--installer-artifacts-directory`. Its replacement Server 2016
+server served one customer bundle publicly and two technician bundles only after
+authentication; unauthenticated technician requests returned 401. All downloaded
+files matched their pre-backup recorded SHA-256 hashes. Trust, accounts, worker
+state, releases and MFA/replay protections remained intact. This uses a locally
+built GNU executable with the disposable lab publisher, and guest-loopback HTTP;
+it does not establish production signing, public connectivity or live transport recovery.
+
+The current MSVC build from `11faae3` also passed that Server 2016 rehearsal with
+four retained bundles: one public customer download and three authenticated
+technician downloads, including the newer eleven-entry MSI bundle. All hashes,
+trust/configuration/authorization comparisons and negative restore/MFA checks
+passed. Its lab-signed executable and both isolated foreground processes were
+verified, with existing service statuses preserved. This remains guest-loopback
+management evidence; native transport/TLS restore, migration rollback and
+production publication require their own verification.
diff --git a/docs/SERVER_CONTINUATION_PROMPT.md b/docs/SERVER_CONTINUATION_PROMPT.md
index 5228c4e18e6..cefa504b93d 100644
--- a/docs/SERVER_CONTINUATION_PROMPT.md
+++ b/docs/SERVER_CONTINUATION_PROMPT.md
@@ -1,5 +1,7 @@
 # Server continuation prompt
 
+> Historical continuation prompt for the single-company RustDesk/Tailscale baseline. Use it only when maintaining that preserved deployment. Current company-hosted product work follows the [product guide](../product/README.md) and [acceptance report](ACCEPTANCE.md).
+
 Paste the following into Codex when working on the RustDesk/Tailscale server. It is intentionally evidence-first because live Tailnet, firewall, and key changes can interrupt support access.
 
 ```text
diff --git a/docs/SOURCE_AND_LICENSE.md b/docs/SOURCE_AND_LICENSE.md
index 8d02df86173..7224c43d20f 100644
--- a/docs/SOURCE_AND_LICENSE.md
+++ b/docs/SOURCE_AND_LICENSE.md
@@ -1,17 +1,335 @@
 # Source availability and licensing
 
-Swan Remote Support is a modified RustDesk client distributed under the GNU Affero General Public License v3.0. Anyone receiving a Swan binary must be able to obtain the complete corresponding source for that exact version, including Swan modifications, build scripts, pinned build configuration, and licence notices.
+Swan Remote Support retains RustDesk attribution and AGPL-3.0 licensing. Publish complete corresponding source for every distributed release, including endpoint, management, protocol and worker changes, build scripts, pinned toolchains/dependencies and license notices. Release metadata must identify the exact immutable public source tag. Keep the source revisions for packaged rendezvous/relay components public in the transport manifest.
 
-The corresponding-source link in every release must point to the immutable public Git tag that produced that binary. A private source copy offered only on request is not the selected release model for this project. The public server address and Ed25519 public key may appear in source; they do not grant access without Tailscale authorization and a device-specific Swan password.
+Each company hosts its own deployment. Company names, logos, colors and public bootstrap/profile trust information customize the product; they do not grant technician access. The configurable product uses enrollment, group authorization, signed session grants and receiving-device enforcement. New packages do not require Tailscale or collect reusable legacy support passwords.
 
-Never publish:
+Never publish company private transport/configuration keys, device credentials, technician/admin tokens, TOTP seeds, signing private keys/PFX passwords, backup decryption material, customer data or private operational logs. Installers carry public bootstrap information only. Machine-specific test/deployment settings and all test credentials belong in ignored local environment/data files.
 
-- the RustDesk server's private `id_ed25519` key;
-- customer device IDs/passwords or customer data;
-- Tailscale auth keys, API/OAuth secrets, or exported session credentials;
-- code-signing keys, PFX files, passwords, or recovery material; or
-- production logs, backup contents, or support-session recordings.
+Project-signed binaries retain the certificate publisher's embedded identity. Company branding assets do not change that identity. Changing embedded resources requires new signed binaries and the corresponding public source/build description. Never supply a project signing private key to company servers or workers.
 
-The official Tailscale Windows MSI is downloaded separately from Tailscale, is not modified or rebranded, and is not part of Swan's AGPL corresponding source. Tailscale's open-source client code is BSD 3-Clause licensed, while its official Windows product and hosted service have additional licensing and service terms. See [Tailscale deployment](TAILSCALE_DEPLOYMENT.md).
+The original single-company Tailscale deployment remains available at `swan-single-company-baseline-1.4.9`; its historical build/deployment documents apply to that baseline only.
 
-Before publishing a release, run a repository-history and artifact secret scan, build from a clean checkout, verify the release hashes and signatures, and confirm the public tag matches the exact source used. Retain upstream RustDesk attribution and the repository's `LICENCE` file.
+Before production publication, build from the reviewed public source, verify artifacts and their signatures/hashes, complete the acceptance checks and publish exact corresponding source. Preserve the repository's `LICENCE` and upstream notices.
+
+The Windows workflow also produces `SwanRemoteSupport-build-source.zip` before
+application compilation. It contains the actual tracked source bytes, initialized
+pinned submodule source, and the six explicitly named generated bridge files.
+`BUILD-SOURCE.json` records repository revisions and every included file hash;
+the public workflow in the archive describes subsequent packaging transformations,
+including removal of the portable launcher's DPI manifest entry. Ignored local
+settings, untracked logs, credentials and build binaries are not swept into this
+archive. Missing bridge inputs, source links, unmerged indexes and submodule pin
+mismatches fail the build. The artifact checksum list includes the archive hash.
+Publish this archive alongside the exact source tag, build instructions and
+third-party component source references. Its presence does not prove binary
+reproducibility or replace release acceptance and signing checks.
+
+The portable packer sorts payload entries and pins its Brotli encoder version.
+Its existing `timestamp` metadata field now carries a nonzero content-derived
+extraction-cache identity within the TOML signed-integer range. Identical packed
+bytes retain the same cache identity; changed payload bytes or startup executable
+selection refresh it even when the software version is unchanged. The metadata
+format stays compatible with the current launcher. This cache marker is not an
+authorization credential or a replacement for package signatures and hashes.
+
+Managed native builds require `SOURCE_DATE_EPOCH` and render their application
+build date in UTC from that recorded timestamp. The Windows workflow derives it
+from the exact public source commit; the application source capsule records it
+as `source_date_epoch` in `BUILD-SOURCE.json`. For a local managed build, set
+`$env:SOURCE_DATE_EPOCH = (git show -s --format=%ct HEAD).Trim()` before invoking
+the build. When rebuilding an exported source capsule without Git, use its
+recorded epoch. Missing, invalid or unsupported timestamps fail the managed
+build instead of silently substituting local wall-clock time. The ordinary
+upstream build retains its existing metadata path.
+
+The topmost-window helper is built from public upstream commit
+`ecd8d6a139eee76845ea66423fb739af450fda90`. Its x64 release workflow requests
+`/Brepro` for compilation and linking, disables incremental linking and records
+a PDB basename. These linker environment settings are documented by
+[Microsoft](https://learn.microsoft.com/en-us/cpp/build/reference/linking?view=msvc-170).
+The PE verifier requires the documented
+[REPRO debug marker](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format)
+and rejects an embedded absolute PDB path. These checks establish build metadata
+properties; an independent binary comparison is still required. Its original
+source, public workflow and verification scripts are retained in a separate
+source artifact and carried alongside native build outputs, outside the
+installed endpoint payload.
+
+## Patched Windows Flutter engine provenance
+
+The managed Windows workflow currently downloads the RustDesk engine release
+asset `windows-x64-release.zip` and requires SHA-256
+`ec8cabf36ee4ff24c8d98de25b00e70781eb03876265aee84d0fe554a110036e`.
+This verifies the reviewed binary input. It does not establish which source and
+toolchain produced that input or prove that rebuilding it yields identical bytes.
+
+The public [upstream build recipe](https://github.com/rustdesk/engine/blob/bc374ca81eae3f77329ebf7bc98efadfde10018e/.github/workflows/flutter-engine-windows-x64-release-build.yml)
+checks out engine tag `3.24.4`, changes `ClearCurrent` to `MakeCurrent` in
+`shell/platform/windows/flutter_windows_engine.cc`, adds `<string>` before
+`<string_view>` in `fml/hex_codec.h`, synchronizes dependencies, and builds
+`host_release`. The tag currently resolves to Flutter engine source
+[`db49896cf25ceabc44096d5f088d86414e05a7aa`](https://github.com/flutter-team-archive/engine/tree/db49896cf25ceabc44096d5f088d86414e05a7aa).
+Keep these source and patch references with the release's third-party notices.
+They identify a public reconstruction candidate; they are not an attestation
+that the pinned binary was built by this recipe.
+
+On 22 October 2026 the upstream API identified release `188171540`, tag commit
+`bc374ca81eae3f77329ebf7bc98efadfde10018e`, and asset `210168939`
+(63,301,215 bytes, last updated 1 December 2024). Its digest field was null, and
+the workflow-run query for the asset creation date returned no runs. The recipe
+uses a floating Windows runner, depot-tools setup action and release overwrite.
+Do not infer immutable build provenance from the mutable release tag or matching
+archive hash alone. Full product source/reproducibility acceptance remains open
+until the engine's build inputs, patches, toolchain/dependencies and rebuilt
+artifacts are verified and published with the project release.
+
+### Independent engine reconstruction
+
+Run **Rebuild patched Windows Flutter engine from pinned source** in Actions to
+build a separate candidate. The reviewed recipe is
+`deployment/windows/flutter-engine.lock.json`: it pins the engine and depot-tools
+commits, the dependency file hash, the three-file engine patch and original/patched file
+hashes. The build rejects a different revision, changed dependency/source bytes
+or additional tracked modifications before patching. It uses the engine's pinned
+Ninja and Clang inputs, records actual dependency revisions and the available
+Windows toolchain versions, and packages the DLL/import library/PDB with the
+original public engine source, applied patch, generated GN arguments and build
+recipe. It does not import certificates or change the application engine pin.
+The old Flutter tinygltf mirror returned 404 for its pinned source commit during
+reconstruction. The lock routes only that dependency to its declared canonical
+upstream repository and retains the exact original DEPS commit
+`9bb5806df4055ac973b970ba5b3e27ce27d98148`. The final package check verifies
+both the checked-out commit and repository URL; the original engine DEPS file
+remains unchanged. The effective gclient configuration is included as evidence.
+
+The reconstruction selects MSVC tools `14.38.33130`, their matching x64 ATL
+component (including `atls.lib`), and Windows SDK
+`10.0.22621.0`. A hash-checked patch to the engine's pinned Flutter buildroot
+`e265c359126b24351f534080fb22edaa159f2215` passes `-vcvars_ver=14.38` to
+Microsoft's environment setup. Before compilation and again before packaging,
+the verifier rejects generated commands that reference another Microsoft toolset
+or SDK, or disable compiler/STL compatibility checks. The original buildroot
+source, applied patch and actual compile/link commands accompany the result.
+The release compiler patch also requests content-based COFF/PE timestamps
+(`/Brepro`) and a relative debug compilation directory; the linker uses a stable
+PDB basename and explicitly disables incremental linking. The final linker
+response file is retained and checked separately, because the Ninja command
+listing alone refers to that file without exposing its flags. These controls
+follow [LLVM's deterministic-build guidance](https://blog.llvm.org/2019/11/deterministic-builds-with-clang-and-lld.html).
+They are necessary inputs to the independent comparison, not proof that all
+remaining sources of binary variation have been removed.
+The two timestamp-controlled builds produced identical DLL/import-library bytes
+but different PDBs, despite identical original engine/buildroot source bytes,
+recorded toolchain hashes and generated commands. The next reconstruction
+experiment replaces the Microsoft linker with `lld-link.exe` from the same
+pinned engine DEPS compiler package and requests one linker integration thread.
+Its public buildroot patch records all three changed source files, and receipts
+record the linker's version and hash. Generated-command checks reject a different
+linker, and final-response checks reject absent or conflicting thread controls.
+Ninja does not require a Microsoft-specific intermediate `.exp` output for LLD.
+The engine's Windows archive definition also omits that intermediate file;
+both generated outputs and archive inputs must agree for GN generation.
+This is an investigation of debug-symbol reproducibility, not a demonstrated
+fix. New independent output comparisons and matching-bundle runtime tests are
+required; the application workflow still defaults to its previous engine.
+The corrected recipe at `05d5369` subsequently completed in
+[run 39753153773](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39753153773).
+Its archive, all 19 evidence files, original public engine/buildroot trees and
+generated linker commands were verified. An isolated standard-user experiment
+with the matching `e6b87b9` application loaded that engine, rendered the branded
+technician login and exited cleanly on Server 2016. Authentication and sessions
+were not exercised in that experiment. An independent rebuild is still needed
+to compare DLL, import library and PDB bytes; no default-engine promotion follows
+from the compile or startup results.
+The disposable GitHub runner installs the selected side-by-side Microsoft C++
+component when needed; this provisioning script refuses execution outside the
+GitHub Windows runner. Local builds require that component to be installed
+beforehand. The ATL library is required at preflight and its hash is recorded
+alongside the compiler/standard-library hashes. Toolchain diagnostics are recorded before
+compilation so a failed build still exposes its actual inputs.
+
+For an equivalent local build, run this in a new PowerShell process on a Windows
+machine with Visual Studio 2022, the selected MSVC/SDK versions, Git, Python,
+and at least 40 GiB free on the chosen build drive. The default Visual Studio path
+matches the GitHub runner's Enterprise installation:
+
+```powershell
+pwsh -NoProfile -File deployment/windows/Build-FlutterEngine.ps1 -BuildRoot C:\SwanEngineSourceBuild
+```
+
+For another Visual Studio edition, supply its installation directory through
+`-VisualStudioPath`, for example
+`-VisualStudioPath 'C:\Program Files\Microsoft Visual Studio\2022\Community'`.
+
+The build directory must not already exist. Downloads and compilation take place
+inside it. The recipe never removes existing toolchains to obtain disk space.
+The output is a source reconstruction candidate, not an automatically accepted
+replacement or production release. Two independent build comparisons, a complete
+toolchain/input review and native Windows runtime qualification are still required
+before promoting a new engine hash to the default production selection. Build receipts
+retain explicit false values for those unproven release gates.
+
+The native Windows workflow's optional `source-candidate-9f97ef0` selection
+is a lab experiment, with the current upstream selection still the default.
+It selects the exact reviewed source-built DLL, import library and symbols,
+preserves Flutter 3.24.5's matching snapshot compiler, and records its hash.
+The original source-engine artifact and selection receipt accompany the outputs.
+An older app bundle failed before GUI startup when only its engine DLL was
+replaced: its compiled Dart snapshot format differed from the source runtime.
+Rebuild the app bundle with the matching compiler; a successful engine build
+alone does not establish compatibility or authorize production publication.
+
+The additional explicit lab choice `source-candidate-05d5369` uses the LLVM-linked
+engine from run `39753153773`. Its DLL, import library and PDB matched original
+bytes from independent run `39761977920`; the public
+[comparison record](../deployment/windows/engine-05d5369-reproducibility.json)
+contains both artifact digests, output hashes and source-verification counts.
+The selector pins the complete first output archive and every binary, rejects
+unknown selections, and preserves the SDK snapshot compiler. Its receipt reports
+the independent rebuild separately from runtime and production approval, which
+remain false. The upstream workflow choice remains the default. A full matching
+application build and remote-session/installer/update qualification are still
+required for this candidate.
+
+### Company component comparisons
+
+The `67b5c69` management, agent and worker binaries also matched byte-for-byte
+between independent push/PR jobs on each of Ubuntu24.04 and Windows2022. All230
+public component source files in each of the four input archives matched Git
+objects; only declared source checkout line endings were handled, and executable
+bytes were never normalized. See the [comparison receipt](evidence/67b5c69-component-reproduction.json).
+The source67 deployment job's obsolete backup-header assertion failed separately;
+corrected deployment checks later passed at `26aea83`. Neither component equality
+nor source verification qualifies final native packages or production signing.
+
+Two independent Ubuntu 24.04 CI jobs for the component inputs reviewed at
+`9f97ef0` produced identical management, agent and worker binaries. Their full
+component input archives were checked against the public source, and all 130
+included source files matched between each platform's pair of builds. The
+Windows pair differed in linker timestamps and debug identifiers. After adding
+`/Brepro` to the x64 Rust configuration, both Windows and Linux component pairs
+at reviewed source `a413ab5` produced identical unsigned executable bytes.
+That result covers the recorded CI platforms and input/toolchain versions;
+broader toolchain qualification and native application, engine and installer
+comparisons remain open.
+See the dated [acceptance evidence](ACCEPTANCE.md#independent-company-component-binary-comparisons-22-october)
+for exact jobs, artifact hashes and limits. Neither normalized diagnostic hashes
+nor unsigned component comparisons qualify complete signed installer releases.
+
+### Native release comparison workflow
+
+The manual **Compare independent native build artifacts** workflow accepts two
+different successful native run IDs and their exact shared public source commit.
+It checks out that source and pinned submodules, verifies both original archive
+digests, validates every archived tracked source file against Git objects, and
+checks generated bridge equality. Source text checkout conversions are reported;
+shipping files are never normalized. Both builds must contain the complete set
+of eight expected executable/MSI outputs. A missing output, invalid digest,
+source mismatch or differing shipping binary fails the job. When binary
+comparison completes, the report is retained even when outputs differ.
+
+The verifier never installs or executes downloaded artifacts. It uses the
+workflow's read-only repository token, does not forward it to storage, and keeps
+signed download URLs out of diagnostic errors. Its output records independent
+build verification separately from runtime qualification and production
+approval, which remain false. Passing this check does not replace signing,
+installer, update, session or Windows compatibility acceptance.
+
+### First native comparison result (22 October 2026)
+
+[Comparison run 39789394627](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39789394627)
+verified the original archives and public source for native runs `39760022829`
+and `39769432105` (attempt 2), both at
+`49ced6854f3cbaab84d95807e9bf342e11588f0f`. Its
+[retained report](../deployment/windows/native-49ced68-rebuild-comparison.json)
+shows byte-identical customer MSI, agent, management service and worker outputs.
+The portable technician EXE, its identical installer-name copy, technician MSI
+and server setup EXE differ. The comparison correctly failed; complete native
+reproducibility is **not established**. No shipping bytes were normalized.
+The newer pinned Roslyn setup compiler and source-built engine are separate
+changes requiring their own exact-source comparison and runtime qualification.
+
+### Source-built engine application comparison (22 October 2026)
+
+[Comparison run 39800887785](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39800887785)
+verified public source and original archives for successful native builds
+`39777271372` and `39789147510`, both at
+`9e4ea6dfce7dc1e66eccf6e1068780a23ae8fd59` with the explicitly selected,
+independently reproduced `05d5369` engine. The
+[original report](../deployment/windows/native-9e4ea6d-rebuild-comparison.json)
+shows identical customer MSI, agent, management service, worker and server setup
+EXE bytes. This establishes the pinned Roslyn server launcher correction across
+two actual native CI builds. The portable technician EXE, its installer-name
+copy and the technician MSI still differ. The comparison failed as intended;
+complete native reproducibility and runtime/release qualification remain open.
+No shipping files were normalized or executed by the comparison.
+
+Local analysis of the preserved `49ced68` originals found identical bytes in all
+95 extracted application files and identical portable executable code sections.
+The portable version-resource string entries have different iteration orders;
+their resulting resource bytes and linker content hashes differ. The pinned
+`winres` 0.1.12 generator iterates unordered maps. The portable build now orders
+contiguous generated version/value directives before passing its RC source to
+the resource compiler, using `winres`'s existing-resource API. Resource blocks,
+values, icons, manifests and unsigned shipping inputs are preserved. Standalone
+ordering regressions run on Linux and Windows CI and in the native packaging
+step. The independent full-build comparison below verifies the correction for
+the exact source and selected engine recorded there.
+
+### Complete unsigned native comparison (22 October 2026)
+
+[Comparison run 39829786141](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39829786141)
+passed for independent successful native runs `39807079997` and `39819129959`,
+both at `e9d89ca97319590905a39663b76718ee53bcdd78` with the explicitly selected
+source-built `05d5369` engine. The
+[original report](../deployment/windows/native-e9d89ca-rebuild-comparison.json)
+records **all eight shipping outputs byte-identical**: customer MSI, technician
+EXE, technician MSI, installer-name EXE copy, server setup EXE, agent, management
+service and worker. No shipping bytes were normalized or executed. Each archive's
+1,155 tracked public source files and six generated bridge files were verified.
+Archive compression differs; the original shipping outputs match exactly.
+
+The retained comparison artifact is `12448516219`, 17,424 bytes, SHA-256
+`611f3d46f88b9ce202d9679a6018662ca8d3496875d12b281895fbefaf9eefaa`.
+This establishes unsigned native reproducibility for those inputs, including the
+portable resource-order correction. It does not qualify other source revisions,
+the default upstream engine, Windows behavior, updates or production signatures.
+The separate 1.5.1 build and runtime/release gates require their own evidence.
+
+### Unpublished 1.5.1 comparison (22 October 2026)
+
+[Comparison run 39844492046](https://github.com/rijff24/SwanRemoteSupport/actions/runs/39844492046)
+also passed for independent native runs `39820151128` and `39832811268`, both at
+`699c9e022ad71e4a409be52b56c9fe9697074bdf`, version **1.5.1**, with the explicitly
+selected `05d5369` engine. Its
+[original report](../deployment/windows/native-699c9e0-rebuild-comparison.json)
+verifies 1,155 tracked public source files and six generated bridges per build;
+all eight original shipping EXE/MSI files are byte-identical, without shipping
+normalization or execution. Comparison artifact `12454272614` is 17,424 bytes,
+SHA-256 `cfbd960c10bbc7c9ec097e0d9dcf7babfc6fe13b27f48eda8edc57da67677bea`.
+
+The retained first archive and all 95 extracted application files passed local
+integrity/manifest checks. The application EXE and Rust DLL differ from the
+preceding 1.5.0 payload; these are actual changed-version upgrade inputs. This
+result establishes build reproducibility for those exact unsigned inputs,
+not installation, authorization, automatic update or release acceptance.
+
+### Server launcher compiler
+
+The server setup recipe uses MIT-licensed Microsoft Roslyn
+`Microsoft.Net.Compilers.Toolset.Framework` 4.12.0, with the NuGet archive and
+compiler executable hashes recorded in `deployment/windows/server-compiler.json`.
+The package declares corresponding source at
+[`dotnet/roslyn` commit dfa7fc6](https://github.com/dotnet/roslyn/commit/dfa7fc6bdea31a858a402168384192b633c811fa).
+The compiler runs only during building and is not embedded in the server setup
+executable. Its Microsoft Authenticode signature is checked before execution.
+The build uses explicit .NET Framework/PowerShell reference assemblies from
+hash-pinned Microsoft SDK packages, rather than the host's runtime assemblies.
+`deployment/windows/server-references.json` records the packages, exact versions,
+archive hashes and five selected assembly hashes. The suppliers publish
+[`Microsoft.NETFramework.ReferenceAssemblies.net462` 1.0.3](https://www.nuget.org/packages/Microsoft.NETFramework.ReferenceAssemblies.net462/1.0.3)
+and [`Microsoft.PowerShell.5.ReferenceAssemblies` 1.1.0](https://www.nuget.org/packages/Microsoft.PowerShell.5.ReferenceAssemblies/1.1.0).
+These are build-only references; package install scripts never run, and the
+reference DLLs are not embedded in the application. Matching local builds still
+do not establish independent cross-image reproducibility or runtime compatibility.
diff --git a/docs/SWAN_CUSTOM_BUILD.md b/docs/SWAN_CUSTOM_BUILD.md
index d57cdec8df2..eb9afced882 100644
--- a/docs/SWAN_CUSTOM_BUILD.md
+++ b/docs/SWAN_CUSTOM_BUILD.md
@@ -1,5 +1,7 @@
 # Swan Remote Support build and deployment guide
 
+> Historical guide for the single-company baseline tagged `swan-single-company-baseline-1.4.9`. Its Tailscale/password flow is preserved for migration; it is not the configurable product's installation flow. Use [product/README.md](../product/README.md) for current development builds and deployments.
+
 ## Purpose and current status
 
 This branch turns the RustDesk `1.4.9` client into **Swan Remote Support** for Swan Computing. It provides:
diff --git a/docs/TAILSCALE_DEPLOYMENT.md b/docs/TAILSCALE_DEPLOYMENT.md
index c5251fd135d..b0b3623aa7e 100644
--- a/docs/TAILSCALE_DEPLOYMENT.md
+++ b/docs/TAILSCALE_DEPLOYMENT.md
@@ -1,5 +1,7 @@
 # Tailscale deployment for Swan Remote Support
 
+> Historical baseline deployment only. The configurable product uses company-hosted rendezvous/relay and signed session grants; new packages must not install or require Tailscale. Keep the existing private deployment available until public direct, relay and denied-access tests pass. The pricing and service information below is historical, not current purchasing guidance.
+
 ## Why Tailscale is installed separately
 
 Tailscale is largely open source, but it is not one wholly open-source Windows product. The `tailscaled` daemon and CLI are published under the BSD 3-Clause licence; the official Windows graphical client and Tailscale's hosted coordination service include components that are not part of that open-source repository. See Tailscale's [open-source overview](https://tailscale.com/opensource), the [client source and licence](https://github.com/tailscale/tailscale), and the [service terms](https://tailscale.com/terms).
diff --git a/docs/UNSIGNED_SPARE_LAPTOP_TEST.md b/docs/UNSIGNED_SPARE_LAPTOP_TEST.md
index 1ed4693f671..e22490c89dd 100644
--- a/docs/UNSIGNED_SPARE_LAPTOP_TEST.md
+++ b/docs/UNSIGNED_SPARE_LAPTOP_TEST.md
@@ -1,5 +1,7 @@
 # Unsigned two-laptop test
 
+> Historical test procedure for `swan-single-company-baseline-1.4.9`. Its Tailscale and password steps apply only to the preserved single-company deployment. For the configurable company-hosted product, use the [product guide](../product/README.md) and [acceptance report](ACCEPTANCE.md).
+
 This procedure is only for an isolated spare laptop owned or controlled by Swan Computing. The current 1.4.9 build is unsigned. Do not use it on a real customer computer, do not place customer data on the spare laptop, and do not weaken Microsoft Defender, SmartScreen, Windows Firewall, or another security control.
 
 ## Before starting
diff --git a/docs/WINDOWS_CODE_SIGNING.md b/docs/WINDOWS_CODE_SIGNING.md
index 4d8ce8bb1ff..51acfec4cd5 100644
--- a/docs/WINDOWS_CODE_SIGNING.md
+++ b/docs/WINDOWS_CODE_SIGNING.md
@@ -8,7 +8,7 @@ The current GitHub Actions workflow intentionally produces an **unsigned build a
 
 Current primary references: [Microsoft SmartScreen reputation guidance](https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/smartscreen-reputation), [Microsoft Artifact Signing eligibility and setup](https://learn.microsoft.com/en-us/azure/artifact-signing/quickstart), [SignPath Foundation conditions](https://signpath.org/terms.html), and the [Microsoft Security Intelligence file-submission portal](https://www.microsoft.com/en-us/wdsi/filesubmission).
 
-The repository's release rules are in the public [Swan code-signing policy](CODE_SIGNING_POLICY.md). Free code signing provided by SignPath.io, certificate by SignPath Foundation.
+The repository's release rules are in the public [Swan code-signing policy](CODE_SIGNING_POLICY.md). SignPath is a proposed provider; no application acceptance or active production signing service is claimed.
 
 ## What signing can and cannot do
 
@@ -34,7 +34,12 @@ Required preparation:
 6. Design a two-stage signing pipeline: sign the inner executables/DLLs, create the self-extracting installer, then sign and timestamp the outer installer.
 7. Verify that SignPath can support the custom self-extracting format. If it cannot, package the signed client as an MSI or another supported container.
 
-The official Tailscale Windows MSI is not embedded in or signed as part of Swan. The bootstrap downloads it from Tailscale and requires its pinned SHA-256 plus a valid `Tailscale Inc.` Authenticode signature. This boundary avoids representing Tailscale's proprietary Windows GUI as a Swan open-source component; SignPath must still review and accept the complete bootstrap behavior.
+The configurable product's company packages do not install or require Tailscale.
+The Tailscale download/signature boundary belongs to the preserved single-company
+baseline only. Provider review must cover the actual configurable release,
+including upstream components, consent and uninstall behavior. Current provider
+preparation and unfulfilled prerequisites are recorded in the
+[code signing policy](CODE_SIGNING_POLICY.md#provider-preparation-checked-28-october-2026).
 
 ### 2. Buy an organization-validated code-signing certificate
 
diff --git a/docs/evidence/07bb8d0-native-file-transfer-and-pause.json b/docs/evidence/07bb8d0-native-file-transfer-and-pause.json
new file mode 100644
index 00000000000..c8dc976e9e8
--- /dev/null
+++ b/docs/evidence/07bb8d0-native-file-transfer-and-pause.json
@@ -0,0 +1,101 @@
+{
+  "recorded_utc": "2026-10-28T22:23:43.900278+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "application_version": "1.5.7",
+  "technician_os": "Windows Server2019 17763.3650 x64",
+  "customer_os": "Windows Server2016 14393 x64",
+  "owned_administrator_desktops": true,
+  "fixtures": [
+    {
+      "role": "customer",
+      "filename": "customer-source.bin",
+      "source_sha256": "1f77ab6689527546b4a60f2cc2ac8c095282c90a6bc84a0fac790ffcd143f3c4",
+      "utc": "2026-10-28T21:53:12.6949026Z",
+      "destination_empty": true,
+      "bytes": 1048576
+    },
+    {
+      "role": "technician",
+      "filename": "technician-source.bin",
+      "source_sha256": "3ea501bf5c49f31ad34b04ae10cd26c1c8c069356666c60af29506e21f2792d8",
+      "utc": "2026-10-28T21:53:20.8264062Z",
+      "destination_empty": true,
+      "bytes": 1048576
+    }
+  ],
+  "native_file_transfer": {
+    "desktop_and_file_transfer_approved_separately_on_customer": true,
+    "opened_from_the_native_desktop_session_toolbar": true,
+    "no_password_or_legacy_credential_entered_for_transfer": true,
+    "both_directions_reported_finished_one_of_one_in_native_ui": true,
+    "customer_connection_manager_reported_both_directions_finished": true,
+    "receiving_directories_initially_empty": true,
+    "destination_files_written_only_by_native_swan_transfer": true
+  },
+  "independent_binary_verification": [
+    {
+      "actual_received_file_verified": true,
+      "utc": "2026-10-28T22:01:23.2698716Z",
+      "destination_was_empty_before_native_ui": true,
+      "bytes": 1048576,
+      "actual_sha256": "1f77ab6689527546b4a60f2cc2ac8c095282c90a6bc84a0fac790ffcd143f3c4",
+      "direction": "customer-to-technician"
+    },
+    {
+      "actual_received_file_verified": true,
+      "utc": "2026-10-28T22:03:04.3609398Z",
+      "destination_was_empty_before_native_ui": true,
+      "bytes": 1048576,
+      "actual_sha256": "3ea501bf5c49f31ad34b04ae10cd26c1c8c069356666c60af29506e21f2792d8",
+      "direction": "technician-to-customer"
+    }
+  ],
+  "claimed_grants_before_pause": {
+    "utc": "2026-10-28T22:03:53.677305+00:00",
+    "independently_claimed_grant_count": 2,
+    "both_attended_and_lease_current": true,
+    "separate_customer_approval_for_desktop_and_file_transfer_observed": true,
+    "server_source_unchanged": true
+  },
+  "customer_stop": {
+    "utc": "2026-10-28T22:04:13.170743+00:00",
+    "both_original_claimed_grants_closed": true,
+    "original_grant_count": 2,
+    "no_manual_server_revocation_used": true
+  },
+  "receiving_device_after_stop": {
+    "renewal_statuses": [
+      403,
+      403
+    ],
+    "standard_user_test": false,
+    "unattended_consent_off": true,
+    "customer_pause_persisted": true,
+    "version": "1.5.7",
+    "utc": "2026-10-28T22:16:05.3588782Z",
+    "same_running_service_and_watch": true,
+    "both_closed_grant_renewals_denied": true,
+    "sequence": 9,
+    "shipping_verifier_passed": true,
+    "profile_revision": 14
+  },
+  "findings": {
+    "client_reconnect_attempt_after_authorization_closure_observed": true,
+    "reconnect_cancelled_and_old_grants_cannot_renew": true,
+    "receiver_logs_showed_managed_authorization_unavailable_for_both_connections": true,
+    "legacy_derived_http_audit_attempts_failed_in_owned_lab": true,
+    "new_candidate_source_disables_authorization_retries_and_legacy_audit_targets": true,
+    "new_guards_native_test_execution_and_runtime_verification_pending": true
+  },
+  "original_private_log_sha256": {
+    "technician-actual-edition-after-stop.private.json": "d6cac9744cb9163ad30d00bee3818b11f664b9394119ccc630426db6aa17fd75",
+    "customer-actual-edition-after-stop.private.json": "43bb18152a3a38a114469a9770e3f61300a9fd310b56e27ef4be4b8f58aa0410"
+  },
+  "limits": [
+    "Two distinct1MiB files; no large, directory, interrupted or clipboard-file transfer qualification.",
+    "No remote UAC, multiple displays, ordinary-account transfer or six-version compatibility qualification.",
+    "Loopback company endpoints and isolated lab VMs; no public Internet or direct-path qualification.",
+    "The1.5.8 native identity build remains separate; it does not yet contain the subsequent retry/audit guards.",
+    "No production signing, publication or completed product acceptance."
+  ]
+}
diff --git a/docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json b/docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json
new file mode 100644
index 00000000000..1e3aee93399
--- /dev/null
+++ b/docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json
@@ -0,0 +1,115 @@
+{
+  "recorded_utc": "2026-10-28T21:46:39.008845+00:00",
+  "application_source": "07bb8d0b99e2be002a30e5d97eebe67a9c2794ad",
+  "application_version": "1.5.7",
+  "technician_os": "Windows Server 2019 17763.3650 x64",
+  "customer_os": "Windows Server 2016 14393 x64",
+  "owned_administrator_desktops": true,
+  "viewer_clipboard_isolation": {
+    "accept_clipboard_disabled_for_both": true,
+    "send_clipboard_disabled_for_both": true,
+    "viewer_count": 2,
+    "utc": "2026-10-28T21:33:39.6549943Z",
+    "only_local_lab_endpoints": true,
+    "documented_options": "https://tigervnc.org/doc/vncviewer.html"
+  },
+  "no_session_baseline_distinct_markers_verified_after_both_setters_completed": true,
+  "customer_to_technician": {
+    "source": {
+      "actual_characters": 84,
+      "interactive_session": 1,
+      "mode": "Check",
+      "actual_utf8_sha256": "5d46d2bf539c9ce0a80ce0f6349bc7a03c0938d433903cc863fe6504876e523f",
+      "matched": true,
+      "utc": "2026-10-28T21:39:57.5931422Z",
+      "endpoint_role": "customer"
+    },
+    "destination": {
+      "actual_characters": 84,
+      "interactive_session": 1,
+      "mode": "Check",
+      "actual_utf8_sha256": "5d46d2bf539c9ce0a80ce0f6349bc7a03c0938d433903cc863fe6504876e523f",
+      "matched": true,
+      "utc": "2026-10-28T21:38:09.4895254Z",
+      "endpoint_role": "technician"
+    },
+    "exact_multiline_unicode_utf8_hash_match": true
+  },
+  "technician_to_customer": {
+    "source": {
+      "actual_characters": 86,
+      "interactive_session": 1,
+      "mode": "Set",
+      "actual_utf8_sha256": "a24549e44c59c5c42ff4f81299ad287ffc6e82e17dae7e94c515ace91b8b3b05",
+      "matched": true,
+      "utc": "2026-10-28T21:40:35.0850446Z",
+      "endpoint_role": "technician"
+    },
+    "destination": {
+      "actual_characters": 86,
+      "interactive_session": 1,
+      "mode": "Check",
+      "actual_utf8_sha256": "a24549e44c59c5c42ff4f81299ad287ffc6e82e17dae7e94c515ace91b8b3b05",
+      "matched": true,
+      "utc": "2026-10-28T21:41:20.9783670Z",
+      "endpoint_role": "customer"
+    },
+    "exact_multiline_unicode_utf8_hash_match": true
+  },
+  "keyboard": {
+    "actual_characters": 50,
+    "raw_file_sha256": "bee5fe07d3bef8c327c72ef03cb5cf03b61094266eb43d5d9d1d76bd6a6e4fd7",
+    "interactive_notepad_session": 1,
+    "text_utf8_sha256": "bee5fe07d3bef8c327c72ef03cb5cf03b61094266eb43d5d9d1d76bd6a6e4fd7",
+    "utc": "2026-10-28T21:42:27.6941332Z",
+    "exact_typed_marker_saved": true,
+    "endpoint_role": "customer"
+  },
+  "session_end": {
+    "utc": "2026-10-28T21:42:58.709603+00:00",
+    "one_real_claimed_attended_session": true,
+    "customer_stopped_and_server_closed": true,
+    "unattended": false
+  },
+  "post_stop": {
+    "new_customer_marker_set": {
+      "actual_characters": 67,
+      "interactive_session": 1,
+      "mode": "Set",
+      "actual_utf8_sha256": "d05475bcd0377bc1219418b4cc93d19c58a8e5d037b919a8080439bcc2aa10ba",
+      "matched": true,
+      "utc": "2026-10-28T21:43:21.1086894Z",
+      "endpoint_role": "customer"
+    },
+    "technician_hash_only_sample": {
+      "actual_characters": 84,
+      "interactive_session": 1,
+      "mode": "Check",
+      "actual_utf8_sha256": "5d46d2bf539c9ce0a80ce0f6349bc7a03c0938d433903cc863fe6504876e523f",
+      "matched": false,
+      "utc": "2026-10-28T21:43:51.2064562Z",
+      "endpoint_role": "technician"
+    },
+    "new_customer_marker_not_received": true,
+    "earlier_customer_marker_observed_instead": true,
+    "last_clipboard_value_preservation_not_qualified": true
+  },
+  "probe_limitations": [
+    "Initial customer Set probe exited1 before final result; failure preserved. Independent read-only source and destination checks verified the intended same value without resetting it.",
+    "Subsequent probe added bounded clipboard-read retries and error-type records; no product binary or permission was changed.",
+    "The first post-stop checker required preservation of the last technician marker and failed. The hash-only result instead matched the earlier customer marker. Only non-arrival of the newly changed customer marker after grant closure is established."
+  ],
+  "limits": [
+    "Text clipboard and one exact ASCII keyboard-save operation; no clipboard-file transfer, file transfer, remote UAC or multiple monitors.",
+    "Two lab VMs and loopback company transport; no public Internet or direct-connect qualification.",
+    "This uses installed1.5.7; the1.5.8 identity-prompt build is separate and not yet installed.",
+    "No complete Windows matrix or production qualification."
+  ],
+  "viewer_clipboard_isolation_after_test": {
+    "viewer_count": 2,
+    "send_clipboard_disabled_for_both": true,
+    "utc": "2026-10-28T21:47:27.8188411Z",
+    "unchanged_through_entire_feature_test": true,
+    "accept_clipboard_disabled_for_both": true
+  }
+}
diff --git a/docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json b/docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json
new file mode 100644
index 00000000000..ccafc1b1835
--- /dev/null
+++ b/docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json
@@ -0,0 +1,107 @@
+{
+  "utc": "2026-10-30T05:03:15.451734+00:00",
+  "source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "version": "1.5.10+78",
+  "source_date_epoch": 1793325277,
+  "comparison_run": 41005323442,
+  "comparison_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41005323442",
+  "comparison_artifact": 12955371943,
+  "comparison_artifact_sha256": "sha256:120597b24e76d19325b5c9fd20c74835fe7afca91bafa1b427f4729f08526a98",
+  "builds": [
+    {
+      "workflow_run": 40988690083,
+      "run_attempt": 1,
+      "artifact": 12950288879,
+      "archive_digest": "sha256:dc97a1b997edfd6aa725562b2f0c90485e2c11791d4a5274150c73c19969640b",
+      "bytes": 256197933
+    },
+    {
+      "workflow_run": 40997460699,
+      "run_attempt": 1,
+      "artifact": 12953994935,
+      "archive_digest": "sha256:785c2da1d0b6f8aa063a770987c8d586151384037057e7aa77b9be8a3d89b7a2",
+      "bytes": 256198010
+    }
+  ],
+  "complete_corresponding_source_and_generated_bridge_checked_by_comparison": true,
+  "first_archive_matches_locally_verified_original": true,
+  "recorded_msvc_inputs_identical": true,
+  "all_eight_original_unsigned_shipping_outputs_byte_identical": true,
+  "shipping_files_normalized_or_rebuilt_for_comparison": false,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.10-customer-x64-unsigned.msi",
+      "first_sha256": "d4545f75aec2618065b32b11c65bafaef470904977f4e0c45c2731eb5da0e6f8",
+      "second_sha256": "d4545f75aec2618065b32b11c65bafaef470904977f4e0c45c2731eb5da0e6f8",
+      "first_bytes": 33894400,
+      "second_bytes": 33894400,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.10-technician-x64-unsigned.exe",
+      "first_sha256": "0514f3bb71f7802cd184bc53f5770f275c398af4cfbaad6cd004fdb6386b75b0",
+      "second_sha256": "0514f3bb71f7802cd184bc53f5770f275c398af4cfbaad6cd004fdb6386b75b0",
+      "first_bytes": 24276480,
+      "second_bytes": 24276480,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.10-technician-x64-unsigned.msi",
+      "first_sha256": "033aefa2cecc720e57b73b94daa6860a38b67df563350d3fbbb588f50f276a96",
+      "second_sha256": "033aefa2cecc720e57b73b94daa6860a38b67df563350d3fbbb588f50f276a96",
+      "first_bytes": 31637504,
+      "second_bytes": 31637504,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.10-x64-unsigned-install.exe",
+      "first_sha256": "0514f3bb71f7802cd184bc53f5770f275c398af4cfbaad6cd004fdb6386b75b0",
+      "second_sha256": "0514f3bb71f7802cd184bc53f5770f275c398af4cfbaad6cd004fdb6386b75b0",
+      "first_bytes": 24276480,
+      "second_bytes": 24276480,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "ced82ac66da9e5a26803390f04313926fb8a2c93a3fd13b35088ea178eb314fa",
+      "second_sha256": "ced82ac66da9e5a26803390f04313926fb8a2c93a3fd13b35088ea178eb314fa",
+      "first_bytes": 65881088,
+      "second_bytes": 65881088,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+      "second_sha256": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+      "first_bytes": 5756416,
+      "second_bytes": 5756416,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "772cb5a490452742d39342e34decc82b3f3be1a2cad1ece6f348ab3972771038",
+      "second_sha256": "772cb5a490452742d39342e34decc82b3f3be1a2cad1ece6f348ab3972771038",
+      "first_bytes": 9130496,
+      "second_bytes": 9130496,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+      "second_sha256": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+      "first_bytes": 4900352,
+      "second_bytes": 4900352,
+      "identical": true
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "executables_run_by_comparison": false,
+  "runtime_qualified_by_comparison": false,
+  "limits": [
+    "Original unsigned Windows outputs only; lab signatures and enrolled-machine runtime have separate receipts.",
+    "This does not qualify canonical Linux Docker image reproduction or the complete Windows runtime matrix.",
+    "Production signing/provider approval and remaining product acceptance gates are open."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
\ No newline at end of file
diff --git a/docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json b/docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json
new file mode 100644
index 00000000000..226c03d0f8d
--- /dev/null
+++ b/docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json
@@ -0,0 +1,64 @@
+{
+  "utc": "2026-10-30T03:18:03.076033+00:00",
+  "source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "version": "1.5.10+78",
+  "workflow_run": 40988690083,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40988690083",
+  "native_job": 123848833939,
+  "native_job_conclusion": "success",
+  "artifact": 12950288879,
+  "artifact_bytes": 256197933,
+  "artifact_sha256": "dc97a1b997edfd6aa725562b2f0c90485e2c11791d4a5274150c73c19969640b",
+  "complete_public_source_and_six_generated_bridge_files_verified": true,
+  "public_source_file_count": 1302,
+  "manifest_hashes_match": true,
+  "pinned_sdk_and_independently_reproduced_engine_verified": true,
+  "required_native_regression_step_conclusions": {
+    "Reject paused support and authorization reuse after resume": "success",
+    "Reject authorization retries and inherited audit destinations": "success",
+    "Reject cross-target and stale-login file-transfer handles": "success",
+    "Verify hardened DLL search supports delayed application libraries": "success",
+    "Build branded client": "success",
+    "Reject incoming capture helpers in the technician edition": "success",
+    "Verify service launcher defers desktop DLL loading": "success",
+    "Verify customer MSI starts a headless native service": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "lifecycle_artifact": {
+    "id": 12951205314,
+    "sha256": "sha256:4cc151e6ba3080391313e8c1717fa62f3207bb042a5ac6dc7f0035c6264093bf",
+    "bytes": 98201
+  },
+  "actual_unsigned_ci_lifecycle": {
+    "customer": {
+      "passed": true,
+      "package_sha256": "d4545f75aec2618065b32b11c65bafaef470904977f4e0c45c2731eb5da0e6f8",
+      "scope": "Fresh administrative MSI install/start and service module inspection, then uninstall on disposable CI; no cold reboot, enrollment, signature acceptance or remote session",
+      "service_running_without_manual_start": true,
+      "no_desktop_engine_or_plugin_modules": true,
+      "uninstall_verified": true
+    },
+    "technician": {
+      "passed": true,
+      "package_sha256": "033aefa2cecc720e57b73b94daa6860a38b67df563350d3fbbb588f50f276a96",
+      "windows": "Windows Server 2022 Datacenter",
+      "build": "20348",
+      "install": true,
+      "repair": true,
+      "uninstall": true,
+      "scope": "MSI payload lifecycle under the CI account; no enrollment, standard-user GUI, signature acceptance or remote session"
+    }
+  },
+  "limits": [
+    "Single native build; independent full native reproduction remains pending.",
+    "CI installs were unsigned and unenrolled. Lab signatures, enrolled-machine upgrade and normal reboot qualification remain separate.",
+    "The intermittent Server2019 1.5.9 cold-start failure is not cleared by these results."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
\ No newline at end of file
diff --git a/docs/evidence/1510-installed-agent-profile-rejection-20261030.json b/docs/evidence/1510-installed-agent-profile-rejection-20261030.json
new file mode 100644
index 00000000000..76fab2b2a71
--- /dev/null
+++ b/docs/evidence/1510-installed-agent-profile-rejection-20261030.json
@@ -0,0 +1,231 @@
+{
+  "utc": "2026-10-30T15:23:06.418315+00:00",
+  "agent_application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "version": "1.5.10+78",
+  "installed_agent_sha256": "f886a53dcb1b97e76fc5792e9fa4a221a13e6bbfd24973d9a56f2a726103adfa",
+  "command": "verify-bootstrap",
+  "real_installed_shipping_binary_executed": true,
+  "separate_state_directories": true,
+  "disposable_fixture_issuer_public_fixtures_only": true,
+  "fixture_private_signing_key_retained": false,
+  "device_credentials_in_fixtures": false,
+  "network_operations_invoked": false,
+  "total_cases": 28,
+  "results": [
+    {
+      "os": "Windows 10 Pro x64 build19045",
+      "utc": "2026-10-30T15:22:24.0129690Z",
+      "cases": [
+        {
+          "edition": "customer",
+          "accepted": true,
+          "case": "valid-control",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "tampered-payload",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "invalid-signature",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-expired",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-future",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-wrong-company",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-older-revision",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": true,
+          "case": "valid-control",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "tampered-payload",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "invalid-signature",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-expired",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-future",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-wrong-company",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-older-revision",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        }
+      ],
+      "installed_state_unchanged": true
+    },
+    {
+      "os": "Windows Server 2019 x64 Desktop Experience build17763",
+      "utc": "2026-10-30T15:22:33.6455074Z",
+      "cases": [
+        {
+          "edition": "customer",
+          "accepted": true,
+          "case": "valid-control",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "tampered-payload",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "invalid-signature",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-expired",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-future",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-wrong-company",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "customer",
+          "accepted": false,
+          "case": "signed-older-revision",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": true,
+          "case": "valid-control",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "tampered-payload",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "invalid-signature",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-expired",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-future",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-wrong-company",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        },
+        {
+          "edition": "technician",
+          "accepted": false,
+          "case": "signed-older-revision",
+          "expected_reason_matched": true,
+          "state_unchanged": true
+        }
+      ],
+      "installed_state_unchanged": true
+    }
+  ],
+  "scope": "Compiled agent configuration and installer-bootstrap validation for customer and technician state. These are isolated state fixtures, not live endpoint configuration swaps or native UI tests.",
+  "installed_native_ui_tamper_behavior_qualified": false,
+  "live_profile_sync_key_rotation_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json b/docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json
new file mode 100644
index 00000000000..f2a1b7df66e
--- /dev/null
+++ b/docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json
@@ -0,0 +1,105 @@
+{
+  "utc": "2026-10-30T16:09:55.166903+00:00",
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "version": "1.5.10+78",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "management_schema": 3,
+  "profile_revisions": {
+    "before": 24,
+    "trusted_transition": 25,
+    "active_replacement": 26
+  },
+  "online_installed_states": [
+    {
+      "os": "Windows 10 Pro x64 build19045",
+      "edition": "customer"
+    },
+    {
+      "os": "Windows Server 2019 x64 Desktop Experience build17763",
+      "edition": "customer"
+    },
+    {
+      "os": "Windows Server 2019 x64 Desktop Experience build17763",
+      "edition": "technician"
+    }
+  ],
+  "all_three_cached_old_key_signed_transition_automatically": true,
+  "all_three_adopted_new_key_and_revision_automatically": true,
+  "explicit_agent_sync_or_endpoint_restart_required_for_adoption": false,
+  "shipping_agent_bytes_unchanged": true,
+  "identity_credential_release_sequence_and_consent_preserved": true,
+  "software_sequence": 13,
+  "unattended_consent_remained_disabled": true,
+  "update_policy_remained_paused": true,
+  "current_signature_verified_by_new_key_and_rejected_by_old_key": true,
+  "active_private_worker_pin_rotated_from_trusted_transition": true,
+  "worker_credentials_endpoint_release_key_registry_and_private_acls_preserved": true,
+  "worker_pin_rotation_automatic": false,
+  "offline_revoked_workers_unchanged": true,
+  "prior_customer_download_anonymous404": true,
+  "prior_customer_and_technician_downloads_authenticated404": true,
+  "real_shipping_agent_https_cases": [
+    {
+      "expected_result": true,
+      "accepted": true,
+      "case": "current-control",
+      "actual_https_request": true,
+      "edition": "customer",
+      "device_credentials_present": false
+    },
+    {
+      "expected_result": true,
+      "accepted": false,
+      "case": "missed-transition",
+      "actual_https_request": true,
+      "edition": "customer",
+      "device_credentials_present": false
+    },
+    {
+      "expected_result": true,
+      "accepted": true,
+      "case": "current-control",
+      "actual_https_request": true,
+      "edition": "technician",
+      "device_credentials_present": false
+    },
+    {
+      "expected_result": true,
+      "accepted": false,
+      "case": "missed-transition",
+      "actual_https_request": true,
+      "edition": "technician",
+      "device_credentials_present": false
+    }
+  ],
+  "missed_transition_fixtures_excluded_device_credentials": true,
+  "fresh_native_mfa_authorized_inventory_named_customer_approval_and_actual_desktop_passed": true,
+  "fresh_native_session_created_after_activation": true,
+  "native_lease_renewal_observed": true,
+  "session_age_at_closed_observation_seconds": 393.7,
+  "customer_stop_closed_exact_new_session_and_ended_technician_access": true,
+  "customer_availability_restored_after_test": true,
+  "pre_rotation_encrypted_archive": {
+    "bytes": 724532938,
+    "sha256": "e6d1204632b13d93490ccf27d4ee3a806bd7959b4c16dff485ffd5a34677c55d",
+    "copy_hash_matched": true
+  },
+  "post_rotation_encrypted_archive": {
+    "bytes": 724539691,
+    "sha256": "5e0e4fdf2500e350b5996d702391284abe2a71dbfc5313bf0806f9c2461486bd",
+    "copy_hash_matched": true
+  },
+  "archive_passphrases_stored_separately": true,
+  "post_rotation_export_container_exit_code": 0,
+  "same_company_stack_healthy_after_backup": true,
+  "post_rotation_archive_restore_tested": false,
+  "replacement_bundles_generated_after_this_rotation": false,
+  "offline_endpoints_need_trusted_transition_or_explicit_reconfiguration": true,
+  "interrupted_activation_qualified": false,
+  "active_native_session_during_activation_tested": false,
+  "full_windows_matrix_qualified": false,
+  "external_public_connectivity_qualified": false,
+  "production_publication": false,
+  "previously_completed_bundles_withdrawn": 21,
+  "historical_failed_jobs_preserved": 2
+}
diff --git a/docs/evidence/1510-linux-authorization-negatives-20261030.json b/docs/evidence/1510-linux-authorization-negatives-20261030.json
new file mode 100644
index 00000000000..092d4eebdac
--- /dev/null
+++ b/docs/evidence/1510-linux-authorization-negatives-20261030.json
@@ -0,0 +1,135 @@
+{
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "scope": "Current isolated company HTTPS API, current Server2019 receiving-device credential and current Server2025 technician graphical account filtering. These checks do not qualify hostile native transport paths.",
+  "company_api": {
+    "utc": "2026-10-30T09:59:02.605024+00:00",
+    "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+    "application_candidate": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+    "scope": "Actual isolated company HTTPS API with MFA accounts and one new pending enrollment; not native protocol bypass qualification.",
+    "checks": [
+      {
+        "name": "anonymous inventory rejected",
+        "status": 401
+      },
+      {
+        "name": "anonymous grant rejected",
+        "status": 401
+      },
+      {
+        "name": "unassigned technician inventory empty",
+        "status": 200
+      },
+      {
+        "name": "unassigned technician grant to known approved device rejected",
+        "status": 403
+      },
+      {
+        "name": "unassigned technician cannot read administrator audit",
+        "status": 401
+      },
+      {
+        "name": "unattended grant without customer consent rejected",
+        "status": 403
+      },
+      {
+        "name": "pending device may read only its own status",
+        "status": 200
+      },
+      {
+        "name": "authorized technician cannot obtain pending-device grant",
+        "status": 403
+      },
+      {
+        "name": "administrator cannot bypass pending-device approval",
+        "status": 403
+      },
+      {
+        "name": "pending device cannot claim a session",
+        "status": 401
+      },
+      {
+        "name": "pending device cannot renew a closed session",
+        "status": 401
+      },
+      {
+        "name": "revoked fixture credential cannot read device status",
+        "status": 401
+      }
+    ],
+    "existing_devices_and_consent_unchanged": true,
+    "no_grants_created_by_denied_requests": true,
+    "only_new_fixture_revoked_after_test": true,
+    "existing_native_app_sessions_not_logged_out": true,
+    "native_unauthorized_protocol_paths_tested": false,
+    "closed_grant_replay_with_approved_device_tested": false,
+    "production_publication": false
+  },
+  "receiving_device_api": {
+    "checks": [
+      {
+        "name": "modified wrong-company payload rejected",
+        "status": 403
+      },
+      {
+        "name": "modified signature rejected",
+        "status": 403
+      },
+      {
+        "name": "valid once-only claim positive control",
+        "status": 200
+      },
+      {
+        "name": "same signed grant second claim rejected",
+        "status": 403
+      },
+      {
+        "name": "authorized open-lease renewal positive control",
+        "status": 200
+      },
+      {
+        "name": "close original receiver authorization",
+        "status": 200
+      },
+      {
+        "name": "closed grant renewal rejected before lease expiry",
+        "status": 403
+      },
+      {
+        "name": "closed signed grant replay rejected before grant expiry",
+        "status": 403
+      },
+      {
+        "name": "earlier native disconnected grant cannot renew",
+        "status": 403
+      }
+    ],
+    "native_protocol_bypass_tested": false,
+    "utc": "2026-10-30T10:03:53.4431119Z",
+    "identity_credential_trust_and_consent_unchanged": true,
+    "receiver_service_running": true,
+    "scope": "Actual company HTTPS claim/renew/close API using the current receiving device credential in guest memory. Native unauthorized transport paths remain separate.",
+    "closed_renew_and_reclaim_checked_before_both_expiries": true,
+    "production_publication": false,
+    "shipping_verifier_passed": true
+  },
+  "native_unassigned_account": {
+    "utc": "2026-10-30T10:10:11.285722+00:00",
+    "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+    "native_version": "1.5.10",
+    "os_build": 26100,
+    "one_owned_unassigned_account_mfa_login_succeeded": true,
+    "company_branding_visible": true,
+    "no_approved_devices_assigned_message_rendered": true,
+    "no_request_support_controls_rendered": true,
+    "no_sessions_history_message_rendered": true,
+    "credentials_and_otp_not_recorded": true,
+    "protocol_bypass_tested": false
+  },
+  "not_qualified": [
+    "Direct-IP native bypass rejection; current stock-client legacy by-ID denial has separate native evidence",
+    "Wrong-company grant signed by a different valid company key; this receipt mutates payload/signature instead",
+    "Full current session expiry/outage/revocation and Windows matrix",
+    "Production signing or external public-network operation"
+  ]
+}
diff --git a/docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json b/docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json
new file mode 100644
index 00000000000..43336697319
--- /dev/null
+++ b/docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json
@@ -0,0 +1,121 @@
+{
+  "utc": "2026-10-30T04:54:51.264365+00:00",
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "version": "1.5.10+78",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "scope": "Disposable Linux company and enrolled Windows Server2019 Desktop Experience, build17763. Lab signing, company bundles, explicit customer upgrade and three normal guest reboots.",
+  "signing": {
+    "lab_only": true,
+    "all_five_outputs_fresh_publisher_checks_passed": true,
+    "private_key_nonexportable_and_not_exported": true,
+    "all_original_inputs_unchanged": true,
+    "customer_msi_sha256": "971009e156b0c83382747d26794ee27c56ddb85dd42fb36fe75d51d593c1b8c8",
+    "technician_msi_sha256": "f10ee5c994734d8c22dc1d77b1a39bddd9bc8c8e784f233c30cdd3ee23788491",
+    "agent_sha256": "f886a53dcb1b97e76fc5792e9fa4a221a13e6bbfd24973d9a56f2a726103adfa",
+    "production_provider_approval": false
+  },
+  "verification_harness_recovery": {
+    "original_signing_task_not_claimed_successful": true,
+    "stalled_final_read_only_attempts_preserved": true,
+    "committed_signed_artifacts_not_rebuilt_or_resigned": true,
+    "final_verification_completed_with_normal_task_priority_and_explicit_windows_builtin_modules": true,
+    "compound_first_reboot_observer_timed_out_then_read_only_corrected_observer_passed": true,
+    "no_service_manually_started_or_reboot_repeated_to_replace_a_failed_observation": true
+  },
+  "company_distribution": {
+    "release_sequence": 13,
+    "channel": "test",
+    "invalid_signatures_rejected": true,
+    "request_cannot_override_release_key": true,
+    "unapproved_builds_rejected_without_jobs": true,
+    "two_approved_worker_jobs_completed": true,
+    "signed_profile_policy_unchanged": true,
+    "updates_paused": true,
+    "editions": [
+      {
+        "edition": "customer",
+        "bundle_sha256": "f4b811067cbbde93a0ac7b720094d664dbe57f22bf5fd47b689467f008999071",
+        "bytes": 32722166,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 200,
+        "download_status": 200
+      },
+      {
+        "edition": "technician",
+        "bundle_sha256": "a70e7a496068a7c5928980e7da441bbb99c64e7d07e047349eda0e714f59be8a",
+        "bytes": 30521970,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 401,
+        "download_status": 200
+      }
+    ]
+  },
+  "enrolled_upgrade": {
+    "before_version": "1.5.9+77",
+    "after_version": "1.5.10+78",
+    "before_sequence": 11,
+    "after_sequence": 13,
+    "profile_revision": 14,
+    "identity_device_credential_bootstrap_and_consent_preserved": true,
+    "company_branding_and_paused_policy_preserved": true,
+    "shipping_verifier_passed": true,
+    "private_worker_running": true,
+    "explicit_setup_upgrade": true,
+    "automatic_upgrade_tested": false
+  },
+  "normal_reboot_checks": [
+    {
+      "number": 1,
+      "boot_utc": "2026-10-30T04:32:09.5000000Z",
+      "automatic_customer_and_private_worker_system_services_running": true,
+      "no_customer_service_timeout_events": true,
+      "native_core_loaded_without_desktop_engine_or_plugins": true,
+      "no_manual_service_start": true,
+      "identity_credential_bootstrap_and_consent_preserved": true,
+      "shipping_installed_verifier_passed": true,
+      "private_worker_https_authorization_passed": true,
+      "no_pending_recovery": true
+    },
+    {
+      "number": 2,
+      "boot_utc": "2026-10-30T04:44:48.5000000Z",
+      "automatic_customer_and_private_worker_system_services_running": true,
+      "no_customer_service_timeout_events": true,
+      "native_core_loaded_without_desktop_engine_or_plugins": true,
+      "no_manual_service_start": true,
+      "identity_credential_bootstrap_and_consent_preserved": true,
+      "shipping_installed_verifier_passed": true,
+      "private_worker_https_authorization_passed": true,
+      "no_pending_recovery": true
+    },
+    {
+      "number": 3,
+      "boot_utc": "2026-10-30T04:49:33.5000000Z",
+      "automatic_customer_and_private_worker_system_services_running": true,
+      "no_customer_service_timeout_events": true,
+      "native_core_loaded_without_desktop_engine_or_plugins": true,
+      "no_manual_service_start": true,
+      "identity_credential_bootstrap_and_consent_preserved": true,
+      "shipping_installed_verifier_passed": true,
+      "private_worker_https_authorization_passed": true,
+      "no_pending_recovery": true
+    }
+  ],
+  "limits": [
+    "Three normal guest reboots on one Server2019 VM do not establish physical cold-power-on reliability or other Windows versions.",
+    "Current installed customer GUI, authorized native sessions and receiving permission negatives remain to be tested.",
+    "The technician bundle is verified but this receipt does not qualify installed technician1510 behavior.",
+    "Automatic rollout remained paused; this was an explicit setup upgrade, not an automatic-update test.",
+    "Both native builds succeeded; exact shipping-byte comparison is pending.",
+    "The historical intermittent159 startup failure remains preserved; these results qualify only the scoped1510 tests."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
\ No newline at end of file
diff --git a/docs/evidence/1510-linux-native-attended-session-20261030.json b/docs/evidence/1510-linux-native-attended-session-20261030.json
new file mode 100644
index 00000000000..94ae34358e5
--- /dev/null
+++ b/docs/evidence/1510-linux-native-attended-session-20261030.json
@@ -0,0 +1,63 @@
+{
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "maintained_engine_source": "source-candidate-05d5369",
+  "scope": "Lab-signed current applications in separate owned Windows Server 2025 technician and Windows Server 2019 customer VMs, against the independently configured Linux company after its schema3 recovery/migration rehearsal. Native transport stays within the isolated lab.",
+  "technician": {
+    "os_build": 26100,
+    "file_version": "1.5.10",
+    "release_sequence": 13,
+    "profile_revision": 14,
+    "company_branding_rendered": true,
+    "mfa_login_and_authorized_inventory_observed": true
+  },
+  "customer": {
+    "os_build": 17763,
+    "file_version": "1.5.10+78",
+    "release_sequence": 13,
+    "profile_revision": 14,
+    "existing_enrollment_after_three_normal_reboots": true,
+    "attended_mode": true
+  },
+  "native_gui_observations": {
+    "request_made_from_authorized_device_inventory": true,
+    "receiving_customer_displayed_named_technician_and_accept_cancel_controls": true,
+    "customer_accepted_this_session": true,
+    "technician_rendered_actual_customer_desktop_after_approval": true,
+    "remote_pointer_opened_desktop_context_menu_confirmed_on_both_vm_consoles": true,
+    "remote_escape_closed_context_menu_confirmed_on_both_vm_consoles": true,
+    "customer_connection_manager_displayed_connected_status_and_disconnect_control": true,
+    "customer_clicked_disconnect": true,
+    "technician_displayed_closed_manually_by_peer": true,
+    "technician_side_control_escape_opened_local_start_menu_and_is_not_claimed_as_remote_input_proof": true
+  },
+  "server_connected_observation": {
+    "utc": "2026-10-30T09:46:00.775977+00:00",
+    "same_authorized_technician_and_approved_customer": true,
+    "claimed": true,
+    "closed": false,
+    "unattended": false,
+    "elapsed_since_request_seconds": 537,
+    "live_authorization_lease": true,
+    "continued_beyond_initial_300_second_lease": true
+  },
+  "server_disconnected_observation": {
+    "utc": "2026-10-30T09:49:06.717105+00:00",
+    "same_session": true,
+    "claimed": true,
+    "closed": true,
+    "live_authorization_lease": false,
+    "historical_lease_timestamp_retained": true,
+    "observer_correction": "The original observation also required lease_until=0. close_grant preserves the historical timestamp and sets closed=1; active_grant and renewal require an open grant. The corrected read-only observer checks the actual close contract. No session was repeated to replace this observation."
+  },
+  "release_boundaries": {
+    "lab_signing_only": true,
+    "company_updates_remain_paused": true,
+    "production_services_replaced": false,
+    "production_publication": false,
+    "public_network_direct_or_relay_qualification": false,
+    "transport_direct_vs_relay_log_correlation_collected": false,
+    "current_negative_authorization_and_closed_grant_replay_tests": false,
+    "full_clipboard_transfer_uac_unattended_multimonitor_and_windows_matrix": false
+  }
+}
diff --git a/docs/evidence/1510-linux-native-management-outage-recovery-20261030.json b/docs/evidence/1510-linux-native-management-outage-recovery-20261030.json
new file mode 100644
index 00000000000..8b382f515c7
--- /dev/null
+++ b/docs/evidence/1510-linux-native-management-outage-recovery-20261030.json
@@ -0,0 +1,37 @@
+{
+  "utc": "2026-10-30T12:04:10.269239+00:00",
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "scope": "Actual enrolled customer1.5.10+78 on Server2019 and technician1.5.10+78 on Server2025 against the isolated Linux company deployment. Only management was stopped; HTTPS and both transport containers remained running.",
+  "attended_native_desktop_before_outage": true,
+  "outage_started_utc": "2026-10-30T11:30:35.563946Z",
+  "original_lease_deadline_utc": "2026-10-30T11:34:35Z",
+  "native_authorization_loss_observed_utc": "2026-10-30T11:31:56.688162Z",
+  "native_authorization_error": "Company session authorization expired or revoked",
+  "access_closed_before_original_lease_deadline": true,
+  "customer_disconnect_used_to_end_outage_session": false,
+  "new_native_request_refused_during_outage": true,
+  "access_remained_closed_after_original_lease_deadline": true,
+  "no_company_grants_created_during_outage": true,
+  "same_management_container_restored": true,
+  "https_and_transport_container_ids_preserved": true,
+  "trusted_https_recovered": true,
+  "actual_receiver_expired_grant_renewal_http_status": 403,
+  "original_lease_unchanged_and_expired_after_recovery": true,
+  "original_closed_flag_remained_false_when_offline_close_callback_could_not_reach_management": true,
+  "receiving_identity_credentials_bootstrap_and_consent_preserved": true,
+  "receiving_installed_shipping_files_verified": true,
+  "customer_and_private_worker_services_running": true,
+  "fresh_customer_approval_after_recovery": true,
+  "fresh_native_desktop_after_recovery": true,
+  "distinct_new_claimed_live_grant_verified": true,
+  "fresh_session_customer_disconnect_verified": true,
+  "technician_disconnect_error": "Closed manually by the peer",
+  "same_fresh_server_record_closed": true,
+  "native_app_vm_or_connection_restart_required_for_recovery": false,
+  "observation_limit": "The customer console initially displayed a blank approval window. Read-only inspection found the CM process running and 813MiB guest memory available. Later foreground activation rendered the pending named approval; its original request was accepted without restarting the VM, app or connection. This does not establish the cause of the delayed console rendering.",
+  "exact_deadline_only_termination_branch_isolated": false,
+  "external_network_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1510-native-stock-client-legacy-denial-20261030.json b/docs/evidence/1510-native-stock-client-legacy-denial-20261030.json
new file mode 100644
index 00000000000..3229ae354be
--- /dev/null
+++ b/docs/evidence/1510-native-stock-client-legacy-denial-20261030.json
@@ -0,0 +1,27 @@
+{
+  "utc": "2026-10-30T10:40:49.168343+00:00",
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "scope": "Cached code-signed stock RustDesk native client1.5.0+68 on Server2025 attempted an ID-based connection through lab company transport to managed customer1.5.10+78 on Server2019, with a dummy legacy password and no company grant.",
+  "control_executable_sha256": "7f6d1e09e5a9924f567962aa57a6b126b409bed4775d98074c727420438768dc",
+  "cached_public_files_verified": 93,
+  "stock_publisher_valid": true,
+  "separate_stock_profile_created": true,
+  "company_credentials_or_grant_supplied": false,
+  "stock_control_enrolled": false,
+  "observed_native_login_error": "Company session authorization denied",
+  "customer_desktop_displayed": false,
+  "company_grants_requested_during_entire_control": 0,
+  "managed_receiver_service_running": true,
+  "target_approval_and_consent_preserved": true,
+  "existing_company_native_process_preserved": true,
+  "normal_control_window_close": true,
+  "control_task_ready_exit0": true,
+  "same_original_attempt_no_restart": true,
+  "stock_window_rendering_was_delayed": true,
+  "source_profile_and_logs_retained_privately": true,
+  "receiving_native_denial_log_collected": false,
+  "native_direct_ip_path_tested": false,
+  "external_network_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json b/docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json
new file mode 100644
index 00000000000..10358cf46ad
--- /dev/null
+++ b/docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json
@@ -0,0 +1,38 @@
+{
+  "utc": "2026-10-30T12:29:07.029862+00:00",
+  "from_application_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "to_application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "os": "Windows Server 2019 x64 Desktop Experience build17763",
+  "edition": "technician",
+  "from_version": "1.5.8+76",
+  "to_version": "1.5.10+78",
+  "from_sequence": 10,
+  "to_sequence": 13,
+  "paused_policy_deferred": true,
+  "closed_maintenance_window_deferred": true,
+  "zero_percent_rollout_deferred": true,
+  "same_original_native_process_held_through_all_deferral_phases": true,
+  "timer_driven_automatic_upgrade_after_policy_opened": true,
+  "manual_installer_or_update_command_invoked": false,
+  "target_msi_sha256": "f10ee5c994734d8c22dc1d77b1a39bddd9bc8c8e784f233c30cdd3ee23788491",
+  "installed_wrapper_sha256": "eda740b63ddd50c796786407d291f89989c554b4eb3aa5c59d0c4eb5ad125352",
+  "installed_agent_sha256": "f886a53dcb1b97e76fc5792e9fa4a221a13e6bbfd24973d9a56f2a726103adfa",
+  "shipping_verifier_passed": true,
+  "valid_lab_publisher_verified": true,
+  "identity_consent_bootstrap_preserved": true,
+  "no_pending_or_failed_recovery_markers": true,
+  "native_updated_app_restarted_automatically": true,
+  "post_upgrade_native_mfa_and_authorized_inventory": true,
+  "exact_installation_report_correlated_with_company": true,
+  "reported_installed_sequence": 13,
+  "reported_phase": "deferred",
+  "original_update_policy_restored_paused": true,
+  "final_profile_revision": 18,
+  "active_session_coordination_tested": false,
+  "interrupted_update_recovery_tested": false,
+  "download_phase_progress_reporting_qualified": false,
+  "standard_user_installation_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false
+}
\ No newline at end of file
diff --git a/docs/evidence/1510-server2025-technician-upgrade-20261030.json b/docs/evidence/1510-server2025-technician-upgrade-20261030.json
new file mode 100644
index 00000000000..d932efc99eb
--- /dev/null
+++ b/docs/evidence/1510-server2025-technician-upgrade-20261030.json
@@ -0,0 +1,66 @@
+{
+  "observed_utc": "2026-10-30T06:47:27.2909330Z",
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "scope": "Existing per-user technician installation in an owned disposable Windows Server 2025 Desktop Experience VM, build26100; explicit company-bundle upgrade under the existing administrator profile.",
+  "company_bundle_sha256": "a70e7a496068a7c5928980e7da441bbb99c64e7d07e047349eda0e714f59be8a",
+  "before": {
+    "native_file_version": "1.5.1",
+    "release_sequence": 3,
+    "profile_revision": 5
+  },
+  "after": {
+    "native_file_version": "1.5.10",
+    "release_sequence": 13,
+    "profile_revision": 14,
+    "technician_executable_sha256": "eda740b63ddd50c796786407d291f89989c554b4eb3aa5c59d0c4eb5ad125352",
+    "agent_sha256": "f886a53dcb1b97e76fc5792e9fa4a221a13e6bbfd24973d9a56f2a726103adfa"
+  },
+  "verified": {
+    "existing_company_endpoint_and_both_trust_pins_match_bundle": true,
+    "signed_profile_refreshed_before_setup_without_pin_override": true,
+    "company_bootstrap_identity_and_consent_preserved": true,
+    "technician_state_contains_no_customer_device_credential": true,
+    "installed_bytes_match_original_lab_signed_outputs": true,
+    "installed_publisher_valid": true,
+    "shipping_verify_installed_passed": true,
+    "company_branding_and_paused_updates_preserved": true,
+    "pending_install_update_configuration_and_uninstall_markers_absent": true
+  },
+  "observer_correction": {
+    "original_post_setup_check_failed": true,
+    "reason": "The observer incorrectly required the customer Flutter file-version label 1.5.10+78. The technician executable reports 1.5.10.",
+    "original_failure_and_setup_logs_preserved": true,
+    "fresh_verification_checked_exact_signed_hashes_publisher_identity_state_and_shipping_verifier": true,
+    "installer_repeated": false
+  },
+  "lab_boundary": {
+    "lab_signing_only": true,
+    "public_lab_certificate_imported_only_into_owned_guest": true,
+    "private_signing_key_exported": false,
+    "production_publication": false,
+    "pre_upgrade_vm_normal_shutdown_and_memory_adjustment": true,
+    "forced_reset_or_disk_replacement": false
+  },
+  "not_qualified_by_this_receipt": [
+    "Native desktop sessions, attended approval, disconnect and receiving permission enforcement",
+    "Standard-user installation or elevation behavior",
+    "Automatic updating, interruption recovery or session/update coordination",
+    "Fresh installation, repair, uninstall or complete operating-system matrix",
+    "Rendered branding, offline branding or profile-key rotation",
+    "External public-network connectivity",
+    "Production publisher approval"
+  ],
+  "subsequent_native_gui": {
+    "utc": "2026-10-30T09:30:26.427579+00:00",
+    "native_version": "1.5.10",
+    "os_build": 26100,
+    "swan_attribution_visible": true,
+    "one_owned_lab_mfa_login_succeeded": true,
+    "authorized_inventory_rendered": true,
+    "target_customer19_approved_visible": true,
+    "native_desktop_session_demonstrated": false,
+    "otp_or_password_recorded": false,
+    "launch_observer_timeout_did_not_restart_original_task": true
+  }
+}
diff --git a/docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json b/docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json
new file mode 100644
index 00000000000..69daef5e242
--- /dev/null
+++ b/docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json
@@ -0,0 +1,129 @@
+{
+  "utc": "2026-10-30T01:05:44.231049+00:00",
+  "bootstrap_source": "aa73d1779007a751628ebc7a67d9e72fde2ad4f0",
+  "working_version": "1.5.10+78",
+  "ci_run": 40982601944,
+  "ci_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40982601944",
+  "artifact_id": 12945297987,
+  "artifact_sha256": "f6f21247131ef9e8c70935c8cd857d701328e714fcae9673cef4cc8430b0c987",
+  "artifact_source_matches_pinned_commit": true,
+  "scope": "Real Windows SCM, service processes, DLL loader and control dispatch with unsigned simulated core DLLs; no native Rust core or remote-control feature qualification.",
+  "platforms": [
+    {
+      "platform": "Windows Server2022 GitHub runner",
+      "cases": [
+        {
+          "case": "normal",
+          "passed": true,
+          "elapsed_seconds": 0.4891144,
+          "expected_error": 0,
+          "pending_checkpoints": []
+        },
+        {
+          "case": "slow-loader",
+          "passed": true,
+          "elapsed_seconds": 35.6337042,
+          "expected_error": 0,
+          "pending_checkpoints": [
+            1,
+            2,
+            3,
+            4,
+            5,
+            6,
+            7
+          ]
+        },
+        {
+          "case": "missing-core",
+          "passed": true,
+          "elapsed_seconds": 0.1510484,
+          "expected_error": 126,
+          "pending_checkpoints": []
+        },
+        {
+          "case": "missing-export",
+          "passed": true,
+          "elapsed_seconds": 0.1581287,
+          "expected_error": 127,
+          "pending_checkpoints": []
+        },
+        {
+          "case": "bounded-loader-timeout",
+          "passed": true,
+          "elapsed_seconds": 10.5239257,
+          "expected_error": 1460,
+          "pending_checkpoints": [
+            1,
+            2
+          ]
+        }
+      ]
+    },
+    {
+      "platform": "Windows Server2019 build17763 owned VM",
+      "cases": [
+        {
+          "case": "normal",
+          "passed": true,
+          "elapsed_seconds": 2.9697324999999997,
+          "expected_error": 0,
+          "pending_checkpoints": [
+            1
+          ]
+        },
+        {
+          "case": "slow-loader",
+          "passed": true,
+          "elapsed_seconds": 35.7144145,
+          "expected_error": 0,
+          "pending_checkpoints": [
+            1,
+            2,
+            3,
+            4,
+            5,
+            6,
+            7
+          ]
+        },
+        {
+          "case": "missing-core",
+          "passed": true,
+          "elapsed_seconds": 0.1122171,
+          "expected_error": 126,
+          "pending_checkpoints": []
+        },
+        {
+          "case": "missing-export",
+          "passed": true,
+          "elapsed_seconds": 0.7184801,
+          "expected_error": 127,
+          "pending_checkpoints": [
+            1
+          ]
+        },
+        {
+          "case": "bounded-loader-timeout",
+          "passed": true,
+          "elapsed_seconds": 10.209052999999999,
+          "expected_error": 1460,
+          "pending_checkpoints": [
+            1,
+            2
+          ]
+        }
+      ]
+    }
+  ],
+  "exact_service_argument_checks_passed_both_platforms": true,
+  "existing_server2019_customer_identity_credential_trust_consent_sequence_preserved": true,
+  "existing_server2019_customer_and_worker_processes_unchanged": true,
+  "all_owned_fixture_services_removed": true,
+  "no_global_service_timeout_or_customer_startup_policy_change": true,
+  "full_native_build_pending": true,
+  "native_cold_boot_retest_pending": true,
+  "original_intermittent_startup_failure_not_cleared": true,
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json b/docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json
new file mode 100644
index 00000000000..b76e3f4080a
--- /dev/null
+++ b/docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json
@@ -0,0 +1,50 @@
+{
+  "utc": "2026-10-30T15:15:48.185192+00:00",
+  "from_application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "to_application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "os": "Windows 10 Pro x64 build19045",
+  "edition": "customer",
+  "from_version": "1.5.4+72",
+  "to_version": "1.5.10+78",
+  "from_sequence": 7,
+  "to_sequence": 13,
+  "target_msi_sha256": "971009e156b0c83382747d26794ee27c56ddb85dd42fb36fe75d51d593c1b8c8",
+  "automatic_timer_download_and_install": true,
+  "manual_update_or_installer_command_invoked": false,
+  "lab_configuration_task_priority_changed_from7_to4": true,
+  "existing_watcher_priority_changed_without_restart_did_not_advance": true,
+  "controlled_configuration_watcher_restart_required": true,
+  "native_service_or_vm_restart_used_as_upgrade_repair": false,
+  "root_cause_fully_isolated": false,
+  "exact_signed_installed_files_and_shipping_verifier_passed": true,
+  "valid_disposable_lab_publisher_verified": true,
+  "msi_product_state": 5,
+  "msi_product_version": "1.5.10",
+  "identity_credential_bootstrap_consent_preserved": true,
+  "unattended_consent_disabled": true,
+  "automatic_system_service_running": true,
+  "no_pending_or_failed_recovery_markers": true,
+  "branding_and_paused_update_policy_preserved": true,
+  "final_profile_revision": 24,
+  "current_native_technician_mfa_and_authorized_inventory": true,
+  "named_customer_approval_and_actual_desktop": true,
+  "correlated_pointer_and_escape": true,
+  "authorization_lease_renewed_beyond_initial300_seconds": true,
+  "customer_main_window_stop_support_ended_access": true,
+  "same_server_session_closed": true,
+  "technician_displayed_authorization_expired_or_revoked": true,
+  "customer_resume_support_restored_availability_after_test": true,
+  "old_authorization_reused_after_resume": false,
+  "active_session_update_coordination_qualified": false,
+  "interrupted_installation_recovery_qualified": false,
+  "unmodified_default_updater_flow_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false,
+  "limits": [
+    "The older 1.5.4 watcher required a scoped task-priority repair and controlled restart. This is not an unmodified unattended-upgrade acceptance pass.",
+    "A normal-priority SYSTEM check verified the staged package signature in about18 seconds; raising the existing watcher priority alone did not advance it. The exact original stalled stage is not proved.",
+    "Current native session passed after upgrade; previous 1.5.4 approval-pipe failure remains separate historical evidence.",
+    "No external NAT, relay-only, secure-desktop, clipboard or transfer qualification is implied."
+  ]
+}
diff --git a/docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json b/docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json
new file mode 100644
index 00000000000..95beb68f9fb
--- /dev/null
+++ b/docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json
@@ -0,0 +1,27 @@
+{
+  "utc": "2026-10-30T17:27:38.677744+00:00",
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "image": "sha256:60113e9b1ef69249bc409f22e49a7dd8fec73d5dc5a9f54f0a943d0ae9f3fdfa",
+  "management_elf_sha256": "877f72e6cab9f2208fef3d127329a9b2284215b1690717f5b5858bba9f91d31a",
+  "cached_toolchain_lab_variant": true,
+  "cached_toolchain_image": "sha256:e279ac3bf9680e4a088ff251fae96da5dfe4b026ccd81a7bd6f1eb233e7d9e6e",
+  "rust_version": "1.90.0",
+  "fresh_source_and_empty_target_required": true,
+  "offline_compile": true,
+  "build_jobs": 1,
+  "build_memory_mib": 1536,
+  "canonical_debian_runtime_retained": true,
+  "real_shipped_harness_used": true,
+  "docker_calls_routed_to_owned_wsl_daemon_without_mocked_results": true,
+  "nonroot_readonly_container_and_private_storage_passed": true,
+  "fresh_company_setup_mfa_and_replay_denial_passed": true,
+  "pending_enrollment_approval_and_unattended_policy_denial_passed": true,
+  "real_backup_wrong_password_rejection_and_restore_passed": true,
+  "original_company_image_unchanged": true,
+  "existing_company_upgrade_performed": false,
+  "new_image_https_native_and_worker_integration_qualified": false,
+  "canonical_production_docker_image_reproduction_qualified": false,
+  "initial_terminal_build_failure": "Docker interpreted a bare local image ID as a registry name. Corrected attempt verified the existing local tag still resolved to that same image ID. No source or live deployment was changed.",
+  "production_publication": false,
+  "restart_identity_approval_and_consent_persistence_passed": true
+}
diff --git a/docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json b/docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json
new file mode 100644
index 00000000000..f07386bc300
--- /dev/null
+++ b/docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json
@@ -0,0 +1,82 @@
+{
+  "utc": "2026-10-30T17:19:19.761891+00:00",
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "version": "1.5.11+79",
+  "workflow_run": 41079284199,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41079284199",
+  "artifact": 12993142115,
+  "artifact_digest": "sha256:353181dce9b4dff8ed9977fdcbeddd42721b99e7e529d6b2816fb62b6a60912b",
+  "artifact_bytes": 256216207,
+  "archive_hash_size_crc_and_safe_entries_verified": true,
+  "all_manifest_hashes_match": true,
+  "public_tracked_source_files_verified": 1314,
+  "generated_bridge_files_verified": 6,
+  "source_repositories": {
+    ".": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+    "libs/hbb_common/": "7e1c392c62d39c364127307cd408421dd5f8cfb0"
+  },
+  "source_date_epoch": 1793373381,
+  "pinned_flutter_sdk_and_engine_verified": true,
+  "engine_source_commit": "05d5369c04804b9a9b2dc06df0cb85b0efe6f274",
+  "engine_production_approved": false,
+  "no_eager_bundled_desktop_dll_imports": true,
+  "required_native_ci_steps": {
+    "Reject paused support and authorization reuse after resume": "success",
+    "Reject authorization retries and inherited audit destinations": "success",
+    "Reject cross-target and stale-login file-transfer handles": "success",
+    "Verify hardened DLL search supports delayed application libraries": "success",
+    "Build branded client": "success",
+    "Reject incoming capture helpers in the technician edition": "success",
+    "Verify service launcher defers desktop DLL loading": "success",
+    "Verify customer MSI starts a headless native service": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "eight_unsigned_shipping_files": {
+    "swan-agent.exe": {
+      "sha256": "ffbc7944b22f9bc237f5e9b3690271b74393ced2e01c759fa69c78a99e27ad7f",
+      "bytes": 5756416
+    },
+    "swan-management.exe": {
+      "sha256": "8249a0685e70326d3a4c5f666493e0e419a6ce04c21e4011478d459b5ed16d28",
+      "bytes": 9130496
+    },
+    "swan-worker.exe": {
+      "sha256": "79d16d6998285438f07b12b15740be5adc70d9a13d7b7726dfd9586c777aea50",
+      "bytes": 4900352
+    },
+    "SwanRemoteSupport-1.5.11-customer-x64-unsigned.msi": {
+      "sha256": "9fe23bc680997b9b8a61396fb235c77c0b462438139952fb22fe9752715f23bb",
+      "bytes": 33902592
+    },
+    "SwanRemoteSupport-1.5.11-technician-x64-unsigned.exe": {
+      "sha256": "194fed13671f14fad554cb14cf1a639f01017d607b80efe20f9e4de488728e75",
+      "bytes": 24276992
+    },
+    "SwanRemoteSupport-1.5.11-technician-x64-unsigned.msi": {
+      "sha256": "d4bd46e2131a7d1f9295b825826964d19210eabc0d79cfe07703a2e845902a8d",
+      "bytes": 31637504
+    },
+    "SwanRemoteSupport-1.5.11-x64-unsigned-install.exe": {
+      "sha256": "194fed13671f14fad554cb14cf1a639f01017d607b80efe20f9e4de488728e75",
+      "bytes": 24276992
+    },
+    "SwanServerSetup-UNSIGNED-TEST.exe": {
+      "sha256": "e4d9dfd287375faa0d7986433cd1856daa72fed7cb66f912bcac0f30d5a12dd8",
+      "bytes": 65881088
+    }
+  },
+  "individual_native_regression_log_bodies_rechecked": false,
+  "independent_build_run": 41093808835,
+  "independent_original_byte_comparison_pending": true,
+  "production_signing_approved": false,
+  "new_lab_signed_packages_ready": false,
+  "installed1511_runtime_or_upgrade_qualified": false,
+  "production_publication": false,
+  "declared_text_checkout_conversion_count": 1170,
+  "source_file_manifest_location": "BUILD-SOURCE.json in archived exact corresponding source; source checkout conversions were checked against pinned Git blobs, without normalizing shipping binaries"
+}
diff --git a/docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json b/docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json
new file mode 100644
index 00000000000..c8422061d5c
--- /dev/null
+++ b/docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json
@@ -0,0 +1,35 @@
+{
+  "utc": "2026-10-30T18:08:15.520941+00:00",
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "version": "1.5.11+79",
+  "original_unsigned_native_run": 41079284199,
+  "lab_signer_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "lab_publisher": "Swan Disposable Lab Publisher 20261027",
+  "existing_nonexportable_windows10_key_reused": true,
+  "private_key_exported": false,
+  "five_endpoint_signatures_and_timestamps_verified": true,
+  "source_input_files_unchanged": true,
+  "source_input_files_verified": 217,
+  "default_customer_and_technician_msi_builds_passed": true,
+  "signed_customer_installed_files": 96,
+  "endpoint_output_sha256": {
+    "signed_agent_sha256": "b74868f18b05d5ff3a90f73d5947ebde6aa832b7a2c61b82546751f8537ca87c",
+    "signed_customer_executable_sha256": "faa39ba09ab1e196936171d7290f5ec0d1d28cff27e548385288746821fbd96c",
+    "signed_technician_executable_sha256": "c542a8072ff032a3e28eb04a8ee2e21a4ccf49351e2a4b0100f5a9a5691932eb",
+    "signed_customer_msi_sha256": "87702116ea7906ce845ac29f1d62df199acc6bd7d4930cf5b922cd2405770943",
+    "signed_technician_msi_sha256": "6709171f7c33c00a74936f9221bc1b4c54502e3314aa16a78367f7518536d1e9"
+  },
+  "signed_management_and_worker_sha256": {
+    "swan-worker.exe": "8b85306e565c5f95dee049d3ab2c0275abbd06129688e0d5eb0de8d678d25564",
+    "swan-management.exe": "a1dc59ab82bb246a2b59c48c8db7b31f3f7684373340484ff746cefd5c5563e8"
+  },
+  "both_server_component_signatures_and_timestamps_verified": true,
+  "signed_output_transfer_hashes_verified": true,
+  "signing_tasks_normal_priority4": true,
+  "existing_customer_service_and_identity_consent_bootstrap_preserved": true,
+  "new_packages_installed": false,
+  "live_management_or_worker_upgraded": false,
+  "independent_native_original_byte_comparison_pending": true,
+  "production_signing_approved": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1511-component-priority-and-recovery-ci-20261030.json b/docs/evidence/1511-component-priority-and-recovery-ci-20261030.json
new file mode 100644
index 00000000000..6a6ad4b7a5e
--- /dev/null
+++ b/docs/evidence/1511-component-priority-and-recovery-ci-20261030.json
@@ -0,0 +1,20 @@
+{
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "workflow_run": 41079208688,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41079208688",
+  "status": "completed",
+  "conclusion": "success",
+  "linux_verify_job": 124147606887,
+  "windows_verify_job": 124147607305,
+  "linux_and_windows_security_management_tests_passed": true,
+  "real_windows_below_normal_parent_normal_helper_regression_passed": true,
+  "windows_priority_test": "update::tests::powershell_verifier_does_not_inherit_background_priority",
+  "windows_large_backup_explicit_ignored_test_passed": true,
+  "linux_real_large_backup_cli_passed": true,
+  "pinned_maintained_windows_transport_build_passed": true,
+  "linux_company_deployment_rehearsal_passed": true,
+  "native1511_build": 41079284199,
+  "native1511_build_completed": false,
+  "installed1511_update_flow_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json b/docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json
new file mode 100644
index 00000000000..aecccfd9fcd
--- /dev/null
+++ b/docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json
@@ -0,0 +1,101 @@
+{
+  "recorded_utc": "2026-10-30T22:06:33.745882+00:00",
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "native_reproduction": {
+    "utc": "2026-10-30T18:22:17.763016+00:00",
+    "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+    "comparison_run": 41105207916,
+    "comparison_artifact": 13000342682,
+    "comparison_artifact_digest": "sha256:0a9dd41d6018fefc13830ca1aeaf83183849fe54b61c22da96880c19edf6dc3d",
+    "report_sha256": "f31d495ffa7e4325e1def99ae6e4e8ca385d0f72bbc8654b4559ec46bd384625",
+    "shipping_outputs_identical": 8,
+    "source_files_per_build": 1314,
+    "bridge_files_per_build": 6,
+    "msvc_files_per_build": [
+      618,
+      618
+    ],
+    "first_archive_matches_locally_verified_original": true,
+    "second_large_local_download_started": false,
+    "runtime_qualified": false,
+    "production_publication": false
+  },
+  "owned_lab_management_upgrade": {
+    "utc": "2026-10-30T18:21:02.019000+00:00",
+    "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+    "image": "sha256:60113e9b1ef69249bc409f22e49a7dd8fec73d5dc5a9f54f0a943d0ae9f3fdfa",
+    "fresh_encrypted_backup_verified": true,
+    "schema_source_unchanged": true,
+    "real_https_health_and_fresh_mfa": true,
+    "company_profile26_paused_updates_identity_consent_roles_workers_releases_jobs_sessions_preserved": true,
+    "transport_and_https_container_ids_preserved": true,
+    "lab_cached_toolchain_image_only": true,
+    "native_session_and_new_worker_recipe_still_pending": true,
+    "production_publication": false
+  },
+  "owned_lab_worker_upgrade": {
+    "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+    "registry_public_path_only": true,
+    "private_configuration_credential_acl_and_customer_identity_consent_preserved": true,
+    "production_publication": false,
+    "utc": "2026-10-30T18:22:12.3507009Z",
+    "new_signed_worker_running_automatic": true,
+    "actual_new_bundle_generation_pending": true,
+    "previous_binary_receipt_and_configuration_retained_inside_private_guest": true,
+    "worker_sha256": "8b85306e565c5f95dee049d3ab2c0275abbd06129688e0d5eb0de8d678d25564",
+    "compiled_existing_configuration_check_passed": true
+  },
+  "fresh_preupgrade_encrypted_backup": {
+    "utc": "2026-10-30T18:14:45.215165+00:00",
+    "bytes": 787780875,
+    "sha256": "e43348733447317b3611ea8c15db261a9bcc97975d5b2c36c22ab09fa7256242",
+    "encrypted_copy_hash_matched": true,
+    "separate_passphrase": true
+  },
+  "company_bundles": {
+    "utc": "2026-10-30T22:06:05.200111+00:00",
+    "editions": [
+      {
+        "edition": "customer",
+        "job_id": "0bf732e1-f0d4-49f2-aa99-c69aee767cdd",
+        "bundle_sha256": "8f308fb9b23ca6b43f288735654c418a5bf803d9e1f382df033c14007648f2de",
+        "bytes": 32721210,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "offline_signature_mutation_check": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 200,
+        "download_status": 200
+      },
+      {
+        "edition": "technician",
+        "job_id": "e1b8fce5-ca83-4245-964b-480e65e9a202",
+        "bundle_sha256": "1d37f064ddaf6d0f4a0c3473cb41ede09e98c2afa7d62fe45fc9b7fcc2eac670",
+        "bytes": 30522021,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "offline_signature_mutation_check": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 401,
+        "download_status": 200
+      }
+    ],
+    "management_deployment_unchanged_during_bundle_generation": true,
+    "application_source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+    "independent_company": true,
+    "updates_paused": true,
+    "installer_executed": false,
+    "native_session_qualified": false,
+    "production_publication": false
+  },
+  "upgrade_fixture_correction": "First attempt restored the original image because it compared volatile issued_at/expires_at. Diagnosis showed all company profile settings equal. Second attempt verified the active Ed25519 signature, validity and stable settings; upgrade passed.",
+  "bounds": [
+    "Lab signing only; no production publisher approval.",
+    "Linux image uses verified cached toolchain; canonical OCI reproducibility remains open.",
+    "Company deployment remains private lab only; public NAT/relay unqualified.",
+    "Endpoint1.5.11 update and full OS/desktop acceptance remain open."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json b/docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json
new file mode 100644
index 00000000000..7e2c03051a4
--- /dev/null
+++ b/docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json
@@ -0,0 +1,103 @@
+{
+  "recorded_utc": "2026-10-30T23:53:55.759298+00:00",
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "os": "Windows10 Pro x64 build19045",
+  "edition": "customer",
+  "scope": "Installed shipping agent verify-package against a real lab-signed1.5.11 MSI and isolated credential-free state/issuer fixtures",
+  "actual_results": {
+    "isolated_fixture_keys_only": true,
+    "actual_installer_executed": false,
+    "utc": "2026-10-30T23:16:52.9886478Z",
+    "production_publication": false,
+    "agent_sha256": "b74868f18b05d5ff3a90f73d5947ebde6aa832b7a2c61b82546751f8537ca87c",
+    "cases": [
+      {
+        "fixture_state_unchanged": true,
+        "accepted": true,
+        "case": "valid-control",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "tampered-signature",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-replay",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-expired",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-edition",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-architecture",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-channel",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-incompatible-windows",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-hash",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-publisher",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-certificate",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-wrong-msi-version",
+        "expected_reason_matched": true
+      },
+      {
+        "fixture_state_unchanged": true,
+        "accepted": false,
+        "case": "signed-invalid-package",
+        "expected_reason_matched": true
+      }
+    ],
+    "network_update_invoked": false,
+    "installed_durable_state_trust_and_binary_unchanged": true
+  },
+  "invalid_package_case_hash_matched_its_signed_fixture_metadata_before_authenticode_rejection": true,
+  "bounds": [
+    "No MSI installation or network update was invoked. This tests the real package-verification path without claiming live automatic-update rejection or other OS/editions.",
+    "Fixture issuer keys are isolated; the installed company trust was not changed.",
+    "Lab publisher only; production signing remains separate."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json b/docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json
new file mode 100644
index 00000000000..d10cf499ded
--- /dev/null
+++ b/docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json
@@ -0,0 +1,103 @@
+{
+  "recorded_utc": "2026-10-30T22:38:11.917028+00:00",
+  "application_source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "scope": "Existing Server2019 Desktop Experience17763 per-user technician1.5.10 to1.5.11 automatic update",
+  "automatic_update_and_fresh_native_mfa": {
+    "maintenance_end": 0,
+    "agent_sha256": "b74868f18b05d5ff3a90f73d5947ebde6aa832b7a2c61b82546751f8537ca87c",
+    "native_processes": [
+      {
+        "pid": 3264,
+        "version": "1.5.11+79",
+        "session": 1
+      }
+    ],
+    "profile_revision": 30,
+    "no_pending_or_failed_update": true,
+    "mode": "final",
+    "rollout_percent": 20,
+    "utc": "2026-10-30T22:33:49.7317572Z",
+    "actual_shipping_verifier_passed": true,
+    "manual_update_or_installer_invoked": false,
+    "publisher_verified": true,
+    "updates_paused": true,
+    "maintenance_start": 0,
+    "version": "1.5.11",
+    "native_sha256": "c542a8072ff032a3e28eb04a8ee2e21a4ccf49351e2a4b0100f5a9a5691932eb",
+    "identity_consent_and_bootstrap_preserved": true,
+    "sequence": 14,
+    "native_mfa_login_independently_audited": true,
+    "post_upgrade_native_mfa_audited": true,
+    "current_technician_report_received_by_company": true,
+    "report_phases_observed": [
+      "deferred"
+    ],
+    "original_paused_policy_restored": true
+  },
+  "excluded_customer_and_recovery_tasks": {
+    "customer_update14_never_staged": true,
+    "technician_recovery_task_observation": [
+      {
+        "last_run_utc": "2026-10-30T22:31:31.0000000Z",
+        "last_result": 1,
+        "name": "Swan Update Recovery technician E7D878CD3C863040 13",
+        "state": "Ready"
+      },
+      {
+        "last_run_utc": "1999-11-29T22:00:00.0000000Z",
+        "last_result": 267011,
+        "name": "Swan Update Recovery technician E7D878CD3C863040 14",
+        "state": "Ready"
+      }
+    ],
+    "cached_updates_paused": false,
+    "worker_sha256": "8b85306e565c5f95dee049d3ab2c0275abbd06129688e0d5eb0de8d678d25564",
+    "utc": "2026-10-30T22:34:24.4445292Z",
+    "worker_service": "Running",
+    "customer_identity_credential_consent_and_trust_preserved": true,
+    "customer_profile_revision": 29,
+    "customer_sequence": 13,
+    "customer_service": "Running",
+    "cached_rollout_percent": 28
+  },
+  "actual_recovery_principal_diagnosis": {
+    "read_only": true,
+    "utc": "2026-10-30T22:35:32.4135381Z",
+    "tasks": [
+      {
+        "name": "Swan Update Recovery technician E7D878CD3C863040 13",
+        "principal": "Administrator",
+        "arguments": "recover-update-task",
+        "last_result": 1,
+        "state": "Ready",
+        "matches_expected_account": false
+      },
+      {
+        "name": "Swan Update Recovery technician E7D878CD3C863040 14",
+        "principal": "Administrator",
+        "arguments": "recover-update-task",
+        "last_result": 267011,
+        "state": "Ready",
+        "matches_expected_account": false
+      }
+    ],
+    "identity_name": "SWAN-END-19\\Administrator"
+  },
+  "original_policy_restored": {
+    "utc": "2026-10-30T22:32:31.392659+00:00",
+    "profile_revision": 30,
+    "signature_verified": true,
+    "original_paused_policy_restored": true,
+    "original_rollout_percent_restored": 20,
+    "restoration_login_used_fresh_totp_after_replay_rejection": true
+  },
+  "finding": "Task Scheduler returns the local account short name Administrator after registration by SID. The shipping guard compares it with only the SID and fully qualified identity; the observed account fails that guard. An older recovery task remains with exit1; current14 recovery/cleanup is not qualified.",
+  "planned_correction": "Resolve actual task principal to a Windows SID and require the exact expected SID, retaining all path/action/argument checks. Do not authorize suffix or display-name matching.",
+  "fixture_incident": "Pause restoration initially reused the admin MFA step consumed by another verifier and received401 before any PUT. Fresh-step login restored signed profile30 and original pause/20% rollout.",
+  "bounds": [
+    "Automatic upgrade, fresh native MFA and reporting passed; durable recovery remains blocked by the account comparison finding.",
+    "No native remote session after1.5.11 upgrade or full Windows lifecycle qualification claimed.",
+    "Lab publisher only; no production signing or publication."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json b/docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json
new file mode 100644
index 00000000000..dd7d9282fd3
--- /dev/null
+++ b/docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json
@@ -0,0 +1,164 @@
+{
+  "recorded_utc": "2026-10-30T22:21:34.875255+00:00",
+  "source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "scope": "Owned existing Windows10 Pro19045 customer automatic1.5.10 to1.5.11 update, normal reboot and isolated shipping-agent profile validation",
+  "baseline": {
+    "native_version": "1.5.10+78",
+    "release_sequence": 13,
+    "profile_revision": 26,
+    "watch_priority": 4,
+    "service_state": "Running",
+    "shipping_verifier_passed": true,
+    "no_recovery_markers": true
+  },
+  "automatic_upgrade_and_post_reboot_verification": {
+    "os": "Windows10 Pro x64",
+    "branding_and_paused_policy_preserved": true,
+    "configuration_task_running_normal_priority": true,
+    "msi_product_version": "1.5.11",
+    "customer_automatic_system_service_running": true,
+    "to_version": "1.5.11+79",
+    "to_sequence": 14,
+    "os_build": 19045,
+    "exact_signed_installed_bytes": true,
+    "no_pending_or_failed_recovery": true,
+    "production_publication": false,
+    "from_version": "1.5.10+78",
+    "manual_update_or_installer_command_invoked": false,
+    "msi_product_state": 5,
+    "utc": "2026-10-30T22:20:48.9806715Z",
+    "consent_revision": 2,
+    "expected_lab_publisher_valid": true,
+    "profile_revision": 28,
+    "from_sequence": 13,
+    "native_approval_after_upgrade_qualified": false,
+    "lab_watcher_priority_repair_and_controlled_restart_required": false,
+    "identity_credential_consent_and_bootstrap_preserved": true,
+    "shipping_verifier_passed": true,
+    "unattended_consent_disabled": true
+  },
+  "original_server_policy_restored": {
+    "utc": "2026-10-30T22:16:02.155736+00:00",
+    "profile_revision": 28,
+    "signature_verified": true,
+    "original_paused_policy_restored": true
+  },
+  "exact_enrolled_customer_server_report": {
+    "utc": "2026-10-30T22:17:39.732244+00:00",
+    "exact_enrolled_customer_owner_matched": true,
+    "installed_sequence": 14,
+    "phase": "current",
+    "revision": 110
+  },
+  "isolated_shipping_agent_profile_cases": [
+    {
+      "edition": "customer",
+      "accepted": true,
+      "case": "valid-control",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "customer",
+      "accepted": false,
+      "case": "tampered-payload",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "customer",
+      "accepted": false,
+      "case": "invalid-signature",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "customer",
+      "accepted": false,
+      "case": "signed-expired",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "customer",
+      "accepted": false,
+      "case": "signed-future",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "customer",
+      "accepted": false,
+      "case": "signed-wrong-company",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "customer",
+      "accepted": false,
+      "case": "signed-older-revision",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": true,
+      "case": "valid-control",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": false,
+      "case": "tampered-payload",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": false,
+      "case": "invalid-signature",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": false,
+      "case": "signed-expired",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": false,
+      "case": "signed-future",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": false,
+      "case": "signed-wrong-company",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    },
+    {
+      "edition": "technician",
+      "accepted": false,
+      "case": "signed-older-revision",
+      "expected_reason_matched": true,
+      "state_unchanged": true
+    }
+  ],
+  "isolated_fixture_state_unchanged": true,
+  "fixtures_have_no_enrolled_device_credentials": true,
+  "normal_reboot_request_after_pre_reboot_shipping_verification": true,
+  "bounds": [
+    "Existing installation upgrade; fresh clean-machine setup remains separate.",
+    "Initial boot lacked the owned WSL KVM driver; no disk opened until driver loaded.",
+    "Two read-only SSH observations timed out during startup; no install, repair or reboot was repeated.",
+    "Isolated profile cases use disposable fixture issuer and do not qualify live HTTPS sync or native UI rejection.",
+    "Post1.5.11 native attended session, active-session update exclusion, interruption recovery, other OS/editions and production signing remain open."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json b/docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json
new file mode 100644
index 00000000000..bdb5d0df9d4
--- /dev/null
+++ b/docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json
@@ -0,0 +1,64 @@
+{
+  "recorded_utc": "2026-10-30T23:53:55.759298+00:00",
+  "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "canonical_build": {
+    "utc": "2026-10-30T23:15:42.539697+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "image": "sha256:83996cd1336c1a718deb84c43a05d079ae53d974346cf0b91a4fbbbc11815713",
+    "tag": "swan-linux-owned:source94284db-canonical-20261031",
+    "canonical_recipe_unchanged": true,
+    "archive_checkout_crlf_only_verified": true,
+    "runtime_tests_pending": true,
+    "independent_canonical_reproduction_pending": true,
+    "company_configuration_unchanged": true,
+    "production_publication": false
+  },
+  "source_context": {
+    "utc": "2026-10-30T22:49:15.194684+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "tag": "swan-linux-owned:source94284db-canonical-20261031",
+    "context_sha256": "d70f6a2b43d9a9029e8195a7154e202664fdf2c2f895a11aa84b90a3640c8b28",
+    "canonical_dockerfile_sha256": "d68a85159e999ffbd45da40d3c0a03e522e74b989f783e53171ecd4727b08be5",
+    "canonical_recipe_unchanged": true,
+    "archive_checkout_crlf_only_verified": true,
+    "pinned_official_builder_id": "sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f",
+    "empty_tracked_target_and_no_cache": true,
+    "one_job_one_cpu_memory_mib": 1536,
+    "company_configuration_unchanged": true,
+    "production_publication": false
+  },
+  "measured_build_resources": {
+    "utc": "2026-10-30T22:54:23.773250+00:00",
+    "authoritative_process": "Existing cargo2615",
+    "cgroup": "/docker/buildkit/kgeq1vx2iyvaa5fmdyzjgefgo",
+    "memory_max_bytes": 1610612736,
+    "memory_current_bytes": 128319488,
+    "cpu_max": "100000 100000",
+    "enforced_one_cpu_and_1536mib_verified": true,
+    "cargo_index_files_observed": 26,
+    "existing_build_not_restarted": true
+  },
+  "fresh_company_runtime": {
+    "utc": "2026-10-30T23:19:44.630389+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "image": "sha256:83996cd1336c1a718deb84c43a05d079ae53d974346cf0b91a4fbbbc11815713",
+    "lab_cached_toolchain_variant": false,
+    "canonical_recipe_and_official_pinned_builder": true,
+    "fresh_source_and_target_compile": true,
+    "real_shipped_harness_passed": true,
+    "nonroot_readonly_and_private_storage": true,
+    "fresh_company_setup_mfa_replay_enrollment_policy_and_restart_persistence": true,
+    "real_management_backup_wrong_password_rejection_and_restore": true,
+    "original_company_image_unchanged": true,
+    "https_and_native_transport_to_new_image_qualified": false,
+    "existing_company_upgrade_performed": false,
+    "canonical_production_docker_reproduction": false,
+    "production_publication": false
+  },
+  "bounds": [
+    "Independent canonical build and binary comparison remain pending. First second-build preflight stopped before Docker build because host memory reserve was unavailable.",
+    "No live company upgrade or external NAT/relay qualification.",
+    "Canonical source export differed from Git blobs only by declared Windows text CRLF checkout conversion; no Dockerfile instructions changed."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json b/docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json
new file mode 100644
index 00000000000..5463a4a326c
--- /dev/null
+++ b/docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json
@@ -0,0 +1,142 @@
+{
+  "recorded_utc": "2026-10-31T00:27:06.189561+00:00",
+  "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "version": "1.5.12+80",
+  "independent_build_comparison": {
+    "utc": "2026-10-31T00:19:10.193240+00:00",
+    "builds": [
+      {
+        "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+        "image": "sha256:83996cd1336c1a718deb84c43a05d079ae53d974346cf0b91a4fbbbc11815713",
+        "tag": "swan-linux-owned:source94284db-canonical-20261031",
+        "management_sha256": "877f72e6cab9f2208fef3d127329a9b2284215b1690717f5b5858bba9f91d31a",
+        "context_sha256": "d70f6a2b43d9a9029e8195a7154e202664fdf2c2f895a11aa84b90a3640c8b28",
+        "canonical_recipe_sha256": "d68a85159e999ffbd45da40d3c0a03e522e74b989f783e53171ecd4727b08be5",
+        "builder": "sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f"
+      },
+      {
+        "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+        "image": "sha256:1f0966c8e341a71ad2a76a61047ba8c7f67b295b1e06fe37f102a09b9e7ccd70",
+        "tag": "swan-linux-owned:source94284db-canonical-independent-20261031",
+        "management_sha256": "877f72e6cab9f2208fef3d127329a9b2284215b1690717f5b5858bba9f91d31a",
+        "context_sha256": "d70f6a2b43d9a9029e8195a7154e202664fdf2c2f895a11aa84b90a3640c8b28",
+        "canonical_recipe_sha256": "d68a85159e999ffbd45da40d3c0a03e522e74b989f783e53171ecd4727b08be5",
+        "builder": "sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f"
+      }
+    ],
+    "management_original_binary_hashes_equal": true,
+    "image_ids_equal": false,
+    "oci_image_reproducibility_qualified": false,
+    "no_binary_normalization": true,
+    "fresh_runtime_pending": false,
+    "company_configuration_unchanged": true,
+    "production_publication": false,
+    "second_real_fresh_company_harness_passed": true
+  },
+  "live_company_upgrade": {
+    "utc": "2026-10-31T00:23:32.129850+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "image": "sha256:83996cd1336c1a718deb84c43a05d079ae53d974346cf0b91a4fbbbc11815713",
+    "fresh_encrypted_backup_verified": true,
+    "schema_source_unchanged": true,
+    "real_https_health_and_fresh_mfa": true,
+    "company_profile30_paused_updates_identity_consent_roles_workers_releases_jobs_sessions_preserved": true,
+    "transport_and_https_container_ids_preserved": true,
+    "lab_cached_toolchain_image_only": false,
+    "canonical_recipe_and_official_builder": true,
+    "management_binary_independently_reproduced": true,
+    "native_session_and_new_worker_recipe_still_pending": true,
+    "production_publication": false
+  },
+  "postupgrade_https_authorization_and_download_routes": {
+    "utc": "2026-10-31T00:25:02.093635+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "image": "sha256:83996cd1336c1a718deb84c43a05d079ae53d974346cf0b91a4fbbbc11815713",
+    "checks": [
+      {
+        "check": "anonymous inventory denied",
+        "status": 401
+      },
+      {
+        "check": "anonymous grant denied",
+        "status": 401
+      },
+      {
+        "check": "unassigned inventory empty",
+        "status": 200
+      },
+      {
+        "check": "unassigned grant denied",
+        "status": 403
+      },
+      {
+        "check": "unassigned administrative audit denied",
+        "status": 401
+      },
+      {
+        "check": "fresh MFA authorized inventory retained",
+        "status": 200
+      },
+      {
+        "check": "unattended grant without consent denied",
+        "status": 403
+      }
+    ],
+    "downloads": [
+      {
+        "edition": "customer",
+        "anonymous_status": 200,
+        "authorized_or_public_status": 200,
+        "expected_content_length": 32721210,
+        "zip_prefix_only_read": true,
+        "full_artifact_hash_rechecked": false
+      },
+      {
+        "edition": "technician",
+        "anonymous_status": 401,
+        "authorized_or_public_status": 200,
+        "expected_content_length": 30522021,
+        "zip_prefix_only_read": true,
+        "full_artifact_hash_rechecked": false
+      }
+    ],
+    "profile30_signature_and_paused_policy_valid": true,
+    "devices_consent_and_sessions_unchanged": true,
+    "fresh_admin_authorized_and_unassigned_technician_mfa": true,
+    "native_desktop_session_qualified": false,
+    "production_publication": false
+  },
+  "encrypted_preupgrade_backup": {
+    "utc": "2026-10-31T00:22:26.603696+00:00",
+    "bytes": 851028686,
+    "sha256": "48ccf04c61368a0b3b2263a330b77553cc076bafa3c0786a59f5fc347b4dc20c",
+    "encrypted_copy_hash_matched": true,
+    "separate_passphrase": true
+  },
+  "isolated_offline_restore": {
+    "utc": "2026-10-31T00:26:50.463966+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "image": "sha256:83996cd1336c1a718deb84c43a05d079ae53d974346cf0b91a4fbbbc11815713",
+    "archive_sha256": "48ccf04c61368a0b3b2263a330b77553cc076bafa3c0786a59f5fc347b4dc20c",
+    "wrong_password_rejected_before_destination": true,
+    "authenticated_stream_restore_succeeded": true,
+    "management_and_transport_sqlite_headers_valid": true,
+    "profile_key_setup_token_transport_keys_and_actual_proxy_configuration_match": true,
+    "all_original_generated_installer_files_match": true,
+    "all_original_tls_key_and_certificate_files_match": true,
+    "artifact_count": 27,
+    "tls_identity_count": 6,
+    "no_plaintext_keys_exported_to_host": true,
+    "no_network_or_restored_server_start": true,
+    "original_company_not_reconfigured": true,
+    "restored_live_new_signing_key_and_mfa_check_pending": true,
+    "profile_revision_in_archive": 30,
+    "new_archive_schema": 3
+  },
+  "limits": [
+    "Original management program bytes match; full OCI images have different identifiers and are not qualified byte-identical",
+    "The restore was offline: wrong-password rejection, authenticated stream and file equality; restored-company HTTPS/MFA and native-session tests are separate",
+    "This receipt contains no current Windows installer, native desktop, public Internet, or production signing qualification"
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json b/docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json
new file mode 100644
index 00000000000..dace900c016
--- /dev/null
+++ b/docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json
@@ -0,0 +1,68 @@
+{
+  "recorded_utc": "2026-10-30T23:53:55.759298+00:00",
+  "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "component_workflow": 41139900763,
+  "component_artifact": 13020050616,
+  "component_artifact_digest": "sha256:436add7111392f65a017990ab79bdf361eb1a6173af5d27c16835914b837fe3a",
+  "component_sources": {
+    "utc": "2026-10-30T23:21:41.397414+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "tracked_component_source_files_verified": 247,
+    "archive_bytes_and_manifests_verified": true,
+    "compiled_windows_agent_unsigned_sha256": "7bcd945aa4edc6dbd85ffb121bc52c9a928e9fcd2f9fc8849c8f686370d5d7a7",
+    "management_and_worker_bytes_unchanged_from7b": true,
+    "executed": false
+  },
+  "declared_text_crlf_checkout_files": 231,
+  "compiled_signed_agent_sha256": "b6a679a2129caf70dcd89958055985043a199f8a2960d7f3bb91754249fce349",
+  "fixed_embedded_script_sha256": "ffd5db22e7e25335b46b62b9a2ac8da529d6ea12b193449fecbbaecb7787d3e7",
+  "actual_standard_user_results": {
+    "fixture_state_and_installed_metadata_unchanged": true,
+    "principal_returned_as_short_name": true,
+    "actual_non_administrator_token": true,
+    "network_update_invoked": false,
+    "actual_installer_executed": false,
+    "legacy_account_string_match": false,
+    "utc": "2026-10-30T23:45:17.9769535Z",
+    "no_enrolled_credentials_in_fixture": true,
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "legacy_control": {
+      "removed": false,
+      "result": 1
+    },
+    "scope": "No-pending-update durable task cleanup only; interruption and installer recovery remain separate",
+    "own_standard_user_registered_task": true,
+    "fixed_embedded_script_hash_verified": true,
+    "real_customer_binary_unchanged": true,
+    "compiled_candidate_removed_exact_own_task": true,
+    "production_publication": false
+  },
+  "real_customer_after_test": {
+    "sequence": 14,
+    "profile_revision": 30,
+    "utc": "2026-10-30T23:52:15.0396030Z",
+    "actual_customer_identity_device_credential_bootstrap_consent_and_release_preserved": true,
+    "customer_service_running": true,
+    "actual_installed_agent_still_source7b": true,
+    "unattended_consent_disabled": true,
+    "source942_only_in_isolated_signed_fixture": true
+  },
+  "signing": {
+    "utc": "2026-10-30T23:30:17.562549+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+    "guest_authenticode_and_timestamps_verified": true,
+    "original_unsigned_inputs_preserved": true,
+    "existing_guest_identity_consent_bootstrap_and_service_preserved": true,
+    "private_key_exported": false,
+    "private_key_exportable": false,
+    "lab_only": true,
+    "production_publication": false
+  },
+  "bounds": [
+    "No-pending-update cleanup only; interrupted installation, retry, rollback and all OS/edition recovery paths remain open.",
+    "The candidate ran only in a separate standard-user fixture with no enrolled device credentials; the actual installed customer remains1.5.11.",
+    "Full1.5.12 native installer build, signing and deployment qualification remain pending."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-independent-native-original-output-reproduction-20261031.json b/docs/evidence/1512-independent-native-original-output-reproduction-20261031.json
new file mode 100644
index 00000000000..d33267d9eb5
--- /dev/null
+++ b/docs/evidence/1512-independent-native-original-output-reproduction-20261031.json
@@ -0,0 +1,102 @@
+{
+  "recorded_utc": "2026-10-31T01:21:30.231607+00:00",
+  "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "primary_run": 41139949964,
+  "independent_run": 41148252538,
+  "comparison": {
+    "utc": "2026-10-31T01:20:28.194434+00:00",
+    "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "comparison_run": 41154793523,
+    "comparison_artifact": 13024272255,
+    "comparison_artifact_digest": "sha256:261cbdb4cc2aca70e4c697166790b41142745c20a06dd549aa5b73b60b6107ed",
+    "report_sha256": "ce3d3bfb22110fba9ee2d6bb64737a66781b81a68662f5c66ab9ebda072a8570",
+    "shipping_outputs_identical": 8,
+    "source_files_per_build": 1325,
+    "bridge_files_per_build": 6,
+    "msvc_files_per_build": [
+      618,
+      618
+    ],
+    "first_archive_matches_github_pinned_metadata": true,
+    "first_archive_local_full_verification_pending": true,
+    "second_large_local_download_started": false,
+    "runtime_qualified": false,
+    "production_publication": false
+  },
+  "shipping_outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.12-customer-x64-unsigned.msi",
+      "first_sha256": "d4f359b6bfa966a6fa66ea81e38abf6649f3dfca03568af7f36b7323f006b19a",
+      "second_sha256": "d4f359b6bfa966a6fa66ea81e38abf6649f3dfca03568af7f36b7323f006b19a",
+      "first_bytes": 33902592,
+      "second_bytes": 33902592,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.12-technician-x64-unsigned.exe",
+      "first_sha256": "ca243a9f783448ef729b05ce64d4aa21eca61be6f16df4fd268be1b4b4b1e864",
+      "second_sha256": "ca243a9f783448ef729b05ce64d4aa21eca61be6f16df4fd268be1b4b4b1e864",
+      "first_bytes": 24274432,
+      "second_bytes": 24274432,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.12-technician-x64-unsigned.msi",
+      "first_sha256": "9cd0a32d899d6d7514f8a126ab157ef799db25ee8d33dbc3cabe6091514bffc9",
+      "second_sha256": "9cd0a32d899d6d7514f8a126ab157ef799db25ee8d33dbc3cabe6091514bffc9",
+      "first_bytes": 31637504,
+      "second_bytes": 31637504,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.12-x64-unsigned-install.exe",
+      "first_sha256": "ca243a9f783448ef729b05ce64d4aa21eca61be6f16df4fd268be1b4b4b1e864",
+      "second_sha256": "ca243a9f783448ef729b05ce64d4aa21eca61be6f16df4fd268be1b4b4b1e864",
+      "first_bytes": 24274432,
+      "second_bytes": 24274432,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "66a4252e15c168240836f20188bca4e0d53ac7d4f1ba25d9791475f7db2370f6",
+      "second_sha256": "66a4252e15c168240836f20188bca4e0d53ac7d4f1ba25d9791475f7db2370f6",
+      "first_bytes": 65881088,
+      "second_bytes": 65881088,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "7bcd945aa4edc6dbd85ffb121bc52c9a928e9fcd2f9fc8849c8f686370d5d7a7",
+      "second_sha256": "7bcd945aa4edc6dbd85ffb121bc52c9a928e9fcd2f9fc8849c8f686370d5d7a7",
+      "first_bytes": 5756416,
+      "second_bytes": 5756416,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "8249a0685e70326d3a4c5f666493e0e419a6ce04c21e4011478d459b5ed16d28",
+      "second_sha256": "8249a0685e70326d3a4c5f666493e0e419a6ce04c21e4011478d459b5ed16d28",
+      "first_bytes": 9130496,
+      "second_bytes": 9130496,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "79d16d6998285438f07b12b15740be5adc70d9a13d7b7726dfd9586c777aea50",
+      "second_sha256": "79d16d6998285438f07b12b15740be5adc70d9a13d7b7726dfd9586c777aea50",
+      "first_bytes": 4900352,
+      "second_bytes": 4900352,
+      "identical": true
+    }
+  ],
+  "compiled_standard_user_recovery_fixture_uses_same_original_agent_bytes": true,
+  "original_unsigned_agent_sha256": "7bcd945aa4edc6dbd85ffb121bc52c9a928e9fcd2f9fc8849c8f686370d5d7a7",
+  "lab_signed_agent_sha256": "b6a679a2129caf70dcd89958055985043a199f8a2960d7f3bb91754249fce349",
+  "local_full_primary_archive_verification_pending": true,
+  "limits": [
+    "The small comparison artifact is digest-verified; full original archives and corresponding source were checked by the pinned comparison workflow",
+    "The original primary archive is still downloading locally; this receipt does not claim local complete archive verification",
+    "Unsigned build reproduction does not qualify signed installers, enrolled upgrades, interrupted recovery or the Windows OS matrix"
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-native-and-component-build-success-20261031.json b/docs/evidence/1512-native-and-component-build-success-20261031.json
new file mode 100644
index 00000000000..fb865d3df7d
--- /dev/null
+++ b/docs/evidence/1512-native-and-component-build-success-20261031.json
@@ -0,0 +1,54 @@
+{
+  "observed_utc": "2026-10-31T00:04:28.362729+00:00",
+  "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "version": "1.5.12+80",
+  "native_run": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41139949964",
+  "component_run": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41139900763",
+  "native_conclusion": "success",
+  "component_conclusion": "success",
+  "native_jobs": [
+    {
+      "id": 124351524126,
+      "name": "generate-bridge / generate_bridge (x86_64-unknown-linux-gnu, ubuntu-22.04, 3.44.0, bridge-artifact-flutter-3.44)",
+      "status": "completed",
+      "conclusion": "success",
+      "active_or_failed_steps": []
+    },
+    {
+      "id": 124351524478,
+      "name": "maintained-transport / transport (windows-2022)",
+      "status": "completed",
+      "conclusion": "success",
+      "active_or_failed_steps": []
+    },
+    {
+      "id": 124351524479,
+      "name": "generate-bridge / generate_bridge (x86_64-unknown-linux-gnu, ubuntu-22.04, 3.22.3, bridge-artifact)",
+      "status": "completed",
+      "conclusion": "success",
+      "active_or_failed_steps": []
+    },
+    {
+      "id": 124351524627,
+      "name": "build-topmost-window / build-RustDeskTempTopMostWindow",
+      "status": "completed",
+      "conclusion": "success",
+      "active_or_failed_steps": []
+    },
+    {
+      "id": 124354872092,
+      "name": "Swan Remote Support x64",
+      "status": "completed",
+      "conclusion": "success",
+      "active_or_failed_steps": []
+    }
+  ],
+  "native_artifact": {
+    "id": 13020663666,
+    "name": "SwanRemoteSupport-1.5.12-x64-unsigned",
+    "bytes": 256231575,
+    "digest": "sha256:bace64f8b188b6ea7ae3e38b9c09b5d6e819d1658275ebf5476003d0381ace2d"
+  },
+  "scope": "CI build success only; local original archive and corresponding source verification pending. Independent Windows build submitted separately. No production publication or installed-endpoint upgrade qualification.",
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-recovery-principal-sid-regression-20261031.json b/docs/evidence/1512-recovery-principal-sid-regression-20261031.json
new file mode 100644
index 00000000000..8589c3f7483
--- /dev/null
+++ b/docs/evidence/1512-recovery-principal-sid-regression-20261031.json
@@ -0,0 +1,33 @@
+{
+  "recorded_utc": "2026-10-30T22:42:35.932976+00:00",
+  "candidate_version": "1.5.12+80",
+  "regression_scope": "Exact Windows recovery principal SID resolution and real task lifecycle; compiled shipping recovery still pending",
+  "source_file_sha256": {
+    "Update-RecoveryTask.ps1": "c3a4b364552d32017aa8d293a58b01a988f1cd9049f6cfac19f43a7773defe7a",
+    "test_update_recovery_task.ps1": "efa44d56856fe1ee99baee8ee1d5b2de4aa7db289dac564226221bbc75e6e20a"
+  },
+  "local_windows_powershell5_regression_passed": true,
+  "server2019_actual_regression": {
+    "limited_run_level_requested": true,
+    "standard_user_qualification": false,
+    "existing_shipping_task14_inspection_passed_without_mutation": true,
+    "shipping_recovery_task14_retained": true,
+    "real_isolated_registration_inspection_and_removal_passed": true,
+    "utc": "2026-10-30T22:40:45.5764041Z",
+    "shipping1_5_11_agent_replaced": false,
+    "embedded_fix_build_still_required": true,
+    "exact_sid_alias_and_foreign_identity_checks_passed": true,
+    "actual_token_is_administrator": true
+  },
+  "server2019_task_last_result": 0,
+  "real_existing_sequence14_task_inspection_readonly_passed": true,
+  "original_shipping_tasks_not_removed_by_regression": true,
+  "first_lab_fixture_assumption_corrected": "Requested Limited task run level does not filter the built-in Administrator token on this lab server. First fixture exited before testing; second records the actual administrator token and does not claim standard-user qualification.",
+  "collector_correction": "Converted diagnostic file content to plain text summary after an initial PowerShell extended-string serialization expanded object metadata. Only compact explicit result fields are used as acceptance evidence.",
+  "limits": [
+    "Candidate guard tested as source; new embedded signed agent and durable interrupted-update recovery remain pending.",
+    "Standard-user recovery qualification remains separate.",
+    "No production signing or publication."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json b/docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json
new file mode 100644
index 00000000000..eca7d15764d
--- /dev/null
+++ b/docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json
@@ -0,0 +1,85 @@
+{
+  "source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "version": "1.5.12+80",
+  "scope": "Owned Windows 10 x64 customer VM and independently hosted Linux company; disposable lab publisher only",
+  "primary_archive": {
+    "run": 41139949964,
+    "bytes": 256231575,
+    "sha256": "bace64f8b188b6ea7ae3e38b9c09b5d6e819d1658275ebf5476003d0381ace2d",
+    "full_local_hash_and_manifest_verified": true,
+    "tracked_sources_verified": 1325,
+    "generated_bridges_verified": 6,
+    "eight_original_shipping_outputs_match_independent_build": true
+  },
+  "distribution": {
+    "nonexportable_owned_lab_publisher": true,
+    "production_signing": false,
+    "both_msi_packages_and_five_signed_outputs_verified": true,
+    "release_sequence": 15,
+    "both_company_bundles_generated_by_real_windows_worker": true,
+    "public_bootstrap_only_and_seven_exact_source_texts_verified": true,
+    "profile_release_signatures_and_payload_hashes_verified": true,
+    "customer_anonymous_download_status": 200,
+    "technician_anonymous_download_status": 401,
+    "technician_authenticated_download_status": 200,
+    "signed_customer_msi_sha256": "d00f3ddd19aedc963678be71699867c43ec4af3e01cf632eb27d5a498d12bdc3",
+    "signed_technician_msi_sha256": "e78fd360fbcc7c93ffd731725f236a8c3ecdd5ed85f651fbfe00c25fcb8f6cf5"
+  },
+  "native_attended_session": {
+    "endpoint_version": "1.5.11+79",
+    "company_source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "receiving_customer_genuine_standard_user": true,
+    "technician_server2019_builtin_administrator_not_standard_user_qualification": true,
+    "fresh_native_technician_mfa_and_authorized_inventory": true,
+    "customer_native_accept_then_desktop_and_pointer_keyboard_control_observed": true,
+    "grant_attempts_from_one_request": 3,
+    "superseded_transport_attempts_closed": 2,
+    "final_active_session_continuously_renewed_lease": true,
+    "customer_native_stop_closed_session_and_technician_reported_revoked_authorization": true,
+    "unattended_disabled_consent_revision": 2
+  },
+  "active_session_update_gate": {
+    "installed_sequence": 14,
+    "approved_target_sequence": 15,
+    "new_signed_msi_and_helper_downloaded_while_actual_desktop_active": true,
+    "old_installed_bytes_and_sequence_unchanged": true,
+    "no_pending_installation_handoff": true,
+    "windows_exclusive_activity_lock_probe_failed_error": 33,
+    "probe_did_not_hold_or_modify_lock": true,
+    "legacy_report_phase": "Failed; contextual activity deferral, not a Deferred enum report"
+  },
+  "interruption": {
+    "isolated_overlay_original_backing_disk_preserved": true,
+    "real_target15_msiexec_and_signed_pending_installing_receipt_required": true,
+    "guest_observed_utc": "2026-10-31T02:57:26.1419082Z",
+    "hypervisor_powercut_utc": "2026-10-31T02:57:26.831271+00:00",
+    "unexpected_shutdown_events": [41, 6008],
+    "normal_boot_same_overlay_without_snapshot_restore": true,
+    "original_pre_powercut_msi_transaction_event_not_observed": true,
+    "boundary": "Power loss after real MSI client startup and durable installing receipt; interruption during a specific file copy is not claimed"
+  },
+  "autonomous_recovery": {
+    "verified_utc": "2026-10-31T03:13:25.3295152Z",
+    "installed_sequence": 15,
+    "actual_windows_installer_version": "1.5.12",
+    "actual_windows_installer_product_state": 5,
+    "shipping_all_installed_files_and_publisher_verifier_passed": true,
+    "identity_device_credential_bootstrap_branding_and_consent_preserved": true,
+    "unattended_disabled_consent_revision": 2,
+    "automatic_system_native_service_running": true,
+    "configuration_watcher_running_at_normal_priority": true,
+    "no_pending_failure_or_restart_markers": true,
+    "recovery_task_automatically_removed_observed_utc": "2026-10-31T03:19:40.5591085Z",
+    "manual_update_installer_recovery_or_service_start_invoked": false,
+    "original_paused_rollout_policy_restored_and_synced_profile": 32
+  },
+  "remaining": [
+    "Technician 1.5.12 upgrade and real interrupted recovery",
+    "Current candidate qualification on every advertised Windows edition",
+    "Remaining native desktop and security acceptance cases",
+    "External public NAT/direct/relay connectivity without Tailscale",
+    "Production signing approval and production release qualification"
+  ],
+  "product_complete": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1513-independent-native-reproduction-20261031.json b/docs/evidence/1513-independent-native-reproduction-20261031.json
new file mode 100644
index 00000000000..748ca8658ed
--- /dev/null
+++ b/docs/evidence/1513-independent-native-reproduction-20261031.json
@@ -0,0 +1,59 @@
+{
+  "utc": "2026-10-31T06:08:44.158999+00:00",
+  "source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+  "version": "1.5.13+81",
+  "first_run": 41165258500,
+  "independent_run": 41169951691,
+  "comparison_run": 41175183194,
+  "comparison_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41175183194",
+  "both_native_builds_and_all_packaging_checks_passed": true,
+  "all_eight_original_shipping_outputs_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "public_source_files_verified_per_build": 1334,
+  "generated_bridges_per_build": 6,
+  "matching_msvc_input_files_per_build": [
+    618,
+    618
+  ],
+  "first_archive_matches_original_locally_verified_download": true,
+  "second_large_host_download_started": false,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.13-customer-x64-unsigned.msi",
+      "sha256": "19f5da8132d35b5bcc2d34f7f3a6ce00f8957da9e242234672c6396a43f86e9c"
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.13-technician-x64-unsigned.exe",
+      "sha256": "733ee3e4b7bf607d50a07a4a6d8f94dc3a8d7ef8db74fe404b776ba4d281d950"
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.13-technician-x64-unsigned.msi",
+      "sha256": "74f8b0902994808b08dce85b61eb3d3389da3682045d8f8a1260f9e5aa69546a"
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.13-x64-unsigned-install.exe",
+      "sha256": "733ee3e4b7bf607d50a07a4a6d8f94dc3a8d7ef8db74fe404b776ba4d281d950"
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "sha256": "3f2521331d347c1a5923fb274708386e92f292c9739eceefdaa7cbc991daca35"
+    },
+    {
+      "path": "swan-agent.exe",
+      "sha256": "7bcd945aa4edc6dbd85ffb121bc52c9a928e9fcd2f9fc8849c8f686370d5d7a7"
+    },
+    {
+      "path": "swan-management.exe",
+      "sha256": "8249a0685e70326d3a4c5f666493e0e419a6ce04c21e4011478d459b5ed16d28"
+    },
+    {
+      "path": "swan-worker.exe",
+      "sha256": "79d16d6998285438f07b12b15740be5adc70d9a13d7b7726dfd9586c777aea50"
+    }
+  ],
+  "limits": [
+    "Unsigned original shipping artifacts; lab Authenticode signatures are separate and are not claimed byte-identical",
+    "Reproducibility is not runtime, Windows compatibility, external-connectivity or production-signing qualification"
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json b/docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json
new file mode 100644
index 00000000000..24a8d4b2a44
--- /dev/null
+++ b/docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json
@@ -0,0 +1,73 @@
+{
+  "utc": "2026-10-31T08:11:16.869578+00:00",
+  "application_source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+  "native_version": "1.5.13+81",
+  "scope": "Windows10 Pro19045 standard-user customer, Server2019 DesktopExperience17763 built-in Administrator technician, independent Linux company",
+  "large_roundtrip": {
+    "utc": "2026-10-31T07:53:22.703669+00:00",
+    "application_source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+    "native_version": "1.5.13+81",
+    "bytes_each_direction": 67108864,
+    "sha256": "1b160da7a30e2286ac3d41447b666392e06b6beaafc8b31df089215404e1a864",
+    "cryptographically_random_source": true,
+    "both_native_ui_transfers_finished": true,
+    "customer_and_returned_file_hashes_exact": true,
+    "separate_customer_approved_file_transfer_session": true,
+    "customer_standard_user": true,
+    "technician_builtin_administrator_not_standard_user_qualification": true,
+    "interrupted_transfer_qualified": false,
+    "production_publication": false
+  },
+  "interrupted_retry": {
+    "identity_credential_trust_and_consent_preserved": true,
+    "partial_sidecar_count": 0,
+    "final_sha256": "84e40ece77dbe5a34d482916ea7dd5c177c02d32fbb043b40f81885ec6cb1026",
+    "final_bytes": 268435456,
+    "release_sequence": 16,
+    "profile_revision": 38,
+    "utc": "2026-10-31T08:09:46.4478519Z",
+    "application_source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+    "native_version": "1.5.13+81",
+    "network_disconnection_seconds": 20,
+    "partial_bytes_observed_before_cut": 2490368,
+    "retained_partial_bytes_after_restore": 9568256,
+    "customer_virtual_cable_restored": true,
+    "fresh_customer_approval_required_for_reconnect": true,
+    "normal_ui_close_reopen_and_send_only": true,
+    "native_transfer_finished_after_retry": true,
+    "partial_sidecars_removed_after_success": true,
+    "manual_file_copy_edit_delete_or_rename": false,
+    "vm_app_service_or_company_restart": false,
+    "automatic_file_transfer_recovery_qualified": false,
+    "byte_offset_resume_not_independently_measured": true,
+    "remaining_finding": "Old transfer UI stayed at11% with no timeout/error after network restoration; normal fresh authorized retry recovered exact bytes.",
+    "production_publication": false
+  },
+  "network": {
+    "actual_partial_observed_utc": "2026-10-31T07:56:42.1326045Z",
+    "virtual_cable_disconnected_utc": "2026-10-31T07:56:42.473626+00:00",
+    "virtual_cable_restored_utc": "2026-10-31T07:57:02.574919+00:00",
+    "only_customer_vm_adapter": true,
+    "original_backing_untouched": true
+  },
+  "read_only_verification_harness": {
+    "first_90_second_observation_timed_out": true,
+    "original_verifier_authoritatively_confirmed_absent_before_new_read_only_verification": true,
+    "subsequent_result_durable_in_guest_and_hashes_verified": true,
+    "no_transfer_or_installer_repeated_by_the_verifier": true
+  },
+  "open_issue": {
+    "old_transfer_ui_remained_at_11_percent_for_over_5_minutes_after_network_restore": true,
+    "normal_fresh_approved_retry_recovered_correct_bytes": true,
+    "bounded_client_send_timeout_and_clear_retry_state_still_required": true
+  },
+  "limits": [
+    "Normal UI close/reopen and Send retry recovered after a real network interruption; automatic file-transfer recovery is not qualified.",
+    "The exact resumed byte offset was not independently measured.",
+    "Built-in Administrator technician does not qualify standard-user technician behavior.",
+    "Private lab connectivity does not qualify external public NAT/direct/relay.",
+    "This does not qualify native1.5.14 automatic update or the clean-OS lifecycle matrix."
+  ],
+  "production_publication": false,
+  "product_complete": false
+}
diff --git a/docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json b/docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json
new file mode 100644
index 00000000000..ef48fbd180c
--- /dev/null
+++ b/docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json
@@ -0,0 +1,49 @@
+{
+  "utc": "2026-10-31T07:52:27.947351+00:00",
+  "application_source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+  "native_version": "1.5.13+81",
+  "company_source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "scope": "Windows10 Pro19045 genuine standard-user customer, WindowsServer2019 DesktopExperience17763 built-in Administrator technician, independent Linux company",
+  "fresh_native_mfa_inventory_customer_approval_and_remote_desktop_observed": true,
+  "unattended_consent_disabled": true,
+  "live_desktop_and_separate_transfer_grants_claimed_and_leases_current": true,
+  "viewer_clipboard_receive_and_send_disabled": true,
+  "synthetic_test_data_only": true,
+  "unicode": {
+    "scripts": [
+      "Latin with accents and macron",
+      "Greek",
+      "Japanese",
+      "Arabic",
+      "emoji",
+      "currency and checkmark"
+    ],
+    "forward_utf8_bom_bytes": 113,
+    "forward_sha256": "674fc3aa97b89ca28248b3e4872462d1664177b065efddede030f6ac988c20f5",
+    "reverse_utf8_bom_bytes": 143,
+    "reverse_sha256": "256d7db6fe2eff9d26457a2d64b63111bf9c798fb937c2ab0aa32280e5d5ebdc",
+    "forward_exact": true,
+    "reverse_exact_with_unique_customer_marker": true,
+    "native_notepad_copy_paste_and_saved_file_hashes_checked": true
+  },
+  "rgb_image": {
+    "width": 128,
+    "height": 96,
+    "forward_rgb_sha256": "9cdcba8d15cbe070bf61b7ee9676d3fe8e63f64f61697044d8532970b3a76101",
+    "reverse_rgb_sha256": "db024d244ebbaef3ac2fec8bf5ea201e999b78339e45c6edf22cb0cae0232b95",
+    "forward_all_pixels_exact": true,
+    "reverse_all_pixels_exact": true,
+    "unique_customer_marker_changed_pixels": 1,
+    "stale_original_clipboard_cannot_satisfy_reverse_marker": true,
+    "native_paint_copy_paste_save_and_independent_pixel_hashes_checked": true
+  },
+  "limits": [
+    "This qualifies native1.5.13 clipboard/session behavior;1.5.14 automatic update remains pending.",
+    "Technician uses the lab built-in Administrator; genuine standard-user technician qualification is separate.",
+    "RGB bitmap clipboard only; alpha-channel images and other image formats are not qualified.",
+    "Private native transport against a company-hosted lab; external public NAT/direct/relay remains unqualified.",
+    "Large/interrupted file-transfer receipts and all advertised clean-OS lifecycle tests remain separate."
+  ],
+  "production_publication": false,
+  "product_complete": false
+}
diff --git a/docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json b/docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json
new file mode 100644
index 00000000000..7ce2dcebe20
--- /dev/null
+++ b/docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json
@@ -0,0 +1,101 @@
+{
+  "observed_installed_source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+  "lab": "Windows Server 2019 technician, owned built-in Administrator console",
+  "automatic_update": {
+    "from_sequence": 14,
+    "to_sequence": 15,
+    "installed_msi_and_shipping_files_verified": true,
+    "installed_version": "1.5.12",
+    "identity_consent_bootstrap_preserved": true,
+    "same_vm_customer_excluded_sequence": 13,
+    "original_paused_policy_restored_profile": 34,
+    "manual_update_or_installer_invoked": false
+  },
+  "failed_acceptance": {
+    "fresh_native_postupdate_login_not_qualified": true,
+    "running_shared_cache_executable_version": "1.5.11+79",
+    "old_cache_runtime_still_present_in_two_processes": true,
+    "backend_control_confirmed_credentials_mfa_and_inventory_valid": true,
+    "company_report_still_installing_old_sequence": true,
+    "restart_to_new_native_runtime_not_qualified": true,
+    "finding": "Portable extraction reuses one per-user runtime directory. A previous process can keep files locked; extraction ignores read/write errors and may launch stale executable bytes. The observed GUI login failure is not independently attributed to this cause."
+  },
+  "candidate": {
+    "version": "1.5.13+81",
+    "separate_cache_directory_per_embedded_payload_sha256": true,
+    "decompression_read_and_write_errors_propagate": true,
+    "failed_extraction_refuses_launch_and_exits_nonzero": true,
+    "new_dependencies": false,
+    "python_payload_metadata_tests_passed": 4,
+    "standalone_rust_linux_cache_tests_passed": 2,
+    "windows_exclusive_locked_file_and_extraction_regressions_added_to_native_ci": true,
+    "source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+    "native_build": {
+      "run": 41165258500,
+      "url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41165258500",
+      "conclusion": "success",
+      "downloaded_archive_sha256": "e053862d1f57fa21d6d75c5b2e533c487fb65325bd0d235292a992760066523d",
+      "public_source_files_verified": 1334,
+      "generated_bridge_files_verified": 6
+    },
+    "cache_regressions": {
+      "source": "8dd97bfe9e417311db55e4d3974d43553d16375f",
+      "runtime_code_identical_to_native_candidate": true,
+      "run": 41165618009,
+      "url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41165618009",
+      "windows_job": 124432423815,
+      "linux_job": 124432423707,
+      "both_passed": true,
+      "windows_exclusive_file_lock_branch_executed": true
+    },
+    "independent_build": {
+      "run": 41169951691,
+      "conclusion": "success",
+      "comparison_run": 41175183194,
+      "all_eight_original_shipping_outputs_identical": true,
+      "exact_source_inputs_verified": true
+    },
+    "lab_distribution": {
+      "all_five_signatures_and_original_receipts_verified": true,
+      "existing_key_nonexportable_verified": true,
+      "private_key_exported": false,
+      "project_or_production_signing": false,
+      "customer_msi_sha256": "e328a1ad36f1cd77bbefcc26da8e38b2d1448c5132937c6bb99336f86ae3e0b7",
+      "technician_msi_sha256": "18424b4672cff59a75195570b616bc626445d8e212bf251786469803985ec6a2",
+      "public_https_files_and_corresponding_source_hash_verified": true,
+      "test_release_sequence": 16,
+      "both_editions_approved": true,
+      "both_company_bundle_jobs_queued": true,
+      "company_bundle_download_verification_pending": false,
+      "automatic_updates_paused": true,
+      "profile_revision": 34,
+      "invalid_signatures_and_request_trust_override_rejected": true,
+      "unapproved_build_rejected_without_job_creation": true,
+      "actual_installation_and_native_runtime_qualification_pending": false
+    },
+    "qualified_scope": "See 1513-technician-automatic-update-runtime-mfa-and-report-20261031.json: one Server2019 owned Administrator technician automatic upgrade, exact runtime, MFA/inventory, report and paused-policy restoration",
+    "remaining_scope": [
+      "Current customer and standard-user technician",
+      "Remote desktop and remaining lifecycle/OS matrix",
+      "Current-candidate interrupted recovery"
+    ],
+    "technician_automatic_update_runtime_login_report_qualified": true,
+    "current_candidate_interrupted_recovery_pending": true
+  },
+  "limits": [
+    "Installed-file verification alone does not qualify the running native runtime",
+    "The built-in Administrator is not standard-user technician qualification",
+    "The actual Windows exclusive-file-lock regression passed; full installed application acceptance remains pending",
+    "The actual Server2019 Administrator technician update/runtime/login/report passed; current customer, standard-user, remote desktop and interrupted-recovery qualification remain separate"
+  ],
+  "product_complete": false,
+  "production_publication": false,
+  "broader_ci": {
+    "run": 41165618161,
+    "windows_x64": "success",
+    "overall": "failure",
+    "failed_job": "i686-pc-windows-msvc",
+    "reason": "Deferred 32-bit Windows toolchain cannot parse Cargo.lock version 4",
+    "windows_32bit_release_deferred": true
+  }
+}
diff --git a/docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json b/docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json
new file mode 100644
index 00000000000..c65bb28cc74
--- /dev/null
+++ b/docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json
@@ -0,0 +1,84 @@
+{
+  "utc": "2026-10-31T05:51:35.629430+00:00",
+  "source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+  "edition": "technician",
+  "os": "Windows Server 2019 Standard Evaluation Desktop Experience, build17763",
+  "account_scope": "Owned built-in Administrator console; not standard-user qualification",
+  "automatic_update": {
+    "from_sequence": 15,
+    "to_sequence": 16,
+    "from_version": "1.5.12",
+    "to_version": "1.5.13",
+    "manual_update_or_installer_invoked": false,
+    "exact_signed_installed_files_verified": true,
+    "identity_consent_and_bootstrap_preserved": true,
+    "same_vm_customer_excluded_and_unchanged_sequence": 13
+  },
+  "runtime": {
+    "version": "1.5.13+81",
+    "sha256": "0e2ef1ae0966e1e2bedeeb63741909decf3da1a2737d7fa893383006a7f44b70",
+    "payload_cache": "payload-35f10ad9aa487c1952c0d7d5d020aa3ea735536fdf6fd445d4ea340a45c2de2d",
+    "matches_verified_original_unsigned_native_payload": true,
+    "old_runtime_process_absent": true,
+    "fresh_mfa_login_and_authorized_inventory_observed": true
+  },
+  "reporting": {
+    "same_installation_identity_as_prior_1_5_11_report": true,
+    "installed_sequence": 16,
+    "installed_version": "1.5.13",
+    "phase_after_policy_pause": "deferred",
+    "target_sequence": null,
+    "report_revision_advanced": true
+  },
+  "policy": {
+    "enabled_revision": 35,
+    "restored_paused_revision": 36,
+    "original_rollout_percent": 20,
+    "limited_test_rollout_percent": 28,
+    "included_technician_cohort": 27,
+    "excluded_same_vm_customer_cohort": 78,
+    "restored_signature_and_installed_acceptance_verified": true
+  },
+  "distribution": [
+    {
+      "edition": "customer",
+      "job_id": "1ca9f174-289c-496a-8d27-dbfb7665ed8f",
+      "bundle_sha256": "e0eb653d371faa54667eb0b8b9128c2f7264b72103e59f8422cdbde027d292ce",
+      "bytes": 32729973,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "job_id": "939469a4-89d7-40bc-ae5f-00b2673925ef",
+      "bundle_sha256": "825b094e8b72bb6213c069adf06b82ad5de7968dfe0d8fe2528ef28b7fa6946d",
+      "bytes": 30521805,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "lab_fixture_maintenance": {
+    "obsolete_pre_1_5_12_recovery_tasks_13_and_14_removed_after_exact_ownership_checks": true,
+    "these_helpers_had_exited_with_result_1_and_reopened_console_windows": true,
+    "installed_payload_unchanged_by_maintenance": true,
+    "maintenance_not_counted_as_upgrade_cleanup_acceptance": true
+  },
+  "limits": [
+    "This qualifies this technician automatic update, exact running runtime, fresh MFA/inventory and company report; it does not qualify a new remote desktop session",
+    "Standard-user technician, current customer update, other clean OS/edition lifecycle tests and technician interruption remain separate",
+    "Independent native reproduction is still running",
+    "Lab signing only; public NAT/relay and production signing remain unqualified"
+  ],
+  "product_complete": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json b/docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json
new file mode 100644
index 00000000000..86888d753b8
--- /dev/null
+++ b/docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json
@@ -0,0 +1,65 @@
+{
+  "utc": "2026-10-31T06:28:32.813594+00:00",
+  "source": "58431d9b0d5d3f2b9f0c92f72367bf276c9841da",
+  "os": "Windows10 Pro x64, build19045",
+  "account_scope": "Genuine standard-user customer desktop; 2GiB disposable VM",
+  "automatic_installation": {
+    "from_sequence": 15,
+    "to_sequence": 16,
+    "from_version": "1.5.12+80",
+    "to_version": "1.5.13+81",
+    "original_idle_customer_gui_open": true,
+    "exact_signed_installed_files_and_publisher_verified": true,
+    "shipping_verifier_passed": true,
+    "msi_registration_state": 5,
+    "msi_registered_version": "1.5.13",
+    "automatic_system_service_restarted_and_running": true,
+    "configuration_watcher_running_at_normal_priority": true,
+    "identity_credential_consent_and_bootstrap_preserved": true,
+    "unattended_consent": false,
+    "consent_revision": 2,
+    "no_pending_or_failed_recovery": true,
+    "original_paused_policy_restored_and_accepted_revision": 38,
+    "manual_update_or_installer_invoked": false
+  },
+  "failed_idle_gui_acceptance": {
+    "old_standard_user_frontend_processes_persisted_after_msi": [
+      5480,
+      5312
+    ],
+    "both_created_before_update": "2026-10-31T06:01Z",
+    "company_branding_lost_in_those_old_processes": true,
+    "observed_status": "Swan Remote Support / Company setup is not complete / Support paused",
+    "automatic_customer_gui_restart_not_qualified": true,
+    "persistent_company_enrollment_loss_not_observed": true
+  },
+  "diagnostic_only": {
+    "exact_old_pid_creation_executable_path_session_and_account_sid_checked": true,
+    "only_old_idle_gui_processes_stopped": [
+      5480,
+      5312
+    ],
+    "normal_updated_executable_reopened_in_same_standard_user_explorer": true,
+    "fresh_customer_frontend_pids": [
+      4824,
+      3552
+    ],
+    "company_branding_and_customer_approval_controls_restored": true,
+    "support_still_paused_and_unattended_still_disabled": true,
+    "service_not_manually_stopped": true,
+    "reenrollment_reinstall_or_manual_update_not_invoked": true,
+    "manual_reopen_not_counted_as_automatic_update_acceptance": true
+  },
+  "harness_limits": {
+    "read_only_observer_timed_out_during_update": true,
+    "original_update_not_restarted_or_repaired": true,
+    "separate_policy_controller_completed_restoration": true,
+    "vnc_black_frame_resolved_by_viewer_refresh_not_windows_repair": true,
+    "first_diagnostic_stop_guard_rejected_CIM_microsecond_vs_process_submicrosecond_precision": true,
+    "both_original_processes_verified_still_live_before_exact_full_precision_diagnostic": true
+  },
+  "required_next_work": "Implement managed customer GUI quiescence/restart during update and retest a genuine standard-user idle GUI; preserve session coordination and interruption recovery",
+  "current_candidate_remote_session_after_update_qualified": false,
+  "product_complete": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json b/docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json
new file mode 100644
index 00000000000..525dc5c4549
--- /dev/null
+++ b/docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json
@@ -0,0 +1,60 @@
+{
+  "date": "2026-11-02",
+  "source": "dde38c9ae213969041fe1cd4f5c4565d910de087",
+  "candidate": "1.5.14+82",
+  "clean_os": "Windows Server2022 Standard Evaluation, Desktop Experience, x64, build20348",
+  "original_clean_os_preserved_with_separate_copy_on_write_disk": true,
+  "installation": {
+    "version": "1.5.14",
+    "watch_state": "Running",
+    "profile_revision": 40,
+    "sequence": 17,
+    "shipping_verifier_passed": true,
+    "utc": "2026-11-02T15:46:54.1287387Z",
+    "all_signed_files": 96,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "enrollment_and_authorization": {
+    "utc": "2026-11-02T15:54:31.540189+00:00",
+    "version": "1.5.14",
+    "sequence": 17,
+    "actual_enrolled_customer": "Server2022",
+    "pending_inventory_hidden": true,
+    "pending_grant_status": 403,
+    "explicit_company_approval_verified": true,
+    "authorized_inventory_visible": true,
+    "unassigned_inventory_hidden": true,
+    "unassigned_grant_status": 403,
+    "unattended_without_consent_status": 403,
+    "other_device_records_unchanged": true,
+    "no_successful_grant_or_native_session_created": true,
+    "production_qualified": false
+  },
+  "connectivity_scope": "Private isolated company lab with its explicit public-certificate/DNS fixtures; installer automatically consumed company bootstrap. External public NAT traversal is not qualified.",
+  "limits": [
+    "Real native sessions and customer consent UI were not exercised on this fresh installation.",
+    "A genuine standard technician OS account is prepared; technician installation/login are still pending.",
+    "Does not qualify native1.5.16 or every Windows release."
+  ],
+  "production_publication": false,
+  "controlled_repair": {
+    "version": "1.5.14",
+    "identity_token_bootstrap_consent_and_revision_preserved": true,
+    "customer_service_and_watcher_running": true,
+    "controlled_missing_signed_license_rejected": true,
+    "sequence": 17,
+    "shipping_verifier_passed": true,
+    "utc": "2026-11-02T16:12:14.9460821Z",
+    "production_publication": false,
+    "no_pending_recovery": true,
+    "unmodified_company_repair_restored_exact_file": true,
+    "interactive_gui_recovery_not_tested": true,
+    "os_build": 20348,
+    "no_manual_msi_or_service_repair": true
+  }
+}
diff --git a/docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json b/docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json
new file mode 100644
index 00000000000..c3dd4fd1e4f
--- /dev/null
+++ b/docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json
@@ -0,0 +1,53 @@
+{
+  "utc": "2026-10-31T07:57:46.603468+00:00",
+  "component_source": "0aac973c028c0be0e20cf38c78cdcbd40b4fe2b6",
+  "native_build_source": "dde38c9ae213969041fe1cd4f5c4565d910de087",
+  "only_source_difference": [
+    ".dockerignore",
+    "deployment/linux/Dockerfile.dockerignore"
+  ],
+  "component_agent_rust_and_embedded_helper_identical_between_sources": true,
+  "workflow_run": 41180429246,
+  "jobs": [
+    {
+      "id": 124476571092,
+      "name": "linux-deployment",
+      "conclusion": "success"
+    },
+    {
+      "id": 124476571217,
+      "name": "maintained-windows-transport/windows-2022",
+      "conclusion": "success"
+    },
+    {
+      "id": 124477814749,
+      "name": "verify/ubuntu-24.04",
+      "conclusion": "success"
+    },
+    {
+      "id": 124477814809,
+      "name": "verify/windows-2022",
+      "conclusion": "success"
+    }
+  ],
+  "checks": {
+    "windows_and_linux_workspace_tests_passed": true,
+    "real_child_ui_helper_timeout_preserves_recovery_diagnostic_and_reaps_child_on_windows": true,
+    "windows_compiled_components_passed": true,
+    "windows_incompressible_backup_above_former_512MiB_limit_passed": true,
+    "linux_deny_by_default_context_contains_new_embedded_helper_and_excludes_private_canaries": true,
+    "linux_management_image_build_fresh_company_persistence_https_transport_and_complete_recovery_passed": true
+  },
+  "earlier_failure": {
+    "source": "dde38c9ae213969041fe1cd4f5c4565d910de087",
+    "job": 124476335870,
+    "missing_public_embedded_source": "deployment/windows/Restart-CustomerUi.ps1",
+    "fixed_by_adding_exact_public_helper_to_both_allowlists": true
+  },
+  "limits": [
+    "Component CI does not qualify the complete native Windows1.5.14 shipping packages.",
+    "The real13-to14 standard-user customer automatic MSI upgrade is still pending.",
+    "Disposable workflow MSI fixtures are separate from every advertised clean-OS qualification."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json b/docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json
new file mode 100644
index 00000000000..17f4f52e6e4
--- /dev/null
+++ b/docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json
@@ -0,0 +1,63 @@
+{
+  "utc": "2026-10-31T09:09:37.979327+02:00",
+  "candidate": "1.5.14+82",
+  "trigger": "1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+  "helper_sha256": "a463848dd1237588f5f964de2ea2ff185074df6ca966fdff1f2841b10343b50a",
+  "test_sha256": "862a92d7757206069a4a835a3a8983246b63249cf678c468f4d1e11763f1a96f",
+  "application_in_functional_lab": "1.5.13+81; original signed installed customer payload unchanged",
+  "os": "Windows10 Pro x64 build19045",
+  "account_scope": "Genuine logged-in standard-user desktop; helper runs as SYSTEM and launches only a limited interactive task for that existing account",
+  "actual_task_result": 0,
+  "checks": {
+    "restart_intent_survives_stop_before_launch": true,
+    "foreign_task_unchanged": true,
+    "real_standard_user_gui_relaunched": true,
+    "fresh_gui_preserved_on_retry": true,
+    "passwords_or_privileged_user_tokens_used": false,
+    "native_wrong_creation_path_and_sid_rejected": true,
+    "unrelated_task_preserved": true,
+    "restart_intent_durable_before_stop": true,
+    "temporary_task_self_deleted": true,
+    "automatic_update_qualified": false,
+    "owned_task_removed_on_uninstall": true,
+    "service_and_payload_unchanged": true
+  },
+  "fresh_native_gui_pids": [
+    4288,
+    4828
+  ],
+  "company_branding_approval_controls_and_paused_support_visually_observed_after_helper": true,
+  "fault_injection": "Interruptions before process stop and after stop/before task launch; real Windows processes and Task Scheduler are used",
+  "actual_hypervisor_power_cut_performed": false,
+  "first_harness_result": {
+    "reserved_namespace_foreign_sentinel_correctly_rejected": true,
+    "fixture_corrected_without_changing_product_helper": true,
+    "only_exact_failed_fixture_tasks_cleaned": true
+  },
+  "implementation_contract": {
+    "signed_installed_release_and_msi_registration_verified_before_ui_recovery": true,
+    "existing_activity_exclusion_and_restart_marker_retained": true,
+    "old_process_path_creation_time_and_user_sid_rechecked_using_held_native_handle": true,
+    "restart_intent_durable_before_process_stop": true,
+    "no_saved_password_or_elevated_customer_ui": true,
+    "fresh_postcommit_gui_not_restarted_on_retry": true,
+    "owned_pending_ui_tasks_removed_on_explicit_uninstall": true,
+    "helper_process_bounded_seconds": 300
+  },
+  "limits": [
+    "This is a functional helper regression, not an automatic MSI update",
+    "Fault injection does not substitute for the required real interruption/recovery test",
+    "Rust integration, native1.5.14 build, real13-to14 customer automatic update and the remaining OS/edition matrix are pending"
+  ],
+  "production_publication": false,
+  "private_stdin_transport": {
+    "utc": "2026-10-31T09:18:06.39588+02:00",
+    "helper_sha256": "a463848dd1237588f5f964de2ea2ff185074df6ca966fdff1f2841b10343b50a",
+    "helper_bytes_streamed": 13446,
+    "bootstrap_encoded_characters": 1340,
+    "full_source_avoids_windows_command_line_limit": true,
+    "actual_windows_powershell_5_1_private_stdin_transport": true,
+    "non_system_rejected_before_task_or_process_mutation": true,
+    "automatic_update_qualified": false
+  }
+}
diff --git a/docs/evidence/1514-native-build-and-company-bundles-20261102.json b/docs/evidence/1514-native-build-and-company-bundles-20261102.json
new file mode 100644
index 00000000000..88b8e0bb27f
--- /dev/null
+++ b/docs/evidence/1514-native-build-and-company-bundles-20261102.json
@@ -0,0 +1,56 @@
+{
+  "utc": "2026-11-02T14:37:44.765655+00:00",
+  "source": "dde38c9ae213969041fe1cd4f5c4565d910de087",
+  "version": "1.5.14+82",
+  "workflow_run": 41180376583,
+  "native_job": 124477714041,
+  "conclusion": "success",
+  "github_artifact": 13036196608,
+  "artifact_digest": "sha256:81b20f24c5e877f7026e44418a4dccaefddecb0349c23794de75fe0fccbcacec",
+  "offline_verification": {
+    "archive_checksums": true,
+    "public_tracked_source_files": 1340,
+    "generated_bridge_files": 6,
+    "pinned_engine_and_sdk": true,
+    "required_build_steps": {
+      "Reject paused support and authorization reuse after resume": "success",
+      "Reject authorization retries and inherited audit destinations": "success",
+      "Reject cross-target and stale-login file-transfer handles": "success",
+      "Verify hardened DLL search supports delayed application libraries": "success",
+      "Build branded client": "success",
+      "Build self-extracting installer": "success",
+      "Reject incoming capture helpers in the technician edition": "success",
+      "Verify service launcher defers desktop DLL loading": "success",
+      "Verify customer MSI starts a headless native service": "success",
+      "Reject unsigned legacy management policy in managed editions": "success",
+      "Reject upstream updater entry points in managed editions": "success",
+      "Reject system-control packets from view-only managed sessions": "success",
+      "Build unsigned customer and technician MSIs with pinned WiX": "success",
+      "Verify unsigned technician MSI installation repair and uninstall": "success",
+      "Build unsigned company server setup with pinned components": "success"
+    }
+  },
+  "lab_signing": {
+    "existing_nonexportable_key_reused": true,
+    "all_five_signatures_valid": true,
+    "private_key_exported": false,
+    "customer_msi_sha256": "c0ae038efbd9edb383c7b386b414c4d3daa0f0df320234ed791d6c62c4f54d24",
+    "technician_msi_sha256": "d542555ab950381f8579839973929f529891692beb483c49055398f9afedebcc"
+  },
+  "company_bundles": {
+    "sequence": 17,
+    "generated_by_existing_windows_worker": true,
+    "public_customer_download_http_status": 200,
+    "anonymous_technician_download_http_status": 401,
+    "authenticated_technician_download_http_status": 200,
+    "signed_profiles_releases_payload_hashes_and_exact_bundle_sources_verified": true,
+    "full_corresponding_source_served_over_https": true,
+    "updates_remain_paused": true
+  },
+  "limits": [
+    "Lab certificates do not qualify production signing.",
+    "Actual customer13-to14 automatic update and limited-user frontend relaunch are still pending.",
+    "Independent native14 reproduction and every advertised clean-OS lifecycle remain unqualified."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json b/docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json
new file mode 100644
index 00000000000..ec66e0dc44c
--- /dev/null
+++ b/docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json
@@ -0,0 +1,54 @@
+{
+  "utc": "2026-11-02T15:17:43.184119+00:00",
+  "source": "dde38c9ae213969041fe1cd4f5c4565d910de087",
+  "os": "Windows10 Pro x64 build19045",
+  "from": "1.5.13+81",
+  "to": "1.5.14+82",
+  "from_sequence": 16,
+  "to_sequence": 17,
+  "automatic_signed_msi_installation": {
+    "os": "Windows10 Pro x64",
+    "branding_and_paused_policy_preserved": true,
+    "configuration_task_running_normal_priority": true,
+    "msi_product_version": "1.5.14",
+    "customer_automatic_system_service_running": true,
+    "to_version": "1.5.14+82",
+    "to_sequence": 17,
+    "os_build": 19045,
+    "exact_signed_installed_bytes": true,
+    "no_pending_or_failed_recovery": true,
+    "production_publication": false,
+    "from_version": "1.5.13+81",
+    "manual_update_or_installer_command_invoked": false,
+    "msi_product_state": 5,
+    "utc": "2026-11-02T15:08:18.6308416Z",
+    "consent_revision": 2,
+    "expected_lab_publisher_valid": true,
+    "profile_revision": 40,
+    "from_sequence": 16,
+    "native_approval_after_upgrade_qualified": false,
+    "lab_watcher_priority_repair_and_controlled_restart_required": false,
+    "identity_credential_consent_and_bootstrap_preserved": true,
+    "shipping_verifier_passed": true,
+    "unattended_consent_disabled": true
+  },
+  "customer_ui_relaunch_acceptance": "FAILED",
+  "finding": {
+    "old_standard_user_ui_processes_still_running": 2,
+    "held_kernel_image_path_differs_from_installed_path": true,
+    "cim_still_reports_original_installed_path": true,
+    "old_mapped_image_renamed_into_msi_rollback_rbf": true,
+    "process_guard_rejected_changed_kernel_path": true,
+    "advanced_powershell_script_emitted_error_but_outer_child_returned_success": true,
+    "configuration_restart_marker_removed_despite_ui_error": true,
+    "owned_ui_recovery_task_left": 1
+  },
+  "policy_restored": {
+    "revision": 40,
+    "updates_paused": true,
+    "rollout_percent": 20
+  },
+  "subsequent_lab_reboot": "Normal reboot requested after preserving failure; it does not qualify automatic UI recovery.",
+  "fix_status": "Working-tree draft closes signed-identity old UI before MSI, retains disabled durable tasks until verified commit, and explicitly returns failure from the source-pipe loader. Not yet compiled or automatically upgraded.",
+  "production_publication": false
+}
diff --git a/docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json b/docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json
new file mode 100644
index 00000000000..cf37247805f
--- /dev/null
+++ b/docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json
@@ -0,0 +1,39 @@
+{
+  "utc": "2026-11-02T17:17:34.067783+00:00",
+  "source": "dde38c9ae213969041fe1cd4f5c4565d910de087",
+  "version": "1.5.14",
+  "sequence": 17,
+  "os": "Clean Windows Server2022 Standard Evaluation Desktop Experience x64 build20348",
+  "execution": "Actual initialized standard-user desktop; installer ran through Limited/Interactive task under the verified non-administrator SID.",
+  "result": "FAILED: Windows Installer policy error1625",
+  "failure": {
+    "error": "Windows Installer policy prevents this per-user technician installation (1625). Contact your company administrator for an approved deployment.",
+    "utc": "2026-11-02T17:02:01.1735778Z",
+    "passed": false
+  },
+  "machine_policy": {
+    "AlwaysInstallElevated": null,
+    "DisableUserInstalls": null,
+    "EnableUserControl": null,
+    "DisableMSI": null
+  },
+  "standard_user_policy": {
+    "AlwaysInstallElevated": null,
+    "DisableUserInstalls": null,
+    "EnableUserControl": null,
+    "DisableMSI": null
+  },
+  "policy_changed": false,
+  "always_install_elevated_enabled": false,
+  "no_technician_executable_installed": true,
+  "original_pending_msi_setup_preserved": {
+    "format": "msi",
+    "sequence": 17,
+    "version": "1.5.14"
+  },
+  "customer_service_unchanged_running": true,
+  "next_test": "Explicitly company-approved EXE distribution; not a silent fallback or MSI policy modification.",
+  "msi_deployment_limit": "Standard-user unmanaged MSI installation is not qualified on this Server2022 baseline; company-managed deployment or another approved format is required.",
+  "policy_reference": "https://learn.microsoft.com/en-us/windows/win32/msi/disablemsi",
+  "production_publication": false
+}
diff --git a/docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json b/docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json
new file mode 100644
index 00000000000..4f9a0679312
--- /dev/null
+++ b/docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json
@@ -0,0 +1,77 @@
+{
+  "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+  "os": "Windows11 Enterprise Evaluation Desktop Experience x64 build26300",
+  "fresh_product_baseline_verified": true,
+  "test_harness_bundle_filename_corrected_before_product_installer_execution": true,
+  "unchanged_company_customer_msi_bundle_sha256": "408a53d329cb4a67546fb07bad20dbd4721bfce0bae2917deebf2582afa6eb19",
+  "installation": {
+    "version": "1.5.16",
+    "watch_state": "Running",
+    "profile_revision": 42,
+    "sequence": 19,
+    "shipping_verifier_passed": true,
+    "utc": "2026-11-02T23:49:13.8421441Z",
+    "all_signed_files": 96,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "approval_and_permissions": {
+    "utc": "2026-11-02T23:56:34.012075+00:00",
+    "version": "1.5.16",
+    "sequence": 19,
+    "actual_enrolled_customer": "Windows11 build26300",
+    "pending_inventory_hidden": true,
+    "pending_grant_status": 403,
+    "explicit_company_approval_verified": true,
+    "authorized_inventory_visible": true,
+    "unassigned_inventory_hidden": true,
+    "unassigned_grant_status": 403,
+    "unattended_without_consent_status": 403,
+    "other_device_records_unchanged": true,
+    "no_successful_grant_or_native_session_created": true,
+    "production_qualified": false
+  },
+  "native_windows11_session_qualified": false,
+  "repair_reboot_upgrade_uninstall_pending": false,
+  "production_publication": false,
+  "standard_user_technician": {
+    "format": "msi",
+    "version": "1.5.16",
+    "release_sequence": 19,
+    "original_company_bundle_sha256": "3a2b12dacf3059e3d0707e1e8a8b505e318af409f47cfe6f7a79f22ee00ffeae",
+    "fresh_install_exit": 0,
+    "genuine_unelevated_desktop_owner": true,
+    "shipping_verifier_passed": true,
+    "company_branding_and_https_domain_displayed": true,
+    "native_mfa_login_passed": true,
+    "authorized_device_inventory_displayed": true,
+    "observed_utc": "2026-11-03T00:34:26.532718+00:00"
+  },
+  "normal_reboot": {
+    "sequence": 19,
+    "version": "1.5.16",
+    "consent_revision": 0,
+    "unattended_consent_off": true,
+    "native_configuration_preserved_through_normal_reboot": true,
+    "service_pid": 3140,
+    "configuration_watch_started_automatically": true,
+    "shipping_verifier_passed": true,
+    "headless_service_has_no_flutter_or_desktop_plugin_module": true,
+    "production_qualified": false,
+    "unexpected_power_loss_event_count": 0,
+    "utc": "2026-11-03T00:55:14.7804998Z",
+    "new_boot_utc": "2026-11-03T00:47:20.5000000Z",
+    "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+    "manual_service_or_watcher_restart": false,
+    "normal_restart_event_and_clean_event_log_shutdown_verified": true,
+    "identity_credential_trust_and_consent_preserved": true,
+    "service_started_automatically": true,
+    "kernel_boot_changed": true,
+    "prior_boot_utc": "2026-11-02T22:42:30.5000000Z"
+  },
+  "repair_upgrade_uninstall_pending": true
+}
diff --git a/docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json b/docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json
new file mode 100644
index 00000000000..c0973a97956
--- /dev/null
+++ b/docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json
@@ -0,0 +1,45 @@
+{
+  "date": "2026-11-02",
+  "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+  "candidate": "1.5.16+84",
+  "workflow_run": 41471883938,
+  "event": "push",
+  "jobs": [
+    {
+      "id": 125367297533,
+      "name": "linux-deployment",
+      "conclusion": "success"
+    },
+    {
+      "id": 125367298067,
+      "name": "maintained-windows-transport / transport (windows-2022)",
+      "conclusion": "success"
+    },
+    {
+      "id": 125367299775,
+      "name": "technician-msi-lifecycle",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 125372328011,
+      "name": "verify (ubuntu-24.04)",
+      "conclusion": "success"
+    },
+    {
+      "id": 125372328116,
+      "name": "verify (windows-2022)",
+      "conclusion": "success"
+    }
+  ],
+  "windows_regression_log_lines": [
+    "2026-11-02T15:39:17.5347515Z test update::tests::advanced_customer_ui_script_failure_returns_a_failed_child_status ... ok",
+    "2026-11-02T15:39:17.7893818Z test verifier_process::tests::interrupted_ui_helper_preserves_its_recovery_diagnostic_and_is_reaped ... ok"
+  ],
+  "scope": "Windows/Linux company components, deployment image and workspace checks; the separate full native Windows build is still pending.",
+  "limits": [
+    "Skipped technician MSI lifecycle job is not qualification.",
+    "Real14-to16 automatic MSI update and latest clean-OS lifecycle matrix remain unqualified.",
+    "No production signing or publication approval."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json b/docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json
new file mode 100644
index 00000000000..552df1f586c
--- /dev/null
+++ b/docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json
@@ -0,0 +1,55 @@
+{
+  "utc": "2026-11-02T17:52:07.423679+00:00",
+  "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+  "version": "1.5.16",
+  "native_workflow_run": 41471963822,
+  "artifact": 13160353060,
+  "artifact_digest": "sha256:c2d26cec0dc88e5bfe53c029f421826b2df0c63b478f8b981fee19fea3526ecf",
+  "all_manifest_hashes_match": true,
+  "transfer_write_regression_log_verified": true,
+  "corresponding_source_archive_verified": true,
+  "lab_signing": {
+    "retained_machine_local_nonexportable_key": true,
+    "private_key_exported": false,
+    "five_outputs_verified": true,
+    "production_signing": false
+  },
+  "prepared_formats": [
+    {
+      "edition": "technician",
+      "format": "exe",
+      "sequence": 18,
+      "sha256": "ff85dc69ebc8580cf0cf6ad7f8c75b5ae8be3e6b33ea4e2fd58362a7b7ff1759"
+    },
+    {
+      "edition": "customer",
+      "format": "msi",
+      "sequence": 19,
+      "sha256": "860ac01b2600e9db6c96397b98fde57a484566cf4260b35da0a7fdd15b1c823b"
+    },
+    {
+      "edition": "technician",
+      "format": "msi",
+      "sequence": 19,
+      "sha256": "85746d1c020eed59da50ff3545f1d043778c9c1dde5769c16b67a3aa04eb9a1f"
+    }
+  ],
+  "public_https_asset_hashes_verified": true,
+  "release_negative_tests": {
+    "invalid_signature_rejected": true,
+    "request_key_override_rejected": true,
+    "unapproved_build_rejected_without_job": true
+  },
+  "three_approved_test_bundle_jobs_queued": true,
+  "company_profile_revision": 40,
+  "automatic_updates_paused": true,
+  "bundle_generation_complete": true,
+  "installer16_executed": true,
+  "native16_live_session_qualified": false,
+  "independent_native16_reproduction_pending": true,
+  "customer_exe_pending": "Signing the outer archive does not sign its embedded installed executable; a trusted producer pipeline must sign the payload before building and signing the outer installer.",
+  "production_publication": false,
+  "bundle_generation_verified_utc": "2026-11-02T17:53:18.343161+00:00",
+  "bundle_download_access_checks_passed": true,
+  "installer_execution_scope": "Technician EXE on genuine standard Server2022 desktop; customer MSI16 execution pending"
+}
diff --git a/docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json b/docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json
new file mode 100644
index 00000000000..6ebcf8c1094
--- /dev/null
+++ b/docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json
@@ -0,0 +1,57 @@
+{
+  "utc": "2026-11-02T15:27:22.009733+00:00",
+  "candidate": "1.5.16+84",
+  "helper_files_sha256": {
+    "Restart-CustomerUi.ps1": "1d2aed24fbef06991381062cdddfbf7b73109f0c05e00f6b762cce56cda4a3aa",
+    "test_customer_ui_restart.ps1": "9cd9be3ae0d3dae45302bc689a2e624262463c8042052b81db6ffa381f7283de"
+  },
+  "execution": "Actual SYSTEM task, genuine standard-user customer desktop, Windows10 Pro build19045, existing native1.5.14+82 signed payload",
+  "task_result": 0,
+  "checks": {
+    "foreign_task_unchanged": true,
+    "real_pre_msi_stop_keeps_disabled_durable_recovery_task": true,
+    "fresh_gui_preserved_on_retry": true,
+    "passwords_or_privileged_user_tokens_used": false,
+    "service_and_payload_unchanged": true,
+    "temporary_task_self_deleted": true,
+    "automatic_update_qualified": false,
+    "unrelated_task_preserved": true,
+    "restart_intent_survives_stop_before_launch": true,
+    "owned_task_removed_on_uninstall": true,
+    "real_standard_user_gui_relaunched": true,
+    "native_wrong_creation_path_and_sid_rejected": true,
+    "preparation_requires_pending_update_and_signed_executable_identity": true,
+    "restart_intent_durable_before_stop": true
+  },
+  "loader_regression": {
+    "utc": "2026-11-02T15:15:06.462558+00:00",
+    "cases": [
+      {
+        "case": "accept",
+        "exit": 0,
+        "passed": true
+      },
+      {
+        "case": "throw",
+        "exit": 1,
+        "passed": true
+      },
+      {
+        "case": "parse",
+        "exit": 1,
+        "passed": true
+      }
+    ],
+    "exact_private_stdin_and_embedded_outer_wrapper": true,
+    "product_state_changed": false,
+    "rust_test_compilation_pending": true,
+    "prepare_helpers_powershell_syntax_passed": true
+  },
+  "changes": "Close guarded old UI before MSI can rename mapped images; disable durable restart tasks until verified commit; explicitly fail the private-pipe loader on advanced script exceptions.",
+  "limits": [
+    "This qualifies the real helper and fault boundaries, not an actual MSI update.",
+    "New Rust integration test and full native16 build remain pending.",
+    "The recorded13to14 automatic UI failure remains failed."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json b/docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json
new file mode 100644
index 00000000000..71f91fe6f38
--- /dev/null
+++ b/docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json
@@ -0,0 +1,50 @@
+{
+  "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+  "installation": {
+    "os": "Windows10 Pro x64",
+    "branding_and_paused_policy_preserved": true,
+    "configuration_task_running_normal_priority": true,
+    "msi_product_version": "1.5.16",
+    "customer_automatic_system_service_running": true,
+    "to_version": "1.5.16+84",
+    "to_sequence": 19,
+    "os_build": 19045,
+    "exact_signed_installed_bytes": true,
+    "no_pending_or_failed_recovery": true,
+    "production_publication": false,
+    "from_version": "1.5.14+82",
+    "manual_update_or_installer_command_invoked": false,
+    "msi_product_state": 5,
+    "utc": "2026-11-02T21:34:32.2927306Z",
+    "consent_revision": 2,
+    "expected_lab_publisher_valid": true,
+    "profile_revision": 42,
+    "from_sequence": 17,
+    "native_approval_after_upgrade_qualified": false,
+    "lab_watcher_priority_repair_and_controlled_restart_required": false,
+    "identity_credential_consent_and_bootstrap_preserved": true,
+    "shipping_verifier_passed": true,
+    "unattended_consent_disabled": true
+  },
+  "automatic_ui_recovery": {
+    "release_sequence": 19,
+    "old_standard_user_frontends_stopped": true,
+    "exclusive_activity_lock_available_after_customer_stop": true,
+    "new_frontend_created_after_release_commit": true,
+    "utc": "2026-11-02T21:34:04.5605341Z",
+    "standard_user_gui_confirmed": true,
+    "native_version": "1.5.16+84",
+    "recovery_task_self_cleaned": true,
+    "profile_revision": 42
+  },
+  "old_standard_frontends": 2,
+  "new_same_sid_frontends": 2,
+  "configuration_policy_enabled_revision": 41,
+  "configuration_policy_restored_paused_revision": 42,
+  "automatic_watcher_update": true,
+  "manual_installer_update_watcher_restart_or_reboot_used": false,
+  "visually_relaunched_branding_and_support_paused_observed": true,
+  "power_interruption_qualification_pending": true,
+  "latest_native_session_qualification_pending": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json b/docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json
new file mode 100644
index 00000000000..5311913539b
--- /dev/null
+++ b/docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json
@@ -0,0 +1,39 @@
+{
+  "utc": "2026-11-02T21:16:16.914716+00:00",
+  "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+  "version": "1.5.16",
+  "sequence": 18,
+  "format": "exe",
+  "os": "Windows Server2022 Standard Evaluation Desktop Experience x64 build20348",
+  "company_generated_bundle": {
+    "edition": "technician",
+    "format": "exe",
+    "sequence": 18,
+    "job_id": "6d1e6af2-8749-40f1-ace3-a2a5457b076e",
+    "bundle_sha256": "e548111b90f679e4014a08a1611fe6a3327471ef5542e827e47c5f8900523a18",
+    "bytes": 26253442,
+    "public_bootstrap_only": true,
+    "profile_and_release_signatures_verified": true,
+    "offline_signature_mutation_check": true,
+    "seven_source_texts_exact": true,
+    "signed_payload_hashes_verified": true,
+    "anonymous_status": 401,
+    "download_status": 200
+  },
+  "actual_standard_user_desktop": true,
+  "limited_interactive_task": true,
+  "setup_exit": 0,
+  "shipping_verifier_passed": true,
+  "explicit_failed_msi_replacement": true,
+  "original_signed_msi_failure_preserved": true,
+  "installer_security_policy_changed": false,
+  "native_process_owner_matches_standard_desktop": true,
+  "native_mfa_login_observed": true,
+  "company_branding_and_https_domain_visible": true,
+  "authorized_inventory_observed": true,
+  "customer14_service_running_and_baseline_preserved": true,
+  "native_connection_pending": true,
+  "msi_standard_user_policy_rejection_remains": true,
+  "lab_signatures_only": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json b/docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json
new file mode 100644
index 00000000000..29b85bbef6e
--- /dev/null
+++ b/docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json
@@ -0,0 +1,120 @@
+{
+  "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+  "native_session": {
+    "utc": "2026-11-02T21:42:06.914897+00:00",
+    "session_id_sha256": "04fbc6ae2976d3cdc5a267dca7a7f58c73e33a840bcf8b2fead47c58d78c0155",
+    "claimed": true,
+    "closed": false,
+    "new_target_bound_grants": 3,
+    "superseded_attempts_closed": 2,
+    "exactly_one_active_native_session": true,
+    "target_and_technician_bound_to_preflight": true,
+    "unattended_disabled": true,
+    "native_customer_waited_for_standard_user_approval": true,
+    "native_desktop_rendered_after_customer_accept": true,
+    "remote_pointer_test_folder_navigation_correlated_on_both_desktops": true,
+    "remote_escape_closed_customer_desktop_context_menu": true,
+    "versions": "1.5.16+84 both native endpoints",
+    "company_source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "native_source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+    "session_still_active": false,
+    "update_coordination_and_transfer_pending": false,
+    "production_publication": false,
+    "customer_stop_verified": true,
+    "transfer_scope": "64MiB exact roundtrip; interrupted256MiB completed by fresh user retry; automatic reauthorization failed"
+  },
+  "roundtrip64": {
+    "utc": "2026-11-02T21:54:45.601937+00:00",
+    "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+    "mode": "roundtrip64",
+    "source_file": {
+      "sha256": "41c16f3eacf0980d39a5b1faac8208093e5be5a8ad2b6bc349574087770954cf",
+      "name": "large-random-64MiB.bin",
+      "bytes": 67108864
+    },
+    "received": [
+      {
+        "no_sidecars": true,
+        "sha256": "41c16f3eacf0980d39a5b1faac8208093e5be5a8ad2b6bc349574087770954cf",
+        "bytes": 67108864,
+        "role": "customer"
+      },
+      {
+        "no_sidecars": true,
+        "sha256": "41c16f3eacf0980d39a5b1faac8208093e5be5a8ad2b6bc349574087770954cf",
+        "bytes": 67108864,
+        "role": "technician"
+      }
+    ],
+    "exact_source_hashes_verified": true,
+    "files_copied_by_verifier": false,
+    "production_publication": false
+  },
+  "interrupted256_retry": {
+    "utc": "2026-11-02T22:18:29.327770+00:00",
+    "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+    "mode": "forward256",
+    "source_file": {
+      "sha256": "b4d782a74e39740e47747c2cb0de9d5c307b5cf7e20b3fde0f8ce1898e3db163",
+      "name": "interruption-random-256MiB.bin",
+      "bytes": 268435456
+    },
+    "received": [
+      {
+        "no_sidecars": true,
+        "sha256": "b4d782a74e39740e47747c2cb0de9d5c307b5cf7e20b3fde0f8ce1898e3db163",
+        "bytes": 268435456,
+        "role": "customer"
+      }
+    ],
+    "exact_source_hashes_verified": true,
+    "files_copied_by_verifier": false,
+    "production_publication": false
+  },
+  "automatic_recovery_failure": {
+    "utc": "2026-11-02T22:07:28.663755+00:00",
+    "source": "1d04bb71eb34a2111a25aed776de664086ea15aa",
+    "network_interruption_seconds": 45,
+    "network_restored": true,
+    "real_partial_bytes_observed": 2097152,
+    "ui_last_progress_bytes_approx": 35787898,
+    "native_transfer_left_blocked_write_and_entered_reauthorization": true,
+    "exact30_second_timeout_not_independently_proven": true,
+    "customer_reapproved_desktop_after_outage": true,
+    "file_transfer_still_waited_for_customer_approval_without_visible_file_prompt": true,
+    "automatic_recovery_passed": false,
+    "normal_file_window_cancel_used": true,
+    "partial_file_untouched": true,
+    "vm_app_service_restart_used": false,
+    "fresh_user_retry_pending": true,
+    "production_publication": false
+  },
+  "network_interruption": {
+    "utc": "2026-11-02T21:55:19.450806+00:00",
+    "vm": "owned Windows10 protected overlay",
+    "only_virtual_customer_adapter": true,
+    "original_backing_disk_untouched": true,
+    "expected_bytes": 268435456,
+    "state": "virtual network restored; native transfer recovery inspection pending",
+    "network_down_requested": true,
+    "network_restored": true,
+    "production_publication": false,
+    "partial": {
+      "observed_utc": "2026-11-02T21:56:23.1860776Z",
+      "bytes": 2097152,
+      "event": "partial"
+    },
+    "network_down_utc": "2026-11-02T21:56:24.500064+00:00",
+    "network_restored_utc": "2026-11-02T21:57:09.595245+00:00"
+  },
+  "customer_stop": {
+    "utc": "2026-11-02T22:20:31.936653+00:00",
+    "customer_stop_used": true,
+    "no_live_authorization_leases": true,
+    "unattended_disabled": true,
+    "updates_remain_paused_revision": 42
+  },
+  "byte_resume_offset_not_independently_measured": true,
+  "exact30_second_live_send_timeout_not_independently_proven": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json b/docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json
new file mode 100644
index 00000000000..3dbeefe5cd2
--- /dev/null
+++ b/docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json
@@ -0,0 +1,143 @@
+{
+  "source": "e11093ba76701d0542114c040095f76684b49250",
+  "version": "1.5.17+85",
+  "native_workflow_run": 41544266406,
+  "artifact_sha256": "f8ad474129fd1266585c21690cff8c2e6512bb1b568741e1cd716fca29cdd886",
+  "public_tracked_source_files_verified": 1355,
+  "generated_bridge_files_verified": 6,
+  "all_archive_manifest_hashes_verified": true,
+  "consent_window_regression_tests": {
+    "actual_tests_passed": 2,
+    "log_source": "GitHub job125620723255",
+    "current_archive_omits_test_log": true,
+    "future_workflow_upload_fixed_in": "306163f"
+  },
+  "compiled_transfer_backpressure_tests_passed": 3,
+  "full_flutter_matrix": {
+    "supported_windows_x64": "success",
+    "legacy_i686": "failure: old Cargo cannot read lockfile4; 32-bit release deferred"
+  },
+  "lab_signing": {
+    "all_five_signatures_valid": true,
+    "nonexportable_key_verified": true,
+    "private_key_exported": false,
+    "production_publisher_approval": false
+  },
+  "company_bundles": [
+    {
+      "edition": "technician",
+      "format": "exe",
+      "sequence": 20,
+      "job_id": "0e89d10d-a7fd-4d30-ac85-c089bcde5076",
+      "bundle_sha256": "14d8628923e42d742eb7d0cf5833e470c33b4fe530bf3ccb437056fb1cb7ed65",
+      "bytes": 26253548,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "msi",
+      "sequence": 21,
+      "job_id": "31a4c885-288b-4f8f-929e-293da37ea09b",
+      "bundle_sha256": "e3c9824e5cb1c179ca94115d0f269ebdfdbb469efa7824ed48e77b1ff7d3891e",
+      "bytes": 32762432,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "format": "msi",
+      "sequence": 21,
+      "job_id": "6460b57f-c048-4cfb-ae3d-b15f3f3bc7bf",
+      "bundle_sha256": "881c42bbe0f93887074fbff4e5809396ed37d9826927eabd4fdf063bb4ea0245",
+      "bytes": 30558307,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "profile_revision": 42,
+  "automatic_updates_paused": true,
+  "standard_server2022_technician_upgrade": {
+    "format": "exe",
+    "native_login_pending": true,
+    "version": "1.5.17",
+    "utc": "2026-11-03T01:21:48.6694999Z",
+    "not_system_or_administrator": true,
+    "original_technician_identity_preserved": true,
+    "shipping_verifier_passed": true,
+    "sequence": 20,
+    "production_publication": false,
+    "standard_user_sid": "S-1-5-21-694964769-3683536714-1669876909-1000"
+  },
+  "native_technician_login": {
+    "native_session_qualified": false,
+    "utc": "2026-11-03T01:27:57.8029130Z",
+    "version": "1.5.17",
+    "source": "e11093ba76701d0542114c040095f76684b49250",
+    "production_publication": false,
+    "sequence": 20,
+    "standard_session_owner_verified": true,
+    "native_mfa_login_passed": true,
+    "company_branding_and_https_domain_displayed": true,
+    "authorized_inventory_displayed": true
+  },
+  "real_customer17_upgrade_pending": false,
+  "interrupted_transfer_consent_fix_live_retest_pending": true,
+  "independent_native_rebuild_pending": true,
+  "full_windows_compatibility_not_qualified": true,
+  "customer_exe_inner_signing_pending": true,
+  "production_publication": false,
+  "real_customer_automatic_update": {
+    "os": "Windows10 Pro x64",
+    "branding_and_paused_policy_preserved": true,
+    "configuration_task_running_normal_priority": true,
+    "msi_product_version": "1.5.17",
+    "customer_automatic_system_service_running": true,
+    "to_version": "1.5.17+85",
+    "to_sequence": 21,
+    "os_build": 19045,
+    "exact_signed_installed_bytes": true,
+    "no_pending_or_failed_recovery": true,
+    "production_publication": false,
+    "from_version": "1.5.16+84",
+    "manual_update_or_installer_command_invoked": false,
+    "msi_product_state": 5,
+    "utc": "2026-11-03T01:53:32.1979631Z",
+    "consent_revision": 2,
+    "expected_lab_publisher_valid": true,
+    "profile_revision": 44,
+    "from_sequence": 19,
+    "native_approval_after_upgrade_qualified": false,
+    "lab_watcher_priority_repair_and_controlled_restart_required": false,
+    "identity_credential_consent_and_bootstrap_preserved": true,
+    "shipping_verifier_passed": true,
+    "unattended_consent_disabled": true
+  },
+  "automatic_standard_customer_ui_relaunch": {
+    "release_sequence": 21,
+    "old_standard_user_frontends_stopped": true,
+    "exclusive_activity_lock_available_after_customer_stop": true,
+    "new_frontend_created_after_release_commit": true,
+    "utc": "2026-11-03T01:53:00.2657004Z",
+    "standard_user_gui_confirmed": true,
+    "native_version": "1.5.17+85",
+    "recovery_task_self_cleaned": true,
+    "profile_revision": 44
+  },
+  "profile_revision_after_rollout": 44
+}
diff --git a/docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json b/docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json
new file mode 100644
index 00000000000..c70f1348bca
--- /dev/null
+++ b/docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json
@@ -0,0 +1,123 @@
+{
+  "source": "e11093ba76701d0542114c040095f76684b49250",
+  "versions": "1.5.17+85 both native endpoints",
+  "desktop": {
+    "utc": "2026-11-03T02:01:39.033747+00:00",
+    "session_id_sha256": "f59c9d85520a4cd0174c8fb720159ddf0ed861edec6b7900b2024639f833b9b1",
+    "claimed": true,
+    "closed": false,
+    "new_target_bound_grants": 1,
+    "superseded_attempts_closed": 0,
+    "exactly_one_active_native_session": true,
+    "lease_until": 1793671551,
+    "target_and_technician_bound_to_preflight": true,
+    "unattended_disabled": true,
+    "native_customer_waited_for_standard_user_approval": true,
+    "native_desktop_rendered_after_customer_accept": true,
+    "remote_pointer_test_folder_navigation_correlated_on_both_desktops": true,
+    "versions": "1.5.17+85 both native endpoints",
+    "company_source": "94284db24b8993344c12cae0a8baa95f82dc0e02",
+    "native_source": "e11093ba76701d0542114c040095f76684b49250",
+    "session_still_active": true,
+    "update_coordination_and_transfer_pending": true,
+    "production_publication": false
+  },
+  "roundtrip64": {
+    "utc": "2026-11-03T02:17:04.238104+00:00",
+    "source": "e11093ba76701d0542114c040095f76684b49250",
+    "mode": "roundtrip64",
+    "source_file": {
+      "sha256": "c75977e80ae1956899fcdb1a4bd7e8dff2bb40076d41eb9789c4c4480bfb4a29",
+      "name": "large-random-64MiB.bin",
+      "bytes": 67108864
+    },
+    "received": [
+      {
+        "no_sidecars": true,
+        "sha256": "c75977e80ae1956899fcdb1a4bd7e8dff2bb40076d41eb9789c4c4480bfb4a29",
+        "bytes": 67108864,
+        "role": "customer"
+      },
+      {
+        "no_sidecars": true,
+        "sha256": "c75977e80ae1956899fcdb1a4bd7e8dff2bb40076d41eb9789c4c4480bfb4a29",
+        "bytes": 67108864,
+        "role": "technician"
+      }
+    ],
+    "exact_source_hashes_verified": true,
+    "files_copied_by_verifier": false,
+    "production_publication": false
+  },
+  "network_interruption": {
+    "utc": "2026-11-03T02:17:37.135884+00:00",
+    "vm": "owned Windows10 protected overlay",
+    "only_virtual_customer_adapter": true,
+    "original_backing_disk_untouched": true,
+    "expected_bytes": 268435456,
+    "state": "virtual network restored; native transfer recovery inspection pending",
+    "network_down_requested": true,
+    "network_restored": true,
+    "production_publication": false,
+    "partial": {
+      "observed_utc": "2026-11-03T02:19:19.7583119Z",
+      "bytes": 2490368,
+      "event": "partial"
+    },
+    "network_down_utc": "2026-11-03T02:19:20.023851+00:00",
+    "network_restored_utc": "2026-11-03T02:20:05.111457+00:00"
+  },
+  "consent_visibility_qualification": {
+    "passed": false,
+    "desktop_and_file_reapproval_prompts_arrived": true,
+    "desktop_accepted_first_with_file_request_pending": true,
+    "approval_manager_minimized_with_pending_file_consent": true,
+    "checked_after_at_least_five_seconds": true,
+    "technician_file_window_waited_for_acceptance": true,
+    "failure_cause": "Approval/elevation button callbacks call windowManager.minimize directly, bypassing the timed guard."
+  },
+  "diagnostic_recovery": {
+    "manual_taskbar_restoration_of_existing_consent_window": true,
+    "existing_pending_file_consent_explicitly_accepted": true,
+    "file_session_cancelled_or_reopened": false,
+    "fresh_user_transfer_retry": false,
+    "application_service_or_vm_restart": false,
+    "byte_resume_offset_measured": false,
+    "exact_live_30_second_write_timeout_proven": false,
+    "result": {
+      "utc": "2026-11-03T02:36:38.650995+00:00",
+      "source": "e11093ba76701d0542114c040095f76684b49250",
+      "mode": "forward256",
+      "source_file": {
+        "sha256": "920c38da8a311f4e42066cb61f336247245b152f8abdb307ec0c93f1baa5c622",
+        "name": "interruption-random-256MiB.bin",
+        "bytes": 268435456
+      },
+      "received": [
+        {
+          "no_sidecars": true,
+          "sha256": "920c38da8a311f4e42066cb61f336247245b152f8abdb307ec0c93f1baa5c622",
+          "bytes": 268435456,
+          "role": "customer"
+        }
+      ],
+      "exact_source_hashes_verified": true,
+      "files_copied_by_verifier": false,
+      "production_publication": false
+    }
+  },
+  "stop": {
+    "utc": "2026-11-03T02:38:42.666537+00:00",
+    "no_live_authorization_leases": true,
+    "customer_stop_clicked": true,
+    "native_source": "e11093ba76701d0542114c040095f76684b49250",
+    "no_vm_app_service_restart": true
+  },
+  "candidate18_change": {
+    "compiled_or_live_tested": false,
+    "all_three_direct_minimize_callbacks_removed": true,
+    "normal_acceptance_and_elevation_schedule_pending_consent_guard": true,
+    "source_architecture_regression_rejects_actual17_callbacks": true
+  },
+  "production_publication": false
+}
diff --git a/docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json b/docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json
new file mode 100644
index 00000000000..560924ce35a
--- /dev/null
+++ b/docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json
@@ -0,0 +1,85 @@
+{
+  "utc": "2026-11-03T07:31:37.516654+00:00",
+  "runtime_source": "323d6efec3ec1ada03d5e2fdbbdfd391647c5420",
+  "producer_source_for_customer_exe": "77f0a192f8be37524e73662e06151de4bfca37bd",
+  "worker_source": "7b60309374389a1b0f8d859f8c164d6cf355353f",
+  "version": "1.5.18",
+  "all_four_company_bundles_generated_by_existing_windows_worker": true,
+  "bundles": [
+    {
+      "edition": "technician",
+      "format": "exe",
+      "sequence": 22,
+      "job_id": "0d4f89e6-c2d1-47e4-9c13-b7a583ea2843",
+      "bundle_sha256": "8d40c684efff53ea354b60cecab7dfcd153c3bcd5fb44519fcf8f61753bc8d87",
+      "bytes": 26254825,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "msi",
+      "sequence": 23,
+      "job_id": "2f62452d-0292-4735-bd26-f9efd76a1f57",
+      "bundle_sha256": "252169432bf95d1c0643a5ead5aa1fdb806eab9b84452970db1a6d07250a2e83",
+      "bytes": 32763403,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "format": "msi",
+      "sequence": 23,
+      "job_id": "5491cb83-b8a2-4aad-aaaf-020736c0f645",
+      "bundle_sha256": "d3f4093fc45aaf7669561fcd1ee64999b2d14c45aa2ce6b11533538504df7093",
+      "bytes": 30557828,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "exe",
+      "sequence": 24,
+      "job_id": "af383af5-a397-418f-8ed6-ac854a52949f",
+      "bundle_sha256": "8f8c2cfa10e35b564fac28b202f0eac8839bf417d02b36a606900dfd2c74d27a",
+      "bytes": 26265973,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    }
+  ],
+  "both_customer_formats_public": true,
+  "both_technician_formats_require_authentication": true,
+  "public_bootstrap_has_no_technician_credentials_or_privileged_enrollment_secret": true,
+  "profile_and_release_signatures_verified": true,
+  "signed_payload_hashes_verified": true,
+  "seven_bundled_source_texts_exact": true,
+  "invalid_release_signature_and_request_trust_override_rejected": true,
+  "unapproved_builds_rejected_without_job_creation": true,
+  "management_deployment_unchanged": true,
+  "automatic_updates_paused": true,
+  "installer_executed": false,
+  "new_clean_os_installation_matrix_qualified": false,
+  "native18_live_consent_recovery_qualified": false,
+  "independent_reproduction_verified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json b/docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json
new file mode 100644
index 00000000000..4916995be9d
--- /dev/null
+++ b/docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json
@@ -0,0 +1,31 @@
+{
+  "utc": "2026-11-03T09:37:02.401366+00:00",
+  "source": "323d6efec3ec1ada03d5e2fdbbdfd391647c5420",
+  "os": "Server2022 build20348 Desktop Experience",
+  "edition": "customer",
+  "format": "msi",
+  "from_version": "1.5.14",
+  "from_sequence": 17,
+  "installed_version": "1.5.18+86",
+  "installed_sequence": 23,
+  "actual_existing_standard_user_customer_window_open_before_setup": true,
+  "explicit_elevated_administrator_shipping_setup_used": true,
+  "shipping_installed_payload_verifier_passed": true,
+  "service_and_watcher_running_after_setup": true,
+  "device_identity_token_consent_and_bootstrap_preserved": true,
+  "profile_revision": 44,
+  "automatic_updates_stayed_paused": true,
+  "old_customer_window_process_survived": true,
+  "old_executable_and_protocol_and_engine_mapped_from_msi_rollback_storage": true,
+  "swan_pending_file_rename_operations": 0,
+  "visible_customer_branding_regressed_after_setup": true,
+  "visible_customer_warning_after_setup": "Company setup is not complete",
+  "visible_customer_transport_status_after_setup": "Not ready",
+  "stop_support_control_still_visible": true,
+  "post_upgrade_screenshot_sha256": "9e5044017941f0510cda290064b3db84ac79bfee7cc4542aeabd292084a81bf5",
+  "existing_window_upgrade_acceptance_passed": false,
+  "explicit_same_release_repair_qualified": false,
+  "automatic_update_ui_recovery_retested": false,
+  "production_publication": false,
+  "required_fix": "Prepare and durably restore existing customer user interfaces during explicit verified setup, including administrator-initiated setup; preserve session exclusion and signed installation recovery."
+}
diff --git a/docs/evidence/1518-native-build-and-exact-source-verification-20261103.json b/docs/evidence/1518-native-build-and-exact-source-verification-20261103.json
new file mode 100644
index 00000000000..428c4c64d6d
--- /dev/null
+++ b/docs/evidence/1518-native-build-and-exact-source-verification-20261103.json
@@ -0,0 +1,49 @@
+{
+  "utc": "2026-11-03T04:33:38.401460+00:00",
+  "source": "323d6efec3ec1ada03d5e2fdbbdfd391647c5420",
+  "version": "1.5.18+86",
+  "workflow_run": 41567752475,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41567752475",
+  "primary_native_build_passed": true,
+  "artifact_id": 13202697737,
+  "artifact_digest": "sha256:2cba07e4e903c4e88574f341561ae4d213cc807962f3b11cf6c5504c8a24f6e0",
+  "all_shipping_manifest_hashes_match": true,
+  "public_tracked_source_files_verified": 1358,
+  "generated_bridge_files_verified": 6,
+  "bridge_artifact_id": 13200505221,
+  "bridge_artifact_digest": "sha256:16b0eeeb74cd6344c99d21c2ad4195526d378502fa402db2e1cd71dbf41e840e",
+  "submodules": {
+    ".": "323d6efec3ec1ada03d5e2fdbbdfd391647c5420",
+    "libs/hbb_common/": "7e1c392c62d39c364127307cd408421dd5f8cfb0"
+  },
+  "flutter_sdk_version": "3.24.5",
+  "engine_source": "05d5369c04804b9a9b2dc06df0cb85b0efe6f274",
+  "required_native_build_steps": {
+    "Keep pending customer approvals visible during reconnects": "success",
+    "Reject indefinitely blocked file-transfer writes": "success",
+    "Reject paused support and authorization reuse after resume": "success",
+    "Reject authorization retries and inherited audit destinations": "success",
+    "Reject cross-target and stale-login file-transfer handles": "success",
+    "Verify hardened DLL search supports delayed application libraries": "success",
+    "Build branded client": "success",
+    "Build self-extracting installer": "success",
+    "Reject incoming capture helpers in the technician edition": "success",
+    "Verify service launcher defers desktop DLL loading": "success",
+    "Verify customer MSI starts a headless native service": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "approval_regression_tests": 3,
+  "compiled_file_write_regression_tests": 3,
+  "downloaded_executables_run_by_offline_verifier": false,
+  "unsigned_payload_files_extracted": 95,
+  "lab_signing_completed": false,
+  "live_pending_consent_retest_passed": false,
+  "independent_native_rebuild_verified": false,
+  "production_publication": false,
+  "qualification": "Exact-source primary native build and offline source/artifact verification only. Native17 visibility failure remains unqualified until an actual native18 interruption test passes."
+}
diff --git a/docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json b/docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json
new file mode 100644
index 00000000000..21151a49296
--- /dev/null
+++ b/docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json
@@ -0,0 +1,40 @@
+{
+  "utc": "2026-11-03T07:03:25.731396+00:00",
+  "version": "1.5.18",
+  "runtime_source": "323d6efec3ec1ada03d5e2fdbbdfd391647c5420",
+  "producer_source": "77f0a192f8be37524e73662e06151de4bfca37bd",
+  "primary_native_run": 41567752475,
+  "unsigned_outer_sha256": "994c159d1fc76f52b8e93692972ab25d5891d11764a590b40e1a7d32a5cd3594",
+  "signed_outer_sha256": "aee04087070f018a5e320775fab42524aa93a157df6319f6c65666ad6012c37d",
+  "signed_outer_bytes": 24296240,
+  "signed_inner_sha256": "a2941d691813a8f1552022eecf50c364c628cfc295de7466f4d353fcd5b47cfb",
+  "installed_manifest_sha256": "935d962bdbe3bc6c8c2a0cb613c1834002c326134c869a9ed86c5b823ff35668",
+  "embedded_files": 95,
+  "all_embedded_payload_hashes_verified_in_guest_and_again_on_host": true,
+  "wrong_inner_manifest_rejected_on_actual_signed_package": true,
+  "actual_native_packer_tests_passed": 6,
+  "python_security_and_packaging_tests_passed": 8,
+  "actual_windows_powershell_native_progress_exit7_missing_tool_and_preference_checks_passed": true,
+  "actual_resource_compiler_selection_verified": true,
+  "resource_compiler_sha256": "b1e5940bbd9fa7bf0724ed4c1dd4d3e1602ac1707abb3c3a7aa047f2418c3978",
+  "executed_producer_scripts_match_public_git_source_exactly": true,
+  "lab_outer_signature_and_rfc3161_timestamp_verified": true,
+  "lab_publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "retained_original_nonexportable_lab_key_verified": true,
+  "private_signing_key_exported": false,
+  "corresponding_source": {
+    "runtime_source_archive_sha256": "bd62bde5c1c4f0561c9ff232604eef8766dba57f2bd7c2620a7ed4e2950d3be4",
+    "supplemental_producer_source": "77f0a192f8be37524e73662e06151de4bfca37bd",
+    "bundle_sha256": "04902d67d5567261f14a18e50f77bfdd1e577d33c71cd070d00d4d065967097b",
+    "bundle_bytes": 8500609,
+    "all_entries_verified": true,
+    "company_settings_or_private_keys_included": false
+  },
+  "installer_executed": false,
+  "fresh_install_repair_upgrade_uninstall_matrix_qualified": false,
+  "independent_native_and_producer_reproduction_verified": false,
+  "live_native18_consent_recovery_qualified": false,
+  "production_signing_provider_approval": false,
+  "production_publication": false,
+  "scope": "Actual Windows producer compilation, six native tests, lab signing and independent signed-inner payload/source verification. This does not qualify installation, public transport, production trust or the native18 live recovery fix."
+}
diff --git a/docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json b/docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json
new file mode 100644
index 00000000000..2e3a27a93ed
--- /dev/null
+++ b/docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json
@@ -0,0 +1,52 @@
+{
+  "utc": "2026-11-03T08:45:18.293240+00:00",
+  "source": "323d6efec3ec1ada03d5e2fdbbdfd391647c5420",
+  "primary_run": 41567752475,
+  "os": "Windows Server2022 Standard Evaluation Desktop Experience",
+  "os_build": "20348",
+  "version": "1.5.18+86",
+  "edition": "technician",
+  "format": "exe",
+  "previous_release_sequence": 20,
+  "release_sequence": 22,
+  "actual_standard_account_not_administrator_or_system": true,
+  "shipping_company_bundle_installation_completed": true,
+  "shipping_installed_identity_verifier_passed": true,
+  "identity_and_bootstrap_preserved": true,
+  "native_process_owner_is_existing_standard_user": true,
+  "native_executable_matches_primary_build": true,
+  "loaded_protocol_library_and_engine_match_primary_build": true,
+  "signed_outer_sha256": "5bc74be3e812ddedbc71256da6fcbd4a9556aeebdbc943b892ffcdb495fd717e",
+  "signed_agent_sha256": "fe347ad45df9b030fd12d4d9d0890a27de8ca5461dca5602ad746d73d030fbb1",
+  "profile_revision": 44,
+  "actual_native_mfa_login_and_authorized_inventory_observed": true,
+  "updated_company_branding_observed": true,
+  "native_inventory_screenshot_sha256": "d007811fdb8032eac521e2002bcc4845ebed33e5d6ee1c62946a6dd0bd175265",
+  "initial_fixture_pin_error_rejected_and_retained": true,
+  "corrected_collector_loads_hashes_from_verified_signed_release": true,
+  "original_preflight_sequence_annotation_error_independently_corrected": true,
+  "product_inputs_unchanged_during_fixture_corrections": true,
+  "fresh_customer_exe_installation_qualified": false,
+  "native18_live_consent_recovery_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "public_internet_transport_qualified": false,
+  "independent_build_reproduction_qualified": false,
+  "production_publication": false,
+  "unassigned_technician_permission_test": {
+    "utc": "2026-11-03T08:56:04.112891+00:00",
+    "native18_unassigned_mfa_login_observed": true,
+    "native18_unassigned_inventory_empty": true,
+    "server_unassigned_inventory_empty": true,
+    "target_is_real_approved_device": true,
+    "valid_new_proof_public_key_used": true,
+    "unauthorized_attended_grant_status": 403,
+    "unassigned_history_unchanged_empty": true,
+    "device_approval_group_and_consent_unchanged": true,
+    "signed_profile_revision": 44,
+    "updates_remain_paused": true,
+    "no_successful_grant_or_native_session_created": true,
+    "receiving_device_bypass_tests_qualified": false,
+    "production_publication": false
+  },
+  "unassigned_native_inventory_screenshot_sha256": "e8ac9d8cd377e938e3ff254326be92589724399d2bd6ef5319dd79396b7bbe49"
+}
diff --git a/docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json b/docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json
new file mode 100644
index 00000000000..428a04624aa
--- /dev/null
+++ b/docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json
@@ -0,0 +1,58 @@
+{
+  "utc": "2026-11-03T21:50:52.226687+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "os": "Windows10 Pro22H2 x64 build19045",
+  "media_sha256": "ac6f8bd452c476f07f2ca14d85622e7c8723af6517aa27a014ddc4831e38b693",
+  "fresh_os_and_readonly_baseline_preserved": true,
+  "no_swan_compiler_tailscale_or_lab_publisher_trust_before_test": true,
+  "autologon_disabled_and_password_removed_before_test": true,
+  "lab_public_certificates_imported_only_after_baseline": true,
+  "fresh_company_customer_msi_installation": {
+    "version": "1.5.19",
+    "watch_state": "Running",
+    "profile_revision": 44,
+    "sequence": 25,
+    "shipping_verifier_passed": true,
+    "utc": "2026-11-03T21:24:41.1486037Z",
+    "all_signed_files": 96,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "normal_reboot_verification": {
+    "no_pending_recovery": true,
+    "identity_token_bootstrap_and_consent_preserved": true,
+    "build": "19045",
+    "utc": "2026-11-03T21:41:24.4911390Z",
+    "boot_utc": "2026-11-03T21:38:46.5000000Z",
+    "watch": "Running",
+    "tailscale_absent": true,
+    "service": "Running",
+    "sequence": 25,
+    "gui_verification_pending": true,
+    "shipping_verifier_passed": true,
+    "profile_revision": 44
+  },
+  "graphical_customer_runtime_qualified": false,
+  "lab_console_input_diagnosis_pending": true,
+  "customer_exe19_qualified": false,
+  "production_signing": false,
+  "full_os_lifecycle_qualified": false,
+  "unapproved_device_authorization_test": {
+    "utc": "2026-11-03T22:28:01.532600+00:00",
+    "fresh_customer19_enrollment_pending": true,
+    "unattended_consent_off": true,
+    "authorized_technician_inventory_excludes_unapproved_device": true,
+    "real_pending_device_grant_with_valid_proof_rejected": 403,
+    "device_approval_group_and_consent_unchanged": true,
+    "session_history_unchanged": true,
+    "signed_profile_revision": 44,
+    "updates_paused": true,
+    "no_successful_grant_or_native_session_created": true,
+    "receiving_device_bypass_qualification": false,
+    "production_publication": false
+  }
+}
diff --git a/docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json b/docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json
new file mode 100644
index 00000000000..6c7eb876bb6
--- /dev/null
+++ b/docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json
@@ -0,0 +1,74 @@
+{
+  "utc": "2026-11-03T23:02:12.284732+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "version": "1.5.19",
+  "actual_worker_generated_and_downloaded_bundles": [
+    {
+      "edition": "technician",
+      "format": "exe",
+      "sequence": 24,
+      "job_id": "2c9cdd8f-d34c-4fef-addc-aaaa9c6889f6",
+      "bundle_sha256": "2d97fb0f511b1310388911829479edaaa0fbda7e6f766c70fe79fae76d56f170",
+      "bytes": 26280883,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "msi",
+      "sequence": 25,
+      "job_id": "7df5e2fd-57ae-4137-8d2e-8fdb328505a8",
+      "bundle_sha256": "30a51e8fabafa4ab88b88798444cc01a2197e65f48a5b90eadebd9015a1b5041",
+      "bytes": 32814322,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "format": "msi",
+      "sequence": 25,
+      "job_id": "566be3bb-c7a5-46cc-85d8-ddf4b91657a4",
+      "bundle_sha256": "c812ad11971a0fa9a1dcb09986194b737702dfe1fb5c592940ef7709a4420738",
+      "bytes": 30625779,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "exe",
+      "sequence": 26,
+      "job_id": "fb96699c-02d8-4eb1-97d7-94361deb0dc7",
+      "bundle_sha256": "d64359857d67d19aa8eccdf7b9d81a9c79eb9cc10a98889e6957846ca066953f",
+      "bytes": 26293122,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    }
+  ],
+  "public_customer_and_authenticated_technician_downloads_verified": true,
+  "profile_revision": 44,
+  "updates_paused": true,
+  "no_company_credentials_or_privileged_enrollment_secret_in_bootstrap": true,
+  "test_signatures_only": true,
+  "all_bundle_formats_installation_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json b/docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json
new file mode 100644
index 00000000000..cc9e77a947a
--- /dev/null
+++ b/docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json
@@ -0,0 +1,54 @@
+{
+  "utc": "2026-11-04T00:04:05.093883+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "producer_source": "dbab5fb72b9da1d994a096b91022cb0bc55e1ff3",
+  "unsigned_outer_sha256": "9cc4d6774927c45053f9ae8aafbfbbffad6a4dc0f68f59cc336a505b3732da2c",
+  "signed_outer_sha256": "a730a20d96c0ce96ca751680e683bf8cf3e45ed9c515354a21a71414edbe6c7f",
+  "signed_inner_sha256": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+  "installed_manifest_sha256": "8badec30c911da204e804f357ce69e623d3c3d7b9d23241f5f16c4673a391621",
+  "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "actual_native_packer_tests_passed": 6,
+  "actual_windows_python_packaging_tests_passed": 10,
+  "signed_payload_verified_again_on_host": true,
+  "wrong_signed_inner_manifest_rejected_on_real_signed_package": true,
+  "embedded_files": 95,
+  "original_nonexportable_lab_key_verified": true,
+  "private_key_exported": false,
+  "independent_producer_reproduction_pending": true,
+  "production_publication": false,
+  "corresponding_source": {
+    "utc": "2026-11-04T00:05:46.585813+00:00",
+    "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+    "producer_source": "dbab5fb72b9da1d994a096b91022cb0bc55e1ff3",
+    "archive_sha256": "dcf7dc7f0afb375e392af7381cf0264f3fca1348f0e7020b33d557b5ccc82032",
+    "bytes": 8534866,
+    "files": 17,
+    "all_source_entries_verified": true,
+    "private_keys_or_company_configuration_included": false,
+    "production_publication": false
+  },
+  "real_clean_install_test": {
+    "os": "Windows 10 Pro x64 build19045",
+    "sequence": 27,
+    "stable_main_filename_present": true,
+    "old_rustdesk_exe_absent": true,
+    "service_running": true,
+    "result": "FAILED acceptance: Start-Process -Wait remained blocked by session0 tray after installer parent exited",
+    "persistent_tray_parent_exited": true,
+    "installer_controller_timed_out_seconds": 900,
+    "assistance": "Stopped only verified session0 tray PID876; setup then enrolled, recorded27 and cleared pending marker. No reinstall.",
+    "enrolled_after_assistance": true,
+    "unattended_consent": false,
+    "profile_revision": 44,
+    "clean_installation_qualified": false
+  },
+  "fix": "Wait for the launched process handle and retain its exit status, rather than waiting for persistent descendants. Apply to setup/elevation/MSI launch paths; signed outer EXE already waits for installer child.",
+  "regression": {
+    "actual_windows_powershell51_entry_tests": "PASS",
+    "real_fixture_parent_exit_code": 7,
+    "tray_child_alive_when_wait_returned": true,
+    "installer_failure_status_preserved": true,
+    "company_installation_not_performed_by_fixture": true,
+    "fixed_bundle_clean_install_pending": true
+  }
+}
diff --git a/docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json b/docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json
new file mode 100644
index 00000000000..a2abc7c0dcf
--- /dev/null
+++ b/docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json
@@ -0,0 +1,21 @@
+{
+  "utc": "2026-11-04T04:49:17.379785+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "producer_source": "dbab5fb72b9da1d994a096b91022cb0bc55e1ff3",
+  "unsigned_primary_and_independent_sha256": "9cc4d6774927c45053f9ae8aafbfbbffad6a4dc0f68f59cc336a505b3732da2c",
+  "signed_inner_sha256": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+  "new_source_and_target_directories": true,
+  "compiled_target_cache_not_reused": true,
+  "verified_dependency_source_cache_reused": true,
+  "all_collected_files_hash_verified": true,
+  "exact_public_producer_sources_verified": true,
+  "actual_native_packer_tests_passed": 6,
+  "actual_windows_python_packaging_tests_passed": 10,
+  "embedded_files_independently_verified": 95,
+  "payload_executed_on_collection_host": false,
+  "original_installed_customer_preserved": true,
+  "outer_signing_not_repeated": true,
+  "no_binary_normalization": true,
+  "corrected_producer_reproduction_passed": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json b/docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json
new file mode 100644
index 00000000000..4222188c39a
--- /dev/null
+++ b/docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json
@@ -0,0 +1,80 @@
+{
+  "utc": "2026-11-03T23:38:22.466670+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "failed_lab_customer_exe_sequence": 26,
+  "fresh_windows10_build": "19045",
+  "actual_failure": "Shipping setup returned Installed executable not found after the EXE copied rustdesk.exe into the Swan installation directory. Expected Swan Remote Support.exe absent.",
+  "actual_directory_listing": [
+    "data",
+    "desktop_drop_plugin.dll",
+    "desktop_multi_window_plugin.dll",
+    "dylib_virtual_display.dll",
+    "file_selector_windows_plugin.dll",
+    "flutter_custom_cursor_plugin.dll",
+    "flutter_gpu_texture_renderer_plugin.dll",
+    "flutter_windows.dll",
+    "librustdesk.dll",
+    "RuntimeBroker_rustdesk.exe",
+    "rustdesk.exe",
+    "screen_retriever_plugin.dll",
+    "texture_rgba_renderer_plugin.dll",
+    "Uninstall Swan Remote Support.lnk",
+    "uni_links_desktop_plugin.dll",
+    "url_launcher_windows_plugin.dll",
+    "WindowInjection.dll",
+    "window_manager_plugin.dll",
+    "window_size_plugin.dll"
+  ],
+  "recovery_markers_retained": [
+    "pending-install.json",
+    "managed-state.json"
+  ],
+  "cause": "Native Flutter installation copies the payload directory without renaming; the producer retained rustdesk.exe and the verifier normalized that filename into the expected manifest name.",
+  "producer_fix": "Stage unchanged signed bytes under the stable installed name; select that entry point; compare embedded names literally.",
+  "python_packaging_tests_passed": 10,
+  "actual_failed_signed_exe_rejected_by_corrected_verifier": true,
+  "host_powershell_native_exit_handling_regression_passed": true,
+  "windows_replacement_build_qualified": false,
+  "fixed_fresh_installation_qualified": false,
+  "approval_withdrawal": {
+    "utc": "2026-11-03T23:31:33.813423+00:00",
+    "withdrawn_lab_customer_exe_sequences": [
+      24,
+      26
+    ],
+    "release_history_retained": true,
+    "other_release_approvals_unchanged": true,
+    "profile44_unchanged_updates_paused": true,
+    "production_releases_affected": false
+  },
+  "production_publication": false,
+  "stopped_disk_identity_verification": {
+    "utc": "2026-11-03T23:40:38.727711+00:00",
+    "copied_signed_inner_sha256": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+    "copied_as_rustdesk_exe_in_stable_install_directory": true,
+    "signed_pending_install_sequence": 26,
+    "device_enrolled": false,
+    "unattended_consent": false,
+    "profile_revision": 44,
+    "installer_not_retried": true,
+    "vm_normally_stopped": true,
+    "disk_read_only_during_collection": true,
+    "nbd_disconnect_trap_completed": true
+  },
+  "withdrawn_download_and_generation_denials": {
+    "utc": "2026-11-03T23:46:25.520108+00:00",
+    "withdrawn_customer_exe_denials": [
+      {
+        "sequence": 24,
+        "anonymous_download": 404,
+        "new_build_request": 409
+      },
+      {
+        "sequence": 26,
+        "anonymous_download": 404,
+        "new_build_request": 409
+      }
+    ],
+    "no_new_build_job_created": true
+  }
+}
diff --git a/docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json b/docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json
new file mode 100644
index 00000000000..aca61a4cabc
--- /dev/null
+++ b/docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json
@@ -0,0 +1,127 @@
+{
+  "utc": "2026-11-04T03:11:29.025430+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "customer_exe_producer_source": "dbab5fb72b9da1d994a096b91022cb0bc55e1ff3",
+  "company_bundle_recipe_source": "332af85187668b08a87714c6e19b41d9ba124ced",
+  "fresh_os": "Windows10 Pro x64 build19045",
+  "fresh_product_free_overlay": true,
+  "shipping_installation": {
+    "version": "1.5.19",
+    "watch_state": "Running",
+    "profile_revision": 44,
+    "sequence": 28,
+    "shipping_verifier_passed": true,
+    "utc": "2026-11-04T02:49:33.7979305Z",
+    "all_signed_files": 95,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "unapproved_device_denial": {
+    "utc": "2026-11-04T02:54:01.352818+00:00",
+    "fresh_customer19_enrollment_pending": true,
+    "unattended_consent_off": true,
+    "authorized_technician_inventory_excludes_unapproved_device": true,
+    "real_pending_device_grant_with_valid_proof_rejected": 403,
+    "device_approval_group_and_consent_unchanged": true,
+    "session_history_unchanged": true,
+    "signed_profile_revision": 44,
+    "updates_paused": true,
+    "no_successful_grant_or_native_session_created": true,
+    "receiving_device_bypass_qualification": false,
+    "production_publication": false
+  },
+  "one_shipping_setup_invocation_only": true,
+  "no_tray_termination_or_manual_service_start": true,
+  "no_manual_executable_rename_or_package_patch": true,
+  "unassisted_shipping_installation_passed": true,
+  "setup_invocation": "Elevated shipping Install-Company.ps1 with explicit company-domain confirmation; isolated lab DNS mapping and public test trust provisioned by fixture",
+  "interactive_uac_and_wizard_success_qualified": false,
+  "fresh_standard_user_gui_qualified": true,
+  "reboot_verification_pending": false,
+  "full_lifecycle_and_windows_matrix_qualified": false,
+  "production_publication": false,
+  "normal_reboot": {
+    "no_pending_recovery": true,
+    "identity_token_bootstrap_and_consent_preserved": true,
+    "build": "19045",
+    "utc": "2026-11-04T03:22:36.3689441Z",
+    "boot_utc": "2026-11-04T03:16:28.5000000Z",
+    "watch": "Running",
+    "tailscale_absent": true,
+    "service": "Running",
+    "sequence": 28,
+    "gui_verification_pending": true,
+    "shipping_verifier_passed": true,
+    "profile_revision": 44
+  },
+  "explicit_shipping_repair": {
+    "no_pending_recovery": true,
+    "utc": "2026-11-04T03:57:00.3504957Z",
+    "explicit_shipping_repair": true,
+    "watch": "Running",
+    "identity_token_bootstrap_consent_preserved": true,
+    "service": "Running",
+    "sequence": 28,
+    "installed_verifier_passed": true,
+    "tailscale_absent": true,
+    "profile_revision": 44
+  },
+  "standard_customer_ui": {
+    "utc": "2026-11-04T04:11:48.375550+00:00",
+    "native_images": {
+      "metadata_only_no_memory_dump": true,
+      "production_qualified": false,
+      "actual_mapped_images_match_primary": true,
+      "utc": "2026-11-04T04:09:17.2624829Z",
+      "unassisted_installation": true,
+      "images": [
+        {
+          "module": "Swan Remote Support.exe",
+          "sha256": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+          "matches_primary_or_signed_main": true,
+          "actual_mapped_file": "\\Device\\HarddiskVolume1\\Program Files\\Swan Remote Support\\Swan Remote Support.exe"
+        },
+        {
+          "module": "librustdesk.dll",
+          "sha256": "22df0b04a78e393b6cb79418faa2c1b5a5dd2b9be0360cf915ca638f97b01cad",
+          "matches_primary_or_signed_main": true,
+          "actual_mapped_file": "\\Device\\HarddiskVolume1\\Program Files\\Swan Remote Support\\librustdesk.dll"
+        },
+        {
+          "module": "flutter_windows.dll",
+          "sha256": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+          "matches_primary_or_signed_main": true,
+          "actual_mapped_file": "\\Device\\HarddiskVolume1\\Program Files\\Swan Remote Support\\flutter_windows.dll"
+        }
+      ],
+      "native_version": "1.5.19+87",
+      "standard_user": true,
+      "native_pid": 3956
+    },
+    "configured_company_name_and_logo_visible": true,
+    "customer_approval_required_visible": true,
+    "stop_support_visibly_paused": true,
+    "resume_support_visibly_ready": true,
+    "unattended_confirmation_shows_company_domain_and_signin_screen_scope": true,
+    "unattended_confirmation_cancelled": true,
+    "unattended_opt_in_and_revocation_qualified_on_this_fixture": false,
+    "live_session_qualified": false,
+    "screenshots": {
+      "standard-ready.png": "6b48839b73f953c684566e04881b8539927f757835b72365c7ea5c4542a27763",
+      "standard-paused.png": "bbdcb86fcb4ed75395951aaaa12e618c2df2d3b857ced1a81d9f7472353d0d81",
+      "unattended-confirmation.png": "47ec2b02cd267eab949ef27bf6202627694832ec2f4f51e4f048deb283bcf665"
+    },
+    "lab_standard_signin_cleanup": {
+      "original_registry_and_lsa_secret_restored": true,
+      "temporary_encrypted_files_removed": true,
+      "automatic_logon_disabled": true,
+      "completed_cleanup_task_removed_separately": true,
+      "first_logon_task_time_limit_reached_after_restoration": true
+    },
+    "production_qualified": false
+  }
+}
diff --git a/docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json b/docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json
new file mode 100644
index 00000000000..69bd41be783
--- /dev/null
+++ b/docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json
@@ -0,0 +1,53 @@
+{
+  "utc": "2026-11-04T04:22:39.118895+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "version": "1.5.19",
+  "release_sequence": 28,
+  "os": "Windows10 Pro x64 build19045",
+  "shipping_exe_uninstall_acceptance": "FAILED: configuration agent executable retained",
+  "observed_removal": {
+    "running_agent_count": 0,
+    "main_present": false,
+    "agent_present": true,
+    "pending_uninstall": true,
+    "watcher_present": false,
+    "utc": "2026-11-04T04:17:25.4628682Z",
+    "service_present": false
+  },
+  "no_running_agent_or_remote_service_after_uninstall": true,
+  "original_shipping_test_not_retried": true,
+  "correction": "Embed fixed completion script after native removal; require application/service/task absent and no installed agent process, remove only fixed agent file, retain identity/consent and uninstall cancellation.",
+  "component_test": {
+    "retained_managed_state_byte_identical": true,
+    "uninstall_cancellation_retained": true,
+    "retained_agent_removed": true,
+    "shipping_native20_qualification": false,
+    "source_component_only": true,
+    "utc": "2026-11-04T04:21:06.8068435Z",
+    "rollback_agent_retained_in_protected_fixture": true
+  },
+  "targeted_windows_powershell_tests_passed": [
+    "test_customer_exe_uninstall.ps1",
+    "test_uninstall_commit.ps1"
+  ],
+  "new_source_hashes": {
+    "deployment/windows/Complete-CustomerExeUninstall.ps1": "5990130e3163eea7f8513bac6d8a7ba674eca4fcc6e9b87b546fca80fa4c40c8",
+    "deployment/windows/test_customer_exe_uninstall.ps1": "8734468f6abb0c74ecdf462998c1b548dd0d50ef6eec4b83b06ae38aa3ae42ee"
+  },
+  "corrected_shipping_installer_full_uninstall_retest_pending": true,
+  "full_lifecycle_qualified": false,
+  "production_publication": false,
+  "explicit_reinstall_after_source_component_cleanup": {
+    "no_pending_recovery": true,
+    "service": "Running",
+    "utc": "2026-11-04T04:23:46.0296538Z",
+    "uninstall_cancellation_cleared_only_by_explicit_setup": true,
+    "watch": "Running",
+    "identity_token_bootstrap_consent_preserved": true,
+    "explicit_shipping_repair_reinstall": true,
+    "sequence": 28,
+    "installed_verifier_passed": true,
+    "tailscale_absent": true,
+    "profile_revision": 44
+  }
+}
diff --git a/docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json b/docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json
new file mode 100644
index 00000000000..d3c5b5ef4e1
--- /dev/null
+++ b/docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json
@@ -0,0 +1,85 @@
+{
+  "recorded_utc": "2026-11-03T15:14:41.487797+00:00",
+  "scope": "Customer MSI explicit upgrade, reboot recovery from stale MSI-moved GUI, and same-release repair on one Server2022 Desktop Experience VM",
+  "source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "version": "1.5.19+87",
+  "os": "Windows Server2022 Standard Evaluation, build20348, Desktop Experience",
+  "lab_signatures_only": true,
+  "first_attempt": {
+    "result": "Preparation refused; not a successful upgrade",
+    "installed_sequence_remained": 23,
+    "target_sequence": 25,
+    "system_prepare_task_result": 1,
+    "pending_install_marker_retained": true,
+    "original_user_processes_survived": true,
+    "read_only_query_full_process_image_name_mismatched_cim_path": true,
+    "actual_images_in_windows_installer_rollback_storage": true,
+    "installer_execution_not_reached": true,
+    "process_identity_guard_not_relaxed": true
+  },
+  "recovery": {
+    "normal_vm_reboot": true,
+    "identity_bootstrap_and_consent_preserved_before_and_after_reboot": true,
+    "original_pending_marker_and_signed_package_retained": true,
+    "manual_state_or_marker_changes": false,
+    "verified_installed18_window_open_before_retry": true,
+    "original_failed_attempt_retained": true
+  },
+  "explicit_upgrade_after_reboot": {
+    "utc": "2026-11-03T15:00:34.4051248Z",
+    "version": "1.5.19",
+    "native_file_version": "1.5.19+87",
+    "sequence": 25,
+    "old_process_gone": true,
+    "original_standard_user_preserved": true,
+    "loaded_images_match_primary": true,
+    "identity_bootstrap_and_consent_preserved": true,
+    "pending_markers_cleared": true,
+    "company_status_and_stop_controls_observed": true,
+    "profile_revision": 44,
+    "consent_revision": 0,
+    "unattended_off": true,
+    "service": "Running",
+    "watch": "Running",
+    "mapped_image_hashes": {
+      "Swan Remote Support.exe": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+      "librustdesk.dll": "22df0b04a78e393b6cb79418faa2c1b5a5dd2b9be0360cf915ca638f97b01cad",
+      "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204"
+    },
+    "original_screenshot_sha256": "7e2868c52b3f3a27e75b1574c093f70bbdb0e73e577503a3e5ea053dbc7b7505"
+  },
+  "same_exact_release_repair_with_open_window": {
+    "utc": "2026-11-03T15:10:58.6302526Z",
+    "version": "1.5.19",
+    "native_file_version": "1.5.19+87",
+    "sequence": 25,
+    "old_process_gone": true,
+    "original_standard_user_preserved": true,
+    "loaded_images_match_primary": true,
+    "identity_bootstrap_and_consent_preserved": true,
+    "pending_markers_cleared": true,
+    "company_status_and_stop_controls_observed": true,
+    "profile_revision": 44,
+    "consent_revision": 0,
+    "unattended_off": true,
+    "service": "Running",
+    "watch": "Running",
+    "mapped_image_hashes": {
+      "Swan Remote Support.exe": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+      "librustdesk.dll": "22df0b04a78e393b6cb79418faa2c1b5a5dd2b9be0360cf915ca638f97b01cad",
+      "flutter_windows.dll": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204"
+    },
+    "original_screenshot_sha256": "987d1c1e118813aa1336b147eafefa46e755121033645043a32f2c48719f4c18"
+  },
+  "remaining": [
+    "Fresh customer EXE19 production and installation",
+    "Other Windows versions and full installation/update/uninstall/interruption matrix",
+    "Native pending-consent and interruption recovery",
+    "External public transport qualification",
+    "Independent candidate19 build reproduction",
+    "Production signing approval and release checks"
+  ],
+  "complete_windows_matrix_qualified": false,
+  "full_lifecycle_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1519-independent-native-reproduction-20261104.json b/docs/evidence/1519-independent-native-reproduction-20261104.json
new file mode 100644
index 00000000000..b0cc9ef943b
--- /dev/null
+++ b/docs/evidence/1519-independent-native-reproduction-20261104.json
@@ -0,0 +1,2585 @@
+{
+  "schema": 1,
+  "source_commit": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "source_date_epoch": 1793705430,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1372,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "flutter/lib/generated_bridge.dart": "e53fdef78c7f550776df0101c8a23ce215cd857daa7bee719c1481219f919e09",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/check-service-bootstrap.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/07bb8d0-component-reproduction.json",
+        "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_backup_memory.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/linux/test_pinned_images.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/web/test-installation-status.js",
+        "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+        "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+        "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+        "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+        "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerExe.ps1",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/Migrate-WorkerCredential.ps1",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Read-WorkerConfiguration.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restart-CustomerUi.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/Run-SetupUiTask.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/SERVICE-STARTUP.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+        "deployment/windows/a6670d6-native-independent-comparison.json",
+        "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+        "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+        "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/e95010e-first-build-and-source-verification.json",
+        "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+        "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+        "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/prepare-customer-exe.py",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/service-bootstrap-tests/CMakeLists.txt",
+        "deployment/windows/service-bootstrap-tests/core.cpp",
+        "deployment/windows/service-bootstrap-tests/main.cpp",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_exe.py",
+        "deployment/windows/test_customer_exe_native_output.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_customer_ui_restart.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_bootstrap.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_setup_ui_broker.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_download.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/test_worker_configuration.ps1",
+        "deployment/windows/verify-portable-payload.py",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_EXE_PRODUCER.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/EXPLICIT_SETUP_UI_RECOVERY.md",
+        "docs/INSTALLATION_STATUS.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE-READINESS.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "docs/evidence/07bb8d0-native-file-transfer-and-pause.json",
+        "docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json",
+        "docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json",
+        "docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json",
+        "docs/evidence/1510-installed-agent-profile-rejection-20261030.json",
+        "docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json",
+        "docs/evidence/1510-linux-authorization-negatives-20261030.json",
+        "docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json",
+        "docs/evidence/1510-linux-native-attended-session-20261030.json",
+        "docs/evidence/1510-linux-native-management-outage-recovery-20261030.json",
+        "docs/evidence/1510-native-stock-client-legacy-denial-20261030.json",
+        "docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json",
+        "docs/evidence/1510-server2025-technician-upgrade-20261030.json",
+        "docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json",
+        "docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json",
+        "docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json",
+        "docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json",
+        "docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json",
+        "docs/evidence/1511-component-priority-and-recovery-ci-20261030.json",
+        "docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json",
+        "docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json",
+        "docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json",
+        "docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json",
+        "docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json",
+        "docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json",
+        "docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json",
+        "docs/evidence/1512-independent-native-original-output-reproduction-20261031.json",
+        "docs/evidence/1512-native-and-component-build-success-20261031.json",
+        "docs/evidence/1512-recovery-principal-sid-regression-20261031.json",
+        "docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json",
+        "docs/evidence/1513-independent-native-reproduction-20261031.json",
+        "docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json",
+        "docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json",
+        "docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json",
+        "docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json",
+        "docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+        "docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json",
+        "docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json",
+        "docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json",
+        "docs/evidence/1514-native-build-and-company-bundles-20261102.json",
+        "docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json",
+        "docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json",
+        "docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json",
+        "docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json",
+        "docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json",
+        "docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json",
+        "docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json",
+        "docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json",
+        "docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json",
+        "docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json",
+        "docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json",
+        "docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json",
+        "docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json",
+        "docs/evidence/1518-native-build-and-exact-source-verification-20261103.json",
+        "docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json",
+        "docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json",
+        "docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json",
+        "docs/evidence/159-windows-attended-lock-unlock-20261029.json",
+        "docs/evidence/159-windows-company-install-enrollment-20261029.json",
+        "docs/evidence/159-windows-native-branding-sync-20261030.json",
+        "docs/evidence/159-windows-native-clipboard-transfer-20261029.json",
+        "docs/evidence/159-windows-native-two-monitor-20261029.json",
+        "docs/evidence/159-windows-receiving-file-permission-denial-20261029.json",
+        "docs/evidence/159-windows-standard-customer-uac-20261029.json",
+        "docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json",
+        "docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-windows-checks.json",
+        "docs/evidence/1c43a38-windows-components-independent.json",
+        "docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json",
+        "docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json",
+        "docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json",
+        "docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json",
+        "docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json",
+        "docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json",
+        "docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json",
+        "docs/evidence/361d7c3-windows-transport-storage-component-checks.json",
+        "docs/evidence/3bcc884-reporting-component-checks.json",
+        "docs/evidence/3bcc884-windows-transport-server2016.json",
+        "docs/evidence/649682a-authenticated-technician-identity-component-checks.json",
+        "docs/evidence/67b5c69-company-backup-and-rollback.json",
+        "docs/evidence/67b5c69-component-reproduction.json",
+        "docs/evidence/67b5c69-native-independent-rebuild.json",
+        "docs/evidence/67b5c69-native158-runtime.json",
+        "docs/evidence/67b5c69-streamed-backup-component-checks.json",
+        "docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json",
+        "docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json",
+        "docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json",
+        "docs/evidence/a96cd4c-installation-reporting-component-checks.json",
+        "docs/evidence/aff8ff6-native159-source-verification.json",
+        "docs/evidence/aff8ff6-windows-full-deployment-export.json",
+        "docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json",
+        "docs/evidence/e47f614-compiled-sender-https.json",
+        "docs/evidence/e47f614-schema3-upgrade-and-rollback.json",
+        "docs/evidence/update-download-streaming.json",
+        "docs/evidence/windows-maintained-component-preparation.json",
+        "docs/evidence/windows-transport-database-storage-finding-20261029.json",
+        "docs/evidence/worker-private-configuration-server2016.json",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/approval_window_auto_hide.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/approval_window_auto_hide_test.dart",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/service_bootstrap.cpp",
+        "flutter/windows/runner/service_bootstrap.h",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/runtime_cache.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/reporting.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/backup_stream.rs",
+        "product/management/src/components.rs",
+        "product/management/src/installation_reporting.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/installation.rs",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/configuration.rs",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1372,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "flutter/lib/generated_bridge.dart": "e53fdef78c7f550776df0101c8a23ce215cd857daa7bee719c1481219f919e09",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/check-service-bootstrap.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/07bb8d0-component-reproduction.json",
+        "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_backup_memory.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/linux/test_pinned_images.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/web/test-installation-status.js",
+        "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+        "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+        "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+        "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+        "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerExe.ps1",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/Migrate-WorkerCredential.ps1",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Read-WorkerConfiguration.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restart-CustomerUi.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/Run-SetupUiTask.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/SERVICE-STARTUP.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+        "deployment/windows/a6670d6-native-independent-comparison.json",
+        "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+        "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+        "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/e95010e-first-build-and-source-verification.json",
+        "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+        "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+        "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/prepare-customer-exe.py",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/service-bootstrap-tests/CMakeLists.txt",
+        "deployment/windows/service-bootstrap-tests/core.cpp",
+        "deployment/windows/service-bootstrap-tests/main.cpp",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_exe.py",
+        "deployment/windows/test_customer_exe_native_output.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_customer_ui_restart.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_bootstrap.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_setup_ui_broker.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_download.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/test_worker_configuration.ps1",
+        "deployment/windows/verify-portable-payload.py",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_EXE_PRODUCER.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/EXPLICIT_SETUP_UI_RECOVERY.md",
+        "docs/INSTALLATION_STATUS.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE-READINESS.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "docs/evidence/07bb8d0-native-file-transfer-and-pause.json",
+        "docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json",
+        "docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json",
+        "docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json",
+        "docs/evidence/1510-installed-agent-profile-rejection-20261030.json",
+        "docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json",
+        "docs/evidence/1510-linux-authorization-negatives-20261030.json",
+        "docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json",
+        "docs/evidence/1510-linux-native-attended-session-20261030.json",
+        "docs/evidence/1510-linux-native-management-outage-recovery-20261030.json",
+        "docs/evidence/1510-native-stock-client-legacy-denial-20261030.json",
+        "docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json",
+        "docs/evidence/1510-server2025-technician-upgrade-20261030.json",
+        "docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json",
+        "docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json",
+        "docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json",
+        "docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json",
+        "docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json",
+        "docs/evidence/1511-component-priority-and-recovery-ci-20261030.json",
+        "docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json",
+        "docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json",
+        "docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json",
+        "docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json",
+        "docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json",
+        "docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json",
+        "docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json",
+        "docs/evidence/1512-independent-native-original-output-reproduction-20261031.json",
+        "docs/evidence/1512-native-and-component-build-success-20261031.json",
+        "docs/evidence/1512-recovery-principal-sid-regression-20261031.json",
+        "docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json",
+        "docs/evidence/1513-independent-native-reproduction-20261031.json",
+        "docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json",
+        "docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json",
+        "docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json",
+        "docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json",
+        "docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+        "docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json",
+        "docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json",
+        "docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json",
+        "docs/evidence/1514-native-build-and-company-bundles-20261102.json",
+        "docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json",
+        "docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json",
+        "docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json",
+        "docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json",
+        "docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json",
+        "docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json",
+        "docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json",
+        "docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json",
+        "docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json",
+        "docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json",
+        "docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json",
+        "docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json",
+        "docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json",
+        "docs/evidence/1518-native-build-and-exact-source-verification-20261103.json",
+        "docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json",
+        "docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json",
+        "docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json",
+        "docs/evidence/159-windows-attended-lock-unlock-20261029.json",
+        "docs/evidence/159-windows-company-install-enrollment-20261029.json",
+        "docs/evidence/159-windows-native-branding-sync-20261030.json",
+        "docs/evidence/159-windows-native-clipboard-transfer-20261029.json",
+        "docs/evidence/159-windows-native-two-monitor-20261029.json",
+        "docs/evidence/159-windows-receiving-file-permission-denial-20261029.json",
+        "docs/evidence/159-windows-standard-customer-uac-20261029.json",
+        "docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json",
+        "docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-windows-checks.json",
+        "docs/evidence/1c43a38-windows-components-independent.json",
+        "docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json",
+        "docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json",
+        "docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json",
+        "docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json",
+        "docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json",
+        "docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json",
+        "docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json",
+        "docs/evidence/361d7c3-windows-transport-storage-component-checks.json",
+        "docs/evidence/3bcc884-reporting-component-checks.json",
+        "docs/evidence/3bcc884-windows-transport-server2016.json",
+        "docs/evidence/649682a-authenticated-technician-identity-component-checks.json",
+        "docs/evidence/67b5c69-company-backup-and-rollback.json",
+        "docs/evidence/67b5c69-component-reproduction.json",
+        "docs/evidence/67b5c69-native-independent-rebuild.json",
+        "docs/evidence/67b5c69-native158-runtime.json",
+        "docs/evidence/67b5c69-streamed-backup-component-checks.json",
+        "docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json",
+        "docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json",
+        "docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json",
+        "docs/evidence/a96cd4c-installation-reporting-component-checks.json",
+        "docs/evidence/aff8ff6-native159-source-verification.json",
+        "docs/evidence/aff8ff6-windows-full-deployment-export.json",
+        "docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json",
+        "docs/evidence/e47f614-compiled-sender-https.json",
+        "docs/evidence/e47f614-schema3-upgrade-and-rollback.json",
+        "docs/evidence/update-download-streaming.json",
+        "docs/evidence/windows-maintained-component-preparation.json",
+        "docs/evidence/windows-transport-database-storage-finding-20261029.json",
+        "docs/evidence/worker-private-configuration-server2016.json",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/approval_window_auto_hide.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/approval_window_auto_hide_test.dart",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/service_bootstrap.cpp",
+        "flutter/windows/runner/service_bootstrap.h",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/runtime_cache.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/reporting.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/backup_stream.rs",
+        "product/management/src/components.rs",
+        "product/management/src/installation_reporting.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/installation.rs",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/configuration.rs",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37824.6",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37824.6",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.19-customer-x64-unsigned.msi",
+      "first_sha256": "1ba59b5b6fb74636bbaf78148fe48f1c84674b83b658d1505e45eeac1742403a",
+      "second_sha256": "1ba59b5b6fb74636bbaf78148fe48f1c84674b83b658d1505e45eeac1742403a",
+      "first_bytes": 34037760,
+      "second_bytes": 34037760,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.19-technician-x64-unsigned.exe",
+      "first_sha256": "78029a4428b74174e2f1a6a5368a106608865464c86a7a5e3ee82bdd92154595",
+      "second_sha256": "78029a4428b74174e2f1a6a5368a106608865464c86a7a5e3ee82bdd92154595",
+      "first_bytes": 24286208,
+      "second_bytes": 24286208,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.19-technician-x64-unsigned.msi",
+      "first_sha256": "145a5077e4f21d4148dc12e522abe91d91e5ead5d0dc91e72a6d583f0759f2bc",
+      "second_sha256": "145a5077e4f21d4148dc12e522abe91d91e5ead5d0dc91e72a6d583f0759f2bc",
+      "first_bytes": 31776768,
+      "second_bytes": 31776768,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.19-x64-unsigned-install.exe",
+      "first_sha256": "78029a4428b74174e2f1a6a5368a106608865464c86a7a5e3ee82bdd92154595",
+      "second_sha256": "78029a4428b74174e2f1a6a5368a106608865464c86a7a5e3ee82bdd92154595",
+      "first_bytes": 24286208,
+      "second_bytes": 24286208,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "fc4e98c9fe7d7343399de97cd1fb1905c82c0dac079cd4ce39259d49b53a756f",
+      "second_sha256": "fc4e98c9fe7d7343399de97cd1fb1905c82c0dac079cd4ce39259d49b53a756f",
+      "first_bytes": 65881088,
+      "second_bytes": 65881088,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+      "second_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+      "first_bytes": 5862912,
+      "second_bytes": 5862912,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "2bef0642129dfe5736e3da8879f67dcaad032ea7706e9d95dec5c65f0e02e84f",
+      "second_sha256": "2bef0642129dfe5736e3da8879f67dcaad032ea7706e9d95dec5c65f0e02e84f",
+      "first_bytes": 9130496,
+      "second_bytes": 9130496,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "09e6c63da82436c1245a1ded122bcc363172fa08f5e01503bc3eca9d3c7d18c0",
+      "second_sha256": "09e6c63da82436c1245a1ded122bcc363172fa08f5e01503bc3eca9d3c7d18c0",
+      "first_bytes": 4900864,
+      "second_bytes": 4900864,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "utc": "2026-11-04T01:31:13.833458+00:00",
+  "first_run": 41628177194,
+  "second_run": 41744919308,
+  "second_artifact": 13286452961,
+  "independent_rebuild_verified": true,
+  "corrected_customer_exe_producer_reproduction_included": false,
+  "qualification_note": "This compares original native CI outputs at a3fedd9, including its original customer EXE. It does not reproduce the separately corrected signed-inner producer at dbab5fb or qualify installation. The customer EXE setup failures and fixes have separate receipts."
+}
diff --git a/docs/evidence/1519-native-build-and-source-verification-20261103.json b/docs/evidence/1519-native-build-and-source-verification-20261103.json
new file mode 100644
index 00000000000..d4d9a7aeabf
--- /dev/null
+++ b/docs/evidence/1519-native-build-and-source-verification-20261103.json
@@ -0,0 +1,63 @@
+{
+  "recorded_utc": "2026-11-03T13:36:21.189845+00:00",
+  "scope": "Primary native build, unsigned artifacts and exact corresponding-source verification; not signed runtime acceptance",
+  "version": "1.5.19+87",
+  "source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "workflow_run": 41628177194,
+  "windows_job": 125895623171,
+  "build_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41628177194",
+  "windows_job_conclusion": "success",
+  "artifact": {
+    "id": 13231382300,
+    "bytes": 256521762,
+    "sha256": "5d4237325267400a1365ffefb384cb8ebda8fcc2a6747337619d7b8399c7b075"
+  },
+  "source_archive_sha256": "25aa64baba41648a1367b710fc5a62d14b37dfec784940fe8f324c683f2139ee",
+  "public_tracked_source_files_verified": 1372,
+  "generated_bridge_files_verified": 6,
+  "submodule_revisions": {
+    ".": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+    "libs/hbb_common/": "7e1c392c62d39c364127307cd408421dd5f8cfb0"
+  },
+  "all_shipping_manifest_hashes_match": true,
+  "pinned_sdk_version": "3.24.5",
+  "engine_source": "05d5369c04804b9a9b2dc06df0cb85b0efe6f274",
+  "engine_sha256": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+  "native_transfer_write_regression_log_verified": true,
+  "three_approval_window_regressions_verified": true,
+  "customer_payload_files_extracted_and_msi_manifest_verified": 95,
+  "downloaded_executables_run_on_host": false,
+  "required_native_ci_steps": {
+    "Keep pending customer approvals visible during reconnects": "success",
+    "Reject indefinitely blocked file-transfer writes": "success",
+    "Reject paused support and authorization reuse after resume": "success",
+    "Reject authorization retries and inherited audit destinations": "success",
+    "Reject cross-target and stale-login file-transfer handles": "success",
+    "Verify hardened DLL search supports delayed application libraries": "success",
+    "Build branded client": "success",
+    "Build self-extracting installer": "success",
+    "Reject incoming capture helpers in the technician edition": "success",
+    "Verify service launcher defers desktop DLL loading": "success",
+    "Verify customer MSI starts a headless native service": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "component_gate": {
+    "source": "12ada256317b55af026ca0540182ca8b7179a1fc",
+    "run": 41624580461,
+    "windows_and_linux_verify_success": true,
+    "actual_windows_powershell_system_broker_test_passed": true,
+    "candidate_changes_since_gate": "Only synchronized Cargo, portable packer, Flutter and workflow version metadata"
+  },
+  "explicit_upgrade_runtime_qualified": false,
+  "same_release_repair_runtime_qualified": false,
+  "live_pending_consent_recovery_qualified": false,
+  "complete_windows_matrix_qualified": false,
+  "independent_native_rebuild_verified": false,
+  "production_signing_approved": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json b/docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json
new file mode 100644
index 00000000000..4f1f19dda48
--- /dev/null
+++ b/docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json
@@ -0,0 +1,35 @@
+{
+  "utc": "2026-11-03T22:37:33.347261+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "producer_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "unsigned_outer_sha256": "1e82a28ec3ff6139cb7bdbc051c266de2df9b4dec0e643506414fceb7f062e06",
+  "signed_outer_sha256": "018a5780cf6342358c6cccba63c96153fc79410d8ae5356a8ff0aedd8f2f6b68",
+  "signed_inner_sha256": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+  "installed_manifest_sha256": "8badec30c911da204e804f357ce69e623d3c3d7b9d23241f5f16c4673a391621",
+  "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "actual_native_packer_tests_passed": 6,
+  "windows_powershell_progress_and_exit_regression_passed": true,
+  "all_collected_files_hash_verified": true,
+  "public_producer_sources_exactly_match_executed_files": true,
+  "actual_resource_compiler_selection_verified": true,
+  "signed_payload_verified_again_on_host": true,
+  "wrong_signed_inner_manifest_rejected_on_real_signed_package": true,
+  "embedded_files": 95,
+  "original_nonexportable_lab_key_verified": true,
+  "private_key_exported": false,
+  "installed": false,
+  "independent_producer_reproduction_pending": true,
+  "production_publication": false,
+  "corresponding_source": {
+    "utc": "2026-11-03T22:42:08.812591+00:00",
+    "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+    "producer_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+    "archive_sha256": "47e8e74a8ed0da39aa2b4d642999adb42ce8d73afc950db3789878d0b31c48bc",
+    "bytes": 8534278,
+    "files": 17,
+    "all_source_entries_verified": true,
+    "private_keys_or_company_configuration_included": false,
+    "production_publication": false
+  },
+  "qualification": "Actual Windows compilation, lab signature and embedded payload verification only"
+}
diff --git a/docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json b/docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json
new file mode 100644
index 00000000000..7f95697fcf7
--- /dev/null
+++ b/docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json
@@ -0,0 +1,49 @@
+{
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "qualification": "Server2022 standard-user technician EXE upgrade and native MFA/inventory only",
+  "upgrade_and_native_login": {
+    "native_process_owner_is_existing_standard_user": true,
+    "sequence": 24,
+    "version": "1.5.19",
+    "format": "exe",
+    "identity_and_bootstrap_preserved": true,
+    "utc": "2026-11-03T15:26:41.2781468Z",
+    "profile_revision": 44,
+    "agent_sha256": "9439084e0bab1e4f26ad6a346d7cf2c5d0d8396557f6136cc89daff0c57eb526",
+    "native_file_version": "1.5.19+87",
+    "previous_sequence": 22,
+    "loaded_protocol_library_and_engine_match_primary_build": true,
+    "native_executable_matches_primary_build": true,
+    "native_pid": 2420,
+    "os_build": "20348",
+    "outer_sha256": "c0901f62ad83a7fa4995888b65dcd0fa642d40c3ac64c42bd960082ba13a0c0c",
+    "ui_observation": {
+      "utc": "2026-11-03T15:26:36.772Z",
+      "file": "authorized-inventory.jpg",
+      "sha256": "98d45f2b900c89e692ec82fc16253cb8a4ea9ec377ede61b458f0485b1d31231",
+      "native_mfa_sign_in_observed": true,
+      "authorized_inventory_observed": true,
+      "company_branding_observed": true,
+      "session_connection_tested": false
+    }
+  },
+  "unassigned_technician_permission_test": {
+    "utc": "2026-11-03T15:29:31.548814+00:00",
+    "native19_unassigned_mfa_login_observed": true,
+    "native19_unassigned_inventory_empty": true,
+    "server_unassigned_inventory_empty": true,
+    "target_is_real_approved_device": true,
+    "valid_new_proof_public_key_used": true,
+    "unauthorized_attended_grant_status": 403,
+    "unassigned_history_unchanged_empty": true,
+    "device_approval_group_and_consent_unchanged": true,
+    "signed_profile_revision": 44,
+    "updates_remain_paused": true,
+    "no_successful_grant_or_native_session_created": true,
+    "receiving_device_bypass_tests_qualified": false,
+    "production_publication": false
+  },
+  "unassigned_native_inventory_screenshot_sha256": "0a804e03cc6f6e153b89e3681bdbbe563c84a2e0dec8b568fe5f8da681319a52",
+  "full_windows_matrix_qualified": false,
+  "production_signed": false
+}
diff --git a/docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json b/docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json
new file mode 100644
index 00000000000..d34e1ab68e3
--- /dev/null
+++ b/docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json
@@ -0,0 +1,126 @@
+{
+  "utc": "2026-11-04T01:52:27.970763+00:00",
+  "runtime_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+  "producer_source": "dbab5fb72b9da1d994a096b91022cb0bc55e1ff3",
+  "customer_sequence": 27,
+  "fresh_installation_qualified": false,
+  "installation_assistance": "Correct stable main filename installed. Stalled old setup required stopping its verified session0 tray; no reinstall. Approval27 subsequently withdrawn.",
+  "post_assistance_installed_verification": {
+    "version": "1.5.19",
+    "watch_state": "Running",
+    "profile_revision": 44,
+    "sequence": 27,
+    "shipping_verifier_passed": true,
+    "assisted_installation_not_clean_acceptance": true,
+    "utc": "2026-11-04T01:03:30.5483318Z",
+    "all_signed_files": 95,
+    "default_unattended_consent_off": true,
+    "service_state": "Running",
+    "production_qualified": false,
+    "enrolled": true,
+    "public_lab_publisher_verified": true,
+    "tailscale_absent": true
+  },
+  "native_mapped_images": {
+    "metadata_only_no_memory_dump": true,
+    "production_qualified": false,
+    "actual_mapped_images_match_primary": true,
+    "assisted_installation_not_clean_acceptance": true,
+    "utc": "2026-11-04T01:07:45.6305150Z",
+    "images": [
+      {
+        "module": "Swan Remote Support.exe",
+        "sha256": "819c78ae404a88801a8ea65f5f9bc69dba5ed9c7bcf91753a942f2f1c540b07c",
+        "matches_primary_or_signed_main": true,
+        "actual_mapped_file": "\\Device\\HarddiskVolume1\\Program Files\\Swan Remote Support\\Swan Remote Support.exe"
+      },
+      {
+        "module": "librustdesk.dll",
+        "sha256": "22df0b04a78e393b6cb79418faa2c1b5a5dd2b9be0360cf915ca638f97b01cad",
+        "matches_primary_or_signed_main": true,
+        "actual_mapped_file": "\\Device\\HarddiskVolume1\\Program Files\\Swan Remote Support\\librustdesk.dll"
+      },
+      {
+        "module": "flutter_windows.dll",
+        "sha256": "c87ba5a71afa7b7100c1c9ccc1289009dab812f9de2acc38f9d5103e48c1f204",
+        "matches_primary_or_signed_main": true,
+        "actual_mapped_file": "\\Device\\HarddiskVolume1\\Program Files\\Swan Remote Support\\flutter_windows.dll"
+      }
+    ],
+    "native_version": "1.5.19+87",
+    "standard_user": true,
+    "native_pid": 6960
+  },
+  "pending_device_denial": {
+    "utc": "2026-11-04T01:05:01.821722+00:00",
+    "fresh_customer19_enrollment_pending": true,
+    "unattended_consent_off": true,
+    "authorized_technician_inventory_excludes_unapproved_device": true,
+    "real_pending_device_grant_with_valid_proof_rejected": 403,
+    "device_approval_group_and_consent_unchanged": true,
+    "session_history_unchanged": true,
+    "signed_profile_revision": 44,
+    "updates_paused": true,
+    "no_successful_grant_or_native_session_created": true,
+    "receiving_device_bypass_qualification": false,
+    "assisted_installation_not_clean_acceptance": true,
+    "production_publication": false
+  },
+  "device_approval": {
+    "utc": "2026-11-04T01:11:37.744736+00:00",
+    "only_test_device_approved": true,
+    "other_devices_unchanged": true,
+    "group_unchanged": true,
+    "unattended_still_off": true
+  },
+  "standard_user_stop_resume_ui_observed": true,
+  "consent_enabled": {
+    "unattended": true,
+    "profile": 44,
+    "sequence": 27,
+    "revision": 1,
+    "utc": "2026-11-04T01:14:14.3190684Z",
+    "phase": "enabled",
+    "local_and_server_consent_match": true,
+    "valid_proof_unattended_grant_status": 200,
+    "previous_grant_closed": false,
+    "no_native_session_claimed": true,
+    "standard_user_native_ui_action": true,
+    "assisted_installation_not_clean_acceptance": true,
+    "production_qualified": false
+  },
+  "consent_revoked": {
+    "unattended": false,
+    "profile": 44,
+    "sequence": 27,
+    "revision": 2,
+    "utc": "2026-11-04T01:15:18.0577299Z",
+    "phase": "revoked",
+    "local_and_server_consent_match": true,
+    "valid_proof_unattended_grant_status": 403,
+    "previous_grant_closed": true,
+    "no_native_session_claimed": true,
+    "standard_user_native_ui_action": true,
+    "assisted_installation_not_clean_acceptance": true,
+    "production_qualified": false
+  },
+  "actual_reboot": {
+    "no_pending_recovery": true,
+    "identity_token_bootstrap_and_consent_preserved": true,
+    "build": "19045",
+    "utc": "2026-11-04T01:40:24.9895500Z",
+    "boot_utc": "2026-11-04T01:27:14.5000000Z",
+    "watch": "Running",
+    "tailscale_absent": true,
+    "service": "Running",
+    "sequence": 27,
+    "gui_verification_pending": true,
+    "shipping_verifier_passed": true,
+    "profile_revision": 44
+  },
+  "post_reboot_gui_qualified": false,
+  "console_limitation": "Saved standard account credential passed Windows LogonUser after reboot; console input rejected it. No password reset. Device state and shipping verifier checks passed over pinned SSH.",
+  "native_session_qualified": false,
+  "complete_windows_matrix_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1521-current-build-and-company-packages-20261104.json b/docs/evidence/1521-current-build-and-company-packages-20261104.json
new file mode 100644
index 00000000000..fad30cca986
--- /dev/null
+++ b/docs/evidence/1521-current-build-and-company-packages-20261104.json
@@ -0,0 +1,87 @@
+{
+  "recorded_at": "2026-11-04T09:27:50.275505+00:00",
+  "version": "1.5.21+89",
+  "source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "primary_native_run": 41779406214,
+  "primary_native_run_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/41779406214",
+  "engine_source": "source-candidate-05d5369",
+  "tracked_source_files_verified": 1390,
+  "generated_bridge_files_verified": 6,
+  "customer_exe": {
+    "unsigned_outer_sha256": "7043dbcf9bf75247610b65b0cdefdafb6b76159e5ac46be04c2b3de61703df72",
+    "signed_outer_sha256": "4a06d1593662d0aa1a954d64dbdda4871a9cfabd7f710601a26c95d26f802006",
+    "signed_inner_sha256": "64c4bcb40a2576fc56306aadb2b99e056132c6abfe5d48ea8ac839f4596f85d6",
+    "installed_manifest_sha256": "2b812d8fe1a94f4dde22f5d18fb330a7692f18eadb7bd50278707ebb7a05f51e",
+    "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+    "actual_native_packer_tests_passed": 6,
+    "actual_windows_python_packaging_tests_passed": 10,
+    "public_producer_sources_exactly_match_executed_files": true,
+    "signed_payload_verified_again_on_host": true,
+    "wrong_signed_inner_manifest_rejected_on_real_signed_package": true,
+    "embedded_files": 95,
+    "private_key_exported": false
+  },
+  "company_bundles": [
+    {
+      "edition": "technician",
+      "format": "exe",
+      "sequence": 26,
+      "bundle_sha256": "44b70527eccbe75d95c30e19228fbe629fd658ea4002da17eea050696972ea4b",
+      "bytes": 26281227,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "msi",
+      "sequence": 29,
+      "bundle_sha256": "a8246711ec4227ed6fc3d25c457d19254d8b6b34bd0a937c2ae526de2bb54ca6",
+      "bytes": 32836943,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "format": "msi",
+      "sequence": 27,
+      "bundle_sha256": "6b59e60b5c27b97e2f080071402ed8eb44ae320eb896210b0a7cfe21ac56eff4",
+      "bytes": 30629047,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "exe",
+      "sequence": 30,
+      "bundle_sha256": "41d93472fa82aa5995bda0e27336fc464549d9b65ef5bea02b1b3c9576fc075a",
+      "bytes": 26295092,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    }
+  ],
+  "automatic_updates_paused": true,
+  "independent_native_reproduction_pending": true,
+  "independent_customer_exe_reproduction_pending": true,
+  "genuine_about_ui_check_pending": true,
+  "shipping_uninstall_retest_pending": true,
+  "full_windows_matrix_pending": true,
+  "external_public_transport_pending": true,
+  "lab_signing_only": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/1521-customer-exe30-lab-manifest-pairing-failure-20261104.json b/docs/evidence/1521-customer-exe30-lab-manifest-pairing-failure-20261104.json
new file mode 100644
index 00000000000..acc99faa604
--- /dev/null
+++ b/docs/evidence/1521-customer-exe30-lab-manifest-pairing-failure-20261104.json
@@ -0,0 +1,20 @@
+{
+  "recorded_utc": "2026-11-04T14:07:07.728910+00:00",
+  "source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "version": "1.5.21",
+  "failed_release": "30-Customer-test",
+  "failure": "Lab release preparation paired the customer EXE with the96-file MSI installed manifest. LICENSE.txt is not in this95-file EXE payload.",
+  "all95_actual_exe_payload_files_hash_matched": true,
+  "shipping_installed_verification_rejected_missing_expected_file": true,
+  "release_sequence_not_committed": true,
+  "last_committed_customer_sequence": 28,
+  "pending_install30_preserved": true,
+  "identity_and_disabled_consent_preserved": true,
+  "wrong_approval_withdrawn": true,
+  "all_other_approvals_and_paused_profile44_preserved": true,
+  "correct_release31_uses_the_same_signed_executable_and_exact95_file_manifest": true,
+  "existing_public_portable_verifier_rejected_wrong96_file_manifest": true,
+  "corrected_bundle_generation_and_recovery_pending": true,
+  "new_vm_or_native_build_created_for_correction": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json b/docs/evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json
new file mode 100644
index 00000000000..8bc2f372ae1
--- /dev/null
+++ b/docs/evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json
@@ -0,0 +1,57 @@
+{
+  "recorded_utc": "2026-11-04T15:41:06.905129+00:00",
+  "source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "version": "1.5.21+89",
+  "os_build": "19045",
+  "edition": "customer",
+  "format": "exe",
+  "release_sequence": 31,
+  "corrected_release_uses_same_native_binary_as_failed30": true,
+  "shipping_replace_failed_setup_passed": true,
+  "previous_signed30_receipt_archived_exactly_by_shipping_recovery": true,
+  "identity_token_bootstrap_and_disabled_consent_preserved": true,
+  "shipping_installed_verification_passed": true,
+  "shipping_native_uninstall_removed_main_service_watcher_and_agent": true,
+  "uninstall_retained_identity_consent_and_update_cancellation": true,
+  "manual_product_file_deletion_or_repair": false,
+  "shipping_explicit_repair_reinstall_passed": true,
+  "shipping_setup_cleared_uninstall_cancellation": true,
+  "service_and_watcher_restored": true,
+  "normal_shutdown_and_startup_preserved_identity_and_consent": true,
+  "actual_standard_user_native_gui_verified": true,
+  "mapped_native_executable_protocol_library_and_engine_match_current_build": true,
+  "about_company_name_version_attribution_visible": true,
+  "about_compact_window_wrap_scroll_and_all_three_link_addresses_reachable": true,
+  "about_close_returned_to_customer_controls": true,
+  "standard_user_stop_and_resume_confirmed": true,
+  "unattended_remained_off_with_consent_revision0": true,
+  "lab_one_time_logon_restored_original_secret_registry_and_removed_cleanup_task": true,
+  "new_vm_created": false,
+  "new_native_build_for_manifest_correction": false,
+  "screenshots": [
+    {
+      "purpose": "customer-about-top-observed",
+      "sha256": "2c5d02917cac1e4074e1f423d93f2925333b64cbc1dd963f7918ba5e26464a8f"
+    },
+    {
+      "purpose": "customer-about-scroll-observed",
+      "sha256": "f9afad53f895a4cd0c6357e31510726ccfa35128d159e6328bb32bb3bf543fa6"
+    },
+    {
+      "purpose": "customer-pause-observed",
+      "sha256": "df697d0811ed4f6631437b0c2b0320c4cdb79e1a0a009ce1c000be44abe1a27f"
+    },
+    {
+      "purpose": "customer-resume-observed",
+      "sha256": "2062b59f6593bd9c95fd2ea4879135d01312ca7b1f5204194bb37a6d005cd369"
+    }
+  ],
+  "limits": [
+    "Setup/recovery/reinstall ran under SYSTEM; this is not interactive UAC installer qualification.",
+    "This covers the existing Windows10 development VM, not the final Windows compatibility matrix.",
+    "Stop/Resume was tested without an active remote session; current-candidate live-session enforcement remains separate.",
+    "Unattended opt-in/revocation, file/clipboard/multi-monitor, authorization expiry and interrupted automatic updates still require the final development-session checks.",
+    "Independent custom signed-inner EXE production, external public transport and production signing remain separate gates."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1521-independent-native-original-output-reproduction-20261104.json b/docs/evidence/1521-independent-native-original-output-reproduction-20261104.json
new file mode 100644
index 00000000000..af7c6e5e89d
--- /dev/null
+++ b/docs/evidence/1521-independent-native-original-output-reproduction-20261104.json
@@ -0,0 +1,2631 @@
+{
+  "schema": 1,
+  "source_commit": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "source_date_epoch": 1793768911,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1390,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "flutter/lib/generated_bridge.dart": "e53fdef78c7f550776df0101c8a23ce215cd857daa7bee719c1481219f919e09",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/check-service-bootstrap.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/07bb8d0-component-reproduction.json",
+        "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_backup_memory.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/linux/test_pinned_images.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/web/test-installation-status.js",
+        "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+        "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+        "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+        "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+        "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerExe.ps1",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Complete-CustomerExeUninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/Migrate-WorkerCredential.ps1",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Read-WorkerConfiguration.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restart-CustomerUi.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/Run-SetupUiTask.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/SERVICE-STARTUP.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+        "deployment/windows/a6670d6-native-independent-comparison.json",
+        "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+        "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+        "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/e95010e-first-build-and-source-verification.json",
+        "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+        "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+        "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/prepare-customer-exe.py",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/service-bootstrap-tests/CMakeLists.txt",
+        "deployment/windows/service-bootstrap-tests/core.cpp",
+        "deployment/windows/service-bootstrap-tests/main.cpp",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_exe.py",
+        "deployment/windows/test_customer_exe_native_output.ps1",
+        "deployment/windows/test_customer_exe_uninstall.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_customer_ui_restart.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_bootstrap.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_setup_ui_broker.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_download.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/test_worker_configuration.ps1",
+        "deployment/windows/verify-portable-payload.py",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_EXE_PRODUCER.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/EXPLICIT_SETUP_UI_RECOVERY.md",
+        "docs/INSTALLATION_STATUS.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE-READINESS.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "docs/evidence/07bb8d0-native-file-transfer-and-pause.json",
+        "docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json",
+        "docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json",
+        "docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json",
+        "docs/evidence/1510-installed-agent-profile-rejection-20261030.json",
+        "docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json",
+        "docs/evidence/1510-linux-authorization-negatives-20261030.json",
+        "docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json",
+        "docs/evidence/1510-linux-native-attended-session-20261030.json",
+        "docs/evidence/1510-linux-native-management-outage-recovery-20261030.json",
+        "docs/evidence/1510-native-stock-client-legacy-denial-20261030.json",
+        "docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json",
+        "docs/evidence/1510-server2025-technician-upgrade-20261030.json",
+        "docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json",
+        "docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json",
+        "docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json",
+        "docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json",
+        "docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json",
+        "docs/evidence/1511-component-priority-and-recovery-ci-20261030.json",
+        "docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json",
+        "docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json",
+        "docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json",
+        "docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json",
+        "docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json",
+        "docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json",
+        "docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json",
+        "docs/evidence/1512-independent-native-original-output-reproduction-20261031.json",
+        "docs/evidence/1512-native-and-component-build-success-20261031.json",
+        "docs/evidence/1512-recovery-principal-sid-regression-20261031.json",
+        "docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json",
+        "docs/evidence/1513-independent-native-reproduction-20261031.json",
+        "docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json",
+        "docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json",
+        "docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json",
+        "docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json",
+        "docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+        "docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json",
+        "docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json",
+        "docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json",
+        "docs/evidence/1514-native-build-and-company-bundles-20261102.json",
+        "docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json",
+        "docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json",
+        "docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json",
+        "docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json",
+        "docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json",
+        "docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json",
+        "docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json",
+        "docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json",
+        "docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json",
+        "docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json",
+        "docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json",
+        "docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json",
+        "docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json",
+        "docs/evidence/1518-native-build-and-exact-source-verification-20261103.json",
+        "docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json",
+        "docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json",
+        "docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json",
+        "docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json",
+        "docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json",
+        "docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json",
+        "docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json",
+        "docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json",
+        "docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json",
+        "docs/evidence/1519-independent-native-reproduction-20261104.json",
+        "docs/evidence/1519-native-build-and-source-verification-20261103.json",
+        "docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json",
+        "docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json",
+        "docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json",
+        "docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json",
+        "docs/evidence/159-windows-attended-lock-unlock-20261029.json",
+        "docs/evidence/159-windows-company-install-enrollment-20261029.json",
+        "docs/evidence/159-windows-native-branding-sync-20261030.json",
+        "docs/evidence/159-windows-native-clipboard-transfer-20261029.json",
+        "docs/evidence/159-windows-native-two-monitor-20261029.json",
+        "docs/evidence/159-windows-receiving-file-permission-denial-20261029.json",
+        "docs/evidence/159-windows-standard-customer-uac-20261029.json",
+        "docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json",
+        "docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-windows-checks.json",
+        "docs/evidence/1c43a38-windows-components-independent.json",
+        "docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json",
+        "docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json",
+        "docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json",
+        "docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json",
+        "docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json",
+        "docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json",
+        "docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json",
+        "docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json",
+        "docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json",
+        "docs/evidence/361d7c3-windows-transport-storage-component-checks.json",
+        "docs/evidence/3bcc884-reporting-component-checks.json",
+        "docs/evidence/3bcc884-windows-transport-server2016.json",
+        "docs/evidence/649682a-authenticated-technician-identity-component-checks.json",
+        "docs/evidence/67b5c69-company-backup-and-rollback.json",
+        "docs/evidence/67b5c69-component-reproduction.json",
+        "docs/evidence/67b5c69-native-independent-rebuild.json",
+        "docs/evidence/67b5c69-native158-runtime.json",
+        "docs/evidence/67b5c69-streamed-backup-component-checks.json",
+        "docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json",
+        "docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json",
+        "docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json",
+        "docs/evidence/a96cd4c-installation-reporting-component-checks.json",
+        "docs/evidence/aff8ff6-native159-source-verification.json",
+        "docs/evidence/aff8ff6-windows-full-deployment-export.json",
+        "docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json",
+        "docs/evidence/e47f614-compiled-sender-https.json",
+        "docs/evidence/e47f614-schema3-upgrade-and-rollback.json",
+        "docs/evidence/update-download-streaming.json",
+        "docs/evidence/windows-maintained-component-preparation.json",
+        "docs/evidence/windows-transport-database-storage-finding-20261029.json",
+        "docs/evidence/worker-private-configuration-server2016.json",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/approval_window_auto_hide.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_about_button.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/approval_window_auto_hide_test.dart",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/service_bootstrap.cpp",
+        "flutter/windows/runner/service_bootstrap.h",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/runtime_cache.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/reporting.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/backup_stream.rs",
+        "product/management/src/components.rs",
+        "product/management/src/installation_reporting.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/installation.rs",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/configuration.rs",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1390,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "flutter/lib/generated_bridge.dart": "e53fdef78c7f550776df0101c8a23ce215cd857daa7bee719c1481219f919e09",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/check-service-bootstrap.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/07bb8d0-component-reproduction.json",
+        "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_backup_memory.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/linux/test_pinned_images.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/web/test-installation-status.js",
+        "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+        "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+        "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+        "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+        "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerExe.ps1",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Complete-CustomerExeUninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/Migrate-WorkerCredential.ps1",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Read-WorkerConfiguration.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restart-CustomerUi.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/Run-SetupUiTask.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/SERVICE-STARTUP.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+        "deployment/windows/a6670d6-native-independent-comparison.json",
+        "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+        "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+        "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/e95010e-first-build-and-source-verification.json",
+        "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+        "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+        "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/prepare-customer-exe.py",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/service-bootstrap-tests/CMakeLists.txt",
+        "deployment/windows/service-bootstrap-tests/core.cpp",
+        "deployment/windows/service-bootstrap-tests/main.cpp",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_exe.py",
+        "deployment/windows/test_customer_exe_native_output.ps1",
+        "deployment/windows/test_customer_exe_uninstall.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_customer_ui_restart.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_bootstrap.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_setup_ui_broker.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_download.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/test_worker_configuration.ps1",
+        "deployment/windows/verify-portable-payload.py",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_EXE_PRODUCER.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/EXPLICIT_SETUP_UI_RECOVERY.md",
+        "docs/INSTALLATION_STATUS.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE-READINESS.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "docs/evidence/07bb8d0-native-file-transfer-and-pause.json",
+        "docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json",
+        "docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json",
+        "docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json",
+        "docs/evidence/1510-installed-agent-profile-rejection-20261030.json",
+        "docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json",
+        "docs/evidence/1510-linux-authorization-negatives-20261030.json",
+        "docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json",
+        "docs/evidence/1510-linux-native-attended-session-20261030.json",
+        "docs/evidence/1510-linux-native-management-outage-recovery-20261030.json",
+        "docs/evidence/1510-native-stock-client-legacy-denial-20261030.json",
+        "docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json",
+        "docs/evidence/1510-server2025-technician-upgrade-20261030.json",
+        "docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json",
+        "docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json",
+        "docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json",
+        "docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json",
+        "docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json",
+        "docs/evidence/1511-component-priority-and-recovery-ci-20261030.json",
+        "docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json",
+        "docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json",
+        "docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json",
+        "docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json",
+        "docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json",
+        "docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json",
+        "docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json",
+        "docs/evidence/1512-independent-native-original-output-reproduction-20261031.json",
+        "docs/evidence/1512-native-and-component-build-success-20261031.json",
+        "docs/evidence/1512-recovery-principal-sid-regression-20261031.json",
+        "docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json",
+        "docs/evidence/1513-independent-native-reproduction-20261031.json",
+        "docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json",
+        "docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json",
+        "docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json",
+        "docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json",
+        "docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+        "docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json",
+        "docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json",
+        "docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json",
+        "docs/evidence/1514-native-build-and-company-bundles-20261102.json",
+        "docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json",
+        "docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json",
+        "docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json",
+        "docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json",
+        "docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json",
+        "docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json",
+        "docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json",
+        "docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json",
+        "docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json",
+        "docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json",
+        "docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json",
+        "docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json",
+        "docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json",
+        "docs/evidence/1518-native-build-and-exact-source-verification-20261103.json",
+        "docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json",
+        "docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json",
+        "docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json",
+        "docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json",
+        "docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json",
+        "docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json",
+        "docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json",
+        "docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json",
+        "docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json",
+        "docs/evidence/1519-independent-native-reproduction-20261104.json",
+        "docs/evidence/1519-native-build-and-source-verification-20261103.json",
+        "docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json",
+        "docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json",
+        "docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json",
+        "docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json",
+        "docs/evidence/159-windows-attended-lock-unlock-20261029.json",
+        "docs/evidence/159-windows-company-install-enrollment-20261029.json",
+        "docs/evidence/159-windows-native-branding-sync-20261030.json",
+        "docs/evidence/159-windows-native-clipboard-transfer-20261029.json",
+        "docs/evidence/159-windows-native-two-monitor-20261029.json",
+        "docs/evidence/159-windows-receiving-file-permission-denial-20261029.json",
+        "docs/evidence/159-windows-standard-customer-uac-20261029.json",
+        "docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json",
+        "docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-windows-checks.json",
+        "docs/evidence/1c43a38-windows-components-independent.json",
+        "docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json",
+        "docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json",
+        "docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json",
+        "docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json",
+        "docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json",
+        "docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json",
+        "docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json",
+        "docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json",
+        "docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json",
+        "docs/evidence/361d7c3-windows-transport-storage-component-checks.json",
+        "docs/evidence/3bcc884-reporting-component-checks.json",
+        "docs/evidence/3bcc884-windows-transport-server2016.json",
+        "docs/evidence/649682a-authenticated-technician-identity-component-checks.json",
+        "docs/evidence/67b5c69-company-backup-and-rollback.json",
+        "docs/evidence/67b5c69-component-reproduction.json",
+        "docs/evidence/67b5c69-native-independent-rebuild.json",
+        "docs/evidence/67b5c69-native158-runtime.json",
+        "docs/evidence/67b5c69-streamed-backup-component-checks.json",
+        "docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json",
+        "docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json",
+        "docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json",
+        "docs/evidence/a96cd4c-installation-reporting-component-checks.json",
+        "docs/evidence/aff8ff6-native159-source-verification.json",
+        "docs/evidence/aff8ff6-windows-full-deployment-export.json",
+        "docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json",
+        "docs/evidence/e47f614-compiled-sender-https.json",
+        "docs/evidence/e47f614-schema3-upgrade-and-rollback.json",
+        "docs/evidence/update-download-streaming.json",
+        "docs/evidence/windows-maintained-component-preparation.json",
+        "docs/evidence/windows-transport-database-storage-finding-20261029.json",
+        "docs/evidence/worker-private-configuration-server2016.json",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/approval_window_auto_hide.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_about_button.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/approval_window_auto_hide_test.dart",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/service_bootstrap.cpp",
+        "flutter/windows/runner/service_bootstrap.h",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/runtime_cache.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/reporting.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/backup_stream.rs",
+        "product/management/src/components.rs",
+        "product/management/src/installation_reporting.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/installation.rs",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/configuration.rs",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37824.6",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37824.6",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.21-customer-x64-unsigned.msi",
+      "first_sha256": "b392bd52c4a2dc6d83e70fff02999bb3249137df8b58bbdc9c058756cbf4d866",
+      "second_sha256": "b392bd52c4a2dc6d83e70fff02999bb3249137df8b58bbdc9c058756cbf4d866",
+      "first_bytes": 34045952,
+      "second_bytes": 34045952,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.21-technician-x64-unsigned.exe",
+      "first_sha256": "2c09169c126ec215093ff3e4aaa90358e73fd3dfb7631772ae942c4ccb504cea",
+      "second_sha256": "2c09169c126ec215093ff3e4aaa90358e73fd3dfb7631772ae942c4ccb504cea",
+      "first_bytes": 24286720,
+      "second_bytes": 24286720,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.21-technician-x64-unsigned.msi",
+      "first_sha256": "0275afe7b1e9e3d651d79ffa523493a167f3b13590f5f7f1341abe169c2a30bb",
+      "second_sha256": "0275afe7b1e9e3d651d79ffa523493a167f3b13590f5f7f1341abe169c2a30bb",
+      "first_bytes": 31780864,
+      "second_bytes": 31780864,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.21-x64-unsigned-install.exe",
+      "first_sha256": "2c09169c126ec215093ff3e4aaa90358e73fd3dfb7631772ae942c4ccb504cea",
+      "second_sha256": "2c09169c126ec215093ff3e4aaa90358e73fd3dfb7631772ae942c4ccb504cea",
+      "first_bytes": 24286720,
+      "second_bytes": 24286720,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "60a96e6706924747a953506ac2193bc28ab992d9b4dccfb34edaee40c001b0cf",
+      "second_sha256": "60a96e6706924747a953506ac2193bc28ab992d9b4dccfb34edaee40c001b0cf",
+      "first_bytes": 65882112,
+      "second_bytes": 65882112,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+      "second_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+      "first_bytes": 5862912,
+      "second_bytes": 5862912,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "aa2d3741ac3d9e5286cbf67e734b4c7f3ec3ed15f982926adb467d8a2f194751",
+      "second_sha256": "aa2d3741ac3d9e5286cbf67e734b4c7f3ec3ed15f982926adb467d8a2f194751",
+      "first_bytes": 9131520,
+      "second_bytes": 9131520,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+      "second_sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+      "first_bytes": 4901376,
+      "second_bytes": 4901376,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "recorded_utc": "2026-11-04T13:24:34.008301+00:00",
+  "builds": [
+    {
+      "workflow_run": 41779406214,
+      "artifact": 13300964955,
+      "archive_digest": "sha256:982b9fac815804284477d5cf0d81b22537eba2ceaa36ab22959ec9f7c6da0612",
+      "bytes": 256584355
+    },
+    {
+      "workflow_run": 41798526036,
+      "artifact": 13310392773,
+      "archive_digest": "sha256:0571a54536750c4b24b04f7829a60ccde075664012b08af906151f201026b35a",
+      "bytes": 256584005
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/1521-native-direct-ip-denial-and-preservation-20261105.json b/docs/evidence/1521-native-direct-ip-denial-and-preservation-20261105.json
new file mode 100644
index 00000000000..1fa936e70af
--- /dev/null
+++ b/docs/evidence/1521-native-direct-ip-denial-and-preservation-20261105.json
@@ -0,0 +1,67 @@
+{
+  "test_date_local": "2026-11-05",
+  "timezone": "Africa/Johannesburg",
+  "utc": "2026-11-04T23:48:30.988807+00:00",
+  "native_source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "version": "1.5.21+89",
+  "scope": "Real direct TCP/protobuf login to installed Windows10 customer through owned loopback forward, with receiving listener temporarily enabled; no company credentials or grant supplied.",
+  "wire_result": {
+    "utc": "2026-11-04T23:32:45.634107+00:00",
+    "native_source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+    "version": "1.5.21+89",
+    "actual_receiving_windows_service": true,
+    "temporary_direct_listener_enabled_for_protocol_test": true,
+    "fresh_native_hash_challenge_received": true,
+    "legacy_password_hash_shaped_from_fresh_challenge": true,
+    "company_credential_or_grant_supplied": false,
+    "actual_native_login_response": "Company session authorization denied",
+    "unauthorized_peer_info_received": false,
+    "response_sha256": "6ed49941fefda2869dd28d4c7bea19c9fd5bf3389352a760a4af10de7b4f4da1",
+    "test_client": "Minimal real TCP/protobuf client; actual installed receiver and company authorization code, no mocked endpoint",
+    "schema_sha256": "a6cd38ffe05f367c8d7bfc2cc03f774f9d08a4078896e62b801f4bb68943b5d6",
+    "framing_source_sha256": "ed5691a29df5db54716e3d5cb065479ad118a5038c35586cad1f703aa4559c47",
+    "stock_graphical_client_result_claimed": false,
+    "full_windows_matrix_qualified": false,
+    "production_publication": false
+  },
+  "company_grants_created_during_controls": 0,
+  "controls_enrolled": false,
+  "company_profile_revision": 44,
+  "automatic_updates_paused": true,
+  "customer_preservation": {
+    "direct_listener_absent": true,
+    "fallback_task_removed": true,
+    "identity_credential_consent_and_trust_preserved": true,
+    "original_native21_hash_preserved": true
+  },
+  "technician_preservation": {
+    "identity_credential_consent_and_trust_preserved": true,
+    "stock_control_not_running": true,
+    "original_native21_hash_preserved": true
+  },
+  "cleanup": {
+    "utc": "2026-11-04T23:39:15.403185+00:00",
+    "owned_stock_processes_stopped": true,
+    "original_direct_option_restored": true,
+    "native_direct_listener_absent": true,
+    "owned_loopback_forward_removed": true,
+    "no_vm_or_company_service_restarted": true
+  },
+  "stock_graphical_control_result": "Inconclusive: window remained black; isolated control processes stopped, files retained. Not claimed as a graphical denial pass.",
+  "historical_stock_id_connection_denial": {
+    "source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+    "receipt": "1510-native-stock-client-legacy-denial-20261030.json",
+    "unchanged_receiving_source_git_blob_sha256": {
+      "src/managed.rs": "e08c28f7496a07d2f8790d8fded75152386b011ef3fed39530bd47d0aebc8e9f",
+      "src/server/connection.rs": "df3b92623369101f6a1949df0027ea5a182f2224f3529403b28e4fd750c1fdee",
+      "src/server.rs": "32c5485c59ef2d5d1be149ffbce0a4c7176cb1a7dbed55ac763ecfed93325176",
+      "src/rendezvous_mediator.rs": "6f9f02a663f2c7ad8169eedd859c31bf3aa97803c97906e0a9c8130e30b0eee1",
+      "product/agent/src/lib.rs": "45df5a819510b193658428c0c07eb2eeb0b7c55e9e5632d1f7a2ce95625e9484",
+      "product/protocol/src/lib.rs": "e4a1fd4c42f80264c020d6417ed88bd77e5cc411d5e33c0e1eb61e6db9964723"
+    },
+    "current_graphical_id_connection_retested": false
+  },
+  "full_windows_matrix_qualified": false,
+  "external_public_connectivity_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json b/docs/evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json
new file mode 100644
index 00000000000..101dbed38ff
--- /dev/null
+++ b/docs/evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json
@@ -0,0 +1,97 @@
+{
+  "test_date_local": "2026-11-05",
+  "timezone": "Africa/Johannesburg",
+  "native_source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "version": "1.5.21+89",
+  "environment": {
+    "customer": "Existing Windows 10 Pro x64 build 19045",
+    "technician": "Existing Windows Server 2022 Desktop Experience x64 build 20348",
+    "company_server": "Existing isolated Linux company deployment",
+    "both_windows_accounts_standard": true,
+    "new_vm_or_disk_created": false,
+    "unattended_consent_off": true
+  },
+  "initial_attended_session": {
+    "native_mfa_and_authorized_inventory_observed": true,
+    "named_customer_approval_prompt_observed": true,
+    "customer_accept_clicked": true,
+    "native_remote_desktop_rendered": true,
+    "target_and_technician_bound_to_preflight": true,
+    "server_claimed": true,
+    "server_lease_unexpired": true
+  },
+  "interruption_and_recovery": {
+    "utc": "2026-11-04T22:53:26.254208+00:00",
+    "source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+    "version": "1.5.21+89",
+    "source_file": {
+      "sha256": "920c38da8a311f4e42066cb61f336247245b152f8abdb307ec0c93f1baa5c622",
+      "name": "interruption-random-256MiB.bin",
+      "bytes": 268435456
+    },
+    "received": {
+      "verifier_did_not_copy_files": true,
+      "sidecars_absent": true,
+      "utc": "2026-11-04T22:53:24.8427842Z",
+      "bytes": 268435456,
+      "sha256": "920c38da8a311f4e42066cb61f336247245b152f8abdb307ec0c93f1baa5c622"
+    },
+    "virtual_network_down_utc": "2026-11-04T22:48:35.318138+00:00",
+    "virtual_network_restored_utc": "2026-11-04T22:49:20.396273+00:00",
+    "partial_bytes_observed_before_interruption": 3014656,
+    "original_transfer_ui_observed_incomplete_at_41_percent": true,
+    "desktop_and_file_reapproval_prompts_arrived": true,
+    "desktop_accepted_first_with_file_request_pending": true,
+    "pending_consent_window_stayed_visible": true,
+    "manual_taskbar_restoration": false,
+    "original_transfer_window_completed_after_explicit_reapproval": true,
+    "fresh_send_or_user_transfer_retry": false,
+    "vm_app_or_service_restart_after_transfer_started": false,
+    "exact_resume_offset_independently_measured": false,
+    "full_windows_matrix_qualified": false,
+    "public_internet_transport_qualified": false,
+    "production_publication": false
+  },
+  "customer_stop": {
+    "utc": "2026-11-04T22:57:08.628906+00:00",
+    "version": "1.5.21+89",
+    "actual_standard_customer_stop": true,
+    "previously_live_claimed_desktop_and_file_sessions": 2,
+    "both_same_server_records_closed": true,
+    "device_approval_preserved": true,
+    "unattended_consent_off": true,
+    "observer_did_not_close_sessions": true,
+    "production_publication": false
+  },
+  "native_technician_history": {
+    "utc": "2026-11-04T23:03:40.635Z",
+    "version": "1.5.21+89",
+    "native_session_history_visible": true,
+    "target": "SWAN-C10-18",
+    "current_desktop_and_file_sessions_display_closed": true,
+    "older_interrupted_sessions_display_ended": true,
+    "standard_technician_account": true
+  },
+  "locally_archived_screenshot_sha256": {
+    "customer-attended-request.jpg": "1e3db67c4347379a2785758e7d828c3774b8dba602106943f46ca0d62135e201",
+    "transfer-interrupted-awaiting-reapproval.jpg": "0b9841d84d376c7b1fa742c27d3d869caad4868485537245c8789033ee925e63",
+    "desktop-accepted-file-pending-window-visible.jpg": "8e5d6813741622aa9dcae0b5d2c79f9da64b0f318cbe6263cd4600b9f7c963e4",
+    "file-prompt-visible-after-desktop-accept.jpg": "569bd5f4cfe21985b212264260f4a33fbde1b2b3ce3c49db722c11db837711f9",
+    "original-transfer-finished.jpg": "364931044add6dc53d1ef2ccf19793a063a55654c4c158f8f16f0d3b260d02d6",
+    "customer-stop-live-sessions.jpg": "751e24bf4480dde450e2cadb350538e3cb1d1e66501bce30ebac4f86e8e2dbe4",
+    "technician-authorization-revoked-after-customer-stop.jpg": "105aeccf163d511f10094b85b20c28c198652d4a25379623ae42b0c0aea4fe83",
+    "technician-desktop-closed-by-customer.jpg": "bb978c2bf3eef93895a111f0cd2d37acddb65cb43f13962a30ea884f139eaf97",
+    "technician-current-session-history.jpg": "d1a3df608afd1b3864f35cdca49c34708a8b85bbdb790b766c59c3fd63c74790"
+  },
+  "qualification": {
+    "pending_consent_visibility_regression_passed": true,
+    "same_original_256mib_transfer_completed_after_reapproval": true,
+    "exact_resume_offset_independently_measured": false,
+    "exact_live_30_second_send_timeout_independently_measured": false,
+    "clipboard_uac_or_multiple_monitors_retested_here": false,
+    "automatic_update_retested_here": false,
+    "full_windows_matrix_qualified": false,
+    "external_public_connectivity_qualified": false,
+    "production_publication": false
+  }
+}
diff --git a/docs/evidence/1521-standard-technician-upgrade-about-mfa-20261104.json b/docs/evidence/1521-standard-technician-upgrade-about-mfa-20261104.json
new file mode 100644
index 00000000000..855e61792bb
--- /dev/null
+++ b/docs/evidence/1521-standard-technician-upgrade-about-mfa-20261104.json
@@ -0,0 +1,47 @@
+{
+  "recorded_utc": "2026-11-04T13:50:45.209682+00:00",
+  "source": "bd331cad1dbe4c45722690c7df70c863a7bd37b5",
+  "version": "1.5.21+89",
+  "os_build": "20348",
+  "edition": "technician",
+  "format": "exe",
+  "previous_release_sequence": 24,
+  "installed_release_sequence": 26,
+  "actual_standard_user_upgrade_passed": true,
+  "identity_token_and_bootstrap_preserved": true,
+  "shipping_installed_verifier_passed": true,
+  "mapped_native_and_libraries_match_primary_build": true,
+  "installed_signed_outer_sha256": "72801ce022644835f228650451e81a062511d3fa92bd73e7fd62a654a0a8326c",
+  "installed_signed_agent_sha256": "6fad3a92f36d632ed2177e9131da4e072b6622b1f17692609375af05ce9c18d7",
+  "native_about_before_login_passed": true,
+  "about_company_name_version_attribution_and_source_links_visible": true,
+  "about_close_returned_to_login": true,
+  "actual_native_mfa_login_and_authorized_inventory_passed": true,
+  "native_sign_out_clears_password_and_mfa": true,
+  "signed_company_profile_revision": 44,
+  "automatic_updates_paused": true,
+  "lab_logon_fixture_original_secret_and_settings_restored": true,
+  "lab_display_policy_restored": true,
+  "new_vm_created": false,
+  "screenshots": [
+    {
+      "purpose": "about",
+      "sha256": "c1afc0145a0cc3739d7ad48ab694e56845c67f34258b1ab5511de0717eb28dd3"
+    },
+    {
+      "purpose": "inventory",
+      "sha256": "9f19b81c21d78c177b9323ece0cb63450b65ae83428713723a62e1746eda68de"
+    },
+    {
+      "purpose": "signed_out",
+      "sha256": "9fda36a20493a61dd4cddc148e006a20f6051d5f16e0a0033347ba5710e4c785"
+    }
+  ],
+  "limits": [
+    "This is focused development verification on the existing test pair; no full Windows matrix is claimed.",
+    "The current customer shipping uninstall correction is not qualified by this technician result.",
+    "Session history, current-candidate desktop-session features, update recovery, external transport and production signing remain separate gates.",
+    "The About dialog was verified in the supported normal window; a smaller-than-minimum layout is not qualified."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/1522-fresh-x64-independent-comparison-20261106.json b/docs/evidence/1522-fresh-x64-independent-comparison-20261106.json
new file mode 100644
index 00000000000..7eae553ff25
--- /dev/null
+++ b/docs/evidence/1522-fresh-x64-independent-comparison-20261106.json
@@ -0,0 +1,2728 @@
+{
+  "schema": 1,
+  "source_commit": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "source_date_epoch": 1793884038,
+  "source_proofs": [
+    {
+      "tracked_files_verified": 1421,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "flutter/lib/generated_bridge.dart": "e53fdef78c7f550776df0101c8a23ce215cd857daa7bee719c1481219f919e09",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "client_wrapper_patch_input": {
+        "script_sha256": "b23092718eb4bd89f9173541d63266790baf76e4b4f48883881ba9aa238364a5",
+        "patched_source_sha256": "4ecdd3b3ace7672043ffbcddd157324915f21854d2c7885cbdaf73fdac6731a0",
+        "original_canonical_sha256": "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/aom-repro-diagnostic.yml",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/check-service-bootstrap.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/msvc-determinism.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/07bb8d0-component-reproduction.json",
+        "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_backup_memory.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/linux/test_pinned_images.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/web/test-installation-status.js",
+        "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+        "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+        "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+        "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+        "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerExe.ps1",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Capture-NativeAomInputs.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Complete-CustomerExeUninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Diagnose-AomObject.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/Migrate-WorkerCredential.ps1",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Read-WorkerConfiguration.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restart-CustomerUi.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/Run-SetupUiTask.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/SERVICE-STARTUP.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+        "deployment/windows/a6670d6-native-independent-comparison.json",
+        "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+        "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+        "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/e95010e-first-build-and-source-verification.json",
+        "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+        "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+        "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+        "deployment/windows/emit-flutter-reply-fixture.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/fixtures/flutter_reply_handler.cpp.in",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/patch-flutter-client-wrapper.py",
+        "deployment/windows/prepare-customer-exe.py",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/service-bootstrap-tests/CMakeLists.txt",
+        "deployment/windows/service-bootstrap-tests/core.cpp",
+        "deployment/windows/service-bootstrap-tests/main.cpp",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-network-probe.js",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_exe.py",
+        "deployment/windows/test_customer_exe_native_output.ps1",
+        "deployment/windows/test_customer_exe_uninstall.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_customer_ui_restart.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_client_wrapper.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_msvc_determinism.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_network_probe.ps1",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_bootstrap.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_setup_ui_broker.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_download.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/test_worker_configuration.ps1",
+        "deployment/windows/verify-portable-payload.py",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_EXE_PRODUCER.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/EXPLICIT_SETUP_UI_RECOVERY.md",
+        "docs/INSTALLATION_STATUS.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK-CHECK.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE-READINESS.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "docs/evidence/07bb8d0-native-file-transfer-and-pause.json",
+        "docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json",
+        "docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json",
+        "docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json",
+        "docs/evidence/1510-installed-agent-profile-rejection-20261030.json",
+        "docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json",
+        "docs/evidence/1510-linux-authorization-negatives-20261030.json",
+        "docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json",
+        "docs/evidence/1510-linux-native-attended-session-20261030.json",
+        "docs/evidence/1510-linux-native-management-outage-recovery-20261030.json",
+        "docs/evidence/1510-native-stock-client-legacy-denial-20261030.json",
+        "docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json",
+        "docs/evidence/1510-server2025-technician-upgrade-20261030.json",
+        "docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json",
+        "docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json",
+        "docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json",
+        "docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json",
+        "docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json",
+        "docs/evidence/1511-component-priority-and-recovery-ci-20261030.json",
+        "docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json",
+        "docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json",
+        "docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json",
+        "docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json",
+        "docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json",
+        "docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json",
+        "docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json",
+        "docs/evidence/1512-independent-native-original-output-reproduction-20261031.json",
+        "docs/evidence/1512-native-and-component-build-success-20261031.json",
+        "docs/evidence/1512-recovery-principal-sid-regression-20261031.json",
+        "docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json",
+        "docs/evidence/1513-independent-native-reproduction-20261031.json",
+        "docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json",
+        "docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json",
+        "docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json",
+        "docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json",
+        "docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+        "docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json",
+        "docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json",
+        "docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json",
+        "docs/evidence/1514-native-build-and-company-bundles-20261102.json",
+        "docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json",
+        "docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json",
+        "docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json",
+        "docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json",
+        "docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json",
+        "docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json",
+        "docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json",
+        "docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json",
+        "docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json",
+        "docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json",
+        "docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json",
+        "docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json",
+        "docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json",
+        "docs/evidence/1518-native-build-and-exact-source-verification-20261103.json",
+        "docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json",
+        "docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json",
+        "docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json",
+        "docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json",
+        "docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json",
+        "docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json",
+        "docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json",
+        "docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json",
+        "docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json",
+        "docs/evidence/1519-independent-native-reproduction-20261104.json",
+        "docs/evidence/1519-native-build-and-source-verification-20261103.json",
+        "docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json",
+        "docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json",
+        "docs/evidence/1521-current-build-and-company-packages-20261104.json",
+        "docs/evidence/1521-customer-exe30-lab-manifest-pairing-failure-20261104.json",
+        "docs/evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json",
+        "docs/evidence/1521-independent-native-original-output-reproduction-20261104.json",
+        "docs/evidence/1521-native-direct-ip-denial-and-preservation-20261105.json",
+        "docs/evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json",
+        "docs/evidence/1521-standard-technician-upgrade-about-mfa-20261104.json",
+        "docs/evidence/1522-management-reproduction-upgrade-and-probe-20261105.json",
+        "docs/evidence/1522-msvc-lambda-path-controls-20261105.json",
+        "docs/evidence/1522-named-wrapper-primary-build-20261105.json",
+        "docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json",
+        "docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json",
+        "docs/evidence/159-windows-attended-lock-unlock-20261029.json",
+        "docs/evidence/159-windows-company-install-enrollment-20261029.json",
+        "docs/evidence/159-windows-native-branding-sync-20261030.json",
+        "docs/evidence/159-windows-native-clipboard-transfer-20261029.json",
+        "docs/evidence/159-windows-native-two-monitor-20261029.json",
+        "docs/evidence/159-windows-receiving-file-permission-denial-20261029.json",
+        "docs/evidence/159-windows-standard-customer-uac-20261029.json",
+        "docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json",
+        "docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-windows-checks.json",
+        "docs/evidence/1c43a38-windows-components-independent.json",
+        "docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json",
+        "docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json",
+        "docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json",
+        "docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json",
+        "docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json",
+        "docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json",
+        "docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json",
+        "docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json",
+        "docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json",
+        "docs/evidence/361d7c3-windows-transport-storage-component-checks.json",
+        "docs/evidence/3bcc884-reporting-component-checks.json",
+        "docs/evidence/3bcc884-windows-transport-server2016.json",
+        "docs/evidence/649682a-authenticated-technician-identity-component-checks.json",
+        "docs/evidence/67b5c69-company-backup-and-rollback.json",
+        "docs/evidence/67b5c69-component-reproduction.json",
+        "docs/evidence/67b5c69-native-independent-rebuild.json",
+        "docs/evidence/67b5c69-native158-runtime.json",
+        "docs/evidence/67b5c69-streamed-backup-component-checks.json",
+        "docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json",
+        "docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json",
+        "docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json",
+        "docs/evidence/a96cd4c-installation-reporting-component-checks.json",
+        "docs/evidence/aff8ff6-native159-source-verification.json",
+        "docs/evidence/aff8ff6-windows-full-deployment-export.json",
+        "docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json",
+        "docs/evidence/company-network-probe-development-20261105.json",
+        "docs/evidence/e47f614-compiled-sender-https.json",
+        "docs/evidence/e47f614-schema3-upgrade-and-rollback.json",
+        "docs/evidence/network-probe-windows-der-finding-and-fix-20261105.json",
+        "docs/evidence/network-probe-windows-port-reservation-control-20261105.json",
+        "docs/evidence/update-download-streaming.json",
+        "docs/evidence/windows-maintained-component-preparation.json",
+        "docs/evidence/windows-transport-database-storage-finding-20261029.json",
+        "docs/evidence/worker-private-configuration-server2016.json",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/approval_window_auto_hide.dart",
+        "flutter/lib/common/company_window_title.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_about_button.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/approval_window_auto_hide_test.dart",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/company_window_title_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/service_bootstrap.cpp",
+        "flutter/windows/runner/service_bootstrap.h",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/runtime_cache.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/reporting.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/backup_stream.rs",
+        "product/management/src/components.rs",
+        "product/management/src/installation_reporting.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/network_probe.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/installation.rs",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/configuration.rs",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    },
+    {
+      "tracked_files_verified": 1421,
+      "bridge_hashes": {
+        "flutter/ios/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "flutter/lib/generated_bridge.dart": "e53fdef78c7f550776df0101c8a23ce215cd857daa7bee719c1481219f919e09",
+        "flutter/lib/generated_bridge.freezed.dart": "06ab02a3cb491c965860a5364d3230e4969134ec0294fef5abde7c3b13575613",
+        "flutter/macos/Runner/bridge_generated.h": "c57eee2ab7bf2466f2d404bf33aa2362d590877154c0fb607b2fcf60dd35d665",
+        "src/bridge_generated.io.rs": "b4ac7aaecea8d2f51f23950792030ccc66f01d3676640d8091b828a5895aa66f",
+        "src/bridge_generated.rs": "b14a876e159eba96f8964329b9abee0afe449a9e28daeb381fb74075714fa425"
+      },
+      "client_wrapper_patch_input": {
+        "script_sha256": "b23092718eb4bd89f9173541d63266790baf76e4b4f48883881ba9aa238364a5",
+        "patched_source_sha256": "4ecdd3b3ace7672043ffbcddd157324915f21854d2c7885cbdaf73fdac6731a0",
+        "original_canonical_sha256": "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989"
+      },
+      "declared_source_text_checkout_conversions": [
+        ".cargo/config.toml",
+        ".dockerignore",
+        ".gitattributes",
+        ".github/FUNDING.yml",
+        ".github/ISSUE_TEMPLATE/bug_report.yaml",
+        ".github/ISSUE_TEMPLATE/config.yml",
+        ".github/dependabot.yml",
+        ".github/patches/apply_flutter_3.44_source_patches.sh",
+        ".github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff",
+        ".github/workflows/aom-repro-diagnostic.yml",
+        ".github/workflows/bridge.yml",
+        ".github/workflows/check-service-bootstrap.yml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/clear-cache.yml",
+        ".github/workflows/company-product.yml",
+        ".github/workflows/compare-native-builds.yml",
+        ".github/workflows/fdroid.yml",
+        ".github/workflows/flutter-build.yml",
+        ".github/workflows/flutter-ci.yml",
+        ".github/workflows/flutter-nightly.yml",
+        ".github/workflows/flutter-tag.yml",
+        ".github/workflows/msvc-determinism.yml",
+        ".github/workflows/playground.yml",
+        ".github/workflows/portable-install-wait.yml",
+        ".github/workflows/swan-transport.yml",
+        ".github/workflows/swan-windows-build.yml",
+        ".github/workflows/third-party-RustDeskTempTopMostWindow.yml",
+        ".github/workflows/wf-cliprdr-ci.yml",
+        ".gitignore",
+        ".gitmodules",
+        "AGENTS.md",
+        "CLAUDE.md",
+        "Cargo.lock",
+        "Cargo.toml",
+        "Dockerfile",
+        "GEMINI.md",
+        "LICENCE",
+        "README.md",
+        "SECURITY.md",
+        "appimage/AppImageBuilder-aarch64.yml",
+        "appimage/AppImageBuilder-x86_64.yml",
+        "branding/swan-logo-dark.svg",
+        "branding/swan-logo-light.svg",
+        "branding/swan-mark.svg",
+        "branding/swan-support-mark.svg",
+        "build.py",
+        "build.rs",
+        "config/tailscale-swan-policy.example.json",
+        "deployment/linux/07bb8d0-component-reproduction.json",
+        "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+        "deployment/linux/Caddyfile",
+        "deployment/linux/Dockerfile",
+        "deployment/linux/Dockerfile.dockerignore",
+        "deployment/linux/README.md",
+        "deployment/linux/automatic-branding-sync-evidence.json",
+        "deployment/linux/company-full-backup-restore-evidence.json",
+        "deployment/linux/company-worker-bundle-evidence.json",
+        "deployment/linux/company.env.example",
+        "deployment/linux/compose.maintained-transport.yaml",
+        "deployment/linux/compose.yaml",
+        "deployment/linux/customer-offline-controls-evidence.json",
+        "deployment/linux/export_transport_candidate.py",
+        "deployment/linux/fresh-company-lab-evidence.json",
+        "deployment/linux/generated-customer-enrollment-evidence.json",
+        "deployment/linux/generated-technician-setup-evidence.json",
+        "deployment/linux/installed-profile-key-rotation-evidence.json",
+        "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+        "deployment/linux/native-technician-interface-evidence.json",
+        "deployment/linux/native-unattended-consent-evidence.json",
+        "deployment/linux/pre-153-company-backup-restore-evidence.json",
+        "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+        "deployment/linux/technician-authorization-evidence.json",
+        "deployment/linux/test_backup_memory.py",
+        "deployment/linux/test_build_context.py",
+        "deployment/linux/test_container_stack.py",
+        "deployment/linux/test_container_startup.py",
+        "deployment/linux/test_pinned_images.py",
+        "deployment/transport-source.json",
+        "deployment/web/test-company-setup.js",
+        "deployment/web/test-installation-status.js",
+        "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+        "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+        "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+        "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+        "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+        "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+        "deployment/windows/7bfce49-native-independent-comparison.json",
+        "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+        "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+        "deployment/windows/9ba592c-company-bundles-evidence.json",
+        "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+        "deployment/windows/9ba592c-native-independent-comparison.json",
+        "deployment/windows/9ba592c-native-source-evidence.json",
+        "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+        "deployment/windows/9ba592c-technician-startup-failure.json",
+        "deployment/windows/Build-CustomerExe.ps1",
+        "deployment/windows/Build-CustomerMsi.ps1",
+        "deployment/windows/Build-ServerSetup.ps1",
+        "deployment/windows/Build-TechnicianMsi.ps1",
+        "deployment/windows/COMPANY-SIGNING.md",
+        "deployment/windows/CUSTOMER-MSI.md",
+        "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+        "deployment/windows/Capture-NativeAomInputs.ps1",
+        "deployment/windows/Commit-Uninstall.ps1",
+        "deployment/windows/Complete-CustomerExeUninstall.ps1",
+        "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+        "deployment/windows/Diagnose-AomObject.ps1",
+        "deployment/windows/Expand-ServerCompiler.ps1",
+        "deployment/windows/Expand-ServerReferences.ps1",
+        "deployment/windows/Expand-WixBuildTools.ps1",
+        "deployment/windows/Get-MsiIdentity.ps1",
+        "deployment/windows/Get-MsiInstallMode.ps1",
+        "deployment/windows/Get-MsiProductCode.ps1",
+        "deployment/windows/Get-PinnedArchive.ps1",
+        "deployment/windows/Get-ServerRemovalPlan.ps1",
+        "deployment/windows/Get-WindowsCompatibility.ps1",
+        "deployment/windows/Install-Company.ps1",
+        "deployment/windows/Install-Server.ps1",
+        "deployment/windows/Install-SwanRemoteSupport.cmd",
+        "deployment/windows/Install-Worker.ps1",
+        "deployment/windows/LOCAL-TESTING.md",
+        "deployment/windows/Migrate-WorkerCredential.ps1",
+        "deployment/windows/New-LocalTestVm.ps1",
+        "deployment/windows/New-TestVm.ps1",
+        "deployment/windows/Open-Technician.ps1",
+        "deployment/windows/Prepare-CustomerDirectory.ps1",
+        "deployment/windows/Prepare-ServerComponents.ps1",
+        "deployment/windows/Read-WorkerConfiguration.ps1",
+        "deployment/windows/Record-MsvcToolchain.ps1",
+        "deployment/windows/Remove-Configuration.ps1",
+        "deployment/windows/Restart-Configuration.ps1",
+        "deployment/windows/Restart-CustomerUi.ps1",
+        "deployment/windows/Restore-Configuration.ps1",
+        "deployment/windows/Restore-CustomerExe.ps1",
+        "deployment/windows/Restore-ReleaseMsi.ps1",
+        "deployment/windows/Run-SetupUiTask.ps1",
+        "deployment/windows/SERVER-COMPONENTS.md",
+        "deployment/windows/SERVICE-STARTUP.md",
+        "deployment/windows/ServerSetupLauncher.cs",
+        "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+        "deployment/windows/Setup-Server.ps1",
+        "deployment/windows/Sign-CompanyArtifact.ps1",
+        "deployment/windows/Start-LocalTest.ps1",
+        "deployment/windows/Start-TestVm.ps1",
+        "deployment/windows/TECHNICIAN-MSI.md",
+        "deployment/windows/Test-DisposableMsi.ps1",
+        "deployment/windows/UPDATE-RECOVERY.md",
+        "deployment/windows/Uninstall-Server.ps1",
+        "deployment/windows/Uninstall-Technician.ps1",
+        "deployment/windows/Uninstall-Worker.ps1",
+        "deployment/windows/Update-RecoveryTask.ps1",
+        "deployment/windows/Update-UninstallCancellation.ps1",
+        "deployment/windows/VM-TESTING.md",
+        "deployment/windows/Verify-MsiRegistration.ps1",
+        "deployment/windows/Verify-Package.ps1",
+        "deployment/windows/WORKER.md",
+        "deployment/windows/a1d67be-native-build-evidence.json",
+        "deployment/windows/a1d67be-native-independent-comparison.json",
+        "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+        "deployment/windows/a6670d6-native-independent-comparison.json",
+        "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+        "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+        "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+        "deployment/windows/archive-build-source.py",
+        "deployment/windows/compare-native-builds.py",
+        "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+        "deployment/windows/cpp-path-probe-d93b067-observations.json",
+        "deployment/windows/cpp-toolchain-ordinal-validation.json",
+        "deployment/windows/d74a631-native-build-evidence.json",
+        "deployment/windows/da0c621-lab-distribution-evidence.json",
+        "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+        "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+        "deployment/windows/da0c621-server22-standard-batch-failure.json",
+        "deployment/windows/da0c621-server25-company-technician-evidence.json",
+        "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+        "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+        "deployment/windows/da0c621-win10-bounded-evidence.json",
+        "deployment/windows/da0c621-win10-company-customer-evidence.json",
+        "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+        "deployment/windows/e95010e-first-build-and-source-verification.json",
+        "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+        "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+        "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+        "deployment/windows/emit-flutter-reply-fixture.py",
+        "deployment/windows/engine-05d5369-reproducibility.json",
+        "deployment/windows/fixtures/flutter_reply_handler.cpp.in",
+        "deployment/windows/generate-customer-msi.py",
+        "deployment/windows/generate-payload-manifest.py",
+        "deployment/windows/install-pinned-flutter.ps1",
+        "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+        "deployment/windows/local-https.js",
+        "deployment/windows/local-test.env.example",
+        "deployment/windows/msi/Technician.wxs",
+        "deployment/windows/native-49ced68-rebuild-comparison.json",
+        "deployment/windows/native-4c5accb-rebuild-comparison.json",
+        "deployment/windows/native-699c9e0-rebuild-comparison.json",
+        "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+        "deployment/windows/native-d8fad20-rebuild-comparison.json",
+        "deployment/windows/native-da0c621-rebuild-comparison.json",
+        "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+        "deployment/windows/native-f84ffb0-toolchain-observations.json",
+        "deployment/windows/patch-flutter-client-wrapper.py",
+        "deployment/windows/prepare-customer-exe.py",
+        "deployment/windows/select-engine-candidate.py",
+        "deployment/windows/server-compiler.json",
+        "deployment/windows/server-components.json",
+        "deployment/windows/server-references.json",
+        "deployment/windows/server19-company-peer-https-evidence.json",
+        "deployment/windows/service-bootstrap-tests/CMakeLists.txt",
+        "deployment/windows/service-bootstrap-tests/core.cpp",
+        "deployment/windows/service-bootstrap-tests/main.cpp",
+        "deployment/windows/test-company-lifecycle.js",
+        "deployment/windows/test-native-profile-time.py",
+        "deployment/windows/test-network-probe.js",
+        "deployment/windows/test-profile-rotation.js",
+        "deployment/windows/test-server-restore.js",
+        "deployment/windows/test-update-download.js",
+        "deployment/windows/test_build_source.py",
+        "deployment/windows/test_company_setup_entrypoint.ps1",
+        "deployment/windows/test_company_watch_recovery.ps1",
+        "deployment/windows/test_customer_directory.ps1",
+        "deployment/windows/test_customer_exe.py",
+        "deployment/windows/test_customer_exe_native_output.ps1",
+        "deployment/windows/test_customer_exe_uninstall.ps1",
+        "deployment/windows/test_customer_msi.py",
+        "deployment/windows/test_customer_service_startup.ps1",
+        "deployment/windows/test_customer_ui_restart.ps1",
+        "deployment/windows/test_engine_candidate.py",
+        "deployment/windows/test_flutter_client_wrapper.py",
+        "deployment/windows/test_flutter_engine_source.py",
+        "deployment/windows/test_msi_install_mode.ps1",
+        "deployment/windows/test_msi_metadata.ps1",
+        "deployment/windows/test_msi_service_guard.ps1",
+        "deployment/windows/test_msi_staging.ps1",
+        "deployment/windows/test_msvc_determinism.ps1",
+        "deployment/windows/test_native_build_comparison.py",
+        "deployment/windows/test_network_probe.ps1",
+        "deployment/windows/test_payload_manifest.py",
+        "deployment/windows/test_pinned_archive.ps1",
+        "deployment/windows/test_pinned_flutter_sdk.py",
+        "deployment/windows/test_reproducible_pe.py",
+        "deployment/windows/test_server_directory.ps1",
+        "deployment/windows/test_server_removal_plan.ps1",
+        "deployment/windows/test_server_setup_reproducibility.ps1",
+        "deployment/windows/test_service_bootstrap.ps1",
+        "deployment/windows/test_service_imports.py",
+        "deployment/windows/test_setup_ui_broker.ps1",
+        "deployment/windows/test_technician_launcher.ps1",
+        "deployment/windows/test_technician_msi_lifecycle.ps1",
+        "deployment/windows/test_uninstall_commit.ps1",
+        "deployment/windows/test_update_download.ps1",
+        "deployment/windows/test_update_recovery_task.ps1",
+        "deployment/windows/test_worker_configuration.ps1",
+        "deployment/windows/verify-portable-payload.py",
+        "deployment/windows/verify-reproducible-pe.py",
+        "deployment/windows/verify-service-imports.py",
+        "deployment/windows/win10-lab-account-repair-evidence.json",
+        "deployment/windows/win10-standard-desktop-bounded-failure.json",
+        "docs/ACCEPTANCE.md",
+        "docs/CODE_OF_CONDUCT-DE.md",
+        "docs/CODE_OF_CONDUCT-FR.md",
+        "docs/CODE_OF_CONDUCT-JP.md",
+        "docs/CODE_OF_CONDUCT-KR.md",
+        "docs/CODE_OF_CONDUCT-NL.md",
+        "docs/CODE_OF_CONDUCT-NO.md",
+        "docs/CODE_OF_CONDUCT-PL.md",
+        "docs/CODE_OF_CONDUCT-RO.md",
+        "docs/CODE_OF_CONDUCT-RU.md",
+        "docs/CODE_OF_CONDUCT-TR.md",
+        "docs/CODE_OF_CONDUCT-ZH.md",
+        "docs/CODE_OF_CONDUCT.md",
+        "docs/CODE_SIGNING_POLICY.md",
+        "docs/CONSENT_SYNC.md",
+        "docs/CONTRIBUTING-DE.md",
+        "docs/CONTRIBUTING-FR.md",
+        "docs/CONTRIBUTING-ID.md",
+        "docs/CONTRIBUTING-IT.md",
+        "docs/CONTRIBUTING-JP.md",
+        "docs/CONTRIBUTING-KR.md",
+        "docs/CONTRIBUTING-NL.md",
+        "docs/CONTRIBUTING-NO.md",
+        "docs/CONTRIBUTING-PL.md",
+        "docs/CONTRIBUTING-RO.md",
+        "docs/CONTRIBUTING-RU.md",
+        "docs/CONTRIBUTING-TR.md",
+        "docs/CONTRIBUTING-ZH.md",
+        "docs/CONTRIBUTING.md",
+        "docs/CUSTOMER_EXE_PRODUCER.md",
+        "docs/CUSTOMER_INSTALL.md",
+        "docs/EXPLICIT_SETUP_UI_RECOVERY.md",
+        "docs/INSTALLATION_STATUS.md",
+        "docs/INSTALLER_REPAIR.md",
+        "docs/NETWORK-CHECK.md",
+        "docs/NETWORK_DIAGNOSTICS.md",
+        "docs/PRIVACY.md",
+        "docs/PRODUCT_COMPLETION_ASSESSMENT.md",
+        "docs/PROFILE_KEY_ROTATION.md",
+        "docs/README-AR.md",
+        "docs/README-CS.md",
+        "docs/README-DA.md",
+        "docs/README-DE.md",
+        "docs/README-EO.md",
+        "docs/README-ES.md",
+        "docs/README-FA.md",
+        "docs/README-FI.md",
+        "docs/README-FR.md",
+        "docs/README-GR.md",
+        "docs/README-HU.md",
+        "docs/README-ID.md",
+        "docs/README-IT.md",
+        "docs/README-JP.md",
+        "docs/README-KR.md",
+        "docs/README-ML.md",
+        "docs/README-NL.md",
+        "docs/README-NO.md",
+        "docs/README-PL.md",
+        "docs/README-PTBR.md",
+        "docs/README-RO.md",
+        "docs/README-RU.md",
+        "docs/README-TR.md",
+        "docs/README-UA.md",
+        "docs/README-VN.md",
+        "docs/README-ZH.md",
+        "docs/RELEASE-READINESS.md",
+        "docs/RELEASE_PAYLOAD.md",
+        "docs/SECURITY-DE.md",
+        "docs/SECURITY-FR.md",
+        "docs/SECURITY-IT.md",
+        "docs/SECURITY-JP.md",
+        "docs/SECURITY-KR.md",
+        "docs/SECURITY-NL.md",
+        "docs/SECURITY-NO.md",
+        "docs/SECURITY-PL.md",
+        "docs/SECURITY-RO.md",
+        "docs/SECURITY-TR.md",
+        "docs/SECURITY.md",
+        "docs/SERVER_BACKUP.md",
+        "docs/SERVER_CONTINUATION_PROMPT.md",
+        "docs/SOURCE_AND_LICENSE.md",
+        "docs/SWAN_CUSTOM_BUILD.md",
+        "docs/TAILSCALE_DEPLOYMENT.md",
+        "docs/UNSIGNED_SPARE_LAPTOP_TEST.md",
+        "docs/WINDOWS_CODE_SIGNING.md",
+        "docs/evidence/07bb8d0-native-file-transfer-and-pause.json",
+        "docs/evidence/07bb8d0-native-text-clipboard-and-keyboard.json",
+        "docs/evidence/1510-b1fbe1e-independent-native-reproduction-20261030.json",
+        "docs/evidence/1510-b1fbe1e-native-build-and-msi-ci-20261030.json",
+        "docs/evidence/1510-installed-agent-profile-rejection-20261030.json",
+        "docs/evidence/1510-installed-profile-key-rotation-and-native-recovery-20261030.json",
+        "docs/evidence/1510-linux-authorization-negatives-20261030.json",
+        "docs/evidence/1510-linux-bundles-server2019-upgrade-three-reboots-20261030.json",
+        "docs/evidence/1510-linux-native-attended-session-20261030.json",
+        "docs/evidence/1510-linux-native-management-outage-recovery-20261030.json",
+        "docs/evidence/1510-native-stock-client-legacy-denial-20261030.json",
+        "docs/evidence/1510-server2019-technician-automatic-upgrade-20261030.json",
+        "docs/evidence/1510-server2025-technician-upgrade-20261030.json",
+        "docs/evidence/1510-service-bootstrap-scm-boundary-20261030.json",
+        "docs/evidence/1510-win10-customer-automatic-upgrade-and-session-20261030.json",
+        "docs/evidence/1511-7b60309-linux-lab-management-fresh-company-20261030.json",
+        "docs/evidence/1511-7b60309-native-build-and-source-ci-20261030.json",
+        "docs/evidence/1511-7b60309-owned-lab-signed-packages-20261030.json",
+        "docs/evidence/1511-component-priority-and-recovery-ci-20261030.json",
+        "docs/evidence/1511-independent-build-coordinated-lab-upgrade-and-bundles-20261031.json",
+        "docs/evidence/1511-installed-windows-signed-package-rejection-20261031.json",
+        "docs/evidence/1511-server2019-technician-automatic-update-and-recovery-principal-finding-20261031.json",
+        "docs/evidence/1511-win10-automatic-upgrade-reboot-and-profile-rejection-20261031.json",
+        "docs/evidence/1512-canonical-linux-first-build-and-fresh-company-20261031.json",
+        "docs/evidence/1512-canonical-linux-reproduction-live-upgrade-and-offline-restore-20261031.json",
+        "docs/evidence/1512-compiled-recovery-standard-user-cleanup-20261031.json",
+        "docs/evidence/1512-independent-native-original-output-reproduction-20261031.json",
+        "docs/evidence/1512-native-and-component-build-success-20261031.json",
+        "docs/evidence/1512-recovery-principal-sid-regression-20261031.json",
+        "docs/evidence/1512-win10-real-session-update-deferral-and-interrupted-recovery-20261031.json",
+        "docs/evidence/1513-independent-native-reproduction-20261031.json",
+        "docs/evidence/1513-native-large-transfer-and-interrupted-retry-20261031.json",
+        "docs/evidence/1513-native-unicode-and-image-clipboard-20261031.json",
+        "docs/evidence/1513-portable-stale-runtime-finding-and-cache-isolation-20261031.json",
+        "docs/evidence/1513-technician-automatic-update-runtime-mfa-and-report-20261031.json",
+        "docs/evidence/1513-win10-idle-customer-update-stale-gui-finding-20261031.json",
+        "docs/evidence/1514-clean-server2022-install-and-enrollment-20261102.json",
+        "docs/evidence/1514-component-ui-helper-and-linux-context-ci-20261031.json",
+        "docs/evidence/1514-customer-ui-restart-functional-helper-20261031.json",
+        "docs/evidence/1514-native-build-and-company-bundles-20261102.json",
+        "docs/evidence/1514-real-automatic-msi-update-and-ui-restart-failure-20261102.json",
+        "docs/evidence/1514-server2022-standard-technician-msi-policy-rejection-20261102.json",
+        "docs/evidence/1516-clean-windows11-customer-install-and-enrollment-20261103.json",
+        "docs/evidence/1516-company-components-and-loader-regression-ci-20261102.json",
+        "docs/evidence/1516-native-build-and-lab-distribution-preparation-20261102.json",
+        "docs/evidence/1516-pre-msi-customer-ui-recovery-functional-20261102.json",
+        "docs/evidence/1516-real-automatic-msi-update-and-standard-ui-recovery-20261102.json",
+        "docs/evidence/1516-server2022-standard-technician-exe-and-mfa-20261102.json",
+        "docs/evidence/1516-standard-native-desktop-transfer-and-outage-recovery-20261103.json",
+        "docs/evidence/1517-build-company-packages-and-standard-technician-upgrade-20261103.json",
+        "docs/evidence/1517-native-interruption-consent-visibility-failure-20261103.json",
+        "docs/evidence/1518-company-generated-exe-msi-both-editions-20261103.json",
+        "docs/evidence/1518-explicit-customer-upgrade-open-ui-failure-20261103.json",
+        "docs/evidence/1518-native-build-and-exact-source-verification-20261103.json",
+        "docs/evidence/1518-signed-inner-customer-exe-producer-20261103.json",
+        "docs/evidence/1518-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-clean-win10-customer-msi-install-and-reboot-20261103.json",
+        "docs/evidence/1519-company-generated-both-editions-exe-msi-20261104.json",
+        "docs/evidence/1519-corrected-exe-and-setup-descendant-wait-20261104.json",
+        "docs/evidence/1519-corrected-exe-producer-independent-reproduction-20261104.json",
+        "docs/evidence/1519-customer-exe26-fresh-install-failure-20261104.json",
+        "docs/evidence/1519-customer-exe28-unassisted-clean-install-20261104.json",
+        "docs/evidence/1519-customer-exe28-uninstall-agent-retention-20261104.json",
+        "docs/evidence/1519-customer-msi-reboot-recovery-and-open-window-repair-20261103.json",
+        "docs/evidence/1519-independent-native-reproduction-20261104.json",
+        "docs/evidence/1519-native-build-and-source-verification-20261103.json",
+        "docs/evidence/1519-signed-inner-customer-exe-producer-20261104.json",
+        "docs/evidence/1519-standard-technician-upgrade-and-native-mfa-20261103.json",
+        "docs/evidence/1519-standard-win10-customer-consent-and-reboot-20261104.json",
+        "docs/evidence/1521-current-build-and-company-packages-20261104.json",
+        "docs/evidence/1521-customer-exe30-lab-manifest-pairing-failure-20261104.json",
+        "docs/evidence/1521-customer-exe31-recovery-uninstall-reinstall-and-about-20261104.json",
+        "docs/evidence/1521-independent-native-original-output-reproduction-20261104.json",
+        "docs/evidence/1521-native-direct-ip-denial-and-preservation-20261105.json",
+        "docs/evidence/1521-standard-native-interrupted-transfer-consent-and-stop-20261105.json",
+        "docs/evidence/1521-standard-technician-upgrade-about-mfa-20261104.json",
+        "docs/evidence/1522-management-reproduction-upgrade-and-probe-20261105.json",
+        "docs/evidence/1522-msvc-lambda-path-controls-20261105.json",
+        "docs/evidence/1522-named-wrapper-primary-build-20261105.json",
+        "docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json",
+        "docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json",
+        "docs/evidence/159-windows-attended-lock-unlock-20261029.json",
+        "docs/evidence/159-windows-company-install-enrollment-20261029.json",
+        "docs/evidence/159-windows-native-branding-sync-20261030.json",
+        "docs/evidence/159-windows-native-clipboard-transfer-20261029.json",
+        "docs/evidence/159-windows-native-two-monitor-20261029.json",
+        "docs/evidence/159-windows-receiving-file-permission-denial-20261029.json",
+        "docs/evidence/159-windows-standard-customer-uac-20261029.json",
+        "docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json",
+        "docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-server2016-runtime.json",
+        "docs/evidence/1c43a38-private-worker-windows-checks.json",
+        "docs/evidence/1c43a38-windows-components-independent.json",
+        "docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json",
+        "docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json",
+        "docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json",
+        "docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json",
+        "docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json",
+        "docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json",
+        "docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json",
+        "docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json",
+        "docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json",
+        "docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json",
+        "docs/evidence/361d7c3-windows-transport-storage-component-checks.json",
+        "docs/evidence/3bcc884-reporting-component-checks.json",
+        "docs/evidence/3bcc884-windows-transport-server2016.json",
+        "docs/evidence/649682a-authenticated-technician-identity-component-checks.json",
+        "docs/evidence/67b5c69-company-backup-and-rollback.json",
+        "docs/evidence/67b5c69-component-reproduction.json",
+        "docs/evidence/67b5c69-native-independent-rebuild.json",
+        "docs/evidence/67b5c69-native158-runtime.json",
+        "docs/evidence/67b5c69-streamed-backup-component-checks.json",
+        "docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json",
+        "docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json",
+        "docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json",
+        "docs/evidence/a96cd4c-installation-reporting-component-checks.json",
+        "docs/evidence/aff8ff6-native159-source-verification.json",
+        "docs/evidence/aff8ff6-windows-full-deployment-export.json",
+        "docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json",
+        "docs/evidence/company-network-probe-development-20261105.json",
+        "docs/evidence/e47f614-compiled-sender-https.json",
+        "docs/evidence/e47f614-schema3-upgrade-and-rollback.json",
+        "docs/evidence/network-probe-windows-der-finding-and-fix-20261105.json",
+        "docs/evidence/network-probe-windows-port-reservation-control-20261105.json",
+        "docs/evidence/update-download-streaming.json",
+        "docs/evidence/windows-maintained-component-preparation.json",
+        "docs/evidence/windows-transport-database-storage-finding-20261029.json",
+        "docs/evidence/worker-private-configuration-server2016.json",
+        "entrypoint.sh",
+        "examples/ipc.rs",
+        "fastlane/metadata/android/en-US/full_description.txt",
+        "fastlane/metadata/android/en-US/short_description.txt",
+        "fastlane/metadata/android/fr-FR/full_description.txt",
+        "fastlane/metadata/android/fr-FR/short_description.txt",
+        "fastlane/metadata/android/nl-NL/full_description.txt",
+        "fastlane/metadata/android/nl-NL/short_description.txt",
+        "fastlane/metadata/android/zh-CN/full_description.txt",
+        "fastlane/metadata/android/zh-CN/short_description.txt",
+        "flatpak/com.rustdesk.RustDesk.metainfo.xml",
+        "flatpak/rustdesk.json",
+        "flutter/.gitattributes",
+        "flutter/.gitignore",
+        "flutter/.metadata",
+        "flutter/README.md",
+        "flutter/analysis_options.yaml",
+        "flutter/android/.gitignore",
+        "flutter/android/app/build.gradle",
+        "flutter/android/app/proguard-rules",
+        "flutter/android/app/src/debug/AndroidManifest.xml",
+        "flutter/android/app/src/main/AndroidManifest.xml",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/BootReceiver.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/FloatingWindowService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/KeyboardKeyEventMapper.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainApplication.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/RdClipboardManager.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/VolumeController.kt",
+        "flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt",
+        "flutter/android/app/src/main/kotlin/ffi.kt",
+        "flutter/android/app/src/main/res/drawable-v21/launch_background.xml",
+        "flutter/android/app/src/main/res/drawable/check_blue.xml",
+        "flutter/android/app/src/main/res/drawable/close_red.xml",
+        "flutter/android/app/src/main/res/drawable/floating_window.xml",
+        "flutter/android/app/src/main/res/drawable/launch_background.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
+        "flutter/android/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
+        "flutter/android/app/src/main/res/values-night/styles.xml",
+        "flutter/android/app/src/main/res/values/colors.xml",
+        "flutter/android/app/src/main/res/values/ic_launcher_background.xml",
+        "flutter/android/app/src/main/res/values/strings.xml",
+        "flutter/android/app/src/main/res/values/styles.xml",
+        "flutter/android/app/src/main/res/xml/accessibility_service_config.xml",
+        "flutter/android/app/src/profile/AndroidManifest.xml",
+        "flutter/android/build.gradle",
+        "flutter/android/flutter_hbb_android.iml",
+        "flutter/android/gradle.properties",
+        "flutter/android/gradle/wrapper/gradle-wrapper.properties",
+        "flutter/android/settings.gradle",
+        "flutter/assets/chat2.svg",
+        "flutter/assets/display_switcher.svg",
+        "flutter/assets/icon.svg",
+        "flutter/assets/keyboard_mouse.svg",
+        "flutter/build_android.sh",
+        "flutter/build_android_deps.sh",
+        "flutter/build_fdroid.sh",
+        "flutter/build_ios.sh",
+        "flutter/ios/.gitignore",
+        "flutter/ios/Flutter/AppFrameworkInfo.plist",
+        "flutter/ios/Flutter/Debug.xcconfig",
+        "flutter/ios/Flutter/Release.xcconfig",
+        "flutter/ios/Podfile",
+        "flutter/ios/Podfile.lock",
+        "flutter/ios/Runner.xcodeproj/project.pbxproj",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/ios/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/ios/Runner.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings",
+        "flutter/ios/Runner/AppDelegate.swift",
+        "flutter/ios/Runner/Assets.xcassets/AppIcon.appiconset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json",
+        "flutter/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md",
+        "flutter/ios/Runner/Base.lproj/LaunchScreen.storyboard",
+        "flutter/ios/Runner/Base.lproj/Main.storyboard",
+        "flutter/ios/Runner/GoogleService-Info.plist",
+        "flutter/ios/Runner/Info.plist",
+        "flutter/ios/Runner/Runner-Bridging-Header.h",
+        "flutter/ios/Runner/Runner.entitlements",
+        "flutter/ios/exportOptions.plist",
+        "flutter/ios_arm64.sh",
+        "flutter/ios_x64.sh",
+        "flutter/lib/common.dart",
+        "flutter/lib/common/approval_window_auto_hide.dart",
+        "flutter/lib/common/company_window_title.dart",
+        "flutter/lib/common/formatter/id_formatter.dart",
+        "flutter/lib/common/hbbs/hbbs.dart",
+        "flutter/lib/common/shared_state.dart",
+        "flutter/lib/common/widgets/address_book.dart",
+        "flutter/lib/common/widgets/animated_rotation_widget.dart",
+        "flutter/lib/common/widgets/audio_input.dart",
+        "flutter/lib/common/widgets/autocomplete.dart",
+        "flutter/lib/common/widgets/chat_page.dart",
+        "flutter/lib/common/widgets/connection_page_title.dart",
+        "flutter/lib/common/widgets/custom_password.dart",
+        "flutter/lib/common/widgets/custom_scale_base.dart",
+        "flutter/lib/common/widgets/dialog.dart",
+        "flutter/lib/common/widgets/gestures.dart",
+        "flutter/lib/common/widgets/login.dart",
+        "flutter/lib/common/widgets/my_group.dart",
+        "flutter/lib/common/widgets/overlay.dart",
+        "flutter/lib/common/widgets/peer_card.dart",
+        "flutter/lib/common/widgets/peer_tab_page.dart",
+        "flutter/lib/common/widgets/peers_view.dart",
+        "flutter/lib/common/widgets/remote_input.dart",
+        "flutter/lib/common/widgets/setting_widgets.dart",
+        "flutter/lib/common/widgets/toolbar.dart",
+        "flutter/lib/consts.dart",
+        "flutter/lib/desktop/pages/company_about_button.dart",
+        "flutter/lib/desktop/pages/company_contact_links.dart",
+        "flutter/lib/desktop/pages/company_technician_page.dart",
+        "flutter/lib/desktop/pages/connection_page.dart",
+        "flutter/lib/desktop/pages/desktop_home_page.dart",
+        "flutter/lib/desktop/pages/desktop_setting_page.dart",
+        "flutter/lib/desktop/pages/desktop_tab_page.dart",
+        "flutter/lib/desktop/pages/file_manager_page.dart",
+        "flutter/lib/desktop/pages/file_manager_tab_page.dart",
+        "flutter/lib/desktop/pages/install_page.dart",
+        "flutter/lib/desktop/pages/port_forward_page.dart",
+        "flutter/lib/desktop/pages/port_forward_tab_page.dart",
+        "flutter/lib/desktop/pages/remote_page.dart",
+        "flutter/lib/desktop/pages/remote_tab_page.dart",
+        "flutter/lib/desktop/pages/server_page.dart",
+        "flutter/lib/desktop/pages/terminal_connection_manager.dart",
+        "flutter/lib/desktop/pages/terminal_page.dart",
+        "flutter/lib/desktop/pages/terminal_tab_page.dart",
+        "flutter/lib/desktop/pages/view_camera_page.dart",
+        "flutter/lib/desktop/pages/view_camera_tab_page.dart",
+        "flutter/lib/desktop/screen/desktop_file_transfer_screen.dart",
+        "flutter/lib/desktop/screen/desktop_port_forward_screen.dart",
+        "flutter/lib/desktop/screen/desktop_remote_screen.dart",
+        "flutter/lib/desktop/screen/desktop_terminal_screen.dart",
+        "flutter/lib/desktop/screen/desktop_view_camera_screen.dart",
+        "flutter/lib/desktop/widgets/button.dart",
+        "flutter/lib/desktop/widgets/dragable_divider.dart",
+        "flutter/lib/desktop/widgets/kb_layout_type_chooser.dart",
+        "flutter/lib/desktop/widgets/list_search_action_listener.dart",
+        "flutter/lib/desktop/widgets/material_mod_popup_menu.dart",
+        "flutter/lib/desktop/widgets/menu_button.dart",
+        "flutter/lib/desktop/widgets/popup_menu.dart",
+        "flutter/lib/desktop/widgets/refresh_wrapper.dart",
+        "flutter/lib/desktop/widgets/remote_toolbar.dart",
+        "flutter/lib/desktop/widgets/tabbar_widget.dart",
+        "flutter/lib/desktop/widgets/titlebar_widget.dart",
+        "flutter/lib/desktop/widgets/update_progress.dart",
+        "flutter/lib/main.dart",
+        "flutter/lib/mobile/pages/connection_page.dart",
+        "flutter/lib/mobile/pages/file_manager_page.dart",
+        "flutter/lib/mobile/pages/home_page.dart",
+        "flutter/lib/mobile/pages/remote_page.dart",
+        "flutter/lib/mobile/pages/scan_page.dart",
+        "flutter/lib/mobile/pages/server_page.dart",
+        "flutter/lib/mobile/pages/settings_page.dart",
+        "flutter/lib/mobile/pages/terminal_page.dart",
+        "flutter/lib/mobile/pages/view_camera_page.dart",
+        "flutter/lib/mobile/widgets/custom_scale_widget.dart",
+        "flutter/lib/mobile/widgets/deploy_dialog.dart",
+        "flutter/lib/mobile/widgets/dialog.dart",
+        "flutter/lib/mobile/widgets/floating_mouse.dart",
+        "flutter/lib/mobile/widgets/floating_mouse_widgets.dart",
+        "flutter/lib/mobile/widgets/gesture_help.dart",
+        "flutter/lib/models/ab_model.dart",
+        "flutter/lib/models/chat_model.dart",
+        "flutter/lib/models/cm_file_model.dart",
+        "flutter/lib/models/desktop_render_texture.dart",
+        "flutter/lib/models/file_model.dart",
+        "flutter/lib/models/group_model.dart",
+        "flutter/lib/models/input_model.dart",
+        "flutter/lib/models/input_modifier_utils.dart",
+        "flutter/lib/models/model.dart",
+        "flutter/lib/models/native_model.dart",
+        "flutter/lib/models/peer_model.dart",
+        "flutter/lib/models/peer_tab_model.dart",
+        "flutter/lib/models/platform_model.dart",
+        "flutter/lib/models/printer_model.dart",
+        "flutter/lib/models/relative_mouse_model.dart",
+        "flutter/lib/models/server_model.dart",
+        "flutter/lib/models/state_model.dart",
+        "flutter/lib/models/terminal_model.dart",
+        "flutter/lib/models/user_model.dart",
+        "flutter/lib/models/web_model.dart",
+        "flutter/lib/native/common.dart",
+        "flutter/lib/native/custom_cursor.dart",
+        "flutter/lib/native/win32.dart",
+        "flutter/lib/plugin/common.dart",
+        "flutter/lib/plugin/event.dart",
+        "flutter/lib/plugin/handlers.dart",
+        "flutter/lib/plugin/manager.dart",
+        "flutter/lib/plugin/model.dart",
+        "flutter/lib/plugin/ui_manager.dart",
+        "flutter/lib/plugin/utils/dialogs.dart",
+        "flutter/lib/plugin/widgets/desc_ui.dart",
+        "flutter/lib/plugin/widgets/desktop_settings.dart",
+        "flutter/lib/utils/event_loop.dart",
+        "flutter/lib/utils/http_service.dart",
+        "flutter/lib/utils/image.dart",
+        "flutter/lib/utils/multi_window_manager.dart",
+        "flutter/lib/utils/platform_channel.dart",
+        "flutter/lib/utils/relative_mouse_accumulator.dart",
+        "flutter/lib/utils/scale.dart",
+        "flutter/lib/web/bridge.dart",
+        "flutter/lib/web/common.dart",
+        "flutter/lib/web/custom_cursor.dart",
+        "flutter/lib/web/dummy.dart",
+        "flutter/lib/web/plugin/handlers.dart",
+        "flutter/lib/web/settings_page.dart",
+        "flutter/lib/web/texture_rgba_renderer.dart",
+        "flutter/lib/web/web_unique.dart",
+        "flutter/lib/web/win32.dart",
+        "flutter/linux/.gitignore",
+        "flutter/linux/CMakeLists.txt",
+        "flutter/linux/bump_mouse.cc",
+        "flutter/linux/bump_mouse.h",
+        "flutter/linux/bump_mouse_x11.cc",
+        "flutter/linux/bump_mouse_x11.h",
+        "flutter/linux/flutter/CMakeLists.txt",
+        "flutter/linux/main.cc",
+        "flutter/linux/my_application.cc",
+        "flutter/linux/my_application.h",
+        "flutter/linux/wayland_shortcuts_inhibit.cc",
+        "flutter/linux/wayland_shortcuts_inhibit.h",
+        "flutter/macos/.gitignore",
+        "flutter/macos/Flutter/Flutter-Debug.xcconfig",
+        "flutter/macos/Flutter/Flutter-Release.xcconfig",
+        "flutter/macos/Podfile",
+        "flutter/macos/Podfile.lock",
+        "flutter/macos/Runner.xcodeproj/project.pbxproj",
+        "flutter/macos/Runner.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme",
+        "flutter/macos/Runner.xcworkspace/contents.xcworkspacedata",
+        "flutter/macos/Runner.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist",
+        "flutter/macos/Runner/AppDelegate.swift",
+        "flutter/macos/Runner/Base.lproj/MainMenu.xib",
+        "flutter/macos/Runner/Configs/AppInfo.xcconfig",
+        "flutter/macos/Runner/Configs/Debug.xcconfig",
+        "flutter/macos/Runner/Configs/Release.xcconfig",
+        "flutter/macos/Runner/Configs/Warnings.xcconfig",
+        "flutter/macos/Runner/DebugProfile.entitlements",
+        "flutter/macos/Runner/Info.plist",
+        "flutter/macos/Runner/MainFlutterWindow.swift",
+        "flutter/macos/Runner/Release.entitlements",
+        "flutter/ndk_arm.sh",
+        "flutter/ndk_arm64.sh",
+        "flutter/ndk_x64.sh",
+        "flutter/ndk_x86.sh",
+        "flutter/pubspec.lock",
+        "flutter/pubspec.yaml",
+        "flutter/run.sh",
+        "flutter/test/approval_window_auto_hide_test.dart",
+        "flutter/test/autocomplete_peer_merge_test.dart",
+        "flutter/test/cm_demo.dart",
+        "flutter/test/cm_test.dart",
+        "flutter/test/company_window_title_test.dart",
+        "flutter/test/input_modifier_utils_test.dart",
+        "flutter/test/server_settings_dialog_test.dart",
+        "flutter/windows/.gitignore",
+        "flutter/windows/CMakeLists.txt",
+        "flutter/windows/flutter/CMakeLists.txt",
+        "flutter/windows/runner/CMakeLists.txt",
+        "flutter/windows/runner/Runner.rc",
+        "flutter/windows/runner/flutter_window.cpp",
+        "flutter/windows/runner/flutter_window.h",
+        "flutter/windows/runner/main.cpp",
+        "flutter/windows/runner/resource.h",
+        "flutter/windows/runner/runner.exe.manifest",
+        "flutter/windows/runner/service_bootstrap.cpp",
+        "flutter/windows/runner/service_bootstrap.h",
+        "flutter/windows/runner/utils.cpp",
+        "flutter/windows/runner/utils.h",
+        "flutter/windows/runner/win32_desktop.cpp",
+        "flutter/windows/runner/win32_desktop.h",
+        "flutter/windows/runner/win32_window.cpp",
+        "flutter/windows/runner/win32_window.h",
+        "libs/clipboard/Cargo.toml",
+        "libs/clipboard/README.md",
+        "libs/clipboard/build.rs",
+        "libs/clipboard/src/cliprdr.h",
+        "libs/clipboard/src/context_send.rs",
+        "libs/clipboard/src/lib.rs",
+        "libs/clipboard/src/platform/mod.rs",
+        "libs/clipboard/src/platform/unix/filetype.rs",
+        "libs/clipboard/src/platform/unix/fuse/cs.rs",
+        "libs/clipboard/src/platform/unix/fuse/mod.rs",
+        "libs/clipboard/src/platform/unix/local_file.rs",
+        "libs/clipboard/src/platform/unix/macos/README.md",
+        "libs/clipboard/src/platform/unix/macos/item_data_provider.rs",
+        "libs/clipboard/src/platform/unix/macos/mod.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_observer.rs",
+        "libs/clipboard/src/platform/unix/macos/paste_task.rs",
+        "libs/clipboard/src/platform/unix/macos/pasteboard_context.rs",
+        "libs/clipboard/src/platform/unix/mod.rs",
+        "libs/clipboard/src/platform/unix/serv_files.rs",
+        "libs/clipboard/src/platform/windows.rs",
+        "libs/clipboard/src/windows/wf_cliprdr.c",
+        "libs/enigo/.gitattributes",
+        "libs/enigo/.github/ISSUE_TEMPLATE/bug_report.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/feature_request.md",
+        "libs/enigo/.github/ISSUE_TEMPLATE/question.md",
+        "libs/enigo/.gitignore",
+        "libs/enigo/.travis.yml",
+        "libs/enigo/.vscode/launch.json",
+        "libs/enigo/Cargo.toml",
+        "libs/enigo/LICENSE",
+        "libs/enigo/README.md",
+        "libs/enigo/appveyor.yml",
+        "libs/enigo/build.rs",
+        "libs/enigo/examples/dsl.rs",
+        "libs/enigo/examples/key.rs",
+        "libs/enigo/examples/keyboard.rs",
+        "libs/enigo/examples/mouse.rs",
+        "libs/enigo/examples/timer.rs",
+        "libs/enigo/rustfmt.toml",
+        "libs/enigo/src/dsl.rs",
+        "libs/enigo/src/lib.rs",
+        "libs/enigo/src/linux/mod.rs",
+        "libs/enigo/src/linux/nix_impl.rs",
+        "libs/enigo/src/linux/xdo.rs",
+        "libs/enigo/src/macos/keycodes.rs",
+        "libs/enigo/src/macos/macos_impl.rs",
+        "libs/enigo/src/macos/mod.rs",
+        "libs/enigo/src/win/keycodes.rs",
+        "libs/enigo/src/win/mod.rs",
+        "libs/enigo/src/win/win_impl.rs",
+        "libs/hbb_common/.gitignore",
+        "libs/hbb_common/Cargo.toml",
+        "libs/hbb_common/build.rs",
+        "libs/hbb_common/examples/config.rs",
+        "libs/hbb_common/examples/system_message.rs",
+        "libs/hbb_common/examples/webrtc.rs",
+        "libs/hbb_common/protos/message.proto",
+        "libs/hbb_common/protos/rendezvous.proto",
+        "libs/hbb_common/src/bytes_codec.rs",
+        "libs/hbb_common/src/compress.rs",
+        "libs/hbb_common/src/config.rs",
+        "libs/hbb_common/src/config/permanent_password.rs",
+        "libs/hbb_common/src/fingerprint.rs",
+        "libs/hbb_common/src/fs.rs",
+        "libs/hbb_common/src/keyboard.rs",
+        "libs/hbb_common/src/lib.rs",
+        "libs/hbb_common/src/mem.rs",
+        "libs/hbb_common/src/password_security.rs",
+        "libs/hbb_common/src/platform/linux.rs",
+        "libs/hbb_common/src/platform/macos.rs",
+        "libs/hbb_common/src/platform/mod.rs",
+        "libs/hbb_common/src/platform/windows.rs",
+        "libs/hbb_common/src/protos/mod.rs",
+        "libs/hbb_common/src/proxy.rs",
+        "libs/hbb_common/src/socket_client.rs",
+        "libs/hbb_common/src/stream.rs",
+        "libs/hbb_common/src/tcp.rs",
+        "libs/hbb_common/src/tls.rs",
+        "libs/hbb_common/src/udp.rs",
+        "libs/hbb_common/src/verifier.rs",
+        "libs/hbb_common/src/webrtc.rs",
+        "libs/hbb_common/src/websocket.rs",
+        "libs/libxdo-sys-stub/Cargo.toml",
+        "libs/libxdo-sys-stub/src/lib.rs",
+        "libs/portable/.gitignore",
+        "libs/portable/Cargo.lock",
+        "libs/portable/Cargo.toml",
+        "libs/portable/build.rs",
+        "libs/portable/generate.py",
+        "libs/portable/requirements.txt",
+        "libs/portable/resource_order.rs",
+        "libs/portable/src/bin_reader.rs",
+        "libs/portable/src/install_wait.rs",
+        "libs/portable/src/main.rs",
+        "libs/portable/src/runtime_cache.rs",
+        "libs/portable/src/ui.rs",
+        "libs/portable/test_generate.py",
+        "libs/remote_printer/Cargo.toml",
+        "libs/remote_printer/src/lib.rs",
+        "libs/remote_printer/src/setup/driver.rs",
+        "libs/remote_printer/src/setup/mod.rs",
+        "libs/remote_printer/src/setup/port.rs",
+        "libs/remote_printer/src/setup/printer.rs",
+        "libs/remote_printer/src/setup/setup.rs",
+        "libs/scrap/.gitignore",
+        "libs/scrap/Cargo.toml",
+        "libs/scrap/README.md",
+        "libs/scrap/build.rs",
+        "libs/scrap/examples/benchmark.rs",
+        "libs/scrap/examples/capture_mag.rs",
+        "libs/scrap/examples/ffplay.rs",
+        "libs/scrap/examples/list.rs",
+        "libs/scrap/examples/record-screen.rs",
+        "libs/scrap/examples/screenshot.rs",
+        "libs/scrap/src/android/ffi.rs",
+        "libs/scrap/src/android/mod.rs",
+        "libs/scrap/src/bindings/aom_ffi.h",
+        "libs/scrap/src/bindings/vpx_ffi.h",
+        "libs/scrap/src/bindings/yuv_ffi.h",
+        "libs/scrap/src/common/android.rs",
+        "libs/scrap/src/common/aom.rs",
+        "libs/scrap/src/common/camera.rs",
+        "libs/scrap/src/common/codec.rs",
+        "libs/scrap/src/common/convert.rs",
+        "libs/scrap/src/common/dxgi.rs",
+        "libs/scrap/src/common/hwcodec.rs",
+        "libs/scrap/src/common/linux.rs",
+        "libs/scrap/src/common/mediacodec.rs",
+        "libs/scrap/src/common/mod.rs",
+        "libs/scrap/src/common/quartz.rs",
+        "libs/scrap/src/common/record.rs",
+        "libs/scrap/src/common/vpx.rs",
+        "libs/scrap/src/common/vpxcodec.rs",
+        "libs/scrap/src/common/vram.rs",
+        "libs/scrap/src/common/wayland.rs",
+        "libs/scrap/src/common/x11.rs",
+        "libs/scrap/src/dxgi/gdi.rs",
+        "libs/scrap/src/dxgi/mag.rs",
+        "libs/scrap/src/dxgi/mod.rs",
+        "libs/scrap/src/lib.rs",
+        "libs/scrap/src/quartz/capturer.rs",
+        "libs/scrap/src/quartz/config.rs",
+        "libs/scrap/src/quartz/display.rs",
+        "libs/scrap/src/quartz/ffi.rs",
+        "libs/scrap/src/quartz/frame.rs",
+        "libs/scrap/src/quartz/mod.rs",
+        "libs/scrap/src/wayland.rs",
+        "libs/scrap/src/wayland/README.md",
+        "libs/scrap/src/wayland/capturable.rs",
+        "libs/scrap/src/wayland/display.rs",
+        "libs/scrap/src/wayland/pipewire.rs",
+        "libs/scrap/src/wayland/remote_desktop_portal.rs",
+        "libs/scrap/src/wayland/request_portal.rs",
+        "libs/scrap/src/wayland/screencast_portal.rs",
+        "libs/scrap/src/x11/capturer.rs",
+        "libs/scrap/src/x11/display.rs",
+        "libs/scrap/src/x11/ffi.rs",
+        "libs/scrap/src/x11/iter.rs",
+        "libs/scrap/src/x11/mod.rs",
+        "libs/scrap/src/x11/server.rs",
+        "libs/virtual_display/Cargo.lock",
+        "libs/virtual_display/Cargo.toml",
+        "libs/virtual_display/README.md",
+        "libs/virtual_display/dylib/Cargo.toml",
+        "libs/virtual_display/dylib/README.md",
+        "libs/virtual_display/dylib/build.rs",
+        "libs/virtual_display/dylib/examples/idd_controller.rs",
+        "libs/virtual_display/dylib/src/lib.rs",
+        "libs/virtual_display/dylib/src/win10/IddController.c",
+        "libs/virtual_display/dylib/src/win10/IddController.h",
+        "libs/virtual_display/dylib/src/win10/Public.h",
+        "libs/virtual_display/dylib/src/win10/idd.rs",
+        "libs/virtual_display/dylib/src/win10/mod.rs",
+        "libs/virtual_display/examples/virtual_display_1.rs",
+        "libs/virtual_display/src/lib.rs",
+        "product/Cargo.lock",
+        "product/Cargo.toml",
+        "product/README.md",
+        "product/agent/Cargo.toml",
+        "product/agent/src/lib.rs",
+        "product/agent/src/main.rs",
+        "product/agent/src/payload.rs",
+        "product/agent/src/reporting.rs",
+        "product/agent/src/technician.rs",
+        "product/agent/src/update.rs",
+        "product/agent/src/verifier_process.rs",
+        "product/management/Cargo.toml",
+        "product/management/src/backup.rs",
+        "product/management/src/backup_stream.rs",
+        "product/management/src/components.rs",
+        "product/management/src/installation_reporting.rs",
+        "product/management/src/main.rs",
+        "product/management/src/network.rs",
+        "product/management/src/network_probe.rs",
+        "product/management/src/schema.sql",
+        "product/management/src/service.rs",
+        "product/management/src/tests.rs",
+        "product/management/src/windows.rs",
+        "product/management/web/app.js",
+        "product/management/web/index.html",
+        "product/management/web/style.css",
+        "product/protocol/Cargo.toml",
+        "product/protocol/src/installation.rs",
+        "product/protocol/src/lib.rs",
+        "product/worker/Cargo.toml",
+        "product/worker/src/configuration.rs",
+        "product/worker/src/main.rs",
+        "product/worker/src/windows.rs",
+        "res/DEBIAN/postinst",
+        "res/DEBIAN/postrm",
+        "res/DEBIAN/preinst",
+        "res/DEBIAN/prerm",
+        "res/PKGBUILD",
+        "res/ab.py",
+        "res/audits.py",
+        "res/bump.sh",
+        "res/design.svg",
+        "res/device-groups.py",
+        "res/devices.py",
+        "res/fdroid/patches/0000-flutter-android-x86.patch",
+        "res/fdroid/patches/0001-x86-no-debuggable.patch",
+        "res/gen_icon.sh",
+        "res/inline-sciter.py",
+        "res/job.py",
+        "res/lang.py",
+        "res/manifest.xml",
+        "res/msi/.gitignore",
+        "res/msi/CustomActions/Common.h",
+        "res/msi/CustomActions/CustomActions.cpp",
+        "res/msi/CustomActions/CustomActions.def",
+        "res/msi/CustomActions/CustomActions.vcxproj",
+        "res/msi/CustomActions/DeviceUtils.cpp",
+        "res/msi/CustomActions/FirewallRules.cpp",
+        "res/msi/CustomActions/ReadConfig.cpp",
+        "res/msi/CustomActions/RemotePrinter.cpp",
+        "res/msi/CustomActions/ServiceUtils.cpp",
+        "res/msi/CustomActions/dllmain.cpp",
+        "res/msi/CustomActions/framework.h",
+        "res/msi/CustomActions/packages.config",
+        "res/msi/CustomActions/pch.cpp",
+        "res/msi/CustomActions/pch.h",
+        "res/msi/Package/Components/Folders.wxs",
+        "res/msi/Package/Components/Regs.wxs",
+        "res/msi/Package/Components/RustDesk.wxs",
+        "res/msi/Package/Fragments/AddRemoveProperties.wxs",
+        "res/msi/Package/Fragments/CustomActions.wxs",
+        "res/msi/Package/Fragments/ShortcutProperties.wxs",
+        "res/msi/Package/Fragments/Upgrades.wxs",
+        "res/msi/Package/Includes.wxi",
+        "res/msi/Package/Language/Package.en-us.wxl",
+        "res/msi/Package/Language/WixExt_en-us.wxl",
+        "res/msi/Package/License.rtf",
+        "res/msi/Package/Package.wixproj",
+        "res/msi/Package/Package.wxs",
+        "res/msi/Package/UI/AnotherApp.wxs",
+        "res/msi/Package/UI/MyInstallDirDlg.wxs",
+        "res/msi/Package/UI/MyInstallDlg.wxs",
+        "res/msi/README.md",
+        "res/msi/msi.sln",
+        "res/msi/preprocess.py",
+        "res/osx-dist.sh",
+        "res/pacman_install",
+        "res/pam.d/rustdesk.debian",
+        "res/pam.d/rustdesk.suse",
+        "res/rpm-flutter-suse.spec",
+        "res/rpm-flutter.spec",
+        "res/rpm-suse.spec",
+        "res/rpm.spec",
+        "res/rustdesk-link.desktop",
+        "res/rustdesk.desktop",
+        "res/rustdesk.service",
+        "res/scalable.svg",
+        "res/startwm.sh",
+        "res/strategies.py",
+        "res/user-groups.py",
+        "res/users.py",
+        "res/vcpkg/aom/aom-avx2.diff",
+        "res/vcpkg/aom/aom-install.diff",
+        "res/vcpkg/aom/aom-uninitialized-pointer.diff",
+        "res/vcpkg/aom/portfile.cmake",
+        "res/vcpkg/aom/vcpkg.json",
+        "res/vcpkg/ffmpeg/0001-create-lib-libraries.patch",
+        "res/vcpkg/ffmpeg/0002-fix-msvc-link.patch",
+        "res/vcpkg/ffmpeg/0003-fix-windowsinclude.patch",
+        "res/vcpkg/ffmpeg/0004-dependencies.patch",
+        "res/vcpkg/ffmpeg/0005-fix-nasm.patch",
+        "res/vcpkg/ffmpeg/0007-fix-lib-naming.patch",
+        "res/vcpkg/ffmpeg/0013-define-WINVER.patch",
+        "res/vcpkg/ffmpeg/0020-fix-aarch64-libswscale.patch",
+        "res/vcpkg/ffmpeg/0024-fix-osx-host-c11.patch",
+        "res/vcpkg/ffmpeg/0040-ffmpeg-add-av_stream_get_first_dts-for-chromium.patch",
+        "res/vcpkg/ffmpeg/0041-add-const-for-opengl-definition.patch",
+        "res/vcpkg/ffmpeg/0042-fix-arm64-linux.patch",
+        "res/vcpkg/ffmpeg/0043-fix-miss-head.patch",
+        "res/vcpkg/ffmpeg/build.sh.in",
+        "res/vcpkg/ffmpeg/patch/0001-avcodec-amfenc-add-query_timeout-option-for-h264-hev.patch",
+        "res/vcpkg/ffmpeg/patch/0002-libavcodec-amfenc-reconfig-when-bitrate-change.patch",
+        "res/vcpkg/ffmpeg/patch/0004-videotoolbox-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0005-mediacodec-changing-bitrate.patch",
+        "res/vcpkg/ffmpeg/patch/0006-dlopen-libva.patch",
+        "res/vcpkg/ffmpeg/patch/0007-fix-linux-configure.patch",
+        "res/vcpkg/ffmpeg/patch/0008-remove-amf-loop-query.patch",
+        "res/vcpkg/ffmpeg/patch/0009-fix-nvenc-reconfigure-blur.patch",
+        "res/vcpkg/ffmpeg/patch/0010.disable-loading-DLLs-from-app-dir.patch",
+        "res/vcpkg/ffmpeg/patch/0011-android-mediacodec-encode-align-64.patch",
+        "res/vcpkg/ffmpeg/patch/0012-fix-macos-big-sur-CVBufferCopyAttachments.patch",
+        "res/vcpkg/ffmpeg/portfile.cmake",
+        "res/vcpkg/ffmpeg/vcpkg-cmake-wrapper.cmake",
+        "res/vcpkg/ffmpeg/vcpkg.json",
+        "res/vcpkg/libvpx/0003-add-uwp-v142-and-v143-support.patch",
+        "res/vcpkg/libvpx/0004-remove-library-suffixes.patch",
+        "res/vcpkg/libvpx/portfile.cmake",
+        "res/vcpkg/libvpx/unofficial-libvpx-config.cmake.in",
+        "res/vcpkg/libvpx/vcpkg.json",
+        "res/vcpkg/libvpx/vpx.pc.in",
+        "res/vcpkg/libyuv/fix-cmakelists.patch",
+        "res/vcpkg/libyuv/libyuv-config.cmake",
+        "res/vcpkg/libyuv/portfile.cmake",
+        "res/vcpkg/libyuv/usage",
+        "res/vcpkg/libyuv/usage-msvc",
+        "res/vcpkg/libyuv/vcpkg.json",
+        "res/vcpkg/mfx-dispatch/0003-upgrade-cmake-3.14.patch",
+        "res/vcpkg/mfx-dispatch/fix-pkgconf.patch",
+        "res/vcpkg/mfx-dispatch/fix-unresolved-symbol.patch",
+        "res/vcpkg/mfx-dispatch/portfile.cmake",
+        "res/vcpkg/mfx-dispatch/vcpkg.json",
+        "res/vcpkg/opus/fix-pkgconfig-version.patch",
+        "res/vcpkg/opus/portfile.cmake",
+        "res/vcpkg/opus/vcpkg.json",
+        "res/xorg.conf",
+        "scripts/Disable-SwanUnattendedAccess.ps1",
+        "scripts/Enable-SwanUnattendedAccess.ps1",
+        "scripts/Install-SwanRemoteSupport-UNSIGNED-TEST.cmd",
+        "scripts/Install-SwanRemoteSupport.cmd",
+        "scripts/Install-SwanRemoteSupport.ps1",
+        "scripts/Run-Swan-Technician-UNSIGNED-TEST.cmd",
+        "src/auth_2fa.rs",
+        "src/build_metadata.rs",
+        "src/client.rs",
+        "src/client/file_trait.rs",
+        "src/client/helper.rs",
+        "src/client/io_loop.rs",
+        "src/client/screenshot.rs",
+        "src/clipboard.rs",
+        "src/clipboard_file.rs",
+        "src/common.rs",
+        "src/core_main.rs",
+        "src/custom_server.rs",
+        "src/flutter.rs",
+        "src/flutter_ffi.rs",
+        "src/hbbs_http.rs",
+        "src/hbbs_http/account.rs",
+        "src/hbbs_http/downloader.rs",
+        "src/hbbs_http/http_client.rs",
+        "src/hbbs_http/record_upload.rs",
+        "src/hbbs_http/sync.rs",
+        "src/ipc.rs",
+        "src/ipc/auth.rs",
+        "src/ipc/fs.rs",
+        "src/kcp_stream.rs",
+        "src/keyboard.rs",
+        "src/lan.rs",
+        "src/lang.rs",
+        "src/lang/README.md",
+        "src/lang/ar.rs",
+        "src/lang/be.rs",
+        "src/lang/bg.rs",
+        "src/lang/ca.rs",
+        "src/lang/cn.rs",
+        "src/lang/cs.rs",
+        "src/lang/da.rs",
+        "src/lang/de.rs",
+        "src/lang/el.rs",
+        "src/lang/en.rs",
+        "src/lang/eo.rs",
+        "src/lang/es.rs",
+        "src/lang/et.rs",
+        "src/lang/eu.rs",
+        "src/lang/fa.rs",
+        "src/lang/fi.rs",
+        "src/lang/fr.rs",
+        "src/lang/ge.rs",
+        "src/lang/gu.rs",
+        "src/lang/he.rs",
+        "src/lang/hi.rs",
+        "src/lang/hr.rs",
+        "src/lang/hu.rs",
+        "src/lang/id.rs",
+        "src/lang/it.rs",
+        "src/lang/ja.rs",
+        "src/lang/ko.rs",
+        "src/lang/kz.rs",
+        "src/lang/lt.rs",
+        "src/lang/lv.rs",
+        "src/lang/ml.rs",
+        "src/lang/nb.rs",
+        "src/lang/nl.rs",
+        "src/lang/pl.rs",
+        "src/lang/pt_PT.rs",
+        "src/lang/ptbr.rs",
+        "src/lang/ro.rs",
+        "src/lang/ru.rs",
+        "src/lang/sc.rs",
+        "src/lang/sk.rs",
+        "src/lang/sl.rs",
+        "src/lang/sq.rs",
+        "src/lang/sr.rs",
+        "src/lang/sv.rs",
+        "src/lang/ta.rs",
+        "src/lang/template.rs",
+        "src/lang/th.rs",
+        "src/lang/tr.rs",
+        "src/lang/tw.rs",
+        "src/lang/uk.rs",
+        "src/lang/vi.rs",
+        "src/lib.rs",
+        "src/main.rs",
+        "src/managed.rs",
+        "src/naming.rs",
+        "src/platform/delegate.rs",
+        "src/platform/gtk_sudo.rs",
+        "src/platform/linux.rs",
+        "src/platform/linux_desktop_manager.rs",
+        "src/platform/macos.mm",
+        "src/platform/macos.rs",
+        "src/platform/mod.rs",
+        "src/platform/privileges_scripts/agent.plist",
+        "src/platform/privileges_scripts/daemon.plist",
+        "src/platform/privileges_scripts/install.scpt",
+        "src/platform/privileges_scripts/uninstall.scpt",
+        "src/platform/privileges_scripts/update.scpt",
+        "src/platform/win_device.rs",
+        "src/platform/windows.cc",
+        "src/platform/windows.rs",
+        "src/platform/windows/acl.rs",
+        "src/platform/windows_delete_test_cert.cc",
+        "src/plugin/callback_ext.rs",
+        "src/plugin/callback_msg.rs",
+        "src/plugin/config.rs",
+        "src/plugin/desc.rs",
+        "src/plugin/errno.rs",
+        "src/plugin/ipc.rs",
+        "src/plugin/manager.rs",
+        "src/plugin/mod.rs",
+        "src/plugin/native.rs",
+        "src/plugin/native_handlers/macros.rs",
+        "src/plugin/native_handlers/mod.rs",
+        "src/plugin/native_handlers/session.rs",
+        "src/plugin/native_handlers/ui.rs",
+        "src/plugin/plog.rs",
+        "src/plugin/plugins.rs",
+        "src/port_forward.rs",
+        "src/privacy_mode.rs",
+        "src/privacy_mode/macos.rs",
+        "src/privacy_mode/win_exclude_from_capture.rs",
+        "src/privacy_mode/win_input.rs",
+        "src/privacy_mode/win_mag.rs",
+        "src/privacy_mode/win_topmost_window.rs",
+        "src/privacy_mode/win_virtual_display.rs",
+        "src/rendezvous_mediator.rs",
+        "src/server.rs",
+        "src/server/audio_service.rs",
+        "src/server/clipboard_service.rs",
+        "src/server/connection.rs",
+        "src/server/dbus.rs",
+        "src/server/display_service.rs",
+        "src/server/input_service.rs",
+        "src/server/login_failure_check.rs",
+        "src/server/portable_service.rs",
+        "src/server/printer_service.rs",
+        "src/server/rdp_input.rs",
+        "src/server/service.rs",
+        "src/server/terminal_helper.rs",
+        "src/server/terminal_service.rs",
+        "src/server/uinput.rs",
+        "src/server/video_qos.rs",
+        "src/server/video_service.rs",
+        "src/server/wayland.rs",
+        "src/service.rs",
+        "src/tray.rs",
+        "src/ui.rs",
+        "src/ui/ab.tis",
+        "src/ui/chatbox.html",
+        "src/ui/cm.css",
+        "src/ui/cm.html",
+        "src/ui/cm.rs",
+        "src/ui/cm.tis",
+        "src/ui/common.css",
+        "src/ui/common.tis",
+        "src/ui/file_transfer.css",
+        "src/ui/file_transfer.tis",
+        "src/ui/grid.tis",
+        "src/ui/header.css",
+        "src/ui/header.tis",
+        "src/ui/index.css",
+        "src/ui/index.html",
+        "src/ui/index.tis",
+        "src/ui/install.html",
+        "src/ui/install.tis",
+        "src/ui/msgbox.tis",
+        "src/ui/port_forward.tis",
+        "src/ui/printer.tis",
+        "src/ui/remote.css",
+        "src/ui/remote.html",
+        "src/ui/remote.rs",
+        "src/ui/remote.tis",
+        "src/ui_cm_interface.rs",
+        "src/ui_interface.rs",
+        "src/ui_session_interface.rs",
+        "src/updater.rs",
+        "src/virtual_display_manager.rs",
+        "src/whiteboard/client.rs",
+        "src/whiteboard/linux.rs",
+        "src/whiteboard/macos.rs",
+        "src/whiteboard/mod.rs",
+        "src/whiteboard/server.rs",
+        "src/whiteboard/win_linux.rs",
+        "src/whiteboard/windows.rs",
+        "tests/test_invariant_wf_cliprdr.c",
+        "vcpkg.json"
+      ]
+    }
+  ],
+  "msvc_input_proofs": [
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37827.9",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    },
+    {
+      "input_identity_sha256": "cc28be208566e3a22107767ee1c5a7dbd926154258b518b9abf7f15810a81f47",
+      "files": 618,
+      "visual_studio_version": "17.14.37827.9",
+      "toolset_directory_version": "14.44.35207",
+      "scope": "Recorded default x64 MSVC inputs; not Windows SDK or actual compiler-command verification"
+    }
+  ],
+  "client_wrapper_input_proofs": [
+    {
+      "original_canonical_sha256": "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989",
+      "patched_source_sha256": [
+        "4ecdd3b3ace7672043ffbcddd157324915f21854d2c7885cbdaf73fdac6731a0"
+      ],
+      "source_files": 1
+    },
+    {
+      "original_canonical_sha256": "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989",
+      "patched_source_sha256": [
+        "4ecdd3b3ace7672043ffbcddd157324915f21854d2c7885cbdaf73fdac6731a0"
+      ],
+      "source_files": 1
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.22-customer-x64-unsigned.msi",
+      "first_sha256": "6ff296f30323534820161c516b4fd5da848c66db2bd3c351a4858698ac9a6234",
+      "second_sha256": "6ff296f30323534820161c516b4fd5da848c66db2bd3c351a4858698ac9a6234",
+      "first_bytes": 34033664,
+      "second_bytes": 34033664,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.22-technician-x64-unsigned.exe",
+      "first_sha256": "030232ad3c486a20d43729dae14a26f65dd9205d2589bf7eecc85914f542a230",
+      "second_sha256": "030232ad3c486a20d43729dae14a26f65dd9205d2589bf7eecc85914f542a230",
+      "first_bytes": 24285696,
+      "second_bytes": 24285696,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.22-technician-x64-unsigned.msi",
+      "first_sha256": "d8ffe486f1a3e4667d149ddf8761a750f7a67858a409ce9a18616668afca7f08",
+      "second_sha256": "d8ffe486f1a3e4667d149ddf8761a750f7a67858a409ce9a18616668afca7f08",
+      "first_bytes": 31780864,
+      "second_bytes": 31780864,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.22-x64-unsigned-install.exe",
+      "first_sha256": "030232ad3c486a20d43729dae14a26f65dd9205d2589bf7eecc85914f542a230",
+      "second_sha256": "030232ad3c486a20d43729dae14a26f65dd9205d2589bf7eecc85914f542a230",
+      "first_bytes": 24285696,
+      "second_bytes": 24285696,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "0bdd06fabae186d5a95ccd0ab2e9bc86011d27424564afabd516a198b486873b",
+      "second_sha256": "0bdd06fabae186d5a95ccd0ab2e9bc86011d27424564afabd516a198b486873b",
+      "first_bytes": 66129408,
+      "second_bytes": 66129408,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+      "second_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+      "first_bytes": 5862912,
+      "second_bytes": 5862912,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+      "second_sha256": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+      "first_bytes": 9378816,
+      "second_bytes": 9378816,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+      "second_sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+      "first_bytes": 4901376,
+      "second_bytes": 4901376,
+      "identical": true
+    }
+  ],
+  "all_shipping_bytes_identical": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "builds": [
+    {
+      "workflow_run": 42079677235,
+      "run_attempt": 1,
+      "artifact": 13445521816,
+      "archive_digest": "sha256:030303d1e0f736f68c2b238fb3ee0e15e71d9c7099c0bb608b20416b2d89e51a",
+      "bytes": 278979525
+    },
+    {
+      "workflow_run": 42169429003,
+      "run_attempt": 1,
+      "artifact": 13483537929,
+      "archive_digest": "sha256:fc674c19b2bcf797d8ee066b2b3ef484f33c34596bc8bb08aeac2e4c62c4a424",
+      "bytes": 278979593
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "comparison_workflow": {
+    "source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+    "run": "42177470881"
+  },
+  "original_comparison_report_artifact": {
+    "artifact": 13483379982,
+    "bytes": 24690,
+    "digest": "sha256:804b09e97e675ad1e32c316b5f0380beb2bd26f8637320aa4a6fab3cfccb78eb"
+  },
+  "qualification_limits": [
+    "Unsigned original output reproducibility only; not installed Windows11 acceptance.",
+    "No production signing or publication.",
+    "Historical +92 mismatch cause remains unexplained; fresh-output +93 comparison passes.",
+    "AV1 captured input/library provenance was separately traced for the primary build; this report compares shipping bytes."
+  ]
+}
diff --git a/docs/evidence/1522-fresh-x64-primary-build-20261106.json b/docs/evidence/1522-fresh-x64-primary-build-20261106.json
new file mode 100644
index 00000000000..d7160cb2063
--- /dev/null
+++ b/docs/evidence/1522-fresh-x64-primary-build-20261106.json
@@ -0,0 +1,68 @@
+{
+  "candidate": "1.5.22+93",
+  "source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "workflow_run": 42079677235,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/42079677235",
+  "original_unsigned_artifact": {
+    "artifact": 13445521816,
+    "digest": "sha256:030303d1e0f736f68c2b238fb3ee0e15e71d9c7099c0bb608b20416b2d89e51a",
+    "expected_bytes": 278979525,
+    "source": "d5eeaa918fbb2510148d041297be99dbdc169360"
+  },
+  "tracked_source_files_verified": 1421,
+  "all_six_original_bridge_inputs_verified": true,
+  "all_declared_manifest_hashes_verified": true,
+  "compiled_branding_approval_transfer_logs_verified": true,
+  "shipping_sha256": {
+    "SwanRemoteSupport-1.5.22-customer-x64-unsigned.msi": "6ff296f30323534820161c516b4fd5da848c66db2bd3c351a4858698ac9a6234",
+    "SwanRemoteSupport-1.5.22-technician-x64-unsigned.exe": "030232ad3c486a20d43729dae14a26f65dd9205d2589bf7eecc85914f542a230",
+    "SwanRemoteSupport-1.5.22-technician-x64-unsigned.msi": "d8ffe486f1a3e4667d149ddf8761a750f7a67858a409ce9a18616668afca7f08",
+    "SwanRemoteSupport-1.5.22-x64-unsigned-install.exe": "030232ad3c486a20d43729dae14a26f65dd9205d2589bf7eecc85914f542a230",
+    "SwanServerSetup-UNSIGNED-TEST.exe": "0bdd06fabae186d5a95ccd0ab2e9bc86011d27424564afabd516a198b486873b",
+    "swan-agent.exe": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+    "swan-management.exe": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+    "swan-worker.exe": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e"
+  },
+  "av1_trace": {
+    "source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+    "run": 42079677235,
+    "original_installed_library_sha256": "65eea89b4a2ff6b22939e69b8a04e61c64ce34b9779c1c91c176d1359cb6a515",
+    "original_object_sha256": "072718e365b6dd404ae1b0e12eff30852f92727a4656f0a4520a63bae82fbec4",
+    "archive_members": 332,
+    "exact_object_matches_in_installed_library": [
+      {
+        "member": "/10078",
+        "archive_offset": 34002834,
+        "bytes": 491979
+      }
+    ],
+    "symbol": "av1_update_inter_mode_stats",
+    "function_bytes": 365,
+    "function_code_sha256_with_original_terminal_relocation": "1278ac11313ba2abe5b46fee3490712afd39a68fd1bac0fa0034a4f56a9a02bc",
+    "original_dll_sha256": "8c35aedb98f6ac9bf4b98d6727e246cb94f0b86919766713a6f26f76e096f09e",
+    "original_function_prefix_matches_in_dll_before_recorded_terminal_relocation": [
+      {
+        "file_offset": "0xddd220",
+        "rva": "0xddde20"
+      }
+    ],
+    "compiled_and_bundled_dll_hashes_match_extracted_original_payload": true,
+    "matches_previous_dll_variants": [
+      true,
+      false
+    ],
+    "no_normalization_or_execution_of_downloaded_binaries": true,
+    "independent_reproduction_verified": false,
+    "production_qualified": false
+  },
+  "independent_run": 42169429003,
+  "independent_run_result": "success",
+  "reproducibility_proven": true,
+  "downloaded_executables_run": false,
+  "candidate_installed": false,
+  "production_signed": false,
+  "production_published": false,
+  "scope": "All eight original unsigned outputs independently reproduced from exact public source with source/bridge/MSVC/wrapper verification. No Windows11 runtime qualification or production signing. Historical +92 mismatch cause remains unexplained.",
+  "comparison_run": 42177470881,
+  "comparison_artifact_digest": "sha256:804b09e97e675ad1e32c316b5f0380beb2bd26f8637320aa4a6fab3cfccb78eb"
+}
diff --git a/docs/evidence/1522-fresh93-customer-exe-and-four-company-bundles-20261106.json b/docs/evidence/1522-fresh93-customer-exe-and-four-company-bundles-20261106.json
new file mode 100644
index 00000000000..7c8d509e98a
--- /dev/null
+++ b/docs/evidence/1522-fresh93-customer-exe-and-four-company-bundles-20261106.json
@@ -0,0 +1,99 @@
+{
+  "source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "candidate": "1.5.22+93",
+  "windows_endpoint_targets": [
+    "windows_11"
+  ],
+  "customer_exe": {
+    "producer_source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+    "unsigned_outer_sha256": "fa56f0435042c31105ff0df8bc5c6ef2ce712acc6aa8be8f24379f9b8d58ec59",
+    "signed_outer_sha256": "eb29d8f1bced5561740224e40e29f2cfe85fa830f8bed46dc227521e59bc04a2",
+    "signed_inner_sha256": "744c4237b4e49fae47c6d5d42f0ad2a61c1a1a80daddc47e962bc163f75b6192",
+    "installed_manifest_sha256": "1dd8a2113828d110384668440ccbe16684963cc31a116be9c21bd254b099155b",
+    "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+    "actual_native_packer_tests_passed": 6,
+    "actual_windows_python_packaging_tests_passed": 10,
+    "embedded_files": 95,
+    "independent_original_bytes_verified": true,
+    "signed_payload_verified_again_on_host": true,
+    "wrong_signed_inner_manifest_rejected_on_real_signed_package": true,
+    "public_producer_sources_exactly_match_executed_files": true
+  },
+  "four_company_bundles": [
+    {
+      "edition": "technician",
+      "format": "exe",
+      "sequence": 28,
+      "job_id": "97d7d0e9-133c-4f31-94a4-1e881fea2a83",
+      "bundle_sha256": "2816b55bff6b74192c6c3782b931eb8fc83cb0b2e98ee2403481c7128effa009",
+      "bytes": 26281154,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "msi",
+      "sequence": 32,
+      "job_id": "661ad2d8-c593-4503-aa51-f297c83e9ee9",
+      "bundle_sha256": "24d5066b68eab45b522439cb5843db835ab8468a91fca2e2ef53e171b5ddbf31",
+      "bytes": 32826823,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "format": "msi",
+      "sequence": 29,
+      "job_id": "a81ec53a-8359-4670-b50e-3d1ca3602087",
+      "bundle_sha256": "33c482118e9b955d88f7f87cb4b52d4dbd5caea6a9b022362871b8f0ef679dde",
+      "bytes": 30624959,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    },
+    {
+      "edition": "customer",
+      "format": "exe",
+      "sequence": 33,
+      "job_id": "9b62d7e1-4a64-4f66-89cf-3ac3ee1f4345",
+      "bundle_sha256": "6d4a7cdb662a5b6ab6dd863d6f736da8a80e861ebbbb2844dc39348f0059d436",
+      "bytes": 26295173,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    }
+  ],
+  "release_import_security": {
+    "invalid_signatures_rejected": true,
+    "request_cannot_override_operator_release_key": true,
+    "unapproved_builds_rejected_without_job_creation": true,
+    "signed_profile_policy_unchanged": true,
+    "automatic_updates_paused": true
+  },
+  "existing_worker_reused": true,
+  "private_keys_exported": false,
+  "lab_signing_only": true,
+  "installer_executed": false,
+  "windows11_runtime_qualified": false,
+  "internet_connectivity_qualified": false,
+  "production_publication": false,
+  "scope": "Actual company worker generation and HTTPS downloads after source and signature verification. EXE and MSI use their own payload manifests. Lab publisher only; Windows11 lifecycle/session/update testing remains open."
+}
diff --git a/docs/evidence/1522-fresh93-lab-signed-packages-20261106.json b/docs/evidence/1522-fresh93-lab-signed-packages-20261106.json
new file mode 100644
index 00000000000..99124b25cb9
--- /dev/null
+++ b/docs/evidence/1522-fresh93-lab-signed-packages-20261106.json
@@ -0,0 +1,36 @@
+{
+  "source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "candidate": "1.5.22+93",
+  "unsigned_reproduction_evidence": "1522-fresh-x64-independent-comparison-20261106.json",
+  "primary_run": 42079677235,
+  "independent_run": 42169429003,
+  "comparison_run": 42177470881,
+  "lab_only": true,
+  "intended_endpoint_windows_versions": [
+    "windows_11"
+  ],
+  "verified_input_files": 217,
+  "all_five_signatures_valid": true,
+  "nonexportable_existing_lab_key_verified": true,
+  "private_key_exported": false,
+  "original_inputs_unchanged": true,
+  "publisher": "Swan Disposable Lab Publisher 20261027",
+  "publisher_certificate_sha256": "c797e22798a8afa94496ea0e8668b6e5ee4a4fc9f639b8200d5e1071e6925ec3",
+  "output_sha256": {
+    "signed_customer_msi_sha256": "85cfbcc617f26fe2cf0a8c4dd1de8e410b6e332ad7cacb19f95ae51650abac52",
+    "signed_customer_executable_sha256": "744c4237b4e49fae47c6d5d42f0ad2a61c1a1a80daddc47e962bc163f75b6192",
+    "signed_technician_msi_sha256": "ca1901bcf8dbc6eb9441f9acc0bfc563dfe9248214b09999ecf76289c6001587",
+    "signed_technician_executable_sha256": "618faf8c9abf70011e7bb254375862f883c61db0e6737246371b2525c4728442",
+    "signed_agent_sha256": "4441b3c15816cf50588b2dd24bf9375c87b2227d8adfdfb60621c6f2c552dd67"
+  },
+  "original_records_hash_verified": 19,
+  "customer_installed_manifest_files": 96,
+  "timestamp_receipts_verified": true,
+  "task_has_no_recurring_triggers": true,
+  "company_updates_paused": true,
+  "customer_exe_producer_running_separately": true,
+  "packages_installed": false,
+  "production_signing": false,
+  "production_publication": false,
+  "limits": "Lab signature and packaging evidence only. No Windows11 runtime, internet connectivity or production publisher qualification."
+}
diff --git a/docs/evidence/1522-fresh93-win11-current-technician-mfa-inventory-20261106.json b/docs/evidence/1522-fresh93-win11-current-technician-mfa-inventory-20261106.json
new file mode 100644
index 00000000000..32fad6d2ee2
--- /dev/null
+++ b/docs/evidence/1522-fresh93-win11-current-technician-mfa-inventory-20261106.json
@@ -0,0 +1,19 @@
+{
+  "application_source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "edition": "technician",
+  "installed_sequence": 29,
+  "version": "1.5.22",
+  "scope": "Existing Windows11 x64 fixture; registry26300, desktop watermark26100",
+  "observed_utc": "2026-11-06T10:08:00Z",
+  "evidence_method": "Real installed native GUI through existing lab console, after the shipping signed-file verification and automatic MSI upgrade recorded separately",
+  "existing_standard_lab_user": true,
+  "real_company_mfa_login_succeeded": true,
+  "authorized_device_inventory_visually_displayed": true,
+  "company_branding_visually_displayed": true,
+  "password_and_one_time_code_not_logged": true,
+  "reusable_credentials_or_tokens_in_process_arguments": false,
+  "new_support_session_qualified": false,
+  "sign_out_qualified": false,
+  "production_signing": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1522-fresh93-win11-customer-automatic-msi-upgrade-20261106.json b/docs/evidence/1522-fresh93-win11-customer-automatic-msi-upgrade-20261106.json
new file mode 100644
index 00000000000..ab24df047cd
--- /dev/null
+++ b/docs/evidence/1522-fresh93-win11-customer-automatic-msi-upgrade-20261106.json
@@ -0,0 +1,30 @@
+{
+  "automatic_standard_user_frontend_relaunched": true,
+  "service_running": true,
+  "identity_enrollment_trust_and_consent_preserved": true,
+  "lab_publisher_valid": true,
+  "manual_installer_or_update_command_invoked": false,
+  "profile_revision": 45,
+  "from_sequence": 19,
+  "production_signing": false,
+  "utc": "2026-11-06T09:26:46.3257768Z",
+  "shipping_verifier_passed": true,
+  "edition": "customer",
+  "no_pending_or_failed_recovery": true,
+  "to_version": "1.5.22+93",
+  "exact_signed_installed_bytes": true,
+  "to_sequence": 32,
+  "application_source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "os_fixture": "Existing Windows11 EnterpriseEval x64; registry build26300, desktop watermark26100; no other OS compatibility qualified",
+  "package_format": "msi",
+  "visible_company_branding_observed_before_and_after": true,
+  "original_paused_policy_and_all_release_approvals_restored": {
+    "utc": "2026-11-06T09:25:31.672145+00:00",
+    "revision": 46,
+    "original_policy_and_all_approvals_restored": true,
+    "updates_paused": true
+  },
+  "technician_upgrade_qualified": false,
+  "public_direct_and_relay_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1522-fresh93-win11-customer-msi-missing-file-repair-20261106.json b/docs/evidence/1522-fresh93-win11-customer-msi-missing-file-repair-20261106.json
new file mode 100644
index 00000000000..afbd8e4e40d
--- /dev/null
+++ b/docs/evidence/1522-fresh93-win11-customer-msi-missing-file-repair-20261106.json
@@ -0,0 +1,25 @@
+{
+  "sequence": 32,
+  "full_shipping_verifier_passed": true,
+  "source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "identity_trust_enrollment_and_consent_preserved": true,
+  "exact_license_restored_by_shipping_repair": true,
+  "utc": "2026-11-06T10:21:00.5542646Z",
+  "no_pending_recovery": true,
+  "missing_hashed_license_detected": true,
+  "test_principal": "SYSTEM",
+  "edition": "customer",
+  "service_and_watcher_running": true,
+  "production_signing": false,
+  "interactive_uac_qualified": false,
+  "observation_utc": "2026-11-06T10:22:05.6516570Z",
+  "actual_task_terminal_success": true,
+  "original_missing_file_backup_retained": true,
+  "first_harness_attempt": {
+    "repair_invoked": false,
+    "failed_on_expected_negative_verification_stderr": true,
+    "resolution": "Continuation retained the same missing-file fixture and original error, captured the verifier child exit code correctly, then invoked the shipping repair path."
+  },
+  "scope": "Existing Windows11 x64 only, customer MSI32, signed isolated lab package",
+  "production_publication": false
+}
diff --git a/docs/evidence/1522-fresh93-win11-msi-uninstall-ui-regression-20261106.json b/docs/evidence/1522-fresh93-win11-msi-uninstall-ui-regression-20261106.json
new file mode 100644
index 00000000000..5bcb5a2a161
--- /dev/null
+++ b/docs/evidence/1522-fresh93-win11-msi-uninstall-ui-regression-20261106.json
@@ -0,0 +1,36 @@
+{
+  "application_source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "os_scope": "Existing Windows11 x64 lab fixture",
+  "msi32_uninstall_exit_code": 0,
+  "files_service_watcher_and_registration_removed": true,
+  "full_uninstall_and_reinstall_acceptance_passed": false,
+  "failure": "Customer standard-user UI processes survived MSI uninstall. Windows renamed their mapped executable into Config.Msi. The next signed EXE setup correctly rejected those processes at the kernel image-path check.",
+  "real_remaining_customer_ui_process_count": 2,
+  "kernel_path_read_only_observation_utc": "2026-11-06T10:54:36.3036638Z",
+  "signed_setup_marker_retained_on_failure": true,
+  "path_or_identity_safety_check_weakened": false,
+  "manual_lab_cleanup_required": true,
+  "explicit_exe33_setup_resume": {
+    "manual_stale_ui_cleanup_required": true,
+    "sequence": 33,
+    "explicit_company_bundle_reinstall_passed": true,
+    "version": "1.5.22+93",
+    "identity_trust_enrollment_and_consent_preserved": true,
+    "old_msi_registration_absent": true,
+    "production_publication": false,
+    "interactive_uac_qualified": false,
+    "format": "exe",
+    "original_uninstall_cancellation_cleared_by_explicit_setup": true,
+    "edition": "customer",
+    "utc": "2026-11-06T11:14:33.7293925Z",
+    "fresh_os_install_qualified": false,
+    "shipping_payload_95_file_verifier_passed": true,
+    "expected_lab_signatures_valid": true,
+    "no_pending_recovery": true,
+    "service_and_watcher_running": true,
+    "test_principal": "SYSTEM"
+  },
+  "source_fix_under_test": "Close real customer UI before MSI RemoveFiles; keep disabled per-user restart tasks until commit or rollback, and restore UI on rollback.",
+  "shipping_fix_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1522-fresh93-win11-technician-automatic-msi-upgrade-20261106.json b/docs/evidence/1522-fresh93-win11-technician-automatic-msi-upgrade-20261106.json
new file mode 100644
index 00000000000..c8c55e63f4d
--- /dev/null
+++ b/docs/evidence/1522-fresh93-win11-technician-automatic-msi-upgrade-20261106.json
@@ -0,0 +1,35 @@
+{
+  "version": "1.5.22",
+  "no_pending_or_failed_recovery": true,
+  "shipping_verifier_passed": true,
+  "production_signing": false,
+  "utc": "2026-11-06T09:58:48.5355326Z",
+  "to_sequence": 29,
+  "from_sequence": 27,
+  "expected_lab_publisher_valid": true,
+  "edition": "technician",
+  "customer_remains_sequence32": true,
+  "manual_installer_or_update_command_invoked": false,
+  "exact_signed_installed_bytes": true,
+  "identity_trust_credential_consent_preserved": true,
+  "application_source": "d5eeaa918fbb2510148d041297be99dbdc169360",
+  "package_format": "msi",
+  "os_scope": "Existing Windows11 x64 fixture only; registry build26300; desktop watermark26100",
+  "automatic_standard_user_frontend_relaunch_verified": true,
+  "company_branded_login_and_about_1522_visually_observed": true,
+  "original_policy_and_all_release_approvals_restored": {
+    "utc": "2026-11-06T09:58:31.505620+00:00",
+    "revision": 50,
+    "original_policy_and_all_approvals_restored": true,
+    "updates_paused": true
+  },
+  "earlier_selection_attempt": {
+    "from_sequence": 19,
+    "selected_sequence": 27,
+    "version": "1.5.21",
+    "cause": "Existing installation used MSI, while the initial lab selection withdrew new MSI29 and targeted EXE28. Old approved MSI27 was therefore selected. Policy and all approvals were restored at revision48 before the corrected MSI29 test.",
+    "fresh93_qualification_claimed_for_that_attempt": false
+  },
+  "current_candidate_login_and_sessions_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/1522-fresh93-win11-technician-foreground-uninstall-failure-20261106.json b/docs/evidence/1522-fresh93-win11-technician-foreground-uninstall-failure-20261106.json
new file mode 100644
index 00000000000..1e4f67b94f9
--- /dev/null
+++ b/docs/evidence/1522-fresh93-win11-technician-foreground-uninstall-failure-20261106.json
@@ -0,0 +1,25 @@
+{
+  "observed_utc": "2026-11-06T12:11:03.0441551Z",
+  "operating_system": "Windows 11 x64 lab",
+  "edition": "technician",
+  "native_version": "1.5.22+93",
+  "company_release_sequence": 29,
+  "standard_user_test": true,
+  "installer_exit": 0,
+  "msi_registered_after_removal": false,
+  "installed_executable_present_after_removal": false,
+  "installed_agent_present_after_removal": false,
+  "cancellation_marker_retained": true,
+  "native_process_before_and_after": {
+    "pid": 5624,
+    "created_utc": "2026-11-06T09:56:54.6110410Z",
+    "session": 1
+  },
+  "full_foreground_uninstall_passed": false,
+  "test_recorder_task_exit": 0,
+  "recorder_success_is_not_installer_acceptance": true,
+  "corrective_candidate": "1.5.23+94",
+  "superseded_customer_only_candidate_run": 42213325451,
+  "superseded_run_conclusion": "cancelled",
+  "required_follow_up": "Rebuild the combined fixes and repeat real Windows 11 foreground uninstall, reinstall and rollback; process-registration unit tests alone do not qualify the installer."
+}
diff --git a/docs/evidence/1522-management-reproduction-upgrade-and-probe-20261105.json b/docs/evidence/1522-management-reproduction-upgrade-and-probe-20261105.json
new file mode 100644
index 00000000000..29562dcb1a5
--- /dev/null
+++ b/docs/evidence/1522-management-reproduction-upgrade-and-probe-20261105.json
@@ -0,0 +1,200 @@
+{
+  "date": "2026-11-05",
+  "source": "6a0c02af89191283f9839ce429c587daa1ed0f03",
+  "scope": "Owned isolated development lab; not production or external Internet qualification",
+  "canonical_linux": {
+    "primary_image": "sha256:878e6e9b327a511a64eacee043b7516a24fba09f0261842bdbc2a8099a1b60b8",
+    "independent_image": "sha256:ce2ba3141d7b3c2877236fe0757b6c62b18e7798bfc44a2c641cbccb6f2f9008",
+    "management_sha256": "2318b9242277944e2f3df93a5e1dcf4ace0d542da20007498e660f87e3b5de9e",
+    "management_bytes": 11092600,
+    "cold_builds_raw_binary_and_source_bytes_identical": true,
+    "whole_oci_byte_reproduction": false,
+    "official_pinned_builder_and_public_canonical_recipe": true,
+    "fresh_company_setup_mfa_replay_enrollment_restart_backup_restore": "passed",
+    "anonymous_bootstrap_denied_and_admin_six_public_fields": "passed"
+  },
+  "windows_checker": {
+    "component_source": "e57414562756e7abf50678d77926ec3e94d94340",
+    "component_workflow": 41948266237,
+    "management_sha256": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+    "exact_corresponding_source_files_verified": 261,
+    "current_public_fifteen_case_fixture": "passed",
+    "valid_der_and_pem": "passed",
+    "invalid_profile_trust_lifetime_company_redirect_tls_and_udp": "rejected",
+    "fixture_peers_are_not_native_session_evidence": true,
+    "no_credentials_or_company_state_created": true,
+    "independent_component_comparison": {
+      "previous_run": 41948266237,
+      "current_run": 41951800979,
+      "source": "6a0c02af89191283f9839ce429c587daa1ed0f03",
+      "source_files_verified": 261,
+      "all_three_unsigned_component_bytes_identical": true,
+      "shipping_byte_normalization": false,
+      "compiled_runtime_unchanged_source_diff": [
+        "deployment/windows/test-network-probe.js",
+        "docs/evidence/network-probe-windows-port-reservation-control-20261105.json"
+      ],
+      "components": {
+        "swan-management.exe": {
+          "identical": true,
+          "sha256": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+          "bytes": 9378816
+        },
+        "swan-agent.exe": {
+          "identical": true,
+          "sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+          "bytes": 5862912
+        },
+        "swan-worker.exe": {
+          "identical": true,
+          "sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+          "bytes": 4901376
+        }
+      },
+      "current_ci_fifteen_case_checker_fixture_passed": true,
+      "installed_signed_files_not_compared": true
+    }
+  },
+  "canonical_image_checker": {
+    "real_existing_company_https_and_pinned_profile": "passed",
+    "four_tcp_ports_and_actual_native_stateless_udp_response": "passed",
+    "der_and_pem_ca": "passed",
+    "wrong_key_untrusted_ca_private_as_outside_claim": "rejected",
+    "external_direct_relay_and_nat_traversal_qualified": false
+  },
+  "full_backup_restore": {
+    "encrypted_archive_bytes": 1736617357,
+    "encrypted_archive_sha256": "0899d65013ecac5eeff3010ad68d518aafedc7f973a0f6085e2bc2261c25841f",
+    "passphrase_kept_separately_with_restricted_local_acl": true,
+    "wrong_password_rejected_before_destination": true,
+    "restored_database_headers_keys_and_actual_deployment_configuration_match": true,
+    "all_57_installer_files_and_6_tls_identity_files_match": true,
+    "offline_no_restored_network_or_server_started": true,
+    "full_existing_company_live_restored_mfa_and_signing_test": "passed in a later network-none rehearsal",
+    "restored_runtime": {
+      "original_company_mfa_and_replay_rejection": "passed",
+      "actual_profile_signature_matches_original_trust_pin": true,
+      "paused_profile44_branding_and_policy_preserved": true,
+      "device_user_release_build_records_preserved_across_restart": true,
+      "anonymous_bootstrap_denied_admin_public_export_passed": true,
+      "runtime_uid": 10001,
+      "network": "none; test HTTP entered only the isolated network namespace",
+      "host_ports_and_cloned_transport": false,
+      "restored_https_and_native_sessions": "not tested",
+      "stopped_and_storage_retained": true,
+      "test_transport_findings": "The first two harness attempts closed or waited for stdin/EOF incorrectly. The final harness reads the framed HTTP response before closing BusyBox nc stdin; prior failed attempts and stopped-container proofs are retained. No passing claim is made for those attempts."
+    }
+  },
+  "existing_company_upgrade": {
+    "old_image": "sha256:c8fe75f7c46155dac622464a206153c16c880459a7a4b6366a96bbe90aab1dc9",
+    "new_image_is_canonical_primary": true,
+    "real_https_fresh_mfa_and_trusted_profile": "passed",
+    "company_records_identity_consent_roles_workers_jobs_releases_sessions_preserved": true,
+    "transport_and_https_container_ids_preserved": true,
+    "updates_remain_paused": true,
+    "new_admin_bootstrap_route_and_anonymous_denial": "passed",
+    "agent_and_worker_unsigned_raw_bytes_unchanged_from_previous_components": true,
+    "native_sessions_against_updated_management": "pending"
+  },
+  "app_candidate": {
+    "verified_unsigned_build_1_5_22_90": 41951834320,
+    "installed_or_approved": false,
+    "superseded_by_branding_fix_source": "ca16998e6a51a7d2c4737e69b2b731b0b3cf2eba",
+    "replacement_version": "1.5.22+91",
+    "replacement_build": 41964194947,
+    "replacement_build_runtime_and_reproduction": "Reproduction FAILED; payload-level diagnosis in progress. No22 installation, approval or signing.",
+    "replacement_build_result": "success",
+    "replacement_artifact": 13389315447,
+    "replacement_artifact_bytes": 256777570,
+    "replacement_artifact_digest": "sha256:d15041e05701744d8269d2e82aa340d1b58fc6034980dc3a97a8291d71ff94ee",
+    "replacement_complete_public_source_files": 1406,
+    "replacement_generated_bridges": 6,
+    "original_archive_hash_manifest_and_regression_checks_passed": true,
+    "branding_test_original_completed_job_log_sha256": "a28446e4a661ce06d40548a6a22b3bb6b651133674feb94186bc6dbd55842738",
+    "branding_test_log_omitted_from_original_artifact": true,
+    "future_ci_log_retention_fix_source": "2fc96a4",
+    "all_95_customer_payload_files_extracted_without_execution_and_manifest_verified": true,
+    "independent_rebuild": 41970609821,
+    "independent_rebuild_result": "Both native builds completed successfully",
+    "original_comparison_run": 41976573481,
+    "original_comparison_result": "FAILED: customer/technician installer bytes differ",
+    "original_comparison_report_artifact": 13391927383,
+    "original_comparison_report_digest": "sha256:111cf00f307fdf556ba4cd0268ce7aaf3d30f457796f4212337ac7f8e25aa2bf",
+    "all_eight_original_outputs_identical": false,
+    "recorded_msvc_inputs_identical": true,
+    "original_output_comparison": [
+      {
+        "path": "SwanRemoteSupport-1.5.22-customer-x64-unsigned.msi",
+        "first_sha256": "d848c4e8fc8ca92ee15c2d3a791fc48087bafbd349c635c0dcee03eae270e0fe",
+        "second_sha256": "de18a6ff8fcff44c14d00cbd5baf43099cfc595872c59b96627f535474f149ff",
+        "first_bytes": 34013184,
+        "second_bytes": 34041856,
+        "identical": false
+      },
+      {
+        "path": "SwanRemoteSupport-1.5.22-technician-x64-unsigned.exe",
+        "first_sha256": "767ecaaf90b4c6216f17581f65df5e4945a178e475e56ea33365aeb2bc292dfb",
+        "second_sha256": "91fe1d2f7b68f2fd0ec2a4e946307ea33cf8890e77912c832df99bcf3fb11aa3",
+        "first_bytes": 24284672,
+        "second_bytes": 24285184,
+        "identical": false
+      },
+      {
+        "path": "SwanRemoteSupport-1.5.22-technician-x64-unsigned.msi",
+        "first_sha256": "9b513ea8badcb4debcceabe79dd9f663cf5db9911110b2935a448e0a33a36656",
+        "second_sha256": "295e1a12875873dc2d182b5b80fc16596506c1f39bfa6345a70ed20af9a7d82a",
+        "first_bytes": 31780864,
+        "second_bytes": 31780864,
+        "identical": false
+      },
+      {
+        "path": "SwanRemoteSupport-1.5.22-x64-unsigned-install.exe",
+        "first_sha256": "767ecaaf90b4c6216f17581f65df5e4945a178e475e56ea33365aeb2bc292dfb",
+        "second_sha256": "91fe1d2f7b68f2fd0ec2a4e946307ea33cf8890e77912c832df99bcf3fb11aa3",
+        "first_bytes": 24284672,
+        "second_bytes": 24285184,
+        "identical": false
+      },
+      {
+        "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+        "first_sha256": "40a7280832259bd6aa9dc555d5e0fdd54c54dab2d01a5bf6c3ebfe95ae5e9592",
+        "second_sha256": "40a7280832259bd6aa9dc555d5e0fdd54c54dab2d01a5bf6c3ebfe95ae5e9592",
+        "first_bytes": 66129408,
+        "second_bytes": 66129408,
+        "identical": true
+      },
+      {
+        "path": "swan-agent.exe",
+        "first_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+        "second_sha256": "6c0ee8581baf04e5effee63647e6f9cb52780dbbe51fe34f8d828e8fde170f73",
+        "first_bytes": 5862912,
+        "second_bytes": 5862912,
+        "identical": true
+      },
+      {
+        "path": "swan-management.exe",
+        "first_sha256": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+        "second_sha256": "00cab63adbf5f6bbaab40e27c86933fc884ff644a5a5587cfbd9f1a234db95b2",
+        "first_bytes": 9378816,
+        "second_bytes": 9378816,
+        "identical": true
+      },
+      {
+        "path": "swan-worker.exe",
+        "first_sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+        "second_sha256": "7f87133666aa6a37ccb03287c74b0730bafa53cfb1c86fe87f51b04db0eecd7e",
+        "first_bytes": 4901376,
+        "second_bytes": 4901376,
+        "identical": true
+      }
+    ],
+    "signing_remains_gated": true
+  },
+  "remaining_boundaries": [
+    "Finish current native app and update qualification on existing development pair before final Windows matrix",
+    "No production signing approval or publication",
+    "No external Internet direct or relay session qualification",
+    "No claim that the final advertised Windows compatibility matrix is complete",
+    "Inherited Full Flutter CI41951800985 fails only its deferred i686 Windows job126997550230: the legacy Rust1.75 toolchain cannot parse Cargo.lock version4. This does not establish Windows x64 success; dedicated pinned Rust1.90 app build41964194947 remains required."
+  ]
+}
diff --git a/docs/evidence/1522-msvc-lambda-path-controls-20261105.json b/docs/evidence/1522-msvc-lambda-path-controls-20261105.json
new file mode 100644
index 00000000000..7f6f9cada0f
--- /dev/null
+++ b/docs/evidence/1522-msvc-lambda-path-controls-20261105.json
@@ -0,0 +1,25 @@
+{
+  "date": "2026-11-05",
+  "scope": "Actual standalone MSVC callback/RTTI/source-path fixture; does not qualify the Flutter app or full native release",
+  "fixture_source": "147937229ad8f9f5ab10b6f9ddaf41fed3ca1066",
+  "fixture_run": 41980763281,
+  "previous_valid_fixture_run": 41980016970,
+  "initial_harness_argument_failure_run": 41979631708,
+  "compiler_sha256": "fe251ef50a1545b1b0835ee17b1e785459712b38d79e45b5c1d3d28970a36619",
+  "toolset": "14.44.35207",
+  "windows_sdk": "10.0.26100.0",
+  "same_path_repeat_raw_bytes_identical": true,
+  "same_fixed_path_raw_fixture_hash_also_matches_previous_ci_job": true,
+  "relocation_changes_lambda_type_identifiers_and_original_exe_bytes": true,
+  "tested_controls_raw_byte_equality": {
+    "experimental_and_pathmap": false,
+    "trimfile": false,
+    "compiler_brepro": false,
+    "relative_source": false
+  },
+  "compiler_modes_not_applied_to_application": true,
+  "no_shipping_bytes_normalized": true,
+  "no_new_full_native_build_or_signing_after_mismatch": true,
+  "next_required_evidence": "Capture effective Flutter C++ compiler paths/commands/SDK inputs and constrain actual compilation paths; the apparent fixed checkout path alone has not explained the two original app results. Do not apply failed flags or claim a whole-app fix.",
+  "production_qualified": false
+}
diff --git a/docs/evidence/1522-named-wrapper-primary-build-20261105.json b/docs/evidence/1522-named-wrapper-primary-build-20261105.json
new file mode 100644
index 00000000000..39ff1025a39
--- /dev/null
+++ b/docs/evidence/1522-named-wrapper-primary-build-20261105.json
@@ -0,0 +1,165 @@
+{
+  "date": "2026-11-05",
+  "candidate": "1.5.22+92",
+  "source": "b0959da31f6e7e37e81aed7ce69de47e6d5ed428",
+  "primary_run": 41986403374,
+  "primary_native_job": 127112041115,
+  "primary_workflow_and_all_jobs_passed": true,
+  "artifact": {
+    "id": 13400430054,
+    "bytes": 256841594,
+    "sha256": "bdb3462d8639a8851514b00a55ef644b42b0a109a7010d93f2299bc9870a6f6d",
+    "original_archive_downloaded_once_and_digest_verified": true,
+    "public_source_files_verified": 1417,
+    "generated_bridge_files_verified_against_original_input_artifact": 6,
+    "bridge_input_artifact": 13396815675,
+    "all_declared_checksum_entries_verified": true,
+    "three_loose_backend_binaries_match_previously_reproduced_unchanged_component_sources": true
+  },
+  "actual_sdk_wrapper": {
+    "engine_revision": "a18df97ca57a249df5d8d68cd0820600223ce262",
+    "upstream_canonical_source_sha256": "48214b6261812361168f49d7a073a079b188709e8b29fdd1785307f9eef43989",
+    "patched_source_sha256": "4ecdd3b3ace7672043ffbcddd157324915f21854d2c7885cbdaf73fdac6731a0",
+    "cached_source_files_patched": 1,
+    "receipt_verified_against_exact_archived_public_patch_inputs": true,
+    "engine_dll_unchanged": true,
+    "shipping_binary_normalization": false
+  },
+  "actual_compiled_logs_verified": [
+    "Rust signed display names preserve identity and reject expired authorization",
+    "Four Flutter approval/title tests including live company window rename",
+    "Three bounded transfer-write tests"
+  ],
+  "ci_installer_checks_passed": [
+    "Technician MSI installation repair and uninstall",
+    "Customer MSI headless native service startup",
+    "Pinned company server setup packaging"
+  ],
+  "verification_harness_correction": "The initial local verifier incorrectly required the installer/source checksum file to list three loose backend binaries. Its coverage now matches the actual workflow; the original ZIP digest is verified and each backend hash additionally matches previously reproduced unchanged component sources. No package bytes or declared hashes changed.",
+  "retained_old_originals_regression": "The updated verifier still rejects exactly four of eight shipping outputs from the two original ca16998 builds, while preserving matching public-source, bridge and MSVC proofs. The prior reproduction failure remains valid.",
+  "independent_run": 41996756641,
+  "independent_source_ref": "swan-lab-native22-wrapper-repro-b0959da",
+  "independent_status_at_observation": "in_progress",
+  "subsequent_independent_result": {
+    "workflow_passed": true,
+    "native_job": 127155599864,
+    "prior_native_job": 127146136559,
+    "prior_job_failure": "HTTP 504 fetching a pinned dependency patch before application compilation",
+    "only_failed_windows_job_retried_once": true,
+    "application_source_unchanged": true,
+    "comparison_run": 42009952812,
+    "comparison_job": 127186182002,
+    "comparison_conclusion": "failure",
+    "report_artifact": 13406372756,
+    "report_archive_bytes": 24714,
+    "report_archive_sha256": "56398fb8414128acde781c79d1bcdd764828f54bd6e0900ed06c7beb8416a587",
+    "public_source_bridge_msvc_and_sdk_patch_proofs_match": true,
+    "original_shipping_outputs_compared": 8,
+    "original_shipping_outputs_identical": 4,
+    "identical_outputs": ["company server installer", "management", "agent", "worker"],
+    "differing_outputs": ["customer EXE", "customer MSI", "technician EXE", "technician MSI"],
+    "full_app_reproduction_not_fixed_by_named_wrapper_alone": true,
+    "no_new_full_build_after_comparison_failure": true
+  },
+  "independent_reproduction_verified": false,
+  "subsequent_payload_diagnosis": {
+    "both_original_archives_downloaded_once_and_digest_verified": true,
+    "raw_customer_files_extracted_without_execution_per_archive": 95,
+    "each_extracted_file_matches_its_original_msi_manifest": true,
+    "identical_raw_customer_files": 94,
+    "only_differing_raw_customer_file": "librustdesk.dll",
+    "launcher_plugins_engine_and_dart_payload_now_identical": true,
+    "dll_bytes_each": 37006336,
+    "first_dll_sha256": "d11cf92a45a6801a0699fdf24c16ad596a21f75bd10fe85ad067a6c445574ee9",
+    "second_dll_sha256": "52b8fa35808f229caae14ad87b0da8f4bcb36a822e8d1a10389557c68f728d69",
+    "dll_total_differing_bytes": 73,
+    "text_section_differing_bytes": 1,
+    "rdata_section_differing_bytes": 68,
+    "remaining_header_differing_bytes": 4,
+    "other_six_sections_identical": true,
+    "text_difference_file_offset_hex": "ddd22e",
+    "text_difference_rva_hex": "ddde2e",
+    "first_code_bytes_hex": "418bc3",
+    "second_code_bytes_hex": "498bc3",
+    "containing_exception_table_function_rva_hex": ["ddde20", "dddf8d"],
+    "rdata_ascii_string_sets_identical": true,
+    "instruction_origin_not_yet_identified": true,
+    "subsequent_source_correspondence": {
+      "library": "Pinned AOM AV1 codec",
+      "source_commit": "10aece4157eb79315da205f39e19bf6ab3ee30d0",
+      "source_unit": "av1/encoder/encodeframe_utils.c",
+      "source_unit_canonical_sha256": "e36cdda0a1090348a297082be1e3c328885790244db7683ba1e3f025914933d8",
+      "function": "av1_update_inter_mode_stats",
+      "evidence": "Disassembly matches the four arguments, NEWMV/GLOBALMV/NEARESTMV values16/15/13, context masks/shifts7/3/4, and three sequential adaptive CDF updates. The different instructions decode as mov eax,r11d and mov rax,r11.",
+      "scope": "Source correspondence; linked COFF symbol/object proof still required. No application or dependency source fix is claimed.",
+      "next_diagnostic": ".github/workflows/aom-repro-diagnostic.yml builds only this pinned dependency twice with separate build roots and compiled cache disabled, retaining original source, compiler inputs and encodeframe_utils objects."
+    },
+    "subsequent_compiled_object_proof": {
+      "diagnostic_source": "d6037210843eb735f5a44754759c19ac6024472d",
+      "workflow_run": 42014980990,
+      "job": 127203145933,
+      "conclusion": "success",
+      "artifact": 13409791057,
+      "artifact_bytes": 804729,
+      "artifact_sha256": "6679baa1febf3ab1b65b1e2bc5dbff65357c80a4cba9da4d92d845073283c140",
+      "both_actual_source_unit_hashes_match_reviewed_upstream": true,
+      "both_compiled_caches_disabled": true,
+      "coff_symbol": "av1_update_inter_mode_stats",
+      "release_function_bytes": 365,
+      "terminal_rel32_offset": 361,
+      "terminal_relocation_symbol": "update_cdf",
+      "both_original_coff_code_prefixes_match_first_dll_before_recorded_terminal_relocation": true,
+      "second_dll_code_variant_not_reproduced_by_these_two_builds": true,
+      "not_a_normalized_shipping_comparison": true,
+      "full_build_logs_checked": [127112041115, 127155599864],
+      "both_full_builds_reported_compiling_aom_from_source": true,
+      "both_full_builds_aom_package_abi": "1e761c33e7434ddde75c99ef0b571efe6456c9b0553cc5f370d033a43d23ac11",
+      "stale_binary_cache_hypothesis_not_supported": true,
+      "next": "Repeat compilation of the exact AV1 translation unit with captured compiler inputs before choosing a source/compiler fix. No additional whole-app candidate or signing is justified yet."
+    },
+    "subsequent_unchanged_translation_unit_repeats": {
+      "single_host_run": 42018100979,
+      "single_host_source": "5ac84a838f5cea97c78c6a2048277c54751b922c",
+      "single_host_job": 127213622186,
+      "single_host_artifact": 13411051533,
+      "single_host_artifact_sha256": "9b409c9fe8bcc4626d26b53cacccea793308e2f82fac76f21c4f6d45fc891446",
+      "single_host_repeat_compiles": 24,
+      "independent_hosts_run": 42021792028,
+      "independent_hosts_source": "4760923f828376a6b0637eac91872dddc292583d",
+      "independent_host_jobs": [127226094853, 127226095154],
+      "independent_host_artifacts": [
+        {"id":13412048621,"bytes":5388574,"sha256":"34439cb58ac2e149a2d363ddcb45d8783a1f519a9624a03281d037ed50fd61de"},
+        {"id":13412412144,"bytes":5388574,"sha256":"1543afc30661dd5695a804f0bde7ba5f1768fde4fcd88c081d5073099fbaf85f"}
+      ],
+      "independent_host_repeat_compiles_each": 24,
+      "all_three_jobs_passed": true,
+      "all_original_archives_and_repeat_object_hashes_verified": true,
+      "actual_original_ninja_command_and_selected_compiler_environment_retained": true,
+      "unchanged_actual_translation_unit_recompiled": true,
+      "total_repeat_compiles": 72,
+      "all_original_function_code_bytes_identical": true,
+      "original_function_code_sha256_including_unresolved_terminal_relocation": "1278ac11313ba2abe5b46fee3490712afd39a68fd1bac0fa0034a4f56a9a02bc",
+      "all_match_first_dll_before_recorded_terminal_relocation": true,
+      "second_dll_variant_reproduced": false,
+      "independent_hosts_actual_source_and_header_files_each": 109,
+      "independent_hosts_all_actual_input_paths_and_hashes_match": true,
+      "independent_host_images": ["20261101.353.1", "20261026.347.1"],
+      "independent_host_cpu_names": ["AMD EPYC 7763", "AMD EPYC 9V74"],
+      "compiler_or_dependency_source_fix_applied": false,
+      "scope": "These repeat tests do not explain or fix the original full-build mismatch. Original endpoint builds did not retain AV1 objects/static libraries or actual include hashes before linking.",
+      "next": "Capture actual AV1 compiled objects, installed static library and final DLL provenance within the endpoint build context. Do not treat the isolated stable repeats as full-app reproduction or apply an unproved compiler flag."
+    },
+    "no_binary_normalization_or_signing": true
+  },
+  "candidate22_signed_approved_or_installed": false,
+  "new_vms_created": 0,
+  "remaining": [
+    "Finish exact-source independent build and compare all eight original shipping outputs",
+    "Prepare fresh signing inputs only after full original-byte reproduction passes",
+    "Installed live branding and genuine byte-changing update checks on existing development pair",
+    "Remaining native security and desktop acceptance checks",
+    "External direct and relay qualification and final advertised Windows matrix",
+    "Production signing approval and release qualification"
+  ],
+  "production_qualified": false
+}
diff --git a/docs/evidence/1522-restored-company-https-mfa-20261105.json b/docs/evidence/1522-restored-company-https-mfa-20261105.json
new file mode 100644
index 00000000000..4130d45263e
--- /dev/null
+++ b/docs/evidence/1522-restored-company-https-mfa-20261105.json
@@ -0,0 +1,37 @@
+{
+  "date": "2026-11-05",
+  "verified_utc": "2026-11-05T13:01:46.856866+00:00",
+  "management_source": "6a0c02af89191283f9839ce429c587daa1ed0f03",
+  "management_image": "sha256:878e6e9b327a511a64eacee043b7516a24fba09f0261842bdbc2a8099a1b60b8",
+  "https_image": "sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb",
+  "scope": "Previously restored existing Linux company database, configuration, signing keys and TLS storage; isolated management and HTTPS only, without host ports or a cloned native transport",
+  "actual_tls_handshake_validates_original_ca_and_company_hostname": true,
+  "certificate_validation_or_hostname_checks_bypassed": false,
+  "restored_root_ca_private_key_and_certificate_unchanged": true,
+  "leaf_certificate_sha256": "30e6c17a62748cfd654492ab1c31fa97725c6473a5d16bbeb87f7eb70fdb8fa1",
+  "actual_profile44_signature_matches_original_pinned_public_key": true,
+  "paused_update_policy_preserved": true,
+  "actual_https_administrator_password_and_totp_login_passed": true,
+  "same_totp_login_replay_rejected_401": true,
+  "anonymous_bootstrap_export_rejected_401": true,
+  "authenticated_six_field_public_bootstrap_export_passed": true,
+  "management_and_https_use_uid10001": true,
+  "management_network_mode_none": true,
+  "https_uses_only_same_isolated_network_namespace": true,
+  "host_ports_published": false,
+  "restored_native_transport_started": false,
+  "initial_test_setup_failure": "The test dropped all capabilities, preventing execution of the existing Caddy binary with its file capability; it exited before serving traffic. Both test services were stopped. The guarded retry permitted only NET_BIND_SERVICE in the isolated namespace while retaining the non-root user, read-only root filesystem and other isolation controls.",
+  "initial_failed_container_and_logs_retained": true,
+  "restored_management_and_https_normally_stopped_after_verification": true,
+  "original_live_management_https_hbbs_hbbr_container_ids_unchanged_and_still_running": true,
+  "original_company_settings_reconfigured": false,
+  "private_keys_or_credentials_exported": false,
+  "new_vms_created": 0,
+  "not_qualified_by_this_test": [
+    "Native sessions through restored infrastructure",
+    "Public external transport or public-certificate renewal",
+    "Full Windows release and runtime matrix",
+    "Production signing or publication"
+  ],
+  "production_qualified": false
+}
diff --git a/docs/evidence/1523-technician-runtime-docker-context-20261106.json b/docs/evidence/1523-technician-runtime-docker-context-20261106.json
new file mode 100644
index 00000000000..0d6fd028d5c
--- /dev/null
+++ b/docs/evidence/1523-technician-runtime-docker-context-20261106.json
@@ -0,0 +1,9 @@
+{
+  "utc": "2026-11-06T13:12:11.008066+00:00",
+  "public_files_exported": 56,
+  "new_runtime_source_included": true,
+  "private_canaries_exported": false,
+  "base_image": "scratch",
+  "external_downloads": false,
+  "passed": true
+}
diff --git a/docs/evidence/1523-technician-runtime-source-unit-20261106.json b/docs/evidence/1523-technician-runtime-source-unit-20261106.json
new file mode 100644
index 00000000000..84e97e1b63f
--- /dev/null
+++ b/docs/evidence/1523-technician-runtime-source-unit-20261106.json
@@ -0,0 +1,21 @@
+{
+  "utc": "2026-11-06T13:01:34.527575+00:00",
+  "container": "swan-technician-lifecycle-unit-20261106",
+  "network": "none",
+  "memory_limit_mib": 512,
+  "exit_code": 0,
+  "oom_killed": false,
+  "public_source_only": true,
+  "test_filter": "technician_runtime::tests",
+  "windows_native_acceptance": false,
+  "tests_passed": 2,
+  "tests_failed": 0,
+  "windows_lock_replacement_test_executed": false,
+  "scope": "Actual Linux file-lock regression; Windows sharing and rebuilt native/installer acceptance remain required.",
+  "source_sha256": {
+    "product/agent/src/technician_runtime.rs": "fa97529c40d5d50869d3931c65453e52653289e0edfca904f3c76e9626bb351a",
+    "product/agent/src/update.rs": "cd71aff29c08938b17c233490668c68e4cf894fb83925e462a116437eb58c409",
+    "src/managed.rs": "0526e9800bef2b24194e54bc9d2e32193561ee4bf4bb408c580c51bd83fc22c2",
+    "src/core_main.rs": "c2f8c474ca85b51aec3ee1346190470ea81117c11ada68f7ca08739a11b63e23"
+  }
+}
diff --git a/docs/evidence/1523-win11-uninstall-ui-source-regression-20261106.json b/docs/evidence/1523-win11-uninstall-ui-source-regression-20261106.json
new file mode 100644
index 00000000000..7de454f36ba
--- /dev/null
+++ b/docs/evidence/1523-win11-uninstall-ui-source-regression-20261106.json
@@ -0,0 +1,32 @@
+{
+  "fresh_gui_preserved_on_retry": true,
+  "uninstall_disables_ui_until_commit_or_rollback": true,
+  "real_pre_msi_stop_keeps_disabled_durable_recovery_task": true,
+  "automatic_update_qualified": false,
+  "unrelated_task_preserved": true,
+  "restart_intent_survives_stop_before_launch": true,
+  "uninstall_rollback_restores_standard_user_ui": true,
+  "preparation_requires_pending_update_and_signed_executable_identity": true,
+  "utc": "2026-11-06T11:23:55.0156551Z",
+  "native_wrong_creation_path_and_sid_rejected": true,
+  "real_standard_user_gui_relaunched": true,
+  "foreign_task_unchanged": true,
+  "restart_intent_durable_before_stop": true,
+  "passwords_or_privileged_user_tokens_used": false,
+  "temporary_task_self_deleted": true,
+  "uninstall_rollback_handles_unconfigured_msi": true,
+  "uninstall_requires_explicit_cancellation": true,
+  "owned_task_removed_on_uninstall": true,
+  "uninstall_closes_real_ui_before_file_removal": true,
+  "service_and_payload_unchanged": true,
+  "candidate": "1.5.23+94",
+  "helper_and_test_source_sha256": {
+    "Restart-CustomerUi.ps1": "73e7329f3a78e7a3c4fc45e83c031ca4599b9760544d4b0ac7979f9000b7b171",
+    "test_customer_ui_restart.ps1": "476171486483558456419d19acfbe8e4416c286c5c6357c64033b698ff7ff9b0"
+  },
+  "actual_system_task_exit": 0,
+  "real_windows11_standard_user_gui": true,
+  "scope": "Standalone exact-source UI helper regression against the installed1.5.22+93 customer on the existing Windows11 VM; private fixture state only",
+  "rust_glue_and_rebuilt_msi_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json b/docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json
new file mode 100644
index 00000000000..4e712f3ed74
--- /dev/null
+++ b/docs/evidence/154-win10-receiving-approval-pipe-failure-20261030.json
@@ -0,0 +1,35 @@
+{
+  "utc": "2026-10-30T13:33:29.1816499Z",
+  "scope": "Existing Windows10 Pro x64 build19045 customer1.5.4+72, release7, tested with technician1.5.10+78 on Server2025 against the isolated Linux company. This is an older receiving build, not current customer1.5.10 qualification.",
+  "receiving_application_source": "a6670d6e5b846be079f7cc0688c55ee9fb07431a",
+  "technician_application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "receiver_normal_existing_disk_boot": true,
+  "receiver_shipping_verifier_passed_before_attempt": true,
+  "receiver_original_identity_credential_and_trust_preserved_before_attempt": true,
+  "unattended_consent_disabled": true,
+  "receiver_automatic_system_service_and_watcher_running": true,
+  "initial_direct_attempt_error": "deadline has elapsed",
+  "later_relay_retry_error": "Company authorization required",
+  "fresh_authorized_inventory_request_reached_receiving_claim": true,
+  "native_technician_waiting_for_customer_approval_observed": true,
+  "customer_console_signed_in": true,
+  "receiving_cm_process_present_in_interactive_session": true,
+  "customer_approval_window_observed": false,
+  "customer_approved_desktop_observed": false,
+  "receiving_log_error": "Failed to start ipc_cm server at path \\.\\pipe\\Swan Remote Support\\query_cm: Access is denied. (os error 5)",
+  "pipe_owner_or_complete_root_cause_established": false,
+  "receiver_or_cm_restarted_to_hide_failure": false,
+  "pending_request_cancelled_normally": true,
+  "no_active_support_before_technician_normal_shutdown": true,
+  "customer_update_policy_briefly_opened": true,
+  "original_paused_update_policy_restored": true,
+  "final_company_profile_revision": 20,
+  "final_receiver_release_sequence": 7,
+  "final_receiver_version": "1.5.4+72",
+  "final_receiver_no_staged_or_pending_update": true,
+  "automatic_customer_update_or_session_exclusion_verified": false,
+  "current_customer1510_failure_reproduced": false,
+  "external_network_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json b/docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json
new file mode 100644
index 00000000000..9178f2e1e7d
--- /dev/null
+++ b/docs/evidence/159-server2019-upgrade-private-worker-cold-start-failure-20261030.json
@@ -0,0 +1,97 @@
+{
+  "utc": "2026-10-30T00:20:00.980417+00:00",
+  "scope": "Existing disposable Windows Server2019 Standard Evaluation x64 Desktop Experience build17763, original Linux company with automatic updates paused. Explicit upgrade of original customer; not fresh installation or complete OS qualification.",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "before_version": "1.5.1+69",
+  "after_version": "1.5.9+77",
+  "before_sequence": 1,
+  "after_sequence": 11,
+  "profile_revision": 14,
+  "worker_migrated_to_new_private_file_credential": true,
+  "legacy_registrations_remain_revoked": true,
+  "service_registry_contains_only_private_configuration_path": true,
+  "actual_standard_user_control_read_succeeded_and_private_credential_read_denied": true,
+  "temporary_standard_user_removed": true,
+  "both_original_queued_bundles_completed_and_independently_verified": true,
+  "public_customer_protected_technician_downloads_verified": true,
+  "generated_bundles": [
+    {
+      "edition": "customer",
+      "job_id": "f0888951-919e-4933-9d2c-b8434162459e",
+      "bundle_sha256": "e65621990df49e9600dd8a00dd068fc68e56858771b20a548563c809bb87ae6b",
+      "bytes": 32722365,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "job_id": "202fd50f-bba0-4d54-a298-2b20389be88f",
+      "bundle_sha256": "5ceb548601d7b9cde3566df45b6de291bb1a76b61afb4ea6db0fe2ee25f0dc94",
+      "bytes": 30526383,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "tamper_rejection_verified": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "explicit_customer_upgrade_and_shipping_verifier_passed": true,
+  "original_device_identity_credential_bootstrap_and_consent_preserved": true,
+  "company_branding_and_paused_policy_preserved": true,
+  "worker_automatic_reboot_passed": true,
+  "customer_automatic_reboot_passed": false,
+  "customer_boot_failure": {
+    "event_ids": [
+      7000,
+      7009
+    ],
+    "service_connection_timeout_ms": 30000,
+    "service_stopped_after_actual_new_boot": true,
+    "cause_unproven": true
+  },
+  "customer_one_manual_warm_recovery_passed": true,
+  "manual_warm_start_seconds": 6.1103574,
+  "recovered_service_did_not_load_flutter_engine_or_desktop_plugins": true,
+  "limits": [
+    "Customer automatic boot is a failing release gate; warm recovery does not qualify it.",
+    "No automatic update rollout, fresh1.5.9 installation, native GUI/session or full Server2019 matrix is established by this run.",
+    "Disposable lab publisher and same-host VM networking do not qualify production signing or public connectivity."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false,
+  "repeat_normal_reboot_customer_and_worker_automatic_start_passed": true,
+  "repeat_boot_identity_credential_trust_consent_and_shipping_verifier_passed": true,
+  "reliable_customer_automatic_startup_qualified": false,
+  "post_reboot_worker_build_verified": {
+    "utc": "2026-10-30T00:32:40.066735+00:00",
+    "job_id": "57ce241e-df10-431b-98af-769a7444941d",
+    "job_completed_after_actual_reboot": true,
+    "only_new_private_worker_registration_enabled": true,
+    "public_download_status": 200,
+    "bundle_sha256": "5d6b3e6d33f93554b5f98ff662a3cf4f41a4c4d52e47d5b416433dbbd9dabad9",
+    "bytes": 32722366,
+    "profile_and_release_signatures_verified": true,
+    "package_and_agent_hashes_verified": true,
+    "company_revision": 14,
+    "release_sequence": 11,
+    "updates_remain_paused": true,
+    "customer_cold_start_failure_remains_unresolved": true,
+    "production_publication": false
+  },
+  "bounded_private_trace": {
+    "bytes": 55574528,
+    "guest_host_sha256_match": true,
+    "automatic_stop_succeeded_and_task_disabled": true,
+    "scope": "Successful repeat boot, not the earlier failed boot",
+    "customer_executable_to_core_image_load_seconds": 4.537094,
+    "no_causal_fix_or_failure_diagnosis_inferred": true
+  }
+}
diff --git a/docs/evidence/159-windows-attended-lock-unlock-20261029.json b/docs/evidence/159-windows-attended-lock-unlock-20261029.json
new file mode 100644
index 00000000000..2c9a8e9cbbe
--- /dev/null
+++ b/docs/evidence/159-windows-attended-lock-unlock-20261029.json
@@ -0,0 +1,30 @@
+{
+  "utc": "2026-10-29T16:47:54.502982+00:00",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "standard_user_technician": true,
+  "customer_os": "Windows Server 2016 Standard Evaluation x64 build14393 Desktop Experience",
+  "customer_approved_attended_session": true,
+  "remote_lock_action_reached_real_windows_lock_screen": true,
+  "lock_screen_video_visible_in_native_technician": true,
+  "secure_attention_sent_using_swan_insert_ctrl_alt_del": true,
+  "owned_lab_password_typed_as_masked_remote_input": true,
+  "same_authorized_session_returned_to_customer_desktop": true,
+  "same_original_live_attended_lease_verified_after_unlock": true,
+  "no_replacement_grant_or_reconnection_required": true,
+  "no_host_secure_attention_used": true,
+  "uac_policy_inspection": {
+    "EnableLUA": 1,
+    "PromptOnSecureDesktop": 1,
+    "ConsentPromptBehaviorAdmin": 5,
+    "ConsentPromptBehaviorUser": 3,
+    "FilterAdministratorToken_configured": false
+  },
+  "uac_prompt_test_passed": false,
+  "production_publication": false,
+  "limits": [
+    "Existing attended Administrator desktop lock/unlock only. Does not qualify unattended consent, reboot to logon, standard-user customer behavior or UAC elevation.",
+    "Separate NAT lab VMs and lab signing only."
+  ],
+  "original_session_closed_and_no_live_lease_after_test": true
+}
\ No newline at end of file
diff --git a/docs/evidence/159-windows-company-install-enrollment-20261029.json b/docs/evidence/159-windows-company-install-enrollment-20261029.json
new file mode 100644
index 00000000000..d811e730769
--- /dev/null
+++ b/docs/evidence/159-windows-company-install-enrollment-20261029.json
@@ -0,0 +1,104 @@
+{
+  "schema": 1,
+  "date": "2026-10-29",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "management_source": "9fa5e8aa6a846ce015362de8082da5c938d79ff8",
+  "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "os": "Windows Server 2016 Standard Evaluation x64 build 14393, Desktop Experience",
+  "scope": "Separate disposable customer VM; standard-user technician on company VM. Existing clean pre-product OS baseline reused. Lab publisher only.",
+  "company_normal_reboot": {
+    "ten_pinned_component_source_key_configuration_and_receipt_hashes_preserved": true,
+    "company_and_worker_running_automatic": true,
+    "maintained_transport_children_and_udp_listener_running": true,
+    "external_verified_https_mfa_profile_and_download_checks_passed": true
+  },
+  "customer_msi_159_sequence11": {
+    "server_generated_public_bundle_used": true,
+    "tailscale_absent": true,
+    "no_manual_server_address_entry": true,
+    "unique_device_enrollment_and_company_branding_verified": true,
+    "shipping_installed_verifier_passed": true,
+    "automatic_system_service_running": true,
+    "unattended_consent_off": true
+  },
+  "technician_standard_user": {
+    "msi_sequence11_blocked_by_windows_policy_1625": true,
+    "server_generated_exe_sequence12_installed_successfully": true,
+    "actual_token_had_no_administrators_sid": true,
+    "shipping_replace_failed_setup_path_used": true,
+    "original_failed_msi_marker_archived_exactly": true,
+    "same_signed_native_and_agent_bytes_as_msi_payload": true,
+    "bootstrap_trust_branding_and_shipping_verifier_passed": true,
+    "windows_installer_policy_not_modified": true,
+    "no_device_credential_present_in_technician_state": true
+  },
+  "deployed_https_authorization_tests": {
+    "real_admin_and_two_technician_mfa_logins": true,
+    "pending_device_hidden_and_grant_rejected_403": true,
+    "technician_self_approval_rejected_401": true,
+    "administrator_approved_device_and_assigned_scoped_group": true,
+    "authorized_inventory_contains_only_approved_device": true,
+    "unassigned_inventory_empty_and_grant_rejected_403": true,
+    "unattended_grant_without_consent_rejected_403": true,
+    "technician_group_access_edit_rejected_401": true,
+    "denied_requests_created_no_grants_or_sessions": true
+  },
+  "external_runtime_interruption_recovery": {
+    "existing_disks_checked_and_normal_booted_without_reinstallation": true,
+    "company_worker_and_installed_technician_hashes_preserved": true,
+    "same_customer_identity_and_original_credential_accepted_over_verified_https": true,
+    "customer_approval_branding_release_sequence_and_consent_preserved": true,
+    "customer_automatic_service_and_shipping_verifier_passed": true
+  },
+  "native_technician_gui": {
+    "mfa_login_passed_in_actual_standard_user_session": true,
+    "company_branding_and_https_identity_visible": true,
+    "authorized_inventory_exactly_one_approved_customer": true,
+    "unattended_action_absent_without_consent": true
+  },
+  "windows_relay_attended_session": {
+    "native_technician_mfa_and_scoped_inventory_used": true,
+    "receiving_prompt_used_company_authenticated_technician_username": true,
+    "customer_explicitly_accepted": true,
+    "exact_receiver_request_and_maintained_windows_hbbr_pair_uuid_correlated": true,
+    "native_video_observed_in_both_vm_consoles": true,
+    "remote_mouse_and_keyboard_opened_customer_folder": true,
+    "claimed_attended_lease_renewed_beyond_initial_300_seconds": true,
+    "customer_disconnect_ended_desktop_and_closed_original_grant": true,
+    "closed_grant_renewal_with_original_device_credential_rejected_403": true,
+    "no_replacement_live_lease_after_disconnect": true,
+    "technician_dialog_closed_manually_by_peer_with_only_ok": true,
+    "initial_direct_path_collision_timed_out_before_relay_fallback": true,
+    "scope": "Separate NAT lab VMs using the company Windows relay through host forwards. This does not qualify public Internet or direct NAT traversal."
+  },
+  "management_outage": {
+    "fresh_native_customer_approved_session_established": true,
+    "only_customer_outbound_management_tcp_port_38446_blocked": true,
+    "relay_ports_not_blocked": true,
+    "automatic_rule_restore_task_registered_before_outage": true,
+    "native_receiver_closed_for_managed_authorization_unavailable": true,
+    "seconds_from_outage_to_receiver_close": 6.983795,
+    "receiver_close_utc": "2026-10-29T16:22:14.703388+00:00",
+    "receiver_log_sha256": "b0c1b11f7ee43d4bbdc9677ec350822ddaffcd52cabaf5347c2dd31fb474e364",
+    "technician_authorization_error_offered_only_ok": true,
+    "outage_rule_disabled_and_verified_https_restored": true,
+    "original_customer_credential_identity_branding_and_consent_preserved": true,
+    "restoring_management_did_not_revive_desktop": true,
+    "after_actual_original_lease_expiry_renew_rejected_403": true,
+    "original_lease_never_extended_after_outage": true,
+    "no_live_replacement_session": true,
+    "session_history_displayed_ended_after_expiry": true,
+    "limit": "The server could not receive the close report during the outage. Its stored closed bit stayed false; the unchanged lease expired normally. The inventory labels it Ended after expiry. This is receiver-side management unreachability, not a full infrastructure outage."
+  },
+  "limits": {
+    "attended_lock_unlock_and_standard_customer_uac_scope_in_separate_159_receipts": true,
+    "clipboard_and_transfer_scope_in_separate_159_windows_native_receipt": true,
+    "no_public_internet_connectivity_claim": true,
+    "standard_user_msi_install_did_not_pass": true,
+    "no_new_clean_iso_install_or_six_os_matrix_claim": true,
+    "production_publication": false,
+    "full_product_acceptance_complete": false,
+    "unattended_reboot_logon_revocation_scope_in_separate_159_receipt": true,
+    "two_monitor_switching_and_input_scope_in_separate_159_receipt": true
+  }
+}
diff --git a/docs/evidence/159-windows-native-branding-sync-20261030.json b/docs/evidence/159-windows-native-branding-sync-20261030.json
new file mode 100644
index 00000000000..db0e9209df5
--- /dev/null
+++ b/docs/evidence/159-windows-native-branding-sync-20261030.json
@@ -0,0 +1,41 @@
+{
+  "utc": "2026-10-29T23:44:11.515201+00:00",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "version": "1.5.9",
+  "scope": "Existing separate Server 2016 company/technician and customer VMs; shipping installed applications; company-controlled lab HTTPS.",
+  "signed_revision_sequence": [
+    1,
+    2,
+    3
+  ],
+  "automatic_branding_change_displayed_in_both_native_editions": true,
+  "changed_fields": [
+    "display names",
+    "SVG logos",
+    "colors",
+    "support contacts",
+    "consent text",
+    "shortcut labels"
+  ],
+  "manual_sync_or_install_required": false,
+  "signature_and_exact_profile_content_verified_in_both_caches": true,
+  "original_branding_automatically_restored_and_native_ui_observed": true,
+  "device_identity_credential_bootstrap_consent_installation_and_binary_hashes_preserved": true,
+  "transport_keys_policy_release_approvals_unchanged": true,
+  "both_original_limited_launchers_restarted_while_management_rule_enabled": true,
+  "both_temporary_management_rules_verified_disabled_after_test": true,
+  "offline_cached_ui_acceptance_complete": true,
+  "limits": [
+    "The initial revision2 outage did not qualify offline UI timing. A separate revision3 repeat verified both restarted cached displays before subsequent enabled-rule and failed-HTTPS checks; both blocks were then disabled.",
+    "Software upgrade, embedded resources, key rotation, negative profile tests and other Windows versions are outside this specific test.",
+    "Lab signing and same-host VM networking do not establish production signing or public Internet connectivity."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false,
+  "offline_repeat_revision": 3,
+  "offline_repeat_both_original_shipping_apps_restarted": true,
+  "offline_repeat_native_cached_ui_observed_before_followup_rule_and_https_failure_checks": true,
+  "offline_repeat_rules_disabled_and_signed_cache_identity_consent_binaries_reverified": true,
+  "offline_test_fixture_limitation": "The second customer restart helper stopped Home then hit a stale process-path race before relaunch. Read-only inspection confirmed only service/server/tray remained; a guarded launch of the same original limited Home task completed the restart. No product change."
+}
diff --git a/docs/evidence/159-windows-native-clipboard-transfer-20261029.json b/docs/evidence/159-windows-native-clipboard-transfer-20261029.json
new file mode 100644
index 00000000000..92645d4d6a6
--- /dev/null
+++ b/docs/evidence/159-windows-native-clipboard-transfer-20261029.json
@@ -0,0 +1,24 @@
+{
+  "utc": "2026-10-29T16:38:01.430607+00:00",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "standard_user_technician": true,
+  "separate_customer_vm": true,
+  "customer_approved_desktop_and_separate_transfer_sessions": true,
+  "both_vnc_viewers_host_clipboard_receive_and_send_disabled_verified": true,
+  "active_session_text_clipboard_both_directions_verified_by_saved_file_hashes": true,
+  "clipboard_forward_sha256": "3450882943a7b06c8955429d08057bc3184b7af76fedf7cfd498f6180784abd7",
+  "clipboard_return_sha256": "58cbd1e21319f0344d89f2c54eedacd185f2f613ac7e835fa903d7f5b62e12ce",
+  "file_send_and_receive_finished_in_native_ui": true,
+  "file_roundtrip_sha256": "72e209f31e81da3088bf7d8324e55ef67fae2ae39b2bfad1fed90606b93eec7b",
+  "file_bytes_each_direction": 1343488,
+  "all_saved_files_hashes_checked_independently_over_ssh": true,
+  "initial_pre_session_clipboard_paste_empty": true,
+  "source_initial_clipboard_sync_is_opt_in": true,
+  "source_reference": "src/client/io_loop.rs:1423 and libs/hbb_common/src/config.rs:171,2120",
+  "production_publication": false,
+  "limits": [
+    "ASCII text and one 1343488-byte file; Unicode, image clipboard, large files, interruption and denied-permission transfer require separate tests.",
+    "No production signing, public Internet, UAC, logon-screen or multi-monitor qualification."
+  ]
+}
\ No newline at end of file
diff --git a/docs/evidence/159-windows-native-two-monitor-20261029.json b/docs/evidence/159-windows-native-two-monitor-20261029.json
new file mode 100644
index 00000000000..2a38709509a
--- /dev/null
+++ b/docs/evidence/159-windows-native-two-monitor-20261029.json
@@ -0,0 +1,49 @@
+{
+  "utc": "2026-10-29T19:48:14.773935+00:00",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "standard_technician_fresh_native_mfa": true,
+  "standard_customer_explicitly_accepted_authenticated_technician": true,
+  "two_active_windows_qxl_displays_1024x768_each": true,
+  "first_display_device": "DISPLAY7",
+  "second_display_device": "DISPLAY5",
+  "native_monitor_selector_switched_to_second_display": true,
+  "distinct_blue_and_green_target_video_observed": true,
+  "remote_mouse_focus_and_keyboard_input_saved_on_both_displays": true,
+  "independent_input_file_hashes_verified": [
+    {
+      "monitor": "one",
+      "bytes": 35,
+      "sha256": "22458fc4c565fd5d21271e849d17b42ab4811ca9eae8708b3fd329082ae0d289"
+    },
+    {
+      "monitor": "two",
+      "bytes": 35,
+      "sha256": "f5d0cdcdb7f23f8d399672babbb34db840a8c024bdd221a8538404f238aeda3d"
+    }
+  ],
+  "same_one_live_claimed_attended_grant_verified": true,
+  "consent_off_revision2_preserved": true,
+  "original_identity_credential_bootstrap_and_binaries_preserved_after_hardware_change": true,
+  "latest_receiver_relay_request_utc": "2026-10-29T19:34:17.906463+00:00",
+  "latest_exact_windows_relay_pair_time": "2026-10-29 21:34:18.062379 +02:00",
+  "receiver_log_sha256": "391ea5259e8ceddfb8eb37ca9598f4e1a49f377cf8541e7c30c86df1f660fe08",
+  "relay_log_sha256": "5c3031ab4e1eef301367ddf61d852042d0b6a9e4d5558c38d4c6dcec883718e7",
+  "initial_unaccepted_request_canceled_and_no_live_authorization_before_retry": true,
+  "production_publication": false,
+  "full_product_acceptance_complete": false,
+  "completed_utc": "2026-10-29T19:57:18.505112+00:00",
+  "returned_to_first_monitor_with_original_saved_marker_visible": true,
+  "monitor_switching_created_no_replacement_grant": true,
+  "native_session_closed_original_grant": true,
+  "closed_row_retained_last_lease_timestamp": true,
+  "closed_flag_makes_retained_lease_unusable": true,
+  "no_live_authorization_after_close": true,
+  "closed_grant_renew_with_original_device_credential_rejected_403": true,
+  "test_target_windows_closed_and_support_service_preserved": true,
+  "scope": "Two separate Windows Server 2016 Desktop Experience lab VMs, standard technician and customer accounts, maintained Windows relay through host forwards, two signed QXL adapters with two active 1024x768 displays.",
+  "limits": [
+    "No mixed-DPI, monitor hot-plug, more than two monitors, combined/individual-window mode or other Windows version qualification.",
+    "No public Internet or direct NAT traversal claim."
+  ]
+}
diff --git a/docs/evidence/159-windows-receiving-file-permission-denial-20261029.json b/docs/evidence/159-windows-receiving-file-permission-denial-20261029.json
new file mode 100644
index 00000000000..8a866dabbda
--- /dev/null
+++ b/docs/evidence/159-windows-receiving-file-permission-denial-20261029.json
@@ -0,0 +1,21 @@
+{
+  "utc": "2026-10-29T16:43:00.516579+00:00",
+  "only_file_permission_removed_from_real_group_policy": true,
+  "native_desktop_customer_approved_and_connected": true,
+  "receiving_consent_dialog_file_permission_disabled": true,
+  "native_transfer_action_still_available_and_attempted": true,
+  "separate_file_connection_reached_receiving_authorization": true,
+  "receiving_error_observed": "Company grant denies file transfer",
+  "file_manager_never_exposed_remote_directory_listing": true,
+  "failed_file_connection_claimed_then_closed_in_server_history": true,
+  "authorized_limited_desktop_lease_still_live": true,
+  "receiving_implementation_reference": "src/server/connection.rs managed_permission_cap and FileTransfer login gate",
+  "lab_policy_restoration_pending": false,
+  "production_publication": false,
+  "exact_original_policy_restored_and_no_live_sessions_after_test": true,
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "limits": [
+    "Separate NAT lab VMs, lab publisher only. This tests native file-transfer login rejection, not every packet or third-party malicious client."
+  ]
+}
\ No newline at end of file
diff --git a/docs/evidence/159-windows-standard-customer-uac-20261029.json b/docs/evidence/159-windows-standard-customer-uac-20261029.json
new file mode 100644
index 00000000000..3302b77cb22
--- /dev/null
+++ b/docs/evidence/159-windows-standard-customer-uac-20261029.json
@@ -0,0 +1,38 @@
+{
+  "credential_uac_prompt_returned_success": true,
+  "elevated_notepad_same_standard_desktop_session": true,
+  "production_publication": false,
+  "utc": "2026-10-29T17:01:55.7322557Z",
+  "token_elevation_true": true,
+  "original_secure_desktop_uac_policy_preserved": true,
+  "customer_release_profile_and_consent_preserved": true,
+  "integrity_sid": "S-1-16-12288",
+  "actual_customer_standard_token_no_administrators_sid": true,
+  "elevated_owner_administrator": true,
+  "native_secure_desktop_credential_prompt_observed": true,
+  "lab_administrator_password_entered_masked_through_swan": true,
+  "remote_input_into_high_integrity_notepad_observed": true,
+  "expected_input_sha256": "019f3971860daa1e337bf3853e84810d82e103c69359b22d91f5252de1acbf26",
+  "expected_input_bytes": 33,
+  "same_original_attended_lease_live_after_elevation_and_input": true,
+  "customer_stop_pending": false,
+  "saved_remote_input_bytes": 33,
+  "original_uac_secure_desktop_policy_preserved": true,
+  "saved_remote_input_sha256": "019f3971860daa1e337bf3853e84810d82e103c69359b22d91f5252de1acbf26",
+  "limited_probe_task_completed_zero": true,
+  "original_customer_identity_credential_approval_profile_and_consent_preserved": true,
+  "elevated_probe_closed": true,
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "customer_os": "Windows Server 2016 Standard Evaluation x64 build14393 Desktop Experience",
+  "standard_customer_disconnect_closed_original_session": true,
+  "no_live_session_after_test": true,
+  "standard_technician_and_customer_accounts": true,
+  "uac_prompt_and_masked_password_input_performed_through_native_swan": true,
+  "unattended_consent_off": true,
+  "limits": [
+    "One credential UAC elevation of Microsoft Notepad on Server 2016 with default secure-desktop policy. This does not qualify every UAC scenario or other Windows versions.",
+    "Separate NAT lab VMs and lab publisher only; no public Internet or production qualification."
+  ],
+  "test_helper_correction": "Initial TokenElevation query used an oversized buffer and returned Windows ERROR_BAD_LENGTH24. The corrected four-byte query verified elevation; original failed query logs retained privately."
+}
\ No newline at end of file
diff --git a/docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json b/docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json
new file mode 100644
index 00000000000..a31bb40cf5b
--- /dev/null
+++ b/docs/evidence/159-windows-unattended-reboot-logon-revocation-20261029.json
@@ -0,0 +1,50 @@
+{
+  "utc": "2026-10-29T17:15:04.602663+00:00",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "standard_customer_explicit_native_consent_dialog_confirmed": true,
+  "before_consent_unattended_grant_rejected_403": true,
+  "same_company_profile_revision1_no_policy_changes": true,
+  "planned_windows_reboot_with_user_apps_forced_closed_no_vm_reset": true,
+  "identity_credential_bootstrap_consent1_and_binaries_preserved_after_reboot": true,
+  "windows_autologon_and_saved_password_absent": true,
+  "automatic_system_service_ready_before_user_logon": true,
+  "fresh_native_technician_mfa_used": true,
+  "one_new_claimed_live_unattended_grant_verified": true,
+  "native_windows_signin_screen_video_observed_without_customer_accept": true,
+  "no_user_desktop_logged_on_during_connection": true,
+  "matching_new_receiver_and_windows_hbbr_connection_uuid_verified": true,
+  "receiver_relay_request_utc": "2026-10-29T17:13:59.037452+00:00",
+  "relay_pair_time": "2026-10-29 19:13:59.015713 +02:00",
+  "receiver_log_sha256": "f7f1e5e81f9418283a7bbeb8b6ff22ab739299ffcfcb160c818cefd4172f6c58",
+  "relay_log_sha256": "3df2231dd3b18170d54905c977f22d661e93b439df24a114791e03cdd0813021",
+  "last_boot_utc": "2026-10-29T17:09:22.4943240Z",
+  "revocation_pending": false,
+  "production_publication": false,
+  "revocation": {
+    "old_consent_revision1_replay_status": 409,
+    "service_still_running": true,
+    "production_publication": false,
+    "local_consent_revoked_revision2": true,
+    "closed_original_unattended_grant_renew_status": 403,
+    "utc": "2026-10-29T17:29:09.2280687Z",
+    "device_identity_credential_trust_and_binaries_preserved": true,
+    "server_consent_off_and_device_still_approved": true,
+    "original_claimed_unattended_grant_closed_lease_zero": true,
+    "new_authorized_technician_unattended_request_rejected_403": true,
+    "no_live_replacement_authorization": true,
+    "native_authorization_expired_or_revoked_dialog_with_only_ok_observed": true,
+    "receiver_closed_utc": "2026-10-29T17:18:59.052506+00:00",
+    "seconds_from_customer_revoke_to_receiver_close": 30.033506,
+    "receiver_log_sha256": "cd51c65acc1a6a3b657c7c02ace34c16a5af034c8533d96c88d0910c30d5cf8b"
+  },
+  "native_remote_standard_customer_logon_after_reboot_observed": true,
+  "management_source": "9fa5e8a",
+  "worker_source": "1c43",
+  "scope": "Two separate Windows Server 2016 Desktop Experience lab VMs through the company Windows relay using host forwards. Customer installed by MSI; technician runs as a standard user from its per-user EXE installation. Explicit customer consent enabled before a planned Windows reboot; no VM reset or Windows autologon.",
+  "limits": [
+    "Does not qualify every Windows version, public Internet connectivity, direct NAT traversal or multiple monitors.",
+    "Does not qualify power-loss recovery or every secure-desktop/UAC scenario."
+  ],
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json b/docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json
new file mode 100644
index 00000000000..e14fcfe3dff
--- /dev/null
+++ b/docs/evidence/1c43a38-private-worker-fresh-server2016-runtime.json
@@ -0,0 +1,62 @@
+{
+  "schema": 1,
+  "date": "2026-10-29",
+  "component_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "installer_helpers_unchanged_at": "9fa5e8aa6a846ce015362de8082da5c938d79ff8",
+  "os": "Windows Server 2016 Standard Evaluation, x64, build 14393, Desktop Experience",
+  "fixture": "Independent writable clone of verified clean pre-product OS baseline; normal boot, no memory snapshot",
+  "fresh_install": {
+    "product_services_and_state_absent_before_install": true,
+    "shipped_install_worker_and_read_configuration_helpers": true,
+    "lab_signed_worker_publisher_verified": true,
+    "company_https_and_profile_key_verified": true,
+    "service_running_automatic_local_system": true,
+    "service_registry_contains_public_configuration_path_only": true,
+    "private_configuration_validated_by_shipped_helper": true
+  },
+  "standard_user": {
+    "actual_temporary_standard_user_token": true,
+    "public_control_file_read_succeeded": true,
+    "private_worker_configuration_read_denied": true,
+    "temporary_account_removed": true,
+    "password_not_persisted_or_printed": true
+  },
+  "normal_reboot": {
+    "new_boot_time_verified": true,
+    "automatic_service_running": true,
+    "private_configuration_receipt_and_executable_hashes_preserved": true,
+    "compiled_configuration_validation_passed": true
+  },
+  "real_build": {
+    "approved_release": "1.5.9 Customer test",
+    "original_worker_temporarily_stopped_to_exclude_other_builders": true,
+    "completed_after_normal_reboot": true,
+    "local_output_hash_equals_server_download": true,
+    "anonymous_customer_download_verified": true,
+    "eleven_unchanged_payload_entries_match_prior_verified_bundle": true,
+    "installer_executed_in_this_test": false
+  },
+  "failed_attempt_and_correction": {
+    "initial_job_failed_without_publishing_package": true,
+    "fresh_guest_missing_lab_release_publisher_dns_and_public_ca": true,
+    "verified_release_https_after_guest_only_lab_mapping_and_public_ca_import": true,
+    "one_new_build_completed_after_correction": true,
+    "initial_failed_job_retained": true
+  },
+  "cleanup": {
+    "original_company_worker_and_management_running": true,
+    "separate_test_worker_revoked_and_token_rejected_401": true,
+    "no_active_builds_cancelled": true,
+    "test_service_stopped_and_set_manual": true,
+    "normal_guest_shutdown_requested": true,
+    "test_disk_and_private_evidence_retained": true,
+    "host_trust_unchanged": true
+  },
+  "boundaries": {
+    "lab_signing_only": true,
+    "production_publication": false,
+    "public_internet_connectivity_qualified": false,
+    "all_supported_windows_versions_qualified": false,
+    "full_product_acceptance_complete": false
+  }
+}
diff --git a/docs/evidence/1c43a38-private-worker-server2016-runtime.json b/docs/evidence/1c43a38-private-worker-server2016-runtime.json
new file mode 100644
index 00000000000..a754002a1c1
--- /dev/null
+++ b/docs/evidence/1c43a38-private-worker-server2016-runtime.json
@@ -0,0 +1,121 @@
+{
+  "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "migration_source": "f9322e545ab5805a35a9ccda031b0e71a066ee9b",
+  "application_and_management_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "os": "Windows Server 2016 Desktop Experience build 14393",
+  "lab_publisher_only": true,
+  "production_publication": false,
+  "migration": {
+    "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+    "reboot_pending": true,
+    "production_publication": false,
+    "build_completion_pending": true,
+    "retention_fixture_preserved": true,
+    "os_build": 14393,
+    "worker_automatic": true,
+    "migration_source": "f9322e545ab5805a35a9ccda031b0e71a066ee9b",
+    "worker_sha256": "6e096258c8a593b848ae2adf6c305a15cf1d3697ab7ec807566061f24b27968f",
+    "utc": "2026-10-29T09:27:27.3564615Z",
+    "company_service_running": true,
+    "registry_only_public_file_path": true,
+    "configuration_private_and_ba_owned": true,
+    "legacy_executable_and_receipt_preserved": true,
+    "guest": "SWAN-COMP-16C",
+    "worker_running": true
+  },
+  "actual_standard_user_read_denial": {
+    "worker_and_company_running": true,
+    "password_persisted_or_printed": false,
+    "public_control_file_read_succeeded": true,
+    "utc": "2026-10-29T09:29:46.9182326Z",
+    "private_worker_configuration_read_denied": true,
+    "actual_standard_user_token": true,
+    "os_build": 14393,
+    "fixture_account_removed": true
+  },
+  "normal_reboot": {
+    "identity_trust_configuration_and_receipts_unchanged": true,
+    "normal_reboot_completed": true,
+    "last_boot_utc": "2026-10-29T09:38:07.4948280Z",
+    "utc": "2026-10-29T09:40:32.5083541Z",
+    "private_acl_preserved": true,
+    "retention_fixture_preserved": true,
+    "worker_and_company_automatic_and_running": true,
+    "registry_only_public_path": true,
+    "two_completed_installer_files_unchanged": true,
+    "https_and_original_signed_profile_verified": true,
+    "administrator_mfa_after_reboot_verified": true,
+    "approvals_and_worker_revocation_preserved": true,
+    "automatic_updates_paused": true,
+    "production_publication": false
+  },
+  "authenticated_build_after_reboot": {
+    "utc": "2026-10-29T09:43:52.679389+00:00",
+    "job_id": "ed2a47c3-49db-4781-bb38-f6feea2a005c",
+    "worker_authenticated_after_normal_reboot": true,
+    "completed_build": true,
+    "anonymous_customer_download_status": 200,
+    "bundle_sha256": "3298f405dde78ce8726e56f47ca70f50256b2d0bc581ebe611145906f40197f6",
+    "bytes": 32722125,
+    "eleven_payload_entries_identical_to_before_reboot": true,
+    "new_signed_profile_verified_and_same_policy": true,
+    "private_file_credential_persistence_verified": true,
+    "automatic_updates_paused": true,
+    "installer_executed": false,
+    "production_publication": false
+  },
+  "initial_company_packages": {
+    "utc": "2026-10-29T09:36:05.483195+00:00",
+    "management_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+    "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+    "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+    "company_server_os": "Server 2016 build 14393",
+    "editions": [
+      {
+        "edition": "customer",
+        "job_id": "8a2add5a-01a8-4cf8-be46-b394c1638fcb",
+        "bundle_sha256": "57e701f5b6d3f282973d108a070fcdbb841198b2187ae5e247dc021a9e68e875",
+        "bytes": 32722124,
+        "public_bootstrap_only": true,
+        "signatures_and_payload_hashes_verified": true,
+        "tampered_payload_rejected": true,
+        "worker_credentials_absent": true,
+        "seven_public_source_texts_exact": true,
+        "anonymous_download_status": 200,
+        "authenticated_technician_download_status": null
+      },
+      {
+        "edition": "technician",
+        "job_id": "62f574fd-9a48-4903-905e-86de7c08c95c",
+        "bundle_sha256": "6f9173645addbcda922e8650c2d75336404f3318126c01bae785f0ce2187f0dc",
+        "bytes": 30526144,
+        "public_bootstrap_only": true,
+        "signatures_and_payload_hashes_verified": true,
+        "tampered_payload_rejected": true,
+        "worker_credentials_absent": true,
+        "seven_public_source_texts_exact": true,
+        "anonymous_download_status": 401,
+        "authenticated_technician_download_status": 200
+      }
+    ],
+    "fresh_independent_company": true,
+    "private_file_worker_credential": true,
+    "old_worker_still_revoked": true,
+    "updates_paused": true,
+    "installer_executed": false,
+    "native_session_qualified": false,
+    "production_publication": false
+  },
+  "remaining_scope": "Endpoint installation/upgrade, sessions and automatic rollout of these packages, full Windows server restore and production signing remain separate gates.",
+  "technician_distribution_role": {
+    "utc": "2026-10-29T09:47:11.197086+00:00",
+    "technician_mfa_login": true,
+    "technician_download_head_status": 200,
+    "management_worker_release_and_build_lists_status": 401,
+    "logged_out_token_download_status": 401,
+    "anonymous_technician_download_status": 401,
+    "no_completed_bundle_download_repeated": true,
+    "company_or_worker_configuration_changed": false,
+    "production_publication": false
+  }
+}
diff --git a/docs/evidence/1c43a38-private-worker-windows-checks.json b/docs/evidence/1c43a38-private-worker-windows-checks.json
new file mode 100644
index 00000000000..9ca254b8e40
--- /dev/null
+++ b/docs/evidence/1c43a38-private-worker-windows-checks.json
@@ -0,0 +1,55 @@
+{
+  "source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "artifact_id": 12885946951,
+  "archive_sha256": "ef2ea7756c6a01cf9a26331326ebc6f12d90428350fdfc24ccd6a3e195c04604",
+  "public_source_files_verified": 239,
+  "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+  "sha256": {
+    "swan-management.exe": "ab29be710b7f546947c3de9fb9f63f1180d0d27ff2157c8446702bd0a280e726",
+    "swan-agent.exe": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+    "swan-worker.exe": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+    "CompanyComponents-source.zip": "b8271228931b8b2da578f27f45910bf79b3445ead63548b635d7db621607be9f"
+  },
+  "worker_private_configuration_checks": {
+    "passed": true,
+    "checks": [
+      "private input reader can validate both migration inputs in one PowerShell process",
+      "compiled worker accepts protected configuration larger than the Windows pipe buffer without revealing credentials",
+      "app-container read permission rejects configuration before any job is claimed",
+      "unexpected file owner rejected",
+      "oversized configuration rejected",
+      "malformed private JSON rejected without echoing credentials",
+      "complete legacy environment cannot substitute for the service private file"
+    ],
+    "company_request_or_build_claimed": false,
+    "worker_sha256": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+    "service_installed": false,
+    "only_fixture_credentials": true,
+    "utc": "2026-10-29T09:12:30.8047965Z"
+  },
+  "executables_ran": false,
+  "independent_binary_reproduction": false,
+  "production_publication": false,
+  "ci_runs": [
+    {
+      "run_id": 40846044050,
+      "event": "push",
+      "successful_jobs": [
+        123353777222,
+        123353777580,
+        123353777715
+      ]
+    },
+    {
+      "run_id": 40846052027,
+      "event": "pull_request",
+      "successful_jobs": [
+        123353722297,
+        123353722647,
+        123353722710
+      ]
+    }
+  ],
+  "technician_msi_lifecycle_in_component_workflow": "skipped; separate native workflow lifecycle passed",
+  "actual_company_worker_migration_and_build": "pending"
+}
diff --git a/docs/evidence/1c43a38-windows-components-independent.json b/docs/evidence/1c43a38-windows-components-independent.json
new file mode 100644
index 00000000000..6c5918cfea2
--- /dev/null
+++ b/docs/evidence/1c43a38-windows-components-independent.json
@@ -0,0 +1,41 @@
+{
+  "utc": "2026-10-29T09:45:06.534252+00:00",
+  "public_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "second_actual_build_revision": "71698e4d4ba9a5998f8fac9aafe17717f816723d",
+  "public_tree_equality_verified": true,
+  "runs": [
+    40846044050,
+    40846052027
+  ],
+  "artifacts": [
+    12885946951,
+    12885920784
+  ],
+  "archive_sha256": [
+    "ef2ea7756c6a01cf9a26331326ebc6f12d90428350fdfc24ccd6a3e195c04604",
+    "a1b3f5cc9beaa8e3b89907d76e0dffb69279562050f6f2601f36dd0b1bddf054"
+  ],
+  "public_source_files_verified_per_build": 239,
+  "binaries": {
+    "swan-worker.exe": {
+      "sha256": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+      "bytes": 4900352,
+      "original_bytes_identical": true
+    },
+    "swan-agent.exe": {
+      "sha256": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+      "bytes": 5756416,
+      "original_bytes_identical": true
+    },
+    "swan-management.exe": {
+      "sha256": "ab29be710b7f546947c3de9fb9f63f1180d0d27ff2157c8446702bd0a280e726",
+      "bytes": 9107968,
+      "original_bytes_identical": true
+    }
+  },
+  "existing_independent_ci_jobs_only": true,
+  "new_build_dispatched": false,
+  "binary_normalization": false,
+  "downloaded_executables_run_for_comparison": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json b/docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json
new file mode 100644
index 00000000000..4695963e05c
--- /dev/null
+++ b/docs/evidence/332af85-coordinated-management-worker-update-and-recovery-20261104.json
@@ -0,0 +1,173 @@
+{
+  "utc": "2026-11-04T02:35:26.130095+00:00",
+  "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+  "canonical_image_build": {
+    "utc": "2026-11-04T01:48:41.296910+00:00",
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "image": "sha256:c8fe75f7c46155dac622464a206153c16c880459a7a4b6366a96bbe90aab1dc9",
+    "tag": "swan-linux-owned:source332af85-canonical-20261104",
+    "canonical_recipe_unchanged": true,
+    "archive_checkout_crlf_only_verified": true,
+    "runtime_tests_pending": true,
+    "independent_canonical_reproduction_pending": true,
+    "company_configuration_unchanged": true,
+    "production_publication": false
+  },
+  "fresh_company_runtime": {
+    "utc": "2026-11-04T02:16:11.499005+00:00",
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "image": "sha256:c8fe75f7c46155dac622464a206153c16c880459a7a4b6366a96bbe90aab1dc9",
+    "lab_cached_toolchain_variant": false,
+    "canonical_recipe_and_official_pinned_builder": true,
+    "fresh_source_and_target_compile": true,
+    "real_shipped_harness_passed": true,
+    "nonroot_readonly_and_private_storage": true,
+    "fresh_company_setup_mfa_replay_enrollment_policy_and_restart_persistence": true,
+    "real_management_backup_wrong_password_rejection_and_restore": true,
+    "original_company_image_unchanged": true,
+    "https_and_native_transport_to_new_image_qualified": false,
+    "existing_company_upgrade_performed": false,
+    "canonical_production_docker_reproduction": false,
+    "production_publication": false
+  },
+  "encrypted_backup": {
+    "utc": "2026-11-04T02:05:49.456667+00:00",
+    "bytes": 1478222994,
+    "sha256": "f608d9c3167a23721d157315b80240ad0d97f2859046a89b80cff5a6e1caf15b",
+    "encrypted_copy_hash_matched": true,
+    "separate_passphrase": true
+  },
+  "offline_restore": {
+    "utc": "2026-11-04T02:14:18.796089+00:00",
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "image": "sha256:c8fe75f7c46155dac622464a206153c16c880459a7a4b6366a96bbe90aab1dc9",
+    "archive_sha256": "f608d9c3167a23721d157315b80240ad0d97f2859046a89b80cff5a6e1caf15b",
+    "restored_volume": "swan-components332-preupgrade-restore-20261104",
+    "wrong_password_rejected_before_destination": true,
+    "authenticated_stream_restore_succeeded": true,
+    "management_and_transport_sqlite_headers_valid": true,
+    "profile_key_setup_token_transport_keys_and_actual_proxy_configuration_match": true,
+    "all_original_generated_installer_files_match": true,
+    "all_original_tls_key_and_certificate_files_match": true,
+    "artifact_count": 48,
+    "tls_identity_count": 6,
+    "no_plaintext_keys_exported_to_host": true,
+    "no_network_or_restored_server_start": true,
+    "original_company_not_reconfigured": true,
+    "restored_live_new_signing_key_and_mfa_check_pending": true,
+    "profile_revision_in_archive": 44,
+    "new_archive_schema": 3
+  },
+  "current_company_upgrade": {
+    "utc": "2026-11-04T02:19:32.128208+00:00",
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "image": "sha256:c8fe75f7c46155dac622464a206153c16c880459a7a4b6366a96bbe90aab1dc9",
+    "fresh_encrypted_backup_verified": true,
+    "schema_source_unchanged": true,
+    "real_https_health_and_fresh_mfa": true,
+    "company_profile44_paused_updates_identity_consent_roles_workers_releases_jobs_sessions_preserved": true,
+    "transport_and_https_container_ids_preserved": true,
+    "lab_cached_toolchain_image_only": false,
+    "canonical_recipe_and_official_builder": true,
+    "management_binary_independently_reproduced": false,
+    "canonical_source332_independent_reproduction_pending": true,
+    "native_session_and_new_worker_recipe_still_pending": true,
+    "production_publication": false
+  },
+  "windows_worker_upgrade": {
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "registry_public_path_only": true,
+    "private_configuration_credential_acl_and_customer_identity_consent_preserved": true,
+    "production_publication": false,
+    "utc": "2026-11-04T02:25:43.6608862Z",
+    "new_signed_worker_running_automatic": true,
+    "actual_new_bundle_generation_pending": true,
+    "previous_binary_receipt_and_configuration_retained_inside_private_guest": true,
+    "worker_sha256": "49792e26a1c337d5dda255ef69a13a3085fb17db88e6cbb6dc7f435c4ada33f1",
+    "compiled_existing_configuration_check_passed": true
+  },
+  "windows_components_ci": {
+    "run": 41750979567,
+    "required_windows_and_linux_jobs_passed": true,
+    "actual_build_revision": "6a85d68240efa7152ec6ee0e841ccbd3f0263f01",
+    "actual_build_tree_equals_source": true,
+    "public_component_source_files_verified": 256
+  },
+  "independent_canonical_source332_reproduction_pending": true,
+  "production_publication": false,
+  "new_bundle_generation_verified": true,
+  "unassisted_customer_installation_pending": true,
+  "four_formats": {
+    "application_source": "a3fedd94e38d902164db90321bcf397c85a6c12b",
+    "bundle_recipe_source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "editions": [
+      {
+        "edition": "customer",
+        "format": "exe",
+        "sequence": 28,
+        "job_id": "5f5eb1e9-16f8-4c19-bbf4-debc643da86b",
+        "bundle_sha256": "f8108e3de04fffd97996695a42e7c7ad43630fa67b6f134879a6c0be3003501e",
+        "bytes": 26294149,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "offline_signature_mutation_check": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 200,
+        "download_status": 200
+      },
+      {
+        "edition": "customer",
+        "format": "msi",
+        "sequence": 25,
+        "job_id": "370c56dd-c2f0-4499-acac-41ab8caa461d",
+        "bundle_sha256": "ffeef137c7f421a3e2b25a55adac89dffdf9675aa0abe07afff86caa3899d557",
+        "bytes": 32814550,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "offline_signature_mutation_check": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 200,
+        "download_status": 200
+      },
+      {
+        "edition": "technician",
+        "format": "exe",
+        "sequence": 24,
+        "job_id": "14ce7891-63ec-43a6-9d9e-fe0b174531b6",
+        "bundle_sha256": "c4caa1465cb83b5010e74631582ec773fbe294ee16748a2041c374922df0a211",
+        "bytes": 26281108,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "offline_signature_mutation_check": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 401,
+        "download_status": 200
+      },
+      {
+        "edition": "technician",
+        "format": "msi",
+        "sequence": 25,
+        "job_id": "47b8cf9c-663c-4737-b56d-6b8120aaab05",
+        "bundle_sha256": "ab953aa2341c7211891c987ee7c7cad1650e7dfe0de91c6e5eee9dad7f2dd505",
+        "bytes": 30626007,
+        "public_bootstrap_only": true,
+        "profile_and_release_signatures_verified": true,
+        "offline_signature_mutation_check": true,
+        "seven_source_texts_exact": true,
+        "signed_payload_hashes_verified": true,
+        "anonymous_status": 401,
+        "download_status": 200
+      }
+    ],
+    "unchanged_paused_update_policy": true,
+    "all_bootstraps_public_only": true,
+    "all_profile_release_signatures_and_payload_hashes_verified": true,
+    "all_seven_source_texts_match": true,
+    "anonymous_customer_download_status": 200,
+    "anonymous_technician_download_status": 401,
+    "source_contains_runtime_producer_and_current_company_components": true
+  }
+}
diff --git a/docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json b/docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json
new file mode 100644
index 00000000000..8f4ecc83ea0
--- /dev/null
+++ b/docs/evidence/332af85-independent-linux-canonical-binary-reproduction-20261104.json
@@ -0,0 +1,65 @@
+{
+  "utc": "2026-11-04T04:35:00.254534+00:00",
+  "builds": [
+    {
+      "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+      "image": "sha256:c8fe75f7c46155dac622464a206153c16c880459a7a4b6366a96bbe90aab1dc9",
+      "tag": "swan-linux-owned:source332af85-canonical-20261104",
+      "management_sha256": "85f0c22fc09334711425662299a3d048e65591faebc64428a125d91f557369a0",
+      "context_sha256": "919de0fbaf07055977723c79a293ef8ac5d14a69ef48e38d1093275885d3d916",
+      "canonical_recipe_sha256": "d68a85159e999ffbd45da40d3c0a03e522e74b989f783e53171ecd4727b08be5",
+      "builder": "sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f"
+    },
+    {
+      "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+      "image": "sha256:144a3c98122538a5f98fcdb32159392bb1e836204d256725afb69f47369e2acb",
+      "tag": "swan-linux-owned:source332af85-canonical-independent-20261104",
+      "management_sha256": "85f0c22fc09334711425662299a3d048e65591faebc64428a125d91f557369a0",
+      "context_sha256": "919de0fbaf07055977723c79a293ef8ac5d14a69ef48e38d1093275885d3d916",
+      "canonical_recipe_sha256": "d68a85159e999ffbd45da40d3c0a03e522e74b989f783e53171ecd4727b08be5",
+      "builder": "sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f"
+    }
+  ],
+  "management_original_binary_hashes_equal": true,
+  "image_ids_equal": false,
+  "oci_image_reproducibility_qualified": false,
+  "no_binary_normalization": true,
+  "fresh_runtime_pending": false,
+  "company_configuration_unchanged": true,
+  "production_publication": false,
+  "second_real_fresh_company_harness_passed": true,
+  "independent_build": {
+    "utc": "2026-11-04T04:30:11.704631+00:00",
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "tag": "swan-linux-owned:source332af85-canonical-independent-20261104",
+    "context_sha256": "919de0fbaf07055977723c79a293ef8ac5d14a69ef48e38d1093275885d3d916",
+    "canonical_dockerfile_sha256": "d68a85159e999ffbd45da40d3c0a03e522e74b989f783e53171ecd4727b08be5",
+    "canonical_recipe_unchanged": true,
+    "archive_checkout_crlf_only_verified": true,
+    "pinned_official_builder_id": "sha256:3914072ca0c3b8aad871db9169a651ccfce30cf58303e5d6f2db16d1d8a7e58f",
+    "empty_tracked_target_and_no_cache": true,
+    "independent_of_first_compiled_layers": true,
+    "first_context_bytes_identical": true,
+    "one_job_one_cpu_memory_mib": 1536,
+    "company_configuration_unchanged": true,
+    "production_publication": false
+  },
+  "real_fresh_company_runtime": {
+    "utc": "2026-11-04T04:35:32.730985+00:00",
+    "source": "332af85187668b08a87714c6e19b41d9ba124ced",
+    "image": "sha256:144a3c98122538a5f98fcdb32159392bb1e836204d256725afb69f47369e2acb",
+    "lab_cached_toolchain_variant": false,
+    "canonical_recipe_and_official_pinned_builder": true,
+    "fresh_source_and_target_compile": true,
+    "real_shipped_harness_passed": true,
+    "nonroot_readonly_and_private_storage": true,
+    "fresh_company_setup_mfa_replay_enrollment_policy_and_restart_persistence": true,
+    "real_management_backup_wrong_password_rejection_and_restore": true,
+    "original_company_image_unchanged": true,
+    "https_and_native_transport_to_new_image_qualified": false,
+    "existing_company_upgrade_performed": false,
+    "canonical_production_docker_reproduction": false,
+    "production_publication": false
+  },
+  "qualification": "Exact canonical source and pinned official toolchain reproduced the original management executable bytes; full OCI image reproducibility remains unqualified."
+}
diff --git a/docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json b/docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json
new file mode 100644
index 00000000000..9d72c4f2481
--- /dev/null
+++ b/docs/evidence/361d7c3-linux-live-migration-recovery-20261030.json
@@ -0,0 +1,43 @@
+{
+  "utc": "2026-10-30T02:40:01Z",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "image": "sha256:e273bd77169fa37ca947128f557957e2b2a0aaea1f72116de174ec11d61c6d24",
+  "scope": "Same-host isolated Linux company: live encrypted restore, schema migration, rollback and current-data upgrade. Lab cached compiler recipe; not canonical production Docker reproduction.",
+  "live_restored_data": {
+    "encrypted_backup_authenticated_and_restored": true,
+    "schema2_to3_startup_verified": true,
+    "automatic_preupgrade_backup_authenticated_back_to_schema2": true,
+    "actual_rollback_to_original_schema2_and_original_containers": true,
+    "restored_copy_stopped_after_test": true
+  },
+  "current_data_upgrade": {
+    "fresh_quiesced_management_checkpoint_verified": true,
+    "latest_original_data_upgraded_in_place": true,
+    "actual_old_binary_rollback_on_fresh_schema2_checkpoint": true,
+    "final_rollforward_to_current_schema3": true,
+    "transport_and_https_container_ids_and_volumes_preserved": true,
+    "one_time_migration_passphrase_absent_from_final_container_environment": true,
+    "active_and_local_deployment_recipes_match": true,
+    "recent_preupgrade_audit_events_retained": 20
+  },
+  "all_live_phases": {
+    "fresh_administrator_and_both_technician_mfa_logins": true,
+    "roles_groups_devices_approvals_and_consent_preserved": true,
+    "signed_profile_pin_revision14_branding_and_paused_updates_preserved": true,
+    "unassigned_session_grant_denied": true,
+    "technician_administrator_route_denied": true,
+    "revoked_legacy_worker_credentials_denied": true,
+    "current_private_worker_authenticated_without_user_access": true,
+    "public_customer_and_authenticated_technician_download_hashes_match": true,
+    "schema3_installation_reporting_route_verified": true
+  },
+  "test_harness_correction": "First restored-data attempt expected a list from the paginated installation-report API. The API correctly returned an object; guarded rollback completed. A corrected attempt resumed the retained restored containers and passed. No product failure or fresh restore was hidden.",
+  "limits": [
+    "No native desktop session was exercised against this newly upgraded Linux server.",
+    "External release mirror assets reused their same-host bind mount; different-host disaster recovery remains open.",
+    "Old binaries were never pointed at schema3. Rollback used retained schema2 data.",
+    "Original, restored and checkpoint data remain private and retained. Only one company copy ran at a time."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json b/docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json
new file mode 100644
index 00000000000..b4582fd62d9
--- /dev/null
+++ b/docs/evidence/361d7c3-linux-preupgrade-offline-backup-restore-20261030.json
@@ -0,0 +1,42 @@
+{
+  "utc": "2026-10-30T01:54:36.762486+00:00",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "scope": "Original Linux company at source67 schema2 / signed profile14, with source361 backup/restore CLI. Offline restore only; live management upgrade, schema3 startup and migration rollback not yet qualified.",
+  "lab_image": "sha256:e273bd77169fa37ca947128f557957e2b2a0aaea1f72116de174ec11d61c6d24",
+  "builder": {
+    "cached_toolchain_image": "sha256:e279ac3bf9680e4a088ff251fae96da5dfe4b026ccd81a7bd6f1eb233e7d9e6e",
+    "rust_version": "1.90.0",
+    "offline_compile": true,
+    "pinned_canonical_runtime_retained": true,
+    "canonical_production_docker_reproduction": false,
+    "public_git_source_context_sha256": "d8a4ebf49579f32ccfcd809ee0058c613cf6e44050f9e569d081f0945a52864c",
+    "derived_lab_recipe_context_sha256": "b103eb4df8be5bd76bc8d64420f9255645cff2e00f12489f9c096550ccfaf73a"
+  },
+  "encrypted_backup": {
+    "format": "SWANBK2",
+    "bytes": 661268962,
+    "sha256": "9e0fe6e98da0d75db5cbc370f2fe7bb15a38290cf83be8546f28d62abde04632",
+    "private_passphrase_kept_separately": true
+  },
+  "same_original_four_containers_and_images_restarted": true,
+  "original_https_trust_profile_revision_and_paused_policy_preserved": true,
+  "wrong_password_rejected_before_destination": true,
+  "authenticated_stream_restore_succeeded": true,
+  "management_and_transport_sqlite_headers_valid": true,
+  "profile_key_setup_token_transport_keys_match": true,
+  "actual_proxy_recipe_and_deployment_settings_match": true,
+  "all_generated_installer_files_match": true,
+  "installer_file_count": 21,
+  "all_tls_key_and_certificate_files_match": true,
+  "tls_identity_file_count": 6,
+  "plaintext_private_keys_not_exported_to_host": true,
+  "restored_server_not_started_or_exposed": true,
+  "live_restore_schema_migration_rollback_pending": true,
+  "limits": [
+    "The restored data has not yet served management or native clients.",
+    "External project-release mirror assets remain in their existing lab bind mount; different-host disaster recovery is not qualified.",
+    "The cached lab compiler recipe is recorded separately from canonical production Docker image reproduction."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json b/docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json
new file mode 100644
index 00000000000..d7e2313fd41
--- /dev/null
+++ b/docs/evidence/361d7c3-post-profile26-restore-and-replacement-bundles-20261030.json
@@ -0,0 +1,75 @@
+{
+  "utc": "2026-10-30T16:39:26.835060+00:00",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "application_source": "b1fbe1e2419c3e749663746c74442d1fe864302d",
+  "application_version": "1.5.10+78",
+  "schema": 3,
+  "profile_revision": 26,
+  "archive_sha256": "5e0e4fdf2500e350b5996d702391284abe2a71dbfc5313bf0806f9c2461486bd",
+  "wrong_password_rejected_before_destination": true,
+  "authenticated_stream_restore_succeeded": true,
+  "all_archived_installer_files_match": 23,
+  "all_tls_key_and_certificate_files_match": 6,
+  "initial_seed_transport_keys_setup_token_proxy_and_deployment_configuration_match": true,
+  "new_active_profile_signing_key_recovered_from_database": true,
+  "same_actual_https_certificate_hostname_and_ca": true,
+  "administrator_mfa_and_same_code_replay_denial": true,
+  "approved_device_identity_and_revoked_unattended_consent_preserved": true,
+  "exact_post_rotation_native_session_remained_closed": true,
+  "authorized_technician_scope_preserved": true,
+  "unassigned_technician_empty_inventory": true,
+  "technician_admin_endpoint_denied": true,
+  "anonymous_inventory_denied": true,
+  "approved_release13_both_editions_preserved": true,
+  "withdrawn_old_downloads_remained404": true,
+  "archived_failed_build_records": 23,
+  "active_worker_count": 1,
+  "revoked_worker_count": 2,
+  "recovery_management_network_internal": true,
+  "recovery_https_loopback_only": true,
+  "initial_recovery_test_network_failure": "Services listened but host HTTPS was unreachable through the internal-only network; retained storage and same stopped containers, added a separate ingress bridge only to HTTPS, then all verification passed.",
+  "fresh_restore_repeated_to_fix_network": false,
+  "native_transport_clone_started": false,
+  "native_session_to_restored_company_qualified": false,
+  "restored_containers_stopped_and_storage_retained": true,
+  "original_company_not_reconfigured_and_healthy": true,
+  "replacement_bundles_generated_by_existing_private_worker_after_recovery": [
+    {
+      "edition": "customer",
+      "job_id": "b820af4b-a346-442f-a50b-b462fd118db7",
+      "bundle_sha256": "e3bb5f310a08d62fabaeef23d91cf780e1570a7c934205325c6c08aeed5f1aa7",
+      "bytes": 32722163,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 200,
+      "download_status": 200
+    },
+    {
+      "edition": "technician",
+      "job_id": "6f0a5a2c-a331-4c48-9113-963937a96c51",
+      "bundle_sha256": "8c4eb429f824d2e114f490806ed418220a901d572bb82f71cb32fac2be8fcb1b",
+      "bytes": 30521967,
+      "public_bootstrap_only": true,
+      "profile_and_release_signatures_verified": true,
+      "offline_signature_mutation_check": true,
+      "seven_source_texts_exact": true,
+      "signed_payload_hashes_verified": true,
+      "anonymous_status": 401,
+      "download_status": 200
+    }
+  ],
+  "replacement_bundle_profile_revision": 26,
+  "signed_program_bytes_and_release13_metadata_unchanged": true,
+  "replacement_bundles_bootstrap_public_only": true,
+  "replacement_bundles_new_profile_signature_and_exact_seven_source_texts_verified": true,
+  "automatic_updates_remained_paused": true,
+  "replacement_installer_executed": false,
+  "archive_cutoff_precedes_the_two_replacement_jobs": true,
+  "different_physical_host_disaster_recovery_qualified": false,
+  "full_windows_matrix_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json b/docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json
new file mode 100644
index 00000000000..c6b6da40919
--- /dev/null
+++ b/docs/evidence/361d7c3-push-pr-windows-linux-component-reproduction-20261030.json
@@ -0,0 +1,184 @@
+{
+  "utc": "2026-10-29T22:56:36.562797+00:00",
+  "component_source_head": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "run_metadata": {
+    "40930580611": {
+      "id": 40930580611,
+      "event": "push",
+      "head_sha": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+      "status": "completed",
+      "conclusion": "success",
+      "html_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40930580611",
+      "jobs": [
+        {
+          "name": "linux-deployment",
+          "id": 123647616688,
+          "conclusion": "success"
+        },
+        {
+          "name": "maintained-windows-transport / transport (windows-2022)",
+          "id": 123647617319,
+          "conclusion": "success"
+        },
+        {
+          "name": "technician-msi-lifecycle",
+          "id": 123647618746,
+          "conclusion": "skipped"
+        },
+        {
+          "name": "verify (windows-2022)",
+          "id": 123652448502,
+          "conclusion": "success"
+        },
+        {
+          "name": "verify (ubuntu-24.04)",
+          "id": 123652448694,
+          "conclusion": "success"
+        }
+      ]
+    },
+    "40930590508": {
+      "id": 40930590508,
+      "event": "pull_request",
+      "head_sha": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+      "status": "completed",
+      "conclusion": "success",
+      "html_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40930590508",
+      "jobs": [
+        {
+          "name": "linux-deployment",
+          "id": 123647648907,
+          "conclusion": "success"
+        },
+        {
+          "name": "maintained-windows-transport / transport (windows-2022)",
+          "id": 123647649713,
+          "conclusion": "success"
+        },
+        {
+          "name": "technician-msi-lifecycle",
+          "id": 123647652043,
+          "conclusion": "skipped"
+        },
+        {
+          "name": "verify (ubuntu-24.04)",
+          "id": 123653092178,
+          "conclusion": "success"
+        },
+        {
+          "name": "verify (windows-2022)",
+          "id": 123653092286,
+          "conclusion": "success"
+        }
+      ]
+    }
+  },
+  "all_original_binaries_identical": true,
+  "binary_normalization": false,
+  "executables_run_for_comparison": false,
+  "new_build_dispatched": false,
+  "merge_checkout_not_assumed_identical_to_head": true,
+  "production_publication": false,
+  "platforms": {
+    "windows-2022": {
+      "builds": [
+        {
+          "run": 40930580611,
+          "artifact": 12922249929,
+          "archive_sha256": "f46ad102d48fc45d052864e99e4937e4f46bfa623e61173a981aada4fb5e025e",
+          "actual_checkout": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+          "public_component_source_files_matching_head": 242,
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "binary_sha256": {
+            "swan-management.exe": "772cb5a490452742d39342e34decc82b3f3be1a2cad1ece6f348ab3972771038",
+            "swan-agent.exe": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+            "swan-worker.exe": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7"
+          },
+          "checkout_text_conversion_count": 226
+        },
+        {
+          "run": 40930590508,
+          "artifact": 12924331807,
+          "archive_sha256": "9f04d6e8f4814176f0fd208ff775364ce03f87cc4014cf05ed83d029e823e23a",
+          "actual_checkout": "b13de18fd6e984be6d1dfff40e4d8b388127ccc1",
+          "public_component_source_files_matching_head": 242,
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "binary_sha256": {
+            "swan-management.exe": "772cb5a490452742d39342e34decc82b3f3be1a2cad1ece6f348ab3972771038",
+            "swan-agent.exe": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+            "swan-worker.exe": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7"
+          },
+          "checkout_text_conversion_count": 226
+        }
+      ],
+      "binaries": {
+        "swan-management.exe": {
+          "sha256": "772cb5a490452742d39342e34decc82b3f3be1a2cad1ece6f348ab3972771038",
+          "bytes": 9130496,
+          "original_bytes_identical": true
+        },
+        "swan-agent.exe": {
+          "sha256": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+          "bytes": 5756416,
+          "original_bytes_identical": true
+        },
+        "swan-worker.exe": {
+          "sha256": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+          "bytes": 4900352,
+          "original_bytes_identical": true
+        }
+      }
+    },
+    "ubuntu-24.04": {
+      "builds": [
+        {
+          "run": 40930580611,
+          "artifact": 12922848256,
+          "archive_sha256": "4b231b4f44f17a78183c8b8fe0a5ed26b1f1b62a9553810663fb33cca9c83b65",
+          "actual_checkout": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+          "public_component_source_files_matching_head": 242,
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "binary_sha256": {
+            "swan-management": "c47fc7d59e800a02dd2aafb4f9a5bb88e8bbbf7a01b8f3a7fa84f8868e115c9e",
+            "swan-agent": "f25446584efd95075a512481d6a68c47edf18e1c828fd3f862b05389e42c41f6",
+            "swan-worker": "32d5ef7d7d60883d5ae40a7d4d0ff0a93f07c1d79dfdc1a54bbd3e20d0fe1836"
+          },
+          "checkout_text_conversion_count": 0
+        },
+        {
+          "run": 40930590508,
+          "artifact": 12922289926,
+          "archive_sha256": "929f6b33ef2e2c28acd7eb03066087606fb328c4ec32a7322d23da7a19552b8b",
+          "actual_checkout": "b13de18fd6e984be6d1dfff40e4d8b388127ccc1",
+          "public_component_source_files_matching_head": 242,
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "binary_sha256": {
+            "swan-management": "c47fc7d59e800a02dd2aafb4f9a5bb88e8bbbf7a01b8f3a7fa84f8868e115c9e",
+            "swan-agent": "f25446584efd95075a512481d6a68c47edf18e1c828fd3f862b05389e42c41f6",
+            "swan-worker": "32d5ef7d7d60883d5ae40a7d4d0ff0a93f07c1d79dfdc1a54bbd3e20d0fe1836"
+          },
+          "checkout_text_conversion_count": 0
+        }
+      ],
+      "binaries": {
+        "swan-management": {
+          "sha256": "c47fc7d59e800a02dd2aafb4f9a5bb88e8bbbf7a01b8f3a7fa84f8868e115c9e",
+          "bytes": 10841240,
+          "original_bytes_identical": true
+        },
+        "swan-agent": {
+          "sha256": "f25446584efd95075a512481d6a68c47edf18e1c828fd3f862b05389e42c41f6",
+          "bytes": 6262616,
+          "original_bytes_identical": true
+        },
+        "swan-worker": {
+          "sha256": "32d5ef7d7d60883d5ae40a7d4d0ff0a93f07c1d79dfdc1a54bbd3e20d0fe1836",
+          "bytes": 5768032,
+          "original_bytes_identical": true
+        }
+      }
+    }
+  },
+  "scope": "Product management/agent/worker components only. Every preserved component source input matches the stated head; the PR checkout is a separate public merge commit. Native Flutter apps, engine outputs and MSI/EXE packages are outside this comparison.",
+  "all_six_original_component_outputs_identical": true
+}
diff --git a/docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json b/docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json
new file mode 100644
index 00000000000..7391f7fbfa3
--- /dev/null
+++ b/docs/evidence/361d7c3-restored-data-native-retest-pending-20261030.json
@@ -0,0 +1,42 @@
+{
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "native_application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "os": "Windows Server 2016 Desktop Experience build 14393",
+  "restored_populated_company_data_activated_for_native_retest": true,
+  "newer_original_data_retained_for_return": true,
+  "activation_checks": {
+    "normal_owned_service_stops_only": true,
+    "company_and_worker_running": true,
+    "https_admin_mfa_verified": true,
+    "signed_profile_approved_device_revoked_consent_releases_workers_preserved": true,
+    "all_five_installer_download_hashes_match": true,
+    "known_customer_download_public": true,
+    "known_technician_anonymous_download_rejected_401": true,
+    "no_live_session": true
+  },
+  "native_retest": {
+    "fresh_native_mfa_not_completed": true,
+    "new_attended_session_not_requested": true,
+    "technician_not_responding_observed": true,
+    "cause_not_established": true,
+    "same_lab_had_intermittent_ssh_and_https_timeouts": true,
+    "substantial_host_wsl_disk_waits_observed": true,
+    "guest_memory_sample_available_mib": 816,
+    "guest_memory_sample_pages_per_second": 893.9091698892476,
+    "idle_customer_later_exited_normally": true,
+    "company_verified_https_profile_responded_after_customer_shutdown": true,
+    "owned_technician_launcher_restarted_after_sid_and_privilege_verification": true,
+    "launcher_observed_running_without_native_gui_at_last_check": true,
+    "cached_guest_disk_reads_enabled_for_next_customer_boot_with_guest_flushes_preserved": true,
+    "test_passed": false
+  },
+  "limitations": [
+    "Disk contention is observed, not a proven explanation of the native UI hang.",
+    "Earlier native acceptance after rollback remains separate from this incomplete restored-data test.",
+    "No public Internet connectivity, different-host recovery or production signing claim."
+  ],
+  "follow_up_native_session_completed_evidence": "361d7c3-windows-native-active-restored-data-20261030.json",
+  "original_incomplete_observation_preserved": true,
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json b/docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json
new file mode 100644
index 00000000000..c103ef6035b
--- /dev/null
+++ b/docs/evidence/361d7c3-windows-native-active-restored-data-20261030.json
@@ -0,0 +1,86 @@
+{
+  "utc": "2026-10-29T22:36:51.519268+00:00",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "fresh_native_mfa_server_audit_matched": true,
+  "standard_customer_explicitly_accepted_authenticated_technician": true,
+  "original_enrollment_credentials_bootstrap_binaries_consent_preserved": true,
+  "native_remote_video_and_mouse_keyboard_input_observed": true,
+  "independent_saved_input_bytes": 52,
+  "independent_saved_input_sha256": "f16dc25b55ee080f5fd362827fc29355afeb08907debf432651c498902824273",
+  "one_new_claimed_attended_grant_with_live_authorization_lease": true,
+  "receiver_and_maintained_windows_relay_uuid_correlated": true,
+  "receiver_log_sha256": "ba08ece00c71c6bbfac021b27e7016d2d7eecc44a26ab2ae5b6f9e07164d0ec7",
+  "relay_log_sha256": "c6af2f047e4c2e73574a8cbd423f9782d04a8e94a75fa00bb0b122e3f6933b1b",
+  "production_publication": false,
+  "completed_utc": "2026-10-29T22:39:19.121719+00:00",
+  "customer_native_disconnect_closed_original_grant": true,
+  "closed_grant_renew_with_original_device_credential_rejected_403": true,
+  "one_request_only_and_no_live_authorization_after_stop": true,
+  "shipping_installed_verifier_passed_after_disconnect": true,
+  "customer_service_running": true,
+  "scope": "Existing separate Server 2016 company and customer VMs while the actual restored populated company data is active after canonical transport migration. Fresh native technician MFA, standard customer approval and input, maintained Windows relay through lab host forwarding.",
+  "limits": [
+    "Same-host lab networking; no public Internet/NAT traversal qualification.",
+    "Restored company data was active during this native session; different-host recovery remains unqualified."
+  ],
+  "full_product_acceptance_complete": false,
+  "actual_restored_company_data_active_during_session": true,
+  "diagnostic_launcher_added_only_stage_timestamps": true,
+  "original_shipping_launcher_bytes_unchanged": true,
+  "all_original_signature_sync_and_installed_checks_retained": true,
+  "earlier_native_stall_cause_unresolved": true,
+  "return_to_retained_newer_original_data_pending": false,
+  "returned_to_newer_original_company_data_and_rechecked_https_mfa_downloads": true,
+  "restored_test_data_copy_retained_after_return": true,
+  "owned_input_fixture_stopped_and_saved_proof_retained": true,
+  "diagnostic_launcher_stopped_original_byte_verified_launcher_started": true,
+  "diagnostic_startup_stage_times": [
+    {
+      "step": "script-entered",
+      "utc": "2026-10-29T22:20:20.8116165Z"
+    },
+    {
+      "step": "agent-signature-before",
+      "utc": "2026-10-29T22:20:21.0616537Z"
+    },
+    {
+      "step": "agent-signature-valid",
+      "utc": "2026-10-29T22:20:25.9263243Z"
+    },
+    {
+      "step": "sync-start-before",
+      "utc": "2026-10-29T22:20:26.1763734Z"
+    },
+    {
+      "step": "sync-process-started",
+      "utc": "2026-10-29T22:20:26.2232577Z"
+    },
+    {
+      "step": "sync-wait-before",
+      "utc": "2026-10-29T22:20:26.2388960Z"
+    },
+    {
+      "step": "sync-process-exited",
+      "utc": "2026-10-29T22:20:26.4561034Z"
+    },
+    {
+      "step": "installed-verification-before",
+      "utc": "2026-10-29T22:20:26.4717356Z"
+    },
+    {
+      "step": "installed-verification-passed",
+      "utc": "2026-10-29T22:20:30.5229158Z"
+    },
+    {
+      "step": "portable-start-before",
+      "utc": "2026-10-29T22:20:30.5697897Z"
+    },
+    {
+      "step": "portable-process-started",
+      "utc": "2026-10-29T22:20:30.6010686Z"
+    }
+  ],
+  "first_diagnostic_parse_failure_not_counted_as_product_failure": true
+}
diff --git a/docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json b/docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json
new file mode 100644
index 00000000000..e7f061708ea
--- /dev/null
+++ b/docs/evidence/361d7c3-windows-native-after-populated-recovery-20261029.json
@@ -0,0 +1,29 @@
+{
+  "utc": "2026-10-29T21:16:41.562030+00:00",
+  "management_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "application_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "version": "1.5.9",
+  "fresh_native_mfa_server_audit_matched": true,
+  "standard_customer_explicitly_accepted_authenticated_technician": true,
+  "original_enrollment_credentials_bootstrap_binaries_consent_preserved": true,
+  "native_remote_video_and_mouse_keyboard_input_observed": true,
+  "independent_saved_input_bytes": 52,
+  "independent_saved_input_sha256": "e057476dea5eba809ce0a8dfc3c9ab875f7ee064f9d4395820ce1059b25166b6",
+  "one_new_claimed_attended_grant_with_live_authorization_lease": true,
+  "receiver_and_maintained_windows_relay_uuid_correlated": true,
+  "receiver_log_sha256": "647373efb162d0a36c03081f34c00b363a5a53e1f56f1e8aceb3582617e30e85",
+  "relay_log_sha256": "d8adc41e2037c7448e0d50c7384ca3444773f4a3f757f3764010af7d2f783569",
+  "production_publication": false,
+  "completed_utc": "2026-10-29T21:20:10.851864+00:00",
+  "customer_native_disconnect_closed_original_grant": true,
+  "closed_grant_renew_with_original_device_credential_rejected_403": true,
+  "one_request_only_and_no_live_authorization_after_stop": true,
+  "shipping_installed_verifier_passed_after_disconnect": true,
+  "customer_service_running": true,
+  "scope": "Existing separate Server 2016 company and customer VMs after canonical transport migration, full populated recovery and rollback. Fresh native technician MFA, standard customer approval and input, maintained Windows relay through lab host forwarding.",
+  "limits": [
+    "Same-host lab networking; no public Internet/NAT traversal qualification.",
+    "This connection followed rollback to retained original company data; native session during restored-data state was not exercised."
+  ],
+  "full_product_acceptance_complete": false
+}
\ No newline at end of file
diff --git a/docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json b/docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json
new file mode 100644
index 00000000000..abf79677e0c
--- /dev/null
+++ b/docs/evidence/361d7c3-windows-populated-running-recovery-20261029.json
@@ -0,0 +1,48 @@
+{
+  "source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "os": "Windows Server 2016 Desktop Experience build 14393",
+  "scope": "Owned lab, same company VM, canonical populated transport storage",
+  "lab_signed_windows_management": true,
+  "canonical_backup": {
+    "format": "SWANBK2",
+    "bytes": 154966061,
+    "sha256": "ded42e848eaf1d8cfb1f6271812c47213d42003116d8e65c08f7008ae3cd2069",
+    "populated_transport_database_included": true,
+    "management_configuration_and_keys_tls_service_environment_receipt_included": true,
+    "installer_artifacts": 5,
+    "strong_passphrase_stored_separately": true,
+    "services_resumed_after_export": true
+  },
+  "isolated_restore": {
+    "actual_signed_windows_cli": true,
+    "sqlite_integrity_schema_and_all_committed_peer_records_match": true,
+    "trust_keys_https_material_receipt_environment_and_five_installers_verified": true,
+    "original_company_worker_pids_and_credential_preserved": true,
+    "wrong_password_and_tamper_tests_repeated_in_this_rehearsal": false,
+    "template_receipt_carried_stale_installed_source_label": true,
+    "actual_installed_source_verified_by_migration_binary_hash_and_export": "361d7c362de7f67b7b7456d33bf0191736eec7d5"
+  },
+  "running_restore_and_rollback": {
+    "restored_data_used_at_canonical_company_path": true,
+    "restored_flat_peer_database_mapped_to_transport_storage": true,
+    "normal_owned_service_stops_only": true,
+    "receipt_firewall_ownership_and_service_environment_checked": true,
+    "https_admin_mfa_verified_in_both_states": true,
+    "signed_profile_approved_device_revoked_consent_releases_workers_preserved_in_both_states": true,
+    "all_five_installer_download_hashes_match_in_both_states": true,
+    "known_customer_download_public_in_both_states": true,
+    "known_technician_anonymous_download_rejected_401_in_both_states": true,
+    "actual_running_restored_peer_database_integrity_schema_and_all_rows_match": true,
+    "table_row_counts": {"peer": 1},
+    "logical_peer_dataset_sha256": "13e74304b8b72a3c06061e2f3f38b96c15482823b8d525033ae8444077b56840",
+    "original_company_data_canonical_again": true,
+    "restored_running_copy_retained": true,
+    "company_and_worker_running": true,
+    "no_data_deleted": true
+  },
+  "native_reconnection_after_migration_and_recovery_pending": true,
+  "different_host_recovery_qualified": false,
+  "public_internet_connectivity_qualified": false,
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json b/docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json
new file mode 100644
index 00000000000..214b9817497
--- /dev/null
+++ b/docs/evidence/361d7c3-windows-populated-transport-migration-20261029.json
@@ -0,0 +1,37 @@
+{
+  "source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "os": "Windows Server 2016 Desktop Experience build 14393",
+  "scope": "Owned independent-company lab; original peer database and company configuration preserved",
+  "lab_signed_windows_management": true,
+  "production_signing": false,
+  "pre_migration_backup": {
+    "format": "SWANBK2",
+    "bytes": 154965880,
+    "sha256": "cd56a5a2aa3c127ceea9e20aab0b9965402e8c0dacc122fdf5e12bdd6d26de52",
+    "actual_legacy_database_and_wal_included": true,
+    "management_identity_tls_receipt_and_five_installer_artifacts_restored_in_isolation": true,
+    "sqlite_integrity_schema_and_all_committed_rows_match": true,
+    "table_row_counts": {"peer": 1},
+    "logical_peer_dataset_sha256": "13e74304b8b72a3c06061e2f3f38b96c15482823b8d525033ae8444077b56840",
+    "wrong_password_and_tamper_tests_repeated_in_this_rehearsal": false
+  },
+  "actual_offline_migration": {
+    "signed_windows_cli_used": true,
+    "services_stopped_normally_and_resumed": true,
+    "original_legacy_database_and_wal_preserved": true,
+    "all_migrated_committed_peer_records_match_restored_backup": true,
+    "canonical_database_reported_by_running_rendezvous": true,
+    "https_admin_mfa_and_signed_profile_verified": true,
+    "device_approval_revoked_consent_release_approvals_workers_preserved": true,
+    "company_transport_keys_and_worker_credential_preserved": true,
+    "corresponding_source_installed": true
+  },
+  "remaining": [
+    "Full encrypted backup from canonical transport storage",
+    "Populated running-stack restore and guarded rollback",
+    "Fresh native remote session after migration and recovery"
+  ],
+  "public_internet_connectivity_qualified": false,
+  "production_publication": false,
+  "full_product_acceptance_complete": false
+}
diff --git a/docs/evidence/361d7c3-windows-transport-storage-component-checks.json b/docs/evidence/361d7c3-windows-transport-storage-component-checks.json
new file mode 100644
index 00000000000..7cbd0fa34fb
--- /dev/null
+++ b/docs/evidence/361d7c3-windows-transport-storage-component-checks.json
@@ -0,0 +1,60 @@
+{
+  "utc": "2026-10-29T19:24:35.687708+00:00",
+  "source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "run": 40930580611,
+  "workflow_url": "https://github.com/rijff24/SwanRemoteSupport/actions/runs/40930580611",
+  "jobs": [
+    {
+      "id": 123647616688,
+      "name": "linux-deployment",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 123647617319,
+      "name": "maintained-windows-transport / transport (windows-2022)",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 123647618746,
+      "name": "technician-msi-lifecycle",
+      "status": "completed",
+      "conclusion": "skipped"
+    },
+    {
+      "id": 123652448502,
+      "name": "verify (windows-2022)",
+      "status": "completed",
+      "conclusion": "success"
+    },
+    {
+      "id": 123652448694,
+      "name": "verify (ubuntu-24.04)",
+      "status": "completed",
+      "conclusion": "success"
+    }
+  ],
+  "windows_named_regressions_passed": [
+    "backup::tests::transport_migration_recovers_stopped_wal_without_changing_source_or_keys",
+    "backup::tests::transport_migration_refuses_existing_target_active_management_and_corrupt_source",
+    "backup::tests::transport_migration_refuses_a_running_windows_database_writer",
+    "components::tests::legacy_transport_database_requires_explicit_migration"
+  ],
+  "windows_job_log_sha256": "b2ca0e314b9089fe63994c01fb0133ad69b5ea9e2aaf0cd6fe37dbf195b6aaec",
+  "windows_artifact": {
+    "id": 12922249929,
+    "archive_sha256": "f46ad102d48fc45d052864e99e4937e4f46bfa623e61173a981aada4fb5e025e",
+    "public_source_files_verified": 242,
+    "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+    "sha256": {
+      "swan-management.exe": "772cb5a490452742d39342e34decc82b3f3be1a2cad1ece6f348ab3972771038",
+      "swan-agent.exe": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+      "swan-worker.exe": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+      "CompanyComponents-source.zip": "0cfd93a07436bd724d6612040bd0513f9877e7db396d1f4097a065fa9a1a758c"
+    }
+  },
+  "downloaded_executables_executed": false,
+  "actual_windows_company_migration_and_populated_restore_pending": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/3bcc884-reporting-component-checks.json b/docs/evidence/3bcc884-reporting-component-checks.json
new file mode 100644
index 00000000000..c49da0d5cb4
--- /dev/null
+++ b/docs/evidence/3bcc884-reporting-component-checks.json
@@ -0,0 +1,40 @@
+{
+  "date": "2026-10-29",
+  "source": "3bcc884ca1a727150fc48aea4639bf97f5eef218",
+  "push_run": 40802350838,
+  "pull_request_run": 40802355594,
+  "passed_jobs": {
+    "push_linux_deployment": 123213172045,
+    "push_windows_verify": 123213172348,
+    "push_ubuntu_verify": 123213172545,
+    "pr_ubuntu_verify": 123213188333,
+    "pr_linux_deployment": 123213188602,
+    "pr_windows_verify": 123213188686
+  },
+  "named_tests_confirmed_in_both_push_platform_logs": [
+    "identity_and_revision_survive_restart_without_credentials_and_stale_callbacks_lose",
+    "preparation_uses_enrolled_identity_and_never_guesses_installed_version",
+    "technician_restarts_and_concurrent_reporters_keep_one_identity_and_unique_revisions",
+    "http_conflict_recovers_once_and_a_newer_local_phase_cancels_old_retry"
+  ],
+  "docker_context": {
+    "required_public_files": 50,
+    "private_file_canaries_excluded": true,
+    "new_reporting_source_included": true,
+    "actual_local_docker_export_also_passed": true
+  },
+  "windows_artifact": {
+    "id": 12867480300,
+    "bytes": 9098709,
+    "sha256": "0565d3eb25e7400fa062dbcd2398c3d3c53b21b8d58a30c20f6436cf4ee275d0",
+    "public_source_files_verified_against_git": 234,
+    "x64_agent_management_worker_verified": true,
+    "executables_run_during_collection": false
+  },
+  "limits": [
+    "MSI lifecycle jobs were skipped, not passed",
+    "Native Windows application version1.5.9 has not been built or tested by these component jobs",
+    "No independent binary reproduction or production signing claim"
+  ],
+  "production_qualified": false
+}
diff --git a/docs/evidence/3bcc884-windows-transport-server2016.json b/docs/evidence/3bcc884-windows-transport-server2016.json
new file mode 100644
index 00000000000..65583e0e0e8
--- /dev/null
+++ b/docs/evidence/3bcc884-windows-transport-server2016.json
@@ -0,0 +1,30 @@
+{
+  "date": "2026-10-29",
+  "project_source": "3bcc884ca1a727150fc48aea4639bf97f5eef218",
+  "transport_build_run": 40802355602,
+  "upstream": "9bae9f2f39d92c4b4ba2e28e089da5071897b22e",
+  "shared": "83419b6549636ee39dacef7776c473f5802e08d6",
+  "public_upstream_source_files_verified": 133,
+  "public_recipe_files_verified": 6,
+  "binary_sha256": {
+    "hbbs.exe": "2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be",
+    "hbbr.exe": "97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0"
+  },
+  "windows_build": "14393",
+  "passed": [
+    "Verified candidate executables started on the owned Server2016 Desktop Experience endpoint in a separate protected directory",
+    "Candidate TCP listeners and dual-stack rendezvous UDP listener became available on separate ports",
+    "Real IPv4 loopback RegisterPeer request received the expected RegisterPeerResponse requesting a public key",
+    "Real IPv6 loopback RegisterPeer request received the same expected response",
+    "No WSAEFAULT or10014 error in collected rendezvous logs",
+    "New isolated transport keys generated without private key export",
+    "Both candidate processes stopped by verified process identity",
+    "Working customer service process and managed state unchanged"
+  ],
+  "limits": [
+    "Existing endpoint VM, not a fresh company-server installation",
+    "Private guest loopback only; no native relay pairing or public NAT traversal tested",
+    "No Windows service registration, setup wizard or recovery qualification",
+    "Unsigned test binaries; no independent binary reproduction or production publication"
+  ]
+}
diff --git a/docs/evidence/649682a-authenticated-technician-identity-component-checks.json b/docs/evidence/649682a-authenticated-technician-identity-component-checks.json
new file mode 100644
index 00000000000..2059077ef1d
--- /dev/null
+++ b/docs/evidence/649682a-authenticated-technician-identity-component-checks.json
@@ -0,0 +1,71 @@
+{
+  "recorded_utc": "2026-10-28T21:48:56.384528+00:00",
+  "application_source": "649682af806e8cdf148399ed397cad2429ad8b5f",
+  "candidate_version": "1.5.8",
+  "workflow": "company-product.yml",
+  "push_run": 40772301701,
+  "pull_request_run": 40772312125,
+  "push_verified_jobs": [
+    {
+      "id": 123112564049,
+      "name": "verify (windows-2022)",
+      "conclusion": "success"
+    },
+    {
+      "id": 123112564166,
+      "name": "verify (ubuntu-24.04)",
+      "conclusion": "success"
+    },
+    {
+      "id": 123112563892,
+      "name": "linux-deployment",
+      "conclusion": "success"
+    }
+  ],
+  "pull_request_verified_jobs": [
+    {
+      "id": 123112591278,
+      "name": "verify (windows-2022)",
+      "conclusion": "success"
+    },
+    {
+      "id": 123112590802,
+      "name": "verify (ubuntu-24.04)",
+      "conclusion": "success"
+    },
+    {
+      "id": 123112591249,
+      "name": "linux-deployment",
+      "conclusion": "success"
+    }
+  ],
+  "named_tests_observed_passing_in_both_push_platform_logs": [
+    "tests::claimed_technician_identity_is_company_bound_and_legacy_safe",
+    "service::session_identity_tests::claimed_identity_comes_from_the_authorized_company_account"
+  ],
+  "coverage": [
+    "Real Axum claim handler returns the database account username despite spoofed identity fields in the request.",
+    "Wrong signed technician identity, wrong device, unauthenticated request and replay are denied.",
+    "Agent accepts the matching company identity, uses signed technician ID with older claim responses, and rejects mismatched or malformed identity."
+  ],
+  "local_source_packaging_tests": {
+    "test_build_source": 5,
+    "test_customer_msi": 6,
+    "all_passed": true
+  },
+  "signed_grant_schema_unchanged": true,
+  "database_schema_unchanged": true,
+  "native_build": {
+    "run": 40772456579,
+    "status_observed": "in_progress",
+    "step_observed": "Install native dependencies",
+    "engine": "source-candidate-05d5369"
+  },
+  "limits": [
+    "New native prompt not installed or visually qualified.",
+    "No independent native 1.5.8 reproduction, signing, company packages or automatic rollout yet.",
+    "Technician MSI lifecycle job was intentionally skipped in these component runs; no 1.5.8 MSI lifecycle qualification.",
+    "Existing ignored component integration fixtures are not counted as passed end-to-end acceptance.",
+    "The 512 MiB expanded company backup limit remains unresolved before adding more retained release artifacts."
+  ]
+}
diff --git a/docs/evidence/67b5c69-company-backup-and-rollback.json b/docs/evidence/67b5c69-company-backup-and-rollback.json
new file mode 100644
index 00000000000..98833572ce1
--- /dev/null
+++ b/docs/evidence/67b5c69-company-backup-and-rollback.json
@@ -0,0 +1,241 @@
+{
+  "recorded_utc": "2026-10-28T23:41:16.160472+00:00",
+  "application_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "recovery_test_source": "26aea8396a69dfec84504acc8323114b4a29aea7",
+  "schema_version": 2,
+  "local_image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+  "generated_fixture_recovery": {
+    "actual_management_cli": true,
+    "format": "SWANBK2",
+    "maximum_virtual_address_space_bytes_per_cli_process": 536870912,
+    "incompressible_artifact_bytes": 537919488,
+    "encrypted_backup_bytes": 538013267,
+    "artifact_sha256_preserved": "970b25894496dad79f41dd988eccf43d80f30febecd900b6a8b08ff800372f6d",
+    "identity_keys_and_setup_token_preserved": true,
+    "sqlite_integrity_passed": true,
+    "private_unix_permissions_passed": true,
+    "write_size_failure_rejected_and_cleaned": true,
+    "restore_sigkill_after_authenticated_staging": true,
+    "interrupted_restore_target_unpublished": true,
+    "retry_preserved_artifact_hash_and_identity": true,
+    "forced_stop_remnants_private_and_preserved_until_explicit_fixture_cleanup": true,
+    "temporary_archive_cleanup_passed": true,
+    "production_qualification": false,
+    "candidate_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+    "candidate_image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+    "test_source": "26aea8396a69dfec84504acc8323114b4a29aea7"
+  },
+  "actual_company_legacy_restore": {
+    "utc": "2026-10-28T23:14:10.372971+00:00",
+    "candidate_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+    "candidate_image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+    "legacy_v1_backup_read_by_new_v2_capable_binary": true,
+    "restored_https_original_ca_and_hostname": true,
+    "restored_active_signing_key_from_database": true,
+    "legacy_seed_unchanged": true,
+    "profile_revision": 14,
+    "administrator_mfa": true,
+    "device_approval_identity_and_revoked_consent_preserved": true,
+    "withdrawn_downloads": [
+      {
+        "edition": "customer",
+        "withdrawn_download_status": 404
+      },
+      {
+        "edition": "technician",
+        "withdrawn_download_status": 404
+      }
+    ],
+    "all_five_device_records_preserved": true,
+    "all_sixteen_installer_artifacts_readable_by_service_uid": true,
+    "current_proxy_configuration_and_complete_tls_match": true,
+    "current_bundle_downloads": [
+      {
+        "edition": "customer",
+        "authenticated": false,
+        "status": 200,
+        "hash_matched": true
+      },
+      {
+        "edition": "customer",
+        "authenticated": true,
+        "status": 200,
+        "hash_matched": true
+      },
+      {
+        "edition": "technician",
+        "authenticated": false,
+        "status": 401,
+        "hash_matched": false
+      },
+      {
+        "edition": "technician",
+        "authenticated": true,
+        "status": 200,
+        "hash_matched": true
+      }
+    ],
+    "release_approvals_match_backup": true,
+    "failed_152_downloads_still_withdrawn": true,
+    "no_native_transport_started": true,
+    "native_session_qualified": false
+  },
+  "actual_management_upgrade_rollback_and_rollforward": {
+    "utc": "2026-10-28T23:29:00.959500+00:00",
+    "old_source": "761b5c56cca8cd7eecb65d3438de0d6f0075bd4e",
+    "new_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+    "old_image": "sha256:72defbd524e10f0b4b08e53234c04ce9a6d3b7d54dbcee41943b5baca7666871",
+    "new_image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+    "database_schema_unchanged": true,
+    "actual_upgrade_rollback_and_rollforward": true,
+    "new_admin_mfa_login_after_final_upgrade": true,
+    "phases": [
+      {
+        "phase": "baseline",
+        "image": "sha256:72defbd524e10f0b4b08e53234c04ce9a6d3b7d54dbcee41943b5baca7666871",
+        "utc": "2026-10-28T23:28:47.845640+00:00",
+        "https_and_transport_containers_unchanged": true,
+        "signed_profile_trust_and_revision_preserved": true,
+        "all_five_device_records_and_consent_preserved": true,
+        "authorized_and_unassigned_technician_permissions_preserved": true,
+        "unassigned_session_request_status": 403,
+        "existing_mfa_sessions_survived": true,
+        "release_approvals_and_group_capabilities_preserved": true
+      },
+      {
+        "phase": "upgraded",
+        "image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+        "utc": "2026-10-28T23:28:54.346527+00:00",
+        "https_and_transport_containers_unchanged": true,
+        "signed_profile_trust_and_revision_preserved": true,
+        "all_five_device_records_and_consent_preserved": true,
+        "authorized_and_unassigned_technician_permissions_preserved": true,
+        "unassigned_session_request_status": 403,
+        "existing_mfa_sessions_survived": true,
+        "release_approvals_and_group_capabilities_preserved": true
+      },
+      {
+        "phase": "rolled-back",
+        "image": "sha256:72defbd524e10f0b4b08e53234c04ce9a6d3b7d54dbcee41943b5baca7666871",
+        "utc": "2026-10-28T23:28:57.178009+00:00",
+        "https_and_transport_containers_unchanged": true,
+        "signed_profile_trust_and_revision_preserved": true,
+        "all_five_device_records_and_consent_preserved": true,
+        "authorized_and_unassigned_technician_permissions_preserved": true,
+        "unassigned_session_request_status": 403,
+        "existing_mfa_sessions_survived": true,
+        "release_approvals_and_group_capabilities_preserved": true
+      },
+      {
+        "phase": "rolled-forward",
+        "image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+        "utc": "2026-10-28T23:28:59.687333+00:00",
+        "https_and_transport_containers_unchanged": true,
+        "signed_profile_trust_and_revision_preserved": true,
+        "all_five_device_records_and_consent_preserved": true,
+        "authorized_and_unassigned_technician_permissions_preserved": true,
+        "unassigned_session_request_status": 403,
+        "existing_mfa_sessions_survived": true,
+        "release_approvals_and_group_capabilities_preserved": true
+      }
+    ],
+    "pre_upgrade_backup_sha256": "06c5ba80a5d15b9037e0f81d76e199c4200ef1424d6d54f547eaaa4f65203e0c",
+    "independent_backup_restore_passed_before_upgrade": true,
+    "native_clients_not_upgraded": true,
+    "windows_company_server_not_touched": true,
+    "no_production_publication": true
+  },
+  "actual_company_new_backup": {
+    "utc": "2026-10-28T23:31:28.563719+00:00",
+    "format": "SWANBK2",
+    "source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+    "bytes": 502466702,
+    "sha256": "7863932fc3d4b9cebdb6e4d1ee4e07892b680adf191bdc8de951246ff7cb826d",
+    "separate_passphrase": true,
+    "installer_artifact_count": 16,
+    "installer_artifact_bytes": 502388268,
+    "profile_revision": 14,
+    "no_additional_management_upgrade_executed": true,
+    "restore_validation_pending": false
+  },
+  "actual_company_new_restore": {
+    "utc": "2026-10-28T23:33:28.282941+00:00",
+    "backup_format": "SWANBK2",
+    "candidate_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+    "candidate_image": "sha256:ab620feb37fc26b8066799dd19508803752431d353a7c0ae06c1218f5f7982ab",
+    "new_v2_full_company_backup_authenticated_and_restored": true,
+    "restored_https_original_ca_and_hostname": true,
+    "restored_active_signing_key_from_database": true,
+    "legacy_seed_unchanged": true,
+    "profile_revision": 14,
+    "administrator_mfa": true,
+    "device_approval_identity_and_revoked_consent_preserved": true,
+    "withdrawn_downloads": [
+      {
+        "edition": "customer",
+        "withdrawn_download_status": 404
+      },
+      {
+        "edition": "technician",
+        "withdrawn_download_status": 404
+      }
+    ],
+    "all_five_device_records_preserved": true,
+    "all_sixteen_installer_artifacts_readable_by_service_uid": true,
+    "current_proxy_configuration_and_complete_tls_match": true,
+    "current_bundle_downloads": [
+      {
+        "edition": "customer",
+        "authenticated": false,
+        "status": 200,
+        "hash_matched": true
+      },
+      {
+        "edition": "customer",
+        "authenticated": true,
+        "status": 200,
+        "hash_matched": true
+      },
+      {
+        "edition": "technician",
+        "authenticated": false,
+        "status": 401,
+        "hash_matched": false
+      },
+      {
+        "edition": "technician",
+        "authenticated": true,
+        "status": 200,
+        "hash_matched": true
+      }
+    ],
+    "release_approvals_match_backup": true,
+    "failed_152_downloads_still_withdrawn": true,
+    "no_native_transport_started": true,
+    "native_session_qualified": false
+  },
+  "both_restore_copies_stopped_and_storage_retained": true,
+  "original_company_healthy_after_new_format_export": true,
+  "corrected_deployment_ci": {
+    "source": "26aea8396a69dfec84504acc8323114b4a29aea7",
+    "push_run": 40785509496,
+    "pull_request_run": 40785514273,
+    "all_six_windows_linux_component_and_linux_deployment_jobs_succeeded": true,
+    "jobs": [
+      123157680332,
+      123157680607,
+      123157680933,
+      123157690681,
+      123157691089,
+      123157691218
+    ]
+  },
+  "limits": [
+    "Management image rollback used the unchanged schema2 database; it does not qualify a future schema downgrade.",
+    "Forced interruption used SIGKILL during actual authenticated restore staging on generated fixture data; it is not a host power-loss test.",
+    "Write-failure injection used a per-file size limit, not exhaustion of the host filesystem.",
+    "Current-company restores verified HTTPS, management state, consent and actual installer access/hashes without starting cloned transport or native sessions.",
+    "Windows full-company restore and final native session/install/update qualification remain open.",
+    "No production signing or publication."
+  ]
+}
diff --git a/docs/evidence/67b5c69-component-reproduction.json b/docs/evidence/67b5c69-component-reproduction.json
new file mode 100644
index 00000000000..e5eae31c735
--- /dev/null
+++ b/docs/evidence/67b5c69-component-reproduction.json
@@ -0,0 +1,570 @@
+{
+  "utc": "2026-10-28T23:18:37.920346+00:00",
+  "source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "platforms": {
+    "ubuntu-24.04": {
+      "builds": [
+        {
+          "run_id": 40782624233,
+          "verification_job": 123147878188,
+          "workflow_conclusion": "failure",
+          "artifact": 12857848292,
+          "digest": "sha256:d7d1842eda79a9e3f5922aa9152addd369c30c5f752c5bcfca46bc36d94140e8",
+          "bytes": 9598173,
+          "packaging_revision": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+          "public_tree": "93e673a91b19e63e8e6fa4c9f1c638aa1333eb25",
+          "public_source_files_verified": 230,
+          "text_checkout_conversions": [],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "sha256": {
+            "swan-management": "6c183edef58eff3dbbd056704ba8abb934c297f8f264556b80805e05578b151d",
+            "swan-agent": "e0c5d8125b702cc9d00ca8889336bebd3d9535f3e71117fb2050aa0bd09b847b",
+            "swan-worker": "297d9270c514bf930e3df5f6bbf6f99767562bb71827b5ce1410216c6cc543fd",
+            "CompanyComponents-source.zip": "6ac69034618e09a927c656d05d42808e930e90991052fa6b244c630f1712befc"
+          }
+        },
+        {
+          "run_id": 40782630003,
+          "verification_job": 123147893099,
+          "workflow_conclusion": "failure",
+          "artifact": 12857554316,
+          "digest": "sha256:a0e17c369a67d57bdde487d27e1676c3787f1191feaadc85142fe269ddd1e3f8",
+          "bytes": 9598173,
+          "packaging_revision": "48171b350e2a4c27f764f4b2364e87a15ece6e4b",
+          "public_tree": "93e673a91b19e63e8e6fa4c9f1c638aa1333eb25",
+          "public_source_files_verified": 230,
+          "text_checkout_conversions": [],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "sha256": {
+            "swan-management": "6c183edef58eff3dbbd056704ba8abb934c297f8f264556b80805e05578b151d",
+            "swan-agent": "e0c5d8125b702cc9d00ca8889336bebd3d9535f3e71117fb2050aa0bd09b847b",
+            "swan-worker": "297d9270c514bf930e3df5f6bbf6f99767562bb71827b5ce1410216c6cc543fd",
+            "CompanyComponents-source.zip": "2a25fe23b948e3f141c4916305aed9267ea1b1f8b1c931564e47126560066b94"
+          }
+        }
+      ],
+      "binaries": {
+        "swan-management": {
+          "identical": true,
+          "first_sha256": "6c183edef58eff3dbbd056704ba8abb934c297f8f264556b80805e05578b151d",
+          "second_sha256": "6c183edef58eff3dbbd056704ba8abb934c297f8f264556b80805e05578b151d",
+          "normalized": false
+        },
+        "swan-agent": {
+          "identical": true,
+          "first_sha256": "e0c5d8125b702cc9d00ca8889336bebd3d9535f3e71117fb2050aa0bd09b847b",
+          "second_sha256": "e0c5d8125b702cc9d00ca8889336bebd3d9535f3e71117fb2050aa0bd09b847b",
+          "normalized": false
+        },
+        "swan-worker": {
+          "identical": true,
+          "first_sha256": "297d9270c514bf930e3df5f6bbf6f99767562bb71827b5ce1410216c6cc543fd",
+          "second_sha256": "297d9270c514bf930e3df5f6bbf6f99767562bb71827b5ce1410216c6cc543fd",
+          "normalized": false
+        }
+      },
+      "all_original_binaries_identical": true
+    },
+    "windows-2022": {
+      "builds": [
+        {
+          "run_id": 40782624233,
+          "verification_job": 123147878499,
+          "workflow_conclusion": "failure",
+          "artifact": 12858024221,
+          "digest": "sha256:ec998eee102fcc8986dae4359fb40fbc46101a0f40eabaf0cea801de918f599d",
+          "bytes": 8940498,
+          "packaging_revision": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+          "public_tree": "93e673a91b19e63e8e6fa4c9f1c638aa1333eb25",
+          "public_source_files_verified": 230,
+          "text_checkout_conversions": [
+            ".cargo/config.toml",
+            ".dockerignore",
+            "LICENCE",
+            "branding/swan-logo-dark.svg",
+            "branding/swan-logo-light.svg",
+            "branding/swan-mark.svg",
+            "branding/swan-support-mark.svg",
+            "deployment/linux/07bb8d0-component-reproduction.json",
+            "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+            "deployment/linux/Caddyfile",
+            "deployment/linux/Dockerfile",
+            "deployment/linux/Dockerfile.dockerignore",
+            "deployment/linux/README.md",
+            "deployment/linux/automatic-branding-sync-evidence.json",
+            "deployment/linux/company-full-backup-restore-evidence.json",
+            "deployment/linux/company-worker-bundle-evidence.json",
+            "deployment/linux/company.env.example",
+            "deployment/linux/compose.maintained-transport.yaml",
+            "deployment/linux/compose.yaml",
+            "deployment/linux/customer-offline-controls-evidence.json",
+            "deployment/linux/export_transport_candidate.py",
+            "deployment/linux/fresh-company-lab-evidence.json",
+            "deployment/linux/generated-customer-enrollment-evidence.json",
+            "deployment/linux/generated-technician-setup-evidence.json",
+            "deployment/linux/installed-profile-key-rotation-evidence.json",
+            "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+            "deployment/linux/native-technician-interface-evidence.json",
+            "deployment/linux/native-unattended-consent-evidence.json",
+            "deployment/linux/pre-153-company-backup-restore-evidence.json",
+            "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+            "deployment/linux/technician-authorization-evidence.json",
+            "deployment/linux/test_backup_memory.py",
+            "deployment/linux/test_build_context.py",
+            "deployment/linux/test_container_stack.py",
+            "deployment/linux/test_container_startup.py",
+            "deployment/transport-source.json",
+            "deployment/web/test-company-setup.js",
+            "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+            "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+            "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+            "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+            "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+            "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+            "deployment/windows/7bfce49-native-independent-comparison.json",
+            "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+            "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+            "deployment/windows/9ba592c-company-bundles-evidence.json",
+            "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+            "deployment/windows/9ba592c-native-independent-comparison.json",
+            "deployment/windows/9ba592c-native-source-evidence.json",
+            "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+            "deployment/windows/9ba592c-technician-startup-failure.json",
+            "deployment/windows/Build-CustomerMsi.ps1",
+            "deployment/windows/Build-ServerSetup.ps1",
+            "deployment/windows/Build-TechnicianMsi.ps1",
+            "deployment/windows/COMPANY-SIGNING.md",
+            "deployment/windows/CUSTOMER-MSI.md",
+            "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+            "deployment/windows/Commit-Uninstall.ps1",
+            "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+            "deployment/windows/Expand-ServerCompiler.ps1",
+            "deployment/windows/Expand-ServerReferences.ps1",
+            "deployment/windows/Expand-WixBuildTools.ps1",
+            "deployment/windows/Get-MsiIdentity.ps1",
+            "deployment/windows/Get-MsiInstallMode.ps1",
+            "deployment/windows/Get-MsiProductCode.ps1",
+            "deployment/windows/Get-PinnedArchive.ps1",
+            "deployment/windows/Get-ServerRemovalPlan.ps1",
+            "deployment/windows/Get-WindowsCompatibility.ps1",
+            "deployment/windows/Install-Company.ps1",
+            "deployment/windows/Install-Server.ps1",
+            "deployment/windows/Install-SwanRemoteSupport.cmd",
+            "deployment/windows/Install-Worker.ps1",
+            "deployment/windows/LOCAL-TESTING.md",
+            "deployment/windows/New-LocalTestVm.ps1",
+            "deployment/windows/New-TestVm.ps1",
+            "deployment/windows/Open-Technician.ps1",
+            "deployment/windows/Prepare-CustomerDirectory.ps1",
+            "deployment/windows/Prepare-ServerComponents.ps1",
+            "deployment/windows/Record-MsvcToolchain.ps1",
+            "deployment/windows/Remove-Configuration.ps1",
+            "deployment/windows/Restart-Configuration.ps1",
+            "deployment/windows/Restore-Configuration.ps1",
+            "deployment/windows/Restore-CustomerExe.ps1",
+            "deployment/windows/Restore-ReleaseMsi.ps1",
+            "deployment/windows/SERVER-COMPONENTS.md",
+            "deployment/windows/ServerSetupLauncher.cs",
+            "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+            "deployment/windows/Setup-Server.ps1",
+            "deployment/windows/Sign-CompanyArtifact.ps1",
+            "deployment/windows/Start-LocalTest.ps1",
+            "deployment/windows/Start-TestVm.ps1",
+            "deployment/windows/TECHNICIAN-MSI.md",
+            "deployment/windows/Test-DisposableMsi.ps1",
+            "deployment/windows/UPDATE-RECOVERY.md",
+            "deployment/windows/Uninstall-Server.ps1",
+            "deployment/windows/Uninstall-Technician.ps1",
+            "deployment/windows/Uninstall-Worker.ps1",
+            "deployment/windows/Update-RecoveryTask.ps1",
+            "deployment/windows/Update-UninstallCancellation.ps1",
+            "deployment/windows/VM-TESTING.md",
+            "deployment/windows/Verify-MsiRegistration.ps1",
+            "deployment/windows/Verify-Package.ps1",
+            "deployment/windows/WORKER.md",
+            "deployment/windows/a1d67be-native-build-evidence.json",
+            "deployment/windows/a1d67be-native-independent-comparison.json",
+            "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+            "deployment/windows/a6670d6-native-independent-comparison.json",
+            "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+            "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+            "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+            "deployment/windows/archive-build-source.py",
+            "deployment/windows/compare-native-builds.py",
+            "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+            "deployment/windows/cpp-path-probe-d93b067-observations.json",
+            "deployment/windows/cpp-toolchain-ordinal-validation.json",
+            "deployment/windows/d74a631-native-build-evidence.json",
+            "deployment/windows/da0c621-lab-distribution-evidence.json",
+            "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+            "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-standard-batch-failure.json",
+            "deployment/windows/da0c621-server25-company-technician-evidence.json",
+            "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+            "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+            "deployment/windows/da0c621-win10-bounded-evidence.json",
+            "deployment/windows/da0c621-win10-company-customer-evidence.json",
+            "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+            "deployment/windows/e95010e-first-build-and-source-verification.json",
+            "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+            "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+            "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+            "deployment/windows/engine-05d5369-reproducibility.json",
+            "deployment/windows/generate-customer-msi.py",
+            "deployment/windows/generate-payload-manifest.py",
+            "deployment/windows/install-pinned-flutter.ps1",
+            "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+            "deployment/windows/local-https.js",
+            "deployment/windows/local-test.env.example",
+            "deployment/windows/msi/Technician.wxs",
+            "deployment/windows/native-49ced68-rebuild-comparison.json",
+            "deployment/windows/native-4c5accb-rebuild-comparison.json",
+            "deployment/windows/native-699c9e0-rebuild-comparison.json",
+            "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+            "deployment/windows/native-d8fad20-rebuild-comparison.json",
+            "deployment/windows/native-da0c621-rebuild-comparison.json",
+            "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-toolchain-observations.json",
+            "deployment/windows/select-engine-candidate.py",
+            "deployment/windows/server-compiler.json",
+            "deployment/windows/server-components.json",
+            "deployment/windows/server-references.json",
+            "deployment/windows/server19-company-peer-https-evidence.json",
+            "deployment/windows/test-company-lifecycle.js",
+            "deployment/windows/test-native-profile-time.py",
+            "deployment/windows/test-profile-rotation.js",
+            "deployment/windows/test-server-restore.js",
+            "deployment/windows/test-update-download.js",
+            "deployment/windows/test_build_source.py",
+            "deployment/windows/test_company_setup_entrypoint.ps1",
+            "deployment/windows/test_company_watch_recovery.ps1",
+            "deployment/windows/test_customer_directory.ps1",
+            "deployment/windows/test_customer_msi.py",
+            "deployment/windows/test_customer_service_startup.ps1",
+            "deployment/windows/test_engine_candidate.py",
+            "deployment/windows/test_flutter_engine_source.py",
+            "deployment/windows/test_msi_install_mode.ps1",
+            "deployment/windows/test_msi_metadata.ps1",
+            "deployment/windows/test_msi_service_guard.ps1",
+            "deployment/windows/test_msi_staging.ps1",
+            "deployment/windows/test_native_build_comparison.py",
+            "deployment/windows/test_payload_manifest.py",
+            "deployment/windows/test_pinned_archive.ps1",
+            "deployment/windows/test_pinned_flutter_sdk.py",
+            "deployment/windows/test_reproducible_pe.py",
+            "deployment/windows/test_server_directory.ps1",
+            "deployment/windows/test_server_removal_plan.ps1",
+            "deployment/windows/test_server_setup_reproducibility.ps1",
+            "deployment/windows/test_service_imports.py",
+            "deployment/windows/test_technician_launcher.ps1",
+            "deployment/windows/test_technician_msi_lifecycle.ps1",
+            "deployment/windows/test_uninstall_commit.ps1",
+            "deployment/windows/test_update_recovery_task.ps1",
+            "deployment/windows/verify-reproducible-pe.py",
+            "deployment/windows/verify-service-imports.py",
+            "deployment/windows/win10-lab-account-repair-evidence.json",
+            "deployment/windows/win10-standard-desktop-bounded-failure.json",
+            "product/Cargo.lock",
+            "product/Cargo.toml",
+            "product/README.md",
+            "product/agent/Cargo.toml",
+            "product/agent/src/lib.rs",
+            "product/agent/src/main.rs",
+            "product/agent/src/payload.rs",
+            "product/agent/src/technician.rs",
+            "product/agent/src/update.rs",
+            "product/agent/src/verifier_process.rs",
+            "product/management/Cargo.toml",
+            "product/management/src/backup.rs",
+            "product/management/src/backup_stream.rs",
+            "product/management/src/components.rs",
+            "product/management/src/main.rs",
+            "product/management/src/network.rs",
+            "product/management/src/schema.sql",
+            "product/management/src/service.rs",
+            "product/management/src/tests.rs",
+            "product/management/src/windows.rs",
+            "product/management/web/app.js",
+            "product/management/web/index.html",
+            "product/management/web/style.css",
+            "product/protocol/Cargo.toml",
+            "product/protocol/src/lib.rs",
+            "product/worker/Cargo.toml",
+            "product/worker/src/main.rs",
+            "product/worker/src/windows.rs"
+          ],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "sha256": {
+            "swan-management.exe": "5232d2c9927419aa8076d7ba42fd3d7a3ea28ff18574f2b58e6fcd047ea2c410",
+            "swan-agent.exe": "4c3e7bf2659f1f07749dfa059848d772b9c1848f11cd1d9058b0addda5f8ad86",
+            "swan-worker.exe": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+            "CompanyComponents-source.zip": "9411e566496caf34c5a1dc55aa73c7ea3fa8627322c952b413cd8971a9ef92ea"
+          }
+        },
+        {
+          "run_id": 40782630003,
+          "verification_job": 123147893293,
+          "workflow_conclusion": "failure",
+          "artifact": 12858741089,
+          "digest": "sha256:ecc54e239f86ec665b8f502534044378ef9ac16c802740cbab7b85be173a0962",
+          "bytes": 8940510,
+          "packaging_revision": "48171b350e2a4c27f764f4b2364e87a15ece6e4b",
+          "public_tree": "93e673a91b19e63e8e6fa4c9f1c638aa1333eb25",
+          "public_source_files_verified": 230,
+          "text_checkout_conversions": [
+            ".cargo/config.toml",
+            ".dockerignore",
+            "LICENCE",
+            "branding/swan-logo-dark.svg",
+            "branding/swan-logo-light.svg",
+            "branding/swan-mark.svg",
+            "branding/swan-support-mark.svg",
+            "deployment/linux/07bb8d0-component-reproduction.json",
+            "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+            "deployment/linux/Caddyfile",
+            "deployment/linux/Dockerfile",
+            "deployment/linux/Dockerfile.dockerignore",
+            "deployment/linux/README.md",
+            "deployment/linux/automatic-branding-sync-evidence.json",
+            "deployment/linux/company-full-backup-restore-evidence.json",
+            "deployment/linux/company-worker-bundle-evidence.json",
+            "deployment/linux/company.env.example",
+            "deployment/linux/compose.maintained-transport.yaml",
+            "deployment/linux/compose.yaml",
+            "deployment/linux/customer-offline-controls-evidence.json",
+            "deployment/linux/export_transport_candidate.py",
+            "deployment/linux/fresh-company-lab-evidence.json",
+            "deployment/linux/generated-customer-enrollment-evidence.json",
+            "deployment/linux/generated-technician-setup-evidence.json",
+            "deployment/linux/installed-profile-key-rotation-evidence.json",
+            "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+            "deployment/linux/native-technician-interface-evidence.json",
+            "deployment/linux/native-unattended-consent-evidence.json",
+            "deployment/linux/pre-153-company-backup-restore-evidence.json",
+            "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+            "deployment/linux/technician-authorization-evidence.json",
+            "deployment/linux/test_backup_memory.py",
+            "deployment/linux/test_build_context.py",
+            "deployment/linux/test_container_stack.py",
+            "deployment/linux/test_container_startup.py",
+            "deployment/transport-source.json",
+            "deployment/web/test-company-setup.js",
+            "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+            "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+            "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+            "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+            "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+            "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+            "deployment/windows/7bfce49-native-independent-comparison.json",
+            "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+            "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+            "deployment/windows/9ba592c-company-bundles-evidence.json",
+            "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+            "deployment/windows/9ba592c-native-independent-comparison.json",
+            "deployment/windows/9ba592c-native-source-evidence.json",
+            "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+            "deployment/windows/9ba592c-technician-startup-failure.json",
+            "deployment/windows/Build-CustomerMsi.ps1",
+            "deployment/windows/Build-ServerSetup.ps1",
+            "deployment/windows/Build-TechnicianMsi.ps1",
+            "deployment/windows/COMPANY-SIGNING.md",
+            "deployment/windows/CUSTOMER-MSI.md",
+            "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+            "deployment/windows/Commit-Uninstall.ps1",
+            "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+            "deployment/windows/Expand-ServerCompiler.ps1",
+            "deployment/windows/Expand-ServerReferences.ps1",
+            "deployment/windows/Expand-WixBuildTools.ps1",
+            "deployment/windows/Get-MsiIdentity.ps1",
+            "deployment/windows/Get-MsiInstallMode.ps1",
+            "deployment/windows/Get-MsiProductCode.ps1",
+            "deployment/windows/Get-PinnedArchive.ps1",
+            "deployment/windows/Get-ServerRemovalPlan.ps1",
+            "deployment/windows/Get-WindowsCompatibility.ps1",
+            "deployment/windows/Install-Company.ps1",
+            "deployment/windows/Install-Server.ps1",
+            "deployment/windows/Install-SwanRemoteSupport.cmd",
+            "deployment/windows/Install-Worker.ps1",
+            "deployment/windows/LOCAL-TESTING.md",
+            "deployment/windows/New-LocalTestVm.ps1",
+            "deployment/windows/New-TestVm.ps1",
+            "deployment/windows/Open-Technician.ps1",
+            "deployment/windows/Prepare-CustomerDirectory.ps1",
+            "deployment/windows/Prepare-ServerComponents.ps1",
+            "deployment/windows/Record-MsvcToolchain.ps1",
+            "deployment/windows/Remove-Configuration.ps1",
+            "deployment/windows/Restart-Configuration.ps1",
+            "deployment/windows/Restore-Configuration.ps1",
+            "deployment/windows/Restore-CustomerExe.ps1",
+            "deployment/windows/Restore-ReleaseMsi.ps1",
+            "deployment/windows/SERVER-COMPONENTS.md",
+            "deployment/windows/ServerSetupLauncher.cs",
+            "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+            "deployment/windows/Setup-Server.ps1",
+            "deployment/windows/Sign-CompanyArtifact.ps1",
+            "deployment/windows/Start-LocalTest.ps1",
+            "deployment/windows/Start-TestVm.ps1",
+            "deployment/windows/TECHNICIAN-MSI.md",
+            "deployment/windows/Test-DisposableMsi.ps1",
+            "deployment/windows/UPDATE-RECOVERY.md",
+            "deployment/windows/Uninstall-Server.ps1",
+            "deployment/windows/Uninstall-Technician.ps1",
+            "deployment/windows/Uninstall-Worker.ps1",
+            "deployment/windows/Update-RecoveryTask.ps1",
+            "deployment/windows/Update-UninstallCancellation.ps1",
+            "deployment/windows/VM-TESTING.md",
+            "deployment/windows/Verify-MsiRegistration.ps1",
+            "deployment/windows/Verify-Package.ps1",
+            "deployment/windows/WORKER.md",
+            "deployment/windows/a1d67be-native-build-evidence.json",
+            "deployment/windows/a1d67be-native-independent-comparison.json",
+            "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+            "deployment/windows/a6670d6-native-independent-comparison.json",
+            "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+            "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+            "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+            "deployment/windows/archive-build-source.py",
+            "deployment/windows/compare-native-builds.py",
+            "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+            "deployment/windows/cpp-path-probe-d93b067-observations.json",
+            "deployment/windows/cpp-toolchain-ordinal-validation.json",
+            "deployment/windows/d74a631-native-build-evidence.json",
+            "deployment/windows/da0c621-lab-distribution-evidence.json",
+            "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+            "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-standard-batch-failure.json",
+            "deployment/windows/da0c621-server25-company-technician-evidence.json",
+            "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+            "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+            "deployment/windows/da0c621-win10-bounded-evidence.json",
+            "deployment/windows/da0c621-win10-company-customer-evidence.json",
+            "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+            "deployment/windows/e95010e-first-build-and-source-verification.json",
+            "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+            "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+            "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+            "deployment/windows/engine-05d5369-reproducibility.json",
+            "deployment/windows/generate-customer-msi.py",
+            "deployment/windows/generate-payload-manifest.py",
+            "deployment/windows/install-pinned-flutter.ps1",
+            "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+            "deployment/windows/local-https.js",
+            "deployment/windows/local-test.env.example",
+            "deployment/windows/msi/Technician.wxs",
+            "deployment/windows/native-49ced68-rebuild-comparison.json",
+            "deployment/windows/native-4c5accb-rebuild-comparison.json",
+            "deployment/windows/native-699c9e0-rebuild-comparison.json",
+            "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+            "deployment/windows/native-d8fad20-rebuild-comparison.json",
+            "deployment/windows/native-da0c621-rebuild-comparison.json",
+            "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-toolchain-observations.json",
+            "deployment/windows/select-engine-candidate.py",
+            "deployment/windows/server-compiler.json",
+            "deployment/windows/server-components.json",
+            "deployment/windows/server-references.json",
+            "deployment/windows/server19-company-peer-https-evidence.json",
+            "deployment/windows/test-company-lifecycle.js",
+            "deployment/windows/test-native-profile-time.py",
+            "deployment/windows/test-profile-rotation.js",
+            "deployment/windows/test-server-restore.js",
+            "deployment/windows/test-update-download.js",
+            "deployment/windows/test_build_source.py",
+            "deployment/windows/test_company_setup_entrypoint.ps1",
+            "deployment/windows/test_company_watch_recovery.ps1",
+            "deployment/windows/test_customer_directory.ps1",
+            "deployment/windows/test_customer_msi.py",
+            "deployment/windows/test_customer_service_startup.ps1",
+            "deployment/windows/test_engine_candidate.py",
+            "deployment/windows/test_flutter_engine_source.py",
+            "deployment/windows/test_msi_install_mode.ps1",
+            "deployment/windows/test_msi_metadata.ps1",
+            "deployment/windows/test_msi_service_guard.ps1",
+            "deployment/windows/test_msi_staging.ps1",
+            "deployment/windows/test_native_build_comparison.py",
+            "deployment/windows/test_payload_manifest.py",
+            "deployment/windows/test_pinned_archive.ps1",
+            "deployment/windows/test_pinned_flutter_sdk.py",
+            "deployment/windows/test_reproducible_pe.py",
+            "deployment/windows/test_server_directory.ps1",
+            "deployment/windows/test_server_removal_plan.ps1",
+            "deployment/windows/test_server_setup_reproducibility.ps1",
+            "deployment/windows/test_service_imports.py",
+            "deployment/windows/test_technician_launcher.ps1",
+            "deployment/windows/test_technician_msi_lifecycle.ps1",
+            "deployment/windows/test_uninstall_commit.ps1",
+            "deployment/windows/test_update_recovery_task.ps1",
+            "deployment/windows/verify-reproducible-pe.py",
+            "deployment/windows/verify-service-imports.py",
+            "deployment/windows/win10-lab-account-repair-evidence.json",
+            "deployment/windows/win10-standard-desktop-bounded-failure.json",
+            "product/Cargo.lock",
+            "product/Cargo.toml",
+            "product/README.md",
+            "product/agent/Cargo.toml",
+            "product/agent/src/lib.rs",
+            "product/agent/src/main.rs",
+            "product/agent/src/payload.rs",
+            "product/agent/src/technician.rs",
+            "product/agent/src/update.rs",
+            "product/agent/src/verifier_process.rs",
+            "product/management/Cargo.toml",
+            "product/management/src/backup.rs",
+            "product/management/src/backup_stream.rs",
+            "product/management/src/components.rs",
+            "product/management/src/main.rs",
+            "product/management/src/network.rs",
+            "product/management/src/schema.sql",
+            "product/management/src/service.rs",
+            "product/management/src/tests.rs",
+            "product/management/src/windows.rs",
+            "product/management/web/app.js",
+            "product/management/web/index.html",
+            "product/management/web/style.css",
+            "product/protocol/Cargo.toml",
+            "product/protocol/src/lib.rs",
+            "product/worker/Cargo.toml",
+            "product/worker/src/main.rs",
+            "product/worker/src/windows.rs"
+          ],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n",
+          "sha256": {
+            "swan-management.exe": "5232d2c9927419aa8076d7ba42fd3d7a3ea28ff18574f2b58e6fcd047ea2c410",
+            "swan-agent.exe": "4c3e7bf2659f1f07749dfa059848d772b9c1848f11cd1d9058b0addda5f8ad86",
+            "swan-worker.exe": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+            "CompanyComponents-source.zip": "96f6766e8bdb2d883c07ed680ada12a3ecba32b066fbdc32077f3911a2fc03d7"
+          }
+        }
+      ],
+      "binaries": {
+        "swan-management.exe": {
+          "identical": true,
+          "first_sha256": "5232d2c9927419aa8076d7ba42fd3d7a3ea28ff18574f2b58e6fcd047ea2c410",
+          "second_sha256": "5232d2c9927419aa8076d7ba42fd3d7a3ea28ff18574f2b58e6fcd047ea2c410",
+          "normalized": false
+        },
+        "swan-agent.exe": {
+          "identical": true,
+          "first_sha256": "4c3e7bf2659f1f07749dfa059848d772b9c1848f11cd1d9058b0addda5f8ad86",
+          "second_sha256": "4c3e7bf2659f1f07749dfa059848d772b9c1848f11cd1d9058b0addda5f8ad86",
+          "normalized": false
+        },
+        "swan-worker.exe": {
+          "identical": true,
+          "first_sha256": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+          "second_sha256": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+          "normalized": false
+        }
+      },
+      "all_original_binaries_identical": true
+    }
+  },
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_publication": false,
+  "known_container_deployment_header_assertion_failure_fixed_separately_in_eaa30b6": true
+}
diff --git a/docs/evidence/67b5c69-native-independent-rebuild.json b/docs/evidence/67b5c69-native-independent-rebuild.json
new file mode 100644
index 00000000000..d973dda0bc5
--- /dev/null
+++ b/docs/evidence/67b5c69-native-independent-rebuild.json
@@ -0,0 +1,97 @@
+{
+  "source_commit": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "source_date_epoch": 1793227638,
+  "builds": [
+    {
+      "workflow_run": 40782677653,
+      "artifact": 12861896518,
+      "digest": "sha256:51e0dea72204ff3d21ced7fc2c03db514d4b3b05732b6ec02fbb60ea0d4aede6",
+      "expected_bytes": 254845617,
+      "source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2"
+    },
+    {
+      "workflow_run": 40819351377,
+      "artifact": 12875938829,
+      "digest": "sha256:54ab72ff56e825e2fc4fc41c5342a5aa6cb560a8888330b83ae2ac4267bd7bef",
+      "expected_bytes": 254845563,
+      "source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2"
+    }
+  ],
+  "recorded_msvc_inputs_identical": true,
+  "outputs": [
+    {
+      "path": "SwanRemoteSupport-1.5.8-customer-x64-unsigned.msi",
+      "first_sha256": "4d3af7dbac8be6e3ad362c186803582a92d215d9b1b8dcc102ffbd1399178b46",
+      "second_sha256": "4d3af7dbac8be6e3ad362c186803582a92d215d9b1b8dcc102ffbd1399178b46",
+      "first_bytes": 33599488,
+      "second_bytes": 33599488,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.8-technician-x64-unsigned.exe",
+      "first_sha256": "d760d2820f3d1584fa8a3a15f21c85cc236d1de6ec37aed71f923b91442ed266",
+      "second_sha256": "d760d2820f3d1584fa8a3a15f21c85cc236d1de6ec37aed71f923b91442ed266",
+      "first_bytes": 24259072,
+      "second_bytes": 24259072,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.8-technician-x64-unsigned.msi",
+      "first_sha256": "8e89859193aa48209e6c4026050f96d6e80319ff0f67bf36e937795d9259f6b7",
+      "second_sha256": "8e89859193aa48209e6c4026050f96d6e80319ff0f67bf36e937795d9259f6b7",
+      "first_bytes": 31354880,
+      "second_bytes": 31354880,
+      "identical": true
+    },
+    {
+      "path": "SwanRemoteSupport-1.5.8-x64-unsigned-install.exe",
+      "first_sha256": "d760d2820f3d1584fa8a3a15f21c85cc236d1de6ec37aed71f923b91442ed266",
+      "second_sha256": "d760d2820f3d1584fa8a3a15f21c85cc236d1de6ec37aed71f923b91442ed266",
+      "first_bytes": 24259072,
+      "second_bytes": 24259072,
+      "identical": true
+    },
+    {
+      "path": "SwanServerSetup-UNSIGNED-TEST.exe",
+      "first_sha256": "8c2f6e9f8617961ed50370d783d051f0f3f456e3e39ea871e4555f03c84a0dac",
+      "second_sha256": "8c2f6e9f8617961ed50370d783d051f0f3f456e3e39ea871e4555f03c84a0dac",
+      "first_bytes": 64304640,
+      "second_bytes": 64304640,
+      "identical": true
+    },
+    {
+      "path": "swan-agent.exe",
+      "first_sha256": "4c3e7bf2659f1f07749dfa059848d772b9c1848f11cd1d9058b0addda5f8ad86",
+      "second_sha256": "4c3e7bf2659f1f07749dfa059848d772b9c1848f11cd1d9058b0addda5f8ad86",
+      "first_bytes": 5522944,
+      "second_bytes": 5522944,
+      "identical": true
+    },
+    {
+      "path": "swan-management.exe",
+      "first_sha256": "5232d2c9927419aa8076d7ba42fd3d7a3ea28ff18574f2b58e6fcd047ea2c410",
+      "second_sha256": "5232d2c9927419aa8076d7ba42fd3d7a3ea28ff18574f2b58e6fcd047ea2c410",
+      "first_bytes": 8870400,
+      "second_bytes": 8870400,
+      "identical": true
+    },
+    {
+      "path": "swan-worker.exe",
+      "first_sha256": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+      "second_sha256": "104d6dced6818da87b12c2aa0f52fea4f7e6da0c1ab20109e9c699a5ff44081c",
+      "first_bytes": 4833792,
+      "second_bytes": 4833792,
+      "identical": true
+    }
+  ],
+  "independent_rebuild_verified": true,
+  "normalization_applied_to_shipping_files": false,
+  "executables_run": false,
+  "runtime_qualified": false,
+  "production_approved": false,
+  "scope": "Original unsigned native shipping outputs; no runtime, signing or production qualification",
+  "recorded_utc": "2026-10-29T06:12:42.822338+00:00",
+  "public_source_proofs_verified": true,
+  "independently_generated_bridges_identical": true,
+  "private_lab_signatures_excluded_from_comparison": true
+}
diff --git a/docs/evidence/67b5c69-native158-runtime.json b/docs/evidence/67b5c69-native158-runtime.json
new file mode 100644
index 00000000000..5f54102107c
--- /dev/null
+++ b/docs/evidence/67b5c69-native158-runtime.json
@@ -0,0 +1,29 @@
+{
+  "date": "2026-10-29",
+  "application_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "version": "1.5.8",
+  "test_release_sequence": 10,
+  "transport_recipe_source": "650361413543baf7ef150f5960544154ec77ddeb",
+  "transport_image": "sha256:3e879d6f3954ff2bc750ab02cdea43e05894e75cd4f8d288c411450d2fae93ca",
+  "passed": [
+    "Server-generated customer and protected technician bundles upgraded installed1.5.7 endpoints to1.5.8",
+    "Shipping installed-file verification, MSI state and lab publisher signatures matched",
+    "Device identity, enrollment, company trust, profile14 and disabled unattended consent survived upgrades",
+    "Technician MFA displayed five authorized devices",
+    "Customer approval prompt used the company-authenticated technician username instead of the operating-system display name",
+    "Live attended desktop matched receiver and maintained relay connection ID and timestamps",
+    "Claimed authorization renewed beyond the initial300-second lease",
+    "Customer Stop closed the original grant; actual receiving-device renewal returned403",
+    "Technician closure dialog offered OK without Retry",
+    "Resume preserved service, watcher, identity and consent without reviving the closed grant or creating a new lease",
+    "Loaded technician native executable and Rust/Flutter libraries matched verified release payload hashes"
+  ],
+  "limits": [
+    "Separate NAT lab VMs and private company endpoints, not public Internet or direct-connection qualification",
+    "Owned Administrator desktops, not ordinary-user active-session control",
+    "Current-candidate clipboard, transfer, UAC, multiple monitors and outage expiry require separate checks",
+    "A stale sign-in frame after a long idle interval redrew after changing window visibility; cause remains unestablished",
+    "Independent native build40819351377 still in progress when this receipt was prepared",
+    "Lab signing only; no production qualification"
+  ]
+}
diff --git a/docs/evidence/67b5c69-streamed-backup-component-checks.json b/docs/evidence/67b5c69-streamed-backup-component-checks.json
new file mode 100644
index 00000000000..6a4a5ad3d83
--- /dev/null
+++ b/docs/evidence/67b5c69-streamed-backup-component-checks.json
@@ -0,0 +1,55 @@
+{
+  "recorded_utc": "2026-10-28T23:06:32.662165+00:00",
+  "source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "format": "SWANBK2",
+  "component_push_run": 40782624233,
+  "component_pull_request_run": 40782630003,
+  "verify_jobs": {
+    "push_linux": 123147878188,
+    "push_windows": 123147878499,
+    "pull_request_linux": 123147893099,
+    "pull_request_windows": 123147893293
+  },
+  "all_four_component_verification_jobs_successful": true,
+  "new_regressions": [
+    "stream_authenticates_order_finality_header_and_chunk_boundaries",
+    "legacy_backup_restores_and_new_export_never_overwrites",
+    "authenticated_but_invalid_zip_never_publishes_or_leaves_plaintext_staging",
+    "crc_failure_during_extraction_preserves_target_and_failed_export_cleans_up"
+  ],
+  "windows_explicit_large_roundtrip": {
+    "test": "backup_above_previous_limit_preserves_incompressible_artifact",
+    "input_bytes": 537919488,
+    "incompressible_fixture": true,
+    "encrypted_archive_above_512MiB": true,
+    "restored_size_sha256_and_key_verified": true,
+    "passed": true
+  },
+  "linux_actual_cli_qualification": {
+    "script": "deployment/linux/test_backup_memory.py",
+    "job": 123147878188,
+    "input_bytes": 537919488,
+    "maximum_virtual_address_space_bytes_per_cli_process": 536870912,
+    "actual_backup_and_restore_commands_passed": true,
+    "encrypted_archive_above_512MiB": true,
+    "artifact_hash_identity_keys_setup_token_sqlite_integrity_and_private_permissions_checked": true
+  },
+  "local_deployment_image": {
+    "pinned_public_source": true,
+    "isolated_build_exit_zero": true,
+    "existing_company_not_upgraded": true,
+    "current_company_restore_rehearsal_pending": true
+  },
+  "deployment_gate": {
+    "runs_failed_on_old_format_header_assertion": true,
+    "assertion_updated_in_source": "eaa30b611e86f1ae9e7f33ab55bc6b87d62129dd",
+    "corrected_deployment_rehearsal_pending": true
+  },
+  "limits": [
+    "These are component and isolated CLI checks, not completed production qualification.",
+    "Actual current-company recovery, guarded upgrade and new-format deployment restore remain separate.",
+    "Forced interruption, disk-full recovery and Windows full-company deployment restore remain open.",
+    "Native reconnect/audit guards and trusted technician labels still require installed runtime rechecks."
+  ],
+  "production_publication": false
+}
diff --git a/docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json b/docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json
new file mode 100644
index 00000000000..99df667afaa
--- /dev/null
+++ b/docs/evidence/9fa5e8a-independent-windows-linux-component-reproduction-20261029.json
@@ -0,0 +1,587 @@
+{
+  "utc": "2026-10-29T18:30:18.720952+00:00",
+  "source": "9fa5e8aa6a846ce015362de8082da5c938d79ff8",
+  "runs": [
+    40865719332,
+    40925349725
+  ],
+  "jobs": {
+    "40865719332": [
+      {
+        "name": "linux-deployment",
+        "conclusion": "success"
+      },
+      {
+        "name": "maintained-windows-transport / transport (windows-2022)",
+        "conclusion": "success"
+      },
+      {
+        "name": "technician-msi-lifecycle",
+        "conclusion": "skipped"
+      },
+      {
+        "name": "verify (ubuntu-24.04)",
+        "conclusion": "success"
+      },
+      {
+        "name": "verify (windows-2022)",
+        "conclusion": "success"
+      }
+    ],
+    "40925349725": [
+      {
+        "name": "linux-deployment",
+        "conclusion": "success"
+      },
+      {
+        "name": "maintained-windows-transport / transport (windows-2022)",
+        "conclusion": "success"
+      },
+      {
+        "name": "technician-msi-lifecycle",
+        "conclusion": "skipped"
+      },
+      {
+        "name": "verify (ubuntu-24.04)",
+        "conclusion": "success"
+      },
+      {
+        "name": "verify (windows-2022)",
+        "conclusion": "success"
+      }
+    ]
+  },
+  "platforms": {
+    "windows-2022": {
+      "builds": [
+        {
+          "run": 40865719332,
+          "artifact": 12894028915,
+          "archive_sha256": "b17c2ad5ee564bca6055a66ee20e7be2b36c0edf8f81f4c0e8578f648037b33a",
+          "public_source_files_verified": 242,
+          "checkout_text_conversions": [
+            ".cargo/config.toml",
+            ".dockerignore",
+            "LICENCE",
+            "branding/swan-logo-dark.svg",
+            "branding/swan-logo-light.svg",
+            "branding/swan-mark.svg",
+            "branding/swan-support-mark.svg",
+            "deployment/linux/07bb8d0-component-reproduction.json",
+            "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+            "deployment/linux/Caddyfile",
+            "deployment/linux/Dockerfile",
+            "deployment/linux/Dockerfile.dockerignore",
+            "deployment/linux/README.md",
+            "deployment/linux/automatic-branding-sync-evidence.json",
+            "deployment/linux/company-full-backup-restore-evidence.json",
+            "deployment/linux/company-worker-bundle-evidence.json",
+            "deployment/linux/company.env.example",
+            "deployment/linux/compose.maintained-transport.yaml",
+            "deployment/linux/compose.yaml",
+            "deployment/linux/customer-offline-controls-evidence.json",
+            "deployment/linux/export_transport_candidate.py",
+            "deployment/linux/fresh-company-lab-evidence.json",
+            "deployment/linux/generated-customer-enrollment-evidence.json",
+            "deployment/linux/generated-technician-setup-evidence.json",
+            "deployment/linux/installed-profile-key-rotation-evidence.json",
+            "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+            "deployment/linux/native-technician-interface-evidence.json",
+            "deployment/linux/native-unattended-consent-evidence.json",
+            "deployment/linux/pre-153-company-backup-restore-evidence.json",
+            "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+            "deployment/linux/technician-authorization-evidence.json",
+            "deployment/linux/test_backup_memory.py",
+            "deployment/linux/test_build_context.py",
+            "deployment/linux/test_container_stack.py",
+            "deployment/linux/test_container_startup.py",
+            "deployment/linux/test_pinned_images.py",
+            "deployment/transport-source.json",
+            "deployment/web/test-company-setup.js",
+            "deployment/web/test-installation-status.js",
+            "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+            "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+            "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+            "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+            "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+            "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+            "deployment/windows/7bfce49-native-independent-comparison.json",
+            "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+            "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+            "deployment/windows/9ba592c-company-bundles-evidence.json",
+            "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+            "deployment/windows/9ba592c-native-independent-comparison.json",
+            "deployment/windows/9ba592c-native-source-evidence.json",
+            "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+            "deployment/windows/9ba592c-technician-startup-failure.json",
+            "deployment/windows/Build-CustomerMsi.ps1",
+            "deployment/windows/Build-ServerSetup.ps1",
+            "deployment/windows/Build-TechnicianMsi.ps1",
+            "deployment/windows/COMPANY-SIGNING.md",
+            "deployment/windows/CUSTOMER-MSI.md",
+            "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+            "deployment/windows/Commit-Uninstall.ps1",
+            "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+            "deployment/windows/Expand-ServerCompiler.ps1",
+            "deployment/windows/Expand-ServerReferences.ps1",
+            "deployment/windows/Expand-WixBuildTools.ps1",
+            "deployment/windows/Get-MsiIdentity.ps1",
+            "deployment/windows/Get-MsiInstallMode.ps1",
+            "deployment/windows/Get-MsiProductCode.ps1",
+            "deployment/windows/Get-PinnedArchive.ps1",
+            "deployment/windows/Get-ServerRemovalPlan.ps1",
+            "deployment/windows/Get-WindowsCompatibility.ps1",
+            "deployment/windows/Install-Company.ps1",
+            "deployment/windows/Install-Server.ps1",
+            "deployment/windows/Install-SwanRemoteSupport.cmd",
+            "deployment/windows/Install-Worker.ps1",
+            "deployment/windows/LOCAL-TESTING.md",
+            "deployment/windows/Migrate-WorkerCredential.ps1",
+            "deployment/windows/New-LocalTestVm.ps1",
+            "deployment/windows/New-TestVm.ps1",
+            "deployment/windows/Open-Technician.ps1",
+            "deployment/windows/Prepare-CustomerDirectory.ps1",
+            "deployment/windows/Prepare-ServerComponents.ps1",
+            "deployment/windows/Read-WorkerConfiguration.ps1",
+            "deployment/windows/Record-MsvcToolchain.ps1",
+            "deployment/windows/Remove-Configuration.ps1",
+            "deployment/windows/Restart-Configuration.ps1",
+            "deployment/windows/Restore-Configuration.ps1",
+            "deployment/windows/Restore-CustomerExe.ps1",
+            "deployment/windows/Restore-ReleaseMsi.ps1",
+            "deployment/windows/SERVER-COMPONENTS.md",
+            "deployment/windows/ServerSetupLauncher.cs",
+            "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+            "deployment/windows/Setup-Server.ps1",
+            "deployment/windows/Sign-CompanyArtifact.ps1",
+            "deployment/windows/Start-LocalTest.ps1",
+            "deployment/windows/Start-TestVm.ps1",
+            "deployment/windows/TECHNICIAN-MSI.md",
+            "deployment/windows/Test-DisposableMsi.ps1",
+            "deployment/windows/UPDATE-RECOVERY.md",
+            "deployment/windows/Uninstall-Server.ps1",
+            "deployment/windows/Uninstall-Technician.ps1",
+            "deployment/windows/Uninstall-Worker.ps1",
+            "deployment/windows/Update-RecoveryTask.ps1",
+            "deployment/windows/Update-UninstallCancellation.ps1",
+            "deployment/windows/VM-TESTING.md",
+            "deployment/windows/Verify-MsiRegistration.ps1",
+            "deployment/windows/Verify-Package.ps1",
+            "deployment/windows/WORKER.md",
+            "deployment/windows/a1d67be-native-build-evidence.json",
+            "deployment/windows/a1d67be-native-independent-comparison.json",
+            "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+            "deployment/windows/a6670d6-native-independent-comparison.json",
+            "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+            "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+            "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+            "deployment/windows/archive-build-source.py",
+            "deployment/windows/compare-native-builds.py",
+            "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+            "deployment/windows/cpp-path-probe-d93b067-observations.json",
+            "deployment/windows/cpp-toolchain-ordinal-validation.json",
+            "deployment/windows/d74a631-native-build-evidence.json",
+            "deployment/windows/da0c621-lab-distribution-evidence.json",
+            "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+            "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-standard-batch-failure.json",
+            "deployment/windows/da0c621-server25-company-technician-evidence.json",
+            "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+            "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+            "deployment/windows/da0c621-win10-bounded-evidence.json",
+            "deployment/windows/da0c621-win10-company-customer-evidence.json",
+            "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+            "deployment/windows/e95010e-first-build-and-source-verification.json",
+            "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+            "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+            "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+            "deployment/windows/engine-05d5369-reproducibility.json",
+            "deployment/windows/generate-customer-msi.py",
+            "deployment/windows/generate-payload-manifest.py",
+            "deployment/windows/install-pinned-flutter.ps1",
+            "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+            "deployment/windows/local-https.js",
+            "deployment/windows/local-test.env.example",
+            "deployment/windows/msi/Technician.wxs",
+            "deployment/windows/native-49ced68-rebuild-comparison.json",
+            "deployment/windows/native-4c5accb-rebuild-comparison.json",
+            "deployment/windows/native-699c9e0-rebuild-comparison.json",
+            "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+            "deployment/windows/native-d8fad20-rebuild-comparison.json",
+            "deployment/windows/native-da0c621-rebuild-comparison.json",
+            "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-toolchain-observations.json",
+            "deployment/windows/select-engine-candidate.py",
+            "deployment/windows/server-compiler.json",
+            "deployment/windows/server-components.json",
+            "deployment/windows/server-references.json",
+            "deployment/windows/server19-company-peer-https-evidence.json",
+            "deployment/windows/test-company-lifecycle.js",
+            "deployment/windows/test-native-profile-time.py",
+            "deployment/windows/test-profile-rotation.js",
+            "deployment/windows/test-server-restore.js",
+            "deployment/windows/test-update-download.js",
+            "deployment/windows/test_build_source.py",
+            "deployment/windows/test_company_setup_entrypoint.ps1",
+            "deployment/windows/test_company_watch_recovery.ps1",
+            "deployment/windows/test_customer_directory.ps1",
+            "deployment/windows/test_customer_msi.py",
+            "deployment/windows/test_customer_service_startup.ps1",
+            "deployment/windows/test_engine_candidate.py",
+            "deployment/windows/test_flutter_engine_source.py",
+            "deployment/windows/test_msi_install_mode.ps1",
+            "deployment/windows/test_msi_metadata.ps1",
+            "deployment/windows/test_msi_service_guard.ps1",
+            "deployment/windows/test_msi_staging.ps1",
+            "deployment/windows/test_native_build_comparison.py",
+            "deployment/windows/test_payload_manifest.py",
+            "deployment/windows/test_pinned_archive.ps1",
+            "deployment/windows/test_pinned_flutter_sdk.py",
+            "deployment/windows/test_reproducible_pe.py",
+            "deployment/windows/test_server_directory.ps1",
+            "deployment/windows/test_server_removal_plan.ps1",
+            "deployment/windows/test_server_setup_reproducibility.ps1",
+            "deployment/windows/test_service_imports.py",
+            "deployment/windows/test_technician_launcher.ps1",
+            "deployment/windows/test_technician_msi_lifecycle.ps1",
+            "deployment/windows/test_uninstall_commit.ps1",
+            "deployment/windows/test_update_download.ps1",
+            "deployment/windows/test_update_recovery_task.ps1",
+            "deployment/windows/test_worker_configuration.ps1",
+            "deployment/windows/verify-reproducible-pe.py",
+            "deployment/windows/verify-service-imports.py",
+            "deployment/windows/win10-lab-account-repair-evidence.json",
+            "deployment/windows/win10-standard-desktop-bounded-failure.json",
+            "product/Cargo.lock",
+            "product/Cargo.toml",
+            "product/README.md",
+            "product/agent/Cargo.toml",
+            "product/agent/src/lib.rs",
+            "product/agent/src/main.rs",
+            "product/agent/src/payload.rs",
+            "product/agent/src/reporting.rs",
+            "product/agent/src/technician.rs",
+            "product/agent/src/update.rs",
+            "product/agent/src/verifier_process.rs",
+            "product/management/Cargo.toml",
+            "product/management/src/backup.rs",
+            "product/management/src/backup_stream.rs",
+            "product/management/src/components.rs",
+            "product/management/src/installation_reporting.rs",
+            "product/management/src/main.rs",
+            "product/management/src/network.rs",
+            "product/management/src/schema.sql",
+            "product/management/src/service.rs",
+            "product/management/src/tests.rs",
+            "product/management/src/windows.rs",
+            "product/management/web/app.js",
+            "product/management/web/index.html",
+            "product/management/web/style.css",
+            "product/protocol/Cargo.toml",
+            "product/protocol/src/installation.rs",
+            "product/protocol/src/lib.rs",
+            "product/worker/Cargo.toml",
+            "product/worker/src/configuration.rs",
+            "product/worker/src/main.rs",
+            "product/worker/src/windows.rs"
+          ],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n"
+        },
+        {
+          "run": 40925349725,
+          "artifact": 12920708621,
+          "archive_sha256": "01b6dcc0003fcb701952caeeb0a9ceaffe1e8684d9b24af27c2cfa3a3b677e8b",
+          "public_source_files_verified": 242,
+          "checkout_text_conversions": [
+            ".cargo/config.toml",
+            ".dockerignore",
+            "LICENCE",
+            "branding/swan-logo-dark.svg",
+            "branding/swan-logo-light.svg",
+            "branding/swan-mark.svg",
+            "branding/swan-support-mark.svg",
+            "deployment/linux/07bb8d0-component-reproduction.json",
+            "deployment/linux/07bb8d0-maintained-transport-native-relay-and-customer-pause.json",
+            "deployment/linux/Caddyfile",
+            "deployment/linux/Dockerfile",
+            "deployment/linux/Dockerfile.dockerignore",
+            "deployment/linux/README.md",
+            "deployment/linux/automatic-branding-sync-evidence.json",
+            "deployment/linux/company-full-backup-restore-evidence.json",
+            "deployment/linux/company-worker-bundle-evidence.json",
+            "deployment/linux/company.env.example",
+            "deployment/linux/compose.maintained-transport.yaml",
+            "deployment/linux/compose.yaml",
+            "deployment/linux/customer-offline-controls-evidence.json",
+            "deployment/linux/export_transport_candidate.py",
+            "deployment/linux/fresh-company-lab-evidence.json",
+            "deployment/linux/generated-customer-enrollment-evidence.json",
+            "deployment/linux/generated-technician-setup-evidence.json",
+            "deployment/linux/installed-profile-key-rotation-evidence.json",
+            "deployment/linux/maintained-transport-and-current-restore-20261028.json",
+            "deployment/linux/native-technician-interface-evidence.json",
+            "deployment/linux/native-unattended-consent-evidence.json",
+            "deployment/linux/pre-153-company-backup-restore-evidence.json",
+            "deployment/linux/shipping-agent-cached-policy-negative-evidence.json",
+            "deployment/linux/technician-authorization-evidence.json",
+            "deployment/linux/test_backup_memory.py",
+            "deployment/linux/test_build_context.py",
+            "deployment/linux/test_container_stack.py",
+            "deployment/linux/test_container_startup.py",
+            "deployment/linux/test_pinned_images.py",
+            "deployment/transport-source.json",
+            "deployment/web/test-company-setup.js",
+            "deployment/web/test-installation-status.js",
+            "deployment/windows/07bb8d0-reproduction-and-lab-distribution.json",
+            "deployment/windows/07bb8d0-server2016-clean-customer-and-enrollment.json",
+            "deployment/windows/07bb8d0-win11-customer-upgrade-pause-and-reboot.json",
+            "deployment/windows/07bb8d0-win11-standard-technician-install-repair-and-mfa.json",
+            "deployment/windows/7407fa1-publisher-timeout-ci-evidence.json",
+            "deployment/windows/7bfce49-lab-distribution-and-technician-startup.json",
+            "deployment/windows/7bfce49-native-independent-comparison.json",
+            "deployment/windows/7bfce49-win10-automatic-recovery-and-native-revocation.json",
+            "deployment/windows/7bfce49-win10-unattended-signin-and-revocation.json",
+            "deployment/windows/9ba592c-company-bundles-evidence.json",
+            "deployment/windows/9ba592c-lab-signed-msi-evidence.json",
+            "deployment/windows/9ba592c-native-independent-comparison.json",
+            "deployment/windows/9ba592c-native-source-evidence.json",
+            "deployment/windows/9ba592c-native-startup-ci-evidence.json",
+            "deployment/windows/9ba592c-technician-startup-failure.json",
+            "deployment/windows/Build-CustomerMsi.ps1",
+            "deployment/windows/Build-ServerSetup.ps1",
+            "deployment/windows/Build-TechnicianMsi.ps1",
+            "deployment/windows/COMPANY-SIGNING.md",
+            "deployment/windows/CUSTOMER-MSI.md",
+            "deployment/windows/Cancel-CustomerExeRecovery.ps1",
+            "deployment/windows/Commit-Uninstall.ps1",
+            "deployment/windows/Copy-ReproducibleMsiInput.ps1",
+            "deployment/windows/Expand-ServerCompiler.ps1",
+            "deployment/windows/Expand-ServerReferences.ps1",
+            "deployment/windows/Expand-WixBuildTools.ps1",
+            "deployment/windows/Get-MsiIdentity.ps1",
+            "deployment/windows/Get-MsiInstallMode.ps1",
+            "deployment/windows/Get-MsiProductCode.ps1",
+            "deployment/windows/Get-PinnedArchive.ps1",
+            "deployment/windows/Get-ServerRemovalPlan.ps1",
+            "deployment/windows/Get-WindowsCompatibility.ps1",
+            "deployment/windows/Install-Company.ps1",
+            "deployment/windows/Install-Server.ps1",
+            "deployment/windows/Install-SwanRemoteSupport.cmd",
+            "deployment/windows/Install-Worker.ps1",
+            "deployment/windows/LOCAL-TESTING.md",
+            "deployment/windows/Migrate-WorkerCredential.ps1",
+            "deployment/windows/New-LocalTestVm.ps1",
+            "deployment/windows/New-TestVm.ps1",
+            "deployment/windows/Open-Technician.ps1",
+            "deployment/windows/Prepare-CustomerDirectory.ps1",
+            "deployment/windows/Prepare-ServerComponents.ps1",
+            "deployment/windows/Read-WorkerConfiguration.ps1",
+            "deployment/windows/Record-MsvcToolchain.ps1",
+            "deployment/windows/Remove-Configuration.ps1",
+            "deployment/windows/Restart-Configuration.ps1",
+            "deployment/windows/Restore-Configuration.ps1",
+            "deployment/windows/Restore-CustomerExe.ps1",
+            "deployment/windows/Restore-ReleaseMsi.ps1",
+            "deployment/windows/SERVER-COMPONENTS.md",
+            "deployment/windows/ServerSetupLauncher.cs",
+            "deployment/windows/Set-ReproducibleMsiMetadata.ps1",
+            "deployment/windows/Setup-Server.ps1",
+            "deployment/windows/Sign-CompanyArtifact.ps1",
+            "deployment/windows/Start-LocalTest.ps1",
+            "deployment/windows/Start-TestVm.ps1",
+            "deployment/windows/TECHNICIAN-MSI.md",
+            "deployment/windows/Test-DisposableMsi.ps1",
+            "deployment/windows/UPDATE-RECOVERY.md",
+            "deployment/windows/Uninstall-Server.ps1",
+            "deployment/windows/Uninstall-Technician.ps1",
+            "deployment/windows/Uninstall-Worker.ps1",
+            "deployment/windows/Update-RecoveryTask.ps1",
+            "deployment/windows/Update-UninstallCancellation.ps1",
+            "deployment/windows/VM-TESTING.md",
+            "deployment/windows/Verify-MsiRegistration.ps1",
+            "deployment/windows/Verify-Package.ps1",
+            "deployment/windows/WORKER.md",
+            "deployment/windows/a1d67be-native-build-evidence.json",
+            "deployment/windows/a1d67be-native-independent-comparison.json",
+            "deployment/windows/a6670d6-lab-upgrade-cache-reboot-and-technician.json",
+            "deployment/windows/a6670d6-native-independent-comparison.json",
+            "deployment/windows/a6670d6-server2022-recoverable-cold-boot.json",
+            "deployment/windows/a6670d6-server2022-reinstall-and-standard-user-findings.json",
+            "deployment/windows/a6670d6-win10-recoverable-cold-boot.json",
+            "deployment/windows/archive-build-source.py",
+            "deployment/windows/compare-native-builds.py",
+            "deployment/windows/cpp-path-probe-0fd6519-observations.json",
+            "deployment/windows/cpp-path-probe-d93b067-observations.json",
+            "deployment/windows/cpp-toolchain-ordinal-validation.json",
+            "deployment/windows/d74a631-native-build-evidence.json",
+            "deployment/windows/da0c621-lab-distribution-evidence.json",
+            "deployment/windows/da0c621-linux-company-two-machine-session-evidence.json",
+            "deployment/windows/da0c621-server19-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-fresh-msi-evidence.json",
+            "deployment/windows/da0c621-server22-standard-batch-failure.json",
+            "deployment/windows/da0c621-server25-company-technician-evidence.json",
+            "deployment/windows/da0c621-server25-customer-msi-evidence.json",
+            "deployment/windows/da0c621-server25-technician-msi-evidence.json",
+            "deployment/windows/da0c621-win10-bounded-evidence.json",
+            "deployment/windows/da0c621-win10-company-customer-evidence.json",
+            "deployment/windows/da0c621-win10-fresh-technician-msi-evidence.json",
+            "deployment/windows/e95010e-first-build-and-source-verification.json",
+            "deployment/windows/e95010e-lab-distribution-and-technician-upgrade.json",
+            "deployment/windows/e95010e-server2022-upgrade-and-standard-user-pause.json",
+            "deployment/windows/e95010e-win11-fresh-customer-and-technician-trust-findings.json",
+            "deployment/windows/engine-05d5369-reproducibility.json",
+            "deployment/windows/generate-customer-msi.py",
+            "deployment/windows/generate-payload-manifest.py",
+            "deployment/windows/install-pinned-flutter.ps1",
+            "deployment/windows/lab-restart-and-paused-updates-20261027.json",
+            "deployment/windows/local-https.js",
+            "deployment/windows/local-test.env.example",
+            "deployment/windows/msi/Technician.wxs",
+            "deployment/windows/native-49ced68-rebuild-comparison.json",
+            "deployment/windows/native-4c5accb-rebuild-comparison.json",
+            "deployment/windows/native-699c9e0-rebuild-comparison.json",
+            "deployment/windows/native-9e4ea6d-rebuild-comparison.json",
+            "deployment/windows/native-d8fad20-rebuild-comparison.json",
+            "deployment/windows/native-da0c621-rebuild-comparison.json",
+            "deployment/windows/native-e9d89ca-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-rebuild-comparison.json",
+            "deployment/windows/native-f84ffb0-toolchain-observations.json",
+            "deployment/windows/select-engine-candidate.py",
+            "deployment/windows/server-compiler.json",
+            "deployment/windows/server-components.json",
+            "deployment/windows/server-references.json",
+            "deployment/windows/server19-company-peer-https-evidence.json",
+            "deployment/windows/test-company-lifecycle.js",
+            "deployment/windows/test-native-profile-time.py",
+            "deployment/windows/test-profile-rotation.js",
+            "deployment/windows/test-server-restore.js",
+            "deployment/windows/test-update-download.js",
+            "deployment/windows/test_build_source.py",
+            "deployment/windows/test_company_setup_entrypoint.ps1",
+            "deployment/windows/test_company_watch_recovery.ps1",
+            "deployment/windows/test_customer_directory.ps1",
+            "deployment/windows/test_customer_msi.py",
+            "deployment/windows/test_customer_service_startup.ps1",
+            "deployment/windows/test_engine_candidate.py",
+            "deployment/windows/test_flutter_engine_source.py",
+            "deployment/windows/test_msi_install_mode.ps1",
+            "deployment/windows/test_msi_metadata.ps1",
+            "deployment/windows/test_msi_service_guard.ps1",
+            "deployment/windows/test_msi_staging.ps1",
+            "deployment/windows/test_native_build_comparison.py",
+            "deployment/windows/test_payload_manifest.py",
+            "deployment/windows/test_pinned_archive.ps1",
+            "deployment/windows/test_pinned_flutter_sdk.py",
+            "deployment/windows/test_reproducible_pe.py",
+            "deployment/windows/test_server_directory.ps1",
+            "deployment/windows/test_server_removal_plan.ps1",
+            "deployment/windows/test_server_setup_reproducibility.ps1",
+            "deployment/windows/test_service_imports.py",
+            "deployment/windows/test_technician_launcher.ps1",
+            "deployment/windows/test_technician_msi_lifecycle.ps1",
+            "deployment/windows/test_uninstall_commit.ps1",
+            "deployment/windows/test_update_download.ps1",
+            "deployment/windows/test_update_recovery_task.ps1",
+            "deployment/windows/test_worker_configuration.ps1",
+            "deployment/windows/verify-reproducible-pe.py",
+            "deployment/windows/verify-service-imports.py",
+            "deployment/windows/win10-lab-account-repair-evidence.json",
+            "deployment/windows/win10-standard-desktop-bounded-failure.json",
+            "product/Cargo.lock",
+            "product/Cargo.toml",
+            "product/README.md",
+            "product/agent/Cargo.toml",
+            "product/agent/src/lib.rs",
+            "product/agent/src/main.rs",
+            "product/agent/src/payload.rs",
+            "product/agent/src/reporting.rs",
+            "product/agent/src/technician.rs",
+            "product/agent/src/update.rs",
+            "product/agent/src/verifier_process.rs",
+            "product/management/Cargo.toml",
+            "product/management/src/backup.rs",
+            "product/management/src/backup_stream.rs",
+            "product/management/src/components.rs",
+            "product/management/src/installation_reporting.rs",
+            "product/management/src/main.rs",
+            "product/management/src/network.rs",
+            "product/management/src/schema.sql",
+            "product/management/src/service.rs",
+            "product/management/src/tests.rs",
+            "product/management/src/windows.rs",
+            "product/management/web/app.js",
+            "product/management/web/index.html",
+            "product/management/web/style.css",
+            "product/protocol/Cargo.toml",
+            "product/protocol/src/installation.rs",
+            "product/protocol/src/lib.rs",
+            "product/worker/Cargo.toml",
+            "product/worker/src/configuration.rs",
+            "product/worker/src/main.rs",
+            "product/worker/src/windows.rs"
+          ],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-pc-windows-msvc\nrelease: 1.90.0\nLLVM version: 20.1.8\n"
+        }
+      ],
+      "binaries": {
+        "swan-management.exe": {
+          "sha256": "9083637461af52e561e7b9260edeee430aae72fdac54eef989f50fc9d6e2c76f",
+          "bytes": 9113088,
+          "original_bytes_identical": true
+        },
+        "swan-agent.exe": {
+          "sha256": "9706c97188ffdf878dabfb57e7853c4292caff7c318c9011ce6431220daf7b8c",
+          "bytes": 5756416,
+          "original_bytes_identical": true
+        },
+        "swan-worker.exe": {
+          "sha256": "5dbf2a0f2048c9831212cc4a0e8b3a6b454330a1035c1aec5ab011103136cde7",
+          "bytes": 4900352,
+          "original_bytes_identical": true
+        }
+      }
+    },
+    "ubuntu-24.04": {
+      "builds": [
+        {
+          "run": 40865719332,
+          "artifact": 12894152753,
+          "archive_sha256": "2e15f9fa54408cdfa25486875331f94c7be59faf13aba50356e1da8379d0920d",
+          "public_source_files_verified": 242,
+          "checkout_text_conversions": [],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n"
+        },
+        {
+          "run": 40925349725,
+          "artifact": 12920323981,
+          "archive_sha256": "14645ae43366e44a0d5ecfa3acb3faa94e05bc4ef5584e9e822359e63b38a1b3",
+          "public_source_files_verified": 242,
+          "checkout_text_conversions": [],
+          "rustc": "rustc 1.90.0 (1159e78c4 2025-09-14)\nbinary: rustc\ncommit-hash: 1159e78c4747b02ef996e55082b704c09b970588\ncommit-date: 2025-09-14\nhost: x86_64-unknown-linux-gnu\nrelease: 1.90.0\nLLVM version: 20.1.8\n"
+        }
+      ],
+      "binaries": {
+        "swan-management": {
+          "sha256": "bc0b6ab7c30935de92b53db0ccc1d6126404ea2d013b3a2a4d1a36234f27ad3c",
+          "bytes": 10830648,
+          "original_bytes_identical": true
+        },
+        "swan-agent": {
+          "sha256": "f25446584efd95075a512481d6a68c47edf18e1c828fd3f862b05389e42c41f6",
+          "bytes": 6262616,
+          "original_bytes_identical": true
+        },
+        "swan-worker": {
+          "sha256": "32d5ef7d7d60883d5ae40a7d4d0ff0a93f07c1d79dfdc1a54bbd3e20d0fe1836",
+          "bytes": 5768032,
+          "original_bytes_identical": true
+        }
+      }
+    }
+  },
+  "binary_normalization": false,
+  "downloaded_executables_run_for_comparison": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json b/docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json
new file mode 100644
index 00000000000..42a09e68b31
--- /dev/null
+++ b/docs/evidence/9fa5e8a-windows-full-backup-running-restore-rollback.json
@@ -0,0 +1,103 @@
+{
+  "schema": 1,
+  "date": "2026-10-29",
+  "backup_restore_cli_source": "9fa5e8aa6a846ce015362de8082da5c938d79ff8",
+  "installed_management_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "installed_worker_source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "platform": "Windows Server 2016 Standard Evaluation x64 build 14393, Desktop Experience",
+  "build_verification": {
+    "company_components_run": 40865719332,
+    "linux_deployment_passed": true,
+    "maintained_windows_transport_build_passed": true,
+    "linux_and_windows_component_checks_passed": true,
+    "windows_large_incompressible_backup_recovery_passed": true,
+    "windows_artifact": 12894028915,
+    "archive_bytes": 9175409,
+    "archive_sha256": "b17c2ad5ee564bca6055a66ee20e7be2b36c0edf8f81f4c0e8578f648037b33a",
+    "all_242_bundled_public_source_files_verified_against_git": true,
+    "three_unsigned_x64_executables_verified_against_manifest": true,
+    "independent_binary_reproduction_for_this_commit": false
+  },
+  "lab_signing": {
+    "timestamped_signatures_and_exact_input_hashes_verified": true,
+    "existing_guest_nonexportable_key_used": true,
+    "private_key_exported": false,
+    "existing_signer_endpoint_identity_consent_and_service_preserved": true,
+    "signer_normally_shut_down_after_collection": true,
+    "production_signing_approval": false
+  },
+  "encrypted_export": {
+    "format": "SWANBK2",
+    "bytes": 128715687,
+    "sha256": "3c9f99b7e7cb5a188807123724d920f62af9cbc61eb646180bef180dcc8670fb",
+    "separate_signed_cli_used_without_replacing_installed_service": true,
+    "company_and_worker_temporarily_stopped_and_resumed": true,
+    "management_database_and_signing_setup_keys": true,
+    "windows_installation_receipt": true,
+    "transport_private_and_public_keys": true,
+    "transport_database_present": false,
+    "complete_https_storage_and_caddy_recipe": true,
+    "service_environment": true,
+    "completed_installer_artifacts": 4,
+    "ciphertext_collected_once_and_hash_verified": true,
+    "separate_private_passphrase_outside_git": true,
+    "earlier_backup_preserved": true
+  },
+  "isolated_restore": {
+    "actual_signed_windows_cli": true,
+    "wrong_password_rejected_without_target": true,
+    "modified_ciphertext_rejected_without_target": true,
+    "private_plaintext_staging_cleaned": true,
+    "management_and_transport_key_hashes_match": true,
+    "installation_receipt_hash_matches": true,
+    "https_files_restored": 13,
+    "https_key_and_certificate_files_hash_verified": 8,
+    "four_installer_hashes_match": true,
+    "restored_keys_have_private_windows_permissions": true,
+    "original_service_pids_and_worker_credential_unchanged_during_isolated_restore": true
+  },
+  "running_restore": {
+    "replacement_built_only_from_authenticated_restored_data": true,
+    "receipt_validated_against_existing_service_paths_and_owned_firewall_rules": true,
+    "restored_deployment_environment_matches_existing_service": true,
+    "transport_and_https_extras_mapped_to_owned_service_directories": true,
+    "normal_service_stops_and_same_parent_directory_moves": true,
+    "original_data_directory_retained": true,
+    "restored_data_started_at_canonical_path": true,
+    "installed_service_binary_and_worker_credential_unchanged": true,
+    "verified_https_and_mfa_login": true,
+    "profile_signature_trust_keys_release_approvals_and_worker_revocation_preserved": true,
+    "revoked_worker_rejected_401": true,
+    "all_four_existing_download_links_and_payload_hashes_verified": true,
+    "customer_downloads_public": true,
+    "technician_download_requires_authentication": true,
+    "anonymous_technician_download_rejected_401": true
+  },
+  "rollback": {
+    "normal_guarded_switch_back_to_preserved_original_directory": true,
+    "successfully_recovered_running_copy_retained": true,
+    "no_data_deleted": true,
+    "company_and_worker_running_automatic": true,
+    "verified_https_mfa_profile_trust_approvals_and_revocation_again": true,
+    "all_four_download_payload_hashes_and_technician_access_checks_passed_again": true,
+    "original_directory_is_current_canonical_data": true
+  },
+  "harness_corrections": {
+    "preparation_stopped_before_mutation_on_environment_json_shape_difference": true,
+    "read_only_comparison_proved_all_five_environment_values_identical": true,
+    "comparison_corrected_to_exact_case_sensitive_array_values_and_count": true,
+    "successful_preparation_multiline_json_collected_without_repeating_preparation": true
+  },
+  "scope_limits": {
+    "same_owned_windows_vm_and_existing_service_layout": true,
+    "new_machine_restore_with_different_paths_not_tested": true,
+    "transport_database_absence_is_not_database_restore_evidence": true,
+    "enrolled_devices_and_remote_sessions_in_this_company": 0,
+    "windows_maintained_transport_not_installed_by_this_test": true,
+    "active_transport_is_still_stock": true,
+    "public_internet_transport_qualification_pending": true,
+    "all_supported_windows_versions_qualification_pending": true,
+    "production_publication": false,
+    "full_product_acceptance_complete": false
+  }
+}
diff --git a/docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json b/docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json
new file mode 100644
index 00000000000..93798035ef2
--- /dev/null
+++ b/docs/evidence/9fa5e8a-windows-maintained-stack-upgrade.json
@@ -0,0 +1,72 @@
+{
+  "schema": 1,
+  "date": "2026-10-29",
+  "management_source": "9fa5e8aa6a846ce015362de8082da5c938d79ff8",
+  "previous_management_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "worker_source_unchanged": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+  "os": "Windows Server 2016 Standard Evaluation x64 build 14393, Desktop Experience",
+  "inputs": {
+    "management_lab_signature_timestamp_and_hash_verified": true,
+    "hbbs_sha256": "2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be",
+    "hbbr_sha256": "97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0",
+    "caddy_sha256": "586d4a4cd74bdfd2951b6b81766a32904ffa69c4f1c3d521da3870a2120f1d31",
+    "all_140_transport_source_files_verified": true,
+    "source_tree_sha256": "c0d40c3b122dfe740fbea5946f3bba9fb67734b57e80c8b7fb4ee3cdcef85541",
+    "complete_corresponding_source_and_license_notices_installed": true,
+    "component_binaries_not_resigned_or_modified": true
+  },
+  "upgrade": {
+    "tested_encrypted_backup_and_prior_running_restore_retained": true,
+    "zero_active_builds_devices_or_sessions_before_switch": true,
+    "management_and_transport_replaced_together": true,
+    "normal_owned_service_stops_and_guarded_directory_moves": true,
+    "all_nine_installed_files_verified_by_hash": true,
+    "three_expected_component_processes_and_udp_listener_verified": true,
+    "company_and_worker_running_automatic": true,
+    "company_identity_transport_trust_worker_credential_and_ownership_receipt_preserved": true,
+    "existing_database_schema": 3,
+    "database_schema_migration_performed": false,
+    "original_installation_and_transport_state_retained": true
+  },
+  "external_management_checks": {
+    "verified_https_and_mfa_login": true,
+    "signed_profile_approvals_and_worker_revocations_unchanged": true,
+    "revoked_worker_rejected_401": true,
+    "all_four_existing_download_links_and_original_payload_hashes_verified": true,
+    "customer_downloads_public": true,
+    "technician_download_authenticated": true,
+    "anonymous_technician_download_rejected_401": true
+  },
+  "transport_registration": {
+    "actual_service_owned_maintained_hbbs": true,
+    "wsl_host_forwarded_ipv4_registration_reply": "3a021001",
+    "guest_ipv4_registration_reply": "3a021001",
+    "guest_ipv6_registration_reply": "3a021001",
+    "no_10014_or_wsaefault_in_maintained_test_log": true,
+    "original_private_and_public_transport_keys_preserved": true,
+    "windows_host_loopback_udp_attempt_failed_10054": true,
+    "wsl_direct_probe_used_instead_of_claiming_windows_udp_forwarding": true,
+    "wsl_probe_compiled_in_cached_isolated_container_without_host_cargo_or_network_dependency_downloads": true
+  },
+  "rollback_and_rollforward": {
+    "original_stock_installation_and_original_transport_state_restored_normally": true,
+    "rollback_verified_https_mfa_trust_approvals_and_revoked_worker_rejection": true,
+    "maintained_installation_and_its_transport_state_restored_normally_again": true,
+    "rollforward_verified_https_mfa_trust_approvals_and_revoked_worker_rejection": true,
+    "both_installations_and_transport_states_preserved": true,
+    "worker_identity_unchanged": true,
+    "no_data_deleted": true,
+    "final_active_stack": "Maintained transport with management 9fa5e8a"
+  },
+  "limits": {
+    "lab_signing_only": true,
+    "native_desktop_session_through_windows_relay_pending": false,
+    "post_upgrade_windows_reboot_test_pending": false,
+    "fresh_full_maintained_windows_setup_installer_runtime_pending": true,
+    "public_internet_connectivity_pending": true,
+    "database_migration_rollback_not_established_by_same_schema_binary_switch": true,
+    "six_windows_versions_not_qualified_by_this_server_test": true,
+    "production_publication": false,
+    "full_product_acceptance_complete": false
+  }
+}
diff --git a/docs/evidence/a96cd4c-installation-reporting-component-checks.json b/docs/evidence/a96cd4c-installation-reporting-component-checks.json
new file mode 100644
index 00000000000..a43823ee761
--- /dev/null
+++ b/docs/evidence/a96cd4c-installation-reporting-component-checks.json
@@ -0,0 +1,32 @@
+{
+  "source": "a96cd4c4d8bf7cdc1d9b03c5457c2a57862fb2a2",
+  "jobs": [
+    {
+      "job_id": 123183023333,
+      "tests": {
+        "reports_reject_unbounded_or_conflicting_status_and_active_content": true,
+        "reports_are_owned_permission_filtered_and_never_authorize_sessions": true,
+        "schema_two_upgrade_requires_backup_and_restores_original_schema_and_keys": true,
+        "failed_schema_upgrade_rolls_back_all_ddl": true
+      },
+      "browser_status_contract": true
+    },
+    {
+      "job_id": 123183023315,
+      "tests": {
+        "reports_reject_unbounded_or_conflicting_status_and_active_content": true,
+        "reports_are_owned_permission_filtered_and_never_authorize_sessions": true,
+        "schema_two_upgrade_requires_backup_and_restores_original_schema_and_keys": true,
+        "failed_schema_upgrade_rolls_back_all_ddl": true
+      },
+      "browser_status_contract": true
+    }
+  ],
+  "push_run": 40793147431,
+  "pull_request_run": 40793153438,
+  "all_six_windows_linux_deployment_jobs_passed": true,
+  "customer_and_technician_senders_connected": false,
+  "live_company_migrated_to_schema3": false,
+  "actual_client_reporting_or_automatic_rollout_qualified": false,
+  "production_publication": false
+}
diff --git a/docs/evidence/aff8ff6-native159-source-verification.json b/docs/evidence/aff8ff6-native159-source-verification.json
new file mode 100644
index 00000000000..026966d33e3
--- /dev/null
+++ b/docs/evidence/aff8ff6-native159-source-verification.json
@@ -0,0 +1,32 @@
+{
+  "source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "workflow_run": 40828471470,
+  "artifact": 12880851423,
+  "artifact_digest": "sha256:fc7e6f085fb46a16fc8f9e574db7a3b0ab8741f3d4416cfb15c256d7444d1795",
+  "public_tracked_source_files_verified": 1254,
+  "generated_bridge_files_verified": 6,
+  "source_date_epoch": 1793253592,
+  "all_manifest_hashes_match": true,
+  "pinned_sdk_and_engine_verified": true,
+  "required_job_steps": {
+    "Reject paused support and authorization reuse after resume": "success",
+    "Reject authorization retries and inherited audit destinations": "success",
+    "Reject cross-target and stale-login file-transfer handles": "success",
+    "Verify hardened DLL search supports delayed application libraries": "success",
+    "Build branded client": "success",
+    "Reject incoming capture helpers in the technician edition": "success",
+    "Verify service launcher defers desktop DLL loading": "success",
+    "Verify customer MSI starts a headless native service": "success",
+    "Reject unsigned legacy management policy in managed editions": "success",
+    "Reject upstream updater entry points in managed editions": "success",
+    "Reject system-control packets from view-only managed sessions": "success",
+    "Build unsigned customer and technician MSIs with pinned WiX": "success",
+    "Verify unsigned technician MSI installation repair and uninstall": "success",
+    "Build unsigned company server setup with pinned components": "success"
+  },
+  "executables_run_during_verification": false,
+  "independent_rebuild_of_this_version_completed": false,
+  "runtime_upgrade_of_this_version_completed": false,
+  "worker_contains_legacy_registry_installer_do_not_deploy": true,
+  "production_publication": false
+}
diff --git a/docs/evidence/aff8ff6-windows-full-deployment-export.json b/docs/evidence/aff8ff6-windows-full-deployment-export.json
new file mode 100644
index 00000000000..13cf5285fca
--- /dev/null
+++ b/docs/evidence/aff8ff6-windows-full-deployment-export.json
@@ -0,0 +1,43 @@
+{
+  "export": {
+    "passphrase_outside_company_data_and_backup": true,
+    "backup_bytes": 95990779,
+    "format": "SWANBK2",
+    "restore_not_yet_tested": true,
+    "passphrase_only_in_child_process_environment": true,
+    "deployment_environment_included": true,
+    "utc": "2026-10-29T10:30:16.1563202Z",
+    "production_publication": false,
+    "management_database_configuration_and_keys_included": true,
+    "complete_https_storage_included": true,
+    "company_and_worker_services_resumed": true,
+    "backup_sha256": "fe8f2b3aa8e75f4c0ccb6fbaf6b1e2ddc2cc90a7075c304fb33ae2c86a7f27a1",
+    "management_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+    "installer_artifacts": 3,
+    "transport_identity_included": true,
+    "transport_database_present_at_export": false,
+    "windows_installation_receipt_included": false
+  },
+  "encrypted_file_collection": {
+    "utc": "2026-10-29T10:30:20.055191+00:00",
+    "sha256": "fe8f2b3aa8e75f4c0ccb6fbaf6b1e2ddc2cc90a7075c304fb33ae2c86a7f27a1",
+    "bytes": 95990779,
+    "passphrase_stored_separately": true,
+    "plaintext_company_keys_not_exported": true,
+    "restore_not_yet_tested": true
+  },
+  "resumed_service_and_trust_checks": {
+    "utc": "2026-10-29T10:44:27.647979+00:00",
+    "https_original_ca_and_signed_profile_verified": true,
+    "administrator_mfa_valid_after_export": true,
+    "three_completed_build_hashes_retained": true,
+    "release_approvals_and_worker_revocations_unchanged": true,
+    "worker_authentication_valid": true,
+    "automatic_updates_still_paused": true,
+    "restore_not_yet_tested": true,
+    "production_publication": false
+  },
+  "scope": "Encrypted deployment data export and resumed original services. Isolated restore exposed omission of Windows installation.json; updated export/reader and complete running-stack restore qualification are pending.",
+  "production_publication": false,
+  "evidence_correction": "The transport store had only its key pair and no database; no transport database was expected or restored. Original raw lab records retained privately."
+}
diff --git a/docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json b/docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json
new file mode 100644
index 00000000000..27ec2bdeca7
--- /dev/null
+++ b/docs/evidence/aff8ff6-windows-isolated-restore-and-receipt-gap.json
@@ -0,0 +1,33 @@
+{
+  "no_restored_server_started": true,
+  "full_running_deployment_restore_pending": true,
+  "production_publication": false,
+  "https_files_restored": 13,
+  "management_database_restored": true,
+  "os_build": 14393,
+  "https_key_and_certificate_files_match": 8,
+  "installer_artifacts_restored": 3,
+  "canonical_company_data_not_replaced": true,
+  "changed_ciphertext_rejected_without_target": true,
+  "wrong_password_rejected_without_target": true,
+  "utc": "2026-10-29T11:20:05.2522537Z",
+  "original_services_not_restarted": true,
+  "management_signing_setup_keys_and_https_recipe_match": true,
+  "original_optional_database_check_corrected_without_repeating_restore": true,
+  "transport_database_recovered_if_present": true,
+  "management_source": "aff8ff61e3fbd6f34c4cf0bb9de6e330ec6e0521",
+  "restored_keys_private": true,
+  "transport_database_present": false,
+  "transport_private_and_public_keys_match": true,
+  "actual_msvc_restore_cli": true,
+  "service_environment_matches": true,
+  "windows_installation_receipt_missing": true,
+  "worker_credential_unchanged": true,
+  "private_staging_cleaned": true,
+  "scope": "Actual MSVC CLI wrong-password/tamper rejection and isolated payload recovery; no restored server was started and no canonical live data replaced.",
+  "harness_notes": [
+    "An initial post-check incorrectly required an optional transport database although none had been created.",
+    "A read-only continuation initially referenced an undefined input path; corrected without repeating restore."
+  ],
+  "receipt_fix_status": "Source fix and local backup tests passed; updated Windows binary/runtime re-export and running-stack restore pending."
+}
diff --git a/docs/evidence/company-network-probe-development-20261105.json b/docs/evidence/company-network-probe-development-20261105.json
new file mode 100644
index 00000000000..8939aefd880
--- /dev/null
+++ b/docs/evidence/company-network-probe-development-20261105.json
@@ -0,0 +1,56 @@
+{
+  "schema": 1,
+  "date": "2026-11-05",
+  "scope": "Development Linux management network checker; not production or external NAT qualification",
+  "base_commit": "4dd3c1f2bd6925f78b4439e966e96dbaae73a78d",
+  "source_files_sha256": {
+    "product/Cargo.lock": "64ff396bc3d0628aafa7649ac10e56d7a73386caa8dcb8ca9caf7b2ee0b8652e",
+    "product/management/Cargo.toml": "96ef5a7eef51ed266f37d8ca1c0a41cdd834409c51385802d54a873fc0521773",
+    "product/management/src/main.rs": "9d00e35b48f952961a7a198d22ba8000c71b6fa15fa543ae4805b81959306d86",
+    "product/management/src/network.rs": "9bd4a0ed73d10d0e09baeda2c91121447558c7c14d425606ca56b88fea7cfa10",
+    "product/management/src/network_probe.rs": "56910321aa9befef5f7dd82174982087b7c9441e81285f867a42a235b021db66",
+    "product/management/src/service.rs": "4b12212c991fa7dbc13e6c0c54e0d2602de8dc45ae674d6da0be086d6d23e151",
+    "product/management/src/tests.rs": "3e0894f2a7800f1b64c53efd7d34e9178cc3188674f4e3b8bb7eaa525e261635",
+    "product/management/web/app.js": "464a8308e7e6046cfb3fd4797e04bf989859894dc2952122619d1b2afd756338",
+    "docs/NETWORK-CHECK.md": "c038f7848b9bdb726bac4c528beaa118d804fbecc2e7b41b15322301b7f1b5d7"
+  },
+  "build": {
+    "rust": "1.90.0",
+    "offline_locked": true,
+    "production_builder": false,
+    "network_and_cli_tests_passed": 4,
+    "real_management_router_authorization_tests_passed": 1,
+    "management_binary_built": true,
+    "initial_failures": [
+      "New role test expected 403 but existing administrator-only routes deliberately return 401; assertion corrected without changing permissions.",
+      "TCP-only TestNatRequest was incorrectly used over UDP; live test rejected it. Replaced with pinned stateless empty-ID rejection, before peer lookup or mutation."
+    ]
+  },
+  "live_existing_company": {
+    "https_hostname_and_ca_validated": true,
+    "pinned_company_profile_signature_validated": true,
+    "tcp_endpoints_passed": 4,
+    "native_udp_stateless_rejection_passed": true,
+    "ordinary_uid": 10001,
+    "container_read_only": true,
+    "data_directory": "Unwritable sentinel; no company Store opened",
+    "wrong_profile_key_rejected": true,
+    "untrusted_company_ca_rejected": true,
+    "insecure_option_rejected": true,
+    "private_path_rejected_for_outside_network": true,
+    "help_without_server_start_passed": true
+  },
+  "other_checks": [
+    "JavaScript syntax",
+    "Company setup/editor contracts",
+    "Installation status UI tests",
+    "git diff --check"
+  ],
+  "limits": [
+    "No new VM, company deployment, enrollment, transport patch or native build.",
+    "Administrator download route covered by real router tests; new browser flow not yet accepted live.",
+    "Windows execution, canonical component builds/reproduction and coordinated deployment remain untested for this change.",
+    "Outside-vantage flag is operator declaration; no independent attestation or external direct/relay qualification.",
+    "UDP reply is unauthenticated connectivity diagnostic, not proof of trust or NAT traversal."
+  ]
+}
diff --git a/docs/evidence/e47f614-compiled-sender-https.json b/docs/evidence/e47f614-compiled-sender-https.json
new file mode 100644
index 00000000000..5c48b6d3cb3
--- /dev/null
+++ b/docs/evidence/e47f614-compiled-sender-https.json
@@ -0,0 +1,24 @@
+{
+  "date": "2026-10-29",
+  "source": "e47f6141a6a4d6b28891face236f8266c09c975a",
+  "scope": "Compiled Linux debug agents and management, isolated fresh schema3 company, verified TLS with a dedicated fixture CA",
+  "passed": [
+    "32 Linux agent tests; four reporting tests passed again after nonblocking cache-lock refinement",
+    "Persistent customer device identity and technician installation UUID across separate processes",
+    "Monotonic revisions, concurrent reporters and stale asynchronous conflict recovery",
+    "Pending device cannot publish a report; approved device can",
+    "Older report rejected over HTTPS",
+    "Technician MFA sign-in and inventory refresh send authenticated reports",
+    "Unassigned technician sees only its own installation report",
+    "Logout and device revocation reject further access and report updates",
+    "No host trust-store changes; fixture services stopped and original company remains healthy"
+  ],
+  "limits": [
+    "Debug agents with explicit test CA, not installed or shipping Windows endpoint applications",
+    "No recorded installation in this fixture: sequence zero and no installed version",
+    "Linux endpoint updater intentionally returns unsupported-platform failure; this proves reporting, not Windows updates",
+    "Native installation phases, signed upgrades, six Windows families and production signing remain open",
+    "e47f614 Linux deployment CI caught missing reporting.rs in explicit Docker context allowlists; corrected separately"
+  ],
+  "production_qualified": false
+}
diff --git a/docs/evidence/e47f614-schema3-upgrade-and-rollback.json b/docs/evidence/e47f614-schema3-upgrade-and-rollback.json
new file mode 100644
index 00000000000..237074373d6
--- /dev/null
+++ b/docs/evidence/e47f614-schema3-upgrade-and-rollback.json
@@ -0,0 +1,25 @@
+{
+  "date": "2026-10-29",
+  "new_management_source": "e47f6141a6a4d6b28891face236f8266c09c975a",
+  "old_management_source": "67b5c69ca62feadf7ecf57d835a79c3d2da19dd2",
+  "scope": "Separate writable copy of a previously restored complete Linux lab company; original company and transport unchanged",
+  "passed": [
+    "Missing private backup passphrase prevents schema2 upgrade; database remains schema2 and no backup is published",
+    "Actual schema2-to3 upgrade creates one encrypted SWANBK2 pre-upgrade archive",
+    "Upgraded schema3 server accepts an authenticated installation report over verified HTTPS",
+    "Old server refuses upgraded schema3 instead of silently downgrading it",
+    "New restorer decrypts the pre-upgrade archive into separate storage with schema2",
+    "Old server serves that restored schema2 through the original HTTPS trust",
+    "Active profile key, branding, policy, five approved devices, disabled unattended consent, group permissions and release approvals match the original company",
+    "Fresh administrator MFA and logout work after rollback",
+    "Post-backup login correctly returns401 after restoration",
+    "All copied services stopped; storage retained; original company remains healthy"
+  ],
+  "test_correction": "An initial assertion incorrectly expected a login created after the pre-upgrade backup to survive restoration. The server rejected it with401. Continuation used fresh MFA and verified the recovered company against the original.",
+  "limits": [
+    "Linux debug migration binary, not a Windows service migration test",
+    "No cloned native transport or endpoint session started",
+    "Backup restoration does not merge post-backup revocations, consent, reports or other changes; reconcile these before exposing a restored deployment"
+  ],
+  "production_qualified": false
+}
diff --git a/docs/evidence/network-probe-windows-der-finding-and-fix-20261105.json b/docs/evidence/network-probe-windows-der-finding-and-fix-20261105.json
new file mode 100644
index 00000000000..48b1e6ce726
--- /dev/null
+++ b/docs/evidence/network-probe-windows-der-finding-and-fix-20261105.json
@@ -0,0 +1,48 @@
+{
+  "date": "2026-11-05",
+  "old_public_source": "4f3cd3ab15b5c210e0f5096dc945882adb4026a3",
+  "old_component_workflow": 41943862252,
+  "old_component_ci": "Linux deployment and both OS component jobs succeeded; standalone Windows certificate-format execution was separate.",
+  "corresponding_source_files_verified_per_component_archive": 259,
+  "old_windows_management_sha256": "6e47bf0ff56e163c03713ce30c8ba73ec7886ecacc141d8cd073902e954fe578",
+  "windows_compiled_finding": {
+    "real_tls_fixture": true,
+    "company_ca_format": "DER exported by Windows",
+    "result": "Rejected valid issuer with UnknownIssuer before transport checks",
+    "test_failed_closed": true,
+    "invalid_trust_accepted": false,
+    "company_server_or_installation_started": false
+  },
+  "root_cause_reference": "https://docs.rs/reqwest/0.12.28/src/reqwest/tls.rs.html",
+  "fix": "Select X.509 DER explicitly; parse PEM bundles and require at least one certificate. No insecure TLS option or machine trust-store modification.",
+  "fixed_source_sha256": {
+    "product/management/src/network_probe.rs": "9cdb4ec94171b4fbcf7007cc331b6036306cdf4c6cbfde680ac0be350b7fd89e",
+    "deployment/windows/test-network-probe.js": "ddf0352ba07590c79b478ea8045a9da7d28717da3b8fb01fcb6ba83d3cf4cb56",
+    "deployment/windows/test_network_probe.ps1": "9d5b4558f6448fdee4f985c814f0e1e19e9adf046c3ef32bef3db74a69f0e699"
+  },
+  "fixed_linux_development_validation": {
+    "network_tests_passed": 4,
+    "real_router_authorization_test_passed": 1,
+    "compiled_development_binary": true,
+    "existing_company_https_and_pinned_profile": true,
+    "der_ca_passed": true,
+    "pem_ca_passed": true,
+    "four_tcp_and_native_stateless_udp_passed": true,
+    "outside_private_path_rejected": true,
+    "wrong_profile_key_untrusted_ca_and_insecure_option_rejected": true,
+    "read_only_unprivileged_probe_and_no_company_state": true
+  },
+  "cancelled_local_canonical_build": {
+    "source": "4f3cd3a",
+    "exit": 130,
+    "reason": "Avoid completing or deploying known CA-format defect after Windows finding",
+    "live_company_unchanged": true
+  },
+  "next_candidate": "1.5.22+90",
+  "limits": [
+    "Corrected compiled Windows execution remains pending; prepared fixture is not a passing result.",
+    "New native packages, automatic upgrades, canonical deployment and independent reproduction remain pending.",
+    "Scripted TLS regression peers do not qualify native support sessions or public NAT/relay operation.",
+    "Final Windows compatibility sweep remains deferred until app completion; no new VM created."
+  ]
+}
diff --git a/docs/evidence/network-probe-windows-port-reservation-control-20261105.json b/docs/evidence/network-probe-windows-port-reservation-control-20261105.json
new file mode 100644
index 00000000000..a54eb3540b7
--- /dev/null
+++ b/docs/evidence/network-probe-windows-port-reservation-control-20261105.json
@@ -0,0 +1,40 @@
+{
+  "date": "2026-11-05",
+  "scope": "Windows regression harness correction, not corrected-candidate acceptance",
+  "prior_fixture_failure": "TCP port reservation succeeded, but Windows denied UDP binding with EACCES for the same port.",
+  "change": "Reserve adjacent TCP NAT/ID ports and matching UDP ID port together; retry at most32 random loopback candidates without changing host firewall or reserved ranges. Close failed reservations.",
+  "old_binary_control": {
+    "passed": true,
+    "old_binary_control": true,
+    "corrected_windows_binary_qualified": false,
+    "known_old_der_failure_expected": true,
+    "checks": [
+      "help",
+      "known-old-der-failure",
+      "trusted-private",
+      "trusted-pem",
+      "private-cannot-qualify-outside",
+      "expired",
+      "future",
+      "zero-revision",
+      "wrong-company",
+      "tampered",
+      "redirect",
+      "wrong-pinned-key",
+      "certificate-hostname-mismatch",
+      "untrusted-ca",
+      "insecure-option-rejected",
+      "malformed-udp"
+    ],
+    "management_sha256": "6e47bf0ff56e163c03713ce30c8ba73ec7886ecacc141d8cd073902e954fe578",
+    "no_company_state_created": true,
+    "no_request_credentials": true,
+    "real_https_and_ed25519": true,
+    "transport_peers": "scripted fixture; not native sessions",
+    "native_or_external_connectivity_qualified": false
+  },
+  "public_script_sha256": "817daecdb967e1abd6163ef387f4f67a6a9d65b0adeef3048aac1687227869ad",
+  "control_adjustment": "Expect the known old DER failure, then use PEM for the remaining cases. Public CI fixture still requires both DER and PEM to succeed.",
+  "corrected_windows_binary_qualified": false,
+  "new_vm_or_installer_or_company_state": false
+}
diff --git a/docs/evidence/update-download-streaming.json b/docs/evidence/update-download-streaming.json
new file mode 100644
index 00000000000..478c6a79f35
--- /dev/null
+++ b/docs/evidence/update-download-streaming.json
@@ -0,0 +1,27 @@
+{
+  "date": "2026-10-29",
+  "scope": "Endpoint update download, staged hash inspection and verified recovery-cache copying",
+  "local_linux_agent_tests": {"passed": 33, "failed": 0, "ignored_https_fixture": 1},
+  "windows_https_workflow": 40825894779,
+  "windows_https_job": 123288805479,
+  "windows_https_source": "6fb0c3c",
+  "windows_https_step_result": "success",
+  "passed": [
+    "Bounded two-chunk channel writes downloads to a private staging file on a blocking worker",
+    "Only explicit completion and the signed expected hash allow atomic publication",
+    "Wrong hash, disconnected producer and size-limit failure retain previous complete download and remove staging",
+    "Staged hash inspection uses a64KiB buffer",
+    "Final local tests also cover copying and hashing recovery files in64KiB chunks, retaining the old target on failure",
+    "Real Windows HTTPS redirects, wrong-hash rejection, truncated response rejection and declared oversize rejection",
+    "Real Windows HTTPS16MiB streamed response matches its hash",
+    "Artifact requests carry no authorization header or cookies",
+    "Temporary TLS identity uses a distinct CA and server leaf; neither is installed as a trusted root"
+  ],
+  "test_fixture_correction": "The first Windows HTTPS fixture failed while using one CA-marked certificate as its server identity. A separate leaf and failure diagnostics were added; the corrected HTTPS step passed. Other jobs in that workflow were still running when recorded.",
+  "limits": [
+    "Final recovery-copy refinement has local Linux test evidence; its Windows CI remains pending",
+    "No native automatic installation or interrupted MSI recovery qualified by these tests",
+    "No production publisher or release approval",
+    "No measured peak-memory qualification for a full native upgrade"
+  ]
+}
diff --git a/docs/evidence/windows-maintained-component-preparation.json b/docs/evidence/windows-maintained-component-preparation.json
new file mode 100644
index 00000000000..cc516986e23
--- /dev/null
+++ b/docs/evidence/windows-maintained-component-preparation.json
@@ -0,0 +1,29 @@
+{
+  "utc": "2026-10-29T10:40:59.573931+00:00",
+  "verifier_public_base_source": "371ce03dc11a410e727ce3f6b6dde50a81f6c7ba",
+  "actual_inputs_from_source_verified_windows_build": 40826572438,
+  "independent_matching_binary_build": 40802355602,
+  "verification": {
+    "maintained_transport": true,
+    "verified_source_files": 140,
+    "source_tree_sha256": "c0d40c3b122dfe740fbea5946f3bba9fb67734b57e80c8b7fb4ee3cdcef85541",
+    "project_revision": "0140beef7b40a0e72af9b30d68421494e32e697d",
+    "sha256": {
+      "hbbs.exe": "2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be",
+      "hbbr.exe": "97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0",
+      "caddy.exe": "586d4a4cd74bdfd2951b6b81766a32904ffa69c4f1c3d521da3870a2120f1d31",
+      "Caddy-LICENSE.txt": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "RustDesk-LICENSE.txt": "8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef",
+      "transport-build-source.zip": "fe39ef7652f13c389e5bf1bf5f5f951ec3746dda6055555dcffe90efcafc20ea",
+      "server-components.json": "3985c7103e9c257e9f6b29be1d433c43f4b31baf8b2b134f647766616d4e04be",
+      "THIRD-PARTY.txt": "e7dd36429f84f0fd07a2134c6998a445b080624807524906fefc6537cda33e84"
+    },
+    "supplier_executables_run": false,
+    "production_publication": false
+  },
+  "actual_stock_hbbs_rejected_before_output": true,
+  "changed_actual_source_rejected_before_output": true,
+  "server_installer_not_built_or_installed_by_this_test": true,
+  "production_publication": false,
+  "immutable_recipe_restored_to_public_revision": "928a53e6ac58cd4387156417f3613a71028f52e5"
+}
diff --git a/docs/evidence/windows-transport-database-storage-finding-20261029.json b/docs/evidence/windows-transport-database-storage-finding-20261029.json
new file mode 100644
index 00000000000..11e48e98d2c
--- /dev/null
+++ b/docs/evidence/windows-transport-database-storage-finding-20261029.json
@@ -0,0 +1,38 @@
+{
+  "utc": "2026-10-29T18:23:53.121224+00:00",
+  "runtime_baseline_source": "9fa5e8aa6a846ce015362de8082da5c938d79ff8",
+  "os": "Windows Server 2016 Desktop Experience build14393",
+  "finding": "Maintained Windows rendezvous default placed its peer database in the RustDesk LocalService profile, outside company transport storage and the earlier full backup input.",
+  "populated_backup_preflight_failed_before_export": true,
+  "encrypted_backup_not_created": true,
+  "company_and_worker_services_running_after_failed_preflight": true,
+  "earlier_absent_transport_db_backup_receipts_do_not_prove_peer_record_recovery": true,
+  "candidate_changes": [
+    "Explicit DB_URL under company transport storage.",
+    "Fail startup and full transport export when a legacy database remains outside company storage and no managed database exists.",
+    "Explicit offline migration with management lock and Windows source writer exclusion.",
+    "Recover stopped database/WAL in private staging, check SQLite integrity, publish without overwriting a destination, preserve original source and keys."
+  ],
+  "implementation_files_sha256": {
+    "product/management/src/components.rs": "c7f016b08b59cb14891f6f442a8b4189f4f0a3c696b7c793b1bef237ebd209be",
+    "product/management/src/main.rs": "f2b45944d8a5a9dbef9c8c7a22b31db651320d3afa3c9d6d26cf2dec517a1723",
+    "product/management/src/backup.rs": "a6c655d84f68500e2bfca9caf32daa2deb7fe8574525e47d63683aae4752e1f7",
+    "product/management/src/backup_stream.rs": "cbcc889e80f9989e91f0fc7086707a6d9d2867de02960933a6885bd8471d76bd"
+  },
+  "linux_regressions": {
+    "clean_package_rebuild": true,
+    "passed": 6,
+    "failed": 0,
+    "log_sha256": "3ccd74ef7cd5c637b39a908a267c492187a91288a50c537270d45176c21de16c",
+    "earlier_cached_test_run_counted": false,
+    "live_company_containers_changed": false
+  },
+  "pending": [
+    "Actual Windows legacy database migration with source/key/identity preservation.",
+    "Full backup and recovery of populated transport and current management records."
+  ],
+  "production_publication": false,
+  "full_product_acceptance_complete": false,
+  "windows_compiled_regressions_passed_source": "361d7c362de7f67b7b7456d33bf0191736eec7d5",
+  "windows_component_evidence": "361d7c3-windows-transport-storage-component-checks.json"
+}
diff --git a/docs/evidence/worker-private-configuration-server2016.json b/docs/evidence/worker-private-configuration-server2016.json
new file mode 100644
index 00000000000..10687db29d4
--- /dev/null
+++ b/docs/evidence/worker-private-configuration-server2016.json
@@ -0,0 +1,30 @@
+{
+  "private_reader": {
+    "source": "1c43a382c87b05e44caff1c6c2bef4cf0b0bb6fc",
+    "only_fake_credential": true,
+    "utc": "2026-10-29T09:00:56.4597808Z",
+    "powershell": "5.1.14393.693",
+    "app_container_read_rejected": true,
+    "os_build": 14393,
+    "compiled_worker_test": false,
+    "same_process_two_private_reads": true,
+    "worker_still_stopped": true,
+    "company_service_unchanged": true
+  },
+  "migration_rejection": {
+    "positive_migration_not_tested": true,
+    "no_configuration_or_journal_created": true,
+    "installed_executable_and_receipt_unchanged": true,
+    "utc": "2026-10-29T09:02:28.7430618Z",
+    "old_credential_rejected_by_real_https": true,
+    "company_still_running": true,
+    "os_build": 14393,
+    "unregistered_replacement_rejected": true,
+    "migration_script_sha256": "8e74670983e4f004910e6c06ac9220f62c08428326d03a91696918b1124889d3",
+    "worker_still_stopped": true,
+    "parser_note": "Windows WhatIf module import messages preceded JSON; original successful invocation retained, not repeated"
+  },
+  "positive_signed_worker_migration_completed": false,
+  "authenticated_build_and_reboot_completed": false,
+  "production_publication": false
+}
diff --git a/flutter/lib/common.dart b/flutter/lib/common.dart
index 1651f670189..4b8ee12dc0f 100644
--- a/flutter/lib/common.dart
+++ b/flutter/lib/common.dart
@@ -3035,8 +3035,14 @@ int versionCmp(String v1, String v2) {
   return bind.versionToNumber(v: v1) - bind.versionToNumber(v: v2);
 }
 
+String getVisibleAppName() {
+  if (!isDesktop) return bind.mainGetAppNameSync();
+  final name = bind.mainGetOptionSync(key: 'managed-company-display-name');
+  return name.isEmpty ? bind.mainGetAppNameSync() : name;
+}
+
 String getWindowName({WindowType? overrideType}) {
-  final name = bind.mainGetAppNameSync();
+  final name = getVisibleAppName();
   switch (overrideType ?? kWindowType) {
     case WindowType.Main:
       return name;
diff --git a/flutter/lib/common/approval_window_auto_hide.dart b/flutter/lib/common/approval_window_auto_hide.dart
new file mode 100644
index 00000000000..2f012494b8e
--- /dev/null
+++ b/flutter/lib/common/approval_window_auto_hide.dart
@@ -0,0 +1,28 @@
+import 'dart:async';
+
+/// Never hide customer consent while another connection still needs a decision.
+class ApprovalWindowAutoHide {
+  final bool Function() hasPendingApproval;
+  final void Function() minimize;
+  Timer? _timer;
+
+  ApprovalWindowAutoHide({
+    required this.hasPendingApproval,
+    required this.minimize,
+  });
+
+  void cancel() {
+    _timer?.cancel();
+    _timer = null;
+  }
+
+  void schedule() {
+    cancel();
+    if (hasPendingApproval()) return;
+    _timer = Timer(const Duration(seconds: 3), () {
+      _timer = null;
+      // Another desktop or file request may arrive after scheduling.
+      if (!hasPendingApproval()) minimize();
+    });
+  }
+}
diff --git a/flutter/lib/common/company_window_title.dart b/flutter/lib/common/company_window_title.dart
new file mode 100644
index 00000000000..e79d206ee72
--- /dev/null
+++ b/flutter/lib/common/company_window_title.dart
@@ -0,0 +1,9 @@
+/// Rename only the application suffix, preserving peer and window-type labels.
+String companyWindowTitle(String title, String previous, String current) {
+  if (previous.isEmpty) return title;
+  if (title == previous) return current;
+  if (title.endsWith(' - $previous')) {
+    return '${title.substring(0, title.length - previous.length)}$current';
+  }
+  return title;
+}
diff --git a/flutter/lib/common/widgets/toolbar.dart b/flutter/lib/common/widgets/toolbar.dart
index 83638000b3d..850b55592a7 100644
--- a/flutter/lib/common/widgets/toolbar.dart
+++ b/flutter/lib/common/widgets/toolbar.dart
@@ -456,12 +456,14 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
       bool isTcpTunneling = false,
       bool isTerminal = false}) {
     final connToken = bind.sessionGetConnToken(sessionId: ffi.sessionId);
+    final managedHandle = connToken?.startsWith('SWT1.') == true;
     connect(context, id,
         isFileTransfer: isFileTransfer,
         isViewCamera: isViewCamera,
         isTerminal: isTerminal,
         isTcpTunneling: isTcpTunneling,
-        connToken: connToken);
+        password: managedHandle ? connToken : null,
+        connToken: managedHandle ? null : connToken);
   }
 
   if (isDefaultConn && isDesktop) {
diff --git a/flutter/lib/desktop/pages/company_about_button.dart b/flutter/lib/desktop/pages/company_about_button.dart
new file mode 100644
index 00000000000..4e9100bcb4e
--- /dev/null
+++ b/flutter/lib/desktop/pages/company_about_button.dart
@@ -0,0 +1,77 @@
+import 'package:flutter/material.dart';
+import 'package:url_launcher/url_launcher.dart';
+
+/// Available in both managed editions, including before technician sign-in.
+class CompanyAboutButton extends StatelessWidget {
+  final String companyName;
+  final Future<String> Function() loadVersion;
+
+  const CompanyAboutButton({
+    super.key,
+    required this.companyName,
+    required this.loadVersion,
+  });
+
+  Future<void> _openLink(BuildContext context, String address) async {
+    var opened = false;
+    try {
+      opened = await launchUrl(Uri.parse(address));
+    } catch (_) {}
+    if (!opened && context.mounted) {
+      ScaffoldMessenger.of(context).showSnackBar(const SnackBar(
+        content: Text('Could not open the browser. You can copy the address from this dialog.'),
+      ));
+    }
+  }
+
+  Widget _link(BuildContext context, String label, String address) => Column(
+    crossAxisAlignment: CrossAxisAlignment.start,
+    children: [
+      TextButton(onPressed: () => _openLink(context, address), child: Text(label)),
+      SelectableText(address),
+    ],
+  );
+
+  Future<void> _showAbout(BuildContext context) async {
+    var version = 'Version unavailable';
+    try {
+      final value = await loadVersion();
+      if (value.trim().isNotEmpty) version = value;
+    } catch (_) {}
+    if (!context.mounted) return;
+    final name = companyName.trim().isEmpty ? 'Swan Remote Support' : companyName;
+    await showDialog<void>(
+      context: context,
+      builder: (dialogContext) => AlertDialog(
+        title: Text('About $name'),
+        scrollable: true,
+        content: Column(
+          mainAxisSize: MainAxisSize.min,
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            SelectableText('Swan Remote Support · $version'),
+            const SizedBox(height: 12),
+            const Text('Open-source remote support based on RustDesk. '
+                'RustDesk copyright © Purslane Tech Pte. Ltd. and contributors.'),
+            const SizedBox(height: 12),
+            const Text('GNU Affero General Public License v3 (AGPL-3.0). '
+                'Third-party components retain their own licences.'),
+            _link(dialogContext, 'Project source', 'https://github.com/rijff24/SwanRemoteSupport'),
+            _link(dialogContext, 'Read the AGPL licence', 'https://www.gnu.org/licenses/agpl-3.0.html'),
+            _link(dialogContext, 'RustDesk source and notices', 'https://github.com/rustdesk/rustdesk'),
+          ],
+        ),
+        actions: [
+          TextButton(onPressed: () => Navigator.of(dialogContext).pop(), child: const Text('Close')),
+        ],
+      ),
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) => TextButton.icon(
+    onPressed: () => _showAbout(context),
+    icon: const Icon(Icons.info_outline),
+    label: const Text('About'),
+  );
+}
diff --git a/flutter/lib/desktop/pages/company_contact_links.dart b/flutter/lib/desktop/pages/company_contact_links.dart
new file mode 100644
index 00000000000..3cae951da1f
--- /dev/null
+++ b/flutter/lib/desktop/pages/company_contact_links.dart
@@ -0,0 +1,33 @@
+import 'package:flutter/material.dart';
+import 'package:url_launcher/url_launcher.dart';
+
+/// Display only public, signed company information. Links never execute commands.
+class CompanyContactLinks extends StatelessWidget {
+  final Map<String, dynamic> company;
+  const CompanyContactLinks({super.key, required this.company});
+
+  Widget _link(String label, String address) => TextButton.icon(
+    onPressed: () async {
+      final url = Uri.tryParse(address);
+      if (url != null && url.scheme == 'https' && url.host.isNotEmpty && url.userInfo.isEmpty) {
+        await launchUrl(url);
+      }
+    },
+    icon: const Icon(Icons.open_in_new),
+    label: Text(label),
+  );
+
+  @override
+  Widget build(BuildContext context) {
+    final contacts = company['support_contacts'] as String? ?? '';
+    final support = company['support_url'] as String? ?? '';
+    final shortcuts = company['shortcuts'] is List ? company['shortcuts'] as List : const [];
+    return Column(crossAxisAlignment: CrossAxisAlignment.start, children: [
+      if (contacts.isNotEmpty) SelectableText(contacts),
+      if (support.isNotEmpty) _link('Contact support', support),
+      for (final entry in shortcuts.whereType<Map>())
+        if (entry['label'] is String && entry['url'] is String)
+          _link(entry['label'] as String, entry['url'] as String),
+    ]);
+  }
+}
diff --git a/flutter/lib/desktop/pages/company_technician_page.dart b/flutter/lib/desktop/pages/company_technician_page.dart
new file mode 100644
index 00000000000..d040d502ed4
--- /dev/null
+++ b/flutter/lib/desktop/pages/company_technician_page.dart
@@ -0,0 +1,248 @@
+import 'dart:convert';
+import 'dart:async';
+import 'dart:io';
+import 'package:flutter/material.dart';
+import 'package:flutter_svg/flutter_svg.dart';
+import 'package:flutter_hbb/common.dart';
+import 'package:flutter_hbb/models/platform_model.dart';
+import 'company_contact_links.dart';
+import 'company_about_button.dart';
+
+/// Company authorization lives in Rust and on the receiver. This view never
+/// receives a bearer token, signing key or reusable device credential.
+class CompanyTechnicianPage extends StatefulWidget {
+  const CompanyTechnicianPage({super.key});
+  @override
+  State<CompanyTechnicianPage> createState() => _CompanyTechnicianPageState();
+}
+
+class _CompanyTechnicianPageState extends State<CompanyTechnicianPage> {
+  final _username = TextEditingController();
+  final _password = TextEditingController();
+  final _code = TextEditingController();
+  Map<String, dynamic> _company = {};
+  List<dynamic> _devices = [];
+  List<dynamic> _history = [];
+  bool _loggedIn = false;
+  bool _busy = false;
+  String _error = '';
+  String _updateError = '';
+  bool _recoveryPending = false;
+  String? _approvedUpdate;
+  Timer? _refreshTimer;
+  Timer? _updateTimer;
+  bool _pollingUpdate = false;
+  bool _updateRunning = false;
+
+  Future<dynamic> _request(Map<String, dynamic> input) async {
+    final text = await bind.mainCompanyRequest(request: jsonEncode(input))
+        .first.timeout(const Duration(seconds: 25));
+    final response = jsonDecode(text) as Map<String, dynamic>;
+    if (response['ok'] != true) {
+      throw Exception(response['error'] ?? 'Company request failed');
+    }
+    return response['data'];
+  }
+
+  Future<void> _run(Future<void> Function() action) async {
+    if (_busy) return;
+    setState(() { _busy = true; _error = ''; });
+    try { await action(); }
+    catch (error) { if (mounted) setState(() { _error = error.toString(); }); }
+    finally { if (mounted) setState(() { _busy = false; }); }
+  }
+
+  Future<void> _pollUpdate() async {
+    if (_pollingUpdate || !mounted || !Platform.isWindows) return;
+    _pollingUpdate = true;
+    try {
+      final progress = await _request({'action': 'update-progress'}) as Map<String, dynamic>;
+      if (progress['handed_off'] == true) exit(0);
+      if (mounted) setState(() {
+        _updateRunning = progress['running'] == true;
+        if (progress['failed'] == true && !_recoveryPending) {
+          _updateError = 'Software update was deferred or could not finish. It will retry automatically.';
+        }
+      });
+    } catch (_) {
+      if (mounted) setState(() { _updateError = 'Software update status is unavailable.'; });
+    } finally { _pollingUpdate = false; }
+  }
+
+  Future<void> _refresh() async {
+    final cachedCompany = jsonDecode(await bind.mainGetCommon(key: 'company-overview'))
+        as Map<String, dynamic>;
+    if (mounted) setState(() { _company = cachedCompany; });
+    if (Platform.isWindows) {
+      try {
+        final recovery = await _request({'action': 'resume-update'}) as Map<String, dynamic>;
+        if (recovery['handed_off'] == true) exit(0);
+        if (mounted) setState(() {
+          _recoveryPending = recovery['pending'] == true;
+          _updateError = _recoveryPending ? 'Software installation recovery is pending. New support connections are unavailable.' : '';
+        });
+      } catch (_) {
+        if (mounted) setState(() {
+          _recoveryPending = true;
+          _updateError = 'Software recovery could not finish. It will retry automatically.';
+        });
+      }
+    }
+    // Retain cached branding if the server is offline; authenticated operations
+    // still require a current signed policy on the native side.
+    try { await _request({'action': 'sync'}); } catch (_) {}
+    final company = jsonDecode(await bind.mainGetCommon(key: 'company-overview'))
+        as Map<String, dynamic>;
+    final status = await _request({'action': 'status'}) as Map<String, dynamic>;
+    final loggedIn = status['logged_in'] == true;
+    if (mounted) setState(() {
+      _company = company; _loggedIn = loggedIn;
+      if (!loggedIn) { _devices = []; _history = []; _approvedUpdate = null; }
+    });
+    final devices = loggedIn ? await _request({'action': 'devices'}) as List<dynamic> : <dynamic>[];
+    final history = loggedIn ? await _request({'action': 'history'}) as List<dynamic> : <dynamic>[];
+    if (mounted) setState(() { _devices = devices; _history = history; });
+    try {
+    if (mounted && loggedIn && Platform.isWindows && !_recoveryPending) {
+      final result = await _request({'action': 'update'}) as Map<String, dynamic>;
+      // Rust writes the signed recovery receipt and starts the verified helper
+      // before acknowledging handoff. New sessions are then blocked natively.
+      // Run this even without new metadata so an interrupted handoff can retry.
+      if (result['handed_off'] == true) exit(0);
+    }
+    final update = loggedIn ? await _request({'action': 'update-status'}) : null;
+    if (mounted) setState(() {
+      _company = company; _loggedIn = loggedIn; _devices = devices; _history = history;
+      _approvedUpdate = update is Map ? update['version'] as String? : null;
+    });
+    } catch (_) {
+      if (mounted) setState(() {
+        _approvedUpdate = null;
+        if (!_recoveryPending) _updateError = 'Software update could not finish. It will retry automatically.';
+      });
+    }
+  }
+
+  Future<void> _login() async {
+    final request = {'action': 'login', 'username': _username.text.trim(),
+      'password': _password.text, 'code': _code.text.trim()};
+    _password.clear(); _code.clear();
+    await _request(request);
+    await _refresh();
+  }
+
+  Future<void> _logout() async {
+    // Clear display state even when the server is offline. Rust clears its
+    // token and pending tickets before attempting server logout.
+    try { await _request({'action': 'logout'}); }
+    finally { if (mounted) setState(() { _loggedIn = false; _devices = []; _history = []; }); }
+  }
+
+  Future<void> _connect(Map<String, dynamic> device, {bool unattended = false}) async {
+    final response = await _request({'action': 'connect', 'device_id': device['id'],
+      'unattended': unattended}) as Map<String, dynamic>;
+    if (!mounted) return;
+    // Only an opaque native request handle enters the window API. Reconnects
+    // need fresh target-bound grants; signing proof keys stay in Rust memory.
+    await connect(context, response['rustdesk_id'] as String,
+        password: response['ticket_handle'] as String);
+  }
+
+  @override
+  void initState() {
+    super.initState();
+    WidgetsBinding.instance.addPostFrameCallback((_) { if (mounted) _run(_refresh); });
+    _refreshTimer = Timer.periodic(const Duration(seconds: 60), (_) {
+      if (mounted && !_busy) _run(_refresh);
+    });
+    _updateTimer = Timer.periodic(const Duration(seconds: 1), (_) { _pollUpdate(); });
+  }
+
+  @override
+  void dispose() {
+    _refreshTimer?.cancel();
+    _updateTimer?.cancel();
+    _username.dispose(); _password.dispose(); _code.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final color = _company['primary_color'] as String? ?? '#007F82';
+    final brandColor = RegExp(r'^#[0-9a-fA-F]{6}$').hasMatch(color)
+        ? Color(0xFF000000 | int.parse(color.substring(1), radix: 16)) : const Color(0xFF007F82);
+    return SingleChildScrollView(
+      padding: const EdgeInsets.all(24),
+      child: Column(crossAxisAlignment: CrossAxisAlignment.start, children: [
+        if ((_company['logo_svg'] as String? ?? '').isNotEmpty)
+          SvgPicture.string(_company['logo_svg'] as String, height: 64, width: 180),
+        const SizedBox(height: 12),
+        Text(_company['display_name'] as String? ?? 'Swan Remote Support Technician',
+            style: Theme.of(context).textTheme.headlineSmall?.copyWith(color: brandColor)),
+        Text(_company['domain'] as String? ?? 'Company setup required'),
+        CompanyContactLinks(company: _company),
+        if (_approvedUpdate != null) Text('Company-approved update available: $_approvedUpdate'),
+        if (_updateError.isNotEmpty) Text(_updateError),
+        if (_updateRunning) const Text('Preparing company-approved software update…'),
+        const SizedBox(height: 16),
+        if (_busy) const LinearProgressIndicator(),
+        if (_error.isNotEmpty) Padding(padding: const EdgeInsets.symmetric(vertical: 12),
+            child: Text(_error, style: const TextStyle(color: Colors.red))),
+        if (!_loggedIn) SizedBox(width: 360, child: Column(children: [
+          TextField(controller: _username, decoration: const InputDecoration(labelText: 'Technician username')),
+          TextField(controller: _password, obscureText: true, enableSuggestions: false,
+              autocorrect: false, decoration: const InputDecoration(labelText: 'Password')),
+          TextField(controller: _code, keyboardType: TextInputType.number, maxLength: 6,
+              decoration: const InputDecoration(labelText: 'Authenticator code'),
+              onSubmitted: (_) { if (!_busy) _run(_login); }),
+          const SizedBox(height: 12),
+          ElevatedButton(onPressed: _busy ? null : () => _run(_login), child: const Text('Sign in')),
+        ])),
+        if (_loggedIn) ...[
+          Row(children: [
+            ElevatedButton.icon(onPressed: _busy ? null : () => _run(_refresh),
+                icon: const Icon(Icons.refresh), label: const Text('Refresh')),
+            const SizedBox(width: 12),
+            TextButton(onPressed: _busy ? null : () => _run(_logout), child: const Text('Sign out')),
+          ]),
+          const SizedBox(height: 16),
+          Text('Authorized devices', style: Theme.of(context).textTheme.titleLarge),
+          if (_devices.isEmpty) const Padding(padding: EdgeInsets.symmetric(vertical: 12),
+              child: Text('No approved devices are assigned to your account.')),
+          for (final value in _devices) Builder(builder: (context) {
+            final device = value as Map<String, dynamic>;
+            final approved = device['state'] == 'approved';
+            return Card(child: ListTile(title: Text(device['name'] as String),
+              subtitle: Text('${device['group']} · ${device['state']}'),
+              trailing: Wrap(spacing: 8, children: [
+                TextButton(onPressed: !_busy && approved && !_recoveryPending ? () => _run(() => _connect(device)) : null,
+                    child: const Text('Request support')),
+                if (device['unattended'] == true)
+                  TextButton(onPressed: !_busy && approved && !_recoveryPending ? () => _run(() => _connect(device, unattended: true)) : null,
+                      child: const Text('Unattended')),
+              ])));
+          }),
+          const SizedBox(height: 20),
+          Text('Session history', style: Theme.of(context).textTheme.titleLarge),
+          if (_history.isEmpty) const Text('No sessions yet.'),
+          for (final value in _history) Builder(builder: (context) {
+            final session = value as Map<String, dynamic>;
+            final time = DateTime.fromMillisecondsSinceEpoch((session['requested_at'] as int) * 1000).toLocal();
+            final active = session['claimed'] == true && session['closed'] != true &&
+                (session['lease_until'] as int) * 1000 > DateTime.now().millisecondsSinceEpoch;
+            return ListTile(title: Text(session['device_name'] as String),
+              subtitle: Text('$time · ${session['unattended'] == true ? 'Unattended' : 'Customer approval'}'),
+              trailing: Text(session['closed'] == true ? 'Closed' :
+                  active ? 'Active' : session['claimed'] == true ? 'Ended' : 'Requested'));
+          }),
+        ],
+        const SizedBox(height: 24),
+        const Text('Powered by Swan Remote Support and RustDesk · AGPL-3.0'),
+        CompanyAboutButton(
+          companyName: _company['display_name'] as String? ?? 'Swan Remote Support Technician',
+          loadVersion: () => bind.mainGetVersion(),
+        ),
+      ]),
+    );
+  }
+}
diff --git a/flutter/lib/desktop/pages/connection_page.dart b/flutter/lib/desktop/pages/connection_page.dart
index 7af8c9911f7..2144690300e 100644
--- a/flutter/lib/desktop/pages/connection_page.dart
+++ b/flutter/lib/desktop/pages/connection_page.dart
@@ -22,10 +22,12 @@ import '../../models/platform_model.dart';
 import '../../desktop/widgets/material_mod_popup_menu.dart' as mod_menu;
 
 class OnlineStatusWidget extends StatefulWidget {
-  const OnlineStatusWidget({Key? key, this.onSvcStatusChanged})
+  const OnlineStatusWidget(
+      {Key? key, this.onSvcStatusChanged, this.managedSupport = false})
       : super(key: key);
 
   final VoidCallback? onSvcStatusChanged;
+  final bool managedSupport;
 
   @override
   State<OnlineStatusWidget> createState() => _OnlineStatusWidgetState();
@@ -143,7 +145,7 @@ class _OnlineStatusWidgetState extends State<OnlineStatusWidget> {
           ? Column(
               children: [
                 basicWidget(),
-                Align(
+                if (!widget.managedSupport) Align(
                         child: startServiceWidget(),
                         alignment: Alignment.centerLeft)
                     .marginOnly(top: 2.0, left: 22.0),
@@ -157,7 +159,9 @@ class _OnlineStatusWidgetState extends State<OnlineStatusWidget> {
     widget.onSvcStatusChanged?.call();
     return Text(
       _svcStopped.value
-          ? translate("Service is not running")
+          ? (widget.managedSupport
+              ? 'Support paused'
+              : translate("Service is not running"))
           : stateGlobal.svcStatus.value == SvcStatus.connecting
               ? translate("connecting_status")
               : stateGlobal.svcStatus.value == SvcStatus.notReady
diff --git a/flutter/lib/desktop/pages/desktop_home_page.dart b/flutter/lib/desktop/pages/desktop_home_page.dart
index 6d8d397683f..233bd66dee2 100644
--- a/flutter/lib/desktop/pages/desktop_home_page.dart
+++ b/flutter/lib/desktop/pages/desktop_home_page.dart
@@ -1,3 +1,5 @@
+import 'company_contact_links.dart';
+import 'company_about_button.dart';
 import 'dart:async';
 import 'dart:io';
 import 'dart:convert';
@@ -5,11 +7,13 @@ import 'dart:convert';
 import 'package:auto_size_text/auto_size_text.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
+import 'package:flutter_svg/flutter_svg.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/common/widgets/animated_rotation_widget.dart';
 import 'package:flutter_hbb/common/widgets/custom_password.dart';
 import 'package:flutter_hbb/consts.dart';
 import 'package:flutter_hbb/desktop/pages/connection_page.dart';
+import 'package:flutter_hbb/desktop/pages/company_technician_page.dart';
 import 'package:flutter_hbb/desktop/pages/desktop_setting_page.dart';
 import 'package:flutter_hbb/desktop/pages/desktop_tab_page.dart';
 import 'package:flutter_hbb/desktop/widgets/update_progress.dart';
@@ -50,6 +54,54 @@ class _DesktopHomePageState extends State<DesktopHomePage>
   var watchIsInputMonitoring = false;
   var watchIsCanRecordAudio = false;
   Timer? _updateTimer;
+  Timer? _companyRefreshTimer;
+  bool _companyConsentBusy = false;
+  bool _companySupportBusy = false;
+
+  Future<void> _changeCompanySupport(bool paused) async {
+    if (_companySupportBusy) return;
+    setState(() { _companySupportBusy = true; });
+    String message;
+    try {
+      final text = await bind.mainCompanyRequest(request: jsonEncode({
+        'action': 'customer-support', 'paused': paused,
+      })).first.timeout(const Duration(seconds: 8));
+      final response = jsonDecode(text) as Map<String, dynamic>;
+      if (response['ok'] != true || response['data']['paused'] != paused) {
+        throw StateError('Support change not confirmed');
+      }
+      svcStopped.value = paused;
+      message = paused ? 'Support paused on this computer.' : 'Support resumed.';
+    } catch (_) {
+      message = 'The support change was not confirmed. Check the support status before relying on it.';
+    } finally {
+      if (mounted) setState(() { _companySupportBusy = false; });
+    }
+    if (mounted) ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text(message)));
+  }
+
+  Future<void> _changeCompanyConsent(bool enabled) async {
+    if (_companyConsentBusy) return;
+    setState(() { _companyConsentBusy = true; });
+    String message;
+    try {
+      final text = await bind.mainCompanyRequest(request: jsonEncode({
+        'action': 'customer-consent', 'enabled': enabled,
+      })).first.timeout(const Duration(seconds: 25));
+      final response = jsonDecode(text) as Map<String, dynamic>;
+      if (response['ok'] != true) throw StateError('Consent not confirmed');
+      final data = response['data'] as Map<String, dynamic>;
+      if (data['unattended'] != enabled) throw StateError('Consent not confirmed');
+      message = enabled ? 'Unattended access enabled.'
+          : data['server_synced'] == true ? 'Unattended access revoked.'
+          : 'Unattended access revoked on this computer. Server synchronization is pending.';
+    } catch (_) {
+      message = 'The consent change was not confirmed. Check the support status before relying on it.';
+    } finally {
+      if (mounted) setState(() { _companyConsentBusy = false; });
+    }
+    if (mounted) ScaffoldMessenger.of(context).showSnackBar(SnackBar(content: Text(message)));
+  }
   bool isCardClosed = false;
 
   final RxBool _editHover = false.obs;
@@ -60,6 +112,9 @@ class _DesktopHomePageState extends State<DesktopHomePage>
   @override
   Widget build(BuildContext context) {
     super.build(context);
+    if (bind.mainGetAppNameSync() == '$swanManagedAppName Technician' && bind.isOutgoingOnly()) {
+      return const CompanyTechnicianPage();
+    }
     final isIncomingOnly = bind.isIncomingOnly();
     return _buildBlock(
         child: Row(
@@ -80,7 +135,7 @@ class _DesktopHomePageState extends State<DesktopHomePage>
   Widget buildLeftPane(BuildContext context) {
     final isIncomingOnly = bind.isIncomingOnly();
     final isOutgoingOnly = bind.isOutgoingOnly();
-    final isSwanManagedClient = bind.mainGetAppNameSync() == swanManagedAppName;
+    final isSwanManagedClient = bind.mainGetAppNameSync() == swanManagedAppName && isIncomingOnly;
     final children = <Widget>[
       if (!isOutgoingOnly && !isSwanManagedClient) buildPresetPasswordWarning(),
       if (bind.isCustomClient())
@@ -88,7 +143,7 @@ class _DesktopHomePageState extends State<DesktopHomePage>
           alignment: Alignment.center,
           child: loadPowered(context),
         ),
-      Align(
+      if (!isSwanManagedClient) Align(
         alignment: Alignment.center,
         child: loadLogo(),
       ),
@@ -122,6 +177,7 @@ class _DesktopHomePageState extends State<DesktopHomePage>
       children.addAll([
         Divider(),
         OnlineStatusWidget(
+          managedSupport: isSwanManagedClient,
           onSvcStatusChanged: () {
             if (isInHomePage()) {
               Future.delayed(Duration(milliseconds: 300), () {
@@ -194,30 +250,41 @@ class _DesktopHomePageState extends State<DesktopHomePage>
 
   Widget buildSwanManagedOverview(BuildContext context) {
     return FutureBuilder<String>(
-      future: bind.mainGetCommon(key: 'permanent-password-set'),
+      future: bind.mainGetCommon(key: 'company-overview'),
       builder: (context, snapshot) {
-        final isReady = snapshot.data == 'true';
-        final statusColor = isReady ? const Color(0xFF0A7D5A) : Colors.orange;
+        Map<String, dynamic> company = {};
+        try {
+          company = jsonDecode(snapshot.data ?? '{}') as Map<String, dynamic>;
+        } catch (_) {}
+        final configured = company['configured'] == true && company['enrolled'] == true;
+        final isReady = configured && company['profile_valid'] == true;
+        final color = company['primary_color'] as String? ?? '#007F82';
+        final brandColor = RegExp(r'^#[0-9a-fA-F]{6}$').hasMatch(color)
+            ? Color(0xFF000000 | int.parse(color.substring(1), radix: 16))
+            : const Color(0xFF007F82);
+        final statusColor = isReady ? brandColor : Colors.orange;
         final statusIcon = isReady ? Icons.verified_user : Icons.warning_amber;
         final statusTitle = isReady
-            ? 'Ready for unattended support'
-            : 'Swan setup is not complete';
+            ? (company['unattended'] == true ? 'Unattended support enabled' : 'Customer approval required')
+            : (configured ? 'Company authorization is unavailable' : 'Company setup is not complete');
         final statusText = isReady
-            ? 'This computer can receive private Swan Computing support while it is connected to Tailscale.'
-            : 'A Swan technician must finish express setup and securely record this computer\'s unique support credentials.';
+            ? 'Only company-authorized technicians can request access. Your company must approve this device before support begins.'
+            : (configured ? 'Cached company branding is shown. A fresh signed configuration is required before support can begin.' : 'Run the company setup included with your download to verify its server and enroll this computer.');
 
         return Padding(
           padding: const EdgeInsets.fromLTRB(20, 16, 16, 8),
           child: Column(
             crossAxisAlignment: CrossAxisAlignment.start,
             children: [
+              if ((company['logo_svg'] as String? ?? '').isNotEmpty)
+                Padding(padding: const EdgeInsets.only(bottom: 12), child: SvgPicture.string(company['logo_svg'] as String, height: 64, width: 180)),
               Text(
-                'Managed by Swan Computing',
+                company['display_name'] as String? ?? 'Swan Remote Support',
                 style: Theme.of(context).textTheme.titleLarge,
               ),
               const SizedBox(height: 8),
               Text(
-                'Remote support is configured for Swan Computing\'s private Tailscale network. The device ID and password are hidden from this customer screen.',
+                company['consent_text'] as String? ?? 'Support requires a verified company configuration. No public-network fallback is permitted.',
                 style: Theme.of(context).textTheme.bodySmall,
               ),
               const SizedBox(height: 16),
@@ -254,10 +321,47 @@ class _DesktopHomePageState extends State<DesktopHomePage>
                 ),
               ),
               const SizedBox(height: 12),
+              Obx(() => TextButton.icon(
+                onPressed: _companySupportBusy ? null : () => _changeCompanySupport(!svcStopped.value),
+                icon: Icon(svcStopped.value ? Icons.play_arrow : Icons.stop_circle_outlined),
+                label: Text(svcStopped.value ? 'Resume support' : 'Stop support'),
+              )),
+              CompanyContactLinks(company: company),
+              if (company['unattended'] == true)
+                TextButton.icon(
+                  onPressed: _companyConsentBusy ? null : () => _changeCompanyConsent(false),
+                  icon: const Icon(Icons.shield_outlined),
+                  label: const Text('Revoke unattended access'),
+                ),
+              if (isReady && company['unattended'] != true && company['allow_unattended'] == true)
+                TextButton.icon(
+                  onPressed: _companyConsentBusy ? null : () async {
+                    final accepted = await showDialog<bool>(
+                      context: context,
+                      builder: (dialogContext) => AlertDialog(
+                        title: const Text('Allow unattended support?'),
+                        scrollable: true,
+                        content: Text('Approved technicians from ${company['display_name']} can connect while you are absent, including at the Windows sign-in screen. You can revoke this permission here at any time.\n\nCompany server: ${company['domain']}\n\n${company['consent_text'] ?? ''}'),
+                        actions: [
+                          TextButton(onPressed: () => Navigator.of(dialogContext).pop(false), child: const Text('Cancel')),
+                          TextButton(onPressed: () => Navigator.of(dialogContext).pop(true), child: const Text('Allow ongoing support')),
+                        ],
+                      ),
+                    );
+                    if (accepted != true || !mounted) return;
+                    await _changeCompanyConsent(true);
+                  },
+                  icon: const Icon(Icons.shield_outlined),
+                  label: const Text('Allow unattended support'),
+                ),
               Text(
-                'The computer owner can use the tray icon to view or stop the support service.',
+                'Use the tray icon to view sessions. Powered by Swan Remote Support and RustDesk · AGPL-3.0.',
                 style: Theme.of(context).textTheme.bodySmall,
               ),
+              CompanyAboutButton(
+                companyName: company['display_name'] as String? ?? swanManagedAppName,
+                loadVersion: () => bind.mainGetVersion(),
+              ),
             ],
           ),
         );
@@ -508,6 +612,13 @@ class _DesktopHomePageState extends State<DesktopHomePage>
   }
 
   Widget buildHelpCards(String updateUrl) {
+    final appName = bind.mainGetAppNameSync();
+    if (appName == swanManagedAppName ||
+        appName == '$swanManagedAppName Technician') {
+      // Managed installation and updates require the company bundle/agent,
+      // including when cached company configuration cannot be verified.
+      return const SizedBox.shrink();
+    }
     if (!bind.isCustomClient() &&
         updateUrl.isNotEmpty &&
         !isCardClosed &&
@@ -775,6 +886,11 @@ class _DesktopHomePageState extends State<DesktopHomePage>
   @override
   void initState() {
     super.initState();
+    if (bind.mainGetAppNameSync().startsWith(swanManagedAppName)) {
+      _companyRefreshTimer = Timer.periodic(const Duration(seconds: 30), (_) {
+        if (mounted) setState(() {});
+      });
+    }
     _updateTimer = periodic_immediate(const Duration(seconds: 1), () async {
       await gFFI.serverModel.fetchID();
       final error = await bind.mainGetError();
@@ -957,6 +1073,7 @@ class _DesktopHomePageState extends State<DesktopHomePage>
     _uniLinksSubscription?.cancel();
     Get.delete<RxBool>(tag: 'stop-service');
     _updateTimer?.cancel();
+    _companyRefreshTimer?.cancel();
     WidgetsBinding.instance.removeObserver(this);
     super.dispose();
   }
diff --git a/flutter/lib/desktop/pages/server_page.dart b/flutter/lib/desktop/pages/server_page.dart
index 8bd7df08be4..1a198ec7a4a 100644
--- a/flutter/lib/desktop/pages/server_page.dart
+++ b/flutter/lib/desktop/pages/server_page.dart
@@ -165,11 +165,7 @@ class ConnectionManagerState extends State<ConnectionManager>
   Widget build(BuildContext context) {
     final serverModel = Provider.of<ServerModel>(context);
     pointerHandler(PointerEvent e) {
-      if (serverModel.cmHiddenTimer != null) {
-        serverModel.cmHiddenTimer!.cancel();
-        serverModel.cmHiddenTimer = null;
-        debugPrint("CM hidden timer has been canceled");
-      }
+      serverModel.cancelApprovalWindowAutoHide();
     }
 
     return serverModel.clients.isEmpty
@@ -1008,7 +1004,6 @@ class _CmControlPanel extends StatelessWidget {
             color: MyTheme.accent,
             onClick: () {
               handleElevate(context);
-              windowManager.minimize();
             },
             icon: Icon(
               Icons.security_rounded,
@@ -1068,7 +1063,6 @@ class _CmControlPanel extends StatelessWidget {
           child: buildButton(context, color: Colors.green[700], onClick: () {
             handleAccept(context);
             handleElevate(context);
-            windowManager.minimize();
           },
               text: 'Accept and Elevate',
               icon: Icon(
@@ -1091,7 +1085,6 @@ class _CmControlPanel extends StatelessWidget {
                       color: MyTheme.accent,
                       onClick: () {
                         handleAccept(context);
-                        windowManager.minimize();
                       },
                       text: 'Accept',
                       textColor: Colors.white,
@@ -1189,6 +1182,7 @@ class _CmControlPanel extends StatelessWidget {
     final model = Provider.of<ServerModel>(context, listen: false);
     model.setShowElevation(false);
     bind.cmElevatePortable(connId: client.id);
+    model.scheduleApprovalWindowAutoHide();
   }
 
   void handleClose() async {
diff --git a/flutter/lib/main.dart b/flutter/lib/main.dart
index 9bd68ed60a6..889f4859d15 100644
--- a/flutter/lib/main.dart
+++ b/flutter/lib/main.dart
@@ -24,6 +24,7 @@ import 'package:provider/provider.dart';
 import 'package:window_manager/window_manager.dart';
 
 import 'common.dart';
+import 'common/company_window_title.dart';
 import 'consts.dart';
 import 'mobile/pages/home_page.dart';
 import 'mobile/pages/server_page.dart';
@@ -429,9 +430,37 @@ class App extends StatefulWidget {
 }
 
 class _AppState extends State<App> with WidgetsBindingObserver {
+  Timer? _brandingTimer;
+  bool _refreshingBranding = false;
+  String _visibleAppName = '';
+
+  Future<void> _refreshBranding() async {
+    if (_refreshingBranding || !mounted) return;
+    _refreshingBranding = true;
+    try {
+      final name = getVisibleAppName();
+      if (name == _visibleAppName) return;
+      final title = await windowManager.getTitle();
+      if (!mounted) return;
+      final renamed = companyWindowTitle(title, _visibleAppName, name);
+      if (renamed != title) await windowManager.setTitle(renamed);
+      if (mounted) setState(() => _visibleAppName = name);
+    } catch (_) {
+      // A closing native window can disappear before the title request completes.
+      debugPrint('Company window title refresh could not complete.');
+    } finally {
+      _refreshingBranding = false;
+    }
+  }
+
   @override
   void initState() {
     super.initState();
+    if (isDesktop) {
+      _visibleAppName = getVisibleAppName();
+      _brandingTimer = Timer.periodic(
+          const Duration(seconds: 30), (_) => _refreshBranding());
+    }
     WidgetsBinding.instance.window.onPlatformBrightnessChanged = () {
       final userPreference = MyTheme.getThemeModePreference();
       if (userPreference != ThemeMode.system) return;
@@ -458,6 +487,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
 
   @override
   void dispose() {
+    _brandingTimer?.cancel();
     WidgetsBinding.instance.removeObserver(this);
     super.dispose();
   }
@@ -502,7 +532,7 @@ class _AppState extends State<App> with WidgetsBindingObserver {
           debugShowCheckedModeBanner: false,
           title: isWeb
               ? '${bind.mainGetAppNameSync()} Web Client V2 (Preview)'
-              : bind.mainGetAppNameSync(),
+              : getVisibleAppName(),
           theme: MyTheme.lightTheme,
           darkTheme: MyTheme.darkTheme,
           themeMode: MyTheme.currentThemeMode(),
diff --git a/flutter/lib/models/server_model.dart b/flutter/lib/models/server_model.dart
index 40c94fcf508..01e8335257b 100644
--- a/flutter/lib/models/server_model.dart
+++ b/flutter/lib/models/server_model.dart
@@ -11,6 +11,7 @@ import 'package:get/get.dart';
 import 'package:window_manager/window_manager.dart';
 
 import '../common.dart';
+import '../common/approval_window_auto_hide.dart';
 import '../common/formatter/id_formatter.dart';
 import '../desktop/pages/server_page.dart' as desktop;
 import '../desktop/widgets/tabbar_widget.dart';
@@ -48,10 +49,22 @@ class ServerModel with ChangeNotifier {
 
   final List<Client> _clients = [];
 
-  Timer? cmHiddenTimer;
+  late final _approvalWindowAutoHide = ApprovalWindowAutoHide(
+    hasPendingApproval: () =>
+        _clients.any((client) => !client.authorized && !client.disconnected),
+    minimize: () {
+      if (!hideCm) windowManager.minimize();
+    },
+  );
 
   final _wakelockKey = UniqueKey();
 
+  void cancelApprovalWindowAutoHide() => _approvalWindowAutoHide.cancel();
+
+  void scheduleApprovalWindowAutoHide() {
+    if (isDesktop) _approvalWindowAutoHide.schedule();
+  }
+
   bool get isStart => _isStart;
 
   bool get mediaOk => _mediaOk;
@@ -587,6 +600,7 @@ class ServerModel with ChangeNotifier {
   }
 
   void _addTab(Client client) {
+    if (!client.authorized) _approvalWindowAutoHide.cancel();
     tabController.add(TabInfo(
         key: client.id.toString(),
         label: client.name,
@@ -598,10 +612,7 @@ class ServerModel with ChangeNotifier {
     });
     // Only do the hidden task when on Desktop.
     if (client.authorized && isDesktop) {
-      cmHiddenTimer = Timer(const Duration(seconds: 3), () {
-        if (!hideCm) windowManager.minimize();
-        cmHiddenTimer = null;
-      });
+      scheduleApprovalWindowAutoHide();
     }
     parent.target?.chatModel
         .updateConnIdOfKey(MessageKey(client.peerId, client.id));
@@ -701,6 +712,7 @@ class ServerModel with ChangeNotifier {
       parent.target?.invokeMethod("cancel_notification", client.id);
       client.authorized = true;
       notifyListeners();
+      scheduleApprovalWindowAutoHide();
     } else {
       bind.cmLoginRes(connId: client.id, res: res);
       parent.target?.invokeMethod("cancel_notification", client.id);
diff --git a/flutter/lib/web/bridge.dart b/flutter/lib/web/bridge.dart
index ac48dfb0ffd..4819e8a255c 100644
--- a/flutter/lib/web/bridge.dart
+++ b/flutter/lib/web/bridge.dart
@@ -1896,6 +1896,10 @@ class RustdeskImpl {
     throw UnimplementedError("sessionPrinterResponse");
   }
 
+  Stream<String> mainCompanyRequest({required String request, dynamic hint}) {
+    throw UnimplementedError("mainCompanyRequest");
+  }
+
   Future<String> mainGetCommon({required String key, dynamic hint}) {
     throw UnimplementedError("mainGetCommon");
   }
diff --git a/flutter/pubspec.yaml b/flutter/pubspec.yaml
index b9f8e1ccbe1..1ae571ee943 100644
--- a/flutter/pubspec.yaml
+++ b/flutter/pubspec.yaml
@@ -16,7 +16,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # 1.1.9-1 works for android, but for ios it becomes 1.1.91, need to set it to 1.1.9-a.1 for iOS, will get 1.1.9.1, but iOS store not allow 4 numbers
-version: 1.4.9+67
+version: 1.5.23+94
 
 environment:
   sdk: '^3.1.0'
diff --git a/flutter/test/approval_window_auto_hide_test.dart b/flutter/test/approval_window_auto_hide_test.dart
new file mode 100644
index 00000000000..e0288f6fd50
--- /dev/null
+++ b/flutter/test/approval_window_auto_hide_test.dart
@@ -0,0 +1,64 @@
+import 'dart:io';
+
+import 'package:flutter_hbb/common/approval_window_auto_hide.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('approval card actions cannot bypass the pending-consent window guard', () {
+    // The live reconnect regression bypassed the timer through an Accept button.
+    // Keep window minimization in ServerModel's guarded controller, including
+    // acceptance and elevation; the timed tests below exercise that controller.
+    final approvalPage =
+        File('lib/desktop/pages/server_page.dart').readAsStringSync();
+    expect(
+      RegExp(r'\bwindowManager\s*\.\s*minimize\s*\(')
+          .hasMatch(approvalPage),
+      isFalse,
+      reason: 'An approval/elevation action must not hide another pending consent.',
+    );
+  });
+
+  testWidgets('desktop approval keeps a pending file consent visible',
+      (tester) async {
+    var pendingFileApproval = true;
+    var minimizations = 0;
+    final autoHide = ApprovalWindowAutoHide(
+      hasPendingApproval: () => pendingFileApproval,
+      minimize: () => minimizations++,
+    );
+    addTearDown(autoHide.cancel);
+
+    autoHide.schedule(); // Desktop approved; file request still pending.
+    await tester.pump(const Duration(seconds: 4));
+    expect(minimizations, 0);
+
+    pendingFileApproval = false;
+    autoHide.schedule();
+    await tester.pump(const Duration(seconds: 3));
+    expect(minimizations, 1);
+  });
+
+  testWidgets('request arriving during the hide delay prevents minimizing',
+      (tester) async {
+    var pending = false;
+    var minimizations = 0;
+    final autoHide = ApprovalWindowAutoHide(
+      hasPendingApproval: () => pending,
+      minimize: () => minimizations++,
+    );
+    addTearDown(autoHide.cancel);
+
+    autoHide.schedule();
+    await tester.pump(const Duration(seconds: 2));
+    pending = true;
+    await tester.pump(const Duration(seconds: 2));
+    expect(minimizations, 0);
+
+    pending = false;
+    autoHide.schedule();
+    await tester.pump(const Duration(seconds: 1));
+    autoHide.cancel(); // New pending request cancels the earlier callback.
+    await tester.pump(const Duration(seconds: 3));
+    expect(minimizations, 0);
+  });
+}
diff --git a/flutter/test/company_window_title_test.dart b/flutter/test/company_window_title_test.dart
new file mode 100644
index 00000000000..a9da7e366c3
--- /dev/null
+++ b/flutter/test/company_window_title_test.dart
@@ -0,0 +1,21 @@
+import 'package:flutter_hbb/common/company_window_title.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('live company rename preserves peer and window type', () {
+    expect(companyWindowTitle('Company A', 'Company A', 'Company B'), 'Company B');
+    expect(
+        companyWindowTitle('Customer 7 - Remote Desktop - Company A',
+            'Company A', 'Company B'),
+        'Customer 7 - Remote Desktop - Company B');
+    expect(
+        companyWindowTitle('Customer 7 - File Transfer - Company A',
+            'Company A', 'Company B'),
+        'Customer 7 - File Transfer - Company B');
+    expect(companyWindowTitle('Company A - Customer 7', 'Company A', 'Company B'),
+        'Company A - Customer 7');
+    expect(companyWindowTitle('Peer - ', '', 'Company B'), 'Peer - ');
+    expect(companyWindowTitle('Peer - 株式会社', '株式会社', 'Support 🦢'),
+        'Peer - Support 🦢');
+  });
+}
diff --git a/flutter/windows/CMakeLists.txt b/flutter/windows/CMakeLists.txt
index 926941b8491..df82cdb6d1b 100644
--- a/flutter/windows/CMakeLists.txt
+++ b/flutter/windows/CMakeLists.txt
@@ -44,6 +44,17 @@ endforeach()
 # Use Unicode for all projects.
 add_definitions(-DUNICODE -D_UNICODE)
 
+# Apply before creating the runner and plugin targets: their PE link timestamps
+# otherwise change on every build even when all compiled payload bytes match.
+# Keep incremental linking available for interactive Debug builds.
+if(MSVC)
+  add_link_options(
+    "$<$<NOT:$<CONFIG:Debug>>:/Brepro>"
+    "$<$<NOT:$<CONFIG:Debug>>:/INCREMENTAL:NO>"
+    "$<$<NOT:$<CONFIG:Debug>>:/PDBALTPATH:%_PDB%>"
+  )
+endif()
+
 # Compilation settings that should be applied to most targets.
 #
 # Be cautious about adding new options here, as plugins use this function by
@@ -70,6 +81,21 @@ add_subdirectory("runner")
 # them to the application.
 include(flutter/generated_plugins.cmake)
 
+# --service returns from the Rust core before creating a Flutter window. Avoid
+# loading the engine and every GUI plugin before the service can register with
+# Windows, especially during a cold boot on slower storage.
+if(MSVC)
+  target_link_libraries(${BINARY_NAME} PRIVATE delayimp)
+  target_link_options(${BINARY_NAME} PRIVATE "/DELAYLOAD:flutter_windows.dll")
+  foreach(plugin ${FLUTTER_PLUGIN_LIST})
+    get_target_property(plugin_type ${plugin}_plugin TYPE)
+    if(plugin_type STREQUAL "SHARED_LIBRARY")
+      target_link_options(${BINARY_NAME} PRIVATE
+        "/DELAYLOAD:$<TARGET_FILE_NAME:${plugin}_plugin>")
+    endif()
+  endforeach()
+endif()
+
 
 # === Installation ===
 # Support files are copied into place next to the executable, so that it can
diff --git a/flutter/windows/runner/CMakeLists.txt b/flutter/windows/runner/CMakeLists.txt
index 2dbf0a973b0..01a85e1069c 100644
--- a/flutter/windows/runner/CMakeLists.txt
+++ b/flutter/windows/runner/CMakeLists.txt
@@ -21,6 +21,12 @@ add_executable(${BINARY_NAME} WIN32
 # that need different build settings.
 apply_standard_settings(${BINARY_NAME})
 
+if("$ENV{SWAN_BUILD}" STREQUAL "1")
+  target_sources(${BINARY_NAME} PRIVATE "service_bootstrap.cpp")
+  target_compile_definitions(${BINARY_NAME} PRIVATE SWAN_MANAGED_SERVICE_BOOTSTRAP)
+  target_link_libraries(${BINARY_NAME} PRIVATE advapi32 shell32)
+endif()
+
 # Add preprocessor definitions for the build version.
 target_compile_definitions(${BINARY_NAME} PRIVATE "FLUTTER_VERSION=\"${FLUTTER_VERSION}\"")
 target_compile_definitions(${BINARY_NAME} PRIVATE "FLUTTER_VERSION_MAJOR=${FLUTTER_VERSION_MAJOR}")
diff --git a/flutter/windows/runner/main.cpp b/flutter/windows/runner/main.cpp
index cd9f386b107..055852987ff 100644
--- a/flutter/windows/runner/main.cpp
+++ b/flutter/windows/runner/main.cpp
@@ -10,6 +10,9 @@
 #include "win32_desktop.h"
 #include "flutter_window.h"
 #include "utils.h"
+#ifdef SWAN_MANAGED_SERVICE_BOOTSTRAP
+#include "service_bootstrap.h"
+#endif
 
 typedef char** (*FUNC_RUSTDESK_CORE_MAIN)(int*);
 typedef void (*FUNC_RUSTDESK_FREE_ARGS)( char**, int);
@@ -22,6 +25,10 @@ const wchar_t* getWindowClassName();
 int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
                       _In_ wchar_t *command_line, _In_ int show_command)
 {
+#ifdef SWAN_MANAGED_SERVICE_BOOTSTRAP
+  int service_exit = 0;
+  if (RunSwanServiceIfRequested(&service_exit)) return service_exit;
+#endif
   HINSTANCE hInstance = LoadLibraryA("librustdesk.dll");
   if (!hInstance)
   {
diff --git a/flutter/windows/runner/service_bootstrap.cpp b/flutter/windows/runner/service_bootstrap.cpp
new file mode 100644
index 00000000000..25ffe12fce1
--- /dev/null
+++ b/flutter/windows/runner/service_bootstrap.cpp
@@ -0,0 +1,214 @@
+#include "service_bootstrap.h"
+
+#include <windows.h>
+#include <shellapi.h>
+
+#include <atomic>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace {
+#ifndef SWAN_SERVICE_BOOTSTRAP_NAME
+#define SWAN_SERVICE_BOOTSTRAP_NAME L"Swan Remote Support"
+#endif
+constexpr wchar_t kServiceName[] = SWAN_SERVICE_BOOTSTRAP_NAME;
+constexpr DWORD kCheckpointIntervalMs = 5000;
+#ifndef SWAN_SERVICE_BOOTSTRAP_TIMEOUT_MS
+#define SWAN_SERVICE_BOOTSTRAP_TIMEOUT_MS 120000
+#endif
+constexpr DWORD kInitializationTimeoutMs = SWAN_SERVICE_BOOTSTRAP_TIMEOUT_MS;
+using ReportStatus = int(__cdecl*)(uint32_t, uint32_t);
+using CoreServiceMain = uint32_t(__cdecl*)(ReportStatus);
+using CoreServiceControl = uint32_t(__cdecl*)(uint32_t);
+
+SERVICE_STATUS_HANDLE status_handle = nullptr;
+SERVICE_STATUS status = {};
+SRWLOCK status_lock = SRWLOCK_INIT;
+HANDLE initialization_finished = nullptr;
+HANDLE heartbeat_ready = nullptr;
+std::atomic<CoreServiceControl> core_control{nullptr};
+std::atomic<DWORD> service_exit{ERROR_SUCCESS};
+
+int __cdecl ReportCoreStatus(uint32_t state, uint32_t error) {
+  if (state != SERVICE_RUNNING && state != SERVICE_STOPPED) {
+    SetLastError(ERROR_INVALID_PARAMETER);
+    return FALSE;
+  }
+  AcquireSRWLockExclusive(&status_lock);
+  if (status.dwCurrentState == SERVICE_STOPPED) {
+    ReleaseSRWLockExclusive(&status_lock);
+    SetLastError(ERROR_SERVICE_NOT_ACTIVE);
+    return FALSE;
+  }
+  status.dwCurrentState = state;
+  status.dwControlsAccepted = state == SERVICE_RUNNING ? SERVICE_ACCEPT_STOP : 0;
+  status.dwWin32ExitCode = error;
+  status.dwCheckPoint = 0;
+  status.dwWaitHint = 0;
+  service_exit = error;
+  const BOOL result = SetServiceStatus(status_handle, &status);
+  SetEvent(initialization_finished);
+  ReleaseSRWLockExclusive(&status_lock);
+  return result;
+}
+
+DWORD WINAPI ControlHandler(DWORD control, DWORD, void*, void*) {
+  auto handler = core_control.load(std::memory_order_acquire);
+  if (handler) return handler(control);
+  return control == SERVICE_CONTROL_INTERROGATE ? NO_ERROR
+                                               : ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+DWORD WINAPI InitializationHeartbeat(void*) {
+  // Start this thread before LoadLibrary: a DLL's initialization may hold the
+  // loader lock, which also gates a newly created thread's DLL notifications.
+  SetEvent(heartbeat_ready);
+  const ULONGLONG started = GetTickCount64();
+  while (WaitForSingleObject(initialization_finished, kCheckpointIntervalMs) ==
+         WAIT_TIMEOUT) {
+    AcquireSRWLockExclusive(&status_lock);
+    if (status.dwCurrentState != SERVICE_START_PENDING) {
+      ReleaseSRWLockExclusive(&status_lock);
+      return 0;
+    }
+    if (GetTickCount64() - started >= kInitializationTimeoutMs) {
+      status.dwCurrentState = SERVICE_STOPPED;
+      status.dwWin32ExitCode = ERROR_TIMEOUT;
+      status.dwCheckPoint = 0;
+      status.dwWaitHint = 0;
+      service_exit = ERROR_TIMEOUT;
+      SetServiceStatus(status_handle, &status);
+      ReleaseSRWLockExclusive(&status_lock);
+      // Initialization has not reached Running or accepted sessions. Do not
+      // run DLL detach handlers while another thread may hold the loader lock.
+      TerminateProcess(GetCurrentProcess(), ERROR_TIMEOUT);
+      return ERROR_TIMEOUT;
+    }
+    ++status.dwCheckPoint;
+    if (!SetServiceStatus(status_handle, &status)) {
+      const DWORD error = GetLastError();
+      service_exit = error;
+      ReleaseSRWLockExclusive(&status_lock);
+      TerminateProcess(GetCurrentProcess(), error);
+      return error;
+    }
+    ReleaseSRWLockExclusive(&status_lock);
+  }
+  return 0;
+}
+
+HMODULE LoadServiceCore() {
+  std::vector<wchar_t> path(32768);
+  const DWORD length = GetModuleFileNameW(nullptr, path.data(),
+                                        static_cast<DWORD>(path.size()));
+  if (length == 0 || length >= path.size()) return nullptr;
+  std::wstring directory(path.data(), length);
+  const auto separator = directory.find_last_of(L"\\/");
+  if (separator == std::wstring::npos) {
+    SetLastError(ERROR_BAD_PATHNAME);
+    return nullptr;
+  }
+  directory.resize(separator + 1);
+  directory += L"librustdesk.dll";
+  return LoadLibraryExW(directory.c_str(), nullptr,
+                        LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR |
+                            LOAD_LIBRARY_SEARCH_SYSTEM32);
+}
+
+void WINAPI ServiceMain(DWORD, wchar_t**) {
+  status.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
+  status.dwCurrentState = SERVICE_START_PENDING;
+  status.dwCheckPoint = 1;
+  status.dwWaitHint = 15000;
+  status_handle = RegisterServiceCtrlHandlerExW(kServiceName, ControlHandler,
+                                               nullptr);
+  if (!status_handle) {
+    service_exit = GetLastError();
+    return;
+  }
+  if (!SetServiceStatus(status_handle, &status)) {
+    service_exit = GetLastError();
+    return;
+  }
+  initialization_finished = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+  DWORD event_error = initialization_finished ? ERROR_SUCCESS : GetLastError();
+  heartbeat_ready = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+  if (!heartbeat_ready) event_error = GetLastError();
+  if (!initialization_finished || !heartbeat_ready) {
+    // Report directly because ReportCoreStatus also signals the event.
+    status.dwCurrentState = SERVICE_STOPPED;
+    status.dwWin32ExitCode = event_error;
+    status.dwCheckPoint = 0;
+    status.dwWaitHint = 0;
+    service_exit = status.dwWin32ExitCode;
+    SetServiceStatus(status_handle, &status);
+    if (initialization_finished) CloseHandle(initialization_finished);
+    if (heartbeat_ready) CloseHandle(heartbeat_ready);
+    return;
+  }
+  HANDLE heartbeat = CreateThread(nullptr, 0, InitializationHeartbeat, nullptr,
+                                  0, nullptr);
+  if (!heartbeat) {
+    ReportCoreStatus(SERVICE_STOPPED, GetLastError());
+  } else if (WaitForSingleObject(heartbeat_ready, 10000) != WAIT_OBJECT_0) {
+    ReportCoreStatus(SERVICE_STOPPED, ERROR_TIMEOUT);
+  } else {
+    HMODULE core = LoadServiceCore();
+    if (!core) {
+      ReportCoreStatus(SERVICE_STOPPED, GetLastError());
+    } else {
+      auto main = reinterpret_cast<CoreServiceMain>(
+          GetProcAddress(core, "swan_service_bootstrap"));
+      auto control = reinterpret_cast<CoreServiceControl>(
+          GetProcAddress(core, "swan_service_control"));
+      if (!main || !control) {
+        ReportCoreStatus(SERVICE_STOPPED, ERROR_PROC_NOT_FOUND);
+      } else {
+        core_control.store(control, std::memory_order_release);
+        const DWORD result = main(ReportCoreStatus);
+        ReportCoreStatus(SERVICE_STOPPED, result);
+        core_control.store(nullptr, std::memory_order_release);
+      }
+      // Keep the core loaded until process exit: a final control callback can
+      // race shutdown. No legacy core entry point is used as a fallback.
+    }
+  }
+  SetEvent(initialization_finished);
+  if (heartbeat) {
+    if (WaitForSingleObject(heartbeat, 5000) != WAIT_OBJECT_0) {
+      TerminateProcess(GetCurrentProcess(), ERROR_TIMEOUT);
+    }
+    CloseHandle(heartbeat);
+  }
+  CloseHandle(heartbeat_ready);
+  CloseHandle(initialization_finished);
+}
+}  // namespace
+
+bool RunSwanServiceIfRequested(int* exit_code) {
+  int count = 0;
+  auto args = CommandLineToArgvW(GetCommandLineW(), &count);
+  if (!args) {
+    *exit_code = static_cast<int>(GetLastError());
+    return true;
+  }
+  bool service = false;
+  for (int i = 1; i < count; ++i) {
+    if (wcscmp(args[i], L"--service") == 0) service = true;
+  }
+  LocalFree(args);
+  if (!service) return false;
+  if (count != 2) {
+    *exit_code = ERROR_INVALID_PARAMETER;
+    return true;
+  }
+  SERVICE_TABLE_ENTRYW table[] = {
+      {const_cast<wchar_t*>(kServiceName), ServiceMain}, {nullptr, nullptr}};
+  if (!StartServiceCtrlDispatcherW(table)) {
+    *exit_code = static_cast<int>(GetLastError());
+  } else {
+    *exit_code = static_cast<int>(service_exit.load(std::memory_order_acquire));
+  }
+  return true;
+}
diff --git a/flutter/windows/runner/service_bootstrap.h b/flutter/windows/runner/service_bootstrap.h
new file mode 100644
index 00000000000..c3ec3b29d9a
--- /dev/null
+++ b/flutter/windows/runner/service_bootstrap.h
@@ -0,0 +1,8 @@
+#ifndef SWAN_SERVICE_BOOTSTRAP_H_
+#define SWAN_SERVICE_BOOTSTRAP_H_
+
+// Returns false for desktop invocations. A handled service invocation must
+// return directly from wWinMain, without loading the desktop or Rust core again.
+bool RunSwanServiceIfRequested(int* exit_code);
+
+#endif
diff --git a/libs/portable/Cargo.toml b/libs/portable/Cargo.toml
index aacfdcf9bb5..fb8c546fad4 100644
--- a/libs/portable/Cargo.toml
+++ b/libs/portable/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rustdesk-portable-packer"
-version = "1.4.9"
+version = "1.5.23"
 edition = "2021"
 description = "RustDesk Remote Desktop"
 
diff --git a/libs/portable/build.rs b/libs/portable/build.rs
index 74e7cc70e4c..4b11a11cc94 100644
--- a/libs/portable/build.rs
+++ b/libs/portable/build.rs
@@ -1,7 +1,9 @@
-fn main() {
+#[cfg(windows)]
+mod resource_order;
+
+fn main() -> std::io::Result<()> {
     #[cfg(windows)]
     {
-        use std::io::Write;
         let mut res = winres::WindowsResource::new();
         res.set_icon("../../res/icon.ico")
             .set_language(winapi::um::winnt::MAKELANGID(
@@ -9,12 +11,18 @@ fn main() {
                 winapi::um::winnt::SUBLANG_ENGLISH_US,
             ))
             .set_manifest_file("../../res/manifest.xml");
-        match res.compile() {
-            Err(e) => {
-                write!(std::io::stderr(), "{}", e).unwrap();
-                std::process::exit(1);
-            }
-            Ok(_) => {}
-        }
+        // winres 0.1.12 writes both metadata maps in randomized iteration order.
+        // Order the generated source before resource compilation, never the PE.
+        let output = std::path::PathBuf::from(std::env::var_os("OUT_DIR").ok_or_else(|| {
+            std::io::Error::new(std::io::ErrorKind::NotFound, "Cargo OUT_DIR is required")
+        })?).join("portable-reproducible.rc");
+        res.write_resource_file(&output)?;
+        let generated = std::fs::read_to_string(&output)?;
+        std::fs::write(&output, resource_order::stable_resource_source(&generated))?;
+        let path = output.to_str().ok_or_else(|| {
+            std::io::Error::new(std::io::ErrorKind::InvalidData, "Resource path is not UTF-8")
+        })?;
+        res.set_resource_file(path).compile()?;
     }
+    Ok(())
 }
diff --git a/libs/portable/generate.py b/libs/portable/generate.py
index d5468a5dc7f..730d2521301 100755
--- a/libs/portable/generate.py
+++ b/libs/portable/generate.py
@@ -3,9 +3,8 @@
 import os
 import optparse
 import subprocess
-from hashlib import md5
+from hashlib import md5, sha256
 import brotli
-import datetime
 
 # 4GB maximum
 length_count = 4
@@ -17,22 +16,24 @@
 
 def generate_md5_table(folder: str, level) -> dict:
     res: dict = dict()
-    curdir = os.curdir
-    os.chdir(folder)
-    for root, _, files in os.walk('.'):
-        # remove ./
-        for f in files:
-            md5_generator = md5()
-            full_path = os.path.join(root, f)
-            print(f"Processing {full_path}...")
-            f = open(full_path, "rb")
-            content = f.read()
-            content_compressed = brotli.compress(
-                content, quality=level)
-            md5_generator.update(content)
-            md5_code = md5_generator.hexdigest().encode(encoding=encoding)
-            res[full_path] = (content_compressed, md5_code)
-    os.chdir(curdir)
+    curdir = os.getcwd()
+    try:
+        os.chdir(folder)
+        for root, directories, files in os.walk('.'):
+            directories.sort()
+            for name in sorted(files):
+                md5_generator = md5()
+                full_path = os.path.join(root, name)
+                print(f"Processing {full_path}...")
+                with open(full_path, "rb") as source:
+                    content = source.read()
+                content_compressed = brotli.compress(
+                    content, quality=level)
+                md5_generator.update(content)
+                md5_code = md5_generator.hexdigest().encode(encoding=encoding)
+                res[full_path] = (content_compressed, md5_code)
+    finally:
+        os.chdir(curdir)
     return res
 
 
@@ -40,7 +41,7 @@ def write_package_metadata(md5_table: dict, output_folder: str, exe: str):
     output_path = os.path.join(output_folder, "data.bin")
     with open(output_path, "wb") as f:
         f.write("rustdesk".encode(encoding=encoding))
-        for path in md5_table.keys():
+        for path in sorted(md5_table):
             (compressed_data, md5_code) = md5_table[path]
             data_length = len(compressed_data)
             path = path.encode(encoding=encoding)
@@ -60,9 +61,18 @@ def write_package_metadata(md5_table: dict, output_folder: str, exe: str):
     print(f"Metadata has been written to {output_path}")
 
 def write_app_metadata(output_folder: str):
+    # The existing runtime reads this field as an extraction-cache identity,
+    # not a wall clock. Keep its wire format and refresh the cache whenever the
+    # packaged payload changes, including between builds with the same version.
+    digest = sha256()
+    with open(os.path.join(output_folder, "data.bin"), "rb") as payload:
+        for chunk in iter(lambda: payload.read(1024 * 1024), b""):
+            digest.update(chunk)
+    cache_identity = (int.from_bytes(digest.digest()[:8], "big") & ((1 << 63) - 1)) or 1
     output_path = os.path.join(output_folder, "app_metadata.toml")
-    with open(output_path, "w") as f:
-        f.write(f"timestamp = {int(datetime.datetime.now().timestamp() * 1000)}\n")
+    with open(output_path, "w", encoding="utf-8", newline="\n") as f:
+        f.write(f"timestamp = {cache_identity}\n")
+        f.write(f"payload_sha256 = {digest.hexdigest()}\n")
     print(f"App metadata has been written to {output_path}")
 
 def build_portable(output_folder: str, target: str):
diff --git a/libs/portable/requirements.txt b/libs/portable/requirements.txt
index ac6cebc8203..71d67b54faf 100644
--- a/libs/portable/requirements.txt
+++ b/libs/portable/requirements.txt
@@ -1 +1 @@
-brotli
\ No newline at end of file
+brotli==1.1.0
diff --git a/libs/portable/resource_order.rs b/libs/portable/resource_order.rs
new file mode 100644
index 00000000000..98d2ff52405
--- /dev/null
+++ b/libs/portable/resource_order.rs
@@ -0,0 +1,77 @@
+//! Stabilize winres-generated metadata before invoking the resource compiler.
+//! Keep each contiguous metadata block separate, including language/translation
+//! blocks, and leave icons, manifests, strings and other source text intact.
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Metadata { Version, Value }
+
+fn metadata(line: &str) -> Option<Metadata> {
+    let line = line.trim_start();
+    if line.starts_with("VALUE ") {
+        Some(Metadata::Value)
+    } else if ["FILEVERSION ", "PRODUCTVERSION ", "FILEFLAGSMASK ", "FILEFLAGS ",
+        "FILEOS ", "FILETYPE ", "FILESUBTYPE "].iter().any(|prefix| line.starts_with(prefix)) {
+        Some(Metadata::Version)
+    } else {
+        None
+    }
+}
+
+pub fn stable_resource_source(source: &str) -> String {
+    let lines: Vec<_> = source.lines().collect();
+    let mut output = String::with_capacity(source.len());
+    let mut start = 0;
+    while start < lines.len() {
+        let mut end = start + 1;
+        if let Some(kind) = metadata(lines[start]) {
+            while end < lines.len() && metadata(lines[end]) == Some(kind) {
+                end += 1;
+            }
+            let mut group = lines[start..end].to_vec();
+            group.sort_unstable();
+            for line in group {
+                output.push_str(line);
+                output.push('\n');
+            }
+        } else {
+            output.push_str(lines[start]);
+            output.push('\n');
+        }
+        start = end;
+    }
+    output
+}
+
+#[cfg(test)]
+mod tests {
+    use super::stable_resource_source;
+
+    #[test]
+    fn generated_metadata_matches_across_map_iteration_orders() {
+        let first = "#pragma code_page(65001)\n1 VERSIONINFO\nPRODUCTVERSION 1, 5, 0, 0\nFILEVERSION 1, 5, 0, 0\nFILEOS 0x40004\n{\nBLOCK \"StringFileInfo\"\n{\nBLOCK \"040904b0\"\n{\nVALUE \"ProductName\", \"RustDesk\"\nVALUE \"LegalCopyright\", \"Copyright © 2026\"\nVALUE \"OriginalFilename\", \"rustdesk.exe\"\n}\n}\nBLOCK \"VarFileInfo\" {\nVALUE \"Translation\", 0x409, 0x04b0\n}\n}\n1 ICON \"../../res/icon.ico\"\n1 24 \"../../res/manifest.xml\"\n\n";
+        let second = first.replace("PRODUCTVERSION 1, 5, 0, 0\nFILEVERSION 1, 5, 0, 0\nFILEOS 0x40004", "FILEOS 0x40004\nFILEVERSION 1, 5, 0, 0\nPRODUCTVERSION 1, 5, 0, 0")
+            .replace("VALUE \"ProductName\", \"RustDesk\"\nVALUE \"LegalCopyright\", \"Copyright © 2026\"\nVALUE \"OriginalFilename\", \"rustdesk.exe\"", "VALUE \"OriginalFilename\", \"rustdesk.exe\"\nVALUE \"ProductName\", \"RustDesk\"\nVALUE \"LegalCopyright\", \"Copyright © 2026\"");
+        assert_ne!(first, second);
+        assert_eq!(stable_resource_source(first), stable_resource_source(&second));
+    }
+
+    #[test]
+    fn keeps_language_and_translation_blocks_separate() {
+        let input = "BLOCK \"040904b0\"\n{\nVALUE \"Z\", \"English\"\nVALUE \"A\", \"English\"\n}\nBLOCK \"040704b0\"\n{\nVALUE \"Z\", \"German\"\nVALUE \"A\", \"German\"\n}\nBLOCK \"VarFileInfo\" {\nVALUE \"Translation\", 0x409, 0x04b0\n}\n";
+        let expected = "BLOCK \"040904b0\"\n{\nVALUE \"A\", \"English\"\nVALUE \"Z\", \"English\"\n}\nBLOCK \"040704b0\"\n{\nVALUE \"A\", \"German\"\nVALUE \"Z\", \"German\"\n}\nBLOCK \"VarFileInfo\" {\nVALUE \"Translation\", 0x409, 0x04b0\n}\n";
+        assert_eq!(stable_resource_source(input), expected);
+    }
+
+    #[test]
+    fn preserves_escaped_values_icons_and_manifest_resources() {
+        let input = "#pragma code_page(65001)\nVALUE \"A\", \"quoted \\\"VALUE text\\\" ©\"\nVALUE \"Z\", \"C:\\\\test\"\n1 ICON \"../../res/icon.ico\"\n1 24\n{\n\" <assembly>VALUE untouched</assembly> \"\n}\n";
+        assert_eq!(stable_resource_source(input), input);
+    }
+
+    #[test]
+    fn ordering_is_idempotent() {
+        let input = "VALUE \"Z\", \"z\"\nVALUE \"A\", \"a\"\n";
+        let ordered = stable_resource_source(input);
+        assert_eq!(stable_resource_source(&ordered), ordered);
+    }
+}
diff --git a/libs/portable/src/bin_reader.rs b/libs/portable/src/bin_reader.rs
index 9effbc5893b..2baa849bafa 100644
--- a/libs/portable/src/bin_reader.rs
+++ b/libs/portable/src/bin_reader.rs
@@ -34,36 +34,36 @@ impl Default for BinaryReader {
 }
 
 impl BinaryData {
-    fn decompress(&self) -> Vec<u8> {
+    fn decompress(&self) -> std::io::Result<Vec<u8>> {
         let cursor = Cursor::new(self.raw);
         let mut decoder = brotli::Decompressor::new(cursor, BUF_SIZE);
         let mut buf = Vec::new();
-        decoder.read_to_end(&mut buf).ok();
-        buf
+        decoder.read_to_end(&mut buf)?;
+        Ok(buf)
     }
 
-    pub fn write_to_file(&self, prefix: &Path) {
+    pub fn write_to_file(&self, prefix: &Path) -> std::io::Result<()> {
         let p = prefix.join(&self.path);
         if let Some(parent) = p.parent() {
             if !parent.exists() {
-                let _ = fs::create_dir_all(parent);
+                fs::create_dir_all(parent)?;
             }
         }
         if p.exists() {
             // check md5
-            let f = fs::read(p.clone()).unwrap_or_default();
+            let f = fs::read(&p)?;
             let digest = format!("{:x}", md5::compute(&f));
             let md5_record = String::from_utf8_lossy(self.md5_code);
             if digest == md5_record {
                 // same, skip this file
                 println!("skip {}", &self.path);
-                return;
+                return Ok(());
             } else {
                 println!("writing {}", p.display());
                 println!("{} -> {}", md5_record, digest)
             }
         }
-        let _ = fs::write(p, self.decompress());
+        fs::write(p, self.decompress()?)
     }
 }
 
@@ -137,3 +137,18 @@ impl BinaryReader {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unusable_existing_runtime_is_an_error_instead_of_launching_stale_bytes() {
+        let root = std::env::temp_dir().join(format!("swan-portable-write-{}", std::process::id()));
+        fs::create_dir_all(root.join("rustdesk.exe")).unwrap();
+        let file = BinaryData { path: "rustdesk.exe".into(), raw: &[], md5_code: b"00000000000000000000000000000000" };
+        assert!(file.write_to_file(&root).is_err());
+        assert!(root.join("rustdesk.exe").is_dir());
+        fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/libs/portable/src/install_wait.rs b/libs/portable/src/install_wait.rs
new file mode 100644
index 00000000000..2f98943c927
--- /dev/null
+++ b/libs/portable/src/install_wait.rs
@@ -0,0 +1,44 @@
+use std::{io,process::Child};
+
+pub fn installation_exit_code(child:io::Result<Child>)->i32 {
+    match child {
+        Ok(mut child)=>match child.wait(){Ok(status)=>status.code().unwrap_or(1),Err(error)=>{eprintln!("Installer wait failed: {error}");1}},
+        Err(error)=>{eprintln!("Installer launch failed: {error}");1},
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn spawn_fixture(code: &str) -> io::Result<Child> {
+        // The standalone rustc test and the application test have different
+        // module prefixes. libtest omits the crate name from both test names.
+        let (_, module) = module_path!().split_once("::").unwrap();
+        std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", &format!("{module}::child_fixture")])
+            .env("SWAN_TEST_INSTALL_CHILD", code)
+            .spawn()
+    }
+    #[test]
+    fn child_fixture(){
+        if let Ok(code)=std::env::var("SWAN_TEST_INSTALL_CHILD") {
+            std::thread::sleep(std::time::Duration::from_millis(100));
+            std::process::exit(code.parse().unwrap());
+        }
+    }
+    #[test]
+    fn waits_for_child_and_preserves_failure_status(){
+        let started=std::time::Instant::now();
+        let child=spawn_fixture("7");
+        assert_eq!(installation_exit_code(child),7);
+        assert!(started.elapsed()>=std::time::Duration::from_millis(100));
+    }
+    #[test]
+    fn completed_child_succeeds_and_missing_executable_fails(){
+        let child=spawn_fixture("0");
+        assert_eq!(installation_exit_code(child),0);
+        let missing=std::env::temp_dir().join(format!("swan-missing-installer-{}.exe",std::process::id()));
+        assert!(!missing.exists());
+        assert_eq!(installation_exit_code(std::process::Command::new(missing).spawn()),1);
+    }
+}
diff --git a/libs/portable/src/main.rs b/libs/portable/src/main.rs
index b7ff44ec55b..c4a9734a076 100644
--- a/libs/portable/src/main.rs
+++ b/libs/portable/src/main.rs
@@ -8,6 +8,8 @@ use std::{
 use bin_reader::BinaryReader;
 
 pub mod bin_reader;
+mod install_wait;
+mod runtime_cache;
 #[cfg(windows)]
 mod ui;
 
@@ -71,7 +73,13 @@ fn setup(
     } else {
         // home dir
         if let Some(dir) = dirs::data_local_dir() {
-            dir.join(APP_PREFIX)
+            match runtime_cache::directory(&dir.join(APP_PREFIX), APP_METADATA) {
+                Ok(directory) => directory,
+                Err(error) => {
+                    eprintln!("Portable runtime cache unavailable: {error}");
+                    return None;
+                }
+            }
         } else {
             eprintln!("not found data local dir");
             return None;
@@ -88,7 +96,10 @@ fn setup(
         std::fs::remove_dir_all(&dir).ok();
     }
     for file in reader.files.iter() {
-        file.write_to_file(&dir);
+        if let Err(error) = file.write_to_file(&dir) {
+            eprintln!("Portable runtime extraction failed for {}: {error}", file.path);
+            return None;
+        }
     }
     write_meta(&dir, ts);
     #[cfg(windows)]
@@ -133,6 +144,7 @@ fn is_windows_7() -> bool {
 }
 
 fn execute(path: PathBuf, args: Vec<String>, _ui: bool) {
+    let wait_for_install=args.iter().any(|argument|argument=="--silent-install");
     println!("executing {}", path.display());
     // setup env
     let exe = std::env::current_exe().unwrap_or_default();
@@ -160,6 +172,10 @@ fn execute(path: PathBuf, args: Vec<String>, _ui: bool) {
             .stderr(Stdio::inherit());
     }
     let _child = cmd.spawn();
+    if wait_for_install {
+        let code=install_wait::installation_exit_code(_child);
+        std::process::exit(code);
+    }
 
     #[cfg(windows)]
     if _ui {
@@ -207,6 +223,8 @@ fn main() {
             args = vec!["--quick_support".to_owned()];
         }
         execute(exe, args, ui);
+    } else {
+        std::process::exit(1);
     }
 }
 
diff --git a/libs/portable/src/runtime_cache.rs b/libs/portable/src/runtime_cache.rs
new file mode 100644
index 00000000000..b3486846bd5
--- /dev/null
+++ b/libs/portable/src/runtime_cache.rs
@@ -0,0 +1,46 @@
+use std::{io, path::{Path, PathBuf}};
+
+pub fn directory(root: &Path, metadata: &[u8]) -> io::Result<PathBuf> {
+    let text = std::str::from_utf8(metadata)
+        .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
+    let digest = text.lines().find_map(|line| line.strip_prefix("payload_sha256 = "))
+        .filter(|value| value.len() == 64 && value.bytes().all(|byte| byte.is_ascii_hexdigit()))
+        .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidData, "Portable payload identity missing or invalid"))?;
+    Ok(root.join(format!("payload-{}", digest.to_ascii_lowercase())))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn new_payload_does_not_reuse_running_previous_runtime() {
+        let root = std::env::temp_dir().join(format!("swan-runtime-cache-{}", std::process::id()));
+        let old = directory(&root, format!("payload_sha256 = {}\n", "a".repeat(64)).as_bytes()).unwrap();
+        let new = directory(&root, format!("payload_sha256 = {}\n", "b".repeat(64)).as_bytes()).unwrap();
+        std::fs::create_dir_all(&old).unwrap();
+        std::fs::write(old.join("rustdesk.exe"), b"previous runtime still in use").unwrap();
+        let mut options = std::fs::OpenOptions::new();
+        options.read(true);
+        #[cfg(windows)] {
+            use std::os::windows::fs::OpenOptionsExt;
+            options.share_mode(0);
+        }
+        let held = options.open(old.join("rustdesk.exe")).unwrap();
+        std::fs::create_dir_all(&new).unwrap();
+        std::fs::write(new.join("rustdesk.exe"), b"current runtime").unwrap();
+        assert_ne!(old, new);
+        assert_eq!(std::fs::read(new.join("rustdesk.exe")).unwrap(), b"current runtime");
+        drop(held);
+        assert_eq!(std::fs::read(old.join("rustdesk.exe")).unwrap(), b"previous runtime still in use");
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn missing_or_unsafe_identity_fails_closed() {
+        for text in ["timestamp = 123\n", "payload_sha256 = ../old", "payload_sha256 = ", "payload_sha256 = xx"] {
+            assert!(directory(Path::new("cache"), text.as_bytes()).is_err());
+        }
+        assert!(directory(Path::new("cache"), &[0xff]).is_err());
+    }
+}
diff --git a/libs/portable/test_generate.py b/libs/portable/test_generate.py
new file mode 100644
index 00000000000..4ad41d33a95
--- /dev/null
+++ b/libs/portable/test_generate.py
@@ -0,0 +1,78 @@
+import importlib.util
+import hashlib
+import os
+from pathlib import Path
+import re
+import tempfile
+import unittest
+from unittest.mock import patch
+
+
+spec = importlib.util.spec_from_file_location("portable_generator", Path(__file__).with_name("generate.py"))
+generator = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(generator)
+
+
+class PortablePackageTests(unittest.TestCase):
+    def test_cache_identity_follows_payload_without_wall_clock_or_file_times(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            payload = root / "data.bin"
+            payload.write_bytes(b"first complete application payload")
+            generator.write_app_metadata(directory)
+            first = (root / "app_metadata.toml").read_bytes()
+            payload.touch()
+            generator.write_app_metadata(directory)
+            self.assertEqual(first, (root / "app_metadata.toml").read_bytes())
+            payload.write_bytes(b"changed complete application payload")
+            generator.write_app_metadata(directory)
+            second = (root / "app_metadata.toml").read_bytes()
+            self.assertNotEqual(first, second)
+            for value in (first, second):
+                match = re.fullmatch(rb"timestamp = ([1-9][0-9]*)\npayload_sha256 = ([a-f0-9]{64})\n", value)
+                self.assertIsNotNone(match)
+                self.assertLessEqual(int(match[1]), (1 << 63) - 1)
+            self.assertIn(hashlib.sha256(payload.read_bytes()).hexdigest().encode(), second)
+
+    def test_package_bytes_and_cache_identity_ignore_dictionary_insertion_order(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            entries = {"./z.dll": (b"compressed-z", b"0" * 32), "./a.exe": (b"compressed-a", b"1" * 32)}
+            generator.write_package_metadata(entries, directory, "./a.exe")
+            generator.write_app_metadata(directory)
+            first = ((root / "data.bin").read_bytes(), (root / "app_metadata.toml").read_bytes())
+            generator.write_package_metadata(dict(reversed(list(entries.items()))), directory, "./a.exe")
+            generator.write_app_metadata(directory)
+            self.assertEqual(first, ((root / "data.bin").read_bytes(), (root / "app_metadata.toml").read_bytes()))
+
+    def test_real_payload_compression_and_executable_selection_remain_bound(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            source = root / "source"
+            source.mkdir()
+            (source / "app.exe").write_bytes(b"application bytes")
+            (source / "assets").mkdir()
+            (source / "assets" / "brand.txt").write_bytes(b"company branding")
+            table = generator.generate_md5_table(str(source), 1)
+            self.assertEqual(len(table), 2)
+            for compressed, _ in table.values():
+                self.assertIn(generator.brotli.decompress(compressed), (b"application bytes", b"company branding"))
+            generator.write_package_metadata(table, directory, "./app.exe")
+            generator.write_app_metadata(directory)
+            first = (root / "app_metadata.toml").read_bytes()
+            generator.write_package_metadata(table, directory, "./another.exe")
+            generator.write_app_metadata(directory)
+            self.assertNotEqual(first, (root / "app_metadata.toml").read_bytes())
+
+    def test_failed_compression_restores_the_callers_directory(self):
+        with tempfile.TemporaryDirectory() as directory:
+            (Path(directory) / "app.exe").write_bytes(b"application bytes")
+            previous = os.getcwd()
+            with patch.object(generator.brotli, "compress", side_effect=RuntimeError("compression failed")):
+                with self.assertRaisesRegex(RuntimeError, "compression failed"):
+                    generator.generate_md5_table(directory, 1)
+            self.assertEqual(previous, os.getcwd())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/product/Cargo.lock b/product/Cargo.lock
new file mode 100644
index 00000000000..2f929632515
--- /dev/null
+++ b/product/Cargo.lock
@@ -0,0 +1,2342 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "base32"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022dfe9eb35f19ebbcb51e0b40a5ab759f46ad60cadf7297e0bd085afb50e076"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f360145194ee8e21db5ee7f3fcd4fe52210864c75c985dae33218202c8bbe040"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.6.4",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "hashlink"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-native-certs",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "httparse",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "js-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
+dependencies = [
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.3",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+dependencies = [
+ "bitflags",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "swan-agent"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "fs2",
+ "hex",
+ "rand 0.8.8",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "swan-protocol",
+ "tokio",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "swan-management"
+version = "0.1.0"
+dependencies = [
+ "aead",
+ "aes-gcm",
+ "anyhow",
+ "argon2",
+ "axum",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "fs2",
+ "hex",
+ "http-body-util",
+ "rand 0.8.8",
+ "reqwest",
+ "rusqlite",
+ "serde",
+ "serde_json",
+ "sha2",
+ "swan-agent",
+ "swan-protocol",
+ "tokio",
+ "totp-rs",
+ "tower",
+ "tower-http",
+ "uuid",
+ "windows-service",
+ "windows-sys 0.61.2",
+ "zip",
+]
+
+[[package]]
+name = "swan-protocol"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "hex",
+ "rand 0.8.8",
+ "serde",
+ "serde_json",
+ "sha2",
+ "url",
+]
+
+[[package]]
+name = "swan-worker"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "reqwest",
+ "serde_json",
+ "swan-agent",
+ "swan-protocol",
+ "tokio",
+ "windows-service",
+ "windows-sys 0.61.2",
+ "zip",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "totp-rs"
+version = "5.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50e69a15e21b2ff22c415446983978bded3244195f17d59cb113551c1e806f91"
+dependencies = [
+ "base32",
+ "constant_time_eq",
+ "hmac",
+ "rand 0.9.5",
+ "sha1",
+ "sha2",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
+dependencies = [
+ "js-sys",
+ "tokio",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.129"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-service"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "857224b3b211c6f3616921f081ee54721ee3ad2ace2fac6a6337e032f7b4dcf2"
+dependencies = [
+ "bitflags",
+ "widestring",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "zip"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "displaydoc",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "thiserror",
+ "zopfli",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
diff --git a/product/Cargo.toml b/product/Cargo.toml
new file mode 100644
index 00000000000..a1f6b1fa82f
--- /dev/null
+++ b/product/Cargo.toml
@@ -0,0 +1,23 @@
+[workspace]
+members = ["protocol", "management", "agent", "worker"]
+resolver = "2"
+
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "AGPL-3.0-only"
+rust-version = "1.90"
+
+[workspace.dependencies]
+anyhow = "1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+base64 = "0.22"
+ed25519-dalek = { version = "2", features = ["rand_core"] }
+rand = "0.8"
+sha2 = "0.10"
+hex = "0.4"
+url = "2"
+uuid = { version = "1", features = ["v4", "serde"] }
+tokio = { version = "1", features = ["full"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots", "blocking"] }
diff --git a/product/README.md b/product/README.md
new file mode 100644
index 00000000000..a8dac39b8a1
--- /dev/null
+++ b/product/README.md
@@ -0,0 +1,114 @@
+# Swan Remote Support company product
+
+Development implementation, not a production release. The original single-company application is preserved at tag `swan-single-company-baseline-1.4.9`.
+
+Each company hosts one independent deployment. The management service uses Axum and SQLite, with an embedded administration interface. Pinned RustDesk OSS rendezvous and relay services carry transport; receiving managed applications enforce company authorization regardless of transport. The project supplies source and releases, not shared hosting or private signing keys.
+
+## Build
+
+Install Rust 1.90.0 and the platform C linker. From the repository root:
+
+```
+cargo +1.90.0 test --manifest-path product/Cargo.toml --workspace --locked
+cargo +1.90.0 build --manifest-path product/Cargo.toml --workspace --release --locked
+```
+
+Windows production builds use MSVC. GNU compilation has verified the product components on the local development machine. Native endpoint builds additionally require the pinned Flutter and vcpkg dependencies in `.github/workflows/swan-windows-build.yml`; the company-product CI separately checks Windows and Linux management components. The root application enables management integration with the `swan_custom` feature.
+
+The Windows native workflow installs Flutter 3.24.5 with
+`deployment/windows/install-pinned-flutter.ps1`. It verifies the exact archive
+SHA-256 from the [official Windows release manifest](https://storage.googleapis.com/flutter_infra_release/releases/releases_windows.json),
+then checks the framework and engine revisions before exporting the SDK path.
+It never resolves the latest stable version. `flutter-sdk-identity.json` is
+retained with both native artifact sets. For an offline build, pass `-Archive`
+with the same official ZIP; its hash is still mandatory. Use a fresh destination
+directory and PowerShell 7. The independently pinned source-engine selector
+continues to verify the matching SDK snapshot compiler before replacing runtime
+files.
+
+After SDK precaching, native builds run
+`python deployment/windows/patch-flutter-client-wrapper.py --sdk SDK_DIRECTORY --receipt artifacts/flutter-client-wrapper-repro.json`.
+It verifies the reviewed upstream client-wrapper source hash before replacing
+one anonymous reply callable with an equivalent named type. The named callable
+keeps MSVC source paths out of its RTTI identity. Engine binaries are unchanged.
+The upstream source fixture and BSD license are included under
+`deployment/windows/fixtures/flutter-sdk-3.24.5/`; the patch script and its receipt
+are retained with corresponding source and build artifacts. Unknown source or
+SDK revisions fail closed. Independent comparison checks the receipt against
+the archived public patch inputs as well as all original shipping bytes.
+The standalone compiler/callback checks do not replace complete native rebuild
+comparison or installed runtime qualification.
+
+Native CI also retains `native-msvc-toolchain.json`: hashes of the default x64
+MSVC compiler, headers and libraries, sorted ordinally for a portable identity.
+Independent comparisons require and validate this record when the pinned source
+contains its capture script. A shared toolset directory or Visual Studio version
+label does not establish identical inputs. This record does not yet pin Windows
+SDK files or prove which compiler commands CMake executed; preserve that
+limitation in release evidence. Reproducibility still requires matching original
+shipping bytes, not normalized binaries or matching compiler labels alone.
+
+The Windows release workflow now requires fresh compiled outputs and builds
+native dependencies with compiled binary caches disabled. It does not restore
+Rust target outputs. This makes the source-build input boundary explicit; it
+does not establish the cause of an older mismatch. Before endpoint compilation,
+`Capture-NativeAomInputs.ps1` retains the actual pinned AV1 source unit, release
+object, installed static library, generated compiler commands and hashes of
+headers actually used by MSVC. Upstream attribution accompanies the library.
+The build also verifies that the installed library stayed unchanged and that
+the bundled native DLL matches the original compiled DLL. These records are
+under `native-aom-inputs/` in the unsigned artifacts. Independent comparison of
+all original shipping outputs and runtime qualification remain mandatory.
+The x64 release requests only its Flutter 3.22.3-generated bridge, used with the
+pinned 3.24.5 SDK. It does not wait for the separate upstream Flutter 3.44 ARM64
+bridge. Other shared-workflow callers retain both bridge jobs by default.
+
+
+Successful company-product CI jobs export `CompanyComponents-<runner>-UNSIGNED-TEST`
+artifacts containing the management service, configuration agent and worker,
+their SHA-256 values, compiler/source revision metadata and a source-input archive.
+The archive preserves tracked component, branding and deployment inputs with their
+actual build-time bytes; private environment files and desktop bridge generation
+are excluded. Rebuild from its `source/` folder using the commands above. These
+are unsigned verification inputs, not production releases or complete desktop
+installation bundles. The installer worker still requires Windows.
+
+## Implemented development flows
+
+- One-time setup, local password/TOTP authentication with replay checks, administrator and technician roles, group access, pending device enrollment, revocation and auditing.
+- Signed company profiles, pinned HTTPS bootstrap, profile refresh, local consent revocation and short-lived, target-bound session grants with challenge proof and authorization leases.
+- Outbound authenticated worker jobs producing ZIP installation bundles from unchanged, hash-checked, Authenticode-verified release artifacts. Public customer downloads and authenticated technician downloads.
+- Company release import and approval, stable/test selection, staged cohorts, pause and UTC maintenance windows. Endpoint updater checks signatures, hashes, publisher and installed executable identity, and excludes sessions during installation.
+- Encrypted management backup and empty-directory restore.
+
+The shared first-run web setup collects branding for both endpoint editions and
+the initial unattended-support and update policy alongside network and
+administrator MFA settings. The same fields remain editable under Branding &
+policies after setup. New devices still require company approval, and unattended
+support requires separate customer consent.
+
+Installers contain public bootstrap information only. The worker pins both profile and project release verification keys locally. Release metadata must include package, installed executable and agent SHA-256 identities, exact source URL, publisher, signing-certificate SHA-256 and supported Windows families. No profile value becomes a shell command.
+
+Install management and installer workers from matching project releases. Before
+requesting work, a worker authenticates to the server's recipe endpoint and checks
+the versioned digest of the fixed ZIP layout and normalized bundled script/license
+bytes. The claim request repeats this digest; a mismatch returns HTTP 409 before
+claiming or recovering jobs. Older workers without the digest cannot claim on a
+new server, and a new worker declines an older server without the recipe endpoint.
+This compatibility check leaves jobs queued for a matching worker and reports the
+mismatch in its protected log. Upload signature, hash and exact-content validation
+remain mandatory; the recipe digest does not authorize different scripts.
+
+The native Flutter technician home includes company branding, MFA login, authorized inventory, attended/unattended connection requests and session history. Its Rust broker retains tokens and proof keys in memory and consumes the selected peer's ticket during the transport challenge. Native source `c0bf4b4` passed standard-user graphical MFA, inventory/history, customer refusal, periodic name synchronization, logout and offline cached-branding/login-refusal checks on the isolated Server 2016 lab. That portable fixture used the existing company service and older customer on the same VM; full company installation, accepted remote control, cross-machine operation and signed automatic-update handoff still require end-to-end validation. See the dated acceptance report for exact artifacts and scope.
+
+The updater writes `pending-update.json` before installation and advances the sequence only after verifying the complete signed installed payload and agent. A staged, publisher-verified replacement agent performs installation and replaces the configuration agent while retaining session exclusion. Pending receipts support delayed retries; an already registered MSI uses forced repair. `swan-agent recover-update` completes recovery only when the signed installed identity matches. These paths compile and have component trust tests; actual signed self-replacement, interrupted installation and scheduled-task restart remain unverified. Full rollback and automatic technician GUI shutdown/handoff remain incomplete.
+
+## Deployment and release gates
+
+See `deployment/windows/LOCAL-TESTING.md` for this machine's isolated test process. Windows service installation is in `deployment/windows/Install-Server.ps1`; Linux container definitions are in `deployment/linux/`. Management must sit behind trusted HTTPS before endpoint use. Companies supply DNS and publicly reachable transport or their own relay. Local tests do not prove internet reachability, NAT traversal or relay fallback.
+
+The pinned WiX recipes build real unsigned customer and technician MSIs locally. The customer package includes the full Flutter payload, service, Windows-owned runtime broker copy, license and configuration agent. Company bootstrap remains an explicit setup input. Build and table inspection do not prove installation or service behavior.
+
+The first published endpoint release targets **Windows 11 x64 only**. Windows 10 and Windows Server 2016/2019/2022/2025 Desktop Experience are deferred; historical lab results do not advertise support for them. Company servers still support the planned Linux and Windows deployment paths. Finish and qualify the existing product on Windows 11 before expanding the endpoint OS matrix. Public direct/relay connectivity without Tailscale, complete installer/update recovery, current end-to-end security checks and valid production signing remain release gates. See `docs/RELEASE-READINESS.md` for the current release path, `docs/ACCEPTANCE.md` for scoped evidence and `deployment/windows/VM-TESTING.md` for the evaluation lab.
+
+Never publish this development build as production. Signing-provider approval, valid production signatures, exact corresponding AGPL source and all acceptance checks are mandatory release gates. Retain RustDesk attribution and license notices when distributing changed binaries or hosting modified server code.
diff --git a/product/agent/Cargo.toml b/product/agent/Cargo.toml
new file mode 100644
index 00000000000..d7ee52250ed
--- /dev/null
+++ b/product/agent/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+workspace = ".."
+name = "swan-agent"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+swan-protocol = { path = "../protocol" }
+anyhow.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+base64.workspace = true
+ed25519-dalek.workspace = true
+rand.workspace = true
+reqwest.workspace = true
+tokio.workspace = true
+sha2.workspace = true
+hex.workspace = true
+axum = "0.8"
+fs2 = "0.4"
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Storage_FileSystem", "Win32_System_SystemInformation"] }
diff --git a/product/agent/src/lib.rs b/product/agent/src/lib.rs
new file mode 100644
index 00000000000..1afc12f1641
--- /dev/null
+++ b/product/agent/src/lib.rs
@@ -0,0 +1,470 @@
+use anyhow::{ensure, Context, Result};
+use base64::{engine::general_purpose::STANDARD, Engine};
+use ed25519_dalek::SigningKey;
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+use std::path::{Path, PathBuf};
+use swan_protocol::*;
+pub use swan_protocol as protocol;
+pub mod update;
+pub mod payload;
+pub mod technician;
+pub mod reporting;
+pub mod technician_runtime;
+#[cfg(any(windows,test))]
+mod verifier_process;
+
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Bootstrap {
+    pub schema:u32,
+    pub edition:Edition,
+    pub company_id:String,
+    pub management_url:String,
+    pub profile_public_key:String,
+    pub release_public_key:String,
+}
+impl Bootstrap {
+    pub fn validate(&self)->Result<()> {
+        ensure!(self.schema==SCHEMA && !self.company_id.is_empty(),"Invalid bootstrap");
+        https_url(&self.management_url)?;public_key(&self.profile_public_key)?;
+        if !self.release_public_key.is_empty(){public_key(&self.release_public_key)?;}
+        Ok(())
+    }
+}
+
+#[derive(Clone,Serialize,Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct AgentState {
+    pub bootstrap:Bootstrap,
+    pub profile:SignedEnvelope,
+    pub accepted_revision:u64,
+    pub device_id:Option<String>,
+    pub device_token:Option<String>,
+    pub unattended_consent:bool,
+    #[serde(default)]
+    pub consent_revision:u64,
+    pub last_release_sequence:u64,
+}
+impl AgentState {
+    pub fn validate_installer_bootstrap(&self,input:&Bootstrap)->Result<()> {
+        input.validate()?;let profile=self.company_profile()?;
+        ensure!(input.company_id==self.bootstrap.company_id && input.edition==self.bootstrap.edition,"Installer belongs to another company or edition");
+        ensure!(input.profile_public_key==self.bootstrap.profile_public_key && input.release_public_key==self.bootstrap.release_public_key,"Installer cannot replace configured trust keys");
+        ensure!(input.management_url.trim_end_matches('/')==profile.management_url.trim_end_matches('/'),"Installer endpoint differs from trusted company configuration");
+        Ok(())
+    }
+    pub fn load(directory:&Path)->Result<Self> {
+        let state=Self::load_for_refresh(directory)?;
+        state.company_profile()?;
+        Ok(state)
+    }
+    // Expired cached policy may fetch a replacement, but cannot authorize sessions.
+    pub fn load_for_refresh(directory:&Path)->Result<Self> {
+        let state:Self=serde_json::from_slice(&std::fs::read(directory.join("managed-state.json"))?)?;
+        state.bootstrap.validate()?;
+        state.cached_profile()?;
+        Ok(state)
+    }
+    pub fn save(&self,directory:&Path)->Result<()> {
+        self.save_internal(directory,None)
+    }
+    pub fn set_local_consent(&mut self,directory:&Path,enabled:bool)->Result<()> {
+        ensure!(self.bootstrap.edition==Edition::Customer,"Customer consent is required");
+        ensure!(self.device_id.is_some(),"Device enrollment required");
+        ensure!(!enabled || self.company_profile()?.allow_unattended,"Company disallows unattended support");
+        self.save_internal(directory,Some(enabled))?;
+        *self=Self::load_for_refresh(directory)?;Ok(())
+    }
+    fn save_internal(&self,directory:&Path,consent_change:Option<bool>)->Result<()> {
+        self.bootstrap.validate()?;self.cached_profile()?;
+        std::fs::create_dir_all(directory)?;
+        #[cfg(unix)] {use std::os::unix::fs::PermissionsExt; std::fs::set_permissions(directory,std::fs::Permissions::from_mode(0o700))?;}
+        let path=directory.join("managed-state.json");
+        use fs2::FileExt;
+        let lock=std::fs::OpenOptions::new().create(true).read(true).write(true).open(directory.join("state.lock"))?;
+        lock.lock_exclusive()?;
+        let mut saved=self.clone();
+        if path.exists(){
+            let existing:AgentState=serde_json::from_slice(&std::fs::read(&path)?)?;
+            existing.bootstrap.validate()?;let existing_profile=existing.cached_profile()?;
+            ensure!(existing.bootstrap.company_id==self.bootstrap.company_id,"Cannot change company ownership");
+            ensure!(existing.bootstrap.edition==self.bootstrap.edition,"Cannot change installed edition");
+            ensure!(existing.bootstrap.release_public_key==self.bootstrap.release_public_key,"Cannot silently replace the release trust key");
+            ensure!(existing.bootstrap.profile_public_key==self.bootstrap.profile_public_key || existing_profile.next_profile_public_key.as_ref()==Some(&self.bootstrap.profile_public_key),"Profile key rotation requires the previously trusted signed profile");
+            ensure!(existing.accepted_revision<=self.accepted_revision,"A newer profile has already been saved");
+            saved.last_release_sequence=saved.last_release_sequence.max(existing.last_release_sequence);
+            if let Some(id)=existing.device_id.as_ref(){
+                ensure!(consent_change!=Some(true) || self.consent_revision==existing.consent_revision,"Consent changed while enable request was pending; confirm again");
+                ensure!(consent_change.is_some() || self.consent_revision<=existing.consent_revision,"Consent revision changes require explicit customer consent");
+                ensure!(self.device_id.as_ref().map(|value|value==id).unwrap_or(true),"Cannot replace enrolled device identity");
+                ensure!(self.device_token.as_ref().map(|value|Some(value)==existing.device_token.as_ref()).unwrap_or(true),"Cannot replace enrolled device credential");
+                if self.device_id.is_none() || self.consent_revision<existing.consent_revision {saved.unattended_consent=existing.unattended_consent;}
+                if self.consent_revision==existing.consent_revision && !existing.unattended_consent {saved.unattended_consent=false;}
+                saved.consent_revision=existing.consent_revision;
+                if let Some(enabled)=consent_change {
+                    saved.consent_revision=existing.consent_revision.checked_add(1).context("Consent revision exhausted")?;
+                    saved.unattended_consent=enabled;
+                }
+                saved.device_id=existing.device_id;saved.device_token=existing.device_token;
+            }
+        }
+        let temporary=directory.join(format!("state-{}.tmp",random_token()));
+        use std::io::Write;
+        let mut options=std::fs::OpenOptions::new();options.write(true).create_new(true);
+        #[cfg(unix)] {use std::os::unix::fs::OpenOptionsExt;options.mode(0o600);}
+        let mut file=options.open(&temporary)?;file.write_all(&serde_json::to_vec_pretty(&saved)?)?;file.sync_all()?;
+        drop(file);
+        replace_state(&temporary,&path)?;Ok(())
+    }
+    pub fn company_profile(&self)->Result<CompanyProfile> {
+        let p=self.cached_profile()?;
+        p.validate(&self.bootstrap.company_id,self.accepted_revision,now())?;
+        Ok(p)
+    }
+    /// Signed cached branding may still be displayed offline. This is never an
+    /// authorization policy; company_profile() remains mandatory for access.
+    pub fn display_profile(&self)->Result<CompanyProfile> {self.cached_profile()}
+    fn cached_profile(&self)->Result<CompanyProfile> {
+        let p:CompanyProfile=self.profile.verify(&public_key(&self.bootstrap.profile_public_key)?)?;
+        // Expiration blocks use, but a previously signed rotation key remains a
+        // trust anchor for obtaining fresh policy after a long offline period.
+        p.validate(&self.bootstrap.company_id,self.accepted_revision,now().min(p.expires_at.saturating_sub(1)))?;
+        Ok(p)
+    }
+    pub fn client(&self)->Result<reqwest::Client> {
+        http_client(15,false)
+    }
+    pub fn endpoint(&self,path:&str)->Result<String> {
+        self.bootstrap.validate()?;
+        Ok(format!("{}/api/v1/{path}",self.bootstrap.management_url.trim_end_matches('/')))
+    }
+    pub async fn sync(&mut self)->Result<()> {
+        let envelope:SignedEnvelope=self.client()?.get(self.endpoint("profile")?).send().await?.error_for_status()?.json().await?;
+        let key=public_key(&self.bootstrap.profile_public_key)?;
+        let profile:CompanyProfile=match envelope.verify(&key){
+            Ok(p)=>p,
+            Err(error)=>{
+                let old=self.cached_profile()?;
+                let next=old.next_profile_public_key.as_ref().context("Profile signature invalid and no trusted key rotation")?;
+                let p=envelope.verify(&public_key(next)?)?;
+                // Commit the new pin only after every validation succeeds below.
+                let _:anyhow::Error=error;
+                p
+            }
+        };
+        profile.validate(&self.bootstrap.company_id,self.accepted_revision,now())?;
+        if envelope.verify::<CompanyProfile>(&key).is_err(){
+            self.bootstrap.profile_public_key=self.cached_profile()?.next_profile_public_key.context("Missing rotation key")?;
+        }
+        self.bootstrap.management_url=profile.management_url.clone();
+        self.accepted_revision=profile.revision;self.profile=envelope;
+        Ok(())
+    }
+    pub async fn enroll(&mut self,name:&str,rustdesk_id:&str,consent:bool)->Result<()> {
+        ensure!(self.bootstrap.edition==Edition::Customer,"Only customer edition enrolls devices");
+        let profile=self.company_profile()?;
+        if let Some(device)=self.device_id.as_ref() {
+            // Repair validates existing ownership instead of issuing new identity
+            // or changing consent merely because setup was run again.
+            let status:Value=self.client()?.get(self.endpoint("device/status")?).bearer_auth(self.device_token.as_ref().context("Missing enrolled credential")?).send().await?.error_for_status()?.json().await?;
+            ensure!(status["company_id"].as_str()==Some(self.bootstrap.company_id.as_str()) && status["device_id"].as_str()==Some(device.as_str()) && status["rustdesk_id"].as_str()==Some(rustdesk_id),"Repair cannot replace company enrollment or transport identity");
+            ensure!(matches!(status["state"].as_str(),Some("pending"|"approved")),"Device requires company administrator intervention");
+            return Ok(());
+        }
+        ensure!(!consent || profile.allow_unattended,"Company has disabled unattended access");
+        let result:Value=self.client()?.post(self.endpoint("enroll")?).json(&json!({"name":name,"rustdesk_id":rustdesk_id,"unattended_consent":consent})).send().await?.error_for_status()?.json().await?;
+        ensure!(result["company_id"].as_str()==Some(self.bootstrap.company_id.as_str()),"Wrong company enrollment response");
+        self.device_id=Some(result["device_id"].as_str().context("Missing device identity")?.into());
+        self.device_token=Some(result["device_token"].as_str().context("Missing device credential")?.into());
+        self.unattended_consent=consent;Ok(())
+    }
+    pub async fn consent(&mut self,enabled:bool)->Result<()> {
+        // Local revoke takes effect even if the server is unavailable.
+        if !enabled {self.unattended_consent=false;}
+        ensure!(!enabled || self.company_profile()?.allow_unattended,"Company disallows unattended support");
+        let revision=if enabled {self.consent_revision.checked_add(1).context("Consent revision exhausted")?}else{self.consent_revision};
+        self.client()?.put(self.endpoint("device/consent")?).bearer_auth(self.device_token.as_ref().context("Not enrolled")?).json(&json!({"unattended":enabled,"revision":revision})).send().await?.error_for_status()?;
+        self.unattended_consent=enabled;Ok(())
+    }
+    pub async fn request_grant(&self,token:&str,device:&str,unattended:bool,key:&SigningKey)->Result<SignedEnvelope> {
+        ensure!(self.bootstrap.edition==Edition::Technician,"Technician edition required");
+        self.company_profile()?;
+        let grant:SignedEnvelope=self.client()?.post(self.endpoint("grants")?).bearer_auth(token).json(&json!({"device_id":device,"proof_public_key":STANDARD.encode(key.verifying_key().as_bytes()),"unattended":unattended})).send().await?.error_for_status()?.json().await?;
+        let parsed:SessionGrant=grant.verify(&public_key(&self.bootstrap.profile_public_key)?)?;
+        parsed.validate(&self.bootstrap.company_id,device,&parsed.rustdesk_id,now())?;
+        ensure!(parsed.proof_public_key==STANDARD.encode(key.verifying_key().as_bytes()) && parsed.unattended==unattended,"Grant differs from requested proof or consent mode");
+        Ok(grant)
+    }
+    pub async fn claim(&self,login:&ManagedLogin,challenge:&str,peer:&str)->Result<Lease> {
+        let activity=lock_session(&state_directory())?;
+        ensure!(self.bootstrap.edition==Edition::Customer,"Customer edition required");
+        let profile=self.company_profile()?;
+        let grant:SessionGrant=login.grant.verify(&public_key(&self.bootstrap.profile_public_key)?)?;
+        grant.validate(&self.bootstrap.company_id,self.device_id.as_ref().context("Not enrolled")?,peer,now())?;
+        login.verify_proof(&grant,challenge)?;
+        ensure!(!grant.unattended || (self.unattended_consent && profile.allow_unattended),"Unattended consent required");
+        let result:Value=self.client()?.post(self.endpoint("grants/claim")?).bearer_auth(self.device_token.as_ref().context("Not enrolled")?).json(&json!({"grant":login.grant})).send().await?.error_for_status()?.json().await?;
+        let expires=result["lease_until"].as_u64().context("Missing lease expiry")?;
+        ensure!(expires>now() && expires<=now()+310,"Invalid session lease");
+        let technician_name=claimed_technician_name(&result,&grant.technician_id)?;
+        Ok(Lease { grant_id:grant.grant_id,technician_name,unattended:grant.unattended,permissions:grant.permissions,expires_at:expires,last_renewed:now(),_activity:activity })
+    }
+    pub async fn renew(&self,lease:&mut Lease)->Result<()> {
+        let remaining=lease.expires_at.checked_sub(now()).filter(|seconds|*seconds>0).context("Session authorization expired")?;
+        let profile=self.company_profile()?;
+        ensure!(!lease.unattended || (self.unattended_consent && profile.allow_unattended),"Unattended consent or company permission revoked");
+        let result:Value=self.client()?.post(self.endpoint(&format!("grants/{}/renew",lease.grant_id))?).timeout(std::time::Duration::from_secs(remaining.min(15))).bearer_auth(self.device_token.as_ref().context("Not enrolled")?).send().await?.error_for_status()?.json().await?;
+        let expires=result["lease_until"].as_u64().context("Missing lease expiry")?;
+        validate_lease_renewal(lease.expires_at,expires,now())?;
+        lease.expires_at=expires;lease.last_renewed=now();Ok(())
+    }
+    pub async fn close(&self,grant_id:&str)->Result<()> {
+        self.client()?.post(self.endpoint(&format!("grants/{grant_id}/close"))?).bearer_auth(self.device_token.as_ref().context("Not enrolled")?).send().await?.error_for_status()?;Ok(())
+    }
+}
+
+fn claimed_technician_name(response:&Value,technician_id:&str)->Result<String> {
+    ensure!(!technician_id.is_empty() && technician_id.len()<=128 && technician_id.bytes().all(|b|b.is_ascii_alphanumeric() || b"._-@".contains(&b)),"Invalid authenticated technician identity");
+    // Older company servers do not return a username. The signed grant still
+    // identifies the account; never replace it with the peer's untrusted name.
+    let Some(identity)=response.get("technician") else {return Ok(format!("Company technician ({technician_id})"));};
+    ensure!(identity["id"].as_str()==Some(technician_id),"Claim returned a different technician");
+    let username=identity["username"].as_str().context("Missing authenticated technician name")?;
+    ensure!(username.len()>=3 && username.len()<=64 && username.bytes().all(|b|b.is_ascii_alphanumeric() || b"._-@".contains(&b)),"Invalid authenticated technician name");
+    Ok(username.to_owned())
+}
+
+fn validate_lease_renewal(previous_expiry:u64,new_expiry:u64,current:u64)->Result<()> {
+    // An in-flight response cannot resurrect authorization after the device's
+    // existing lease expired, even when its proposed new expiry is valid.
+    ensure!(current<previous_expiry,"Session authorization expired");
+    ensure!(new_expiry>current && new_expiry<=current.saturating_add(310),"Invalid session lease");
+    Ok(())
+}
+
+fn replace_state(temporary:&Path,path:&Path)->Result<()> {
+    #[cfg(windows)] {
+        use std::os::windows::ffi::OsStrExt;
+        use windows_sys::Win32::Storage::FileSystem::{MoveFileExW,MOVEFILE_REPLACE_EXISTING,MOVEFILE_WRITE_THROUGH};
+        let from:Vec<u16>=temporary.as_os_str().encode_wide().chain(Some(0)).collect();
+        let to:Vec<u16>=path.as_os_str().encode_wide().chain(Some(0)).collect();
+        // Replace without deleting the valid state first; a crash retains old or new.
+        if unsafe{MoveFileExW(from.as_ptr(),to.as_ptr(),MOVEFILE_REPLACE_EXISTING|MOVEFILE_WRITE_THROUGH)}==0 {return Err(std::io::Error::last_os_error().into());}
+        Ok(())
+    }
+    #[cfg(not(windows))] {std::fs::rename(temporary,path)?;Ok(())}
+}
+
+pub struct Lease { pub grant_id:String,pub technician_name:String,pub unattended:bool,pub permissions:SessionPermissions,pub expires_at:u64,pub last_renewed:u64,_activity:std::fs::File }
+pub fn activity_file(directory:&Path)->Result<std::fs::File> {
+    std::fs::create_dir_all(directory)?;
+    Ok(std::fs::OpenOptions::new().create(true).read(true).write(true).open(directory.join("activity.lock"))?)
+}
+pub fn lock_session(directory:&Path)->Result<std::fs::File> {
+    let file=activity_file(directory)?;fs2::FileExt::try_lock_shared(&file).context("An update or installation is in progress")?;
+    ensure!(!directory.join("pending-uninstall").exists(),"Customer uninstall prevents new support sessions");
+    ensure!(!directory.join("pending-install.json").exists(),"Company installation requires recovery before support sessions can start");
+    ensure!(!directory.join("pending-update.json").exists(),"Software update requires recovery before support sessions can start");
+    ensure!(!directory.join("configuration-restart.json").exists(),"Configuration restart requires recovery before support sessions can start");Ok(file)
+}
+pub fn state_directory()->PathBuf {
+    if let Some(directory)=std::env::var_os("SWAN_STATE_DIR"){return directory.into();}
+    #[cfg(windows)] {return PathBuf::from(std::env::var_os("PROGRAMDATA").unwrap_or_else(||"C:\\ProgramData".into())).join("SwanRemoteSupport");}
+    #[cfg(not(windows))] {PathBuf::from("/var/lib/swan-remote-support")}
+}
+pub async fn bootstrap(input:Bootstrap)->Result<AgentState> {
+    input.validate()?;
+    let client=http_client(15,false)?;
+    let profile:SignedEnvelope=client.get(format!("{}/api/v1/profile",input.management_url.trim_end_matches('/'))).send().await?.error_for_status()?.json().await?;
+    let parsed:CompanyProfile=profile.verify(&public_key(&input.profile_public_key)?)?;
+    parsed.validate(&input.company_id,0,now())?;
+    Ok(AgentState {bootstrap:input,profile,accepted_revision:parsed.revision,device_id:None,device_token:None,unattended_consent:false,consent_revision:0,last_release_sequence:0})
+}
+
+pub fn http_client(timeout_seconds:u64,artifact_redirects:bool)->Result<reqwest::Client> {
+    let builder=reqwest::Client::builder().timeout(std::time::Duration::from_secs(timeout_seconds)).https_only(true)
+        .redirect(if artifact_redirects{reqwest::redirect::Policy::limited(5)}else{reqwest::redirect::Policy::none()});
+    #[cfg(debug_assertions)]
+    let builder=if let Some(path)=std::env::var_os("SWAN_TEST_CA_FILE") {
+        builder.add_root_certificate(reqwest::Certificate::from_der(&std::fs::read(path)?)?)
+    }else{builder};
+    Ok(builder.build()?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn claimed_technician_identity_is_company_bound_and_legacy_safe() {
+        assert_eq!(claimed_technician_name(&json!({"technician":{"id":"tech-id","username":"company.tech"}}),"tech-id").unwrap(),"company.tech");
+        assert_eq!(claimed_technician_name(&json!({"peer_name":"Administrator"}),"tech-id").unwrap(),"Company technician (tech-id)");
+        for response in [
+            json!({"technician":{"id":"other-tech","username":"company.tech"}}),
+            json!({"technician":{"id":"tech-id"}}),
+            json!({"technician":{"id":"tech-id","username":"Administrator\nverified"}}),
+            json!({"technician":{"id":"tech-id","username":"\u{202e}company.tech"}}),
+            json!({"technician":null}),
+        ] {assert!(claimed_technician_name(&response,"tech-id").is_err());}
+        assert!(claimed_technician_name(&json!({}),"").is_err());
+    }
+    #[test]
+    fn delayed_renewal_cannot_resurrect_expired_authorization() {
+        assert!(validate_lease_renewal(100,399,99).is_ok());
+        assert!(validate_lease_renewal(100,400,100).is_err());
+        assert!(validate_lease_renewal(100,401,101).is_err());
+        assert!(validate_lease_renewal(100,99,99).is_err());
+        assert!(validate_lease_renewal(100,410,99).is_err());
+    }
+    pub(super) fn fixture()->AgentState {
+        let key=SigningKey::from_bytes(&[7;32]);let public=STANDARD.encode(key.verifying_key().as_bytes());
+        let profile=CompanyProfile{schema:1,company_id:"test-company".into(),revision:1,issued_at:now()-1000,expires_at:now()+3600,management_url:"https://support.example.com".into(),rendezvous:"support.example.com".into(),relay:"support.example.com".into(),transport_public_key:public.clone(),customer:Branding::default(),technician:Branding::default(),allow_unattended:true,updates_paused:true,rollout_percent:100,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:"test".into(),next_profile_public_key:None};
+        AgentState{bootstrap:Bootstrap{schema:1,edition:Edition::Customer,company_id:profile.company_id.clone(),management_url:profile.management_url.clone(),profile_public_key:public.clone(),release_public_key:public},profile:SignedEnvelope::sign(&profile,&key).unwrap(),accepted_revision:1,device_id:Some("device".into()),device_token:Some(random_token()),unattended_consent:true,consent_revision:0,last_release_sequence:0}
+    }
+    #[test]
+    fn refreshed_update_policy_can_pause_a_previously_eligible_installation() {
+        let directory=std::env::temp_dir().join(format!("swan-update-policy-{}",random_token()));
+        let key=SigningKey::from_bytes(&[7;32]);let mut state=fixture();
+        let mut profile=state.company_profile().unwrap();profile.updates_paused=false;
+        state.profile=SignedEnvelope::sign(&profile,&key).unwrap();state.save(&directory).unwrap();
+        let downloading=state.clone();assert!(update::update_policy_open(&downloading).unwrap());
+        profile.revision+=1;profile.updates_paused=true;
+        state.accepted_revision=profile.revision;state.profile=SignedEnvelope::sign(&profile,&key).unwrap();state.save(&directory).unwrap();
+        assert!(!update::update_policy_open(&AgentState::load(&directory).unwrap()).unwrap());
+        profile.revision+=1;profile.updates_paused=false;
+        let hour=((now()/3600)%24) as u8;
+        profile.maintenance_start_utc=(hour+2)%24;profile.maintenance_end_utc=(hour+3)%24;
+        state.accepted_revision=profile.revision;state.profile=SignedEnvelope::sign(&profile,&key).unwrap();state.save(&directory).unwrap();
+        assert!(!update::update_policy_open(&AgentState::load(&directory).unwrap()).unwrap());
+        assert!(update::update_policy_open(&downloading).unwrap());
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn repair_bootstrap_cannot_change_company_edition_or_trust() {
+        let state=fixture();let original=state.bootstrap.clone();
+        assert!(state.validate_installer_bootstrap(&original).is_ok());
+        let mut changed=original.clone();changed.company_id="other-company".into();assert!(state.validate_installer_bootstrap(&changed).is_err());
+        let mut changed=original.clone();changed.edition=Edition::Technician;assert!(state.validate_installer_bootstrap(&changed).is_err());
+        let mut changed=original.clone();changed.management_url="https://other.example.com".into();assert!(state.validate_installer_bootstrap(&changed).is_err());
+        let mut changed=original;changed.profile_public_key=STANDARD.encode(SigningKey::from_bytes(&[12;32]).verifying_key().as_bytes());assert!(state.validate_installer_bootstrap(&changed).is_err());
+    }
+    #[test]
+    fn update_recovery_rejects_tampering_sequence_conflicts_and_new_install_replay(){
+        let mut state=fixture();state.last_release_sequence=1;
+        let key=SigningKey::from_bytes(&[7;32]);
+        let mut release=Release{schema:1,product:PRODUCT.into(),version:"1.5.0".into(),sequence:2,edition:Edition::Customer,architecture:"x64".into(),channel:"test".into(),expires_at:now()+3600,artifact_url:"https://releases.example/package.exe".into(),sha256:"a".repeat(64),installed_sha256:"b".repeat(64),installed_files:vec![InstalledFile{path:"Swan Remote Support.exe".into(),sha256:"b".repeat(64)},InstalledFile{path:"librustdesk.dll".into(),sha256:"c".repeat(64)},InstalledFile{path:"flutter_windows.dll".into(),sha256:"d".repeat(64)}],agent_url:"https://releases.example/agent.exe".into(),agent_sha256:"c".repeat(64),publisher:"Example".into(),publisher_certificate_sha256:"d".repeat(64),windows_versions:vec!["windows_11".into()],source_url:"https://releases.example/source.tar.gz".into(),format:"exe".into(),rollback_protocol:0};
+        let envelope=SignedEnvelope::sign(&release,&key).unwrap();
+        update::test_failed_release_quarantine(&state,&release,&key);
+        assert!(update::validate_previous_release(&state,&envelope,2).is_ok());
+        assert!(update::validate_previous_release(&state,&envelope,0).is_err());
+        assert!(update::validate_previous_release(&state,&envelope,1).is_err());
+        assert!(update::validate_previous_release(&state,&envelope,3).is_err());
+        assert!(update::validate_recovery_release(&state,&envelope,1,"installing").is_ok());
+        assert!(update::validate_recovery_release(&state,&envelope,1,"rolling_back").is_ok());
+        assert!(update::validate_recovery_release(&state,&envelope,0,"installing").is_err());
+        assert!(update::validate_recovery_release(&state,&envelope,2,"installing").is_err());
+        assert!(update::validate_recovery_release(&state,&envelope,1,"unknown").is_err());
+        let mut tampered=envelope.clone();tampered.signature=STANDARD.encode([0u8;64]);
+        assert!(update::validate_previous_release(&state,&tampered,2).is_err());
+        assert!(update::validate_recovery_release(&state,&tampered,1,"installing").is_err());
+        let foreign=SignedEnvelope::sign(&release,&SigningKey::from_bytes(&[9;32])).unwrap();
+        assert!(update::validate_previous_release(&state,&foreign,2).is_err());
+        assert!(update::validate_recovery_release(&state,&foreign,1,"installing").is_err());
+        state.last_release_sequence=3;
+        assert!(update::validate_recovery_release(&state,&envelope,1,"installing").is_err());
+        state.last_release_sequence=2;
+        assert!(update::validate_recovery_release(&state,&envelope,1,"installing").is_ok(),"Recovery can finish after the sequence was saved before a crash");
+        state.last_release_sequence=1;release.expires_at=now()-1;
+        let expired=SignedEnvelope::sign(&release,&key).unwrap();
+        assert!(update::validate_previous_release(&state,&expired,2).is_ok(),"A signed recorded previous release remains available after metadata expiry");
+        assert!(update::validate_recovery_release(&state,&expired,1,"installing").is_ok(),"Previously selected interrupted work can finish");
+        assert!(update::validate_release(&state,&expired).is_err(),"Expired metadata cannot start a new update");
+        state.bootstrap.edition=Edition::Technician;
+        assert!(update::validate_previous_release(&state,&expired,2).is_err());
+        assert!(update::validate_recovery_release(&state,&expired,1,"installing").is_err());
+    }
+    #[test]
+    fn explicit_repair_accepts_only_exact_pinned_release_without_weakening_updates() {
+        let mut state=fixture();let key=SigningKey::from_bytes(&[7;32]);
+        let mut release=Release{schema:1,product:PRODUCT.into(),version:"1.5.0".into(),sequence:2,edition:Edition::Customer,architecture:"x64".into(),channel:"test".into(),expires_at:now()+3600,artifact_url:"https://releases.example/package.exe".into(),sha256:"a".repeat(64),installed_sha256:"b".repeat(64),installed_files:vec![InstalledFile{path:"Swan Remote Support.exe".into(),sha256:"b".repeat(64)},InstalledFile{path:"librustdesk.dll".into(),sha256:"c".repeat(64)},InstalledFile{path:"flutter_windows.dll".into(),sha256:"d".repeat(64)}],agent_url:"https://releases.example/agent.exe".into(),agent_sha256:"c".repeat(64),publisher:"Example".into(),publisher_certificate_sha256:"d".repeat(64),windows_versions:vec!["windows_11".into()],source_url:"https://releases.example/source.tar.gz".into(),format:"exe".into(),rollback_protocol:0};
+        let pinned=SignedEnvelope::sign(&release,&key).unwrap();
+        assert!(update::validate_repair_release(&state,&pinned,&pinned).is_err(),"Unrecorded installation cannot use repair");
+        state.last_release_sequence=2;
+        assert!(update::validate_repair_release(&state,&pinned,&pinned).is_ok());
+        assert!(update::validate_release(&state,&pinned).is_err(),"Automatic updates still reject current-sequence replay");
+        release.sha256="e".repeat(64);let changed=SignedEnvelope::sign(&release,&key).unwrap();
+        assert!(update::validate_repair_release(&state,&changed,&pinned).is_err(),"Even newly signed replacements at the same sequence require a new release");
+        release.sequence=1;let older=SignedEnvelope::sign(&release,&key).unwrap();
+        assert!(update::validate_repair_release(&state,&older,&older).is_err());
+        release.sequence=2;release.expires_at=now();let expired=SignedEnvelope::sign(&release,&key).unwrap();
+        assert!(update::validate_repair_release(&state,&expired,&expired).is_err());
+        let mut tampered=pinned.clone();tampered.signature=STANDARD.encode([0u8;64]);
+        assert!(update::validate_repair_release(&state,&tampered,&pinned).is_err());
+    }
+    #[test]
+    fn explicit_consent_changes_survive_older_refreshes() {
+        let directory=std::env::temp_dir().join(format!("swan-consent-{}",random_token()));
+        let mut state=fixture();state.save(&directory).unwrap();let old_allowed=state.clone();
+        state.set_local_consent(&directory,false).unwrap();let old_revoked=state.clone();
+        old_allowed.save(&directory).unwrap();assert!(!AgentState::load(&directory).unwrap().unattended_consent);
+        state.set_local_consent(&directory,true).unwrap();old_revoked.save(&directory).unwrap();
+        let current=AgentState::load(&directory).unwrap();assert!(current.unattended_consent);assert_eq!(current.consent_revision,2);
+        state.set_local_consent(&directory,false).unwrap();current.save(&directory).unwrap();
+        assert!(!AgentState::load(&directory).unwrap().unattended_consent);
+        assert!(current.clone().set_local_consent(&directory,true).is_err(),"An enable response from before revocation must not reenable access");
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn stale_refresh_cannot_restore_consent_or_replay_update_state() {
+        let directory=std::env::temp_dir().join(format!("swan-state-{}",random_token()));
+        let mut state=fixture();state.save(&directory).unwrap();let stale=state.clone();
+        state.unattended_consent=false;state.last_release_sequence=10;state.save(&directory).unwrap();
+        stale.save(&directory).unwrap();let actual=AgentState::load(&directory).unwrap();
+        assert!(!actual.unattended_consent);assert_eq!(actual.last_release_sequence,10);
+        assert_eq!(actual.device_id,state.device_id);assert_eq!(actual.device_token,state.device_token);
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn stale_pre_enrollment_refresh_preserves_identity_and_trust() {
+        let directory=std::env::temp_dir().join(format!("swan-enrollment-{}",random_token()));
+        let enrolled=fixture();let mut before=enrolled.clone();before.device_id=None;before.device_token=None;before.unattended_consent=false;
+        before.save(&directory).unwrap();enrolled.save(&directory).unwrap();before.save(&directory).unwrap();
+        let current=AgentState::load(&directory).unwrap();assert_eq!(current.device_id,enrolled.device_id);assert_eq!(current.device_token,enrolled.device_token);assert!(current.unattended_consent);
+        let mut replacement=current.clone();replacement.device_id=Some("different-device".into());assert!(replacement.save(&directory).is_err());
+        let mut replacement=current.clone();replacement.device_token=Some(random_token());assert!(replacement.save(&directory).is_err());
+        let mut replacement=current.clone();replacement.bootstrap.edition=Edition::Technician;assert!(replacement.save(&directory).is_err());
+        let mut replacement=current.clone();replacement.bootstrap.release_public_key=STANDARD.encode(SigningKey::from_bytes(&[8;32]).verifying_key().as_bytes());assert!(replacement.save(&directory).is_err());
+        let mut replacement=current.clone();let key=SigningKey::from_bytes(&[9;32]);replacement.bootstrap.profile_public_key=STANDARD.encode(key.verifying_key().as_bytes());replacement.profile=SignedEnvelope::sign(&current.company_profile().unwrap(),&key).unwrap();assert!(replacement.save(&directory).is_err());
+        assert_eq!(AgentState::load(&directory).unwrap().device_token,enrolled.device_token);
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn trusted_profile_rotation_preserves_enrollment_and_rejects_rollback() {
+        let directory=std::env::temp_dir().join(format!("swan-rotation-{}",random_token()));
+        let mut state=fixture();let next=SigningKey::from_bytes(&[10;32]);let next_public=STANDARD.encode(next.verifying_key().as_bytes());
+        let mut profile=state.company_profile().unwrap();profile.next_profile_public_key=Some(next_public.clone());
+        state.profile=SignedEnvelope::sign(&profile,&SigningKey::from_bytes(&[7;32])).unwrap();state.save(&directory).unwrap();let old=state.clone();
+        profile.revision+=1;profile.next_profile_public_key=None;profile.management_url="https://new-support.example.com".into();
+        state.bootstrap.profile_public_key=next_public.clone();state.bootstrap.management_url=profile.management_url.clone();state.accepted_revision=profile.revision;state.profile=SignedEnvelope::sign(&profile,&next).unwrap();
+        state.save(&directory).unwrap();let loaded=AgentState::load(&directory).unwrap();
+        assert_eq!(loaded.bootstrap.profile_public_key,next_public);assert_eq!(loaded.bootstrap.management_url,profile.management_url);assert_eq!(loaded.device_id,old.device_id);assert_eq!(loaded.device_token,old.device_token);assert_eq!(loaded.unattended_consent,old.unattended_consent);
+        assert!(old.save(&directory).is_err());std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn expired_cache_only_allows_refresh_and_never_unsigned_policy() {
+        let directory=std::env::temp_dir().join(format!("swan-expired-{}",random_token()));let mut state=fixture();
+        let mut profile=state.company_profile().unwrap();profile.expires_at=now()-1;
+        state.profile=SignedEnvelope::sign(&profile,&SigningKey::from_bytes(&[7;32])).unwrap();state.save(&directory).unwrap();
+        assert!(AgentState::load(&directory).is_err());assert!(AgentState::load_for_refresh(&directory).is_ok());
+        assert_eq!(AgentState::load_for_refresh(&directory).unwrap().display_profile().unwrap().customer.display_name,PRODUCT);
+        state.profile.payload=STANDARD.encode(b"{}");std::fs::write(directory.join("managed-state.json"),serde_json::to_vec(&state).unwrap()).unwrap();
+        assert!(AgentState::load_for_refresh(&directory).is_err());std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn bootstrap_never_accepts_http_or_embedded_credentials() {
+        let key=STANDARD.encode(SigningKey::from_bytes(&[1;32]).verifying_key().as_bytes());
+        let mut b=Bootstrap{schema:1,edition:Edition::Customer,company_id:"a".into(),management_url:"https://support.example.com".into(),profile_public_key:key,release_public_key:String::new()};
+        assert!(b.validate().is_ok());b.management_url="http://support.example.com".into();assert!(b.validate().is_err());
+        b.management_url="https://secret@example.com".into();assert!(b.validate().is_err());
+    }
+}
diff --git a/product/agent/src/main.rs b/product/agent/src/main.rs
new file mode 100644
index 00000000000..80a47d54499
--- /dev/null
+++ b/product/agent/src/main.rs
@@ -0,0 +1,258 @@
+use anyhow::{bail, ensure, Context, Result};
+use ed25519_dalek::SigningKey;
+use rand::rngs::OsRng;
+use serde_json::json;
+use std::path::PathBuf;
+use swan_agent::*;
+use swan_protocol::*;
+
+#[cfg(windows)]
+async fn refresh_runtime_cache(directory:&std::path::Path)->Result<bool> {
+    let directory=directory.to_owned();
+    tokio::task::spawn_blocking(move ||swan_agent::update::refresh_windows_runtime_cache(&directory))
+        .await.context("Windows component cache maintenance task failed")?
+}
+
+#[tokio::main]
+async fn main()->Result<()> {
+    let args:Vec<String>=std::env::args().collect();
+    let command=args.get(1).map(String::as_str).unwrap_or("help");
+    let directory=state_directory();
+    #[cfg(windows)]
+    let directory=if command=="recover-update-task" {
+        let executable=std::env::current_exe()?;
+        let updates=executable.parent().and_then(|folder|folder.parent()).context("Missing staged updates directory")?;
+        ensure!(updates.file_name().is_some_and(|name|name.to_string_lossy().eq_ignore_ascii_case("updates")),"Recovery task is outside staged updates");
+        updates.parent().context("Missing company recovery directory")?.to_owned()
+    }else{directory};
+    match command {
+        #[cfg(windows)]
+        "setup-ui"=>{
+            let operation=args.get(2).context("Missing internal setup UI operation")?.clone();
+            let task_directory=PathBuf::from(args.get(3).context("Missing internal setup UI directory")?);
+            let operation_id=args.get(4).context("Missing internal setup UI transaction")?.clone();
+            tokio::task::spawn_blocking(move ||swan_agent::update::complete_setup_ui_task(&task_directory,&operation,&operation_id))
+                .await.context("Explicit setup UI task failed")??;
+        }
+        "rollback-protocol"=>println!("1"),
+        #[cfg(windows)]
+        "prepare-customer-directory"=>{
+            let directory=PathBuf::from(args.get(2).context("Missing customer state directory")?);
+            swan_agent::update::prepare_customer_directory(&directory,true)?;
+        }
+        #[cfg(windows)]
+        "commit-uninstall"=>{
+            // The signed MSI embeds a separate agent copy: its installed copy
+            // has already been removed when the commit script executes.
+            let edition=args.get(2).context("Missing uninstall edition")?;
+            ensure!(matches!(edition.as_str(),"customer"|"technician"),"Invalid uninstall edition");
+            let directory=PathBuf::from(args.get(3).context("Missing uninstall state directory")?);
+            let edition=edition.to_owned();
+            tokio::task::spawn_blocking(move ||swan_agent::update::commit_uninstall(&directory,&edition))
+                .await.context("Uninstall commit cleanup failed")??;
+        }
+        #[cfg(windows)]
+        "cancel-update-recovery"|"restore-update-recovery"=>{
+            let executable=std::env::current_exe()?;
+            let directory=if let Some(path)=args.get(2){PathBuf::from(path)}else{
+                ensure!(executable.file_name().is_some_and(|name|name.to_string_lossy().eq_ignore_ascii_case("swan-agent.exe")),"Uninstall cancellation requires the installed agent");
+                executable.parent().context("Missing installed agent directory")?.to_owned()
+            };
+            swan_agent::update::uninstall_cancellation(&directory,command=="restore-update-recovery",false)?;
+        }
+        #[cfg(windows)]
+        "recover-update-task"=>{
+            println!("Recovery task handed off: {}",AgentState::recover_from_staged_task(&directory).await?);
+        }
+        #[cfg(windows)]
+        "remove-configuration-task"|"restore-configuration-task"=>{
+            let executable=std::env::current_exe()?;
+            let directory=if let Some(path)=args.get(2){PathBuf::from(path)}else{
+                ensure!(executable.file_name().is_some_and(|name|name.to_string_lossy().eq_ignore_ascii_case("swan-agent.exe")),"Uninstall cleanup requires the installed configuration agent");
+                executable.parent().context("Missing installed agent directory")?.to_owned()
+            };
+            swan_agent::update::configuration_task_removal(&directory,command=="restore-configuration-task")?;
+        }
+        "setup"=>{
+            let file=args.get(2).context("Usage: swan-agent setup bootstrap.json --accept-company")?;
+            ensure!(args.iter().any(|a|a=="--accept-company"),"Review the company HTTPS domain and trust key; pass --accept-company only after confirming them");
+            let input:Bootstrap=serde_json::from_slice(&std::fs::read(file)?)?;
+            #[cfg(windows)]
+            if input.edition==Edition::Customer {swan_agent::update::prepare_customer_directory(&directory,std::env::var_os("SWAN_STATE_DIR").is_none())?;}
+            ensure!(!directory.join("managed-state.json").exists(),"Already configured; refuse to silently change company ownership");
+            println!("Connecting to company domain {}",input.management_url);
+            bootstrap(input).await?.save(&directory)?;
+            println!("Company verified and profile pinned.");
+        }
+        "enroll"=>{
+            let name=args.get(2).context("Usage: swan-agent enroll COMPUTER_NAME RUSTDESK_ID [--unattended-consent]")?;
+            let peer=args.get(3).context("Missing RustDesk ID")?;
+            let mut state=AgentState::load(&directory)?;
+            state.enroll(name,peer,args.iter().any(|a|a=="--unattended-consent")).await?;state.save(&directory)?;
+            println!("Device enrolled. Company approval is required before remote access.");
+        }
+        "verify-bootstrap"=>{
+            let file=args.get(2).context("Usage: swan-agent verify-bootstrap bootstrap.json")?;
+            let input:Bootstrap=serde_json::from_slice(&std::fs::read(file)?)?;
+            AgentState::load(&directory)?.validate_installer_bootstrap(&input)?;
+            println!("Installer company and trust match existing configuration.");
+        }
+        "sync"=>{let mut state=AgentState::load_for_refresh(&directory)?;state.sync().await?;state.save(&directory)?;println!("Profile synchronized.");}
+        "watch"=>{loop {match AgentState::load_for_refresh(&directory){Ok(mut state)=>{
+            match state.sync().await{Ok(())=>state.save(&directory)?,Err(error)=>eprintln!("Profile refresh failed: {error}")};
+            #[cfg(windows)]
+            if let Err(error)=refresh_runtime_cache(&directory).await {eprintln!("Windows component cache maintenance deferred: {error}");}
+            // Reload after refresh: another process may have changed consent.
+            // Server revisions reject delayed requests from an older choice.
+            let mut current=AgentState::load_for_refresh(&directory)?;
+            if current.bootstrap.edition==Edition::Customer && current.device_id.is_some() && !current.unattended_consent {
+                if let Err(error)=current.consent(false).await {eprintln!("Consent revocation synchronization deferred: {error}");}
+            }
+            if state.bootstrap.edition==Edition::Customer {
+                reporting::heartbeat(&directory,None).await;
+                match state.update(&directory,None).await {Ok(true)=>return Ok(()),Ok(false)=>{},Err(error)=>eprintln!("Update deferred: {error}")}
+            }
+        },Err(error)=>eprintln!("Configuration unavailable: {error}")};tokio::time::sleep(std::time::Duration::from_secs(300)).await;}}
+        "update"=>{
+            let mut state=AgentState::load_for_refresh(&directory)?;state.sync().await?;state.save(&directory)?;
+            #[cfg(windows)]
+            refresh_runtime_cache(&directory).await?;
+            let token=std::env::var("SWAN_TECHNICIAN_TOKEN").ok();
+            println!("Update handed off: {}",state.update(&directory,token.as_deref()).await?);
+        }
+        #[cfg(windows)]
+        "refresh-os-cache"=>{println!("Windows component cache refreshed: {}",refresh_runtime_cache(&directory).await?);}
+        #[cfg(windows)]
+        "resume-update"=>{
+            let state=AgentState::load_for_refresh(&directory)?;
+            println!("Update recovery handed off: {}",state.resume_pending_update_online(&directory,true).await?);
+        }
+        #[cfg(windows)]
+        "apply-update"=>{
+            let update_directory=directory.clone();
+            let customer=AgentState::load_for_refresh(&directory)?.bootstrap.edition==Edition::Customer;
+            let outcome=tokio::task::spawn_blocking(move ||->anyhow::Result<bool>{
+                let mut state=AgentState::load_for_refresh(&update_directory)?;
+                state.apply_pending_update(&update_directory)
+            }).await.context("Update helper task failed").and_then(|result|result);
+            if customer && (matches!(&outcome,Ok(true)) || outcome.is_err()) {
+                let restart_directory=directory.clone();
+                let restart=tokio::task::spawn_blocking(move ||swan_agent::update::finish_configuration_restart(&restart_directory))
+                    .await.context("Configuration restart task failed").and_then(|result|result);
+                if let Err(restart_error)=restart {
+                    if let Err(error)=&outcome {eprintln!("Update remains pending: {error:#}");}
+                    return Err(restart_error).context("Configuration task restart failed; durable recovery will retry");
+                }
+            }
+            let installed=outcome?;
+            if !customer && installed {
+                use std::os::windows::process::CommandExt;
+                // Installation verified the pinned executable and publisher.
+                // Restart with company state only; technicians sign in again.
+                std::process::Command::new(directory.join("SwanRemoteSupport-Technician.exe"))
+                    .env("SWAN_STATE_DIR",&directory).env_remove("SWAN_TECHNICIAN_TOKEN")
+                    .env_remove("SWAN_SESSION_GRANT").env_remove("SWAN_SESSION_PROOF_KEY")
+                    .creation_flags(0x08000000).stdin(std::process::Stdio::null())
+                    .stdout(std::process::Stdio::null()).stderr(std::process::Stdio::null()).spawn()
+                    .context("Updated technician application could not restart")?;
+            }
+            println!("Installed release verified: {}",installed);
+        }
+        #[cfg(windows)]
+        "prepare-installation"=>{
+            let file=PathBuf::from(args.get(2).context("Usage: swan-agent prepare-installation release.json INSTALLER [--repair | --replace-failed-setup]")?);
+            let package=PathBuf::from(args.get(3).context("Missing original installer path")?);
+            let prepare_directory=directory.clone();let repair=args.iter().any(|value|value=="--repair");
+            let replace_failed_setup=args.iter().any(|value|value=="--replace-failed-setup");
+            tokio::task::spawn_blocking(move ||->Result<()> {
+                let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(file)?)?;
+                let state=AgentState::load(&prepare_directory)?;
+                state.prepare_installation_with_recovery(&prepare_directory,&envelope,&package,repair,replace_failed_setup)
+            }).await.context("Explicit installation preparation failed")??;
+            println!("Verified setup prepared; any cancelled update evidence was retained.");
+        }
+        #[cfg(windows)]
+        "record-installation"=>{
+            let file=PathBuf::from(args.get(2).context("Usage: swan-agent record-installation release.json INSTALLER [--repair]")?);
+            let package=PathBuf::from(args.get(3).context("Missing original installer path")?);
+            let record_directory=directory.clone();let repair=args.iter().any(|value|value=="--repair");
+            tokio::task::spawn_blocking(move ||->Result<()> {
+                let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(file)?)?;
+                let mut state=AgentState::load(&record_directory)?;
+                state.record_installation(&record_directory,&envelope,&package,repair)
+            }).await.context("Installation recording task failed")??;
+            println!("Installed application and agent identities verified; release sequence recorded.");
+        }
+        #[cfg(windows)]
+        "recover-update"=>{let mut state=AgentState::load_for_refresh(&directory)?;state.recover_update(&directory)?;println!("Installed release verified and update state recovered.");}
+        #[cfg(windows)]
+        "verify-installed"=>{
+            let state=AgentState::load_for_refresh(&directory)?;
+            swan_agent::update::verify_installed_metadata(&state,&directory)?;
+            println!("Installed executable and pinned release publisher verified.");
+        }
+        #[cfg(windows)]
+        "verify-package"=>{
+            let state=AgentState::load(&directory)?;
+            let metadata=args.get(2).context("Usage: swan-agent verify-package release.json INSTALLER")?;
+            let package=args.get(3).context("Missing installer path")?;
+            let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(metadata)?)?;
+            if args.iter().any(|value|value=="--repair") {swan_agent::update::verify_repair_package(&state,&directory,&envelope,std::path::Path::new(package))?;}
+            else{swan_agent::update::verify_package(&state,&directory,&envelope,std::path::Path::new(package))?;}
+            println!("Installer metadata, bytes and publisher verified.");
+        }
+        "revoke-unattended"=>{
+            let mut state=AgentState::load_for_refresh(&directory)?;state.set_local_consent(&directory,false)?;
+            match state.consent(false).await {Ok(())=>println!("Unattended access revoked locally and on the server."),Err(_)=>println!("Unattended access revoked locally. Server synchronization will retry when available.")}
+        }
+        "allow-unattended"=>{
+            ensure!(args.iter().any(|value|value=="--confirm-unattended"),"Explicit --confirm-unattended consent is required");
+            let mut state=AgentState::load(&directory)?;
+            state.consent(true).await?;state.set_local_consent(&directory,true)?;
+            println!("Unattended support enabled by explicit customer consent.");
+        }
+        "login"=>{
+            let state=AgentState::load(&directory)?;
+            ensure!(state.bootstrap.edition==Edition::Technician,"Technician edition required");
+            let username=args.get(2).context("Usage: swan-agent login USERNAME (password and code from SWAN_LOGIN_PASSWORD and SWAN_LOGIN_TOTP)")?;
+            let password=std::env::var("SWAN_LOGIN_PASSWORD").context("Set SWAN_LOGIN_PASSWORD for this process only")?;
+            let code=std::env::var("SWAN_LOGIN_TOTP").context("Set SWAN_LOGIN_TOTP for this process only")?;
+            let token=state.technician_login(username,&password,&code).await?;
+            reporting::heartbeat(&directory,Some(&token)).await;
+            // Explicit CLI exchange for automation. Never write tokens to logs or persistent profile files.
+            println!("{}",json!({"token":token}));
+        }
+        "devices"=>{
+            let state=AgentState::load(&directory)?;
+            let token=std::env::var("SWAN_TECHNICIAN_TOKEN").context("Set authenticated technician token")?;
+            let devices=state.technician_inventory(&token).await?;
+            reporting::heartbeat(&directory,Some(&token)).await;
+            println!("{}",serde_json::to_string_pretty(&devices)?);
+        }
+        "history"=>{
+            let state=AgentState::load(&directory)?;
+            let token=std::env::var("SWAN_TECHNICIAN_TOKEN").context("Set authenticated technician token")?;
+            println!("{}",serde_json::to_string_pretty(&state.technician_history(&token).await?)?);
+        }
+        "logout"=>{
+            let state=AgentState::load_for_refresh(&directory)?;
+            let token=std::env::var("SWAN_TECHNICIAN_TOKEN").context("Set authenticated technician token")?;
+            state.technician_logout(&token).await?;println!("Technician session signed out.");
+        }
+        "connect"=>{
+            let state=AgentState::load(&directory)?;let device=args.get(2).context("Usage: swan-agent connect DEVICE_ID APP_EXE [--unattended]")?;
+            let executable=PathBuf::from(args.get(3).context("Missing app executable")?);
+            ensure!(executable.is_file(),"App executable not found");
+            let token=std::env::var("SWAN_TECHNICIAN_TOKEN").context("Authenticated technician token required")?;
+            let proof=SigningKey::generate(&mut OsRng);
+            let envelope=state.request_grant(&token,device,args.iter().any(|a|a=="--unattended"),&proof).await?;
+            let grant:SessionGrant=envelope.verify(&public_key(&state.bootstrap.profile_public_key)?)?;
+            let mut child=std::process::Command::new(executable).arg("--connect").arg(&grant.rustdesk_id)
+                .env("SWAN_STATE_DIR",&directory).env("SWAN_SESSION_GRANT",serde_json::to_string(&envelope)?)
+                .env("SWAN_SESSION_PROOF_KEY",hex::encode(proof.to_bytes())).spawn()?;
+            ensure!(child.wait()?.success(),"Technician application exited unsuccessfully");
+        }
+        _=>{println!("Swan Remote Support configuration agent\nCommands: setup, verify-bootstrap, enroll, sync, watch, update, revoke-unattended, allow-unattended --confirm-unattended, login, devices, history, logout, connect\nState directory: {}",directory.display());if command!="help"{bail!("Unknown command");}}
+    }
+    Ok(())
+}
diff --git a/product/agent/src/payload.rs b/product/agent/src/payload.rs
new file mode 100644
index 00000000000..a08ab04075a
--- /dev/null
+++ b/product/agent/src/payload.rs
@@ -0,0 +1,247 @@
+//! Verify the signed installed payload, including native libraries and assets.
+use anyhow::{ensure,Context,Result};
+use std::path::Path;
+use swan_protocol::{digest,InstalledFile};
+
+#[cfg(any(windows,test))]
+pub(crate) const WINDOWS_BROKER_CACHE:&str="RuntimeBroker_rustdesk.exe";
+
+#[cfg(any(windows,test))]
+fn plain_file(path:&Path)->Result<std::fs::Metadata> {
+    let metadata=std::fs::symlink_metadata(path)?;
+    ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"Windows component path is not a regular file");
+    #[cfg(windows)] {
+        use std::os::windows::fs::MetadataExt;
+        ensure!(metadata.file_attributes() & 0x400 == 0,"Windows component path is a reparse point");
+    }
+    ensure!(metadata.len()>0 && metadata.len()<=512*1024*1024,"Windows component size is invalid");
+    Ok(metadata)
+}
+
+#[cfg(any(windows,test))]
+fn component_bytes(path:&Path)->Result<Vec<u8>> {
+    use std::io::Read;
+    let metadata=plain_file(path)?;
+    let mut bytes=Vec::new();
+    std::fs::File::open(path)?.take(512*1024*1024+1).read_to_end(&mut bytes)?;
+    ensure!(bytes.len() as u64==metadata.len(),"Windows component changed while reading");
+    Ok(bytes)
+}
+
+#[cfg(any(windows,test))]
+fn windows_cache_path(root:&Path,system_broker:&Path)->Result<std::path::PathBuf> {
+    let metadata=std::fs::symlink_metadata(root)?;
+    ensure!(metadata.is_dir() && !metadata.file_type().is_symlink(),"Installed directory is not a regular directory");
+    #[cfg(windows)] {
+        use std::os::windows::fs::MetadataExt;
+        ensure!(metadata.file_attributes() & 0x400 == 0,"Installed directory is a reparse point");
+    }
+    ensure!(system_broker.file_name().and_then(|n|n.to_str()).is_some_and(|n|n.eq_ignore_ascii_case("RuntimeBroker.exe")),"Unexpected Windows component source");
+    plain_file(system_broker)?;
+    Ok(root.join(WINDOWS_BROKER_CACHE))
+}
+
+#[cfg(any(windows,test))]
+pub(crate) fn windows_cache_current(root:&Path,system_broker:&Path)->Result<bool> {
+    let cache=windows_cache_path(root,system_broker)?;
+    match std::fs::symlink_metadata(&cache) {
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>Ok(false),
+        Err(error)=>Err(error.into()),
+        Ok(_)=>Ok(component_bytes(&cache)?==component_bytes(system_broker)?),
+    }
+}
+
+/// The caller holds installation/session exclusion and supplies the OS system
+/// directory, never a source from a company profile or downloaded package.
+/// Refresh this generated Windows cache without accepting stale bytes as part
+/// of the signed project payload or killing an in-use helper.
+#[cfg(any(windows,test))]
+pub(crate) fn refresh_windows_cache(root:&Path,system_broker:&Path)->Result<bool> {
+    use std::io::Write;
+    let cache=windows_cache_path(root,system_broker)?;
+    if windows_cache_current(root,system_broker)? {return Ok(false);}
+    let source=component_bytes(system_broker)?;
+    let modified=plain_file(system_broker)?.modified()?;
+    let temporary=root.join(format!(".swan-windows-cache-{}.tmp",swan_protocol::random_token()));
+    let mut created=false;
+    let result=(||->Result<()> {
+        let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&temporary)?;
+        created=true;
+        file.write_all(&source)?;
+        file.set_times(std::fs::FileTimes::new().set_modified(modified))?;
+        file.sync_all()?;drop(file);
+        ensure!(component_bytes(system_broker)?==source,"Windows component changed before cache publication");
+        crate::replace_state(&temporary,&cache).context("Windows component cache is in use or cannot be replaced")?;
+        ensure!(windows_cache_current(root,system_broker)?,"Windows component changed during cache publication");
+        Ok(())
+    })();
+    if created && temporary.exists(){std::fs::remove_file(&temporary).context("Cannot remove unpublished Windows component cache")?;}
+    result?;Ok(true)
+}
+
+/// Preserve a complete signed payload before an installer can modify it.
+/// Only a fully verified, flushed directory becomes visible at destination.
+pub(crate) fn snapshot(source:&Path,destination:&Path,files:&[InstalledFile])->Result<()> {
+    use std::io::Write;
+    ensure!(!destination.exists(),"Rollback snapshot already exists");
+    ensure!(!files.is_empty() && files.len()<=4096,"Installed payload manifest required");
+    for file in files {file.validate()?;}
+    let source=std::fs::canonicalize(source)?;
+    let temporary=destination.parent().context("Missing snapshot parent")?.join(format!("swan-snapshot-{}",swan_protocol::random_token()));
+    std::fs::create_dir(&temporary)?;
+    let result=(||->Result<()> {
+        let mut total=0u64;
+        for file in files {
+            let path=std::fs::canonicalize(source.join(&file.path))?;
+            ensure!(path.starts_with(&source) && path.is_file(),"Snapshot source escapes installation");
+            let size=std::fs::metadata(&path)?.len();
+            ensure!(size<=512*1024*1024,"Snapshot file exceeds size limit");
+            total=total.checked_add(size).context("Snapshot size overflow")?;
+            ensure!(total<=2*1024*1024*1024,"Snapshot exceeds total size limit");
+            let bytes=std::fs::read(path)?;
+            ensure!(bytes.len() as u64==size,"Snapshot source changed during copying");
+            ensure!(digest(&bytes).eq_ignore_ascii_case(&file.sha256),"Snapshot source differs from signed manifest");
+            let target=temporary.join(&file.path);
+            std::fs::create_dir_all(target.parent().context("Missing snapshot file parent")?)?;
+            let mut output=std::fs::OpenOptions::new().create_new(true).write(true).open(target)?;
+            output.write_all(&bytes)?;output.sync_all()?;
+        }
+        verify(&temporary,files)?;
+        std::fs::rename(&temporary,destination).context("Cannot publish complete rollback snapshot")
+    })();
+    if result.is_err(){std::fs::remove_dir_all(&temporary).context("Cannot clean incomplete rollback snapshot")?;}
+    result
+}
+
+pub fn verify(root:&Path,files:&[InstalledFile])->Result<()> {
+    ensure!(!files.is_empty() && files.len()<=4096,"Installed payload manifest required");
+    let root=std::fs::canonicalize(root)?;
+    let mut expected=std::collections::HashSet::new();
+    for file in files {
+        file.validate()?;
+        ensure!(expected.insert(file.path.to_ascii_lowercase()),"Duplicate installed file path");
+        let path=std::fs::canonicalize(root.join(&file.path)).context("Installed payload file missing")?;
+        ensure!(path.starts_with(&root) && path.is_file(),"Installed payload escapes its directory");
+        ensure!(std::fs::metadata(&path)?.len()<=512*1024*1024,"Installed payload file exceeds size limit");
+        ensure!(digest(std::fs::read(path)?).eq_ignore_ascii_case(&file.sha256),"Installed payload hash differs from signed manifest");
+    }
+    // Additional native code can be loaded without changing the main EXE.
+    // Reject unlisted DLLs/EXEs rather than treating them as ordinary user data.
+    let mut directories=vec![(root.clone(),0u32)];let mut count=0usize;
+    while let Some((directory,depth))=directories.pop() {
+        ensure!(depth<=32,"Installed directory nesting exceeds limit");
+        for entry in std::fs::read_dir(directory)? {
+            let entry=entry?;count+=1;ensure!(count<=16384,"Installed directory exceeds verification limit");
+            let path=entry.path();let canonical=std::fs::canonicalize(&path)?;
+            ensure!(canonical.starts_with(&root),"Installed directory contains an external link");
+            if canonical.is_dir(){directories.push((path,depth+1));continue;}
+            let extension=path.extension().and_then(|value|value.to_str()).unwrap_or("");
+            if extension.eq_ignore_ascii_case("exe") || extension.eq_ignore_ascii_case("dll") {
+                let relative=path.strip_prefix(&root)?.to_str().context("Invalid installed filename")?.replace('\\',"/").to_ascii_lowercase();
+                ensure!(expected.contains(&relative),"Installed native code is absent from signed manifest");
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn windows_owned_cache_refreshes_after_os_change_without_changing_project_files(){
+        let base=std::env::temp_dir().join(format!("swan-os-cache-{}",swan_protocol::random_token()));
+        let root=base.join("installed");let system=base.join("system");
+        std::fs::create_dir_all(&root).unwrap();std::fs::create_dir(&system).unwrap();
+        let source=system.join("RuntimeBroker.exe");let cache=root.join(WINDOWS_BROKER_CACHE);
+        std::fs::write(root.join("endpoint.exe"),b"approved project bytes").unwrap();
+        std::fs::write(&source,b"updated Windows component").unwrap();
+        std::fs::write(&cache,b"previous Windows component").unwrap();
+        assert!(!windows_cache_current(&root,&source).unwrap());
+        assert!(refresh_windows_cache(&root,&source).unwrap());
+        assert_eq!(std::fs::read(&cache).unwrap(),std::fs::read(&source).unwrap());
+        assert_eq!(std::fs::metadata(&cache).unwrap().modified().unwrap(),std::fs::metadata(&source).unwrap().modified().unwrap());
+        assert!(!refresh_windows_cache(&root,&source).unwrap());
+        let files=vec![InstalledFile{path:"endpoint.exe".into(),sha256:digest(b"approved project bytes")},InstalledFile{path:WINDOWS_BROKER_CACHE.into(),sha256:digest(b"updated Windows component")}];
+        verify(&root,&files).unwrap();
+        std::fs::write(root.join("endpoint.exe"),b"tampered project bytes").unwrap();
+        assert!(verify(&root,&files).is_err());
+        assert!(!std::fs::read_dir(&root).unwrap().any(|e|e.unwrap().file_name().to_string_lossy().starts_with(".swan-windows-cache-")));
+        std::fs::remove_dir_all(base).unwrap();
+    }
+    #[test]
+    fn windows_cache_rejects_missing_source_wrong_source_name_and_directory_target(){
+        let base=std::env::temp_dir().join(format!("swan-os-cache-reject-{}",swan_protocol::random_token()));
+        let root=base.join("installed");std::fs::create_dir_all(&root).unwrap();
+        let source=base.join("RuntimeBroker.exe");let cache=root.join(WINDOWS_BROKER_CACHE);
+        std::fs::write(&cache,b"original cache").unwrap();
+        assert!(refresh_windows_cache(&root,&source).is_err());
+        std::fs::write(&source,b"").unwrap();
+        assert!(refresh_windows_cache(&root,&source).is_err());
+        let wrong=base.join("profile-selected.exe");std::fs::write(&wrong,b"untrusted source").unwrap();
+        assert!(refresh_windows_cache(&root,&wrong).is_err());
+        assert_eq!(std::fs::read(&cache).unwrap(),b"original cache");
+        std::fs::remove_file(&cache).unwrap();std::fs::create_dir(&cache).unwrap();std::fs::write(&source,b"system component").unwrap();
+        assert!(refresh_windows_cache(&root,&source).is_err());assert!(cache.is_dir());
+        std::fs::remove_dir_all(base).unwrap();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn windows_cache_rejects_links_without_changing_external_files(){
+        let base=std::env::temp_dir().join(format!("swan-os-cache-links-{}",swan_protocol::random_token()));
+        let root=base.join("installed");std::fs::create_dir_all(&root).unwrap();
+        let source=base.join("RuntimeBroker.exe");let external=base.join("outside.exe");
+        std::fs::write(&source,b"system component").unwrap();std::fs::write(&external,b"must remain unchanged").unwrap();
+        std::os::unix::fs::symlink(&external,root.join(WINDOWS_BROKER_CACHE)).unwrap();
+        assert!(refresh_windows_cache(&root,&source).is_err());
+        assert_eq!(std::fs::read(&external).unwrap(),b"must remain unchanged");
+        std::fs::remove_dir_all(base).unwrap();
+    }
+    #[cfg(windows)]
+    #[test]
+    fn windows_cache_preserves_a_locked_destination_and_cleans_unpublished_copy(){
+        use std::os::windows::fs::OpenOptionsExt;
+        let base=std::env::temp_dir().join(format!("swan-os-cache-locked-{}",swan_protocol::random_token()));
+        let root=base.join("installed");std::fs::create_dir_all(&root).unwrap();
+        let source=base.join("RuntimeBroker.exe");let cache=root.join(WINDOWS_BROKER_CACHE);
+        std::fs::write(&source,b"new system component").unwrap();std::fs::write(&cache,b"in-use old component").unwrap();
+        let held=std::fs::OpenOptions::new().read(true).share_mode(1).open(&cache).unwrap();
+        assert!(refresh_windows_cache(&root,&source).is_err());drop(held);
+        assert_eq!(std::fs::read(&cache).unwrap(),b"in-use old component");
+        assert!(!std::fs::read_dir(&root).unwrap().any(|e|e.unwrap().file_name().to_string_lossy().starts_with(".swan-windows-cache-")));
+        assert!(refresh_windows_cache(&root,&source).unwrap());
+        std::fs::remove_dir_all(base).unwrap();
+    }
+    #[test]
+    fn snapshot_preserves_complete_payload_and_never_publishes_tampered_or_partial_source(){
+        let root=std::env::temp_dir().join(format!("swan-snapshot-test-{}",swan_protocol::random_token()));
+        let source=root.join("installed");std::fs::create_dir_all(source.join("data")).unwrap();
+        let files:Vec<_>=[("endpoint.exe",b"signed executable".as_slice()),("library.dll",b"signed library".as_slice()),("data/assets.json",b"signed assets".as_slice())].into_iter().map(|(path,bytes)|{std::fs::write(source.join(path),bytes).unwrap();InstalledFile{path:path.into(),sha256:digest(bytes)}}).collect();
+        let saved=root.join("rollback");snapshot(&source,&saved,&files).unwrap();
+        std::fs::write(source.join("library.dll"),b"installer replaced library").unwrap();
+        verify(&saved,&files).unwrap();
+        assert!(snapshot(&source,&saved,&files).is_err());
+        assert!(snapshot(&source,&root.join("tampered"),&files).is_err());
+        assert!(!root.join("tampered").exists());
+        std::fs::write(source.join("library.dll"),b"signed library").unwrap();
+        std::fs::remove_file(source.join("data/assets.json")).unwrap();
+        assert!(snapshot(&source,&root.join("incomplete"),&files).is_err());
+        assert!(!root.join("incomplete").exists());
+        let mut traversal=files.clone();traversal[0].path="../escape.exe".into();
+        assert!(snapshot(&source,&root.join("unsafe"),&traversal).is_err());
+        assert!(!root.join("unsafe").exists());
+        assert!(!std::fs::read_dir(&root).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with("swan-snapshot-")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn payload_rejects_library_asset_tampering_missing_files_and_extra_native_code(){
+        let root=std::env::temp_dir().join(format!("swan-payload-{}",swan_protocol::random_token()));
+        std::fs::create_dir_all(root.join("data")).unwrap();
+        let files:Vec<_>=[("endpoint.exe",b"executable".as_slice()),("library.dll",b"library".as_slice()),("data/assets.json",b"assets".as_slice())].into_iter().map(|(path,bytes)|{std::fs::write(root.join(path),bytes).unwrap();InstalledFile{path:path.into(),sha256:digest(bytes)}}).collect();
+        verify(&root,&files).unwrap();
+        for (path,original) in [("library.dll",b"library".as_slice()),("data/assets.json",b"assets".as_slice())]{std::fs::write(root.join(path),b"tampered").unwrap();assert!(verify(&root,&files).is_err());std::fs::write(root.join(path),original).unwrap();}
+        std::fs::write(root.join("injected.dll"),b"unlisted native code").unwrap();assert!(verify(&root,&files).is_err());std::fs::remove_file(root.join("injected.dll")).unwrap();
+        std::fs::remove_file(root.join("library.dll")).unwrap();assert!(verify(&root,&files).is_err());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/product/agent/src/reporting.rs b/product/agent/src/reporting.rs
new file mode 100644
index 00000000000..76fd31ac9c4
--- /dev/null
+++ b/product/agent/src/reporting.rs
@@ -0,0 +1,279 @@
+//! Best-effort installation diagnostics. No credentials are persisted here and
+//! no reporting result participates in authorization or installation decisions.
+use crate::*;
+use fs2::FileExt;
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Cache {
+    company_id: String,
+    report: InstallationReport,
+}
+
+fn uuid() -> String {
+    use rand::RngCore;
+    let mut bytes = [0u8; 16];
+    rand::rngs::OsRng.fill_bytes(&mut bytes);
+    bytes[6] = (bytes[6] & 15) | 64;
+    bytes[8] = (bytes[8] & 63) | 128;
+    let hex = hex::encode(bytes);
+    format!("{}-{}-{}-{}-{}", &hex[..8], &hex[8..12], &hex[12..16], &hex[16..20], &hex[20..])
+}
+
+fn locked(directory: &Path) -> Result<std::fs::File> {
+    // The existing installed state directory supplies the Windows ACL. Never
+    // create an alternate directory with weaker permissions for diagnostics.
+    ensure!(directory.join("managed-state.json").is_file(), "Installed company state required");
+    let mut options = std::fs::OpenOptions::new();
+    options.create(true).read(true).write(true);
+    #[cfg(unix)] {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    let file = options.open(directory.join("installation-report.lock"))?;
+    file.try_lock_exclusive().context("Another installation reporter is busy")?;
+    Ok(file)
+}
+
+fn read(directory: &Path) -> Result<Option<Cache>> {
+    match std::fs::read(directory.join("installation-report.json")) {
+        Ok(bytes) => {
+            let cache: Cache = serde_json::from_slice(&bytes)?;
+            cache.report.validate()?;
+            Ok(Some(cache))
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(error) => Err(error.into()),
+    }
+}
+
+fn save(directory: &Path, cache: &Cache) -> Result<()> {
+    use std::io::Write;
+    let temporary = directory.join(format!("installation-report-{}.tmp", random_token()));
+    let mut options = std::fs::OpenOptions::new();
+    options.create_new(true).write(true);
+    #[cfg(unix)] {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    let result = (|| -> Result<()> {
+        let mut file = options.open(&temporary)?;
+        file.write_all(&serde_json::to_vec(cache)?)?;
+        file.sync_all()?;
+        drop(file);
+        crate::replace_state(&temporary, &directory.join("installation-report.json"))
+    })();
+    if result.is_err() && temporary.exists() { std::fs::remove_file(temporary)?; }
+    result
+}
+
+fn prepare(directory: &Path, phase: Option<UpdatePhase>, target: Option<u64>, downloaded: u64, total: Option<u64>) -> Result<(AgentState, InstallationReport)> {
+    let _lock = locked(directory)?;
+    ensure!(!directory.join("pending-uninstall").exists(), "Uninstall in progress");
+    let state = AgentState::load(directory)?;
+    let old = read(directory)?;
+    if let Some(old) = &old {
+        ensure!(old.company_id == state.bootstrap.company_id && old.report.identity.edition == state.bootstrap.edition, "Installation report ownership changed");
+    }
+    let installation_id = match state.bootstrap.edition {
+        Edition::Customer => state.device_id.clone().context("Device enrollment required")?,
+        Edition::Technician => old.as_ref().map(|cache| cache.report.identity.installation_id.clone()).unwrap_or_else(uuid),
+    };
+    if let Some(old) = &old { ensure!(old.report.identity.installation_id == installation_id, "Installation identity changed"); }
+    let installed_version = if state.last_release_sequence > 0 {
+        let envelope = serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+        Some(update::validate_previous_release(&state, &envelope, state.last_release_sequence)?.version)
+    } else { None };
+    let (phase, target) = if let Some(phase) = phase { (phase, target) }
+    else if let Some(sequence) = update::pending_report_target(&state, directory)? { (UpdatePhase::Recovering, Some(sequence)) }
+    else { (if state.last_release_sequence > 0 { UpdatePhase::Current } else { UpdatePhase::Checking }, None) };
+    let report = InstallationReport {
+        schema: 1,
+        identity: InstallationIdentity { edition: state.bootstrap.edition.clone(), installation_id },
+        revision: old.map(|cache| cache.report.revision).unwrap_or(0).checked_add(1).context("Report revision exhausted")?,
+        installed_sequence: state.last_release_sequence,
+        installed_version,
+        phase,
+        target_sequence: target, downloaded_bytes: downloaded, total_bytes: total,
+    };
+    report.validate()?;
+    save(directory, &Cache { company_id: state.bootstrap.company_id.clone(), report: report.clone() })?;
+    Ok((state, report))
+}
+
+fn rebase(directory: &Path, company: &str, report: &InstallationReport, remote_revision: u64) -> Result<Option<InstallationReport>> {
+    let _lock = locked(directory)?;
+    let Some(mut cache) = read(directory)? else { return Ok(None); };
+    // An old asynchronous response cannot replace a newer download/install phase.
+    if cache.company_id != company || cache.report != *report { return Ok(None); }
+    cache.report.revision = remote_revision.max(report.revision).checked_add(1).context("Report revision exhausted")?;
+    cache.report.validate()?;
+    save(directory, &cache)?;
+    Ok(Some(cache.report))
+}
+
+/// The caller may log a generic failure, but must continue its normal work.
+pub async fn report(directory: &Path, technician_token: Option<&str>, phase: Option<UpdatePhase>, target: Option<u64>, downloaded: u64, total: Option<u64>) -> Result<()> {
+    let folder = directory.to_owned();
+    let (state, report) = tokio::task::spawn_blocking(move || prepare(&folder, phase, target, downloaded, total)).await.context("Report preparation task failed")??;
+    let token = match state.bootstrap.edition {
+        Edition::Customer => state.device_token.as_deref().context("Device enrollment required")?,
+        Edition::Technician => technician_token.context("Current technician login required")?,
+    };
+    let client = crate::http_client(3, false)?;
+    let endpoint = state.endpoint("installations/report")?;
+    transmit(directory, &state.bootstrap.company_id, report, token, client, &endpoint).await
+}
+
+async fn transmit(directory: &Path, company: &str, mut report: InstallationReport, token: &str, client: reqwest::Client, endpoint: &str) -> Result<()> {
+    let response = client.post(endpoint).bearer_auth(token).json(&report).send().await?;
+    if response.status() != reqwest::StatusCode::CONFLICT { response.error_for_status()?; return Ok(()); }
+    let remote: Value = client.get(endpoint).query(&report.identity).bearer_auth(token).send().await?.error_for_status()?.json().await?;
+    let revision = remote["revision"].as_u64().context("Missing remote report revision")?;
+    let folder = directory.to_owned(); let company = company.to_owned(); let previous = report.clone();
+    let Some(rebased) = tokio::task::spawn_blocking(move || rebase(&folder, &company, &previous, revision)).await.context("Report revision recovery task failed")?? else { return Ok(()); };
+    report = rebased;
+    // One bounded retry; a concurrent reporter wins naturally on the server.
+    client.post(endpoint).bearer_auth(token).json(&report).send().await?.error_for_status()?;
+    Ok(())
+}
+
+pub async fn heartbeat(directory: &Path, technician_token: Option<&str>) {
+    if report(directory, technician_token, None, None, 0, None).await.is_err() {
+        eprintln!("Installation status reporting deferred");
+    }
+}
+
+pub async fn progress(directory: &Path, technician_token: Option<&str>, phase: UpdatePhase, target: Option<u64>, downloaded: u64, total: Option<u64>) {
+    if report(directory, technician_token, Some(phase), target, downloaded, total).await.is_err() {
+        eprintln!("Installation status reporting deferred");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn identity_and_revision_survive_restart_without_credentials_and_stale_callbacks_lose() {
+        let directory = std::env::temp_dir().join(format!("swan-report-{}", random_token()));
+        std::fs::create_dir(&directory).unwrap();
+        std::fs::write(directory.join("managed-state.json"), b"test lock prerequisite").unwrap();
+        let report = InstallationReport { schema: 1, identity: InstallationIdentity { edition: Edition::Technician, installation_id: uuid() }, revision: 1, installed_sequence: 0, installed_version: None, phase: UpdatePhase::Checking, target_sequence: None, downloaded_bytes: 0, total_bytes: None };
+        report.validate().unwrap();
+        { let _lock = locked(&directory).unwrap(); save(&directory, &Cache { company_id: "company".into(), report: report.clone() }).unwrap(); }
+        assert_eq!(read(&directory).unwrap().unwrap().report, report);
+        let next = rebase(&directory, "company", &report, 81).unwrap().unwrap();
+        assert_eq!(next.revision, 82);
+        assert_eq!(next.identity, report.identity);
+        assert!(rebase(&directory, "company", &report, 100).unwrap().is_none());
+        assert!(rebase(&directory, "other-company", &next, 100).unwrap().is_none());
+        let bytes = std::fs::read_to_string(directory.join("installation-report.json")).unwrap();
+        for secret in ["token", "password", "totp", "private_key"] { assert!(!bytes.contains(secret)); }
+        #[cfg(unix)] { use std::os::unix::fs::PermissionsExt; assert_eq!(std::fs::metadata(directory.join("installation-report.json")).unwrap().permissions().mode() & 0o777, 0o600); }
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+
+    #[test]
+    fn preparation_uses_enrolled_identity_and_never_guesses_installed_version() {
+        let directory = std::env::temp_dir().join(format!("swan-report-state-{}", random_token()));
+        let mut state = crate::tests::fixture();
+        state.device_id = Some(uuid());
+        state.save(&directory).unwrap();
+        let (_, first) = prepare(&directory, None, None, 0, None).unwrap();
+        assert_eq!(Some(&first.identity.installation_id), state.device_id.as_ref());
+        assert_eq!(first.installed_version, None);
+        assert_eq!(first.phase, UpdatePhase::Checking);
+        let (_, second) = prepare(&directory, Some(UpdatePhase::Downloading), Some(10), 50, Some(100)).unwrap();
+        assert_eq!(second.revision, first.revision + 1);
+        assert_eq!(second.identity, first.identity);
+        assert_eq!(second.downloaded_bytes, 50);
+        state.last_release_sequence = 9; state.save(&directory).unwrap();
+        assert!(prepare(&directory, None, None, 0, None).is_err(), "Missing signed installation must not be guessed from agent version");
+        assert_eq!(read(&directory).unwrap().unwrap().report, second);
+        std::fs::write(directory.join("installed-release.json"), b"{}").unwrap();
+        assert!(prepare(&directory, None, None, 0, None).is_err());
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+
+    #[test]
+    fn technician_restarts_and_concurrent_reporters_keep_one_identity_and_unique_revisions() {
+        let directory = std::env::temp_dir().join(format!("swan-report-tech-{}", random_token()));
+        let mut state = crate::tests::fixture();
+        state.bootstrap.edition = Edition::Technician;
+        state.device_id = None; state.device_token = None;
+        state.save(&directory).unwrap();
+        let (_, first) = prepare(&directory, None, None, 0, None).unwrap();
+        {
+            let _busy = locked(&directory).unwrap();
+            assert!(prepare(&directory, None, None, 0, None).is_err(), "Busy reporting must defer instead of waiting on another process");
+        }
+        let handles: Vec<_> = (0..8).map(|_| {
+            let folder = directory.clone();
+            std::thread::spawn(move || {
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+                loop {
+                    if let Ok((_, report)) = prepare(&folder, None, None, 0, None) { break report; }
+                    assert!(std::time::Instant::now() < deadline, "Concurrent reporter never completed");
+                    std::thread::sleep(std::time::Duration::from_millis(1));
+                }
+            })
+        }).collect();
+        let mut revisions = Vec::new();
+        for handle in handles {
+            let report = handle.join().unwrap();
+            assert_eq!(report.identity, first.identity);
+            revisions.push(report.revision);
+        }
+        revisions.sort_unstable(); assert_eq!(revisions, (2..=9).collect::<Vec<_>>());
+        std::fs::write(directory.join("installation-report.json"), b"corrupt cache").unwrap();
+        assert!(prepare(&directory, None, None, 0, None).is_err(), "Corrupt state cannot reset identity and counters");
+        std::fs::remove_dir_all(directory).unwrap();
+    }
+
+    #[tokio::test]
+    async fn http_conflict_recovers_once_and_a_newer_local_phase_cancels_old_retry() {
+        use axum::{extract::State, http::{HeaderMap, StatusCode}, routing::post, Json, Router};
+        use std::sync::{Arc, Mutex};
+        #[derive(Clone)]
+        struct Fixture { reports: Arc<Mutex<Vec<InstallationReport>>>, directory: PathBuf, newer: bool }
+        async fn receive(State(fixture): State<Fixture>, headers: HeaderMap, Json(report): Json<InstallationReport>) -> StatusCode {
+            assert_eq!(headers["authorization"], "Bearer test-session-memory-only");
+            let mut reports = fixture.reports.lock().unwrap(); reports.push(report);
+            if reports.len() == 1 { StatusCode::CONFLICT } else { StatusCode::OK }
+        }
+        async fn previous(State(fixture): State<Fixture>, headers: HeaderMap) -> Json<Value> {
+            assert_eq!(headers["authorization"], "Bearer test-session-memory-only");
+            if fixture.newer {
+                let folder = fixture.directory.clone();
+                tokio::task::spawn_blocking(move || {
+                    let _lock = locked(&folder).unwrap();
+                    let mut cache = read(&folder).unwrap().unwrap();
+                    cache.report.revision += 1; cache.report.phase = UpdatePhase::Preparing;
+                    cache.report.target_sequence = Some(10);
+                    save(&folder, &cache).unwrap();
+                }).await.unwrap();
+            }
+            Json(json!({"revision": 40}))
+        }
+        for newer in [false, true] {
+            let directory = std::env::temp_dir().join(format!("swan-report-http-{}", random_token()));
+            let mut state = crate::tests::fixture(); state.device_id = Some(uuid()); state.save(&directory).unwrap();
+            let (_, report) = prepare(&directory, None, None, 0, None).unwrap();
+            let fixture = Fixture { reports: Arc::new(Mutex::new(Vec::new())), directory: directory.clone(), newer };
+            let app = Router::new().route("/report", post(receive).get(previous)).with_state(fixture.clone());
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let endpoint = format!("http://{}/report", listener.local_addr().unwrap());
+            let server = tokio::spawn(async move { axum::serve(listener, app).await.unwrap(); });
+            // Only this private transport fixture accepts HTTP. Production builds
+            // derive a validated HTTPS company endpoint and forbid redirects.
+            transmit(&directory, &state.bootstrap.company_id, report, "test-session-memory-only", reqwest::Client::new(), &endpoint).await.unwrap();
+            let reports = fixture.reports.lock().unwrap().clone();
+            assert_eq!(reports.len(), if newer { 1 } else { 2 });
+            let saved = read(&directory).unwrap().unwrap().report;
+            if newer { assert_eq!(saved.phase, UpdatePhase::Preparing); assert_eq!(saved.revision, 2); }
+            else { assert_eq!(reports[1].revision, 41); assert_eq!(saved, reports[1]); }
+            server.abort(); let _ = server.await;
+            std::fs::remove_dir_all(directory).unwrap();
+        }
+    }
+}
diff --git a/product/agent/src/technician.rs b/product/agent/src/technician.rs
new file mode 100644
index 00000000000..b38e31b004f
--- /dev/null
+++ b/product/agent/src/technician.rs
@@ -0,0 +1,35 @@
+//! HTTPS technician operations. Credentials and session tokens are never saved.
+use crate::{protocol::*, AgentState};
+use anyhow::{ensure, Context, Result};
+use ed25519_dalek::SigningKey;
+use serde_json::{json, Value};
+
+impl AgentState {
+    pub async fn technician_login(&self, username:&str, password:&str, code:&str)->Result<String> {
+        ensure!(self.bootstrap.edition==Edition::Technician,"Technician edition required");
+        self.company_profile()?;
+        ensure!(!username.is_empty() && username.len()<=100 && password.len()<=256 && code.len()==6 && code.bytes().all(|b|b.is_ascii_digit()),"Invalid login input");
+        let response:Value=self.client()?.post(self.endpoint("login")?).json(&json!({"username":username,"password":password,"totp_code":code})).send().await?.error_for_status()?.json().await?;
+        Ok(response["token"].as_str().context("Missing authenticated token")?.to_owned())
+    }
+    pub async fn technician_inventory(&self, token:&str)->Result<Value> {
+        ensure!(self.bootstrap.edition==Edition::Technician,"Technician edition required");
+        self.company_profile()?;
+        Ok(self.client()?.get(self.endpoint("devices")?).bearer_auth(token).send().await?.error_for_status()?.json().await?)
+    }
+    pub async fn technician_history(&self, token:&str)->Result<Value> {
+        ensure!(self.bootstrap.edition==Edition::Technician,"Technician edition required");
+        self.company_profile()?;
+        Ok(self.client()?.get(self.endpoint("sessions")?).bearer_auth(token).send().await?.error_for_status()?.json().await?)
+    }
+    pub async fn technician_logout(&self, token:&str)->Result<()> {
+        ensure!(self.bootstrap.edition==Edition::Technician,"Technician edition required");
+        self.client()?.post(self.endpoint("logout")?).bearer_auth(token).send().await?.error_for_status()?;
+        Ok(())
+    }
+    pub async fn technician_ticket(&self, token:&str, device:&str, unattended:bool, key:&SigningKey)->Result<(SignedEnvelope,SessionGrant)> {
+        let envelope=self.request_grant(token,device,unattended,key).await?;
+        let grant:SessionGrant=envelope.verify(&public_key(&self.bootstrap.profile_public_key)?)?;
+        Ok((envelope,grant))
+    }
+}
diff --git a/product/agent/src/technician_runtime.rs b/product/agent/src/technician_runtime.rs
new file mode 100644
index 00000000000..4661fb86f72
--- /dev/null
+++ b/product/agent/src/technician_runtime.rs
@@ -0,0 +1,102 @@
+//! Process-lifetime exclusion for explicit technician removal, not session authority.
+use anyhow::{ensure, Context, Result};
+use std::{fs::File, path::Path};
+#[cfg(any(windows, test))]
+use std::time::{Duration, Instant};
+
+fn open(directory: &Path) -> Result<File> {
+    let mut options = std::fs::OpenOptions::new();
+    options.create(true).read(true).write(true);
+    #[cfg(windows)] {
+        use std::os::windows::fs::OpenOptionsExt;
+        // A remover must observe the same file until every native process exits.
+        options.share_mode(0x1 | 0x2); // FILE_SHARE_READ | FILE_SHARE_WRITE
+    }
+    #[cfg(unix)] {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    options.open(directory.join("technician-runtime.lock"))
+        .context("Cannot open technician runtime registration")
+}
+
+pub fn register(directory: &Path) -> Result<File> {
+    let marker = directory.join("pending-uninstall");
+    ensure!(!marker.try_exists()?, "Technician removal is in progress");
+    let file = open(directory)?;
+    fs2::FileExt::try_lock_shared(&file).context("Technician removal is in progress")?;
+    ensure!(!marker.try_exists()?, "Technician removal began during startup");
+    Ok(file)
+}
+
+#[cfg(any(windows, test))]
+pub(crate) fn wait_for_exit(directory: &Path, timeout: Duration) -> Result<()> {
+    let file = open(directory)?;
+    let deadline = Instant::now() + timeout;
+    loop {
+        ensure!(directory.join("pending-uninstall").try_exists()?, "Technician removal was cancelled");
+        match fs2::FileExt::try_lock_exclusive(&file) {
+            Ok(()) => return Ok(()),
+            Err(error) if error.raw_os_error() == fs2::lock_contended_error().raw_os_error() => {
+                ensure!(Instant::now() < deadline, "Close the technician application before removing it; no application files were removed");
+                std::thread::sleep(Duration::from_millis(50));
+            }
+            Err(error) => return Err(error).context("Cannot verify technician shutdown"),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn directory() -> std::path::PathBuf {
+        let path = std::env::temp_dir().join(format!("swan-technician-runtime-{}", crate::protocol::random_token()));
+        std::fs::create_dir(&path).unwrap();
+        path
+    }
+
+    fn cleanup(path: &Path) {
+        assert_eq!(std::fs::canonicalize(path).unwrap().parent(), Some(std::fs::canonicalize(std::env::temp_dir()).unwrap().as_path()));
+        std::fs::remove_dir_all(path).unwrap();
+    }
+
+    #[test]
+    fn removal_waits_for_every_registered_process() {
+        let path = directory();
+        let first = register(&path).unwrap();
+        let second = register(&path).unwrap();
+        std::fs::write(path.join("pending-uninstall"), b"").unwrap();
+        assert!(wait_for_exit(&path, Duration::from_millis(1)).is_err());
+        drop(first);
+        assert!(wait_for_exit(&path, Duration::from_millis(1)).is_err());
+        drop(second);
+        wait_for_exit(&path, Duration::from_millis(1)).unwrap();
+        cleanup(&path);
+    }
+
+    #[test]
+    fn cancellation_rejects_startup_and_missing_cancellation_rejects_removal() {
+        let path = directory();
+        assert!(wait_for_exit(&path, Duration::ZERO).is_err());
+        std::fs::write(path.join("pending-uninstall"), b"").unwrap();
+        assert!(register(&path).is_err());
+        wait_for_exit(&path, Duration::ZERO).unwrap();
+        std::fs::remove_file(path.join("pending-uninstall")).unwrap();
+        drop(register(&path).unwrap());
+        cleanup(&path);
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn active_registration_prevents_replacing_the_lock_file() {
+        let path = directory();
+        let runtime = register(&path).unwrap();
+        let lock = path.join("technician-runtime.lock");
+        assert!(std::fs::remove_file(&lock).is_err());
+        assert!(std::fs::rename(&lock, path.join("replaced.lock")).is_err());
+        drop(runtime);
+        std::fs::remove_file(&lock).unwrap();
+        cleanup(&path);
+    }
+}
diff --git a/product/agent/src/update.rs b/product/agent/src/update.rs
new file mode 100644
index 00000000000..5dc49dc0c0b
--- /dev/null
+++ b/product/agent/src/update.rs
@@ -0,0 +1,1921 @@
+//! Company-approved endpoint updates. No package code executes before metadata,
+//! bytes, publisher and session exclusion have been checked.
+use crate::*;
+use anyhow::{ensure,Context,Result};
+use serde::{Deserialize,Serialize};
+use std::path::Path;
+
+#[derive(Clone,Serialize,Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Receipt {
+    release:SignedEnvelope,
+    previous_sequence:u64,
+    phase:String,
+    #[serde(default)]
+    previous_release:Option<SignedEnvelope>,
+    #[serde(default)]
+    rollback_protocol:u32,
+}
+
+fn require_existing_application(target:&Path)->Result<()> {
+    ensure!(target.is_file(),"Application was removed; automatic updates cannot reinstall it. Run explicit company setup or repair.");
+    Ok(())
+}
+
+#[cfg(windows)]
+fn installed_target(directory:&Path,edition:&Edition)->Result<std::path::PathBuf> {
+    if *edition==Edition::Technician {Ok(directory.join("SwanRemoteSupport-Technician.exe"))}else{
+        Ok(std::path::PathBuf::from(std::env::var_os("ProgramFiles").context("ProgramFiles unavailable")?).join("Swan Remote Support/Swan Remote Support.exe"))
+    }
+}
+
+pub fn validate_release(state:&AgentState,envelope:&SignedEnvelope)->Result<Release> {
+    let profile=state.company_profile()?;
+    let release:Release=envelope.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+    release.validate(&state.bootstrap.edition,state.last_release_sequence,now())?;
+    ensure!(release.channel==profile.update_channel,"Wrong update channel");
+    Ok(release)
+}
+
+pub fn validate_repair_release(state:&AgentState,envelope:&SignedEnvelope,installed:&SignedEnvelope)->Result<Release> {
+    state.company_profile()?;
+    ensure!(state.last_release_sequence>0,"Repair requires a previously recorded installation");
+    let key=public_key(&state.bootstrap.release_public_key)?;
+    let release:Release=envelope.verify(&key)?;
+    let previous:Release=installed.verify(&key)?;
+    ensure!(envelope.payload==installed.payload && envelope.signature==installed.signature && release.sequence==previous.sequence && release.sequence==state.last_release_sequence,"Repair must use the exact currently pinned release");
+    release.validate(&state.bootstrap.edition,state.last_release_sequence-1,now())?;
+    Ok(release)
+}
+
+pub(crate) fn validate_recovery_release(state:&AgentState,envelope:&SignedEnvelope,previous_sequence:u64,phase:&str)->Result<Release> {
+    ensure!(matches!(phase,"installing"|"rolling_back"),"Unknown update recovery phase");
+    let release:Release=envelope.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+    release.validate(&state.bootstrap.edition,previous_sequence,now().min(release.expires_at.saturating_sub(1)))?;
+    ensure!(state.last_release_sequence==previous_sequence || state.last_release_sequence==release.sequence,"Recovery sequence conflict");
+    Ok(release)
+}
+
+#[cfg(any(windows,test))]
+fn installation_release(state:&AgentState,directory:&Path,envelope:&SignedEnvelope,repair:bool)->Result<Release> {
+    cancelled_pending_update(state,directory)?;
+    let setup_marker=directory.join("pending-install.json");
+    let completion=if !repair && setup_marker.exists() {
+        let marker:SignedEnvelope=serde_json::from_slice(&std::fs::read(setup_marker)?)?;
+        let requested:Release=envelope.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+        marker.payload==envelope.payload && marker.signature==envelope.signature && requested.sequence==state.last_release_sequence
+    }else{false};
+    if repair || completion {
+        let installed:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+        validate_repair_release(state,envelope,&installed)
+    }else{
+        let release=validate_release(state,envelope)?;
+        ensure!(release.sequence>failed_release_sequence(state,directory)?,"Failed release is quarantined; approve a newer release");
+        Ok(release)
+    }
+}
+
+#[cfg(any(windows,test))]
+fn cancelled_pending_update(state:&AgentState,directory:&Path)->Result<Option<(Receipt,Vec<u8>)>> {
+    let bytes=match std::fs::read(directory.join("pending-update.json")) {
+        Ok(bytes)=>bytes,
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>return Ok(None),
+        Err(error)=>return Err(error).context("Cannot inspect pending update for explicit setup"),
+    };
+    ensure!(directory.join("pending-uninstall").exists(),"Resolve active update recovery before explicit setup");
+    let receipt:Receipt=serde_json::from_slice(&bytes)?;
+    validate_pending_receipt(state,&receipt)?;
+    Ok(Some((receipt,bytes)))
+}
+
+#[cfg(any(windows,test))]
+fn archive_cancelled_update(state:&AgentState,directory:&Path)->Result<()> {
+    let Some((receipt,bytes))=cancelled_pending_update(state,directory)? else{return Ok(());};
+    let release=validate_pending_receipt(state,&receipt)?;
+    let folder=directory.join("updates").join(release.sequence.to_string());
+    std::fs::create_dir_all(&folder)?;
+    let archive=folder.join("cancelled-update.json");
+    match std::fs::read(&archive) {
+        Ok(saved)=>ensure!(saved==bytes,"Cancelled update archive differs; refuse to overwrite evidence"),
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>publish_initial_bytes(&archive,&bytes)?,
+        Err(error)=>return Err(error).context("Cannot inspect cancelled update archive"),
+    }
+    ensure!(directory.join("pending-uninstall").exists() && std::fs::read(directory.join("pending-update.json"))?==bytes,"Cancellation changed while preparing setup");
+    std::fs::remove_file(directory.join("pending-update.json"))?;
+    Ok(())
+}
+
+#[cfg(any(windows,test))]
+fn prepare_installation_marker(directory:&Path,envelope:&SignedEnvelope)->Result<()> {
+    let path=directory.join("pending-install.json");
+    match std::fs::read(&path) {
+        Ok(bytes)=>{
+            let stored:SignedEnvelope=serde_json::from_slice(&bytes)?;
+            ensure!(stored.payload==envelope.payload && stored.signature==envelope.signature,"Another company setup must be recovered first");
+            Ok(())
+        },
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>publish_initial_bytes(&path,&serde_json::to_vec(envelope)?),
+        Err(error)=>Err(error).context("Cannot inspect company setup recovery marker"),
+    }
+}
+
+#[cfg(any(windows,test))]
+#[derive(Debug,PartialEq,Eq)]
+struct SetupUiOperation { id:String, marker_sha256:String }
+
+#[cfg(any(windows,test))]
+fn setup_ui_operation(directory:&Path,envelope:&SignedEnvelope)->Result<SetupUiOperation> {
+    use std::io::Read;
+    let file=std::fs::File::open(directory.join("pending-install.json"))?;
+    let modified=file.metadata()?.modified()?.duration_since(std::time::UNIX_EPOCH)?.as_nanos();
+    let mut bytes=Vec::new();file.take(2*1024*1024+1).read_to_end(&mut bytes)?;
+    ensure!(bytes.len()<=2*1024*1024,"Setup marker exceeds size limit");
+    let marker:SignedEnvelope=serde_json::from_slice(&bytes)?;
+    ensure!(marker.payload==envelope.payload && marker.signature==envelope.signature,"Another setup owns UI recovery");
+    let marker_sha256=digest(&bytes);
+    // Last-write time distinguishes a new same-release repair from an older
+    // completed transaction, while retries retain the original operation.
+    let id=digest(format!("{marker_sha256}:{modified}").as_bytes())[..32].to_owned();
+    Ok(SetupUiOperation{id,marker_sha256})
+}
+
+#[cfg(test)]
+#[test]
+fn explicit_ui_transaction_distinguishes_retry_repair_and_foreign_marker() {
+    let root=std::env::temp_dir().join(format!("swan-setup-ui-{}",random_token()));
+    std::fs::create_dir(&root).unwrap();
+    let envelope=SignedEnvelope{payload:"fixture payload".into(),signature:"fixture signature".into()};
+    assert!(setup_ui_operation(&root,&envelope).is_err());
+    prepare_installation_marker(&root,&envelope).unwrap();
+    let first=setup_ui_operation(&root,&envelope).unwrap();
+    prepare_installation_marker(&root,&envelope).unwrap();
+    assert_eq!(setup_ui_operation(&root,&envelope).unwrap(),first,"Retry must resume its original task identity");
+    let foreign=SignedEnvelope{payload:"another payload".into(),signature:envelope.signature.clone()};
+    assert!(setup_ui_operation(&root,&foreign).is_err());
+    let marker=root.join("pending-install.json");
+    let file=std::fs::OpenOptions::new().write(true).open(&marker).unwrap();
+    let later=file.metadata().unwrap().modified().unwrap()+std::time::Duration::from_secs(2);
+    file.set_times(std::fs::FileTimes::new().set_modified(later)).unwrap();drop(file);
+    let repair=setup_ui_operation(&root,&envelope).unwrap();
+    assert_eq!(first.marker_sha256,repair.marker_sha256);
+    assert_ne!(first.id,repair.id,"New same-release setup must not reuse a completed transaction");
+    std::fs::write(&marker,b"interrupted marker").unwrap();
+    assert!(setup_ui_operation(&root,&envelope).is_err());
+    std::fs::write(&marker,vec![b' ';2*1024*1024+1]).unwrap();
+    assert!(setup_ui_operation(&root,&envelope).is_err());
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+#[cfg(windows)]
+#[derive(Serialize)]
+struct SetupUiCompletion<'a> {
+    schema:u32, operation_id:&'a str, operation:&'a str,
+    marker_sha256:&'a str, agent_sha256:&'a str, system_context:bool,
+}
+
+#[cfg(windows)]
+fn run_setup_ui_broker(directory:&Path,operation:&str,context:Option<&SetupUiOperation>,agent_hash:&str)->Result<()> {
+    prepare_customer_directory(directory,true)?;
+    let script=directory.join("setup-ui-broker.ps1");
+    publish_download(&script,include_bytes!("../../../deployment/windows/Run-SetupUiTask.ps1"))?;
+    prepare_customer_directory(directory,true)?;
+    let mut command=powershell_command()?;
+    command.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(script)
+        .arg("-Directory").arg(directory).arg("-Operation").arg(operation);
+    if let Some(context)=context {
+        command.arg("-OperationId").arg(&context.id).arg("-AgentSha256").arg(agent_hash.to_ascii_lowercase())
+            .arg("-MarkerSha256").arg(&context.marker_sha256);
+    }
+    let mut child=command.stdin(std::process::Stdio::null()).spawn()?;
+    let status=crate::verifier_process::wait_with_message(&mut child,std::time::Duration::from_secs(930),
+        "Explicit setup UI recovery timed out; signed setup remains pending")?;
+    ensure!(status.success(),"Explicit setup UI recovery failed; preserve the signed setup marker and retry verified company setup");
+    Ok(())
+}
+
+#[cfg(windows)]
+fn explicit_setup_ui(directory:&Path,envelope:&SignedEnvelope,release:&Release,operation:&str)->Result<()> {
+    use std::io::Read;
+    ensure!(matches!(operation,"prepare"|"restart"),"Unknown explicit setup UI operation");
+    prepare_customer_directory(directory,true)?;
+    let context=setup_ui_operation(directory,envelope)?;
+    let source=std::fs::File::open(std::env::current_exe()?)?;
+    let mut bytes=Vec::new();source.take(64*1024*1024+1).read_to_end(&mut bytes)?;
+    ensure!(bytes.len()<=64*1024*1024 && digest(&bytes).eq_ignore_ascii_case(&release.agent_sha256),"Setup UI requires the exact signed release agent");
+    let stage=directory.join("setup-ui").join(&context.id);
+    std::fs::create_dir_all(&stage)?;
+    let helper=stage.join("swan-agent.exe");
+    if helper.exists(){ensure!(staged_hash_matches(&helper,&release.agent_sha256)?,"Existing setup UI helper differs");}
+    else{publish_initial_bytes(&helper,&bytes)?;}
+    prepare_customer_directory(directory,true)?;
+    let mut agent_release=release.clone();agent_release.sha256=release.agent_sha256.clone();
+    verify_publisher(&helper,&agent_release)?;
+    run_setup_ui_broker(directory,operation,Some(&context),&release.agent_sha256)
+}
+
+/// Fixed SYSTEM-only task entry point. The parent retains session exclusion;
+/// acquiring its activity lock again here would deadlock explicit setup.
+#[cfg(windows)]
+pub fn complete_setup_ui_task(directory:&Path,operation:&str,operation_id:&str)->Result<()> {
+    ensure!(matches!(operation,"prepare"|"restart"),"Unknown setup UI task operation");
+    prepare_customer_directory(directory,true)?;
+    ensure!(!directory.join("pending-uninstall").exists(),"Uninstall cancels setup UI recovery");
+    let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("pending-install.json"))?)?;
+    let context=setup_ui_operation(directory,&envelope)?;
+    ensure!(context.id==operation_id,"Setup UI task belongs to another transaction");
+    let state=AgentState::load(directory)?;
+    ensure!(state.bootstrap.edition==Edition::Customer,"Setup UI recovery requires customer edition");
+    let release=installation_release(&state,directory,&envelope,false)?;
+    let helper=directory.join("setup-ui").join(&context.id).join("swan-agent.exe");
+    ensure!(std::fs::canonicalize(std::env::current_exe()?)?==std::fs::canonicalize(&helper)? && staged_hash_matches(&helper,&release.agent_sha256)?,"Setup UI task must use its exact staged signed agent");
+    let target=installed_target(directory,&Edition::Customer)?;
+    if operation=="prepare" {
+        let old_hash=if state.last_release_sequence>0 {
+            let installed:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+            validate_previous_release(&state,&installed,state.last_release_sequence)?.installed_sha256
+        }else{
+            if target.exists(){ensure!(staged_hash_matches(&target,&release.installed_sha256)?,"Existing unrecorded software requires an explicit migration before setup");}
+            release.installed_sha256.clone()
+        };
+        customer_ui_recovery(directory,&target,"prepare",&format!("{old_hash},{}",release.installed_sha256).to_ascii_lowercase())?;
+    }else{
+        ensure!(state.last_release_sequence==release.sequence,"UI restoration requires committed installation metadata");
+        verify_installed(directory,&release)?;
+        customer_ui_recovery(directory,&target,"restart","")?;
+    }
+    // The UI helper independently requires SYSTEM even when no window exists.
+    ensure!(!directory.join("pending-uninstall").exists() && setup_ui_operation(directory,&envelope)?==context,"Setup changed during UI recovery");
+    let agent_hash=release.agent_sha256.to_ascii_lowercase();
+    let receipt=SetupUiCompletion {schema:1,operation_id:&context.id,operation,marker_sha256:&context.marker_sha256,agent_sha256:&agent_hash,system_context:true};
+    publish_download(&helper.parent().context("Missing setup helper directory")?.join(format!("{operation}-result.json")),&serde_json::to_vec(&receipt)?)
+}
+
+#[cfg(any(windows,test))]
+fn replace_failed_installation_marker(state:&AgentState,directory:&Path,envelope:&SignedEnvelope)->Result<()> {
+    let path=directory.join("pending-install.json");
+    let bytes=std::fs::read(&path).context("Explicit setup replacement requires a pending setup")?;
+    let stored:SignedEnvelope=serde_json::from_slice(&bytes)?;
+    if stored.payload==envelope.payload && stored.signature==envelope.signature {return Ok(());}
+    let key=public_key(&state.bootstrap.release_public_key)?;
+    let previous:Release=stored.verify(&key)?;
+    previous.validate(&state.bootstrap.edition,state.last_release_sequence,now().min(previous.expires_at.saturating_sub(1)))?;
+    let replacement:Release=envelope.verify(&key)?;
+    replacement.validate(&state.bootstrap.edition,previous.sequence,now())?;
+    let archive=directory.join("cancelled-setups");std::fs::create_dir_all(&archive)?;
+    let target=archive.join(format!("{}-{}.json",previous.sequence,digest(&bytes)));
+    if target.exists(){ensure!(std::fs::read(&target)?==bytes,"Conflicting cancelled setup evidence");}
+    else{publish_initial_bytes(&target,&bytes)?;}
+    // Retain the original receipt before atomically replacing the blocking marker.
+    // A crash before replacement leaves the old setup blocked; after replacement
+    // it leaves the new setup blocked until full installation verification.
+    let temporary=directory.join(format!("swan-setup-{}.tmp",random_token()));
+    publish_initial_bytes(&temporary,&serde_json::to_vec(envelope)?)?;
+    let result=crate::replace_state(&temporary,&path);
+    if result.is_err() && temporary.exists(){std::fs::remove_file(&temporary)?;}
+    result
+}
+
+fn validate_pending_receipt(state:&AgentState,receipt:&Receipt)->Result<Release> {
+    ensure!(receipt.rollback_protocol<=1,"Unsupported pending rollback protocol");
+    let release=validate_recovery_release(state,&receipt.release,receipt.previous_sequence,&receipt.phase)?;
+    if let Some(previous)=receipt.previous_release.as_ref(){
+        let old=validate_previous_release(state,previous,receipt.previous_sequence)?;
+        ensure!(old.format==release.format,"Installer format migration requires explicit setup");
+    }
+    if receipt.phase=="rolling_back" {
+        ensure!(state.last_release_sequence==receipt.previous_sequence,"Cannot roll back a committed newer installation");
+        let previous=receipt.previous_release.as_ref().context("Rollback requires previous release metadata")?;
+        ensure!(receipt.rollback_protocol==1 && validate_previous_release(state,previous,receipt.previous_sequence)?.rollback_protocol==1,"Previous release cannot enforce rollback quarantine");
+    }
+    Ok(release)
+}
+
+pub(crate) fn pending_report_target(state:&AgentState,directory:&Path)->Result<Option<u64>> {
+    let bytes=match std::fs::read(directory.join("pending-update.json")) {
+        Ok(bytes)=>bytes,
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>return Ok(None),
+        Err(error)=>return Err(error.into()),
+    };
+    let receipt:Receipt=serde_json::from_slice(&bytes)?;
+    Ok(Some(validate_pending_receipt(state,&receipt)?.sequence))
+}
+
+#[cfg(any(windows,test))]
+fn validate_completion_receipt(state:&AgentState,receipt:&Receipt)->Result<Release> {
+    ensure!(receipt.phase=="installing","Use resume-update to finish pending rollback");
+    validate_pending_receipt(state,receipt)
+}
+
+fn failed_release_sequence(state:&AgentState,directory:&Path)->Result<u64> {
+    let path=directory.join("failed-update.json");
+    let bytes=match std::fs::read(path) {
+        Ok(bytes)=>bytes,
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>return Ok(0),
+        Err(error)=>return Err(error).context("Cannot read failed update quarantine"),
+    };
+    let receipt:Receipt=serde_json::from_slice(&bytes)?;
+    ensure!(receipt.phase=="rolled_back" && receipt.rollback_protocol==1,"Invalid failed update quarantine");
+    let release:Release=receipt.release.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+    release.validate(&state.bootstrap.edition,receipt.previous_sequence,now().min(release.expires_at.saturating_sub(1)))?;
+    let previous=receipt.previous_release.context("Failed update lacks previous release")?;
+    ensure!(validate_previous_release(state,&previous,receipt.previous_sequence)?.rollback_protocol==1,"Previous release does not support quarantine");
+    Ok(release.sequence)
+}
+
+async fn download(url:&str,hash:&str,path:&Path)->Result<()> {
+    download_reporting(url,hash,path,None).await
+}
+
+async fn download_reporting(url:&str,hash:&str,path:&Path,reporter:Option<(&Path,Option<&str>,u64)>)->Result<()> {
+    https_url(url)?;
+    // Artifact endpoints may redirect to HTTPS object storage. No credentials
+    // are attached, and reqwest rejects any redirect to plain HTTP.
+    let client=http_client(600,true)?;
+    let mut response=client.get(url).send().await?.error_for_status()?;
+    ensure!(response.content_length().unwrap_or(0)<=512*1024*1024,"Package too large");
+    // A bounded queue keeps large installers off the endpoint's working set.
+    // Only the blocking writer owns staging; a dropped/failed download closes
+    // its channel without Complete and therefore cannot publish partial bytes.
+    let (sender,receiver)=tokio::sync::mpsc::channel(2);
+    let path=path.to_owned();let hash=hash.to_owned();
+    let writer=tokio::task::spawn_blocking(move ||write_download(&path,&hash,receiver,512*1024*1024));
+    let mut downloaded=0u64;
+    let total=response.content_length();
+    let mut last_report=std::time::Instant::now();
+    if let Some((directory,token,sequence))=reporter {reporting::progress(directory,token,UpdatePhase::Downloading,Some(sequence),0,total).await;}
+    let transfer=async {
+    while let Some(chunk)=response.chunk().await? {
+        downloaded=downloaded.checked_add(chunk.len() as u64).context("Package size overflow")?;
+        ensure!(downloaded<=512*1024*1024,"Package too large");
+        sender.send(DownloadPart::Bytes(chunk.to_vec())).await.context("Download staging writer stopped")?;
+        if last_report.elapsed()>=std::time::Duration::from_secs(5) {
+            if let Some((directory,token,sequence))=reporter {reporting::progress(directory,token,UpdatePhase::Downloading,Some(sequence),downloaded,total).await;}
+            last_report=std::time::Instant::now();
+        }
+    }
+    sender.send(DownloadPart::Complete).await.context("Download staging writer stopped")?;
+    Ok::<(),anyhow::Error>(())
+    }.await;
+    drop(sender);
+    let publication=writer.await.context("Download publication task failed")?;
+    transfer?;publication?;
+    if let Some((directory,token,sequence))=reporter {reporting::progress(directory,token,UpdatePhase::Preparing,Some(sequence),downloaded,Some(downloaded)).await;}
+    Ok(())
+}
+
+enum DownloadPart {Bytes(Vec<u8>),Complete}
+
+fn write_download(path:&Path,hash:&str,mut receiver:tokio::sync::mpsc::Receiver<DownloadPart>,limit:u64)->Result<()> {
+    use std::io::Write;
+    use sha2::{Digest,Sha256};
+    let temporary=path.parent().context("Missing download directory")?.join(format!("swan-download-{}.tmp",random_token()));
+    let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&temporary)?;
+    let result=(||->Result<()> {
+        let mut digest=Sha256::new();let mut size=0u64;
+        loop {
+            match receiver.blocking_recv().context("Download interrupted before completion")? {
+                DownloadPart::Bytes(bytes)=>{
+                    size=size.checked_add(bytes.len() as u64).context("Package size overflow")?;
+                    ensure!(size<=limit,"Package too large");
+                    file.write_all(&bytes)?;digest.update(&bytes);
+                },
+                DownloadPart::Complete=>break,
+            }
+        }
+        ensure!(hex::encode(digest.finalize()).eq_ignore_ascii_case(hash),"Package hash mismatch");
+        file.sync_all()?;drop(file);
+        crate::replace_state(&temporary,path).context("Cannot publish complete download")
+    })();
+    if result.is_err(){std::fs::remove_file(&temporary).context("Cannot remove failed download staging file")?;}
+    result
+}
+
+fn publish_download(path:&Path,bytes:&[u8])->Result<()> {
+    use std::io::Write;
+    // A crash or a concurrent reader must see the previous complete download,
+    // never a truncated installer or helper executable.
+    let temporary=path.parent().context("Missing download directory")?.join(format!("swan-download-{}.tmp",random_token()));
+    let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&temporary)?;
+    let result=(||->Result<()> {
+        file.write_all(bytes)?;file.sync_all()?;drop(file);
+        crate::replace_state(&temporary,path).context("Cannot publish complete download")
+    })();
+    if result.is_err(){std::fs::remove_file(&temporary).context("Cannot remove failed download staging file")?;}
+    result
+}
+
+#[cfg(any(windows,test))]
+fn publish_initial_receipt(path:&Path,receipt:&Receipt)->Result<()> {
+    publish_initial_bytes(path,&serde_json::to_vec(receipt)?)
+}
+
+#[cfg(any(windows,test))]
+fn publish_initial_bytes(path:&Path,bytes:&[u8])->Result<()> {
+    use std::io::Write;
+    let temporary=path.parent().context("Missing receipt directory")?.join(format!("swan-receipt-{}.tmp",random_token()));
+    let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&temporary)?;
+    let result=(||->Result<()> {
+        file.write_all(bytes)?;file.sync_all()?;drop(file);
+        #[cfg(windows)] {
+            use std::os::windows::ffi::OsStrExt;
+            use windows_sys::Win32::Storage::FileSystem::{MoveFileExW,MOVEFILE_WRITE_THROUGH};
+            let from:Vec<u16>=temporary.as_os_str().encode_wide().chain(Some(0)).collect();
+            let to:Vec<u16>=path.as_os_str().encode_wide().chain(Some(0)).collect();
+            // Do not replace a receipt another updater already published.
+            if unsafe{MoveFileExW(from.as_ptr(),to.as_ptr(),MOVEFILE_WRITE_THROUGH)}==0 {return Err(std::io::Error::last_os_error().into());}
+        }
+        #[cfg(not(windows))] {std::fs::hard_link(&temporary,path)?;std::fs::remove_file(&temporary)?;}
+        Ok(())
+    })();
+    if result.is_err(){std::fs::remove_file(&temporary).context("Cannot clean failed receipt staging")?;}
+    result
+}
+
+fn staged_hash_matches(path:&Path,hash:&str)->Result<bool> {
+    use std::io::Read;
+    use sha2::{Digest,Sha256};
+    let mut file=match std::fs::File::open(path) {
+        Ok(file)=>file,
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>return Ok(false),
+        Err(error)=>return Err(error).context("Cannot inspect staged download"),
+    };
+    let mut digest=Sha256::new();let mut buffer=[0u8;64*1024];
+    loop {let count=file.read(&mut buffer)?;if count==0 {break;}digest.update(&buffer[..count]);}
+    Ok(hex::encode(digest.finalize()).eq_ignore_ascii_case(hash))
+}
+
+#[cfg(windows)]
+async fn restore_staged_download(path:&Path,url:&str,hash:&str,release:&Release)->Result<()> {
+    let check_path=path.to_owned();let check_hash=hash.to_owned();
+    let valid=tokio::task::spawn_blocking(move ||staged_hash_matches(&check_path,&check_hash)).await.context("Staging inspection task failed")??;
+    if !valid {download(url,hash,path).await?;}
+    let mut artifact_release=release.clone();artifact_release.sha256=hash.to_owned();
+    verify_downloaded_publisher(path,&artifact_release).await
+}
+
+#[cfg(windows)]
+fn system_directory()->Result<std::path::PathBuf> {
+    let mut directory=[0u16;32768];
+    let length=unsafe{windows_sys::Win32::System::SystemInformation::GetSystemDirectoryW(directory.as_mut_ptr(),directory.len() as u32)} as usize;
+    ensure!(length>0 && length<directory.len(),"Cannot resolve trusted Windows system directory");
+    Ok(std::path::PathBuf::from(String::from_utf16(&directory[..length])?))
+}
+
+#[cfg(windows)]
+pub fn powershell_command()->Result<std::process::Command> {
+    use std::os::windows::process::CommandExt;
+    let root=system_directory()?.join("WindowsPowerShell/v1.0");
+    let mut command=std::process::Command::new(root.join("powershell.exe"));
+    // PowerShell 7 can pass its module paths through a Rust child to Windows
+    // PowerShell. Use only Windows' built-ins for trust and compatibility checks.
+    command.env("PSModulePath",root.join("Modules"));
+    // Trust checks must not inherit a background caller's scheduling priority.
+    // Keep these noninteractive helpers hidden and explicitly normal priority.
+    command.creation_flags(0x08000020);
+    Ok(command)
+}
+
+#[cfg(windows)]
+fn verify_publisher(path:&Path,release:&Release)->Result<()> {
+    // Packages may reside in a read-only deployment share. Execute the embedded
+    // verifier without writing beside the package or trusting a mutable helper.
+    let mut verifier=embedded_powershell_command(include_str!("../../../deployment/windows/Verify-Package.ps1"),&[
+        ("Path",path.to_str().context("Package path is not valid Unicode")?),
+        ("Publisher",&release.publisher),("CertificateSha256",&release.publisher_certificate_sha256),("Sha256",&release.sha256),
+    ])?.stdin(std::process::Stdio::null()).spawn()?;
+    // Include cold Windows PowerShell/module startup and hashing in this budget.
+    // A clean standard-user Windows 11 test took over two minutes with a valid
+    // package. Keep verification bounded and fail closed on timeout.
+    let status=crate::verifier_process::wait(&mut verifier,std::time::Duration::from_secs(300))?;
+    ensure!(status.success(),"Package publisher verification failed");Ok(())
+}
+
+#[cfg(windows)]
+pub fn commit_uninstall(directory:&Path,edition:&str)->Result<()> {
+    ensure!(matches!(edition,"customer"|"technician"),"Invalid uninstall edition");
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Commit-Uninstall.ps1"),
+        &[("Directory",directory.to_str().context("Uninstall state path is not valid Unicode")?),("Edition",edition)])?.status()?;
+    ensure!(status.success(),"Uninstall commit cleanup failed");
+    if edition=="customer" {
+        run_setup_ui_broker(directory,"cleanup",None,"")?;
+        customer_ui_recovery(directory,&installed_target(directory,&Edition::Customer)?,"remove","")?;
+    }
+    Ok(())
+}
+
+#[cfg(windows)]
+fn customer_ui_loader()->&'static str {
+    r#"param([string]$Directory,[string]$Executable,[string]$Operation,[string]$ExpectedHashes)
+$ErrorActionPreference='Stop'
+try {
+$reader=[IO.StreamReader]::new([Console]::OpenStandardInput(),[Text.UTF8Encoding]::new($false,$true))
+try{$source=$reader.ReadToEnd()}finally{$reader.Dispose()}
+& ([ScriptBlock]::Create($source)) -Directory $Directory -Executable $Executable -Operation $Operation -ExpectedHashes $ExpectedHashes
+} catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }
+"#
+}
+
+#[cfg(windows)]
+fn customer_ui_recovery(directory:&Path,target:&Path,operation:&str,expected_hashes:&str)->Result<()> {
+    // The fixed helper exceeds Windows' encoded command-line limit. Feed its
+    // embedded source through a private child pipe instead of a mutable file.
+    let mut helper=embedded_powershell_command(customer_ui_loader(),&[
+        ("Directory",directory.to_str().context("Customer UI state path is not valid Unicode")?),
+        ("Executable",target.to_str().context("Customer UI executable path is not valid Unicode")?),
+        ("Operation",operation),("ExpectedHashes",expected_hashes),
+    ])?.stdin(std::process::Stdio::piped()).spawn()?;
+    let mut input=helper.stdin.take().context("Customer UI helper input unavailable")?;
+    let writer=std::thread::Builder::new().name("customer-ui-helper-source".into()).spawn(move || {
+        use std::io::Write;
+        input.write_all(include_bytes!("../../../deployment/windows/Restart-CustomerUi.ps1"))
+    });
+    let writer=match writer {
+        Ok(writer)=>writer,
+        Err(error)=>{
+            helper.kill().context("Cannot stop customer UI helper without its source writer")?;
+            helper.wait().context("Cannot reap customer UI helper without its source writer")?;
+            return Err(error).context("Cannot start customer UI source writer");
+        }
+    };
+    let status=crate::verifier_process::wait_with_message(&mut helper,std::time::Duration::from_secs(300),
+        "Customer UI recovery helper timed out; durable recovery remains pending");
+    let written=writer.join().map_err(|_|anyhow::anyhow!("Customer UI source writer failed"));
+    let status=status?;
+    written??;
+    ensure!(status.success(),"Customer UI recovery helper failed");Ok(())
+}
+
+#[cfg(windows)]
+pub fn prepare_customer_directory(directory:&Path,canonical:bool)->Result<()> {
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Prepare-CustomerDirectory.ps1"),
+        &[("Directory",directory.to_str().context("Customer state path is not valid Unicode")?),("Scope",if canonical{"canonical"}else{"custom"})])?.status()?;
+    ensure!(status.success(),"Customer state directory is not trusted or private");Ok(())
+}
+
+#[cfg(windows)]
+pub fn prepare_server_directory(directory:&Path)->Result<()> {
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Prepare-CustomerDirectory.ps1"),
+        &[("Directory",directory.to_str().context("Server state path is not valid Unicode")?),
+          ("Scope","server"),("Existing","reject")])?.status()?;
+    ensure!(status.success(),"Fresh server state directory could not be created privately; preserve existing state");Ok(())
+}
+
+#[cfg(windows)]
+pub fn prepare_worker_directory(directory:&Path)->Result<()> {
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Prepare-CustomerDirectory.ps1"),
+        &[("Directory",directory.to_str().context("Worker state path is not valid Unicode")?),
+          ("Scope","worker"),("Existing","reject")])?.status()?;
+    ensure!(status.success(),"Fresh worker state directory could not be created privately; preserve existing state");Ok(())
+}
+
+#[cfg(windows)]
+pub fn read_worker_configuration(path:&Path)->Result<Vec<u8>> {
+    use std::io::Read;
+    let mut process=embedded_powershell_command(include_str!("../../../deployment/windows/Read-WorkerConfiguration.ps1"),
+        &[("Path",path.to_str().context("Worker configuration path is not valid Unicode")?)])?
+        .stdin(std::process::Stdio::null()).stdout(std::process::Stdio::piped()).stderr(std::process::Stdio::null()).spawn()?;
+    let pipe=process.stdout.take().context("Worker configuration reader pipe unavailable")?;
+    let reader=std::thread::Builder::new().name("worker-configuration-reader".into()).spawn(move ||->std::io::Result<Vec<u8>> {
+        let mut bytes=Vec::new();pipe.take(16*1024+1).read_to_end(&mut bytes)?;Ok(bytes)
+    })?;
+    let status=crate::verifier_process::wait(&mut process,std::time::Duration::from_secs(300))?;
+    let output=reader.join().map_err(|_|anyhow::anyhow!("Worker configuration reader failed"))??;
+    ensure!(status.success(),"Worker configuration must be a private canonical file owned by SYSTEM or Administrators");
+    ensure!(!output.is_empty() && output.len()<=16*1024,"Invalid worker configuration size");
+    Ok(output)
+}
+
+#[cfg(windows)]
+fn validate_uninstall_directory(directory:&Path,customer:bool)->Result<()> {
+    let guard=r#"param([string]$Directory,[string]$Edition)
+$ErrorActionPreference='Stop'
+$expected=if($Edition -eq 'customer'){Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'SwanRemoteSupport'}else{Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'SwanRemoteSupport-Technician'}
+if([IO.Path]::GetFullPath($Directory).TrimEnd('\') -ine [IO.Path]::GetFullPath($expected).TrimEnd('\')){throw 'Uninstall requires the canonical edition directory.'}
+"#;
+    let status=embedded_powershell_command(guard,&[("Directory",directory.to_str().context("Uninstall path is not valid Unicode")?),("Edition",if customer{"customer"}else{"technician"})])?.status()?;
+    ensure!(status.success(),"Invalid uninstall state directory");Ok(())
+}
+
+#[cfg(windows)]
+pub fn uninstall_cancellation(directory:&Path,restore:bool,customer:bool)->Result<()> {
+    validate_uninstall_directory(directory,customer)?;
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Update-UninstallCancellation.ps1"),
+        &[("Directory",directory.to_str().context("Uninstall state path is not valid Unicode")?),("Operation",if restore{"restore"}else{"cancel"})])?.status()?;
+    ensure!(status.success(),"Uninstall recovery cancellation failed");
+    if !customer && !restore {
+        crate::technician_runtime::wait_for_exit(directory,std::time::Duration::from_secs(20))?;
+    }
+    Ok(())
+}
+
+#[cfg(windows)]
+pub fn configuration_task_removal(directory:&Path,restore:bool)->Result<()> {
+    validate_uninstall_directory(directory,true)?;
+    if !restore {
+        uninstall_cancellation(directory,false,true)?;
+        customer_ui_recovery(directory,&installed_target(directory,&Edition::Customer)?,"uninstall","")?;
+    }
+    let script=if restore {include_str!("../../../deployment/windows/Restore-Configuration.ps1")}else{include_str!("../../../deployment/windows/Remove-Configuration.ps1")};
+    let status=embedded_powershell_command(script,&[("Directory",directory.to_str().context("Configuration state path is not valid Unicode")?)])?.status()?;
+    ensure!(status.success(),"Company configuration task cleanup failed");
+    if restore {
+        uninstall_cancellation(directory,true,true)?;
+        if !directory.join("pending-uninstall").exists() {
+            customer_ui_recovery(directory,&installed_target(directory,&Edition::Customer)?,"restart","")?;
+        }
+    }
+    Ok(())
+}
+
+#[cfg(windows)]
+fn embedded_powershell_command(script:&str,arguments:&[(&str,&str)])->Result<std::process::Command> {
+    let literal=|value:&str|format!("'{}'",value.replace('\'',"''"));
+    let mut script=format!("$ProgressPreference='SilentlyContinue'; & {{\n{script}\n}}");
+    for (name,value) in arguments {
+        ensure!(name.starts_with(|character:char|character.is_ascii_alphabetic()) && name.bytes().all(|byte|byte.is_ascii_alphanumeric()),"Invalid embedded helper parameter");
+        script.push_str(&format!(" -{name} {}",literal(value)));
+    }
+    let bytes:Vec<u8>=script.encode_utf16().flat_map(u16::to_le_bytes).collect();
+    let mut command=powershell_command()?;
+    command.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-EncodedCommand"]).arg(STANDARD.encode(bytes));
+    Ok(command)
+}
+
+#[cfg(windows)]
+async fn verify_downloaded_publisher(path:&Path,release:&Release)->Result<()> {
+    let path=path.to_owned();let release=release.clone();
+    tokio::task::spawn_blocking(move ||verify_publisher(&path,&release)).await.context("Publisher verification task failed")?
+}
+
+pub(crate) fn update_policy_open(state:&AgentState)->Result<bool> {
+    let profile=state.company_profile()?;
+    Ok(!profile.updates_paused && maintenance_open(profile.maintenance_start_utc,profile.maintenance_end_utc,now()))
+}
+
+#[cfg(any(windows,test))]
+fn replace_verified_file(source:&Path,target:&Path,expected_hash:&str)->Result<()> {
+    use std::io::{Read,Write};
+    use sha2::{Digest,Sha256};
+    // Stage on the destination volume so replacement never streams bytes into
+    // the currently installed executable. Verify the exact bytes being staged.
+    let mut input=std::fs::File::open(source)?;
+    let temporary=target.parent().context("Missing replacement directory")?.join(format!("swan-replacement-{}.tmp",random_token()));
+    let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&temporary)?;
+    let result=(||->Result<()> {
+        let mut digest=Sha256::new();let mut buffer=[0u8;64*1024];let mut size=0u64;
+        loop {
+            let count=input.read(&mut buffer)?;if count==0 {break;}
+            size+=count as u64;ensure!(size<=512*1024*1024,"Replacement exceeds package size limit");
+            file.write_all(&buffer[..count])?;digest.update(&buffer[..count]);
+        }
+        drop(input);
+        ensure!(hex::encode(digest.finalize()).eq_ignore_ascii_case(expected_hash),"Replacement executable hash mismatch");
+        file.sync_all()?;drop(file);
+        let deadline=std::time::Instant::now()+std::time::Duration::from_secs(30);
+        loop {
+            match crate::replace_state(&temporary,target) {
+                Ok(())=>return Ok(()),
+                Err(error)=>{
+                    let sharing_conflict=error.downcast_ref::<std::io::Error>().map(|e|matches!(e.raw_os_error(),Some(5|32|33))).unwrap_or(false);
+                    if cfg!(windows) && sharing_conflict && std::time::Instant::now()<deadline {
+                        std::thread::sleep(std::time::Duration::from_millis(100));
+                    }else{return Err(error).context("Executable replacement failed; previous file retained");}
+                }
+            }
+        }
+    })();
+    if result.is_err(){let _=std::fs::remove_file(&temporary);}
+    result
+}
+
+#[cfg(windows)]
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct MsiIdentity {product_code:String,upgrade_code:String,product_version:String,template:String}
+
+#[cfg(windows)]
+fn validate_msi_identity(identity:&MsiIdentity,edition:&Edition,version:&str)->Result<()> {
+    let guid=|value:&str|value.len()==38 && value.starts_with('{') && value.ends_with('}') && value.bytes().enumerate().all(|(index,byte)|match index {0|37=>true,9|14|19|24=>byte==b'-',_=>byte.is_ascii_hexdigit()});
+    ensure!(guid(&identity.product_code) && guid(&identity.upgrade_code),"Invalid MSI product or upgrade identity");
+    let upgrade=if *edition==Edition::Customer {"{32A585D7-9A78-4AD2-AF72-D0266EFC709D}"}else{"{A4374699-436F-4917-9A4E-223F62A9E634}"};
+    ensure!(identity.upgrade_code.eq_ignore_ascii_case(upgrade),"MSI belongs to another product or edition");
+    ensure!(identity.product_version==version,"MSI version differs from signed release");
+    ensure!(identity.template.split(';').next()==Some("x64"),"MSI must target Windows x64");
+    Ok(())
+}
+
+#[cfg(windows)]
+fn read_msi_identity(package:&Path)->Result<MsiIdentity> {
+    let output=embedded_powershell_command(include_str!("../../../deployment/windows/Get-MsiIdentity.ps1"),
+        &[("Package",package.to_str().context("MSI path is not valid Unicode")?)])?.output()?;
+    ensure!(output.status.success(),"Cannot inspect MSI identity without installation");
+    let identity:MsiIdentity=serde_json::from_slice(&output.stdout)?;
+    Ok(identity)
+}
+
+#[cfg(windows)]
+fn verify_msi_identity(package:&Path,release:&Release)->Result<MsiIdentity> {
+    ensure!(release.format=="msi","Expected a signed MSI release");
+    let identity=read_msi_identity(package)?;
+    validate_msi_identity(&identity,&release.edition,&release.version)?;
+    Ok(identity)
+}
+
+#[cfg(windows)]
+pub fn verify_msi_release_identity(package:&Path,release:&Release)->Result<()> {
+    verify_msi_identity(package,release)?;Ok(())
+}
+
+#[cfg(windows)]
+fn verify_msi_registration(package:&Path,release:&Release)->Result<()> {
+    if release.format!="msi" {return Ok(());}
+    let identity=verify_msi_identity(package,release)?;
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Verify-MsiRegistration.ps1"),
+        &[("ProductCode",&identity.product_code),("Version",&release.version)])?.status()?;
+    ensure!(status.success(),"Expected MSI product and version are not installed; recovery remains pending");
+    Ok(())
+}
+
+#[cfg(windows)]
+fn msi_install_command(package:&Path,release:&Release)->Result<std::process::Command> {
+    verify_msi_identity(package,release)?;
+    let output=embedded_powershell_command(include_str!("../../../deployment/windows/Get-MsiInstallMode.ps1"),
+        &[("Package",package.to_str().context("MSI path is not valid Unicode")?)])?.output()?;
+    ensure!(output.status.success(),"Unable to determine MSI installation or repair mode");
+    let mode=std::str::from_utf8(&output.stdout)?.trim();
+    ensure!(matches!(mode,"/i"|"/fvamus"),"Unexpected MSI installation mode");
+    let mut command=std::process::Command::new(system_directory()?.join("msiexec.exe"));
+    command.arg(mode).arg(package).args(["/qn","/norestart"]);
+    Ok(command)
+}
+
+#[cfg(windows)]
+pub fn verify_package(state:&AgentState,directory:&Path,envelope:&SignedEnvelope,path:&Path)->Result<()> {
+    let release=installation_release(state,directory,envelope,false)?;
+    verify_compatibility(path.parent().context("Missing package directory")?,&release)?;
+    ensure!(staged_hash_matches(path,&release.sha256)?,"Installer hash differs from signed metadata");
+    verify_publisher(path,&release)?;
+    if release.format=="msi" {verify_msi_identity(path,&release)?;}
+    Ok(())
+}
+
+#[cfg(windows)]
+pub fn verify_repair_package(state:&AgentState,directory:&Path,envelope:&SignedEnvelope,path:&Path)->Result<()> {
+    let release=installation_release(state,directory,envelope,true)?;
+    verify_compatibility(path.parent().context("Missing package directory")?,&release)?;
+    ensure!(staged_hash_matches(path,&release.sha256)?,"Repair installer hash differs from signed metadata");
+    verify_publisher(path,&release)?;
+    if release.format=="msi" {verify_msi_identity(path,&release)?;}
+    Ok(())
+}
+
+#[cfg(windows)]
+fn verify_compatibility(_directory:&Path,release:&Release)->Result<()> {
+    let output=embedded_powershell_command(include_str!("../../../deployment/windows/Get-WindowsCompatibility.ps1"),&[])?.output()?;
+    ensure!(output.status.success(),"Unsupported Windows version or installation type");
+    let platform=String::from_utf8(output.stdout)?;
+    ensure!(release.windows_versions.iter().any(|v|v==platform.trim()),"Release does not support this Windows version");Ok(())
+}
+
+#[cfg(windows)]
+pub fn verify_installed_metadata(state:&AgentState,directory:&Path)->Result<()> {
+    let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+    let release:Release=envelope.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+    // Previously installed software may start after metadata expiry to show
+    // cached branding. This never authorizes a new install or remote session.
+    release.validate(&state.bootstrap.edition,state.last_release_sequence.saturating_sub(1),now().min(release.expires_at.saturating_sub(1)))?;
+    ensure!(state.last_release_sequence==0 || release.sequence==state.last_release_sequence,"Installed release sequence differs from state");
+    verify_compatibility(directory,&release)?;
+    verify_installed(directory,&release)
+}
+
+/// A Windows update can replace the system RuntimeBroker while leaving its
+/// generated privacy-helper copy behind. Keep verification strict, but refresh
+/// that one OS-owned cache under the same exclusion used for installation.
+/// This never repairs or accepts a changed project release file.
+#[cfg(windows)]
+pub fn refresh_windows_runtime_cache(directory:&Path)->Result<bool> {
+    let state=AgentState::load_for_refresh(directory)?;
+    if state.bootstrap.edition!=Edition::Customer {return Ok(false);}
+    let target=installed_target(directory,&state.bootstrap.edition)?;
+    require_existing_application(&target)?;
+    let root=target.parent().context("Missing installed directory")?;
+    let source=system_directory()?.join("RuntimeBroker.exe");
+    if crate::payload::windows_cache_current(root,&source)? {return Ok(false);}
+
+    let activity=activity_file(directory)?;
+    fs2::FileExt::try_lock_exclusive(&activity).context("Windows cache refresh requires all sessions and installations to finish")?;
+    for marker in ["pending-uninstall","pending-install.json","pending-update.json","configuration-restart.json"] {
+        ensure!(!directory.join(marker).exists(),"Installation or recovery takes precedence over Windows cache refresh");
+    }
+    let latest=AgentState::load_for_refresh(directory)?;
+    ensure!(latest.bootstrap.edition==Edition::Customer,"Customer configuration changed during cache maintenance");
+    let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+    let release=validate_previous_release(&latest,&envelope,latest.last_release_sequence)?;
+    let mut files=release.installed_files.clone();
+    ensure!(!files.iter().any(|f|f.path.eq_ignore_ascii_case(crate::payload::WINDOWS_BROKER_CACHE)),"OS cache cannot be a project release artifact");
+    // Account for the existing cache only while checking that every signed
+    // project file and the native file set are untouched. It is not trusted for
+    // execution: refresh_windows_cache replaces it from System32, and the final
+    // verification still requires the exact current Windows bytes.
+    let cache=root.join(crate::payload::WINDOWS_BROKER_CACHE);
+    if cache.exists() {
+        crate::payload::windows_cache_current(root,&source)?;
+        files.push(InstalledFile{path:crate::payload::WINDOWS_BROKER_CACHE.into(),sha256:digest(std::fs::read(&cache)?)});
+    }
+    crate::payload::verify(root,&files)?;
+    let changed=crate::payload::refresh_windows_cache(root,&source)?;
+    verify_installed(directory,&release)?;
+    Ok(changed)
+}
+
+#[cfg(windows)]
+fn save_installed_metadata(directory:&Path,envelope:&SignedEnvelope)->Result<()> {
+    use std::io::Write;
+    let temporary=directory.join(format!("installed-release-{}.tmp",random_token()));
+    let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&temporary)?;
+    file.write_all(&serde_json::to_vec(envelope)?)?;file.sync_all()?;drop(file);
+    crate::replace_state(&temporary,&directory.join("installed-release.json"))
+}
+
+#[cfg(windows)]
+pub fn finish_configuration_restart(directory:&Path)->Result<()> {
+    let activity=activity_file(directory)?;
+    fs2::FileExt::try_lock_exclusive(&activity).context("Configuration restart requires update and session exclusion")?;
+    let marker=directory.join("configuration-restart.json");
+    let ui_target=if marker.exists() {
+        ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels configuration restart");
+        let state=AgentState::load_for_refresh(directory)?;
+        let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(&marker)?)?;
+        let release=validate_previous_release(&state,&envelope,state.last_release_sequence)?;
+        ensure!(release.edition==Edition::Customer,"Configuration restart requires a customer release");
+        let installed:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+        ensure!(installed.payload==envelope.payload && installed.signature==envelope.signature,"Restart marker differs from installed release");
+        verify_installed(directory,&release)?;
+        verify_msi_registration(&installer_cache(directory,&release),&release)?;
+        Some(installed_target(directory,&release.edition)?)
+    }else{None};
+    // Keep session exclusion and the signed restart marker until existing user
+    // interfaces have durable, unelevated restart tasks. A retry must not leave
+    // an old mapped executable displaying stale company policy after an MSI.
+    if let Some(target)=ui_target {customer_ui_recovery(directory,&target,"restart","")?;}
+    // Resume the watcher last so its update pass cannot race a lengthy UI
+    // recovery and incorrectly report the committed update as failed.
+    let status=embedded_powershell_command(include_str!("../../../deployment/windows/Restart-Configuration.ps1"),
+        &[("Directory",directory.to_str().context("Configuration path is not valid Unicode")?)])?.status()?;
+    ensure!(status.success(),"Configuration task restart remains pending");
+    if marker.exists(){std::fs::remove_file(marker)?;}
+    Ok(())
+}
+
+pub(crate) fn validate_previous_release(state:&AgentState,envelope:&SignedEnvelope,previous_sequence:u64)->Result<Release> {
+    ensure!(previous_sequence>0,"Rollback requires a recorded signed installation");
+    let release:Release=envelope.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+    release.validate(&state.bootstrap.edition,previous_sequence-1,now().min(release.expires_at.saturating_sub(1)))?;
+    ensure!(release.sequence==previous_sequence,"Rollback release differs from previous installation");
+    Ok(release)
+}
+
+#[cfg(windows)]
+fn save_receipt(path:&Path,receipt:&Receipt)->Result<()> {
+    publish_download(path,&serde_json::to_vec(receipt)?)
+}
+
+#[cfg(windows)]
+fn installer_cache(directory:&Path,release:&Release)->std::path::PathBuf {
+    directory.join("releases").join(release.sequence.to_string()).join(format!("installer.{}",release.format))
+}
+
+#[cfg(windows)]
+fn retain_installer(source:&Path,target:&Path,release:&Release)->Result<()> {
+    ensure!(std::fs::metadata(source)?.len()<=512*1024*1024,"Installer exceeds cache size limit");
+    ensure!(staged_hash_matches(source,&release.sha256)?,"Installer cache source differs from signed release");
+    verify_publisher(source,release)?;
+    std::fs::create_dir_all(target.parent().context("Missing installer cache directory")?)?;
+    replace_verified_file(source,target,&release.sha256)?;
+    verify_publisher(target,release)
+}
+
+#[cfg(windows)]
+async fn ensure_previous_installer(state:&AgentState,directory:&Path)->Result<()> {
+    let state=state.clone();let installed_directory=directory.to_owned();
+    let release=tokio::task::spawn_blocking(move ||->Result<Release> {
+        let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(installed_directory.join("installed-release.json"))?)?;
+        validate_previous_release(&state,&envelope,state.last_release_sequence)
+    }).await.context("Previous installer discovery failed")??;
+    let cache=installer_cache(directory,&release);
+    tokio::fs::create_dir_all(cache.parent().context("Missing installer cache directory")?).await?;
+    // Previously recorded metadata may be expired. It authorizes retaining only
+    // the exact old package bytes, never selecting another software release.
+    restore_staged_download(&cache,&release.artifact_url,&release.sha256,&release).await
+}
+
+#[cfg(windows)]
+fn agent_rollback_protocol(agent:&Path,directory:&Path)->Result<u32> {
+    let output=std::process::Command::new(agent).arg("rollback-protocol")
+        .env("SWAN_STATE_DIR",directory).env_remove("SWAN_TECHNICIAN_TOKEN")
+        .env_remove("SWAN_SESSION_GRANT").env_remove("SWAN_SESSION_PROOF_KEY")
+        .output().context("Cannot inspect signed previous agent rollback support")?;
+    // Older signed agents may not implement the command. They can still upgrade,
+    // but cannot be automatically restored with an unsupported quarantine format.
+    Ok(if output.status.success() && std::str::from_utf8(&output.stdout)?.trim()=="1" {1}else{0})
+}
+
+#[cfg(windows)]
+fn supports_rollback(previous:&Release,failed:&Release)->bool {
+    previous.rollback_protocol==1 && previous.edition==failed.edition && previous.format==failed.format &&
+        (previous.format=="msi" || (previous.format=="exe" && (previous.edition==Edition::Customer || previous.sha256.eq_ignore_ascii_case(&previous.installed_sha256))))
+}
+
+#[cfg(windows)]
+fn rollback_release(state:&AgentState,directory:&Path,folder:&Path,receipt:&Receipt)->Result<()> {
+    ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic rollback");
+    ensure!(receipt.rollback_protocol==1 && receipt.phase=="rolling_back","Rollback was not durably prepared");
+    ensure!(state.last_release_sequence==receipt.previous_sequence,"Cannot roll back a committed newer installation");
+    let previous=receipt.previous_release.as_ref().context("Rollback requires a signed previous release")?;
+    let release=validate_previous_release(state,previous,receipt.previous_sequence)?;
+    let failed_release=receipt.release.verify::<Release>(&public_key(&state.bootstrap.release_public_key)?)?;
+    ensure!(release.edition==state.bootstrap.edition && supports_rollback(&release,&failed_release),"Rollback requires compatible releases");
+    let snapshot=folder.join("rollback");
+    verify_compatibility(directory,&release)?;
+    verify_rollback_snapshot(state,&snapshot,previous,receipt.previous_sequence)?;
+    ensure!(agent_rollback_protocol(&snapshot.join("agent/swan-agent.exe"),directory)?==1,"Previous agent cannot enforce failed-release quarantine");
+    let target=installed_target(directory,&state.bootstrap.edition)?;
+    if release.format=="msi" {
+        let package=snapshot.join("package/installer.msi");
+        let previous_identity=verify_msi_identity(&package,&release)?;
+        let next_package=folder.join("SwanRemoteSupport-install.msi");
+        ensure!(staged_hash_matches(&next_package,&failed_release.sha256)?,"Failed installer identity is unavailable for narrow MSI recovery");
+        verify_publisher(&next_package,&failed_release)?;
+        let next_identity=verify_msi_identity(&next_package,&failed_release)?;
+        let script=folder.join("Restore-ReleaseMsi.ps1");
+        std::fs::write(&script,include_str!("../../../deployment/windows/Restore-ReleaseMsi.ps1"))?;
+        let status=powershell_command()?.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(script)
+            .arg("-PreviousPackage").arg(&package).arg("-NextProductCode").arg(next_identity.product_code).arg("-NextVersion").arg(&failed_release.version)
+            .arg("-PreviousProductCode").arg(previous_identity.product_code).arg("-PreviousVersion").arg(&release.version).arg("-Directory").arg(target.parent().context("Missing installation directory")?).arg("-Edition").arg(if release.edition==Edition::Customer {"customer"}else{"technician"}).status()?;
+        ensure!(status.success(),"MSI rollback remains pending; explicit recovery or restart may be required");
+    }else if release.edition==Edition::Customer {
+        let package=snapshot.join("package/installer.exe");
+        ensure!(staged_hash_matches(&package,&release.sha256)?,"Previous EXE installer is unavailable for complete customer recovery");
+        verify_publisher(&package,&release)?;
+        let script=folder.join("Restore-CustomerExe.ps1");
+        std::fs::write(&script,include_str!("../../../deployment/windows/Restore-CustomerExe.ps1"))?;
+        let status=powershell_command()?.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(script).arg("-Package").arg(package).arg("-Directory").arg(target.parent().context("Missing customer installation directory")?).status()?;
+        ensure!(status.success(),"Customer EXE restoration remains pending");
+    }else{
+        require_existing_application(&target)?;
+        replace_verified_file(&snapshot.join("endpoint/SwanRemoteSupport-Technician.exe"),&target,&release.installed_sha256)?;
+    }
+    replace_verified_file(&snapshot.join("agent/swan-agent.exe"),&directory.join("swan-agent.exe"),&release.agent_sha256)?;
+    verify_installed(directory,&release)?;
+    ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancelled recovery before completion");
+    if release.edition==Edition::Customer {
+        let script=folder.join("Restore-Configuration.ps1");
+        std::fs::write(&script,include_str!("../../../deployment/windows/Restore-Configuration.ps1"))?;
+        let status=powershell_command()?.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(script).arg("-Directory").arg(directory).args(["-DeferStart","-RequireTask"]).status()?;
+        ensure!(status.success(),"Customer configuration task restoration remains pending");
+    }
+    save_installed_metadata(directory,previous)?;
+    let mut failed=receipt.clone();failed.phase="rolled_back".into();
+    ensure!(receipt.release.verify::<Release>(&public_key(&state.bootstrap.release_public_key)?)?.sequence>=failed_release_sequence(state,directory)?,"Cannot lower failed-release quarantine");
+    // Persist quarantine before unblocking sessions. No enrollment or consent
+    // state is restored, and the installed sequence never advances on failure.
+    save_receipt(&directory.join("failed-update.json"),&failed)?;
+    std::fs::remove_file(directory.join("pending-update.json"))?;
+    Ok(())
+}
+
+#[cfg(windows)]
+fn verify_rollback_snapshot(state:&AgentState,directory:&Path,envelope:&SignedEnvelope,previous_sequence:u64)->Result<()> {
+    let release=validate_previous_release(state,envelope,previous_sequence)?;
+    let stored:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+    ensure!(stored.payload==envelope.payload && stored.signature==envelope.signature,"Rollback metadata differs from pending receipt");
+    crate::payload::verify(&directory.join("endpoint"),&release.installed_files)?;
+    crate::payload::verify(&directory.join("agent"),&[InstalledFile{path:"swan-agent.exe".into(),sha256:release.agent_sha256.clone()}])?;
+    let mut executable_release=release.clone();executable_release.sha256=release.installed_sha256.clone();
+    let executable=if release.edition==Edition::Technician {"SwanRemoteSupport-Technician.exe"}else{"Swan Remote Support.exe"};
+    verify_publisher(&directory.join("endpoint").join(executable),&executable_release)?;
+    let mut agent_release=release.clone();agent_release.sha256=release.agent_sha256.clone();
+    verify_publisher(&directory.join("agent/swan-agent.exe"),&agent_release)?;
+    let package=directory.join("package").join(format!("installer.{}",release.format));
+    // Older snapshots did not preserve installers. Forward recovery remains
+    // available; future MSI rollback must separately require this package.
+    if package.exists(){
+        ensure!(staged_hash_matches(&package,&release.sha256)?,"Rollback installer differs from signed release");
+        verify_publisher(&package,&release)?;
+    }
+    Ok(())
+}
+
+#[cfg(windows)]
+fn prepare_rollback_snapshot(state:&AgentState,directory:&Path,update:&Release)->Result<SignedEnvelope> {
+    let envelope:SignedEnvelope=serde_json::from_slice(&std::fs::read(directory.join("installed-release.json"))?)?;
+    let previous=validate_previous_release(state,&envelope,state.last_release_sequence)?;
+    ensure!(previous.format==update.format,"Installer format migration requires explicit setup");
+    verify_compatibility(directory,&previous)?;
+    verify_installed(directory,&previous)?;
+    let folder=directory.join("updates").join(update.sequence.to_string());
+    let destination=folder.join("rollback");
+    if destination.exists(){
+        ensure!(destination.join("package").join(format!("installer.{}",previous.format)).is_file(),"Existing rollback snapshot lacks its original installer; explicit recovery is required");
+        verify_rollback_snapshot(state,&destination,&envelope,state.last_release_sequence)?;return Ok(envelope);
+    }
+    let temporary=folder.join(format!("swan-rollback-{}",random_token()));std::fs::create_dir(&temporary)?;
+    let result=(||->Result<()> {
+        let target=installed_target(directory,&state.bootstrap.edition)?;
+        crate::payload::snapshot(target.parent().context("Missing installed directory")?,&temporary.join("endpoint"),&previous.installed_files)?;
+        crate::payload::snapshot(directory,&temporary.join("agent"),&[InstalledFile{path:"swan-agent.exe".into(),sha256:previous.agent_sha256.clone()}])?;
+        retain_installer(&installer_cache(directory,&previous),&temporary.join("package").join(format!("installer.{}",previous.format)),&previous)?;
+        save_installed_metadata(&temporary,&envelope)?;
+        verify_rollback_snapshot(state,&temporary,&envelope,state.last_release_sequence)?;
+        std::fs::rename(&temporary,&destination).context("Cannot publish complete release rollback snapshot")
+    })();
+    if result.is_err(){std::fs::remove_dir_all(&temporary).context("Cannot remove incomplete release rollback snapshot")?;}
+    result?;Ok(envelope)
+}
+
+#[cfg(windows)]
+fn recovery_task(directory:&Path,release:&Release,operation:&str)->Result<()> {
+    ensure!(matches!(operation,"register"|"remove"),"Unknown recovery task operation");
+    let folder=directory.join("updates").join(release.sequence.to_string());
+    let script=folder.join("Update-RecoveryTask.ps1");
+    std::fs::write(&script,include_str!("../../../deployment/windows/Update-RecoveryTask.ps1"))?;
+    let status=powershell_command()?.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(script)
+        .arg("-Operation").arg(operation).arg("-Directory").arg(directory).arg("-Edition").arg(if release.edition==Edition::Customer {"customer"}else{"technician"})
+        .arg("-Sequence").arg(release.sequence.to_string()).status()?;
+    ensure!(status.success(),"Durable update recovery task operation failed");Ok(())
+}
+
+#[cfg(windows)]
+fn launch_update_helper(directory:&Path,release:&Release)->Result<()> {
+    ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic update handoff");
+    use std::os::windows::process::CommandExt;
+    let folder=directory.join("updates").join(release.sequence.to_string());
+    let helper=folder.join("swan-agent.exe");
+    ensure!(digest(std::fs::read(&helper)?).eq_ignore_ascii_case(&release.agent_sha256),"Staged update helper hash mismatch");
+    let mut agent_release=release.clone();agent_release.sha256=release.agent_sha256.clone();verify_publisher(&helper,&agent_release)?;
+    recovery_task(directory,release,"register")?;
+    use std::io::Write;
+    let attempt=folder.join(format!("last-attempt-{}.tmp",random_token()));
+    let mut file=std::fs::OpenOptions::new().create_new(true).write(true).open(&attempt)?;
+    file.write_all(now().to_string().as_bytes())?;file.sync_all()?;drop(file);
+    crate::replace_state(&attempt,&folder.join("last-attempt.txt"))?;
+    let log=std::fs::OpenOptions::new().create(true).append(true).open(folder.join("apply-update.log"))?;
+    std::process::Command::new(helper).arg("apply-update").env("SWAN_STATE_DIR",directory).env_remove("SWAN_TECHNICIAN_TOKEN")
+        .creation_flags(0x08000020).stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::from(log.try_clone()?)).stderr(std::process::Stdio::from(log)).spawn()?;
+    Ok(())
+}
+
+impl AgentState {
+    #[cfg(windows)]
+    pub fn prepare_installation(&self,directory:&Path,envelope:&SignedEnvelope,package:&Path,repair:bool)->Result<()> {
+        self.prepare_installation_with_recovery(directory,envelope,package,repair,false)
+    }
+    #[cfg(windows)]
+    pub fn prepare_installation_with_recovery(&self,directory:&Path,envelope:&SignedEnvelope,package:&Path,repair:bool,replace_failed_setup:bool)->Result<()> {
+        ensure!(!repair || !replace_failed_setup,"Repair cannot replace another pending setup");
+        let activity=activity_file(directory)?;fs2::FileExt::try_lock_exclusive(&activity).context("Explicit setup requires all sessions and update helpers to close")?;
+        let state=AgentState::load(directory)?;
+        if repair {verify_repair_package(&state,directory,envelope,package)?;}else{verify_package(&state,directory,envelope,package)?;}
+        let release=installation_release(&state,directory,envelope,repair)?;
+        if replace_failed_setup {replace_failed_installation_marker(&state,directory,envelope)?;}
+        else{prepare_installation_marker(directory,envelope)?;}
+        archive_cancelled_update(&state,directory)?;
+        if state.bootstrap.edition==Edition::Customer {
+            // Explicit verified setup supersedes a cancelled uninstall only
+            // after its durable setup marker blocks every new session.
+            let uninstall=directory.join("pending-uninstall");
+            if uninstall.exists(){std::fs::remove_file(uninstall)?;}
+            explicit_setup_ui(directory,envelope,&release,"prepare")?;
+        }
+        Ok(())
+    }
+    #[cfg(windows)]
+    pub async fn recover_from_staged_task(directory:&Path)->Result<bool> {
+        let check_directory=directory.to_owned();
+        let pending=tokio::task::spawn_blocking(move ||->Result<Option<AgentState>> {
+            let state=AgentState::load_for_refresh(&check_directory)?;
+            let helper=std::env::current_exe()?;
+            let folder=helper.parent().context("Missing staged recovery folder")?;
+            let sequence=folder.file_name().context("Missing recovery sequence")?.to_string_lossy().parse::<u64>()?;
+            ensure!(sequence>0 && helper==check_directory.join("updates").join(sequence.to_string()).join("swan-agent.exe"),"Recovery task must run from its exact staged helper");
+            let receipt_path=check_directory.join("pending-update.json");
+            if !receipt_path.exists() || check_directory.join("pending-uninstall").exists(){
+                if state.last_release_sequence==sequence && check_directory.join("configuration-restart.json").exists() && !check_directory.join("pending-uninstall").exists() {
+                    finish_configuration_restart(&check_directory)?;
+                }
+                let installed:SignedEnvelope=serde_json::from_slice(&std::fs::read(check_directory.join("installed-release.json"))?)?;
+                let mut release:Release=installed.verify(&public_key(&state.bootstrap.release_public_key)?)?;
+                ensure!(release.edition==state.bootstrap.edition,"Installed release belongs to another edition");
+                release.sequence=sequence;recovery_task(&check_directory,&release,"remove")?;return Ok(None);
+            }
+            let receipt:Receipt=serde_json::from_slice(&std::fs::read(receipt_path)?)?;
+            let release=validate_pending_receipt(&state,&receipt)?;
+            ensure!(release.sequence==sequence,"Another update owns the pending receipt");
+            ensure!(digest(std::fs::read(&helper)?).eq_ignore_ascii_case(&release.agent_sha256),"Recovery task helper differs from signed receipt");
+            let mut agent_release=release;agent_release.sha256=agent_release.agent_sha256.clone();verify_publisher(&helper,&agent_release)?;
+            Ok(Some(state))
+        }).await.context("Staged recovery task verification failed")??;
+        let Some(state)=pending else{return Ok(false);};
+        state.resume_pending_update_online(directory,false).await
+    }
+    pub async fn approved_update(&self,directory:&Path,technician_token:Option<&str>)->Result<Option<SignedEnvelope>> {
+        let profile=self.company_profile()?;
+        if !update_policy_open(self)?{return Ok(None);}
+        let (path,token)=if self.bootstrap.edition==Edition::Customer {
+            ("device/update",self.device_token.as_deref().context("Not enrolled")?)
+        }else{("user/update",technician_token.context("Technician authentication required")?)};
+        let state=self.clone();let installed_directory=directory.to_owned();
+        let format=tokio::task::spawn_blocking(move ||->Result<String> {
+            let installed:SignedEnvelope=serde_json::from_slice(&std::fs::read(installed_directory.join("installed-release.json"))?)?;
+            Ok(validate_previous_release(&state,&installed,state.last_release_sequence)?.format)
+        }).await.context("Installed release discovery failed")??;
+        let value:Value=self.client()?.get(self.endpoint(path)?).query(&[("format",&format)]).bearer_auth(token).send().await?.error_for_status()?.json().await?;
+        if value.is_null(){return Ok(None);}
+        let envelope:SignedEnvelope=serde_json::from_value(value)?;
+        let release:Release=envelope.verify(&public_key(&self.bootstrap.release_public_key)?)?;
+        release.validate(&self.bootstrap.edition,0,now())?;
+        ensure!(release.channel==profile.update_channel,"Wrong update channel");
+        ensure!(release.format==format,"Server offered an installer format migration; explicit setup is required");
+        // An already installed release is not an installation request.
+        let state=self.clone();let directory=directory.to_owned();
+        let failed=tokio::task::spawn_blocking(move ||failed_release_sequence(&state,&directory)).await.context("Failed-release quarantine check failed")??;
+        let minimum=self.last_release_sequence.max(failed);
+        if release.sequence<=minimum{return Ok(None);}
+        validate_release(self,&envelope)?;
+        Ok(Some(envelope))
+    }
+    #[cfg(windows)]
+    pub fn record_installation(&mut self,directory:&Path,envelope:&SignedEnvelope,package:&Path,repair:bool)->Result<()> {
+        let activity=activity_file(directory)?;fs2::FileExt::try_lock_exclusive(&activity).context("Installation verification requires all sessions to close")?;
+        let mut latest=AgentState::load(directory)?;
+        let release=installation_release(&latest,directory,envelope,repair)?;
+        let setup_marker=directory.join("pending-install.json");
+        ensure!(latest.bootstrap.edition!=Edition::Customer || setup_marker.exists(),"Customer installation recording requires prepared verified setup");
+        if setup_marker.exists(){
+            let pending:SignedEnvelope=serde_json::from_slice(&std::fs::read(&setup_marker)?)?;
+            ensure!(pending.payload==envelope.payload && pending.signature==envelope.signature,"Another company installation must be recovered first");
+        }
+        verify_compatibility(directory,&release)?;
+        verify_installed(directory,&release)?;
+        verify_msi_registration(package,&release)?;
+        retain_installer(package,&installer_cache(directory,&release),&release)?;
+        save_installed_metadata(directory,envelope)?;
+        latest.last_release_sequence=release.sequence;latest.save(directory)?;
+        if latest.bootstrap.edition==Edition::Customer {
+            // Keep the blocking marker if restoration fails, including after
+            // metadata commit. Exact same-release completion can then retry.
+            explicit_setup_ui(directory,envelope,&release,"restart")?;
+        }
+        // Explicit verified setup takes responsibility for registering and
+        // starting its watcher after this command returns.
+        let restart_marker=directory.join("configuration-restart.json");
+        if restart_marker.exists(){std::fs::remove_file(restart_marker)?;}
+        if setup_marker.exists(){std::fs::remove_file(setup_marker)?;}
+        let uninstall_marker=directory.join("pending-uninstall");
+        if uninstall_marker.exists(){std::fs::remove_file(uninstall_marker)?;}
+        let cancellation_rollback=directory.join("uninstall-cancellation-rollback.json");
+        if cancellation_rollback.exists(){std::fs::remove_file(cancellation_rollback)?;}
+        *self=latest;Ok(())
+    }
+    #[cfg(windows)]
+    pub fn recover_update(&mut self,directory:&Path)->Result<()> {
+        ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic recovery");
+        let activity=activity_file(directory)?;fs2::FileExt::try_lock_exclusive(&activity).context("Recovery requires all sessions to close")?;
+        let receipt_path=directory.join("pending-update.json");
+        let receipt:Receipt=serde_json::from_slice(&std::fs::read(&receipt_path)?)?;
+        let release=validate_completion_receipt(self,&receipt)?;
+        verify_compatibility(directory,&release)?;
+        verify_installed(directory,&release)?;
+        let cache=installer_cache(directory,&release);
+        let package=if cache.is_file(){cache.clone()}else{directory.join("updates").join(release.sequence.to_string()).join(format!("SwanRemoteSupport-install.{}",release.format))};
+        verify_msi_registration(&package,&release)?;
+        retain_installer(&package,&cache,&release)?;
+        save_installed_metadata(directory,&receipt.release)?;
+        // A crashed updater may have installed successfully or saved state before
+        // removing the receipt. Exact signed executable identity proves either case.
+        if release.edition==Edition::Customer {publish_download(&directory.join("configuration-restart.json"),&serde_json::to_vec(&receipt.release)?)?;}
+        self.last_release_sequence=release.sequence;self.save(directory)?;
+        std::fs::remove_file(receipt_path)?;Ok(())
+    }
+    #[cfg(windows)]
+    pub fn resume_pending_update(&self,directory:&Path,retry_now:bool)->Result<bool> {
+        self.resume_prepared_update(directory,retry_now,None)
+    }
+    #[cfg(windows)]
+    fn resume_prepared_update(&self,directory:&Path,retry_now:bool,expected:Option<&Receipt>)->Result<bool> {
+        let activity=activity_file(directory)?;fs2::FileExt::try_lock_exclusive(&activity).context("Update recovery already running or sessions remain active")?;
+        let receipt_path=directory.join("pending-update.json");
+        if !receipt_path.exists(){return Ok(false);}
+        ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic update recovery");
+        ensure!(!directory.join("pending-install.json").exists(),"Company setup recovery must finish first");
+        let latest=AgentState::load_for_refresh(directory)?;
+        let receipt:Receipt=serde_json::from_slice(&std::fs::read(&receipt_path)?)?;
+        if let Some(expected)=expected {
+            ensure!(serde_json::to_vec(&receipt)?==serde_json::to_vec(expected)?,"Pending update changed during staging recovery");
+        }
+        let release=validate_pending_receipt(&latest,&receipt)?;
+        verify_compatibility(directory,&release)?;
+        let attempt=directory.join("updates").join(release.sequence.to_string()).join("last-attempt.txt");
+        if !retry_now && attempt.exists(){
+            let previous=std::fs::read_to_string(attempt)?.parse::<u64>().context("Invalid update retry timestamp")?;
+            if now().saturating_sub(previous)<300{return Ok(false);}
+        }
+        launch_update_helper(directory,&release)?;Ok(true)
+    }
+    #[cfg(windows)]
+    pub async fn resume_pending_update_online(&self,directory:&Path,retry_now:bool)->Result<bool> {
+        let check_directory=directory.to_owned();
+        let plan=tokio::task::spawn_blocking(move ||->Result<Option<(Receipt,Release)>> {
+            let activity=activity_file(&check_directory)?;
+            fs2::FileExt::try_lock_exclusive(&activity).context("Update recovery already running or sessions remain active")?;
+            let receipt_path=check_directory.join("pending-update.json");
+            if !receipt_path.exists(){return Ok(None);}
+            ensure!(!check_directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic update recovery");
+            ensure!(!check_directory.join("pending-install.json").exists(),"Company setup recovery must finish first");
+            let latest=AgentState::load_for_refresh(&check_directory)?;
+            let receipt:Receipt=serde_json::from_slice(&std::fs::read(receipt_path)?)?;
+            let release=validate_pending_receipt(&latest,&receipt)?;
+            verify_compatibility(&check_directory,&release)?;
+            let attempt=check_directory.join("updates").join(release.sequence.to_string()).join("last-attempt.txt");
+            if !retry_now && attempt.exists(){
+                let previous=std::fs::read_to_string(attempt)?.parse::<u64>().context("Invalid update retry timestamp")?;
+                if now().saturating_sub(previous)<300{return Ok(None);}
+            }
+            Ok(Some((receipt,release)))
+        }).await.context("Recovery planning task failed")??;
+        let Some((receipt,release))=plan else{return Ok(false);};
+        // The durable signed receipt authorizes only these exact artifact bytes.
+        // No credentials accompany release downloads, including redirects.
+        let folder=directory.join("updates").join(release.sequence.to_string());
+        tokio::fs::create_dir_all(&folder).await?;
+        if receipt.phase=="installing" || (receipt.phase=="rolling_back" && release.format=="msi") {
+            restore_staged_download(&folder.join(format!("SwanRemoteSupport-install.{}",release.format)),&release.artifact_url,&release.sha256,&release).await?;
+        }
+        restore_staged_download(&folder.join("swan-agent.exe"),&release.agent_url,&release.agent_sha256,&release).await?;
+        let state=self.clone();let directory=directory.to_owned();
+        tokio::task::spawn_blocking(move ||state.resume_prepared_update(&directory,retry_now,Some(&receipt))).await.context("Recovery handoff task failed")?
+    }
+    #[cfg(windows)]
+    pub fn apply_pending_update(&mut self,directory:&Path)->Result<bool> {
+        // This method performs blocking Windows installation and is called from
+        // spawn_blocking. A bounded wait lets the preparing process release its lock.
+        let activity=activity_file(directory)?;
+        let deadline=std::time::Instant::now()+std::time::Duration::from_secs(30);
+        loop {
+            match fs2::FileExt::try_lock_exclusive(&activity) {
+                Ok(())=>break,
+                Err(error)=>{ensure!(std::time::Instant::now()<deadline,"Update handoff could not acquire session exclusion: {error}");std::thread::sleep(std::time::Duration::from_millis(100));}
+            }
+        }
+        let receipt_path=directory.join("pending-update.json");
+        if !receipt_path.exists(){return Ok(false);}
+        ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic update recovery");
+        ensure!(!directory.join("pending-install.json").exists(),"Company setup recovery must finish first");
+        let mut receipt:Receipt=serde_json::from_slice(&std::fs::read(&receipt_path)?)?;
+        let mut latest=AgentState::load_for_refresh(directory)?;
+        let release=validate_pending_receipt(&latest,&receipt)?;
+        verify_compatibility(directory,&release)?;
+        let helper=std::env::current_exe()?;
+        let mut agent_release=release.clone();agent_release.sha256=release.agent_sha256.clone();
+        ensure!(digest(std::fs::read(&helper)?).eq_ignore_ascii_case(&release.agent_sha256),"Update helper differs from signed release");
+        verify_publisher(&helper,&agent_release)?;
+        let folder=directory.join("updates").join(release.sequence.to_string());
+        if receipt.phase=="rolling_back" {
+            rollback_release(&latest,directory,&folder,&receipt)?;
+            *self=latest;return Ok(true);
+        }
+        let package=folder.join(format!("SwanRemoteSupport-install.{}",release.format));
+        ensure!(staged_hash_matches(&package,&release.sha256)?,"Staged installer hash mismatch");
+        verify_publisher(&package,&release)?;
+        if release.edition==Edition::Customer {
+            let script=folder.join("Stop-Configuration.ps1");
+            std::fs::write(&script,include_str!("../../../deployment/windows/Restart-Configuration.ps1"))?;
+            let status=powershell_command()?.args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"])
+                .arg(script).arg("-Directory").arg(directory).arg("-StopOnly").status()?;
+            ensure!(status.success(),"Configuration watcher could not stop; signed update recovery remains pending");
+        }
+        let installation=(||->Result<()> {
+        if let Err(error)=verify_installed(directory,&release).and_then(|()|verify_msi_registration(&package,&release)) {
+            eprintln!("Installed payload requires recovery: {error:#}");
+            if let Some(previous)=receipt.previous_release.as_ref(){
+                verify_rollback_snapshot(&latest,&folder.join("rollback"),previous,receipt.previous_sequence)?;
+            }
+            if release.edition==Edition::Customer {
+                // MSI can rename a mapped old image into rollback storage. Close
+                // only exact existing user images before that rename, retaining
+                // disabled recovery tasks until signed installation verification.
+                let previous=receipt.previous_release.as_ref()
+                    .map(|envelope|validate_previous_release(&latest,envelope,receipt.previous_sequence)).transpose()?;
+                let old_hash=previous.as_ref().map(|value|value.installed_sha256.as_str()).unwrap_or(&release.installed_sha256);
+                let hashes=format!("{old_hash},{}",release.installed_sha256).to_ascii_lowercase();
+                customer_ui_recovery(directory,&installed_target(directory,&Edition::Customer)?,"prepare",&hashes)?;
+            }
+            if latest.bootstrap.edition==Edition::Technician {
+                ensure!(release.format=="msi" || (release.format=="exe" && release.sha256.eq_ignore_ascii_case(&release.installed_sha256)),"Technician updates require an MSI or a portable EXE");
+                let target=installed_target(directory,&latest.bootstrap.edition)?;
+                require_existing_application(&target)?;
+                let previous=folder.join("previous-technician.exe");
+                if !previous.exists(){std::fs::copy(&target,&previous)?;}
+                if release.format=="msi" {
+                    let status=msi_install_command(&package,&release)?.arg(format!("INSTALLFOLDER={}",directory.display())).status()?;
+                    ensure!(status.code()!=Some(1625),"Windows Installer policy prevents this technician update (1625). Contact your company administrator for an approved deployment; signed recovery remains pending");
+                    ensure!(matches!(status.code(),Some(0|3010)),"Technician MSI installation failed; retain signed recovery receipt");
+                }else{replace_verified_file(&package,&target,&release.installed_sha256)?;}
+            }else{
+                require_existing_application(&installed_target(directory,&latest.bootstrap.edition)?)?;
+                let mut command=if release.format=="msi" {msi_install_command(&package,&release)?}else{let mut c=std::process::Command::new(&package);c.args(["--silent-install","printer=0"]);c};
+                let status=command.status()?;
+                ensure!(matches!(status.code(),Some(0|3010)),"Installation failed; retain signed recovery receipt");
+            }
+            let installed_agent=directory.join("swan-agent.exe");
+            let agent_already_current=installed_agent.is_file() && digest(std::fs::read(&installed_agent)?).eq_ignore_ascii_case(&release.agent_sha256);
+            if !agent_already_current {
+                let previous=folder.join("previous-agent.exe");
+                if installed_agent.exists() && !previous.exists(){std::fs::copy(&installed_agent,&previous)?;}
+                replace_verified_file(&helper,&installed_agent,&release.agent_sha256).context("Agent replacement failed; retain update receipt")?;
+            }
+        }
+        verify_installed(directory,&release)?;
+        verify_msi_registration(&package,&release)?;
+        Ok(())
+        })();
+        if let Err(error)=installation {
+            let previous=receipt.previous_release.as_ref().map(|envelope|validate_previous_release(&latest,envelope,receipt.previous_sequence)).transpose()?;
+            let can_rollback=receipt.rollback_protocol==1 && latest.last_release_sequence==receipt.previous_sequence && previous.as_ref().map(|old|supports_rollback(old,&release)).unwrap_or(false);
+            if !can_rollback{return Err(error).context("Update failed; signed recovery remains pending");}
+            eprintln!("Update failed; restoring the verified previous release: {error:#}");
+            receipt.phase="rolling_back".into();save_receipt(&receipt_path,&receipt)?;
+            rollback_release(&latest,directory,&folder,&receipt)?;
+            *self=latest;return Ok(true);
+        }
+        save_installed_metadata(directory,&receipt.release)?;
+        retain_installer(&package,&installer_cache(directory,&release),&release)?;
+        if release.edition==Edition::Customer {publish_download(&directory.join("configuration-restart.json"),&serde_json::to_vec(&receipt.release)?)?;}
+        latest.last_release_sequence=release.sequence;latest.save(directory)?;
+        std::fs::remove_file(receipt_path)?;*self=latest;Ok(true)
+    }
+    pub async fn update(&mut self,directory:&Path,technician_token:Option<&str>)->Result<bool> {
+        reporting::progress(directory,technician_token,UpdatePhase::Checking,None,0,None).await;
+        let result=self.update_inner(directory,technician_token).await;
+        match &result {
+            Ok(false)=>{
+                if update_policy_open(self).unwrap_or(false) {reporting::heartbeat(directory,technician_token).await;}
+                else {reporting::progress(directory,technician_token,UpdatePhase::Deferred,None,0,None).await;}
+            },
+            Err(_)=>reporting::progress(directory,technician_token,UpdatePhase::Failed,None,0,None).await,
+            Ok(true)=>{},
+        }
+        result
+    }
+    async fn update_inner(&mut self,directory:&Path,technician_token:Option<&str>)->Result<bool> {
+        #[cfg(not(windows))] {let _=(directory,technician_token);anyhow::bail!("Endpoint updates require Windows");}
+        #[cfg(windows)] {
+            ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall cancels automatic updates");
+            ensure!(!directory.join("pending-install.json").exists(),"Company setup recovery is required before automatic updates");
+            ensure!(!directory.join("configuration-restart.json").exists(),"Committed update requires configuration restart recovery before another update");
+            if directory.join("pending-update.json").exists(){
+                let check_directory=directory.to_owned();let state=self.clone();
+                let target=tokio::task::spawn_blocking(move ||->Result<u64> {
+                    let receipt:Receipt=serde_json::from_slice(&std::fs::read(check_directory.join("pending-update.json"))?)?;
+                    Ok(validate_pending_receipt(&state,&receipt)?.sequence)
+                }).await.context("Recovery report inspection failed")??;
+                reporting::progress(directory,technician_token,UpdatePhase::Recovering,Some(target),0,None).await;
+                return self.resume_pending_update_online(directory,false).await;
+            }
+            require_existing_application(&installed_target(directory,&self.bootstrap.edition)?)?;
+            if !update_policy_open(self)?{return Ok(false);}
+            let receipt_path=directory.join("pending-update.json");
+            // An interrupted installation is deliberately not guessed successful.
+            // Keep the signed receipt so recovery can verify the installed build.
+            ensure!(!receipt_path.exists(),"Interrupted update requires recovery before another installation");
+            let Some(envelope)=self.approved_update(directory,technician_token).await? else{return Ok(false);};
+            let release=validate_release(self,&envelope)?;
+            ensure!(release.edition!=Edition::Technician || (release.format=="msi" || (release.format=="exe" && release.installed_sha256.eq_ignore_ascii_case(&release.sha256))),"Technician updates require an MSI or a portable EXE with matching installed identity");
+            let folder=directory.join("updates").join(release.sequence.to_string());tokio::fs::create_dir_all(&folder).await?;
+            let check_folder=folder.clone();let check_release=release.clone();
+            tokio::task::spawn_blocking(move ||verify_compatibility(&check_folder,&check_release)).await.context("Compatibility verification task failed")??;
+            let package=folder.join(format!("SwanRemoteSupport-install.{}",release.format));
+            download_reporting(&release.artifact_url,&release.sha256,&package,Some((directory,technician_token,release.sequence))).await?;
+            verify_downloaded_publisher(&package,&release).await?;
+            let replacement_agent=folder.join("swan-agent.exe");
+            download_reporting(&release.agent_url,&release.agent_sha256,&replacement_agent,Some((directory,technician_token,release.sequence))).await?;
+            let mut agent_release=release.clone();agent_release.sha256=release.agent_sha256.clone();
+            verify_downloaded_publisher(&replacement_agent,&agent_release).await?;
+            ensure_previous_installer(self,directory).await?;
+            // Downloads may take minutes. Require a fresh signed policy and
+            // current server approval before creating an installation receipt.
+            self.sync().await?;self.save(directory)?;
+            let Some(current)=self.approved_update(directory,technician_token).await? else{return Ok(false);};
+            if current.payload!=envelope.payload || current.signature!=envelope.signature{return Ok(false);}
+            reporting::progress(directory,technician_token,UpdatePhase::Preparing,Some(release.sequence),0,None).await;
+            let reporting_directory=directory.to_owned();let reporting_target=release.sequence;
+            let directory=directory.to_owned();
+            let prepared=tokio::task::spawn_blocking(move ||->Result<Option<AgentState>> {
+            let activity=activity_file(&directory)?;
+            fs2::FileExt::try_lock_exclusive(&activity).context("Update deferred while a session or connection attempt is active")?;
+            ensure!(!directory.join("pending-install.json").exists(),"Company setup started while the update was downloading");
+            ensure!(!directory.join("pending-uninstall").exists(),"Explicit uninstall started while the update was downloading");
+            ensure!(!receipt_path.exists(),"Another update already requires recovery");
+            ensure!(!directory.join("configuration-restart.json").exists(),"Another update awaits configuration restart");
+            // Re-read consent and enrollment immediately before installation.
+            let latest=AgentState::load(&directory)?;
+            if !update_policy_open(&latest)?{return Ok(None);}
+            // Removal during download must not be turned into a fresh install.
+            require_existing_application(&installed_target(&directory,&latest.bootstrap.edition)?)?;
+            validate_release(&latest,&envelope)?;
+            ensure!(release.sequence>failed_release_sequence(&latest,&directory)?,"Failed release is quarantined");
+            let previous_release=prepare_rollback_snapshot(&latest,&directory,&release)?;
+            let previous=validate_previous_release(&latest,&previous_release,latest.last_release_sequence)?;
+            let rollback_protocol=if previous.rollback_protocol==1 {agent_rollback_protocol(&directory.join("updates").join(release.sequence.to_string()).join("rollback/agent/swan-agent.exe"),&directory)?}else{0};
+            let receipt=Receipt{release:envelope,previous_sequence:latest.last_release_sequence,phase:"installing".into(),previous_release:Some(previous_release),rollback_protocol};
+            publish_initial_receipt(&receipt_path,&receipt)?;
+            // The signed replacement runs from staging. This caller must exit so
+            // Windows releases the old executable before it is overwritten.
+            launch_update_helper(&directory,&release)?;
+            Ok(Some(latest))
+            }).await.context("Update handoff task failed")??;
+            if let Some(latest)=prepared {
+                *self=latest;
+                reporting::progress(&reporting_directory,technician_token,UpdatePhase::Installing,Some(reporting_target),0,None).await;
+                Ok(true)
+            }else{Ok(false)}
+        }
+    }
+}
+
+#[cfg(windows)]
+fn verify_installed(directory:&Path,release:&Release)->Result<()> {
+    let agent=directory.join("swan-agent.exe");
+    ensure!(digest(std::fs::read(&agent)?).eq_ignore_ascii_case(&release.agent_sha256),"Installed configuration agent differs from signed release; recovery remains pending");
+    let mut agent_release=release.clone();agent_release.sha256=release.agent_sha256.clone();verify_publisher(&agent,&agent_release)?;
+    let target=installed_target(directory,&release.edition)?;
+    // Portable technician state also contains the agent and updater. Its single
+    // packed EXE is verified separately; customer files share an install root.
+    if release.edition==Edition::Customer {
+        let mut files=release.installed_files.clone();
+        // RustDesk copies this Windows-owned process for input/privacy support.
+        // It varies with Windows updates and is not a project release artifact.
+        files.push(InstalledFile{path:"RuntimeBroker_rustdesk.exe".into(),sha256:digest(std::fs::read(system_directory()?.join("RuntimeBroker.exe"))?)});
+        crate::payload::verify(target.parent().context("Missing installation directory")?,&files)?;
+    }
+    ensure!(digest(std::fs::read(&target)?).eq_ignore_ascii_case(&release.installed_sha256),"Installed executable differs from signed release; recovery remains pending");
+    let mut installed=release.clone();installed.sha256=release.installed_sha256.clone();verify_publisher(&target,&installed)
+}
+
+#[cfg(test)]
+pub(crate) fn test_failed_release_quarantine(state:&AgentState,release:&Release,key:&SigningKey) {
+    let folder=std::env::temp_dir().join(format!("swan-quarantine-test-{}",random_token()));std::fs::create_dir(&folder).unwrap();
+    assert_eq!(failed_release_sequence(state,&folder).unwrap(),0);
+    let mut previous=release.clone();previous.sequence=1;previous.expires_at=now()-1;previous.rollback_protocol=1;
+    #[cfg(windows)] {
+        let mut old=previous.clone();old.format="msi".into();old.edition=Edition::Customer;
+        let mut failed=old.clone();assert!(supports_rollback(&old,&failed));
+        failed.edition=Edition::Technician;assert!(!supports_rollback(&old,&failed));
+        old.edition=Edition::Technician;assert!(supports_rollback(&old,&failed));
+        old.rollback_protocol=0;assert!(!supports_rollback(&old,&failed));old.rollback_protocol=1;
+        old.format="exe".into();assert!(!supports_rollback(&old,&failed));
+        failed.format="exe".into();old.installed_sha256=old.sha256.clone();assert!(supports_rollback(&old,&failed));
+        old.edition=Edition::Customer;failed.edition=Edition::Customer;assert!(supports_rollback(&old,&failed));
+        old.rollback_protocol=0;assert!(!supports_rollback(&old,&failed));
+        let mut identity=MsiIdentity{product_code:"{00112233-4455-6677-8899-AABBCCDDEEFF}".into(),upgrade_code:"{32A585D7-9A78-4AD2-AF72-D0266EFC709D}".into(),product_version:release.version.clone(),template:"x64;1033".into()};
+        validate_msi_identity(&identity,&Edition::Customer,&release.version).unwrap();
+        assert!(validate_msi_identity(&identity,&Edition::Technician,&release.version).is_err());
+        assert!(validate_msi_identity(&identity,&Edition::Customer,"99.0.0").is_err());
+        identity.template="Intel;1033".into();assert!(validate_msi_identity(&identity,&Edition::Customer,&release.version).is_err());
+        identity.template="x64;1033".into();identity.product_code="invalid product".into();assert!(validate_msi_identity(&identity,&Edition::Customer,&release.version).is_err());
+        let builtins=powershell_command().unwrap().args(["-NoLogo","-NoProfile","-NonInteractive","-Command","$ErrorActionPreference='Stop'; Get-Command Get-FileHash,Get-AuthenticodeSignature | ForEach-Object Name"]).output().unwrap();
+        assert!(builtins.status.success());
+        let commands=String::from_utf8(builtins.stdout).unwrap();
+        assert!(commands.contains("Get-FileHash") && commands.contains("Get-AuthenticodeSignature"));
+        let source=folder.join("unsigned-installer.exe");let target=folder.join("cache/installer.exe");
+        std::fs::write(&source,b"unsigned cache fixture").unwrap();
+        let mut installer=release.clone();installer.sha256=digest(b"unsigned cache fixture");
+        let mut tampered=installer.clone();tampered.sha256=digest(b"different installer");
+        assert!(retain_installer(&source,&target,&tampered).is_err());
+        assert!(!target.exists());
+        assert!(retain_installer(&source,&target,&installer).is_err(),"Correct hashes cannot bypass publisher verification");
+        assert!(!target.exists());
+        // Exercise real Authenticode trust without signing a test program or
+        // executing an installer: copy a Windows-signed OS binary into our fixture.
+        std::fs::copy(system_directory().unwrap().join("cmd.exe"),&source).unwrap();
+        let identity=powershell_command().unwrap().env("SWAN_TEST_TRUST_FIXTURE",&source).args(["-NoLogo","-NoProfile","-NonInteractive","-Command","$ErrorActionPreference='Stop'; $s=Get-AuthenticodeSignature -LiteralPath $env:SWAN_TEST_TRUST_FIXTURE; if($s.Status -ne 'Valid'){throw 'Windows fixture signature unavailable'}; $h=[Security.Cryptography.SHA256]::Create(); try { @{publisher=$s.SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName,$false);certificate_hash=[BitConverter]::ToString($h.ComputeHash($s.SignerCertificate.RawData)).Replace('-','')} | ConvertTo-Json -Compress } finally {$h.Dispose()}"]).output().unwrap();
+        assert!(identity.status.success());
+        let identity:Value=serde_json::from_slice(&identity.stdout).unwrap();
+        installer.publisher=identity["publisher"].as_str().unwrap().into();
+        installer.publisher_certificate_sha256=identity["certificate_hash"].as_str().unwrap().into();
+        installer.sha256=digest(std::fs::read(&source).unwrap());
+        retain_installer(&source,&target,&installer).unwrap();
+        assert!(staged_hash_matches(&target,&installer.sha256).unwrap());
+        let preparation=folder.join("verified-explicit-preparation");state.save(&preparation).unwrap();
+        let initial_state=std::fs::read(preparation.join("managed-state.json")).unwrap();
+        let mut cancelled_release=release.clone();cancelled_release.sequence=2;
+        let cancelled=Receipt{release:SignedEnvelope::sign(&cancelled_release,key).unwrap(),previous_sequence:1,phase:"installing".into(),previous_release:Some(SignedEnvelope::sign(&previous,key).unwrap()),rollback_protocol:1};
+        let pending_bytes=serde_json::to_vec_pretty(&cancelled).unwrap();
+        std::fs::write(preparation.join("pending-update.json"),&pending_bytes).unwrap();
+        std::fs::write(preparation.join("pending-uninstall"),b"explicit fixture cancellation").unwrap();
+        let mut requested=installer.clone();requested.sequence=3;
+        // This fixture exercises interrupted setup, using the runner's signed
+        // OS binary. Its metadata must support the host running the test.
+        requested.windows_versions=swan_protocol::WINDOWS_VERSIONS.iter().map(|version|(*version).into()).collect();
+        let mut invalid=requested.clone();invalid.sha256=digest(b"wrong verified setup bytes");
+        assert!(state.prepare_installation(&preparation,&SignedEnvelope::sign(&invalid,key).unwrap(),&source,false).is_err());
+        assert!(!preparation.join("pending-install.json").exists());
+        assert_eq!(std::fs::read(preparation.join("pending-update.json")).unwrap(),pending_bytes);
+        let envelope=SignedEnvelope::sign(&requested,key).unwrap();
+        // This signed OS-binary fixture is outside canonical customer storage
+        // and is not the release agent. It may arm durable recovery, but must
+        // never reach privileged UI execution. Real broker/installer tests run
+        // separately in disposable Windows environments.
+        assert!(state.prepare_installation(&preparation,&envelope,&source,false).is_err());
+        assert!(state.prepare_installation(&preparation,&envelope,&source,false).is_err());
+        assert!(!preparation.join("pending-update.json").exists());
+        assert_eq!(std::fs::read(preparation.join("updates/2/cancelled-update.json")).unwrap(),pending_bytes);
+        assert!(!preparation.join("pending-uninstall").exists() && preparation.join("pending-install.json").exists());
+        assert!(crate::lock_session(&preparation).is_err(),"UI preparation failure must retain session exclusion");
+        assert!(!preparation.join("setup-ui").exists(),"A noncanonical fixture must not stage a SYSTEM executable");
+        assert_eq!(std::fs::read(preparation.join("managed-state.json")).unwrap(),initial_state);
+        let mut wrong_publisher=installer.clone();wrong_publisher.publisher="Unapproved publisher".into();
+        assert!(retain_installer(&source,&target,&wrong_publisher).is_err());
+        let injected=folder.join("publisher-injection.txt");
+        wrong_publisher.publisher=format!("Unapproved'; Set-Content -LiteralPath '{}' -Value injected; #",injected.display());
+        assert!(retain_installer(&source,&target,&wrong_publisher).is_err());
+        assert!(!injected.exists(),"Publisher values must remain literal arguments, never commands");
+        assert!(staged_hash_matches(&target,&installer.sha256).unwrap(),"Publisher rejection retains the previous complete cache");
+        let mut wrong_certificate=installer.clone();wrong_certificate.publisher_certificate_sha256="0".repeat(64);
+        assert!(retain_installer(&source,&target,&wrong_certificate).is_err());
+        assert!(staged_hash_matches(&target,&installer.sha256).unwrap(),"Certificate rejection retains the previous complete cache");
+    }
+    let mut failed=release.clone();failed.expires_at=now()-1;
+    let receipt=Receipt{release:SignedEnvelope::sign(&failed,key).unwrap(),previous_sequence:1,phase:"rolled_back".into(),previous_release:Some(SignedEnvelope::sign(&previous,key).unwrap()),rollback_protocol:1};
+    let path=folder.join("failed-update.json");
+    let pending_path=folder.join("pending-update.json");
+    publish_initial_receipt(&pending_path,&receipt).unwrap();
+    let saved=std::fs::read(&pending_path).unwrap();
+    let mut competing=receipt.clone();competing.phase="installing".into();
+    assert!(publish_initial_receipt(&pending_path,&competing).is_err());
+    assert_eq!(std::fs::read(&pending_path).unwrap(),saved,"Never overwrite another durable recovery receipt");
+    assert!(!std::fs::read_dir(&folder).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with("swan-receipt-")));
+    let write=|receipt:&Receipt|std::fs::write(&path,serde_json::to_vec(receipt).unwrap()).unwrap();
+    write(&receipt);assert_eq!(failed_release_sequence(state,&folder).unwrap(),2);
+    assert!(release.validate(&state.bootstrap.edition,failed_release_sequence(state,&folder).unwrap(),now()).is_err(),"The failed sequence cannot be selected again");
+    let mut later=release.clone();later.sequence=3;
+    assert!(later.validate(&state.bootstrap.edition,failed_release_sequence(state,&folder).unwrap(),now()).is_ok());
+    let mut pending=receipt.clone();pending.phase="rolling_back".into();
+    assert!(validate_pending_receipt(state,&pending).is_ok());
+    assert!(validate_completion_receipt(state,&pending).is_err(),"Completion-only recovery must not override a pending rollback");
+    let mut committed=state.clone();committed.last_release_sequence=2;
+    assert!(validate_pending_receipt(&committed,&pending).is_err());
+    let mut different_format=previous.clone();different_format.format="msi".into();
+    pending.previous_release=Some(SignedEnvelope::sign(&different_format,key).unwrap());
+    assert!(validate_pending_receipt(state,&pending).is_err(),"Automatic rollback must not ignore installer registrations");
+    let mut legacy=previous.clone();legacy.rollback_protocol=0;
+    pending.previous_release=Some(SignedEnvelope::sign(&legacy,key).unwrap());
+    assert!(validate_pending_receipt(state,&pending).is_err(),"Never restore an endpoint lacking quarantine support");
+    pending.previous_release=None;assert!(validate_pending_receipt(state,&pending).is_err());
+    pending.phase="installing".into();pending.rollback_protocol=0;
+    assert!(validate_pending_receipt(state,&pending).is_ok(),"Legacy receipts can still finish forward recovery");
+    assert!(validate_completion_receipt(state,&pending).is_ok());
+    pending.rollback_protocol=2;assert!(validate_pending_receipt(state,&pending).is_err());
+    let mut newer=state.clone();newer.last_release_sequence=3;
+    assert_eq!(failed_release_sequence(&newer,&folder).unwrap(),2,"Installing a later release retains failed-release history");
+    let mut foreign=state.clone();foreign.bootstrap.edition=Edition::Technician;
+    assert!(failed_release_sequence(&foreign,&folder).is_err());
+    foreign.bootstrap.edition=state.bootstrap.edition.clone();foreign.bootstrap.release_public_key=STANDARD.encode(SigningKey::from_bytes(&[9;32]).verifying_key().as_bytes());
+    assert!(failed_release_sequence(&foreign,&folder).is_err());
+    let mut bad=receipt.clone();bad.release.signature=STANDARD.encode([0u8;64]);write(&bad);
+    assert!(failed_release_sequence(state,&folder).is_err());
+    let mut bad=receipt.clone();bad.previous_sequence=2;write(&bad);
+    assert!(failed_release_sequence(state,&folder).is_err());
+    let mut bad=receipt.clone();bad.rollback_protocol=0;write(&bad);
+    assert!(failed_release_sequence(state,&folder).is_err());
+    let mut bad=receipt.clone();bad.phase="rolling_back".into();write(&bad);
+    assert!(failed_release_sequence(state,&folder).is_err());
+    std::fs::write(&path,b"interrupted metadata").unwrap();assert!(failed_release_sequence(state,&folder).is_err());
+    std::fs::remove_file(&path).unwrap();std::fs::create_dir(&path).unwrap();
+    assert!(failed_release_sequence(state,&folder).is_err(),"Quarantine I/O failures must not clear suppression");
+    let cancellation_folder=folder.join("explicit-cancelled-setup");std::fs::create_dir(&cancellation_folder).unwrap();
+    state.save(&cancellation_folder).unwrap();
+    let original_state=std::fs::read(cancellation_folder.join("managed-state.json")).unwrap();
+    let mut cancelled=receipt.clone();cancelled.phase="installing".into();
+    let cancelled_bytes=serde_json::to_vec_pretty(&cancelled).unwrap();
+    let cancelled_path=cancellation_folder.join("pending-update.json");
+    std::fs::write(&cancelled_path,&cancelled_bytes).unwrap();
+    let mut setup=release.clone();setup.sequence=3;
+    let setup_envelope=SignedEnvelope::sign(&setup,key).unwrap();
+    assert!(installation_release(state,&cancellation_folder,&setup_envelope,false).is_err(),"Active recovery must not become implicit setup");
+    assert!(archive_cancelled_update(state,&cancellation_folder).is_err());
+    std::fs::write(cancellation_folder.join("pending-uninstall"),b"explicit user cancellation").unwrap();
+    assert!(installation_release(state,&cancellation_folder,&setup_envelope,false).is_ok());
+    let mut repair=previous.clone();repair.expires_at=now()+3600;
+    let repair_envelope=SignedEnvelope::sign(&repair,key).unwrap();
+    std::fs::write(cancellation_folder.join("installed-release.json"),serde_json::to_vec(&repair_envelope).unwrap()).unwrap();
+    assert!(installation_release(state,&cancellation_folder,&repair_envelope,true).is_ok());
+    assert!(installation_release(state,&cancellation_folder,&repair_envelope,false).is_err(),"Cancellation cannot bypass sequence replay protection");
+    let foreign=SignedEnvelope::sign(&setup,&SigningKey::from_bytes(&[9;32])).unwrap();
+    assert!(installation_release(state,&cancellation_folder,&foreign,false).is_err());
+    let mut tampered=cancelled.clone();tampered.release.signature=STANDARD.encode([0u8;64]);
+    std::fs::write(&cancelled_path,serde_json::to_vec(&tampered).unwrap()).unwrap();
+    assert!(installation_release(state,&cancellation_folder,&setup_envelope,false).is_err());
+    assert!(archive_cancelled_update(state,&cancellation_folder).is_err());
+    std::fs::write(&cancelled_path,&cancelled_bytes).unwrap();
+    prepare_installation_marker(&cancellation_folder,&setup_envelope).unwrap();
+    let marker_bytes=std::fs::read(cancellation_folder.join("pending-install.json")).unwrap();
+    let mut competing=setup.clone();competing.sequence=4;
+    assert!(prepare_installation_marker(&cancellation_folder,&SignedEnvelope::sign(&competing,key).unwrap()).is_err());
+    assert_eq!(std::fs::read(cancellation_folder.join("pending-install.json")).unwrap(),marker_bytes);
+    let foreign_key=SigningKey::from_bytes(&[250;32]);
+    assert!(replace_failed_installation_marker(state,&cancellation_folder,&SignedEnvelope::sign(&competing,&foreign_key).unwrap()).is_err());
+    let mut older=competing.clone();older.sequence=2;
+    assert!(replace_failed_installation_marker(state,&cancellation_folder,&SignedEnvelope::sign(&older,key).unwrap()).is_err());
+    let mut wrong_edition=competing.clone();wrong_edition.edition=if state.bootstrap.edition==Edition::Customer {Edition::Technician}else{Edition::Customer};
+    assert!(replace_failed_installation_marker(state,&cancellation_folder,&SignedEnvelope::sign(&wrong_edition,key).unwrap()).is_err());
+    assert_eq!(std::fs::read(cancellation_folder.join("pending-install.json")).unwrap(),marker_bytes);
+    let newer=SignedEnvelope::sign(&competing,key).unwrap();
+    replace_failed_installation_marker(state,&cancellation_folder,&newer).unwrap();
+    let retained=cancellation_folder.join("cancelled-setups").join(format!("3-{}.json",digest(&marker_bytes)));
+    assert_eq!(std::fs::read(retained).unwrap(),marker_bytes);
+    let replaced:SignedEnvelope=serde_json::from_slice(&std::fs::read(cancellation_folder.join("pending-install.json")).unwrap()).unwrap();
+    assert_eq!(replaced.payload,newer.payload);
+    assert!(lock_session(&cancellation_folder).is_err(),"Replacement setup must still block support");
+    assert_eq!(std::fs::read(cancellation_folder.join("managed-state.json")).unwrap(),original_state);
+    std::fs::write(cancellation_folder.join("pending-install.json"),&marker_bytes).unwrap();
+    prepare_installation_marker(&cancellation_folder,&setup_envelope).unwrap();
+    archive_cancelled_update(state,&cancellation_folder).unwrap();
+    let archive=cancellation_folder.join("updates/2/cancelled-update.json");
+    assert_eq!(std::fs::read(&archive).unwrap(),cancelled_bytes);
+    assert!(!cancelled_path.exists());
+    assert!(cancellation_folder.join("pending-uninstall").exists() && lock_session(&cancellation_folder).is_err());
+    std::fs::write(&cancelled_path,&cancelled_bytes).unwrap();
+    archive_cancelled_update(state,&cancellation_folder).unwrap();
+    let mut changed=cancelled.clone();changed.phase="rolling_back".into();
+    std::fs::write(&cancelled_path,serde_json::to_vec(&changed).unwrap()).unwrap();
+    assert!(archive_cancelled_update(state,&cancellation_folder).is_err(),"Cancelled evidence cannot be overwritten on retry");
+    assert_eq!(std::fs::read(&archive).unwrap(),cancelled_bytes);
+    assert_eq!(std::fs::read(cancellation_folder.join("managed-state.json")).unwrap(),original_state,"Explicit preparation preserves identity, consent and sequence");
+    std::fs::remove_file(&cancelled_path).unwrap();
+    std::fs::write(cancellation_folder.join("installed-release.json"),serde_json::to_vec(&setup_envelope).unwrap()).unwrap();
+    let mut completed=state.clone();completed.last_release_sequence=setup.sequence;
+    assert!(installation_release(&completed,&cancellation_folder,&setup_envelope,false).is_ok(),"Setup may finish exact committed metadata after marker cleanup was interrupted");
+    let mut altered=setup.clone();altered.version="99.0.0".into();
+    assert!(installation_release(&completed,&cancellation_folder,&SignedEnvelope::sign(&altered,key).unwrap(),false).is_err());
+    std::fs::remove_file(cancellation_folder.join("pending-install.json")).unwrap();
+    assert!(installation_release(&completed,&cancellation_folder,&setup_envelope,false).is_err(),"Absent completion marker restores ordinary sequence rejection");
+    assert!(installation_release(&completed,&cancellation_folder,&setup_envelope,true).is_ok());
+    std::fs::remove_dir_all(folder).unwrap();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[cfg(windows)]
+    #[test]
+    fn advanced_customer_ui_script_failure_returns_a_failed_child_status() {
+        use std::io::Write;
+        use std::process::Stdio;
+        for (body,success) in [
+            ("[Console]::WriteLine('completed')",true),
+            ("throw 'controlled recovery failure'",false),
+            ("[void][int]::Parse('controlled recovery failure')",false),
+        ] {
+            // Advanced scripts otherwise emit an inner terminating error while
+            // the outer invocation can still return a successful process code.
+            let source=format!("[CmdletBinding()]param($Directory,$Executable,$Operation,$ExpectedHashes)\n$ErrorActionPreference='Stop'\nfunction Run-Recovery {{ {body} }}\nif($Operation -eq 'restart'){{Run-Recovery}}\n");
+            let mut child=embedded_powershell_command(customer_ui_loader(),&[
+                ("Directory","C:/inert"),("Executable","C:/inert.exe"),("Operation","restart"),
+            ]).unwrap().stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+            child.stdin.take().unwrap().write_all(source.as_bytes()).unwrap();
+            let status=crate::verifier_process::wait_with_message(&mut child,std::time::Duration::from_secs(30),"Recovery loader regression timed out").unwrap();
+            let output=child.wait_with_output().unwrap();
+            assert_eq!(status.success(),success,"{}",String::from_utf8_lossy(&output.stderr));
+            if success {assert!(String::from_utf8_lossy(&output.stdout).contains("completed"));}
+            else {assert!(!output.stderr.is_empty());}
+        }
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn normal_priority_powershell_child() {
+        if std::env::var("SWAN_TEST_PRIORITY_CHILD").as_deref()!=Ok("1"){return;}
+        // Only this disposable test process is lowered; the main test runner
+        // and its other concurrent tests keep their original scheduling.
+        let lower=format!("$p=[Diagnostics.Process]::GetProcessById({});$p.PriorityClass=[Diagnostics.ProcessPriorityClass]::BelowNormal;[Console]::WriteLine($p.PriorityClass.ToString())",std::process::id());
+        let parent=powershell_command().unwrap().args(["-NoLogo","-NoProfile","-NonInteractive","-Command",&lower]).output().unwrap();
+        assert!(parent.status.success());
+        assert_eq!(String::from_utf8(parent.stdout).unwrap().trim(),"BelowNormal");
+        let verifier=powershell_command().unwrap().args(["-NoLogo","-NoProfile","-NonInteractive","-Command","[Console]::WriteLine(([Diagnostics.Process]::GetCurrentProcess()).PriorityClass.ToString())"]).output().unwrap();
+        assert!(verifier.status.success());
+        assert_eq!(String::from_utf8(verifier.stdout).unwrap().trim(),"Normal");
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn powershell_verifier_does_not_inherit_background_priority() {
+        use std::process::{Command,Stdio};
+        let mut child=Command::new(std::env::current_exe().unwrap())
+            .args(["--exact","update::tests::normal_priority_powershell_child","--nocapture"])
+            .env("SWAN_TEST_PRIORITY_CHILD","1")
+            .stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped()).spawn().unwrap();
+        let status=crate::verifier_process::wait(&mut child,std::time::Duration::from_secs(240)).unwrap();
+        let output=child.wait_with_output().unwrap();
+        assert!(status.success(),"priority fixture failed: {} {}",String::from_utf8_lossy(&output.stdout),String::from_utf8_lossy(&output.stderr));
+    }
+
+    #[tokio::test]
+    async fn streamed_download_requires_completion_hash_and_limit_before_replacement(){
+        let folder=std::env::temp_dir().join(format!("swan-stream-test-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();let target=folder.join("installer.exe");
+        std::fs::write(&target,b"previous complete package").unwrap();
+        for (parts,hash,limit,succeeds) in [
+            (vec![DownloadPart::Bytes(b"new ".to_vec()),DownloadPart::Bytes(b"package".to_vec()),DownloadPart::Complete],digest(b"new package"),11,true),
+            (vec![DownloadPart::Bytes(b"tampered".to_vec()),DownloadPart::Complete],digest(b"new package"),11,false),
+            (vec![DownloadPart::Bytes(b"partial".to_vec())],digest(b"partial"),11,false),
+            (vec![DownloadPart::Bytes(b"oversize".to_vec()),DownloadPart::Complete],digest(b"oversize"),7,false),
+        ] {
+            let before=std::fs::read(&target).unwrap();
+            let (sender,receiver)=tokio::sync::mpsc::channel(2);let path=target.clone();
+            let task=tokio::task::spawn_blocking(move ||write_download(&path,&hash,receiver,limit));
+            for part in parts {if sender.send(part).await.is_err(){break;}}
+            drop(sender);assert_eq!(task.await.unwrap().is_ok(),succeeds);
+            assert_eq!(std::fs::read(&target).unwrap(),if succeeds {b"new package".to_vec()}else{before});
+            assert_eq!(std::fs::read_dir(&folder).unwrap().count(),1,"Failed or cancelled staging must be removed");
+        }
+        std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[cfg(windows)]
+    #[test]
+    #[ignore="Requires an explicitly selected isolated MSI artifact; reads its database without installation"]
+    fn real_msi_identity_matches_release_policy_without_installation(){
+        let package=std::path::PathBuf::from(std::env::var_os("SWAN_TEST_MSI_PACKAGE").expect("Set private fixture MSI path"));
+        let edition=match std::env::var("SWAN_TEST_MSI_EDITION").unwrap().as_str(){"customer"=>Edition::Customer,"technician"=>Edition::Technician,_=>panic!("Explicit fixture edition required")};
+        let version=std::env::var("SWAN_TEST_MSI_VERSION").expect("Explicit fixture version required");
+        let hash=digest(std::fs::read(&package).unwrap());
+        let identity=read_msi_identity(&package).unwrap();
+        validate_msi_identity(&identity,&edition,&version).unwrap();
+        let wrong=if edition==Edition::Customer {Edition::Technician}else{Edition::Customer};
+        assert!(validate_msi_identity(&identity,&wrong,&version).is_err());
+        assert!(validate_msi_identity(&identity,&edition,"99.0.0").is_err());
+        {
+            let script=package.parent().unwrap().join("Restore-ReleaseMsi-read-only-test.ps1");
+            std::fs::write(&script,include_str!("../../../deployment/windows/Restore-ReleaseMsi.ps1")).unwrap();
+            let inspect=|previous_version:&str|powershell_command().unwrap().args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(&script)
+                .arg("-PreviousPackage").arg(&package).arg("-NextProductCode").arg(&identity.product_code).arg("-NextVersion").arg(&version)
+                .arg("-PreviousProductCode").arg(&identity.product_code).arg("-PreviousVersion").arg(previous_version).arg("-Directory").arg(package.parent().unwrap()).arg("-Edition").arg(if edition==Edition::Customer {"customer"}else{"technician"}).arg("-InspectOnly").output().unwrap();
+            let result=inspect(&version);assert!(result.status.success(),"{}",String::from_utf8_lossy(&result.stderr));
+            let plan:serde_json::Value=serde_json::from_slice(&result.stdout).unwrap();
+            assert_eq!(plan["installer_executed"],false);assert_eq!(plan["would_remove_next"],false);
+            assert!(!inspect("99.0.0").status.success(),"Read-only recovery planning must reject incorrect previous identity");
+        }
+        assert_eq!(hash,digest(std::fs::read(package).unwrap()),"Read-only MSI inspection must not change its bytes");
+    }
+    #[tokio::test]
+    #[ignore="Requires the isolated loopback HTTPS download-recovery harness"]
+    async fn https_download_recovery_preserves_staging_on_tamper_and_interruption(){
+        let base=std::env::var("SWAN_TEST_DOWNLOAD_BASE").expect("Run deployment/windows/test-update-download.js");
+        assert!(base.starts_with("https://localhost:"));
+        let folder=std::env::temp_dir().join(format!("swan-https-download-test-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();
+        let artifact=folder.join("installer.exe");
+        let payload=b"Swan HTTPS recovery download fixture\n";let hash=digest(payload);
+        std::fs::write(&artifact,b"previous complete staging").unwrap();
+        download(&format!("{base}/artifact"),&hash,&artifact).await.unwrap();
+        assert_eq!(std::fs::read(&artifact).unwrap(),payload);
+        assert!(download(&format!("{base}/tampered"),&hash,&artifact).await.is_err());
+        assert_eq!(std::fs::read(&artifact).unwrap(),payload);
+        assert!(download(&format!("{base}/partial"),&hash,&artifact).await.is_err());
+        assert_eq!(std::fs::read(&artifact).unwrap(),payload);
+        assert!(download(&format!("{base}/oversized"),&hash,&artifact).await.is_err());
+        assert_eq!(std::fs::read(&artifact).unwrap(),payload);
+        let large=vec![0x5a;16*1024*1024];
+        download(&format!("{base}/large"),&digest(&large),&artifact).await.unwrap();
+        assert!(staged_hash_matches(&artifact,&digest(&large)).unwrap());
+        assert!(!std::fs::read_dir(&folder).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with("swan-download-")));
+        std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn recovery_staging_requires_exact_hash_and_distinguishes_missing_from_io_failure(){
+        let folder=std::env::temp_dir().join(format!("swan-staging-test-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();
+        let artifact=folder.join("helper.exe");let hash=digest(b"authorized helper");
+        assert!(!staged_hash_matches(&artifact,&hash).unwrap());
+        std::fs::write(&artifact,b"truncated helper").unwrap();
+        assert!(!staged_hash_matches(&artifact,&hash).unwrap());
+        publish_download(&artifact,b"authorized helper").unwrap();
+        assert!(staged_hash_matches(&artifact,&hash.to_uppercase()).unwrap());
+        assert!(staged_hash_matches(&folder,&hash).is_err());
+        std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn download_publication_retains_complete_files_and_cleans_failed_staging(){
+        let folder=std::env::temp_dir().join(format!("swan-download-test-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();
+        let target=folder.join("installer.exe");
+        std::fs::write(&target,b"previous complete package").unwrap();
+        publish_download(&target,b"new complete package").unwrap();
+        assert_eq!(std::fs::read(&target).unwrap(),b"new complete package");
+        let conflict=folder.join("directory.exe");std::fs::create_dir(&conflict).unwrap();
+        assert!(publish_download(&conflict,b"replacement").is_err());
+        assert!(conflict.is_dir());
+        assert_eq!(std::fs::read(&target).unwrap(),b"new complete package");
+        assert!(!std::fs::read_dir(&folder).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with("swan-download-")));
+        std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn executable_replacement_verifies_staged_bytes_and_preserves_previous_on_failure(){
+        let folder=std::env::temp_dir().join(format!("swan-replacement-test-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();
+        let source=folder.join("source.exe");let target=folder.join("installed.exe");
+        std::fs::write(&source,b"complete replacement").unwrap();std::fs::write(&target,b"previous executable").unwrap();
+        assert!(replace_verified_file(&source,&target,&digest(b"wrong content")).is_err());
+        assert_eq!(std::fs::read(&target).unwrap(),b"previous executable");
+        replace_verified_file(&source,&target,&digest(b"complete replacement")).unwrap();
+        assert_eq!(std::fs::read(&target).unwrap(),b"complete replacement");
+        assert_eq!(std::fs::read(&source).unwrap(),b"complete replacement");
+        let directory_target=folder.join("directory.exe");std::fs::create_dir(&directory_target).unwrap();
+        assert!(replace_verified_file(&source,&directory_target,&digest(b"complete replacement")).is_err());
+        assert!(directory_target.is_dir());
+        assert!(!std::fs::read_dir(&folder).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with("swan-replacement-")));
+        std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn interrupted_setup_blocks_sessions_until_recovered(){
+        let folder=std::env::temp_dir().join(format!("swan-pending-install-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();std::fs::write(folder.join("pending-install.json"),b"interrupted setup fixture").unwrap();
+        assert!(lock_session(&folder).is_err());
+        std::fs::remove_file(folder.join("pending-install.json")).unwrap();
+        assert!(lock_session(&folder).is_ok());std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn interrupted_update_blocks_sessions_after_process_lock_is_released(){
+        let folder=std::env::temp_dir().join(format!("swan-pending-update-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();
+        let updater=activity_file(&folder).unwrap();fs2::FileExt::try_lock_exclusive(&updater).unwrap();
+        std::fs::write(folder.join("pending-update.json"),b"interrupted update fixture").unwrap();
+        drop(updater);
+        assert!(lock_session(&folder).is_err());
+        std::fs::remove_file(folder.join("pending-update.json")).unwrap();
+        std::fs::write(folder.join("configuration-restart.json"),b"committed update awaiting restart").unwrap();
+        assert!(lock_session(&folder).is_err());
+        std::fs::remove_file(folder.join("configuration-restart.json")).unwrap();
+        assert!(lock_session(&folder).is_ok());std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[cfg(windows)]
+    #[test]
+    fn powershell_installer_byte_lock_excludes_native_sessions(){
+        use std::io::{BufRead,Write};use std::os::windows::process::CommandExt;
+        let folder=std::env::temp_dir().join(format!("swan-installer-lock-{}",random_token()));std::fs::create_dir(&folder).unwrap();
+        let script=folder.join("hold-install-lock.ps1");
+        std::fs::write(&script,r#"param([string]$Directory)
+$ErrorActionPreference='Stop'
+$stream=[IO.File]::Open((Join-Path $Directory 'activity.lock'),[IO.FileMode]::OpenOrCreate,[IO.FileAccess]::ReadWrite,[IO.FileShare]::ReadWrite)
+try {$stream.Lock(0,1);[Console]::WriteLine('locked');[Console]::ReadLine()|Out-Null}finally{$stream.Dispose()}
+"#).unwrap();
+        let mut child=std::process::Command::new("powershell.exe").args(["-NoLogo","-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(&script).arg(&folder).creation_flags(0x08000000).stdin(std::process::Stdio::piped()).stdout(std::process::Stdio::piped()).spawn().unwrap();
+        let mut output=std::io::BufReader::new(child.stdout.take().unwrap());let mut line=String::new();output.read_line(&mut line).unwrap();
+        let ready=line.trim()=="locked";let blocked=lock_session(&folder).is_err();
+        if let Some(mut input)=child.stdin.take(){input.write_all(b"release\n").unwrap();}
+        let status=child.wait().unwrap();assert!(ready && blocked && status.success());
+        assert!(lock_session(&folder).is_ok());std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn removed_application_requires_explicit_setup_instead_of_automatic_reinstall() {
+        let folder=std::env::temp_dir().join(format!("swan-removed-{}",random_token()));
+        std::fs::create_dir(&folder).unwrap();let target=folder.join("endpoint.exe");
+        assert!(require_existing_application(&target).is_err());
+        std::fs::write(&target,b"installed test fixture").unwrap();
+        assert!(require_existing_application(&target).is_ok());
+        std::fs::write(folder.join("pending-uninstall"),b"explicit cancellation").unwrap();
+        assert!(lock_session(&folder).is_err());
+        std::fs::remove_file(folder.join("pending-uninstall")).unwrap();
+        assert!(lock_session(&folder).is_ok());
+        std::fs::remove_file(&target).unwrap();
+        assert!(require_existing_application(&target).is_err());
+        std::fs::remove_file(folder.join("activity.lock")).unwrap();
+        std::fs::remove_dir(folder).unwrap();
+    }
+    #[test]
+    fn update_lock_excludes_sessions_and_releases_on_close() {
+        let folder=std::env::temp_dir().join(format!("swan-lock-{}",random_token()));
+        let session=lock_session(&folder).unwrap();let update=activity_file(&folder).unwrap();
+        assert!(fs2::FileExt::try_lock_exclusive(&update).is_err());drop(session);
+        fs2::FileExt::try_lock_exclusive(&update).unwrap();assert!(lock_session(&folder).is_err());drop(update);
+        assert!(lock_session(&folder).is_ok());std::fs::remove_dir_all(folder).unwrap();
+    }
+    #[test]
+    fn closing_one_connection_does_not_release_another_connections_update_lock() {
+        let folder=std::env::temp_dir().join(format!("swan-multiple-session-lock-{}",random_token()));
+        let first=lock_session(&folder).unwrap();
+        let second=lock_session(&folder).unwrap();
+        let update=activity_file(&folder).unwrap();
+        assert!(fs2::FileExt::try_lock_exclusive(&update).is_err());
+        drop(first);
+        assert!(fs2::FileExt::try_lock_exclusive(&update).is_err());
+        drop(second);
+        fs2::FileExt::try_lock_exclusive(&update).unwrap();
+        assert!(lock_session(&folder).is_err());
+        drop(update);
+        assert!(lock_session(&folder).is_ok());
+        std::fs::remove_dir_all(folder).unwrap();
+    }
+}
diff --git a/product/agent/src/verifier_process.rs b/product/agent/src/verifier_process.rs
new file mode 100644
index 00000000000..8fcf3be4719
--- /dev/null
+++ b/product/agent/src/verifier_process.rs
@@ -0,0 +1,77 @@
+//! Trust verification must fail closed instead of leaving startup waiting forever.
+use anyhow::{bail, Context, Result};
+use std::process::{Child, ExitStatus};
+use std::time::{Duration, Instant};
+
+pub(crate) fn wait(child: &mut Child, timeout: Duration) -> Result<ExitStatus> {
+    wait_with_message(child,timeout,"Publisher verification timed out; no installation or application launch was authorized")
+}
+
+pub(crate) fn wait_with_message(child: &mut Child, timeout: Duration, message: &'static str) -> Result<ExitStatus> {
+    let started = Instant::now();
+    let outcome = (|| {
+        loop {
+            if let Some(status) = child.try_wait().context("Cannot inspect helper process")? {
+                return Ok(status);
+            }
+            if started.elapsed() >= timeout {
+                bail!("{message}");
+            }
+            std::thread::sleep(Duration::from_millis(50).min(timeout.saturating_sub(started.elapsed())));
+        }
+    })();
+    if outcome.is_err() {
+        child.kill().context("Cannot stop stalled helper process")?;
+        child.wait().context("Cannot reap stopped helper process")?;
+    }
+    outcome
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::process::{Command, Stdio};
+
+    fn child(mode: &str) -> Child {
+        Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "verifier_process::tests::verifier_child"])
+            .env("SWAN_VERIFIER_WAIT_TEST", mode)
+            .stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null())
+            .spawn().unwrap()
+    }
+
+    #[test]
+    fn verifier_child() {
+        match std::env::var("SWAN_VERIFIER_WAIT_TEST").as_deref() {
+            Ok("stall") => std::thread::sleep(Duration::from_secs(30)),
+            Ok("reject") => std::process::exit(7),
+            _ => {}
+        }
+    }
+
+    #[test]
+    fn completed_and_rejected_verifiers_keep_their_real_exit_status() {
+        for (mode, expected) in [("accept", 0), ("reject", 7)] {
+            let mut process = child(mode);
+            assert_eq!(wait(&mut process, Duration::from_secs(20)).unwrap().code(), Some(expected));
+        }
+    }
+
+    #[test]
+    fn stalled_verification_is_an_error_and_its_process_is_reaped() {
+        let mut process = child("stall");
+        let error = wait(&mut process, Duration::from_millis(100)).unwrap_err();
+        assert!(error.to_string().contains("timed out"));
+        assert!(process.try_wait().unwrap().is_some());
+    }
+
+    #[test]
+    fn interrupted_ui_helper_preserves_its_recovery_diagnostic_and_is_reaped() {
+        let mut process=child("stall");
+        let error=wait_with_message(&mut process,Duration::from_millis(100),
+            "Customer UI recovery helper timed out; durable recovery remains pending").unwrap_err();
+        assert!(error.to_string().contains("durable recovery remains pending"));
+        assert!(!error.to_string().contains("no installation or application launch was authorized"));
+        assert!(process.try_wait().unwrap().is_some());
+    }
+}
diff --git a/product/management/Cargo.toml b/product/management/Cargo.toml
new file mode 100644
index 00000000000..816b88db482
--- /dev/null
+++ b/product/management/Cargo.toml
@@ -0,0 +1,40 @@
+[package]
+workspace = ".."
+name = "swan-management"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+swan-protocol = { path = "../protocol" }
+swan-agent = { path = "../agent" }
+anyhow.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+reqwest.workspace = true
+base64.workspace = true
+ed25519-dalek.workspace = true
+rand.workspace = true
+sha2.workspace = true
+hex.workspace = true
+fs2 = "0.4"
+tokio.workspace = true
+uuid.workspace = true
+axum = "0.8"
+rusqlite = { version = "0.32", features = ["bundled", "backup"] }
+aes-gcm = "0.10"
+# Enable STREAM on the existing locked AEAD implementation for large backups.
+aead = { version = "0.5.2", features = ["stream"] }
+zip = { version = "2", default-features = false, features = ["deflate"] }
+argon2 = "0.5"
+totp-rs = { version = "5", features = ["gen_secret"] }
+tower-http = { version = "0.6", features = ["limit", "set-header"] }
+
+[target.'cfg(windows)'.dependencies]
+windows-service = "0.8"
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_Security", "Win32_System_JobObjects", "Win32_System_Threading"] }
+
+[dev-dependencies]
+tower = { version = "0.5", features = ["util"] }
+http-body-util = "0.1"
diff --git a/product/management/src/backup.rs b/product/management/src/backup.rs
new file mode 100644
index 00000000000..95f407992a9
--- /dev/null
+++ b/product/management/src/backup.rs
@@ -0,0 +1,453 @@
+use aes_gcm::{aead::{Aead,KeyInit},Aes256Gcm,Nonce};
+use anyhow::{ensure,Context,Result};
+use rand::RngCore;
+use std::{io::{Cursor,Read,Write},path::Path};
+
+#[path="backup_stream.rs"]
+mod stream;
+const HEADER:&[u8]=b"SWANBK1";
+fn key(password:&str,salt:&[u8])->Result<[u8;32]> {
+    ensure!(password.len()>=16 && password.len()<=1024,"Backup passphrase must contain 16–1024 characters");
+    let mut key=[0u8;32];argon2::Argon2::default().hash_password_into(password.as_bytes(),salt,&mut key).map_err(|_|anyhow::anyhow!("Backup key derivation failed"))?;Ok(key)
+}
+pub fn export(data:&Path,destination:&Path,password:&str)->Result<()> {
+    export_complete(data,destination,password,None,None,None)
+}
+pub fn export_complete(data:&Path,destination:&Path,password:&str,transport:Option<&Path>,configuration:Option<&Path>,tls_identity:Option<&Path>)->Result<()> {
+    export_deployment(data,destination,password,transport,configuration,tls_identity,None)
+}
+fn tls_entry(name:&str)->bool {
+    name.strip_prefix("tls-storage/").is_some_and(|relative| {
+        !relative.is_empty() && !relative.contains(['\\',':']) &&
+        relative.split('/').count()<=32 && relative.split('/').all(|part| {
+            let stem=part.split('.').next().unwrap_or_default().to_ascii_uppercase();
+            !part.is_empty() && !part.ends_with(['.',' ']) && !part.chars().any(|c|c.is_control() || "<>\"|?*".contains(c)) &&
+            !matches!(stem.as_str(),"CON"|"PRN"|"AUX"|"NUL"|"COM1"|"COM2"|"COM3"|"COM4"|"COM5"|"COM6"|"COM7"|"COM8"|"COM9"|"LPT1"|"LPT2"|"LPT3"|"LPT4"|"LPT5"|"LPT6"|"LPT7"|"LPT8"|"LPT9")
+        })
+    })
+}
+fn collect_tls(root:&Path,directory:&Path,files:&mut Vec<(String,std::path::PathBuf)>)->Result<()> {
+    let metadata=std::fs::symlink_metadata(directory)?;
+    ensure!(!metadata.file_type().is_symlink(),"TLS storage must not contain symbolic links");
+    #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"TLS storage must not contain reparse points");}
+    ensure!(metadata.is_dir(),"TLS storage must be a directory");
+    for entry in std::fs::read_dir(directory)? {
+        let path=entry?.path();let metadata=std::fs::symlink_metadata(&path)?;
+        ensure!(!metadata.file_type().is_symlink(),"TLS storage must not contain symbolic links");
+        #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"TLS storage must not contain reparse points");}
+        let relative=path.strip_prefix(root)?.to_str().context("TLS storage filenames must be UTF-8")?.replace('\\',"/");
+        let name=format!("tls-storage/{relative}");ensure!(tls_entry(&name),"Unsupported TLS storage path");
+        if metadata.is_dir(){collect_tls(root,&path,files)?;}else{
+            ensure!(metadata.is_file(),"TLS storage must contain regular files only");
+            ensure!(files.len()<4096,"Too many backup files");files.push((name,path));
+        }
+    }
+    Ok(())
+}
+pub fn export_deployment(data:&Path,destination:&Path,password:&str,transport:Option<&Path>,configuration:Option<&Path>,tls_identity:Option<&Path>,tls_directory:Option<&Path>)->Result<()> {
+    export_deployment_with_artifacts(data,destination,password,transport,configuration,tls_identity,tls_directory,None)
+}
+fn artifact_entry(name:&str)->bool {
+    name.strip_prefix("artifacts/").and_then(|name|name.strip_suffix(".zip"))
+        .is_some_and(|id|uuid::Uuid::parse_str(id).is_ok_and(|parsed|parsed.to_string()==id))
+}
+fn snapshot_transport(directory:&Path,data:&Path,destination:&Path)->Result<()> {
+    // A stopped WAL database can need SHM initialization or recovery, which
+    // cannot occur on a read-only transport mount. Recover a private copy;
+    // never ignore WAL frames or change the original transport storage.
+    let staging=data.join(format!("backup-transport-source-{}",swan_protocol::random_token()));
+    let builder=std::fs::DirBuilder::new();
+    #[cfg(unix)] let mut builder=builder;
+    #[cfg(unix)] {use std::os::unix::fs::DirBuilderExt;builder.mode(0o700);}
+    builder.create(&staging).context("Create private transport backup staging")?;
+    let result=(||->Result<()> {
+        let mut total=0u64;
+        for name in ["db_v2.sqlite3","db_v2.sqlite3-wal","db_v2.sqlite3-journal"] {
+            let source=directory.join(name);
+            let metadata=match std::fs::symlink_metadata(&source) {
+                Ok(value)=>value,
+                Err(error) if error.kind()==std::io::ErrorKind::NotFound && name!="db_v2.sqlite3"=>continue,
+                Err(error)=>return Err(error).context("Inspect stopped transport backup source"),
+            };
+            ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"Transport database backup source must be a regular file");
+            #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Transport database backup source must not be a reparse point");}
+            total=total.checked_add(metadata.len()).context("Transport backup source size overflow")?;
+            ensure!(total<=512*1024*1024,"Transport backup source exceeds 512 MiB");
+            let input=std::fs::File::open(&source)?;
+            let mut options=std::fs::OpenOptions::new();options.create_new(true).write(true);
+            #[cfg(unix)] {use std::os::unix::fs::OpenOptionsExt;options.mode(0o600);}
+            let mut output=options.open(staging.join(name))?;
+            ensure!(std::io::copy(&mut input.take(metadata.len()+1),&mut output)?==metadata.len(),"Transport database changed during backup; stop transport before export");
+        }
+        let transport_db=rusqlite::Connection::open(staging.join("db_v2.sqlite3")).context("Open staged transport database for backup")?;
+        transport_db.backup(rusqlite::DatabaseName::Main,destination,None).context("Snapshot staged transport database for backup")?;
+        Ok(())
+    })();
+    // Only remove the fixed files in the directory created by this operation.
+    // SQLite handles are dropped before cleanup, including on a failed snapshot.
+    for name in ["db_v2.sqlite3","db_v2.sqlite3-wal","db_v2.sqlite3-shm","db_v2.sqlite3-journal"] {
+        match std::fs::remove_file(staging.join(name)) {
+            Ok(())=>{},Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{},
+            Err(error)=>return Err(error).context("Remove private transport backup staging file"),
+        }
+    }
+    std::fs::remove_dir(&staging).context("Remove private transport backup staging directory")?;
+    result
+}
+
+pub fn migrate_transport_database(data:&Path,source:&Path)->Result<()> {
+    ensure!(data.is_absolute() && source.is_absolute(),"Company and source directories must be absolute");
+    let transport=data.join("transport");
+    for directory in [data,source,transport.as_path()] {
+        for parent in directory.ancestors() {
+            let metadata=std::fs::symlink_metadata(parent)?;
+            ensure!(metadata.is_dir() && !metadata.file_type().is_symlink(),"Migration directories must not contain links");
+            #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Migration directories must not contain reparse points");}
+        }
+    }
+    for path in [data.join("management.sqlite3"),data.join("management.lock"),transport.join("id_ed25519"),transport.join("id_ed25519.pub")] {
+        let metadata=std::fs::symlink_metadata(path)?;
+        ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"Existing company database, lock and transport keys are required");
+        #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Migration inputs must not be reparse points");}
+    }
+    let lock=std::fs::OpenOptions::new().read(true).write(true).open(data.join("management.lock"))?;
+    fs2::FileExt::try_lock_exclusive(&lock).context("Stop company management before transport database migration")?;
+    let target=transport.join("db_v2.sqlite3");
+    ensure!(matches!(std::fs::symlink_metadata(&target),Err(error) if error.kind()==std::io::ErrorKind::NotFound),"Refusing to overwrite an existing managed transport database");
+    let mut sources=Vec::new();
+    for name in ["db_v2.sqlite3","db_v2.sqlite3-wal","db_v2.sqlite3-journal"] {
+        let path=source.join(name);
+        let metadata=match std::fs::symlink_metadata(&path) {
+            Ok(metadata)=>metadata,
+            Err(error) if error.kind()==std::io::ErrorKind::NotFound && name!="db_v2.sqlite3"=>continue,
+            Err(error)=>return Err(error).context("Inspect stopped source transport database"),
+        };
+        ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"Migration source must be a regular database file");
+        #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Migration source must not be a reparse point");}
+        let mut options=std::fs::OpenOptions::new();options.read(true);
+        // Deny an existing or new Windows writer while copying the stopped DB/WAL.
+        #[cfg(windows)] {use std::os::windows::fs::OpenOptionsExt;options.share_mode(1);}
+        sources.push(options.open(path).context("Stop rendezvous before migrating its database")?);
+    }
+    let staging=stream::Staging::new(data)?;
+    let snapshot=staging.0.join("transport.sqlite3");
+    snapshot_transport(source,data,&snapshot)?;
+    let database=rusqlite::Connection::open_with_flags(&snapshot,rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY)?;
+    let integrity:String=database.query_row("PRAGMA quick_check",[],|row|row.get(0))?;
+    ensure!(integrity=="ok","Migrated transport database integrity check failed");
+    drop(database);
+    std::fs::OpenOptions::new().read(true).write(true).open(&snapshot)?.sync_all()?;
+    // Publish atomically without replacing another migration's destination.
+    std::fs::hard_link(&snapshot,&target).context("Publish managed transport database without overwriting existing state")?;
+    drop(sources);
+    Ok(())
+}
+pub fn export_deployment_with_artifacts(data:&Path,destination:&Path,password:&str,transport:Option<&Path>,configuration:Option<&Path>,tls_identity:Option<&Path>,tls_directory:Option<&Path>,artifacts:Option<&Path>)->Result<()> {
+    ensure!(!destination.exists(),"Refusing to overwrite an existing backup");
+    let db=rusqlite::Connection::open_with_flags(data.join("management.sqlite3"),rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY).context("Open management database for backup")?;
+    let snapshot=data.join(format!("backup-{}.sqlite3",swan_protocol::random_token()));
+    db.backup(rusqlite::DatabaseName::Main,&snapshot,None).context("Snapshot management database for backup")?;
+    let mut snapshots=vec![snapshot.clone()];
+    let result=(||->Result<()> {
+        let mut files=vec![("management.sqlite3".to_string(),snapshot.clone()),("profile-key.hex".to_string(),data.join("profile-key.hex")),("setup-token.txt".to_string(),data.join("setup-token.txt"))];
+        if let Some(directory)=transport {
+            #[cfg(windows)] {crate::components::transport_database_path(directory,&crate::components::legacy_transport_database()?)?;}
+            files.push(("transport-id_ed25519".into(),directory.join("id_ed25519")));files.push(("transport-id_ed25519.pub".into(),directory.join("id_ed25519.pub")));
+            if directory.join("db_v2.sqlite3").exists(){
+                let transport_snapshot=data.join(format!("backup-transport-{}.sqlite3",swan_protocol::random_token()));snapshots.push(transport_snapshot.clone());
+                snapshot_transport(directory,data,&transport_snapshot)?;
+                files.push(("transport-db.sqlite3".into(),transport_snapshot));
+            }
+        }
+        if let Some(path)=configuration {files.push(("deployment.env".into(),path.to_path_buf()));}
+        if let Some(path)=tls_identity {files.push(("tls-identity".into(),path.to_path_buf()));}
+        if let Some(directory)=tls_directory {collect_tls(directory,directory,&mut files)?;}
+        if let Some(directory)=artifacts {
+            let metadata=std::fs::symlink_metadata(directory)?;
+            ensure!(metadata.is_dir() && !metadata.file_type().is_symlink(),"Installer artifacts must be a regular directory");
+            #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Installer artifacts must not contain reparse points");}
+            for entry in std::fs::read_dir(directory)? {
+                let path=entry?.path();let metadata=std::fs::symlink_metadata(&path)?;
+                ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"Installer artifacts must contain regular files only");
+                #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Installer artifacts must not contain reparse points");}
+                let name=format!("artifacts/{}",path.file_name().and_then(|name|name.to_str()).context("Installer artifact name must be UTF-8")?);
+                ensure!(artifact_entry(&name),"Installer artifact must use its canonical build UUID and ZIP extension; finish uploads before export");
+                ensure!(files.len()<4096,"Too many backup files");files.push((name,path));
+            }
+        }
+        let proxy=data.join("Caddyfile");
+        match std::fs::symlink_metadata(&proxy) {
+            Ok(metadata)=>{
+                ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"HTTPS configuration must be a regular file");
+                #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"HTTPS configuration must not be a reparse point");}
+                files.push(("Caddyfile".into(),proxy));
+            },
+            Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{},
+            Err(error)=>return Err(error).context("Cannot inspect HTTPS configuration for backup"),
+        }
+        let receipt=data.join("installation.json");
+        match std::fs::symlink_metadata(&receipt) {
+            Ok(metadata)=>{
+                ensure!(metadata.is_file() && !metadata.file_type().is_symlink() && (1..=64*1024).contains(&metadata.len()),"Windows installation receipt must be a bounded regular file");
+                #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Windows installation receipt must not be a reparse point");}
+                files.push(("installation.json".into(),receipt));
+            },
+            Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{},
+            Err(error)=>return Err(error).context("Cannot inspect Windows installation receipt for backup"),
+        }
+        ensure!(files.len()<=4096,"Too many backup files");
+        stream::export(data,files,destination,password)
+    })();
+    for snapshot in snapshots {if snapshot.exists(){std::fs::remove_file(&snapshot).context("Remove plaintext database snapshot after backup")?;}}
+    result
+}
+fn empty_target(data:&Path)->Result<()> {
+    match std::fs::symlink_metadata(data) {
+        Ok(metadata)=>{
+            ensure!(metadata.is_dir() && !metadata.file_type().is_symlink(),"Restore target must be a regular directory");
+            #[cfg(windows)] {use std::os::windows::fs::MetadataExt;ensure!(metadata.file_attributes()&0x400==0,"Restore target must not be a reparse point");}
+            ensure!(std::fs::read_dir(data)?.next().is_none(),"Restore requires an empty target directory and a stopped management service");
+        },
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{},
+        Err(error)=>return Err(error.into()),
+    }
+    Ok(())
+}
+pub fn restore(data:&Path,source:&Path,password:&str)->Result<()> {
+    empty_target(data)?;
+    let mut header=[0u8;7];std::fs::File::open(source)?.read_exact(&mut header)?;
+    if header.as_slice()==stream::HEADER {return stream::restore(data,source,password);}
+    // Legacy archives retain their original bounded-memory reader and limits.
+    ensure!(std::fs::metadata(source)?.len()<=1024*1024*1024,"Backup exceeds size limit");
+    let bytes=std::fs::read(source)?;
+    ensure!(bytes.len()>HEADER.len()+28 && bytes.starts_with(HEADER),"Invalid backup format");
+    let offset=HEADER.len();let salt=&bytes[offset..offset+16];let nonce=&bytes[offset+16..offset+28];
+    let cipher=Aes256Gcm::new_from_slice(&key(password,salt)?).map_err(|_|anyhow::anyhow!("Invalid decryption key"))?;
+    let plaintext=cipher.decrypt(Nonce::from_slice(nonce),&bytes[offset+28..]).map_err(|_|anyhow::anyhow!("Backup password incorrect or backup modified"))?;
+    let mut archive=zip::ZipArchive::new(Cursor::new(plaintext))?;
+    restore_archive(data,&mut archive,512*1024*1024)
+}
+fn restore_archive<R:Read+std::io::Seek>(data:&Path,archive:&mut zip::ZipArchive<R>,limit:u64)->Result<()> {
+    ensure!((3..=4096).contains(&archive.len()),"Unexpected backup contents");
+    let allowed=["management.sqlite3","profile-key.hex","setup-token.txt","transport-id_ed25519","transport-id_ed25519.pub","transport-db.sqlite3","deployment.env","tls-identity","Caddyfile","installation.json"];
+    let mut names=std::collections::HashSet::new();
+    for index in 0..archive.len(){let entry=archive.by_index(index)?;ensure!((allowed.contains(&entry.name()) || tls_entry(entry.name()) || artifact_entry(entry.name())) && !entry.is_dir() && names.insert(entry.name().to_string()),"Unknown or duplicate backup entry");}
+    let mut portable_names=std::collections::HashSet::new();
+    for name in &names {ensure!(portable_names.insert(name.to_ascii_lowercase()),"Backup filenames collide on Windows");}
+    for name in &portable_names {
+        let mut parent=name.as_str();while let Some((prefix,_))=parent.rsplit_once('/') {ensure!(!portable_names.contains(prefix),"Backup file conflicts with a directory");parent=prefix;}
+    }
+    ensure!(names.contains("transport-id_ed25519")==names.contains("transport-id_ed25519.pub"),"Incomplete transport trust key pair");
+    for required in &allowed[..3]{ensure!(names.contains(*required),"Missing management backup entry");}
+    // Bound all expanded sizes before writing to private staging. ZIP CRC and
+    // exact lengths are checked during extraction, before publishing the target.
+    let mut total=0u64;
+    for name in &names {
+        let entry=archive.by_name(name)?;
+        if name=="installation.json" {ensure!((1..=64*1024).contains(&entry.size()),"Invalid Windows installation receipt size");}
+        total=total.checked_add(entry.size()).context("Backup size overflow")?;
+        ensure!(total<=limit,"Backup contents too large");
+    }
+    stream::extract(data,archive,names)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn migration_fixture()->(std::path::PathBuf,std::path::PathBuf,std::path::PathBuf) {
+        let root=std::env::temp_dir().join(format!("swan-transport-migrate-{}",swan_protocol::random_token()));
+        let data=root.join("company");let source=root.join("stopped-source");
+        std::fs::create_dir_all(data.join("transport")).unwrap();std::fs::create_dir(&source).unwrap();
+        for name in ["management.sqlite3","management.lock","transport/id_ed25519","transport/id_ed25519.pub"] {std::fs::write(data.join(name),b"owned company fixture").unwrap();}
+        (root,data,source)
+    }
+    #[test]
+    fn transport_migration_recovers_stopped_wal_without_changing_source_or_keys() {
+        let (root,data,source)=migration_fixture();
+        let original=root.join("writer.sqlite3");let writer=rusqlite::Connection::open(&original).unwrap();
+        writer.execute_batch("PRAGMA journal_mode=WAL; PRAGMA wal_autocheckpoint=0; CREATE TABLE peer(id TEXT PRIMARY KEY); INSERT INTO peer VALUES ('preserved-fixture');").unwrap();
+        std::fs::copy(&original,source.join("db_v2.sqlite3")).unwrap();std::fs::copy(root.join("writer.sqlite3-wal"),source.join("db_v2.sqlite3-wal")).unwrap();
+        let source_db=std::fs::read(source.join("db_v2.sqlite3")).unwrap();let source_wal=std::fs::read(source.join("db_v2.sqlite3-wal")).unwrap();
+        migrate_transport_database(&data,&source).unwrap();
+        let migrated=rusqlite::Connection::open(data.join("transport/db_v2.sqlite3")).unwrap();
+        assert_eq!(migrated.query_row("SELECT id FROM peer",[],|row|row.get::<_,String>(0)).unwrap(),"preserved-fixture");
+        assert_eq!(std::fs::read(source.join("db_v2.sqlite3")).unwrap(),source_db);assert_eq!(std::fs::read(source.join("db_v2.sqlite3-wal")).unwrap(),source_wal);
+        assert!(!source.join("db_v2.sqlite3-shm").exists());
+        for name in ["id_ed25519","id_ed25519.pub"] {assert_eq!(std::fs::read(data.join("transport").join(name)).unwrap(),b"owned company fixture");}
+        assert!(std::fs::read_dir(&data).unwrap().all(|entry|{let entry=entry.unwrap();let name=entry.file_name();let name=name.to_string_lossy();!name.starts_with(".swan-backup-") && !name.starts_with("backup-transport-source-")}));
+        drop(migrated);drop(writer);std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn transport_migration_refuses_existing_target_active_management_and_corrupt_source() {
+        let (root,data,source)=migration_fixture();let target=data.join("transport/db_v2.sqlite3");
+        std::fs::write(&target,b"retained original target").unwrap();
+        assert!(migrate_transport_database(&data,&source).is_err());assert_eq!(std::fs::read(&target).unwrap(),b"retained original target");std::fs::remove_file(&target).unwrap();
+        let lock=std::fs::OpenOptions::new().read(true).write(true).open(data.join("management.lock")).unwrap();fs2::FileExt::try_lock_exclusive(&lock).unwrap();
+        assert!(migrate_transport_database(&data,&source).is_err());assert!(!target.exists());drop(lock);
+        std::fs::write(source.join("db_v2.sqlite3"),b"corrupt source fixture").unwrap();
+        assert!(migrate_transport_database(&data,&source).is_err());assert!(!target.exists());assert_eq!(std::fs::read(source.join("db_v2.sqlite3")).unwrap(),b"corrupt source fixture");
+        assert!(!std::fs::read_dir(&data).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with(".swan-backup-")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[cfg(windows)]
+    #[test]
+    fn transport_migration_refuses_a_running_windows_database_writer() {
+        let (root,data,source)=migration_fixture();let writer=rusqlite::Connection::open(source.join("db_v2.sqlite3")).unwrap();
+        writer.execute_batch("CREATE TABLE peer(id TEXT);").unwrap();
+        assert!(migrate_transport_database(&data,&source).is_err());assert!(!data.join("transport/db_v2.sqlite3").exists());
+        drop(writer);std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn failed_transport_snapshot_removes_private_staging_without_changing_source() {
+        let root=std::env::temp_dir().join(format!("swan-failed-transport-backup-{}",swan_protocol::random_token()));
+        let data=root.join("data");let transport=root.join("transport");std::fs::create_dir_all(&data).unwrap();std::fs::create_dir(&transport).unwrap();
+        let db=rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();db.execute_batch("CREATE TABLE identity(value TEXT);").unwrap();drop(db);
+        std::fs::write(data.join("profile-key.hex"),b"fixture key").unwrap();std::fs::write(data.join("setup-token.txt"),b"fixture token").unwrap();
+        let invalid=b"corrupt transport database fixture";
+        std::fs::write(transport.join("db_v2.sqlite3"),invalid).unwrap();
+        std::fs::write(transport.join("id_ed25519"),b"fixture private key").unwrap();std::fs::write(transport.join("id_ed25519.pub"),b"fixture public key").unwrap();
+        let archive=root.join("rejected.backup");
+        let error=export_complete(&data,&archive,"failed backup test passphrase",Some(&transport),None,None).unwrap_err();
+        assert!(format!("{error:#}").contains("transport database"));assert!(!archive.exists());
+        assert_eq!(std::fs::read(transport.join("db_v2.sqlite3")).unwrap(),invalid);
+        assert!(std::fs::read_dir(&data).unwrap().all(|entry|!entry.unwrap().file_name().to_string_lossy().starts_with("backup-")),"Failed export must remove plaintext snapshots and staging");
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[cfg(unix)]
+    #[test]
+    fn readonly_transport_wal_export_preserves_committed_peers() {
+        use std::os::unix::fs::PermissionsExt;
+        let root=std::env::temp_dir().join(format!("swan-readonly-wal-backup-{}",swan_protocol::random_token()));
+        let data=root.join("data");let original=root.join("original");let transport=root.join("transport");
+        for directory in [&data,&original,&transport]{std::fs::create_dir_all(directory).unwrap();}
+        let management=rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();
+        management.execute_batch("CREATE TABLE identity(value TEXT);INSERT INTO identity VALUES('retained company');").unwrap();drop(management);
+        std::fs::write(data.join("profile-key.hex"),b"fixture key").unwrap();std::fs::write(data.join("setup-token.txt"),b"fixture token").unwrap();
+        let writer=rusqlite::Connection::open(original.join("db_v2.sqlite3")).unwrap();
+        writer.execute_batch("PRAGMA journal_mode=WAL;PRAGMA wal_autocheckpoint=0;CREATE TABLE peers(id TEXT);INSERT INTO peers VALUES('committed WAL peer');").unwrap();
+        // Model stopped transport storage with committed WAL frames and no SHM
+        // file, as a read-only backup mount may present it after interruption.
+        for name in ["db_v2.sqlite3","db_v2.sqlite3-wal"]{std::fs::copy(original.join(name),transport.join(name)).unwrap();}
+        let source_database=std::fs::read(transport.join("db_v2.sqlite3")).unwrap();let source_wal=std::fs::read(transport.join("db_v2.sqlite3-wal")).unwrap();
+        std::fs::write(transport.join("id_ed25519"),b"fixture private key").unwrap();std::fs::write(transport.join("id_ed25519.pub"),b"fixture public key").unwrap();
+        std::fs::set_permissions(&transport,std::fs::Permissions::from_mode(0o555)).unwrap();
+        let probe=transport.join("write-probe");
+        if std::fs::OpenOptions::new().create_new(true).write(true).open(&probe).is_ok(){
+            // Root bypasses Unix mode bits; actual read-only mount coverage is
+            // provided by the separate container deployment rehearsal.
+            std::fs::set_permissions(&transport,std::fs::Permissions::from_mode(0o755)).unwrap();drop(writer);std::fs::remove_dir_all(root).unwrap();return;
+        }
+        let archive=root.join("complete.backup");
+        let result=export_complete(&data,&archive,"readonly WAL test passphrase",Some(&transport),None,None);
+        let source_unchanged=!transport.join("db_v2.sqlite3-shm").exists();
+        std::fs::set_permissions(&transport,std::fs::Permissions::from_mode(0o755)).unwrap();drop(writer);
+        result.unwrap();assert!(source_unchanged,"Export must not write into read-only transport storage");
+        assert_eq!(std::fs::read(transport.join("db_v2.sqlite3")).unwrap(),source_database);assert_eq!(std::fs::read(transport.join("db_v2.sqlite3-wal")).unwrap(),source_wal);
+        assert!(std::fs::read_dir(&data).unwrap().all(|entry|!entry.unwrap().file_name().to_string_lossy().starts_with("backup-")),"Plaintext snapshots and staging must be removed");
+        let restored=root.join("restored");restore(&restored,&archive,"readonly WAL test passphrase").unwrap();
+        let db=rusqlite::Connection::open(restored.join("transport-db.sqlite3")).unwrap();
+        assert_eq!(db.query_row("SELECT id FROM peers",[],|row|row.get::<_,String>(0)).unwrap(),"committed WAL peer");drop(db);
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn installer_artifacts_roundtrip_and_reject_unfinished_or_unsafe_entries() {
+        let root=std::env::temp_dir().join(format!("swan-artifact-backup-{}",swan_protocol::random_token()));
+        let data=root.join("data");let artifacts=data.join("artifacts");std::fs::create_dir_all(&artifacts).unwrap();
+        let db=rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();db.execute_batch("CREATE TABLE builds(id TEXT);INSERT INTO builds VALUES('retained');").unwrap();drop(db);
+        std::fs::write(data.join("profile-key.hex"),b"key").unwrap();std::fs::write(data.join("setup-token.txt"),b"token").unwrap();
+        let id=uuid::Uuid::new_v4().to_string();let name=format!("{id}.zip");std::fs::write(artifacts.join(&name),b"retained installer bytes").unwrap();
+        let archive=root.join("complete.backup");
+        export_deployment_with_artifacts(&data,&archive,"installer backup test password",None,None,None,None,Some(&artifacts)).unwrap();
+        let restored=root.join("restored");restore(&restored,&archive,"installer backup test password").unwrap();
+        assert_eq!(std::fs::read(restored.join("artifacts").join(&name)).unwrap(),b"retained installer bytes");
+        for name in ["artifacts/../outside.zip","artifacts/not-a-build.zip","artifacts/00000000-0000-0000-0000-000000000000.zip/child","artifacts/00000000-0000-0000-0000-000000000000.partial"] {assert!(!artifact_entry(name));}
+        std::fs::write(artifacts.join(format!("{id}.partial")),b"unfinished upload").unwrap();
+        let rejected=root.join("unfinished.backup");
+        assert!(export_deployment_with_artifacts(&data,&rejected,"installer backup test password",None,None,None,None,Some(&artifacts)).is_err());assert!(!rejected.exists());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn complete_backup_preserves_transport_configuration_and_tls_and_rejects_tampering() {
+        let root=std::env::temp_dir().join(format!("swan-full-backup-{}",swan_protocol::random_token()));
+        let data=root.join("data");let transport=root.join("transport");std::fs::create_dir_all(&data).unwrap();std::fs::create_dir(&transport).unwrap();
+        let db=rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();db.execute_batch("CREATE TABLE identity(value TEXT);INSERT INTO identity VALUES('company identity');").unwrap();drop(db);
+        std::fs::write(data.join("profile-key.hex"),"management signing key").unwrap();std::fs::write(data.join("setup-token.txt"),"setup token").unwrap();
+        std::fs::write(transport.join("id_ed25519"),b"private transport key").unwrap();std::fs::write(transport.join("id_ed25519.pub"),b"public transport key").unwrap();
+        let db=rusqlite::Connection::open(transport.join("db_v2.sqlite3")).unwrap();db.execute_batch("CREATE TABLE peers(id TEXT);INSERT INTO peers VALUES('retained peer');").unwrap();drop(db);
+        let configuration=root.join("company.env");let tls=root.join("server.pfx");std::fs::write(&configuration,b"company settings and TLS password").unwrap();std::fs::write(&tls,b"TLS identity fixture").unwrap();
+        let tls_storage=root.join("caddy");let certificate=tls_storage.join("certificates/acme.example/company.example/company.key");
+        std::fs::create_dir_all(certificate.parent().unwrap()).unwrap();std::fs::write(&certificate,b"ACME private key fixture").unwrap();
+        std::fs::write(tls_storage.join("account.json"),b"ACME account fixture").unwrap();
+        std::fs::write(data.join("Caddyfile"),b"company.example { reverse_proxy 127.0.0.1:24440 }").unwrap();
+        let receipt=br#"{"schema":1,"service_name":"SwanCompanyServer","full_stack":true}"#;
+        std::fs::write(data.join("installation.json"),receipt).unwrap();
+        let archive=root.join("complete.swan-backup");export_deployment(&data,&archive,"complete backup passphrase",Some(&transport),Some(&configuration),Some(&tls),Some(&tls_storage)).unwrap();
+        let destination=root.join("restored");restore(&destination,&archive,"complete backup passphrase").unwrap();
+        assert_eq!(std::fs::read(destination.join("transport-id_ed25519")).unwrap(),b"private transport key");assert_eq!(std::fs::read(destination.join("transport-id_ed25519.pub")).unwrap(),b"public transport key");
+        assert_eq!(std::fs::read(destination.join("deployment.env")).unwrap(),std::fs::read(configuration).unwrap());assert_eq!(std::fs::read(destination.join("tls-identity")).unwrap(),std::fs::read(tls).unwrap());
+        assert_eq!(std::fs::read(destination.join("tls-storage/certificates/acme.example/company.example/company.key")).unwrap(),std::fs::read(certificate).unwrap());
+        assert_eq!(std::fs::read(destination.join("tls-storage/account.json")).unwrap(),b"ACME account fixture");
+        assert_eq!(std::fs::read(destination.join("Caddyfile")).unwrap(),std::fs::read(data.join("Caddyfile")).unwrap());
+        assert_eq!(std::fs::read(destination.join("installation.json")).unwrap(),receipt);
+        let db=rusqlite::Connection::open(destination.join("transport-db.sqlite3")).unwrap();assert_eq!(db.query_row("SELECT id FROM peers",[],|row|row.get::<_,String>(0)).unwrap(),"retained peer");drop(db);
+        let mut modified=std::fs::read(&archive).unwrap();let last=modified.len()-1;modified[last]^=1;let tampered=root.join("tampered.swan-backup");std::fs::write(&tampered,modified).unwrap();
+        let rejected=root.join("rejected");assert!(restore(&rejected,&tampered,"complete backup passphrase").is_err());assert!(!rejected.exists());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn installation_receipt_rejects_invalid_file_types_and_sizes_before_export() {
+        for kind in ["directory","empty","oversized"] {
+            let root=std::env::temp_dir().join(format!("swan-receipt-backup-{}",swan_protocol::random_token()));
+            let data=root.join("data");std::fs::create_dir_all(&data).unwrap();
+            let db=rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();db.execute_batch("CREATE TABLE identity(value TEXT);").unwrap();drop(db);
+            std::fs::write(data.join("profile-key.hex"),b"key").unwrap();std::fs::write(data.join("setup-token.txt"),b"token").unwrap();
+            let receipt=data.join("installation.json");
+            if kind=="directory" {std::fs::create_dir(&receipt).unwrap();}else{std::fs::write(&receipt,vec![b'x';if kind=="empty" {0}else{64*1024+1}]).unwrap();}
+            let output=root.join("rejected.backup");assert!(export(&data,&output,"receipt backup test password").is_err());assert!(!output.exists());
+            assert!(!std::fs::read_dir(&data).unwrap().any(|entry|entry.unwrap().file_name().to_string_lossy().starts_with("backup-")));
+            std::fs::remove_dir_all(root).unwrap();
+        }
+    }
+    #[test]
+    fn invalid_receipt_size_in_authenticated_archive_never_publishes_restore() {
+        let root=std::env::temp_dir().join(format!("swan-invalid-receipt-restore-{}",swan_protocol::random_token()));std::fs::create_dir(&root).unwrap();
+        for size in [0,64*1024+1] {
+            let mut archive=zip::ZipWriter::new(Cursor::new(Vec::new()));
+            for name in ["management.sqlite3","profile-key.hex","setup-token.txt"] {archive.start_file(name,zip::write::SimpleFileOptions::default()).unwrap();archive.write_all(b"fixture").unwrap();}
+            archive.start_file("installation.json",zip::write::SimpleFileOptions::default()).unwrap();archive.write_all(&vec![b'x';size]).unwrap();
+            let mut archive=zip::ZipArchive::new(archive.finish().unwrap()).unwrap();let destination=root.join(format!("rejected-{size}"));
+            assert!(restore_archive(&destination,&mut archive,1024*1024).is_err());assert!(!destination.exists());
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn tls_archive_paths_cannot_escape_restore_or_collide_with_management() {
+        assert!(tls_entry("tls-storage/certificates/company.example/company.key"));
+        for name in ["tls-storage/../profile-key.hex","tls-storage/./key","tls-storage//key","tls-storage/C:/key","tls-storage/dir\\key","tls-storage/key\0","tls-storage/","tls-storage/key.","tls-storage/key ","tls-storage/CON.key","tls-storage/NUL","profile-key.hex"] {assert!(!tls_entry(name),"{name:?}");}
+        let root=std::env::temp_dir().join(format!("swan-invalid-tls-backup-{}",swan_protocol::random_token()));std::fs::create_dir(&root).unwrap();
+        for (index,extras) in [vec!["tls-storage/../outside"],vec!["tls-storage/Key","tls-storage/key"],vec!["tls-storage/file","tls-storage/file/child"]].into_iter().enumerate() {
+            let mut archive=zip::ZipWriter::new(Cursor::new(Vec::new()));
+            for name in ["management.sqlite3","profile-key.hex","setup-token.txt"].into_iter().chain(extras) {archive.start_file(name,zip::write::SimpleFileOptions::default()).unwrap();archive.write_all(b"fixture").unwrap();}
+            let plaintext=archive.finish().unwrap().into_inner();let salt=[1u8;16];let nonce=[2u8;12];
+            let cipher=Aes256Gcm::new_from_slice(&key("invalid archive test password",&salt).unwrap()).unwrap();let ciphertext=cipher.encrypt(Nonce::from_slice(&nonce),plaintext.as_ref()).unwrap();
+            let mut bytes=HEADER.to_vec();bytes.extend(salt);bytes.extend(nonce);bytes.extend(ciphertext);
+            let source=root.join(format!("{index}.backup"));std::fs::write(&source,bytes).unwrap();let destination=root.join(format!("restore-{index}"));
+            assert!(restore(&destination,&source,"invalid archive test password").is_err());assert!(!destination.exists());
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn backup_roundtrip_rejects_wrong_password_and_nonempty_restore() {
+        let root=std::env::temp_dir().join(format!("swan-backup-{}",swan_protocol::random_token()));
+        let data=root.join("data");std::fs::create_dir_all(&data).unwrap();
+        let db=rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();db.execute_batch("CREATE TABLE evidence(value TEXT);INSERT INTO evidence VALUES('preserved');").unwrap();drop(db);
+        std::fs::write(data.join("profile-key.hex"),"key").unwrap();std::fs::write(data.join("setup-token.txt"),"token").unwrap();
+        let archive=root.join("backup.swan");export(&data,&archive,"long backup passphrase").unwrap();
+        assert!(restore(&root.join("wrong"),&archive,"different long password").is_err());
+        restore(&root.join("restored"),&archive,"long backup passphrase").unwrap();
+        let db=rusqlite::Connection::open(root.join("restored/management.sqlite3")).unwrap();
+        assert_eq!(db.query_row("SELECT value FROM evidence",[],|r|r.get::<_,String>(0)).unwrap(),"preserved");drop(db);
+        assert!(restore(&root.join("restored"),&archive,"long backup passphrase").is_err());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/product/management/src/backup_stream.rs b/product/management/src/backup_stream.rs
new file mode 100644
index 00000000000..30c154c430b
--- /dev/null
+++ b/product/management/src/backup_stream.rs
@@ -0,0 +1,350 @@
+//! Bounded-memory SWANBK2 envelope. Encryption is RustCrypto STREAM, not
+//! independent GCM messages: sequence and the mandatory last block authenticate
+//! ordering and completion. The plaintext ZIP only exists in private staging.
+use super::*;
+use aead::{stream::{DecryptorBE32, EncryptorBE32}, Payload};
+use std::{fs::{File, OpenOptions}, io::{BufReader, Seek}, path::PathBuf};
+
+pub(super) const HEADER: &[u8] = b"SWANBK2";
+pub(super) const LIMIT: u64 = 64 * 1024 * 1024 * 1024;
+const CHUNK: usize = 1024 * 1024;
+const TAG: usize = 16;
+
+fn private_file(path: &Path) -> Result<File> {
+    let mut options = OpenOptions::new();
+    options.create_new(true).read(true).write(true);
+    #[cfg(unix)] { use std::os::unix::fs::OpenOptionsExt; options.mode(0o600); }
+    Ok(options.open(path)?)
+}
+
+pub(super) fn protect_directory(path: &Path) -> Result<()> {
+    #[cfg(unix)] {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700))?;
+    }
+    #[cfg(windows)] {
+        let identity = std::process::Command::new("whoami.exe").args(["/user", "/fo", "csv", "/nh"]).output()?;
+        ensure!(identity.status.success(), "Cannot identify backup restore owner");
+        let identity = String::from_utf8_lossy(&identity.stdout);
+        let sid = identity.trim().rsplit(',').next().context("Missing restore owner SID")?.trim_matches('"');
+        ensure!(sid.starts_with("S-1-") && sid.bytes().all(|byte| byte == b'S' || byte == b'-' || byte.is_ascii_digit()), "Invalid restore owner SID");
+        let status = std::process::Command::new("icacls.exe").arg(path)
+            .args(["/inheritance:r", "/grant:r"]).arg(format!("*{sid}:(OI)(CI)F"))
+            .args(["*S-1-5-18:(OI)(CI)F", "*S-1-5-32-544:(OI)(CI)F"]).output()?;
+        ensure!(status.status.success(), "Cannot protect backup staging and restored company keys");
+    }
+    Ok(())
+}
+
+pub(super) struct Staging(pub(super) PathBuf);
+impl Staging {
+    pub(super) fn new(parent: &Path) -> Result<Self> {
+        let path = parent.join(format!(".swan-backup-{}", swan_protocol::random_token()));
+        let mut builder = std::fs::DirBuilder::new();
+        #[cfg(unix)] { use std::os::unix::fs::DirBuilderExt; builder.mode(0o700); }
+        builder.create(&path)?;
+        let staging = Self(path);
+        protect_directory(&staging.0)?;
+        Ok(staging)
+    }
+    fn cleanup(self) -> Result<()> {
+        std::fs::remove_dir_all(&self.0).context("Remove private backup staging")
+    }
+}
+impl Drop for Staging {
+    fn drop(&mut self) {
+        if let Err(error) = std::fs::remove_dir_all(&self.0) {
+            if error.kind() != std::io::ErrorKind::NotFound {
+                eprintln!("Cannot remove private backup staging: {error}");
+            }
+        }
+    }
+}
+
+// Fill the buffer even when the underlying reader returns short reads.
+fn read_block(reader: &mut impl Read, buffer: &mut [u8]) -> Result<usize> {
+    let mut count = 0;
+    while count < buffer.len() {
+        match reader.read(&mut buffer[count..]) {
+            Ok(0) => break,
+            Ok(read) => count += read,
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => continue,
+            Err(error) => return Err(error.into()),
+        }
+    }
+    Ok(count)
+}
+
+fn encrypt(input: &mut impl Read, output: &mut impl Write, password: &str) -> Result<()> {
+    let mut salt = [0u8; 16];
+    let mut nonce = [0u8; 7];
+    rand::rngs::OsRng.fill_bytes(&mut salt);
+    rand::rngs::OsRng.fill_bytes(&mut nonce);
+    let mut header = HEADER.to_vec(); header.extend(salt); header.extend(nonce);
+    let cipher = Aes256Gcm::new_from_slice(&key(password, &salt)?).map_err(|_| anyhow::anyhow!("Invalid backup encryption key"))?;
+    let mut stream = EncryptorBE32::from_aead(cipher, (&nonce).into());
+    output.write_all(&header)?;
+    let mut buffer = vec![0; CHUNK];
+    let mut total = 0u64;
+    loop {
+        let count = read_block(input, &mut buffer)?;
+        total = total.checked_add(count as u64).context("Backup size overflow")?;
+        ensure!(total <= LIMIT + 128 * 1024 * 1024, "Backup archive exceeds size limit");
+        let payload = Payload { msg: &buffer[..count], aad: &header };
+        if count < CHUNK {
+            let encrypted = stream.encrypt_last(payload).map_err(|_| anyhow::anyhow!("Backup encryption failed"))?;
+            output.write_all(&encrypted)?;
+            return Ok(());
+        }
+        let encrypted = stream.encrypt_next(payload).map_err(|_| anyhow::anyhow!("Backup encryption failed"))?;
+        output.write_all(&encrypted)?;
+    }
+}
+
+fn decrypt(input: &mut impl Read, output: &mut impl Write, password: &str) -> Result<()> {
+    let mut header = [0u8; 30];
+    input.read_exact(&mut header)?;
+    ensure!(header.starts_with(HEADER), "Invalid backup format");
+    let cipher = Aes256Gcm::new_from_slice(&key(password, &header[7..23])?).map_err(|_| anyhow::anyhow!("Invalid decryption key"))?;
+    let mut stream = DecryptorBE32::from_aead(cipher, header[23..30].into());
+    let mut buffer = vec![0; CHUNK + TAG];
+    let mut total = 0u64;
+    loop {
+        let count = read_block(input, &mut buffer)?;
+        ensure!(count >= TAG, "Backup truncated: missing authenticated final block");
+        total = total.checked_add((count - TAG) as u64).context("Backup size overflow")?;
+        ensure!(total <= LIMIT + 128 * 1024 * 1024, "Backup archive exceeds size limit");
+        let payload = Payload { msg: &buffer[..count], aad: &header };
+        if count < buffer.len() {
+            let plaintext = stream.decrypt_last(payload).map_err(|_| anyhow::anyhow!("Backup password incorrect or backup modified"))?;
+            output.write_all(&plaintext)?;
+            return Ok(());
+        }
+        let plaintext = stream.decrypt_next(payload).map_err(|_| anyhow::anyhow!("Backup password incorrect or backup modified"))?;
+        output.write_all(&plaintext)?;
+    }
+}
+
+pub(super) fn export(data: &Path, files: Vec<(String, PathBuf)>, destination: &Path, password: &str) -> Result<()> {
+    let staging = Staging::new(data)?;
+    let result = (|| -> Result<()> {
+        let file = private_file(&staging.0.join("archive.zip"))?;
+        let mut archive = zip::ZipWriter::new(file);
+        let options = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+        let mut total = 0u64;
+        for (name, path) in files {
+            let metadata = std::fs::symlink_metadata(&path)?;
+            ensure!(metadata.is_file() && !metadata.file_type().is_symlink(), "Backup source must be a regular file");
+            #[cfg(windows)] { use std::os::windows::fs::MetadataExt; ensure!(metadata.file_attributes() & 0x400 == 0, "Backup source must not be a reparse point"); }
+            total = total.checked_add(metadata.len()).context("Backup size overflow")?;
+            ensure!(total <= LIMIT, "Backup contents exceed 64 GiB");
+            archive.start_file(name, options)?;
+            let mut input = File::open(&path)?.take(metadata.len() + 1);
+            ensure!(std::io::copy(&mut input, &mut archive)? == metadata.len(), "Backup source changed during export; stop writes before export");
+        }
+        let mut file = archive.finish()?;
+        file.rewind()?;
+        // create_new is also the overwrite guard; remove only our own incomplete output.
+        let mut output = private_file(destination)?;
+        let encrypted = encrypt(&mut file, &mut output, password).and_then(|_| Ok(output.sync_all()?));
+        drop(output);
+        if encrypted.is_err() { std::fs::remove_file(destination).context("Remove incomplete encrypted backup")?; }
+        encrypted
+    })();
+    staging.cleanup()?;
+    result
+}
+
+pub(super) fn restore(data: &Path, source: &Path, password: &str) -> Result<()> {
+    ensure!(std::fs::metadata(source)?.len() <= LIMIT + 132 * 1024 * 1024, "Backup exceeds size limit");
+    let parent = data.parent().filter(|path| !path.as_os_str().is_empty()).unwrap_or(Path::new("."));
+    let staging = Staging::new(parent)?;
+    let result = (|| -> Result<()> {
+        let mut file = private_file(&staging.0.join("archive.zip"))?;
+        decrypt(&mut BufReader::new(File::open(source)?), &mut file, password)?;
+        file.rewind()?;
+        let mut archive = zip::ZipArchive::new(file)?;
+        super::restore_archive(data, &mut archive, LIMIT)
+    })();
+    staging.cleanup()?;
+    result
+}
+
+pub(super) fn extract<R: Read + Seek>(data: &Path, archive: &mut zip::ZipArchive<R>, names: std::collections::HashSet<String>) -> Result<()> {
+    let parent = data.parent().filter(|path| !path.as_os_str().is_empty()).unwrap_or(Path::new("."));
+    let staging = Staging::new(parent)?;
+    let result = (|| -> Result<()> {
+        let payload = staging.0.join("restored");
+        std::fs::create_dir(&payload)?;
+        protect_directory(&payload)?;
+        for name in names {
+            let mut entry = archive.by_name(&name)?;
+            let expected = entry.size();
+            let path = payload.join(name);
+            if let Some(parent) = path.parent() { std::fs::create_dir_all(parent)?; }
+            let mut file = private_file(&path)?;
+            ensure!(std::io::copy(&mut entry.by_ref().take(expected + 1), &mut file)? == expected, "Backup entry size mismatch");
+            file.sync_all()?;
+        }
+        // Only a completely authenticated, validated and successfully extracted
+        // backup is published. Preserve an existing target on every earlier failure.
+        super::empty_target(data)?;
+        if data.exists() { std::fs::remove_dir(data)?; }
+        std::fs::rename(&payload, data).context("Publish verified backup restore")?;
+        Ok(())
+    })();
+    staging.cleanup()?;
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sha2::{Digest, Sha256};
+
+    fn fixture() -> (PathBuf, PathBuf) {
+        let root = std::env::temp_dir().join(format!("swan-stream-test-{}", swan_protocol::random_token()));
+        let data = root.join("data"); std::fs::create_dir_all(&data).unwrap();
+        let db = rusqlite::Connection::open(data.join("management.sqlite3")).unwrap();
+        db.execute_batch("CREATE TABLE identity(value TEXT); INSERT INTO identity VALUES('retained identity');").unwrap();
+        drop(db);
+        std::fs::write(data.join("profile-key.hex"), b"fixture signing key").unwrap();
+        std::fs::write(data.join("setup-token.txt"), b"fixture setup token").unwrap();
+        (root, data)
+    }
+
+    #[test]
+    fn stream_authenticates_order_finality_header_and_chunk_boundaries() {
+        let password = "stream encryption test password";
+        for size in [0, 1, CHUNK - 1, CHUNK, CHUNK + 1, 2 * CHUNK + 333] {
+            let mut plaintext = vec![0; size]; rand::rngs::OsRng.fill_bytes(&mut plaintext);
+            let mut encrypted = Vec::new(); encrypt(&mut plaintext.as_slice(), &mut encrypted, password).unwrap();
+            let mut restored = Vec::new(); decrypt(&mut encrypted.as_slice(), &mut restored, password).unwrap();
+            assert_eq!(restored, plaintext);
+            assert!(decrypt(&mut encrypted.as_slice(), &mut Vec::new(), "different test password").is_err());
+            let mut truncated = encrypted.clone(); truncated.pop();
+            assert!(decrypt(&mut truncated.as_slice(), &mut Vec::new(), password).is_err());
+            let mut modified = encrypted.clone(); let last = modified.len() - 1; modified[last] ^= 1;
+            assert!(decrypt(&mut modified.as_slice(), &mut Vec::new(), password).is_err());
+            let mut changed_header = encrypted.clone(); changed_header[23] ^= 1;
+            assert!(decrypt(&mut changed_header.as_slice(), &mut Vec::new(), password).is_err());
+            let mut appended = encrypted.clone(); appended.extend_from_slice(&[0; 16]);
+            assert!(decrypt(&mut appended.as_slice(), &mut Vec::new(), password).is_err());
+            if size >= CHUNK {
+                let boundary = 30 + CHUNK + TAG;
+                let mut truncated = &encrypted[..boundary];
+                assert!(decrypt(&mut truncated, &mut Vec::new(), password).is_err(), "A complete next block must not substitute for finality");
+            }
+            if size >= 2 * CHUNK {
+                let block = CHUNK + TAG;
+                let mut reordered = encrypted.clone();
+                for index in 0..block { reordered.swap(30 + index, 30 + block + index); }
+                assert!(decrypt(&mut reordered.as_slice(), &mut Vec::new(), password).is_err());
+                let mut deleted = encrypted.clone(); deleted.drain(30..30 + block);
+                assert!(decrypt(&mut deleted.as_slice(), &mut Vec::new(), password).is_err());
+            }
+        }
+        struct ShortRead<'a>(&'a [u8]);
+        impl Read for ShortRead<'_> {
+            fn read(&mut self, output: &mut [u8]) -> std::io::Result<usize> {
+                let count = output.len().min(511).min(self.0.len());
+                output[..count].copy_from_slice(&self.0[..count]); self.0 = &self.0[count..]; Ok(count)
+            }
+        }
+        let bytes = vec![42; CHUNK + 31]; let mut encrypted = Vec::new();
+        encrypt(&mut ShortRead(&bytes), &mut encrypted, password).unwrap();
+        let mut restored = Vec::new(); decrypt(&mut ShortRead(&encrypted), &mut restored, password).unwrap();
+        assert_eq!(bytes, restored);
+    }
+
+    #[test]
+    fn legacy_backup_restores_and_new_export_never_overwrites() {
+        let (root, data) = fixture();
+        let mut archive = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        for name in ["management.sqlite3", "profile-key.hex", "setup-token.txt"] {
+            archive.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+            archive.write_all(&std::fs::read(data.join(name)).unwrap()).unwrap();
+        }
+        let plaintext = archive.finish().unwrap().into_inner();
+        let salt = [1u8; 16]; let nonce = [2u8; 12]; let password = "legacy compatibility test password";
+        let cipher = Aes256Gcm::new_from_slice(&key(password, &salt).unwrap()).unwrap();
+        let mut bytes = super::super::HEADER.to_vec(); bytes.extend(salt); bytes.extend(nonce);
+        bytes.extend(cipher.encrypt(Nonce::from_slice(&nonce), plaintext.as_ref()).unwrap());
+        let source = root.join("legacy.backup"); std::fs::write(&source, &bytes).unwrap();
+        super::super::restore(&root.join("restored"), &source, password).unwrap();
+        assert_eq!(std::fs::read(root.join("restored/profile-key.hex")).unwrap(), b"fixture signing key");
+        assert!(super::super::export(&data, &source, password).is_err());
+        assert_eq!(std::fs::read(&source).unwrap(), bytes);
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn authenticated_but_invalid_zip_never_publishes_or_leaves_plaintext_staging() {
+        let (root, _) = fixture(); let password = "invalid zip test password";
+        for (index, invalid) in ["tls-storage/../outside", "unknown-secret"].into_iter().enumerate() {
+            let mut archive = zip::ZipWriter::new(Cursor::new(Vec::new()));
+            for name in ["management.sqlite3", "profile-key.hex", "setup-token.txt", invalid] {
+                archive.start_file(name, zip::write::SimpleFileOptions::default()).unwrap(); archive.write_all(b"fixture").unwrap();
+            }
+            let bytes = archive.finish().unwrap().into_inner(); let mut encrypted = Vec::new();
+            encrypt(&mut bytes.as_slice(), &mut encrypted, password).unwrap();
+            let source = root.join(format!("bad-{index}.backup")); std::fs::write(&source, encrypted).unwrap();
+            let destination = root.join(format!("restored-{index}"));
+            std::fs::create_dir(&destination).unwrap();
+            assert!(super::super::restore(&destination, &source, password).is_err());
+            assert!(std::fs::read_dir(&destination).unwrap().next().is_none());
+            assert!(std::fs::read_dir(&root).unwrap().all(|entry| !entry.unwrap().file_name().to_string_lossy().starts_with(".swan-backup-")));
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn crc_failure_during_extraction_preserves_target_and_failed_export_cleans_up() {
+        let (root, data) = fixture(); let password = "crc rejection test password";
+        let mut archive = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        for name in ["management.sqlite3", "profile-key.hex", "setup-token.txt"] {
+            archive.start_file(name, zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Stored)).unwrap();
+            archive.write_all(b"unique CRC payload fixture").unwrap();
+        }
+        let mut bytes = archive.finish().unwrap().into_inner();
+        let offset = bytes.windows(b"unique CRC payload fixture".len()).position(|part| part == b"unique CRC payload fixture").unwrap();
+        bytes[offset] ^= 1;
+        let mut encrypted = Vec::new(); encrypt(&mut bytes.as_slice(), &mut encrypted, password).unwrap();
+        let source = root.join("crc.backup"); std::fs::write(&source, encrypted).unwrap();
+        let target = root.join("target"); std::fs::create_dir(&target).unwrap();
+        assert!(super::super::restore(&target, &source, password).is_err());
+        assert!(std::fs::read_dir(&target).unwrap().next().is_none());
+        let failed = root.join("failed.backup");
+        assert!(super::super::export(&data, &failed, "short").is_err());
+        assert!(!failed.exists());
+        for directory in [&root, &data] {
+            assert!(std::fs::read_dir(directory).unwrap().all(|entry| {
+                let name = entry.unwrap().file_name(); let name = name.to_string_lossy();
+                !name.starts_with(".swan-backup-") && !name.starts_with("backup-")
+            }));
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    // Required explicitly by CI and suitable for a memory-limited local container.
+    // Separate from the default suite because it writes/restores >1 GiB on disk.
+    #[test]
+    #[ignore = "large backup qualification; run explicitly"]
+    fn backup_above_previous_limit_preserves_incompressible_artifact() {
+        let (root, data) = fixture(); let artifacts = data.join("artifacts"); std::fs::create_dir(&artifacts).unwrap();
+        let name = format!("{}.zip", uuid::Uuid::new_v4()); let mut file = File::create(artifacts.join(&name)).unwrap();
+        let mut buffer = vec![0; CHUNK]; let mut expected = Sha256::new();
+        for _ in 0..513 { rand::rngs::OsRng.fill_bytes(&mut buffer); file.write_all(&buffer).unwrap(); expected.update(&buffer); }
+        file.sync_all().unwrap(); drop(file);
+        let source = root.join("large.backup"); let password = "large backup qualification password";
+        super::super::export_deployment_with_artifacts(&data, &source, password, None, None, None, None, Some(&artifacts)).unwrap();
+        assert!(std::fs::metadata(&source).unwrap().len() > 512 * 1024 * 1024);
+        let target = root.join("restored"); super::super::restore(&target, &source, password).unwrap();
+        let mut file = File::open(target.join("artifacts").join(&name)).unwrap();
+        assert_eq!(file.metadata().unwrap().len(), 513 * 1024 * 1024);
+        let mut actual = Sha256::new(); loop { let count = file.read(&mut buffer).unwrap(); if count == 0 { break; } actual.update(&buffer[..count]); }
+        assert_eq!(expected.finalize(), actual.finalize()); drop(file);
+        assert_eq!(std::fs::read(target.join("profile-key.hex")).unwrap(), b"fixture signing key");
+        std::fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/product/management/src/components.rs b/product/management/src/components.rs
new file mode 100644
index 00000000000..5175403b000
--- /dev/null
+++ b/product/management/src/components.rs
@@ -0,0 +1,299 @@
+use anyhow::{Context, Result};
+use std::{ffi::OsString, future::Future, path::PathBuf, process::Stdio, time::Duration};
+use tokio::{process::{Child, Command}, sync::oneshot};
+
+pub(crate) struct Component {
+    name: &'static str,
+    executable: PathBuf,
+    arguments: Vec<OsString>,
+    directory: PathBuf,
+    environment: Vec<(OsString, OsString)>,
+    log: Option<std::fs::File>,
+    ready_key: Option<PathBuf>,
+}
+
+#[cfg(windows)]
+pub(crate) fn installed_specs() -> Result<Vec<Component>> {
+    use std::io::Read;
+    use sha2::{Digest, Sha256};
+    let host = std::env::var("SWAN_PUBLIC_HOST").context("Set company public hostname")?;
+    anyhow::ensure!(valid_hostname(&host), "Invalid company public hostname");
+    let executable = std::env::current_exe()?;
+    let packaged = executable.parent().context("Management install directory")?.join("components");
+    let data = PathBuf::from(std::env::var("SWAN_DATA_DIR").context("Set company data directory")?);
+    anyhow::ensure!(data.is_absolute(), "Company data directory must be absolute");
+    let transport = data.join("transport");
+    let database = transport_database_path(&transport, &legacy_transport_database()?)?;
+    let tls = data.join("tls");
+    let logs = data.join("logs");
+    for directory in [&transport, &tls, &logs] {std::fs::create_dir_all(directory)?;}
+    let config = data.join("Caddyfile");
+    anyhow::ensure!(config.is_file(), "Company HTTPS configuration missing");
+    let pins = [
+        ("hbbs", "2f3b865dea3e2439f732829e19562533044e7b83a050530e0c11341786b047be"),
+        ("hbbr", "97ead452f1c5484fa78d2d7f6b0954c116f32d00d0a6cdd045806806df124bc0"),
+        ("caddy", "586d4a4cd74bdfd2951b6b81766a32904ffa69c4f1c3d521da3870a2120f1d31"),
+    ];
+    let mut result = Vec::new();
+    for (name, expected) in pins {
+        let binary = packaged.join(format!("{name}.exe"));
+        anyhow::ensure!(std::fs::symlink_metadata(&binary)?.is_file(), "Component must be a regular file");
+        let mut input = std::fs::File::open(&binary)?;
+        let mut hash = Sha256::new();
+        let mut buffer = [0u8; 65536];
+        loop {let count=input.read(&mut buffer)?;if count==0 {break;}hash.update(&buffer[..count]);}
+        anyhow::ensure!(hex::encode(hash.finalize())==expected, "Packaged {name} hash mismatch");
+        let (arguments, directory, environment, ready_key) = match name {
+            "hbbs" => (vec!["-r".into(), format!("{host}:21117").into(), "-k".into(), "_".into()], transport.clone(), vec![("DB_URL".into(), database.clone().into_os_string())], Some(transport.join("id_ed25519.pub"))),
+            "hbbr" => (vec!["-k".into(), "_".into()], transport.clone(), vec![], None),
+            _ => (vec!["run".into(), "--config".into(), config.as_os_str().to_owned(), "--adapter".into(), "caddyfile".into()], data.clone(),
+                  vec![("XDG_DATA_HOME".into(), tls.clone().into_os_string()), ("XDG_CONFIG_HOME".into(), data.join("proxy-config").into_os_string())], None),
+        };
+        let log = std::fs::OpenOptions::new().create(true).append(true).open(logs.join(format!("{name}.log")))?;
+        result.push(Component{name, executable:binary, arguments, directory, environment, log:Some(log), ready_key});
+    }
+    Ok(result)
+}
+
+#[cfg(windows)]
+pub(crate) fn legacy_transport_database() -> Result<PathBuf> {
+    let root=PathBuf::from(std::env::var_os("SystemRoot").context("Windows system root is unavailable")?);
+    anyhow::ensure!(root.is_absolute(),"Windows system root must be absolute");
+    Ok(root.join("ServiceProfiles/LocalService/AppData/Roaming/RustDesk/config/db_v2.sqlite3"))
+}
+
+pub(crate) fn transport_database_path(directory:&std::path::Path,legacy:&std::path::Path)->Result<PathBuf> {
+    let target=directory.join("db_v2.sqlite3");
+    match std::fs::symlink_metadata(&target) {
+        Ok(metadata)=>{
+            anyhow::ensure!(metadata.is_file() && !metadata.file_type().is_symlink(),"Managed transport database must be a regular file");
+            #[cfg(windows)] {use std::os::windows::fs::MetadataExt;anyhow::ensure!(metadata.file_attributes()&0x400==0,"Managed transport database must not be a reparse point");}
+        },
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{
+            match std::fs::symlink_metadata(legacy) {
+                Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{},
+                Err(error)=>return Err(error).context("Inspect legacy transport database before startup or backup"),
+                Ok(_)=>anyhow::bail!("Legacy Windows transport database is outside company storage. Stop the company and rendezvous services, back up the original database and keys, then run swan-management migrate-transport-database SOURCE_DIRECTORY with SWAN_DATA_DIR set to this company. No empty replacement database will be started or backed up."),
+            }
+        },
+        Err(error)=>return Err(error).context("Inspect managed transport database"),
+    }
+    Ok(target)
+}
+
+fn valid_hostname(host: &str) -> bool {
+    host.len()<=253 && host.contains('.') && host.split('.').all(|label|
+        !label.is_empty() && label.len()<=63 && !label.starts_with('-') && !label.ends_with('-') &&
+        label.bytes().all(|byte|byte.is_ascii_alphanumeric() || byte==b'-'))
+}
+
+#[cfg(windows)]
+struct ProcessJob(std::os::windows::io::OwnedHandle);
+#[cfg(windows)]
+impl ProcessJob {
+    fn new() -> Result<Self> {
+        use std::os::windows::io::{AsRawHandle, FromRawHandle, OwnedHandle};
+        use windows_sys::Win32::System::JobObjects::*;
+        // An unnamed, non-inheritable job owns only children launched here.
+        let raw=unsafe {CreateJobObjectW(std::ptr::null(), std::ptr::null())};
+        anyhow::ensure!(!raw.is_null(), "Create component process job: {}", std::io::Error::last_os_error());
+        let handle=unsafe {OwnedHandle::from_raw_handle(raw)};
+        let mut limits:JOBOBJECT_EXTENDED_LIMIT_INFORMATION=unsafe {std::mem::zeroed()};
+        limits.BasicLimitInformation.LimitFlags=JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+        let set=unsafe {SetInformationJobObject(handle.as_raw_handle(),JobObjectExtendedLimitInformation,
+            &limits as *const _ as *const _,std::mem::size_of_val(&limits) as u32)};
+        anyhow::ensure!(set!=0, "Configure component process job: {}", std::io::Error::last_os_error());
+        Ok(Self(handle))
+    }
+    fn attach(&self, child: &Child) -> Result<()> {
+        use std::os::windows::io::AsRawHandle;
+        let handle=child.raw_handle().context("Component exited before job assignment")?;
+        let assigned=unsafe {windows_sys::Win32::System::JobObjects::AssignProcessToJobObject(self.0.as_raw_handle(),handle)};
+        anyhow::ensure!(assigned!=0,"Assign component process job: {}",std::io::Error::last_os_error());
+        Ok(())
+    }
+}
+
+async fn stop_children(children: &mut [(&'static str, Child)]) -> Result<()> {
+    let mut failure = None;
+    for (name, child) in children {
+        let outcome = async {
+            if child.try_wait()?.is_none() {child.start_kill()?;}
+            tokio::time::timeout(Duration::from_secs(10), child.wait()).await??;
+            Ok::<_, anyhow::Error>(())
+        }.await;
+        if let Err(error)=outcome {failure=Some(error.context(format!("Stop {name}")));}
+    }
+    match failure {Some(error)=>Err(error),None=>Ok(())}
+}
+
+pub(crate) async fn supervise<F, Fut>(specs: Vec<Component>, mut stop: oneshot::Receiver<()>, run: F) -> Result<()>
+where F: FnOnce(oneshot::Receiver<()>) -> Fut, Fut: Future<Output=Result<()>> {
+    #[cfg(windows)]
+    let job=ProcessJob::new()?;
+    let mut children = Vec::new();
+    let startup = async {
+        for spec in specs {
+            let mut command=Command::new(&spec.executable);
+            command.args(&spec.arguments).current_dir(&spec.directory).envs(spec.environment)
+                .stdin(Stdio::null()).kill_on_drop(true);
+            #[cfg(windows)]
+            command.creation_flags(0x08000000); // CREATE_NO_WINDOW
+            if let Some(log)=spec.log {command.stderr(log.try_clone()?).stdout(log);}else{command.stderr(Stdio::null()).stdout(Stdio::null());}
+            let child=command.spawn().with_context(||format!("Start {}",spec.name))?;
+            children.push((spec.name,child));
+            #[cfg(windows)]
+            job.attach(&children.last().context("Started component missing")?.1)?;
+            if let Some(key)=spec.ready_key {
+                use base64::Engine;
+                let deadline=tokio::time::Instant::now()+Duration::from_secs(30);
+                loop {
+                    if let Ok(value)=tokio::fs::read_to_string(&key).await {
+                        if base64::engine::general_purpose::STANDARD.decode(value.trim()).is_ok_and(|value|value.len()==32) {break;}
+                    }
+                    if children.last_mut().context("Started component missing")?.1.try_wait()?.is_some() {anyhow::bail!("Component exited before transport key became ready");}
+                    anyhow::ensure!(tokio::time::Instant::now()<deadline,"Transport key readiness timed out");
+                    tokio::select! {_=&mut stop=>anyhow::bail!("Service stopped during component startup"),_=tokio::time::sleep(Duration::from_millis(100))=>{}}
+                }
+            }
+        }
+        Ok::<_,anyhow::Error>(())
+    }.await;
+    if let Err(error)=startup {stop_children(&mut children).await?;return Err(error);}
+    let (shutdown, receiver)=oneshot::channel();
+    let server=run(receiver);
+    tokio::pin!(server);
+    let mut monitor=tokio::time::interval(Duration::from_millis(200));
+    let mut server_finished=false;
+    let outcome=loop {
+        tokio::select! {
+            result=&mut server=>{server_finished=true;break result;},
+            _=&mut stop=>break Ok(()),
+            _=monitor.tick()=>{
+                let mut failure=None;
+                for (name,child) in &mut children {
+                    match child.try_wait() {
+                        Ok(Some(status))=>{failure=Some(anyhow::anyhow!("Component {name} exited: {status}"));break;},
+                        Err(error)=>{failure=Some(error.into());break;},
+                        Ok(None)=>{},
+                    }
+                }
+                if let Some(error)=failure {break Err(error);}
+            }
+        }
+    };
+    let _=shutdown.send(());
+    let server_stop=if server_finished {Ok(())}else{
+        match tokio::time::timeout(Duration::from_secs(10),&mut server).await {
+            Ok(result)=>result,Err(error)=>Err(anyhow::Error::from(error).context("Management shutdown timed out")),
+        }
+    };
+    let cleanup=stop_children(&mut children).await;
+    outcome.and(server_stop).and(cleanup)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn legacy_transport_database_requires_explicit_migration() {
+        let root=std::env::temp_dir().join(format!("swan-transport-path-{}",uuid::Uuid::new_v4()));
+        std::fs::create_dir(&root).unwrap();
+        let managed=root.join("company");std::fs::create_dir(&managed).unwrap();let legacy=root.join("legacy.sqlite3");
+        assert_eq!(transport_database_path(&managed,&legacy).unwrap(),managed.join("db_v2.sqlite3"));
+        std::fs::write(&legacy,b"original database").unwrap();
+        assert!(transport_database_path(&managed,&legacy).is_err());
+        std::fs::write(managed.join("db_v2.sqlite3"),b"migrated database").unwrap();
+        assert_eq!(transport_database_path(&managed,&legacy).unwrap(),managed.join("db_v2.sqlite3"));
+        assert_eq!(std::fs::read(&legacy).unwrap(),b"original database");
+        std::fs::remove_file(managed.join("db_v2.sqlite3")).unwrap();std::fs::create_dir(managed.join("db_v2.sqlite3")).unwrap();
+        assert!(transport_database_path(&managed,&legacy).is_err());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+    #[test]
+    fn rejects_host_configuration_injection() {
+        for host in ["localhost", "example.com\n}", "example.com:443", "example.com/path", "-bad.example", "a..example", "example.com;cmd"] {assert!(!valid_hostname(host));}
+        assert!(valid_hostname("support.example.com"));
+    }
+    #[test]
+    #[ignore = "child fixture invoked by supervision tests"]
+    fn child_fixture() {
+        if std::env::var("SWAN_COMPONENT_FIXTURE").as_deref()==Ok("wait") {std::thread::sleep(Duration::from_secs(60));}
+    }
+    fn fixture(wait: bool) -> Component {
+        Component{name:"fixture", executable:std::env::current_exe().unwrap(),
+            arguments:vec!["--exact".into(), "components::tests::child_fixture".into(), "--ignored".into()],
+            directory:std::env::current_dir().unwrap(), environment:vec![("SWAN_COMPONENT_FIXTURE".into(),if wait {"wait"}else{"exit"}.into())],log:None,ready_key:None}
+    }
+    #[tokio::test]
+    async fn service_stop_reaps_components() {
+        let (stop,receiver)=oneshot::channel();
+        let result=supervise(vec![fixture(true)],receiver,|shutdown|async {let _=stop.send(());let _=shutdown.await;Ok(())}).await;
+        assert!(result.is_ok(),"{result:?}");
+    }
+    #[tokio::test]
+    async fn component_exit_stops_management() {
+        let (_stop,receiver)=oneshot::channel();
+        let result=supervise(vec![fixture(false)],receiver,|shutdown|async {shutdown.await?;Ok(())}).await;
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("Component fixture exited"));
+    }
+    #[tokio::test]
+    async fn partial_start_failure_reaps_started_components() {
+        let (_stop,receiver)=oneshot::channel();
+        let mut missing=fixture(false);missing.executable=std::env::temp_dir().join(format!("missing-swan-component-{}",uuid::Uuid::new_v4()));
+        let result=supervise(vec![fixture(true),missing],receiver,|_|async {panic!("Management started despite component failure")}).await;
+        assert!(result.is_err());
+    }
+    #[cfg(windows)]
+    #[test]
+    #[ignore = "process-owner fixture invoked by crash containment test"]
+    fn job_owner_fixture() {
+        let pid_file=PathBuf::from(std::env::var_os("SWAN_JOB_PID_FILE").unwrap());
+        let runtime=tokio::runtime::Runtime::new().unwrap();
+        runtime.block_on(async {
+            let job=ProcessJob::new().unwrap();
+            let child=Command::new(std::env::current_exe().unwrap())
+                .args(["--exact","components::tests::child_fixture","--ignored"])
+                .env("SWAN_COMPONENT_FIXTURE","wait").stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()).spawn().unwrap();
+            job.attach(&child).unwrap();
+            let temporary=pid_file.with_extension("tmp");
+            std::fs::write(&temporary,child.id().unwrap().to_string()).unwrap();
+            std::fs::rename(temporary,&pid_file).unwrap();
+            tokio::time::sleep(Duration::from_secs(60)).await;
+            drop(job);
+        });
+    }
+    #[cfg(windows)]
+    #[test]
+    fn process_owner_crash_terminates_children() {
+        use std::os::windows::io::{AsRawHandle,FromRawHandle,OwnedHandle};
+        use windows_sys::Win32::System::Threading::{OpenProcess,GetExitCodeProcess,PROCESS_QUERY_LIMITED_INFORMATION};
+        let directory=std::env::temp_dir().join(format!("swan-job-test-{}",uuid::Uuid::new_v4()));
+        std::fs::create_dir(&directory).unwrap();
+        let pid_file=directory.join("pid");
+        let mut owner=std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact","components::tests::job_owner_fixture","--ignored"])
+            .env("SWAN_JOB_PID_FILE",&pid_file).stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()).spawn().unwrap();
+        let deadline=std::time::Instant::now()+Duration::from_secs(10);
+        while !pid_file.is_file() {
+            if std::time::Instant::now()>=deadline {let _=owner.kill();let _=owner.wait();panic!("Job owner did not report child");}
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        let pid=std::fs::read_to_string(&pid_file).unwrap().parse::<u32>().unwrap();
+        let raw=unsafe {OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,0,pid)};
+        let open=!raw.is_null();
+        let child=if open {Some(unsafe {OwnedHandle::from_raw_handle(raw)})}else{None};
+        owner.kill().unwrap();owner.wait().unwrap();
+        assert!(open,"Cannot observe supervised child");
+        let child=child.unwrap();
+        loop {
+            let mut exit=259;
+            assert_ne!(unsafe {GetExitCodeProcess(child.as_raw_handle(),&mut exit)},0);
+            if exit!=259 {break;}
+            assert!(std::time::Instant::now()<deadline,"Child survived owner crash");
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        std::fs::remove_file(pid_file).unwrap();std::fs::remove_dir(directory).unwrap();
+    }
+}
diff --git a/product/management/src/installation_reporting.rs b/product/management/src/installation_reporting.rs
new file mode 100644
index 00000000000..240bc39cd04
--- /dev/null
+++ b/product/management/src/installation_reporting.rs
@@ -0,0 +1,226 @@
+use super::*;
+
+#[derive(Default, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Page { #[serde(default)] offset: u64 }
+
+fn owner(s: &Store, headers: &HeaderMap, identity: &InstallationIdentity) -> Result<String, ApiError> {
+    match identity.edition {
+        Edition::Customer => {
+            let device = s.device(headers)?;
+            if identity.installation_id != device { return Err(denied()); }
+            Ok(device)
+        }
+        Edition::Technician => s.user(headers, false),
+    }
+}
+fn kind(edition: &Edition) -> &'static str {
+    match edition { Edition::Customer => "customer", Edition::Technician => "technician" }
+}
+async fn blocking(task: impl FnOnce() -> ApiResult + Send + 'static) -> ApiResult {
+    tokio::task::spawn_blocking(task).await.map_err(|_| ApiError(StatusCode::INTERNAL_SERVER_ERROR, "Installation reporting unavailable"))?
+}
+
+pub(super) async fn report(State(s): State<Shared>, headers: HeaderMap, Json(input): Json<InstallationReport>) -> ApiResult {
+    input.validate().map_err(|_| bad("Invalid installation report"))?;
+    blocking(move || {
+        let actor = owner(&s, &headers, &input.identity)?;
+        s.rate(&format!("installation-actor:{actor}"), 240)?;
+        s.rate(&format!("installation:{actor}:{}", input.identity.installation_id), 60)?;
+        let body = serde_json::to_string(&input)?;
+        let hash = digest(token(&headers)?);
+        let mut db = s.db.lock().unwrap();
+        let tx = db.transaction()?;
+        // Recheck inside the write transaction: revocation/disable/logout must
+        // not race the earlier ownership lookup.
+        let active: bool = match input.identity.edition {
+            Edition::Customer => tx.query_row("SELECT EXISTS(SELECT 1 FROM devices WHERE id=?1 AND token_hash=?2 AND state='approved')", params![actor, hash], |row| row.get(0))?,
+            Edition::Technician => tx.query_row("SELECT EXISTS(SELECT 1 FROM sessions s JOIN users u ON u.id=s.user_id WHERE u.id=?1 AND s.token_hash=?2 AND s.expires_at>?3 AND u.disabled=0)", params![actor, hash, now()], |row| row.get(0))?,
+        };
+        if !active { return Err(unauthorized()); }
+        let previous: Option<(u64, String)> = tx.query_row("SELECT revision,body FROM installation_reports WHERE owner_kind=?1 AND owner_id=?2 AND installation_id=?3", params![kind(&input.identity.edition), actor, input.identity.installation_id], |row| Ok((row.get(0)?, row.get(1)?))).optional()?;
+        if let Some((revision, old)) = &previous {
+            if input.revision < *revision || (input.revision == *revision && old != &body) {
+                return Err(ApiError(StatusCode::CONFLICT, "Installation report superseded"));
+            }
+            if input.revision == *revision {
+                // Replaying the same message does not refresh its last-seen time.
+                return Ok(Json(json!({"accepted":true,"revision":revision})));
+            }
+        }
+        tx.execute("INSERT INTO installation_reports(owner_kind,owner_id,installation_id,revision,received_at,body) VALUES(?1,?2,?3,?4,?5,?6) ON CONFLICT(owner_kind,owner_id,installation_id) DO UPDATE SET revision=excluded.revision,received_at=excluded.received_at,body=excluded.body", params![kind(&input.identity.edition), actor, input.identity.installation_id, input.revision, now(), body])?;
+        tx.commit()?;
+        // This diagnostic never changes a device, permission, release or grant.
+        Ok(Json(json!({"accepted":true,"revision":input.revision})))
+    }).await
+}
+
+pub(super) async fn own_report(State(s): State<Shared>, headers: HeaderMap, Query(identity): Query<InstallationIdentity>) -> ApiResult {
+    identity.validate().map_err(|_| bad("Invalid installation identity"))?;
+    blocking(move || {
+        let actor = owner(&s, &headers, &identity)?;
+        let row: Option<(u64, u64, String)> = s.db.lock().unwrap().query_row("SELECT revision,received_at,body FROM installation_reports WHERE owner_kind=?1 AND owner_id=?2 AND installation_id=?3", params![kind(&identity.edition), actor, identity.installation_id], |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?))).optional()?;
+        Ok(Json(match row {
+            Some((revision, received, body)) => json!({"revision":revision,"received_at":received,"report":serde_json::from_str::<InstallationReport>(&body)?}),
+            None => Value::Null,
+        }))
+    }).await
+}
+
+pub(super) async fn reports(State(s): State<Shared>, headers: HeaderMap, Query(page): Query<Page>) -> ApiResult {
+    if page.offset > i64::MAX as u64 - 201 { return Err(bad("Invalid report page")); }
+    blocking(move || {
+        let actor = s.user(&headers, false)?;
+        s.rate(&format!("installation-list:{actor}"), 60)?;
+        let db = s.db.lock().unwrap();
+        let mut statement = db.prepare("SELECT r.owner_kind,r.owner_id,r.installation_id,r.received_at,r.body,COALESCE(d.name,u.username,'Unknown installation'),COALESCE(d.state,CASE WHEN u.disabled=0 THEN 'active' ELSE 'disabled' END) FROM installation_reports r LEFT JOIN devices d ON r.owner_kind='customer' AND d.id=r.owner_id LEFT JOIN users u ON r.owner_kind='technician' AND u.id=r.owner_id WHERE EXISTS(SELECT 1 FROM users a WHERE a.id=?1 AND a.role='admin') OR (r.owner_kind='technician' AND r.owner_id=?1) OR (r.owner_kind='customer' AND d.state='approved' AND EXISTS(SELECT 1 FROM group_access g WHERE g.group_id=d.group_id AND g.user_id=?1)) ORDER BY r.received_at DESC,r.owner_kind,r.owner_id,r.installation_id LIMIT 201 OFFSET ?2")?;
+        let rows = statement.query_map(params![actor, page.offset as i64], |row| Ok((row.get::<_,String>(0)?, row.get::<_,String>(1)?, row.get::<_,String>(2)?, row.get::<_,u64>(3)?, row.get::<_,String>(4)?, row.get::<_,String>(5)?, row.get::<_,String>(6)?)))?;
+        let mut reports = Vec::new();
+        for row in rows {
+            let (edition, owner, installation, received, body, name, state) = row?;
+            let report: InstallationReport = serde_json::from_str(&body)?;
+            reports.push(json!({"edition":edition,"owner_id":owner,"installation_id":installation,"owner_name":name,"owner_state":state,"received_at":received,"report":report}));
+        }
+        let next = if reports.len() > 200 { reports.truncate(200); Some(page.offset + 200) } else { None };
+        Ok(Json(json!({"reports":reports,"next_offset":next})))
+    }).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::{body::Body, http::Request};
+    use tower::ServiceExt;
+
+    async fn call(app: &Router, path: &str, method: &str, credential: Option<&str>, body: Value) -> (StatusCode, Value) {
+        let mut request = Request::builder().method(method).uri(path).header(header::CONTENT_TYPE, "application/json");
+        if let Some(credential) = credential { request = request.header(header::AUTHORIZATION, format!("Bearer {credential}")); }
+        let response = app.clone().oneshot(request.body(Body::from(body.to_string())).unwrap()).await.unwrap();
+        let status = response.status();
+        let bytes = axum::body::to_bytes(response.into_body(), 2 * 1024 * 1024).await.unwrap();
+        (status, serde_json::from_slice(&bytes).unwrap())
+    }
+    fn report(edition: Edition, id: &str) -> InstallationReport {
+        InstallationReport { schema: 1, identity: InstallationIdentity { edition, installation_id: id.into() }, revision: 1, installed_sequence: 9, installed_version: Some("1.5.7".into()), phase: UpdatePhase::Downloading, target_sequence: Some(10), downloaded_bytes: 25, total_bytes: Some(100) }
+    }
+
+    #[tokio::test]
+    async fn reports_are_owned_permission_filtered_and_never_authorize_sessions() {
+        let directory = std::env::temp_dir().join(format!("swan-installation-report-{}", random_token()));
+        let store = Arc::new(Store::open(&directory).unwrap());
+        let credentials: Vec<_> = (0..6).map(|_| random_token()).collect();
+        let device = "a0000000-0000-4000-8000-000000000001";
+        let other_device = "a0000000-0000-4000-8000-000000000002";
+        let installation = "b0000000-0000-4000-8000-000000000001";
+        {
+            let db = store.db.lock().unwrap();
+            for (index, role) in ["admin", "technician", "technician", "technician"].into_iter().enumerate() {
+                let user = format!("user-{index}");
+                db.execute("INSERT INTO users(id,username,password_hash,totp_secret,role) VALUES(?1,?1,'fixture','fixture',?2)", params![user, role]).unwrap();
+                db.execute("INSERT INTO sessions VALUES(?1,?2,?3)", params![digest(&credentials[index]), user, now() + 3600]).unwrap();
+            }
+            db.execute("INSERT INTO group_access VALUES('group-a','user-1')", []).unwrap();
+            for (index, id) in [device, other_device].into_iter().enumerate() {
+                db.execute("INSERT INTO devices(id,name,rustdesk_id,token_hash,state,group_id) VALUES(?1,?1,?2,?3,'approved',?4)", params![id, format!("peer-{index}"), digest(&credentials[index + 4]), if index == 0 { "group-a" } else { "group-b" }]).unwrap();
+            }
+        }
+        let app = router(store.clone());
+        let customer = report(Edition::Customer, device);
+        let technician = report(Edition::Technician, installation);
+        let path = "/api/v1/installations/report";
+        for (credential, body, expected) in [
+            (None, &customer, StatusCode::UNAUTHORIZED),
+            (Some(credentials[1].as_str()), &customer, StatusCode::UNAUTHORIZED),
+            (Some(credentials[4].as_str()), &technician, StatusCode::UNAUTHORIZED),
+            (Some(credentials[5].as_str()), &customer, StatusCode::FORBIDDEN),
+            (Some(credentials[4].as_str()), &customer, StatusCode::OK),
+            (Some(credentials[1].as_str()), &technician, StatusCode::OK),
+            (Some(credentials[2].as_str()), &technician, StatusCode::OK),
+        ] {
+            assert_eq!(call(&app, path, "POST", credential, serde_json::to_value(body).unwrap()).await.0, expected);
+        }
+        for (index, count) in [(0, 3), (1, 2), (2, 1), (3, 0)] {
+            let (status, rows) = call(&app, "/api/v1/installations", "GET", Some(&credentials[index]), Value::Null).await;
+            assert_eq!(status, StatusCode::OK); assert_eq!(rows["reports"].as_array().unwrap().len(), count);
+        }
+        let own = format!("{path}?edition=customer&installation_id={device}");
+        store.db.lock().unwrap().execute("UPDATE installation_reports SET received_at=1 WHERE owner_kind='customer'", []).unwrap();
+        assert_eq!(call(&app, path, "POST", Some(&credentials[4]), serde_json::to_value(&customer).unwrap()).await.0, StatusCode::OK);
+        assert_eq!(call(&app, &own, "GET", Some(&credentials[4]), Value::Null).await.1["received_at"], 1, "Replay must not claim a fresh heartbeat");
+        let mut newer = customer.clone(); newer.revision = 2; newer.downloaded_bytes = 50;
+        assert_eq!(call(&app, path, "POST", Some(&credentials[4]), serde_json::to_value(&newer).unwrap()).await.0, StatusCode::OK);
+        assert_eq!(call(&app, path, "POST", Some(&credentials[4]), serde_json::to_value(&customer).unwrap()).await.0, StatusCode::CONFLICT);
+        newer.downloaded_bytes = 51;
+        assert_eq!(call(&app, path, "POST", Some(&credentials[4]), serde_json::to_value(&newer).unwrap()).await.0, StatusCode::CONFLICT);
+        assert_eq!(call(&app, &format!("{path}?edition=technician&installation_id={installation}"), "GET", Some(&credentials[3]), Value::Null).await.1, Value::Null, "Other technicians cannot retrieve this installation report");
+        {
+            let db = store.db.lock().unwrap();
+            assert_eq!(db.query_row("SELECT COUNT(*) FROM grants", [], |row| row.get::<_,u64>(0)).unwrap(), 0);
+            assert!(!db.query_row("SELECT unattended FROM devices WHERE id=?1", [device], |row| row.get::<_,bool>(0)).unwrap());
+            db.execute("UPDATE devices SET state='revoked' WHERE id=?1", [device]).unwrap();
+            db.execute("UPDATE users SET disabled=1 WHERE id='user-1'", []).unwrap();
+        }
+        assert_eq!(call(&app, path, "POST", Some(&credentials[4]), serde_json::to_value(&customer).unwrap()).await.0, StatusCode::UNAUTHORIZED);
+        assert_eq!(call(&app, &own, "GET", Some(&credentials[4]), Value::Null).await.0, StatusCode::UNAUTHORIZED);
+        assert_eq!(call(&app, path, "POST", Some(&credentials[1]), serde_json::to_value(&technician).unwrap()).await.0, StatusCode::UNAUTHORIZED);
+        assert_eq!(call(&app, "/api/v1/installations", "GET", Some(&credentials[1]), Value::Null).await.0, StatusCode::UNAUTHORIZED);
+        store.db.lock().unwrap().execute("UPDATE devices SET state='pending' WHERE id=?1", [other_device]).unwrap();
+        assert_eq!(call(&app, path, "POST", Some(&credentials[5]), serde_json::to_value(report(Edition::Customer, other_device)).unwrap()).await.0, StatusCode::UNAUTHORIZED);
+        // Pagination fixtures use valid report rows in one transaction. They
+        // exercise the real HTTP reader, not receipt ingestion or remote MFA.
+        {
+            let mut db = store.db.lock().unwrap(); let tx = db.transaction().unwrap();
+            for _ in 0..210 {
+                let input = report(Edition::Technician, &Uuid::new_v4().to_string());
+                tx.execute("INSERT INTO installation_reports VALUES('technician','user-2',?1,1,?2,?3)", params![input.identity.installation_id, now(), serde_json::to_string(&input).unwrap()]).unwrap();
+            }
+            tx.commit().unwrap();
+        }
+        let first = call(&app, "/api/v1/installations", "GET", Some(&credentials[0]), Value::Null).await.1;
+        let second = call(&app, "/api/v1/installations?offset=200", "GET", Some(&credentials[0]), Value::Null).await.1;
+        assert_eq!(first["reports"].as_array().unwrap().len(), 200); assert_eq!(first["next_offset"], 200);
+        assert_eq!(second["reports"].as_array().unwrap().len(), 13); assert!(second["next_offset"].is_null());
+        let own_page = call(&app, "/api/v1/installations?offset=200", "GET", Some(&credentials[2]), Value::Null).await.1;
+        assert_eq!(own_page["reports"].as_array().unwrap().len(), 11);
+        assert_eq!(call(&app, "/api/v1/installations?offset=18446744073709551615", "GET", Some(&credentials[0]), Value::Null).await.0, StatusCode::BAD_REQUEST);
+        let foreign_directory = directory.with_extension("other-company");
+        let foreign_store = Arc::new(Store::open(&foreign_directory).unwrap()); let foreign_app = router(foreign_store.clone());
+        assert_eq!(call(&foreign_app, path, "POST", Some(&credentials[4]), serde_json::to_value(&customer).unwrap()).await.0, StatusCode::UNAUTHORIZED);
+        assert_eq!(foreign_store.db.lock().unwrap().query_row("SELECT COUNT(*) FROM installation_reports", [], |row| row.get::<_,u64>(0)).unwrap(), 0);
+        drop(foreign_app); drop(foreign_store); std::fs::remove_dir_all(foreign_directory).unwrap();
+        drop(app); drop(store); std::fs::remove_dir_all(directory).unwrap();
+    }
+
+    #[test]
+    fn schema_two_upgrade_requires_backup_and_restores_original_schema_and_keys() {
+        let directory = std::env::temp_dir().join(format!("swan-report-migration-{}", random_token()));
+        let original = Store::open(&directory).unwrap(); let public = original.key.verifying_key();
+        original.db.lock().unwrap().execute_batch("DROP TABLE installation_reports; PRAGMA user_version=2;").unwrap(); drop(original);
+        assert!(Store::open_with_backup_password(&directory, None).is_err());
+        let upgraded = Store::open_with_backup_password(&directory, Some("schema three backup fixture password")).unwrap();
+        assert_eq!(upgraded.key.verifying_key(), public);
+        assert_eq!(upgraded.db.lock().unwrap().pragma_query_value(None, "user_version", |row| row.get::<_,u32>(0)).unwrap(), 3);
+        let archive = std::fs::read_dir(&directory).unwrap().map(|entry| entry.unwrap().path()).find(|path| path.file_name().unwrap().to_string_lossy().starts_with("pre-upgrade-v2-")).unwrap();
+        drop(upgraded);
+        let restored = directory.with_extension("restored");
+        crate::backup::restore(&restored, &archive, "schema three backup fixture password").unwrap();
+        let db = Connection::open(restored.join("management.sqlite3")).unwrap();
+        assert_eq!(db.pragma_query_value(None, "user_version", |row| row.get::<_,u32>(0)).unwrap(), 2);
+        assert_eq!(db.query_row("SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='installation_reports'", [], |row| row.get::<_,u64>(0)).unwrap(), 0);
+        assert_eq!(std::fs::read(restored.join("profile-key.hex")).unwrap(), std::fs::read(directory.join("profile-key.hex")).unwrap());
+        drop(db); std::fs::remove_dir_all(directory).unwrap(); std::fs::remove_dir_all(restored).unwrap();
+    }
+
+    #[test]
+    fn failed_schema_upgrade_rolls_back_all_ddl() {
+        let directory = std::env::temp_dir().join(format!("swan-report-migration-failure-{}", random_token()));
+        let original = Store::open(&directory).unwrap();
+        original.db.lock().unwrap().execute_batch("DROP TABLE profile_signing_keys; DROP TABLE installation_reports; CREATE TABLE installation_reports(invalid TEXT); PRAGMA user_version=1;").unwrap();
+        drop(original);
+        assert!(Store::open_with_backup_password(&directory, Some("failed migration backup password")).is_err());
+        let db = Connection::open(directory.join("management.sqlite3")).unwrap();
+        assert_eq!(db.pragma_query_value(None, "user_version", |row| row.get::<_,u32>(0)).unwrap(), 1);
+        assert_eq!(db.query_row("SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='profile_signing_keys'", [], |row| row.get::<_,u64>(0)).unwrap(), 0, "DDL before the failing index must not partially migrate the database");
+        drop(db); std::fs::remove_dir_all(directory).unwrap();
+    }
+}
diff --git a/product/management/src/main.rs b/product/management/src/main.rs
new file mode 100644
index 00000000000..14f8d72ef66
--- /dev/null
+++ b/product/management/src/main.rs
@@ -0,0 +1,106 @@
+mod service;
+mod backup;
+mod network;
+mod network_probe;
+#[cfg(test)]
+mod tests;
+use anyhow::{Context, Result};
+use axum::Router;
+use service::Store;
+use std::{net::SocketAddr, path::PathBuf, sync::Arc};
+#[cfg(windows)]
+mod windows;
+#[cfg(any(windows, test))]
+mod components;
+
+fn main() -> Result<()> {
+    if std::env::args().nth(1).as_deref()==Some("migrate-transport-database") {
+        let args:Vec<String>=std::env::args().collect();
+        anyhow::ensure!(args.len()==3,"Usage: swan-management migrate-transport-database SOURCE_DIRECTORY");
+        let data=PathBuf::from(std::env::var_os("SWAN_DATA_DIR").context("Set SWAN_DATA_DIR to the existing company data directory")?);
+        backup::migrate_transport_database(&data,std::path::Path::new(&args[2]))?;
+        println!("Transport database migrated into company storage; original database and keys preserved. No services started.");
+        return Ok(());
+    }
+    #[cfg(windows)]
+    if std::env::args().nth(1).as_deref()==Some("prepare-server-directory") {
+        let args:Vec<String>=std::env::args().collect();
+        anyhow::ensure!(args.len()==3,"Usage: swan-management prepare-server-directory PATH");
+        swan_agent::update::prepare_server_directory(std::path::Path::new(&args[2]))?;
+        println!("Fresh private company state directory created; no server started.");
+        return Ok(());
+    }
+    #[cfg(windows)]
+    if std::env::args().nth(1).as_deref()==Some("check-components") {
+        components::installed_specs()?;
+        println!("Pinned company executables and hostname validated; HTTPS configuration found; no services started.");
+        return Ok(());
+    }
+    #[cfg(windows)]
+    if std::env::args().any(|a|a=="--service") {return windows::dispatch();}
+    if std::env::args().skip(1).collect::<Vec<_>>()==["check-network","--help"] {
+        println!("{}",network_probe::USAGE);return Ok(());
+    }
+    anyhow::ensure!(matches!(std::env::args().nth(1).as_deref(),None|Some("backup"|"restore"|"prepare-profile-key"|"activate-profile-key"|"check-network")),
+        "Unknown management command; no server started");
+    // This is the executable entrypoint, not a helper within an existing runtime.
+    let runtime=tokio::runtime::Runtime::new()?;
+    runtime.block_on(async {
+        let (sender,receiver)=tokio::sync::oneshot::channel();
+        #[cfg(unix)]
+        let mut terminate=tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()).context("Install management termination handler")?;
+        tokio::spawn(async move {
+            #[cfg(unix)]
+            let signal=tokio::select! {result=tokio::signal::ctrl_c()=>result,_=terminate.recv()=>Ok(())};
+            #[cfg(not(unix))]
+            let signal=tokio::signal::ctrl_c().await;
+            if let Err(error)=signal {eprintln!("Management shutdown signal failed: {error}");}
+            let _=sender.send(());
+        });
+        run(receiver).await
+    })
+}
+
+async fn run(stop:tokio::sync::oneshot::Receiver<()>)->Result<()> {
+    let data = PathBuf::from(std::env::var("SWAN_DATA_DIR").unwrap_or_else(|_| "swan-data".into()));
+    let args:Vec<String>=std::env::args().collect();
+    // A standalone probe uses only a public bootstrap. Never open company
+    // storage, create setup keys or start a listener for this command.
+    if args.get(1).map(String::as_str)==Some("check-network") {
+        let report=network_probe::run(&args[2..]).await?;
+        println!("{}",serde_json::to_string_pretty(&report)?);
+        anyhow::ensure!(report["requested_checks_passed"]==true,"One or more requested network checks failed; inspect the JSON report");
+        return Ok(());
+    }
+    if matches!(args.get(1).map(String::as_str),Some("backup"|"restore")) {
+        let path=PathBuf::from(args.get(2).context("Usage: swan-management backup|restore FILE")?);
+        let passphrase=std::env::var("SWAN_BACKUP_PASSPHRASE").context("Set SWAN_BACKUP_PASSPHRASE for this process")?;
+        let operation=args[1].clone();let extra=args[3..].to_vec();
+        tokio::task::spawn_blocking(move || ->Result<()> {
+            let mut inputs=std::collections::HashMap::new();
+            anyhow::ensure!(extra.len()%2==0,"Backup options require explicit paths");
+            for pair in extra.chunks_exact(2){
+                anyhow::ensure!(operation=="backup" && matches!(pair[0].as_str(),"--transport-directory"|"--deployment-env"|"--tls-identity"|"--tls-directory"|"--installer-artifacts-directory"),"Unknown backup option");
+                anyhow::ensure!(inputs.insert(pair[0].clone(),PathBuf::from(&pair[1])).is_none(),"Duplicate backup option");
+            }
+            if operation=="backup" {
+                backup::export_deployment_with_artifacts(&data,&path,&passphrase,inputs.get("--transport-directory").map(|p|p.as_path()),inputs.get("--deployment-env").map(|p|p.as_path()),inputs.get("--tls-identity").map(|p|p.as_path()),inputs.get("--tls-directory").map(|p|p.as_path()),inputs.get("--installer-artifacts-directory").map(|p|p.as_path()))
+            }else{backup::restore(&data,&path,&passphrase)}
+        }).await??;
+        println!("Encrypted {} completed.",args[1]);return Ok(());
+    }
+    let store_data=data.clone();
+    let store = Arc::new(tokio::task::spawn_blocking(move ||Store::open(&store_data)).await??);
+    if matches!(args.get(1).map(String::as_str),Some("prepare-profile-key"|"activate-profile-key")) {
+        if args[1]=="activate-profile-key" {anyhow::ensure!(args.iter().any(|arg|arg=="--confirm-clients-synced"),"First synchronize the prepared signed transition to installed clients; activation requires --confirm-clients-synced");}
+        let operation=args[1].clone();
+        let public=tokio::task::spawn_blocking(move ||if operation=="prepare-profile-key" {store.prepare_profile_rotation()}else{store.activate_profile_rotation()}).await??;
+        println!("Profile public key: {public}");return Ok(());
+    }
+    let address: SocketAddr = std::env::var("SWAN_LISTEN").unwrap_or_else(|_| "127.0.0.1:8080".into()).parse()?;
+    let app: Router = service::router(store);
+    let listener = tokio::net::TcpListener::bind(address).await.context("Bind management listener")?;
+    println!("Swan Remote Support management listening on {address}; secrets stored under {}",data.display());
+    axum::serve(listener, app.into_make_service_with_connect_info::<SocketAddr>()).with_graceful_shutdown(async {let _=stop.await;}).await?;
+    Ok(())
+}
diff --git a/product/management/src/network.rs b/product/management/src/network.rs
new file mode 100644
index 00000000000..27029d42065
--- /dev/null
+++ b/product/management/src/network.rs
@@ -0,0 +1,96 @@
+//! Server-side diagnostics are not evidence of reachability from the Internet.
+use serde_json::{json,Value};
+use std::{net::IpAddr,time::Duration};
+use swan_protocol::{CompanyProfile,SignedEnvelope};
+
+fn address_class(address:IpAddr)->&'static str {
+    let private=match address {
+        IpAddr::V4(ip)=>{let o=ip.octets();ip.is_private() || ip.is_loopback() || ip.is_link_local() || ip.is_documentation() || o[0]==0 || o[0]>=224 || (o[0]==100 && (64..=127).contains(&o[1])) || (o[0]==198 && (18..=19).contains(&o[1])) || (o[0]==192 && o[1]==0 && o[2]==0) || (o[0]==192 && o[1]==88 && o[2]==99)},
+        // Treat special-use and documentation ranges conservatively. A public
+        // candidate is still not independent proof of an external vantage.
+        IpAddr::V6(ip)=>if let Some(v4)=ip.to_ipv4(){address_class(IpAddr::V4(v4))!="public_candidate"}else{let s=ip.segments();s[0]&0xe000!=0x2000 || (s[0]==0x2001 && (s[1]<0x0200 || s[1]==0x0db8)) || s[0]==0x2002 || (s[0]==0x3fff && s[1]&0xf000==0)},
+    };
+    if private {"private_or_local"}else{"public_candidate"}
+}
+
+pub(super) async fn tcp(name:&str,host:&str,port:u16)->Value {
+    let resolved=tokio::time::timeout(Duration::from_secs(3),tokio::net::lookup_host((host,port))).await;
+    let addresses:Vec<_>=match resolved {Ok(Ok(addresses))=>addresses.take(8).collect(),_=>return json!({"name":name,"host":host,"port":port,"reachable":false,"result":"DNS resolution failed or timed out","addresses":[]})};
+    let visible:Vec<_>=addresses.iter().map(|address|json!({"ip":address.ip().to_string(),"classification":address_class(address.ip())})).collect();
+    for address in addresses.iter().take(4) {
+        if matches!(tokio::time::timeout(Duration::from_secs(3),tokio::net::TcpStream::connect(address)).await,Ok(Ok(_))) {
+            return json!({"name":name,"host":host,"port":port,"reachable":true,"result":"TCP connection succeeded from this probe machine","connected_ip":address.ip().to_string(),"public_path_candidate":address_class(address.ip())=="public_candidate","addresses":visible});
+        }
+    }
+    json!({"name":name,"host":host,"port":port,"reachable":false,"result":"TCP connection failed or timed out","addresses":visible})
+}
+
+// The pinned UDP handler ignores TestNatRequest (TCP only). An empty-ID
+// RegisterPk with nonempty placeholder uuid/pk is rejected BEFORE peer lookup,
+// rate-state changes or database access. This is a stateless reachability probe,
+// never an enrollment or key registration. UDP carries raw protobuf.
+const UDP_REQUEST:&[u8]=&[0x7a,0x06,0x12,0x01,0x00,0x1a,0x01,0x00];
+pub(super) async fn udp(host:&str,port:u16)->Value {
+    let addresses:Vec<_>=match tokio::time::timeout(Duration::from_secs(3),tokio::net::lookup_host((host,port))).await {
+        Ok(Ok(addresses))=>addresses.take(8).collect(),
+        _=>return json!({"host":host,"port":port,"reachable":false,"result":"UDP DNS resolution failed or timed out"}),
+    };
+    for address in addresses.iter().take(4){
+        let attempt=async {
+            let socket=tokio::net::UdpSocket::bind(if address.is_ipv4(){"0.0.0.0:0"}else{"[::]:0"}).await?;
+            socket.connect(address).await?;socket.send(UDP_REQUEST).await?;
+            let mut buffer=[0u8;4096];let count=socket.recv(&mut buffer).await?;
+            anyhow::Ok(buffer[..count]==[0x82,0x01,0x02,0x08,0x02])
+        };
+        if let Ok(Ok(true))=tokio::time::timeout(Duration::from_secs(3),attempt).await {
+            return json!({"host":host,"port":port,"reachable":true,"result":"Native UDP invalid-ID rejection received from this probe machine","probe":"stateless_empty_id_rejection","connected_ip":address.ip().to_string(),"public_path_candidate":address_class(address.ip())=="public_candidate","response_authenticated":false,"nat_traversal_verified":false});
+        }
+    }
+    json!({"host":host,"port":port,"reachable":false,"result":"Native UDP response missing, malformed or timed out","nat_traversal_verified":false})
+}
+
+async fn management(profile:&CompanyProfile,key:&ed25519_dalek::VerifyingKey)->bool {
+    let result=async {
+        let envelope:SignedEnvelope=swan_agent::http_client(5,false)?.get(format!("{}/api/v1/profile",profile.management_url.trim_end_matches('/'))).send().await?.error_for_status()?.json().await?;
+        let returned:CompanyProfile=envelope.verify(key)?;
+        returned.validate(&profile.company_id,profile.revision,swan_protocol::now())?;
+        anyhow::Ok(())
+    }.await;
+    result.is_ok()
+}
+
+pub async fn check(profile:&CompanyProfile,key:&ed25519_dalek::VerifyingKey)->anyhow::Result<Value> {
+    let (host,id_port)=swan_protocol::transport_socket(&profile.rendezvous,21116)?;
+    let (relay_host,relay_port)=swan_protocol::transport_socket(&profile.relay,21117)?;
+    let nat_port=id_port.checked_sub(1).filter(|port|*port>0).ok_or_else(||anyhow::anyhow!("ID server port must allow its preceding NAT-test port"))?;
+    let (nat,id,relay,https,udp)=tokio::join!(tcp("NAT-test TCP",&host,nat_port),tcp("Rendezvous TCP",&host,id_port),tcp("Relay TCP",&relay_host,relay_port),management(profile,key),udp(&host,id_port));
+    Ok(json!({"vantage_point":"company_server","management_url":profile.management_url,"https_and_company_signature_valid":https,"tcp_checks":[nat,id,relay],"external_reachability_verified":false,"udp_reachability_verified":udp["reachable"]==true,"udp_check":udp,"guidance":"Run the standalone check-network command on a separate Internet connection, then test real native direct and relay sessions. Server-side checks do not prove external access. Office hosting needs port forwarding; CGNAT may require a company-controlled public relay. HTTPS-only proxies are not guaranteed."}))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn special_use_addresses_are_not_public_candidates(){
+        for ip in ["0.0.0.1","198.18.0.1","240.0.0.1","2001:db8::1","3fff::1","fec0::1","::ffff:192.168.1.1"]{assert_eq!(address_class(ip.parse().unwrap()),"private_or_local");}
+        for ip in ["8.8.8.8","2606:4700:4700::1111"]{assert_eq!(address_class(ip.parse().unwrap()),"public_candidate");}
+
+    }
+    #[tokio::test]
+    async fn udp_probe_requires_a_native_reply_from_its_connected_endpoint(){
+        for (reply,expected) in [(vec![0x82,0x01,0x02,0x08,0x02],true),(vec![0x0a,0],false)]{
+            let server=tokio::net::UdpSocket::bind("127.0.0.1:0").await.unwrap();let port=server.local_addr().unwrap().port();
+            let task=tokio::spawn(async move{let mut bytes=[0u8;64];let (n,peer)=server.recv_from(&mut bytes).await.unwrap();assert_eq!(&bytes[..n],UDP_REQUEST);server.send_to(&reply,peer).await.unwrap();});
+            let value=udp("127.0.0.1",port).await;assert_eq!(value["reachable"],expected);assert_ne!(value["public_path_candidate"],true);task.await.unwrap();
+        }
+    }
+    #[tokio::test]
+    async fn tcp_diagnostics_detect_local_listener_and_closed_port_without_claiming_public_access(){
+        let listener=tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();let port=listener.local_addr().unwrap().port();
+        let result=tcp("test","127.0.0.1",port).await;assert_eq!(result["reachable"],true);assert_eq!(result["addresses"][0]["classification"],"private_or_local");
+        drop(listener);assert_eq!(tcp("test","127.0.0.1",port).await["reachable"],false);
+        assert_eq!(address_class("100.64.1.2".parse().unwrap()),"private_or_local");assert_eq!(address_class("::1".parse().unwrap()),"private_or_local");
+        assert_eq!(swan_protocol::transport_socket("support.example.com:443",21116).unwrap(),("support.example.com".into(),443));
+        assert!(swan_protocol::transport_socket("support.example.com:0",21116).is_err());
+    }
+}
diff --git a/product/management/src/network_probe.rs b/product/management/src/network_probe.rs
new file mode 100644
index 00000000000..249c72373bc
--- /dev/null
+++ b/product/management/src/network_probe.rs
@@ -0,0 +1,85 @@
+//! A company-run probe: no accounts, enrollment, database or private server keys.
+use anyhow::{ensure,Context,Result};
+use serde_json::{json,Value};
+use std::{path::{Path,PathBuf},time::Duration};
+use swan_agent::Bootstrap;
+use swan_protocol::{CompanyProfile,SignedEnvelope};
+use tokio::io::AsyncReadExt;
+
+pub const USAGE:&str="Usage: swan-management check-network BOOTSTRAP_JSON [--outside-network] [--ca-file CERTIFICATE]\nRun on a separate Internet connection for outside-network checks. The location flag is an operator declaration, not independent attestation. No company account or server data directory is needed.";
+
+struct Options{bootstrap:PathBuf,ca:Option<PathBuf>,outside:bool}
+impl Options{
+    fn parse(args:&[String])->Result<Self>{
+        let first=args.first().filter(|x|!x.starts_with('-')).context(USAGE)?;
+        let mut result=Self{bootstrap:first.into(),ca:None,outside:false};let mut i=1;
+        while i<args.len(){match args[i].as_str(){
+            "--outside-network"=>{ensure!(!result.outside,"Duplicate outside-network flag");result.outside=true;},
+            "--ca-file"=>{ensure!(result.ca.is_none(),"Duplicate CA file");i+=1;result.ca=Some(args.get(i).filter(|x|!x.starts_with('-')).context("CA certificate path missing")?.into());},
+            _=>anyhow::bail!("{USAGE}"),
+        };i+=1;}
+        Ok(result)
+    }
+}
+async fn read_limited(path:&Path,limit:u64)->Result<Vec<u8>>{
+    let file=tokio::fs::File::open(path).await.context("Open probe input")?;let mut bytes=Vec::new();
+    file.take(limit+1).read_to_end(&mut bytes).await?;ensure!(bytes.len() as u64<=limit,"Probe input exceeds size limit");Ok(bytes)
+}
+pub async fn run(args:&[String])->Result<Value>{
+    let options=Options::parse(args)?;
+    let bootstrap:Bootstrap=serde_json::from_slice(&read_limited(&options.bootstrap,16*1024).await?).context("Expected public installer or network bootstrap JSON")?;
+    bootstrap.validate()?;
+    let management=swan_protocol::https_url(&bootstrap.management_url)?;
+    ensure!(management.query().is_none(),"Management base URL must not contain query parameters");
+    let mut client=reqwest::Client::builder().https_only(true).redirect(reqwest::redirect::Policy::none()).connect_timeout(Duration::from_secs(3)).timeout(Duration::from_secs(5));
+    if let Some(path)=options.ca {
+        let bytes=read_limited(&path,1024*1024).await?;
+        // Rustls defers from_pem parsing: DER can look like an empty, successful
+        // PEM parse. X.509 DER starts with an ASN.1 SEQUENCE; select it explicitly.
+        if bytes.first()==Some(&0x30) {
+            client=client.add_root_certificate(reqwest::Certificate::from_der(&bytes).context("Invalid company DER CA certificate")?);
+        } else {
+            let certificates=reqwest::Certificate::from_pem_bundle(&bytes).context("Invalid company PEM CA certificate")?;
+            ensure!(!certificates.is_empty(),"Company CA file contains no certificates");
+            for certificate in certificates {client=client.add_root_certificate(certificate);}
+        }
+    }
+    let mut response=client.build()?.get(format!("{}/api/v1/profile",bootstrap.management_url.trim_end_matches('/'))).send().await.context("Company HTTPS request failed")?.error_for_status()?;
+    let mut bytes=Vec::new();while let Some(chunk)=response.chunk().await?{
+        ensure!(bytes.len().saturating_add(chunk.len())<=2*1024*1024,"Company profile response exceeds size limit");bytes.extend_from_slice(&chunk);
+    }
+    let envelope:SignedEnvelope=serde_json::from_slice(&bytes)?;
+    let profile:CompanyProfile=envelope.verify(&swan_protocol::public_key(&bootstrap.profile_public_key)?)?;
+    profile.validate(&bootstrap.company_id,0,swan_protocol::now())?;
+    ensure!(profile.management_url.trim_end_matches('/')==bootstrap.management_url.trim_end_matches('/'),"Company endpoint changed; obtain a fresh public bootstrap");
+    let (host,id_port)=swan_protocol::transport_socket(&profile.rendezvous,21116)?;
+    let (relay_host,relay_port)=swan_protocol::transport_socket(&profile.relay,21117)?;
+    let nat_port=id_port.checked_sub(1).filter(|p|*p>0).context("NAT-test TCP port is invalid")?;
+    let https_host=management.host_str().context("Management hostname missing")?;
+    let https_port=management.port_or_known_default().context("Management HTTPS port missing")?;
+    let (https,nat,id,relay,udp)=tokio::join!(
+        super::network::tcp("Management HTTPS TCP",https_host,https_port),super::network::tcp("NAT-test TCP",&host,nat_port),
+        super::network::tcp("Rendezvous TCP",&host,id_port),super::network::tcp("Relay TCP",&relay_host,relay_port),super::network::udp(&host,id_port));
+    let tcp=[https,nat,id,relay];
+    let reachable=tcp.iter().all(|x|x["reachable"]==true) && udp["reachable"]==true;
+    let public=tcp.iter().all(|x|x["public_path_candidate"]==true) && udp["public_path_candidate"]==true;
+    Ok(json!({"vantage_point":"standalone_probe","outside_network_declared_by_operator":options.outside,"outside_vantage_independently_attested":false,
+        "company_id":profile.company_id,"profile_revision":profile.revision,"management_url":profile.management_url,"https_and_company_signature_valid":true,
+        "tcp_checks":tcp,"udp_check":udp,"all_endpoint_checks_passed":reachable,"connected_addresses_public_candidates":public,
+        "requested_checks_passed":reachable && (!options.outside || public),"native_direct_and_relay_sessions_verified":false,
+        "guidance":"Results describe reachability from this probe computer. The outside-network flag does not prove its location. Private/special-use routes fail the outside-network check. Test real customer-approved direct and relay sessions from a separate Internet connection before publishing downloads; CGNAT may require a company-controlled public relay. No shared hosted service is used."}))
+}
+
+#[cfg(test)]
+mod tests{
+    use super::*;
+    #[test]
+    fn invalid_probe_options_do_not_silently_start_a_server(){
+        let args=|s:&[&str]|s.iter().map(|s|s.to_string()).collect::<Vec<_>>();
+        assert!(Options::parse(&[]).is_err());assert!(Options::parse(&args(&["--outside-network"])).is_err());
+        assert!(Options::parse(&args(&["bootstrap.json","--ca-file"])).is_err());
+        assert!(Options::parse(&args(&["bootstrap.json","--outside-network","--outside-network"])).is_err());
+        assert!(Options::parse(&args(&["bootstrap.json","--insecure"])).is_err());
+        let value=Options::parse(&args(&["bootstrap.json","--ca-file","root.pem","--outside-network"])).unwrap();assert!(value.outside);assert_eq!(value.ca,Some(PathBuf::from("root.pem")));
+    }
+}
diff --git a/product/management/src/schema.sql b/product/management/src/schema.sql
new file mode 100644
index 00000000000..481eaadf8a4
--- /dev/null
+++ b/product/management/src/schema.sql
@@ -0,0 +1,16 @@
+CREATE TABLE IF NOT EXISTS profile(id INTEGER PRIMARY KEY CHECK(id=1),body TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS users(id TEXT PRIMARY KEY,username TEXT NOT NULL UNIQUE,password_hash TEXT NOT NULL,totp_secret TEXT NOT NULL,last_totp_step INTEGER NOT NULL DEFAULT 0,role TEXT NOT NULL CHECK(role IN ('admin','technician')),disabled INTEGER NOT NULL DEFAULT 0);
+CREATE TABLE IF NOT EXISTS sessions(token_hash TEXT PRIMARY KEY,user_id TEXT NOT NULL REFERENCES users(id),expires_at INTEGER NOT NULL);
+CREATE TABLE IF NOT EXISTS devices(id TEXT PRIMARY KEY,name TEXT NOT NULL,rustdesk_id TEXT NOT NULL UNIQUE,token_hash TEXT NOT NULL UNIQUE,unattended INTEGER NOT NULL DEFAULT 0,state TEXT NOT NULL CHECK(state IN ('pending','approved','revoked')),group_id TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS group_access(group_id TEXT NOT NULL,user_id TEXT NOT NULL REFERENCES users(id),PRIMARY KEY(group_id,user_id));
+CREATE TABLE IF NOT EXISTS grants(id TEXT PRIMARY KEY,user_id TEXT NOT NULL REFERENCES users(id),device_id TEXT NOT NULL REFERENCES devices(id),body TEXT NOT NULL,expires_at INTEGER NOT NULL,claimed INTEGER NOT NULL DEFAULT 0,closed INTEGER NOT NULL DEFAULT 0,lease_until INTEGER NOT NULL DEFAULT 0);
+CREATE TABLE IF NOT EXISTS audit(id INTEGER PRIMARY KEY,at INTEGER NOT NULL,actor TEXT NOT NULL,event TEXT NOT NULL,target TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS releases(id TEXT PRIMARY KEY,body TEXT NOT NULL,envelope TEXT NOT NULL,approved INTEGER NOT NULL DEFAULT 0);
+CREATE TABLE IF NOT EXISTS workers(id TEXT PRIMARY KEY,token_hash TEXT NOT NULL UNIQUE,disabled INTEGER NOT NULL DEFAULT 0);
+CREATE TABLE IF NOT EXISTS builds(id TEXT PRIMARY KEY,body TEXT NOT NULL,state TEXT NOT NULL,worker TEXT NOT NULL DEFAULT '',claimed_at INTEGER NOT NULL DEFAULT 0,result TEXT NOT NULL DEFAULT '');
+CREATE TABLE IF NOT EXISTS group_permissions(group_id TEXT PRIMARY KEY,body TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS device_consent_revisions(device_id TEXT PRIMARY KEY REFERENCES devices(id),revision INTEGER NOT NULL);
+CREATE TABLE IF NOT EXISTS profile_signing_keys(id INTEGER PRIMARY KEY CHECK(id=1),active_hex TEXT NOT NULL,pending_hex TEXT);
+CREATE TABLE IF NOT EXISTS installation_reports(owner_kind TEXT NOT NULL CHECK(owner_kind IN ('customer','technician')),owner_id TEXT NOT NULL,installation_id TEXT NOT NULL,revision INTEGER NOT NULL CHECK(revision>0),received_at INTEGER NOT NULL,body TEXT NOT NULL,PRIMARY KEY(owner_kind,owner_id,installation_id));
+CREATE INDEX IF NOT EXISTS installation_reports_received ON installation_reports(received_at DESC);
+PRAGMA user_version=3;
diff --git a/product/management/src/service.rs b/product/management/src/service.rs
new file mode 100644
index 00000000000..77642a4fef3
--- /dev/null
+++ b/product/management/src/service.rs
@@ -0,0 +1,1219 @@
+use anyhow::ensure;
+use argon2::{password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString}, Argon2};
+use axum::{extract::{DefaultBodyLimit, Path, Query, State}, http::{header, HeaderMap, StatusCode}, response::{Html, IntoResponse, Response}, routing::{get, post, put}, Json, Router};
+use base64::{engine::general_purpose::STANDARD, Engine};
+use ed25519_dalek::SigningKey;
+use rand::rngs::OsRng;
+use rusqlite::{params, Connection, OptionalExtension};
+use serde::Deserialize;
+use serde_json::{json, Value};
+use std::{collections::HashMap, path::{Path as FsPath,PathBuf}, sync::{Arc, Mutex}};
+use swan_protocol::*;
+use totp_rs::{Algorithm, Secret, TOTP};
+use uuid::Uuid;
+
+#[path="installation_reporting.rs"]
+mod installation_reporting;
+
+pub struct Store {
+    _process_lock: std::fs::File,
+    db: Mutex<Connection>,
+    key: SigningKey,
+    setup_hash: String,
+    limits: Mutex<HashMap<String,(u64,u32)>>,
+    artifact_dir: PathBuf,
+}
+type Shared = Arc<Store>;
+type ApiResult = Result<Json<Value>, ApiError>;
+struct ApiError(StatusCode, &'static str);
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response { (self.0,Json(json!({"error":self.1}))).into_response() }
+}
+impl From<anyhow::Error> for ApiError {
+    fn from(error:anyhow::Error)->Self { eprintln!("Management operation failed: {}",error.root_cause()); Self(StatusCode::INTERNAL_SERVER_ERROR,"Operation failed") }
+}
+impl From<rusqlite::Error> for ApiError {
+    fn from(error:rusqlite::Error)->Self { anyhow::Error::from(error).into() }
+}
+impl From<serde_json::Error> for ApiError {
+    fn from(error:serde_json::Error)->Self { anyhow::Error::from(error).into() }
+}
+fn bad(message:&'static str)->ApiError { ApiError(StatusCode::BAD_REQUEST,message) }
+fn denied()->ApiError { ApiError(StatusCode::FORBIDDEN,"Access denied") }
+fn unauthorized()->ApiError { ApiError(StatusCode::UNAUTHORIZED,"Authentication required") }
+fn token(headers:&HeaderMap)->Result<&str,ApiError> {
+    headers.get(header::AUTHORIZATION).and_then(|v|v.to_str().ok()).and_then(|v|v.strip_prefix("Bearer ")).filter(|v|v.len()>=32 && v.len()<=256).ok_or_else(unauthorized)
+}
+fn password_hash(password:&str)->anyhow::Result<String> {
+    ensure!(password.len()>=14 && password.len()<=256,"Password must contain 14–256 characters");
+    Ok(Argon2::default().hash_password(password.as_bytes(),&SaltString::generate(&mut OsRng)).map_err(|_|anyhow::anyhow!("Password hashing failed"))?.to_string())
+}
+fn totp(secret:&str)->anyhow::Result<TOTP> {
+    Ok(TOTP::new(Algorithm::SHA1,6,1,30,Secret::Encoded(secret.into()).to_bytes().map_err(|_|anyhow::anyhow!("Invalid TOTP secret"))?).map_err(|_|anyhow::anyhow!("Invalid TOTP parameters"))?)
+}
+fn totp_step(secret:&str,code:&str,time:u64)->anyhow::Result<u64> {
+    ensure!(code.len()==6 && code.bytes().all(|b|b.is_ascii_digit()),"Invalid code");
+    let generator=totp(secret)?;
+    for step in [(time/30).saturating_sub(1),time/30,time/30+1] {
+        if generator.generate(step*30)==code { return Ok(step); }
+    }
+    anyhow::bail!("Invalid code")
+}
+
+impl Store {
+    pub fn open(directory:&FsPath)->anyhow::Result<Self> {
+        Self::open_with_backup_password(directory,std::env::var("SWAN_BACKUP_PASSPHRASE").ok().as_deref())
+    }
+    fn open_with_backup_password(directory:&FsPath,backup_password:Option<&str>)->anyhow::Result<Self> {
+        std::fs::create_dir_all(directory)?;
+        #[cfg(unix)] { use std::os::unix::fs::PermissionsExt; std::fs::set_permissions(directory,std::fs::Permissions::from_mode(0o700))?; }
+        let mut lock_options=std::fs::OpenOptions::new();lock_options.create(true).read(true).write(true);
+        #[cfg(unix)] {use std::os::unix::fs::OpenOptionsExt;lock_options.mode(0o600);}
+        let process_lock=lock_options.open(directory.join("management.lock"))?;
+        fs2::FileExt::try_lock_exclusive(&process_lock).map_err(|_|anyhow::anyhow!("Company management data is in use; stop the service before offline operations"))?;
+        let key_path=directory.join("profile-key.hex");
+        if !key_path.exists() { write_secret(&key_path,&hex::encode(SigningKey::generate(&mut OsRng).to_bytes()))?; }
+        let key_bytes:[u8;32]=hex::decode(std::fs::read_to_string(&key_path)?.trim())?.try_into().map_err(|_|anyhow::anyhow!("Invalid signing key"))?;
+        let setup_path=directory.join("setup-token.txt");
+        if !setup_path.exists() { write_secret(&setup_path,&random_token())?; }
+        let setup_hash=digest(std::fs::read_to_string(setup_path)?.trim());
+        let db=Connection::open(directory.join("management.sqlite3"))?;
+        db.pragma_update(None,"journal_mode","WAL")?;
+        db.pragma_update(None,"foreign_keys","ON")?;
+        db.busy_timeout(std::time::Duration::from_secs(5))?;
+        let version:u32=db.pragma_query_value(None,"user_version",|r|r.get(0))?;
+        ensure!(version<=3,"Database was created by a newer server; restore the pre-upgrade backup rather than downgrading it");
+        if version==1 || version==2 {
+            let password=backup_password.ok_or_else(||anyhow::anyhow!("Schema upgrade requires SWAN_BACKUP_PASSPHRASE in private environment configuration for an encrypted pre-upgrade backup"))?;
+            crate::backup::export(directory,&directory.join(format!("pre-upgrade-v{version}-{}.swan-backup",random_token())),password)?;
+        }
+        let migration=db.unchecked_transaction()?;
+        migration.execute_batch(include_str!("schema.sql"))?;
+        migration.execute("INSERT OR IGNORE INTO profile_signing_keys(id,active_hex) VALUES(1,?1)",[hex::encode(key_bytes)])?;
+        migration.commit()?;
+        let active_hex:String=db.query_row("SELECT active_hex FROM profile_signing_keys WHERE id=1",[],|row|row.get(0))?;
+        let key=signing_key_from_hex(&active_hex)?;
+        let artifact_dir=directory.join("artifacts");std::fs::create_dir_all(&artifact_dir)?;
+        Ok(Self {_process_lock:process_lock,db:Mutex::new(db),key,setup_hash,limits:Mutex::new(HashMap::new()),artifact_dir})
+    }
+    pub fn prepare_profile_rotation(&self)->anyhow::Result<String> {
+        let mut db=self.db.lock().unwrap();let tx=db.transaction()?;
+        let pending:Option<String>=tx.query_row("SELECT pending_hex FROM profile_signing_keys WHERE id=1",[],|row|row.get(0))?;
+        ensure!(pending.is_none(),"A profile key rotation is already pending");
+        let raw:String=tx.query_row("SELECT body FROM profile WHERE id=1",[],|row|row.get(0))?;
+        let mut profile:CompanyProfile=serde_json::from_str(&raw)?;
+        ensure!(profile.next_profile_public_key.is_none(),"Profile already declares a replacement key");
+        let next=SigningKey::generate(&mut OsRng);let public=STANDARD.encode(next.verifying_key().as_bytes());
+        profile.next_profile_public_key=Some(public.clone());profile.revision=profile.revision.checked_add(1).ok_or_else(||anyhow::anyhow!("Profile revision exhausted"))?;
+        profile.issued_at=now();profile.expires_at=now()+30*86400;profile.validate(&profile.company_id,profile.revision,now())?;
+        tx.execute("UPDATE profile_signing_keys SET pending_hex=?1 WHERE id=1",[hex::encode(next.to_bytes())])?;
+        tx.execute("UPDATE profile SET body=?1 WHERE id=1",[serde_json::to_string(&profile)?])?;
+        tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,'local-operator','profile.key.prepared',?2)",params![now(),public])?;
+        tx.commit()?;Ok(public)
+    }
+    pub fn activate_profile_rotation(&self)->anyhow::Result<String> {
+        let mut db=self.db.lock().unwrap();let tx=db.transaction()?;
+        let pending:Option<String>=tx.query_row("SELECT pending_hex FROM profile_signing_keys WHERE id=1",[],|row|row.get(0))?;
+        let pending=pending.ok_or_else(||anyhow::anyhow!("No pending profile key rotation"))?;
+        let next=signing_key_from_hex(&pending)?;let public=STANDARD.encode(next.verifying_key().as_bytes());
+        let raw:String=tx.query_row("SELECT body FROM profile WHERE id=1",[],|row|row.get(0))?;let mut profile:CompanyProfile=serde_json::from_str(&raw)?;
+        ensure!(profile.next_profile_public_key.as_ref()==Some(&public),"Published profile does not authorize the pending key");
+        profile.next_profile_public_key=None;profile.revision=profile.revision.checked_add(1).ok_or_else(||anyhow::anyhow!("Profile revision exhausted"))?;
+        profile.issued_at=now();profile.expires_at=now()+30*86400;profile.validate(&profile.company_id,profile.revision,now())?;
+        tx.execute("UPDATE profile_signing_keys SET active_hex=?1,pending_hex=NULL WHERE id=1",[pending])?;
+        tx.execute("UPDATE profile SET body=?1 WHERE id=1",[serde_json::to_string(&profile)?])?;
+        tx.execute("UPDATE grants SET closed=1,lease_until=0 WHERE closed=0",[])?;
+        tx.execute("UPDATE builds SET state='failed',result=?1 WHERE state IN ('queued','running','uploaded','completed')",[json!({"ok":false,"error":"Company signing key rotated; regenerate company bundles"}).to_string()])?;
+        tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,'local-operator','profile.key.activated',?2)",params![now(),public])?;
+        tx.commit()?;Ok(public)
+    }
+    fn profile(&self)->anyhow::Result<CompanyProfile> {
+        let raw:String=self.db.lock().unwrap().query_row("SELECT body FROM profile WHERE id=1",[],|r|r.get(0))?;
+        Ok(serde_json::from_str(&raw)?)
+    }
+    fn user(&self,headers:&HeaderMap,admin:bool)->Result<String,ApiError> {
+        let hash=digest(token(headers)?);
+        let result:Option<(String,String)>=self.db.lock().unwrap().query_row("SELECT u.id,u.role FROM sessions s JOIN users u ON u.id=s.user_id WHERE s.token_hash=?1 AND s.expires_at>?2 AND u.disabled=0",params![hash,now()],|r|Ok((r.get(0)?,r.get(1)?))).optional()?;
+        match result { Some((id,role)) if !admin || role=="admin" => Ok(id),_=>Err(unauthorized()) }
+    }
+    fn device(&self,headers:&HeaderMap)->Result<String,ApiError> {
+        self.db.lock().unwrap().query_row("SELECT id FROM devices WHERE token_hash=?1 AND state='approved'",[digest(token(headers)?)],|r|r.get(0)).optional()?.ok_or_else(unauthorized)
+    }
+    fn worker(&self,headers:&HeaderMap)->Result<(),ApiError> {
+        let found:bool=self.db.lock().unwrap().query_row("SELECT EXISTS(SELECT 1 FROM workers WHERE token_hash=?1 AND disabled=0)",[digest(token(headers)?)],|r|r.get(0))?;
+        if found {Ok(())} else {Err(unauthorized())}
+    }
+    fn audit(&self,actor:&str,event:&str,target:&str)->Result<(),ApiError> {
+        self.db.lock().unwrap().execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,?3,?4)",params![now(),actor,event,target])?;
+        Ok(())
+    }
+    fn rate(&self,key:&str,maximum:u32)->Result<(),ApiError> {
+        let mut limits=self.limits.lock().unwrap();
+        let time=now(); limits.retain(|_,v|time.saturating_sub(v.0)<300);
+        if limits.len()>10000 { return Err(ApiError(StatusCode::TOO_MANY_REQUESTS,"Retry later")); }
+        let value=limits.entry(key.into()).or_insert((time,0));
+        if time.saturating_sub(value.0)>=60 { *value=(time,0); }
+        value.1+=1;
+        if value.1>maximum {Err(ApiError(StatusCode::TOO_MANY_REQUESTS,"Retry later"))} else {Ok(())}
+    }
+}
+fn write_secret(path:&FsPath,value:&str)->anyhow::Result<()> {
+    use std::io::Write;
+    let mut options=std::fs::OpenOptions::new(); options.write(true).create_new(true);
+    #[cfg(unix)] {use std::os::unix::fs::OpenOptionsExt;options.mode(0o600);}
+    let mut file=options.open(path)?; file.write_all(value.as_bytes())?;file.sync_all()?;Ok(())
+}
+
+pub fn router(store:Shared)->Router {
+    Router::new()
+        .route("/",get(||async{Html(include_str!("../web/index.html"))}))
+        .route("/app.js",get(||async{([(header::CONTENT_TYPE,"text/javascript; charset=utf-8")],include_str!("../web/app.js"))}))
+        .route("/style.css",get(||async{([(header::CONTENT_TYPE,"text/css")],include_str!("../web/style.css"))}))
+        .route("/health",get(||async{Json(json!({"status":"ok","product":PRODUCT}))}))
+        .route("/swan-support-mark.svg",get(||async{([(header::CONTENT_TYPE,"image/svg+xml")],include_str!("../../../branding/swan-support-mark.svg"))}))
+        .route("/api/v1/default-branding",get(||async{Json(Branding::default())}))
+        .route("/api/v1/status",get(status))
+        .route("/api/v1/setup",post(setup))
+        .route("/api/v1/login",post(login))
+        .route("/api/v1/logout",post(logout))
+        .route("/api/v1/profile",get(profile).put(save_profile))
+        .route("/api/v1/network/check",post(network_check))
+        .route("/api/v1/network/bootstrap",get(network_bootstrap))
+        .route("/api/v1/users",get(users).post(create_user))
+        .route("/api/v1/users/{id}/disable",post(disable_user))
+        .route("/api/v1/enroll",post(enroll))
+        .route("/api/v1/installations",get(installation_reporting::reports))
+        .route("/api/v1/installations/report",get(installation_reporting::own_report).post(installation_reporting::report))
+        .route("/api/v1/devices",get(devices))
+        .route("/api/v1/devices/{id}/state",put(device_state))
+        .route("/api/v1/device/consent",put(consent))
+        .route("/api/v1/device/status",get(device_status))
+        .route("/api/v1/groups/{group}/permissions",get(group_permissions).put(set_group_permissions))
+        .route("/api/v1/groups/{group}/users/{user}",put(group_access).delete(revoke_group_access))
+        .route("/api/v1/grants",post(grant))
+        .route("/api/v1/grants/claim",post(claim))
+        .route("/api/v1/grants/{id}/renew",post(renew))
+        .route("/api/v1/grants/{id}/close",post(close_grant))
+        .route("/api/v1/audit",get(audit))
+        .route("/api/v1/sessions",get(session_history))
+        .route("/api/v1/releases",get(releases).post(import_release))
+        .route("/api/v1/releases/{id}/approve",post(approve_release).delete(withdraw_release))
+        .route("/api/v1/device/update",get(device_update))
+        .route("/api/v1/user/update",get(technician_update))
+        .route("/api/v1/workers",get(workers).post(create_worker))
+        .route("/api/v1/workers/{id}",axum::routing::delete(revoke_worker))
+        .route("/api/v1/builds",get(builds).post(create_build))
+        .route("/api/v1/worker/claim",post(claim_build))
+        .route("/api/v1/worker/recipe",get(worker_recipe))
+        .route("/api/v1/worker/builds/{id}",put(finish_build))
+        .route("/api/v1/worker/builds/{id}/artifact",put(upload_artifact).layer(DefaultBodyLimit::max(512*1024*1024)))
+        .route("/api/v1/downloads/{id}",get(download_artifact))
+        .layer(DefaultBodyLimit::max(1024*1024))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(header::HeaderName::from_static("x-content-type-options"),header::HeaderValue::from_static("nosniff")))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(header::HeaderName::from_static("content-security-policy"),header::HeaderValue::from_static("default-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'")))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::overriding(header::CACHE_CONTROL,header::HeaderValue::from_static("no-store")))
+        .with_state(store)
+}
+async fn status(State(s):State<Shared>)->ApiResult {
+    let configured=s.db.lock().unwrap().query_row("SELECT EXISTS(SELECT 1 FROM profile)",[],|r|r.get::<_,bool>(0))?;
+    Ok(Json(json!({"configured":configured,"profile_public_key":STANDARD.encode(s.key.verifying_key().as_bytes())})))
+}
+async fn network_check(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    let actor=s.user(&headers,true)?;s.rate("network-check",10)?;
+    let profile=s.profile()?;
+    let result=crate::network::check(&profile,&s.key.verifying_key()).await?;
+    s.audit(&actor,"network.checked",&profile.company_id)?;Ok(Json(result))
+}
+async fn network_bootstrap(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    let actor=s.user(&headers,true)?;s.rate("network-bootstrap",10)?;
+    let profile=s.profile()?;
+    let bootstrap=swan_agent::Bootstrap{schema:SCHEMA,edition:Edition::Customer,company_id:profile.company_id.clone(),management_url:profile.management_url,profile_public_key:STANDARD.encode(s.key.verifying_key().as_bytes()),release_public_key:String::new()};
+    s.audit(&actor,"network.bootstrap_downloaded",&profile.company_id)?;
+    Ok(Json(serde_json::to_value(bootstrap)?))
+}
+#[derive(Deserialize)]
+struct Setup { profile:CompanyProfile, username:String,password:String,totp_secret:String,totp_code:String }
+async fn setup(State(s):State<Shared>,headers:HeaderMap,Json(mut input):Json<Setup>)->ApiResult {
+    s.rate("setup",5)?;
+    if digest(token(&headers)?)!=s.setup_hash {return Err(denied());}
+    validate_username(&input.username)?;
+    let step=totp_step(&input.totp_secret,&input.totp_code,now()).map_err(|_|bad("Invalid authenticator code"))?;
+    let hash=password_hash(&input.password).map_err(|_|bad("Password must contain 14–256 characters"))?;
+    input.profile.company_id=Uuid::new_v4().to_string(); input.profile.revision=1;
+    input.profile.issued_at=now();input.profile.expires_at=now()+86400*30;
+    input.profile.validate(&input.profile.company_id,0,now()).map_err(|_|bad("Invalid company profile"))?;
+    let mut db=s.db.lock().unwrap();let transaction=db.transaction()?;
+    let exists:bool=transaction.query_row("SELECT EXISTS(SELECT 1 FROM profile)",[],|r|r.get(0))?;
+    if exists {return Err(ApiError(StatusCode::CONFLICT,"Already configured"));}
+    let user=Uuid::new_v4().to_string();
+    transaction.execute("INSERT INTO profile(id,body) VALUES(1,?1)",[serde_json::to_string(&input.profile)?])?;
+    transaction.execute("INSERT INTO users(id,username,password_hash,totp_secret,last_totp_step,role) VALUES(?1,?2,?3,?4,?5,'admin')",params![user,input.username,hash,input.totp_secret,step])?;
+    transaction.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'company.setup',?3)",params![now(),user,input.profile.company_id])?;
+    transaction.commit()?;
+    Ok(Json(json!({"company_id":input.profile.company_id})))
+}
+fn validate_username(name:&str)->Result<(),ApiError> {
+    if name.len()<3 || name.len()>64 || !name.bytes().all(|b|b.is_ascii_alphanumeric() || b"._-@".contains(&b)) {Err(bad("Invalid username"))} else {Ok(())}
+}
+#[derive(Deserialize)]
+struct Login { username:String,password:String,totp_code:String }
+async fn login(State(s):State<Shared>,Json(input):Json<Login>)->ApiResult {
+    s.rate("login-global",60)?;s.rate(&format!("login:{}",input.username),5)?;
+    validate_username(&input.username)?;
+    let record:Option<(String,String,String,u64)>=s.db.lock().unwrap().query_row("SELECT id,password_hash,totp_secret,last_totp_step FROM users WHERE username=?1 AND disabled=0",[&input.username],|r|Ok((r.get(0)?,r.get(1)?,r.get(2)?,r.get(3)?))).optional()?;
+    let (id,hash,secret,last)=record.ok_or_else(unauthorized)?;
+    let parsed=PasswordHash::new(&hash).map_err(|_|unauthorized())?;
+    Argon2::default().verify_password(input.password.as_bytes(),&parsed).map_err(|_|unauthorized())?;
+    let step=totp_step(&secret,&input.totp_code,now()).map_err(|_|unauthorized())?;
+    if step<=last {return Err(unauthorized());}
+    let value=random_token();
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    if tx.execute("UPDATE users SET last_totp_step=?1 WHERE id=?2 AND last_totp_step<?1",params![step,id])?!=1 {return Err(unauthorized());}
+    tx.execute("DELETE FROM sessions WHERE expires_at<=?1",[now()])?;
+    tx.execute("INSERT INTO sessions(token_hash,user_id,expires_at) VALUES(?1,?2,?3)",params![digest(&value),id,now()+3600])?;
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'user.login',?2)",params![now(),id])?;tx.commit()?;
+    Ok(Json(json!({"token":value,"expires_at":now()+3600,"user_id":id})))
+}
+async fn logout(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    let user=s.user(&headers,false)?;
+    s.db.lock().unwrap().execute("DELETE FROM sessions WHERE token_hash=?1",[digest(token(&headers)?)])?;
+    s.audit(&user,"user.logout",&user)?;Ok(Json(json!({"ok":true})))
+}
+async fn profile(State(s):State<Shared>)->ApiResult {
+    let mut profile=s.profile().map_err(|_|ApiError(StatusCode::SERVICE_UNAVAILABLE,"Company not configured"))?;
+    // Renew the signed policy lifetime without changing the administrator's revision.
+    profile.issued_at=now();profile.expires_at=now()+7*86400;
+    Ok(Json(serde_json::to_value(SignedEnvelope::sign(&profile,&s.key)?)?))
+}
+async fn save_profile(State(s):State<Shared>,headers:HeaderMap,Json(mut input):Json<CompanyProfile>)->ApiResult {
+    let user=s.user(&headers,true)?;
+    let current=s.profile()?;
+    input.company_id=current.company_id.clone();input.revision=current.revision+1;
+    input.issued_at=now();input.expires_at=now()+30*86400;
+    input.validate(&current.company_id,current.revision,now()).map_err(|_|bad("Invalid profile"))?;
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    let raw:String=tx.query_row("SELECT body FROM profile WHERE id=1",[],|r|r.get(0))?;
+    if serde_json::from_str::<CompanyProfile>(&raw)?.revision!=current.revision {return Err(ApiError(StatusCode::CONFLICT,"Profile changed; reload"));}
+    tx.execute("UPDATE profile SET body=?1 WHERE id=1",[serde_json::to_string(&input)?])?;
+    if !input.allow_unattended {close_unattended_grants(&tx,None)?;}
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'profile.updated',?3)",params![now(),user,input.revision.to_string()])?;
+    tx.commit()?;Ok(Json(json!({"revision":input.revision})))
+}
+#[derive(Deserialize)]
+struct CreateUser { username:String,password:String,role:String }
+async fn create_user(State(s):State<Shared>,headers:HeaderMap,Json(input):Json<CreateUser>)->ApiResult {
+    let actor=s.user(&headers,true)?;validate_username(&input.username)?;
+    if !["admin","technician"].contains(&input.role.as_str()) {return Err(bad("Invalid role"));}
+    let hash=password_hash(&input.password).map_err(|_|bad("Password must contain 14–256 characters"))?;
+    let secret=Secret::generate_secret().to_encoded().to_string();let id=Uuid::new_v4().to_string();
+    s.db.lock().unwrap().execute("INSERT INTO users(id,username,password_hash,totp_secret,role) VALUES(?1,?2,?3,?4,?5)",params![id,input.username,hash,secret,input.role])?;
+    s.audit(&actor,"user.created",&id)?;
+    Ok(Json(json!({"id":id,"totp_secret":secret,"message":"Transfer authenticator secret privately; it will not be returned again."})))
+}
+async fn users(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.user(&headers,true)?;let db=s.db.lock().unwrap();let mut statement=db.prepare("SELECT id,username,role,disabled FROM users ORDER BY username")?;
+    let rows=statement.query_map([],|r|Ok(json!({"id":r.get::<_,String>(0)?,"username":r.get::<_,String>(1)?,"role":r.get::<_,String>(2)?,"disabled":r.get::<_,bool>(3)?})))?.collect::<Result<Vec<_>,_>>()?;
+    Ok(Json(json!(rows)))
+}
+async fn disable_user(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>)->ApiResult {
+    let actor=s.user(&headers,true)?;if actor==id {return Err(bad("Cannot disable your own administrator account"));}
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    tx.execute("UPDATE users SET disabled=1 WHERE id=?1",[&id])?;
+    tx.execute("DELETE FROM sessions WHERE user_id=?1",[&id])?;
+    tx.execute("UPDATE grants SET closed=1,lease_until=0 WHERE user_id=?1",[&id])?;
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'user.disabled',?3)",params![now(),actor,id])?;
+    tx.commit()?;Ok(Json(json!({"ok":true})))
+}
+#[derive(Deserialize)]
+struct Enrollment { name:String,rustdesk_id:String,unattended_consent:bool }
+async fn enroll(State(s):State<Shared>,Json(input):Json<Enrollment>)->ApiResult {
+    s.rate("enrollment",10)?;
+    if input.name.trim().is_empty() || input.name.len()>100 || input.rustdesk_id.len()>20 || input.rustdesk_id.len()<6 || !input.rustdesk_id.bytes().all(|b|b.is_ascii_digit()) {return Err(bad("Invalid device identity"));}
+    let profile=s.profile()?;
+    if input.unattended_consent && !profile.allow_unattended {return Err(denied());}
+    let id=Uuid::new_v4().to_string();let credential=random_token();
+    s.db.lock().unwrap().execute("INSERT INTO devices(id,name,rustdesk_id,token_hash,unattended,state,group_id) VALUES(?1,?2,?3,?4,?5,'pending','default')",params![id,input.name,input.rustdesk_id,digest(&credential),input.unattended_consent])?;
+    s.audit(&id,"device.enrolled",&id)?;
+    Ok(Json(json!({"device_id":id,"device_token":credential,"state":"pending","company_id":profile.company_id})))
+}
+async fn devices(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    let user=s.user(&headers,false)?;let db=s.db.lock().unwrap();
+    let mut statement=db.prepare("SELECT d.id,d.name,d.rustdesk_id,d.state,d.group_id,d.unattended FROM devices d WHERE EXISTS(SELECT 1 FROM users u WHERE u.id=?1 AND u.role='admin') OR (d.state='approved' AND EXISTS(SELECT 1 FROM group_access g WHERE g.group_id=d.group_id AND g.user_id=?1)) ORDER BY d.name")?;
+    let rows=statement.query_map([user],|r|Ok(json!({"id":r.get::<_,String>(0)?,"name":r.get::<_,String>(1)?,"rustdesk_id":r.get::<_,String>(2)?,"state":r.get::<_,String>(3)?,"group":r.get::<_,String>(4)?,"unattended":r.get::<_,bool>(5)?})))?.collect::<Result<Vec<_>,_>>()?;
+    Ok(Json(json!(rows)))
+}
+#[derive(Deserialize)]
+struct DeviceState { state:String,group:String }
+async fn device_state(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>,Json(input):Json<DeviceState>)->ApiResult {
+    let actor=s.user(&headers,true)?;
+    if !["approved","revoked","pending"].contains(&input.state.as_str()) || input.group.is_empty() || input.group.len()>64 {return Err(bad("Invalid state or group"));}
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    let previous_group:Option<String>=tx.query_row("SELECT group_id FROM devices WHERE id=?1",[&id],|row|row.get(0)).optional()?;
+    let previous_group=previous_group.ok_or(ApiError(StatusCode::NOT_FOUND,"Device not found"))?;
+    tx.execute("UPDATE devices SET state=?1,group_id=?2 WHERE id=?3",params![input.state,input.group,id])?;
+    if input.state!="approved" || input.group!=previous_group {
+        tx.execute("UPDATE grants SET closed=1,lease_until=0 WHERE device_id=?1",[&id])?;
+    }
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,?3,?4)",params![now(),actor,format!("device.{}",input.state),id])?;
+    tx.commit()?;Ok(Json(json!({"ok":true})))
+}
+#[derive(Deserialize)]
+struct Consent { unattended:bool,revision:u64 }
+fn close_unattended_grants(db:&Connection,device:Option<&str>)->Result<(),ApiError> {
+    let ids={
+        let mut statement=db.prepare("SELECT id,body FROM grants WHERE closed=0 AND (?1 IS NULL OR device_id=?1)")?;
+        let rows=statement.query_map([device],|row|Ok((row.get::<_,String>(0)?,row.get::<_,String>(1)?)))?;
+        let mut ids=Vec::new();
+        for row in rows {let (id,body)=row?;let grant:SessionGrant=serde_json::from_str(&body)?;if grant.unattended {ids.push(id);}}
+        ids
+    };
+    for id in ids {db.execute("UPDATE grants SET closed=1,lease_until=0 WHERE id=?1",[id])?;}
+    Ok(())
+}
+async fn device_status(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    // Pending devices may inspect only their own identity, never session APIs.
+    let device:String=s.db.lock().unwrap().query_row("SELECT id FROM devices WHERE token_hash=?1 AND state IN ('pending','approved')",[digest(token(&headers)?)],|row|row.get(0)).optional()?.ok_or_else(unauthorized)?;
+    let company=s.profile()?.company_id;
+    let value=s.db.lock().unwrap().query_row("SELECT rustdesk_id,state FROM devices WHERE id=?1",[&device],|row|Ok(json!({"company_id":company,"device_id":device,"rustdesk_id":row.get::<_,String>(0)?,"state":row.get::<_,String>(1)?})))?;
+    Ok(Json(value))
+}
+async fn consent(State(s):State<Shared>,headers:HeaderMap,Json(input):Json<Consent>)->ApiResult {
+    let device=s.device(&headers)?;
+    if input.unattended && !s.profile()?.allow_unattended {return Err(denied());}
+    if input.revision>i64::MAX as u64 {return Err(bad("Invalid consent revision"));}
+    {
+        let mut db=s.db.lock().unwrap();let transaction=db.transaction()?;
+        let revision:u64=transaction.query_row("SELECT revision FROM device_consent_revisions WHERE device_id=?1",[&device],|row|row.get(0)).optional()?.unwrap_or(0);
+        let enabled:bool=transaction.query_row("SELECT unattended FROM devices WHERE id=?1",[&device],|row|row.get(0))?;
+        // Equal revisions are idempotent; revocation wins conflicting requests.
+        if input.revision<revision || (input.revision==revision && input.unattended && !enabled) {return Err(ApiError(StatusCode::CONFLICT,"Consent request superseded"));}
+        if input.revision==revision && input.unattended==enabled {return Ok(Json(json!({"ok":true})));}
+        transaction.execute("UPDATE devices SET unattended=?1 WHERE id=?2",params![input.unattended,device])?;
+        if !input.unattended {
+            close_unattended_grants(&transaction,Some(&device))?;
+        }
+        transaction.execute("INSERT INTO device_consent_revisions(device_id,revision) VALUES(?1,?2) ON CONFLICT(device_id) DO UPDATE SET revision=excluded.revision",params![device,input.revision])?;
+        transaction.commit()?;
+    }
+    s.audit(&device,"device.consent_changed",&device)?;Ok(Json(json!({"ok":true})))
+}
+async fn group_access(State(s):State<Shared>,headers:HeaderMap,Path((group,user)):Path<(String,String)>)->ApiResult {
+    let actor=s.user(&headers,true)?;if group.len()>64 || group.is_empty(){return Err(bad("Invalid group"));}
+    s.db.lock().unwrap().execute("INSERT OR IGNORE INTO group_access(group_id,user_id) VALUES(?1,?2)",params![group,user])?;
+    s.audit(&actor,"group.access_granted",&user)?;Ok(Json(json!({"ok":true})))
+}
+#[derive(Deserialize)]
+struct GrantRequest { device_id:String, proof_public_key:String, unattended:bool }
+fn device_permissions(db:&Connection,device:&str)->Result<SessionPermissions,ApiError> {
+    let raw:Option<String>=db.query_row("SELECT p.body FROM devices d LEFT JOIN group_permissions p ON p.group_id=d.group_id WHERE d.id=?1",[device],|row|row.get(0))?;
+    Ok(match raw {Some(value)=>serde_json::from_str(&value)?,None=>SessionPermissions::support_default()})
+}
+async fn group_permissions(State(s):State<Shared>,headers:HeaderMap,Path(group):Path<String>)->ApiResult {
+    s.user(&headers,true)?;
+    let raw:Option<String>=s.db.lock().unwrap().query_row("SELECT body FROM group_permissions WHERE group_id=?1",[group],|row|row.get(0)).optional()?;
+    Ok(Json(match raw {Some(value)=>serde_json::from_str(&value)?,None=>serde_json::to_value(SessionPermissions::support_default())?}))
+}
+async fn set_group_permissions(State(s):State<Shared>,headers:HeaderMap,Path(group):Path<String>,Json(policy):Json<SessionPermissions>)->ApiResult {
+    let actor=s.user(&headers,true)?;if group.is_empty() || group.len()>64 {return Err(bad("Invalid group"));}
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    tx.execute("INSERT INTO group_permissions(group_id,body) VALUES(?1,?2) ON CONFLICT(group_id) DO UPDATE SET body=excluded.body",params![group,serde_json::to_string(&policy)?])?;
+    let invalid={
+        let mut statement=tx.prepare("SELECT g.id,g.body FROM grants g JOIN devices d ON d.id=g.device_id WHERE d.group_id=?1 AND g.closed=0")?;
+        let rows=statement.query_map([&group],|row|Ok((row.get::<_,String>(0)?,row.get::<_,String>(1)?)))?;
+        let mut ids=Vec::new();
+        for row in rows {let (id,body)=row?;let grant:SessionGrant=serde_json::from_str(&body)?;if !policy.allows(&grant.permissions){ids.push(id);}}
+        ids
+    };
+    for id in invalid {tx.execute("UPDATE grants SET closed=1,lease_until=0 WHERE id=?1",[id])?;}
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'group.permissions_changed',?3)",params![now(),actor,group])?;
+    tx.commit()?;Ok(Json(json!({"ok":true})))
+}
+async fn grant(State(s):State<Shared>,headers:HeaderMap,Json(input):Json<GrantRequest>)->ApiResult {
+    let user=s.user(&headers,false)?;s.rate(&format!("grant:{user}"),30)?;
+    public_key(&input.proof_public_key).map_err(|_|bad("Invalid proof key"))?;
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    let raw:String=tx.query_row("SELECT body FROM profile WHERE id=1",[],|row|row.get(0))?;
+    let profile:CompanyProfile=serde_json::from_str(&raw)?;
+    let peer:Option<String>=tx.query_row("SELECT d.rustdesk_id FROM devices d JOIN users u ON u.id=?2 WHERE d.id=?1 AND d.state='approved' AND u.disabled=0 AND (?3=0 OR d.unattended=1) AND (u.role='admin' OR EXISTS(SELECT 1 FROM group_access g WHERE g.group_id=d.group_id AND g.user_id=u.id))",params![input.device_id,user,input.unattended],|r|r.get(0)).optional()?;
+    let peer=peer.ok_or_else(denied)?;
+    if input.unattended && !profile.allow_unattended {return Err(denied());}
+    let grant=SessionGrant { schema:SCHEMA,company_id:profile.company_id,grant_id:Uuid::new_v4().to_string(),technician_id:user.clone(),device_id:input.device_id.clone(),rustdesk_id:peer,proof_public_key:input.proof_public_key,unattended:input.unattended,permissions:device_permissions(&tx,&input.device_id)?,issued_at:now(),expires_at:now()+60 };
+    tx.execute("INSERT INTO grants(id,user_id,device_id,body,expires_at) VALUES(?1,?2,?3,?4,?5)",params![grant.grant_id,user,input.device_id,serde_json::to_string(&grant)?,grant.expires_at])?;
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'session.requested',?3)",params![now(),user,grant.grant_id])?;
+    tx.commit()?;
+    Ok(Json(serde_json::to_value(SignedEnvelope::sign(&grant,&s.key)?)?))
+}
+#[derive(Deserialize)]
+struct Claim { grant:SignedEnvelope }
+fn active_grant(db:&Connection,id:&str,device:&str)->Result<bool,ApiError> {
+    Ok(db.query_row("SELECT EXISTS(SELECT 1 FROM grants g JOIN devices d ON d.id=g.device_id JOIN users u ON u.id=g.user_id WHERE g.id=?1 AND g.device_id=?2 AND d.state='approved' AND u.disabled=0 AND g.closed=0 AND (u.role='admin' OR EXISTS(SELECT 1 FROM group_access a WHERE a.user_id=u.id AND a.group_id=d.group_id)))",params![id,device],|r|r.get(0))?)
+}
+async fn claim(State(s):State<Shared>,headers:HeaderMap,Json(input):Json<Claim>)->ApiResult {
+    let device=s.device(&headers)?;let profile=s.profile()?;
+    let grant:SessionGrant=input.grant.verify(&s.key.verifying_key()).map_err(|_|denied())?;
+    let peer:String=s.db.lock().unwrap().query_row("SELECT rustdesk_id FROM devices WHERE id=?1",[&device],|r|r.get(0))?;
+    grant.validate(&profile.company_id,&device,&peer,now()).map_err(|_|denied())?;
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    if !active_grant(&tx,&grant.grant_id,&device)? {return Err(denied());}
+    if !device_permissions(&tx,&device)?.allows(&grant.permissions) {return Err(denied());}
+    let consent:bool=tx.query_row("SELECT unattended FROM devices WHERE id=?1",[&device],|r|r.get(0))?;
+    if grant.unattended && !(consent && profile.allow_unattended) {return Err(denied());}
+    let (technician_id,technician_name):(String,String)=tx.query_row("SELECT u.id,u.username FROM grants g JOIN users u ON u.id=g.user_id WHERE g.id=?1 AND g.device_id=?2",params![grant.grant_id,device],|row|Ok((row.get(0)?,row.get(1)?)))?;
+    if technician_id!=grant.technician_id {return Err(denied());}
+    if tx.execute("UPDATE grants SET claimed=1,lease_until=?1 WHERE id=?2 AND claimed=0 AND expires_at>?3",params![now()+300,grant.grant_id,now()])?!=1 {return Err(denied());}
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'session.claimed',?3)",params![now(),device,grant.grant_id])?;tx.commit()?;
+    Ok(Json(json!({"lease_until":now()+300,"unattended":grant.unattended,"technician":{"id":technician_id,"username":technician_name}})))
+}
+async fn renew(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>)->ApiResult {
+    let device=s.device(&headers)?;let profile=s.profile()?;
+    let db=s.db.lock().unwrap();
+    if !active_grant(&db,&id,&device)? {return Err(denied());}
+    let raw:String=db.query_row("SELECT body FROM grants WHERE id=?1",[&id],|r|r.get(0))?;
+    let grant:SessionGrant=serde_json::from_str(&raw)?;
+    if !device_permissions(&db,&device)?.allows(&grant.permissions) {return Err(denied());}
+    let consent:bool=db.query_row("SELECT unattended FROM devices WHERE id=?1",[&device],|r|r.get(0))?;
+    if grant.unattended && !(consent && profile.allow_unattended){return Err(denied());}
+    if db.execute("UPDATE grants SET lease_until=?1 WHERE id=?2 AND claimed=1 AND lease_until>?3 AND closed=0",params![now()+300,id,now()])?!=1 {return Err(denied());}
+    Ok(Json(json!({"lease_until":now()+300})))
+}
+async fn close_grant(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>)->ApiResult {
+    let device=s.device(&headers)?;
+    s.db.lock().unwrap().execute("UPDATE grants SET closed=1 WHERE id=?1 AND device_id=?2",params![id,device])?;
+    s.audit(&device,"session.closed",&id)?;Ok(Json(json!({"ok":true})))
+}
+async fn audit(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.user(&headers,true)?;let db=s.db.lock().unwrap();let mut statement=db.prepare("SELECT at,actor,event,target FROM audit ORDER BY id DESC LIMIT 500")?;
+    let rows=statement.query_map([],|r|Ok(json!({"at":r.get::<_,u64>(0)?,"actor":r.get::<_,String>(1)?,"event":r.get::<_,String>(2)?,"target":r.get::<_,String>(3)?})))?.collect::<Result<Vec<_>,_>>()?;Ok(Json(json!(rows)))
+}
+async fn session_history(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    let user=s.user(&headers,false)?;let db=s.db.lock().unwrap();
+    let administrator:bool=db.query_row("SELECT role='admin' FROM users WHERE id=?1",[&user],|r|r.get(0))?;
+    let mut statement=db.prepare("SELECT g.id,g.body,g.claimed,g.closed,g.lease_until,d.name FROM grants g JOIN devices d ON d.id=g.device_id WHERE (?1=1 OR g.user_id=?2) ORDER BY g.rowid DESC LIMIT 200")?;
+    let rows=statement.query_map(params![administrator,user],|r|Ok((r.get::<_,String>(0)?,r.get::<_,String>(1)?,r.get::<_,bool>(2)?,r.get::<_,bool>(3)?,r.get::<_,u64>(4)?,r.get::<_,String>(5)?)))?.collect::<Result<Vec<_>,_>>()?;
+    let mut result=Vec::new();
+    for(id,body,claimed,closed,lease,name)in rows {let grant:SessionGrant=serde_json::from_str(&body)?;result.push(json!({"id":id,"technician_id":grant.technician_id,"device_id":grant.device_id,"device_name":name,"requested_at":grant.issued_at,"unattended":grant.unattended,"claimed":claimed,"closed":closed,"lease_until":lease}));}
+    Ok(Json(json!(result)))
+}
+#[derive(Deserialize)]
+struct ReleaseImport { envelope:SignedEnvelope, public_key:String }
+async fn import_release(State(s):State<Shared>,headers:HeaderMap,Json(input):Json<ReleaseImport>)->ApiResult {
+    let user=s.user(&headers,true)?;
+    // Project trust is configured by the operator, never accepted from the request.
+    let trusted=std::env::var("SWAN_RELEASE_PUBLIC_KEY").map_err(|_|bad("Project release trust key not configured"))?;
+    if input.public_key!=trusted {return Err(denied());}
+    let release:Release=input.envelope.verify(&public_key(&trusted)?).map_err(|_|denied())?;
+    release.validate(&release.edition,0,now()).map_err(|_|bad("Invalid release"))?;
+    let id=format!("{}-{:?}-{}",release.sequence,release.edition,release.channel);
+    s.db.lock().unwrap().execute("INSERT INTO releases(id,body,envelope,approved) VALUES(?1,?2,?3,0)",params![id,serde_json::to_string(&release)?,serde_json::to_string(&input.envelope)?])?;
+    s.audit(&user,"release.imported",&id)?;Ok(Json(json!({"id":id})))
+}
+async fn approve_release(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>)->ApiResult {
+    let user=s.user(&headers,true)?;let db=s.db.lock().unwrap();
+    let raw:String=db.query_row("SELECT body FROM releases WHERE id=?1",[&id],|r|r.get(0))?;
+    let release:Release=serde_json::from_str(&raw)?;
+    release.validate(&release.edition,0,now()).map_err(|_|bad("Release expired"))?;
+    db.execute("UPDATE releases SET approved=1 WHERE id=?1",[&id])?;drop(db);
+    s.audit(&user,"release.approved",&id)?;Ok(Json(json!({"ok":true})))
+}
+async fn releases(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.user(&headers,true)?;list_json(&s,"SELECT id,body,approved FROM releases",true)
+}
+fn list_json(s:&Store,sql:&str,approved:bool)->ApiResult {
+    let db=s.db.lock().unwrap();let mut stmt=db.prepare(sql)?;
+    let rows=stmt.query_map([],|r|Ok((r.get::<_,String>(0)?,r.get::<_,String>(1)?,if approved{r.get::<_,bool>(2)?}else{false})))?.collect::<Result<Vec<_>,_>>()?;
+    let mut values=Vec::new();
+    for (id,raw,approved) in rows {values.push(json!({"id":id,"data":serde_json::from_str::<Value>(&raw)?,"approved":approved}));}
+    Ok(Json(json!(values)))
+}
+#[derive(Default,Deserialize)]
+#[serde(deny_unknown_fields)]
+struct UpdateQuery {format:Option<String>}
+async fn device_update(State(s):State<Shared>,headers:HeaderMap,Query(query):Query<UpdateQuery>)->ApiResult {
+    let device=s.device(&headers)?;select_update(&s,&device,Edition::Customer,query.format.as_deref())
+}
+async fn technician_update(State(s):State<Shared>,headers:HeaderMap,Query(query):Query<UpdateQuery>)->ApiResult {
+    let user=s.user(&headers,false)?;select_update(&s,&user,Edition::Technician,query.format.as_deref())
+}
+fn select_update(s:&Store,device:&str,edition:Edition,format:Option<&str>)->ApiResult {
+    if format.map(|format|!["exe","msi"].contains(&format)).unwrap_or(false){return Err(bad("Invalid installer format"));}
+    let profile=s.profile()?;
+    let cohort=u8::from_str_radix(&digest(&device)[..2],16).map_err(|_|bad("Invalid device"))? as u32 * 100 / 256;
+    if profile.updates_paused || cohort>=profile.rollout_percent as u32 || !maintenance_open(profile.maintenance_start_utc,profile.maintenance_end_utc,now()) {return Ok(Json(Value::Null));}
+    let db=s.db.lock().unwrap();let mut stmt=db.prepare("SELECT body,envelope FROM releases WHERE approved=1")?;
+    let rows=stmt.query_map([],|r|Ok((r.get::<_,String>(0)?,r.get::<_,String>(1)?)))?.collect::<Result<Vec<_>,_>>()?;
+    let mut best:Option<(u64,Value)>=None;
+    for (body,envelope) in rows {let release:Release=serde_json::from_str(&body)?;
+        if release.edition==edition && format.map(|format|release.format==format).unwrap_or(true) && release.channel==profile.update_channel && release.expires_at>now() && best.as_ref().map(|b|b.0<release.sequence).unwrap_or(true) {best=Some((release.sequence,serde_json::from_str(&envelope)?));}}
+    Ok(Json(best.map(|v|v.1).unwrap_or(Value::Null)))
+}
+async fn create_worker(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    let user=s.user(&headers,true)?;let credential=random_token();let id=Uuid::new_v4().to_string();
+    s.db.lock().unwrap().execute("INSERT INTO workers(id,token_hash) VALUES(?1,?2)",params![id,digest(&credential)])?;
+    s.audit(&user,"worker.created",&id)?;Ok(Json(json!({"worker_id":id,"worker_token":credential})))
+}
+async fn workers(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.user(&headers,true)?;let db=s.db.lock().unwrap();
+    let mut statement=db.prepare("SELECT id,disabled FROM workers ORDER BY rowid DESC")?;
+    let rows=statement.query_map([],|r|Ok(json!({"worker_id":r.get::<_,String>(0)?,"disabled":r.get::<_,bool>(1)?})))?.collect::<Result<Vec<_>,_>>()?;
+    Ok(Json(json!(rows)))
+}
+async fn revoke_worker(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>)->ApiResult {
+    let actor=s.user(&headers,true)?;let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    let worker:Option<String>=tx.query_row("SELECT token_hash FROM workers WHERE id=?1",[&id],|r|r.get(0)).optional()?;
+    let worker=worker.ok_or(ApiError(StatusCode::NOT_FOUND,"Unknown worker"))?;
+    tx.execute("UPDATE workers SET disabled=1 WHERE id=?1",[&id])?;
+    // A revoked claim must never become retryable through the expiry sweep.
+    let cancelled=tx.execute("UPDATE builds SET state='failed',result=?1 WHERE worker=?2 AND state IN ('running','uploaded')",params![json!({"artifact_url":"","sha256":"","log":"Installer worker revoked"}).to_string(),worker])?;
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'worker.revoked',?3)",params![now(),actor,id])?;
+    tx.commit()?;Ok(Json(json!({"ok":true,"cancelled_builds":cancelled})))
+}
+#[derive(Deserialize)]
+struct BuildRequest { release_id:String }
+async fn create_build(State(s):State<Shared>,headers:HeaderMap,Json(input):Json<BuildRequest>)->ApiResult {
+    let actor=s.user(&headers,true)?;let mut profile=s.profile()?;
+    profile.issued_at=now();profile.expires_at=now()+7*86400;
+    let db=s.db.lock().unwrap();
+    let release:Option<(String,bool)>=db.query_row("SELECT envelope,approved FROM releases WHERE id=?1",[&input.release_id],|r|Ok((r.get(0)?,r.get(1)?))).optional()?;
+    let (envelope,approved)=release.ok_or(ApiError(StatusCode::NOT_FOUND,"Unknown release"))?;
+    if !approved{return Err(ApiError(StatusCode::CONFLICT,"Release must be approved before generating installers"));}
+    let id=Uuid::new_v4().to_string();let body=json!({"release":serde_json::from_str::<Value>(&envelope)?,"profile":SignedEnvelope::sign(&profile,&s.key)?,"profile_public_key":STANDARD.encode(s.key.verifying_key().as_bytes()),"release_public_key":std::env::var("SWAN_RELEASE_PUBLIC_KEY").map_err(|_|bad("Release key not configured"))?});
+    db.execute("INSERT INTO builds(id,body,state) VALUES(?1,?2,'queued')",params![id,body.to_string()])?;drop(db);s.audit(&actor,"build.queued",&id)?;Ok(Json(json!({"id":id})))
+}
+async fn builds(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.user(&headers,true)?;let db=s.db.lock().unwrap();let mut stmt=db.prepare("SELECT id,state,result FROM builds ORDER BY rowid DESC LIMIT 100")?;
+    let rows=stmt.query_map([],|r|Ok(json!({"id":r.get::<_,String>(0)?,"state":r.get::<_,String>(1)?,"result":r.get::<_,String>(2)?})))?.collect::<Result<Vec<_>,_>>()?;Ok(Json(json!(rows)))
+}
+async fn worker_recipe(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.worker(&headers)?;
+    Ok(Json(json!({"schema":1,"bundle_recipe":company_bundle_recipe()?})))
+}
+async fn claim_build(State(s):State<Shared>,headers:HeaderMap)->ApiResult {
+    s.worker(&headers)?;let worker=digest(token(&headers)?);
+    let recipe=company_bundle_recipe()?;
+    if headers.get(COMPANY_BUNDLE_RECIPE_HEADER).and_then(|value|value.to_str().ok())!=Some(recipe.as_str()) {
+        return Err(ApiError(StatusCode::CONFLICT,"Company bundle recipe mismatch; install matching server and worker releases. No job claimed"));
+    }
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    // Recheck under the claim transaction: revocation may follow the initial
+    // authentication check before this request acquires the database lock.
+    let enabled:bool=tx.query_row("SELECT EXISTS(SELECT 1 FROM workers WHERE token_hash=?1 AND disabled=0)",[&worker],|r|r.get(0))?;
+    if !enabled{return Err(unauthorized());}
+    // Expired claims are retryable; worker output is named by immutable job ID.
+    tx.execute("UPDATE builds SET state='queued',worker='' WHERE state IN ('running','uploaded') AND claimed_at<?1",[now().saturating_sub(3600)])?;
+    let row:Option<(String,String)>=tx.query_row("SELECT id,body FROM builds WHERE state='queued' ORDER BY rowid LIMIT 1",[],|r|Ok((r.get(0)?,r.get(1)?))).optional()?;
+    if let Some((id,body))=row {tx.execute("UPDATE builds SET state='running',worker=?1,claimed_at=?2 WHERE id=?3",params![worker,now(),id])?;tx.commit()?;Ok(Json(json!({"id":id,"job":serde_json::from_str::<Value>(&body)?})))} else {Ok(Json(Value::Null))}
+}
+#[derive(Deserialize)]
+struct BuildResult { success:bool, artifact_url:String,sha256:String,log:String }
+
+#[cfg(test)]
+mod session_identity_tests {
+    use super::*;
+    #[tokio::test]
+    async fn claimed_identity_comes_from_the_authorized_company_account() {
+        use tower::ServiceExt;
+        let directory=std::env::temp_dir().join(format!("swan-session-identity-{}",random_token()));
+        let store=Arc::new(Store::open(&directory).unwrap());
+        let technician_token=random_token();let device_token=random_token();let other_device_token=random_token();
+        let public=STANDARD.encode(store.key.verifying_key().as_bytes());
+        let profile=CompanyProfile{schema:1,company_id:"identity-test".into(),revision:1,issued_at:now()-1,expires_at:now()+3600,management_url:"https://support.example.com".into(),rendezvous:"support.example.com".into(),relay:"support.example.com".into(),transport_public_key:public.clone(),customer:Default::default(),technician:Default::default(),allow_unattended:false,updates_paused:true,rollout_percent:0,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:"test".into(),next_profile_public_key:None};
+        {
+            let db=store.db.lock().unwrap();
+            db.execute("INSERT INTO profile VALUES(1,?1)",[serde_json::to_string(&profile).unwrap()]).unwrap();
+            db.execute("INSERT INTO users(id,username,password_hash,totp_secret,role) VALUES('tech-id','company.tech','unused','unused','technician')",[]).unwrap();
+            db.execute("INSERT INTO sessions VALUES(?1,'tech-id',?2)",params![digest(&technician_token),now()+3600]).unwrap();
+            db.execute("INSERT INTO group_access VALUES('customers','tech-id')",[]).unwrap();
+            for (id,peer,token) in [("device","123",&device_token),("other-device","456",&other_device_token)] {
+                db.execute("INSERT INTO devices(id,name,rustdesk_id,token_hash,state,group_id) VALUES(?1,?1,?2,?3,'approved','customers')",params![id,peer,digest(token)]).unwrap();
+            }
+        }
+        let headers=|credential:&str| {let mut h=HeaderMap::new();h.insert(header::AUTHORIZATION,format!("Bearer {credential}").parse().unwrap());h};
+        let envelope:SignedEnvelope=serde_json::from_value(grant(State(store.clone()),headers(&technician_token),Json(GrantRequest{device_id:"device".into(),proof_public_key:public,unattended:false})).await.ok().unwrap().0).unwrap();
+        let original:SessionGrant=envelope.verify(&store.key.verifying_key()).unwrap();
+        let mut altered=original.clone();altered.technician_id="other-tech".into();
+        let wrong_identity=SignedEnvelope::sign(&altered,&store.key).unwrap();
+        let app=router(store.clone());
+        for (credential,envelope,expected) in [
+            (None,&envelope,StatusCode::UNAUTHORIZED),
+            (Some(other_device_token.as_str()),&envelope,StatusCode::FORBIDDEN),
+            (Some(device_token.as_str()),&wrong_identity,StatusCode::FORBIDDEN),
+            (Some(device_token.as_str()),&envelope,StatusCode::OK),
+            (Some(device_token.as_str()),&envelope,StatusCode::FORBIDDEN),
+        ] {
+            let mut request=axum::http::Request::builder().method("POST").uri("/api/v1/grants/claim").header(header::CONTENT_TYPE,"application/json");
+            if let Some(credential)=credential {request=request.header(header::AUTHORIZATION,format!("Bearer {credential}"));}
+            let body=json!({"grant":envelope,"technician":{"id":"tech-id","username":"Administrator"},"peer_name":"Administrator"});
+            let response=app.clone().oneshot(request.body(axum::body::Body::from(serde_json::to_vec(&body).unwrap())).unwrap()).await.unwrap();
+            assert_eq!(response.status(),expected);
+            if expected==StatusCode::OK {
+                let bytes=axum::body::to_bytes(response.into_body(),4096).await.unwrap();
+                let value:Value=serde_json::from_slice(&bytes).unwrap();
+                assert_eq!(value["technician"],json!({"id":"tech-id","username":"company.tech"}));
+                assert!(value["lease_until"].as_u64().unwrap()>now());
+            }
+        }
+        let claims:u64=store.db.lock().unwrap().query_row("SELECT COUNT(*) FROM audit WHERE event='session.claimed'",[],|row|row.get(0)).unwrap();
+        assert_eq!(claims,1);
+        drop(app);drop(store);std::fs::remove_dir_all(directory).unwrap();
+    }
+}
+
+#[cfg(test)]
+mod worker_completion_tests {
+    use super::*;
+    #[tokio::test]
+    async fn incompatible_worker_cannot_claim_or_requeue_jobs() {
+        use tower::ServiceExt;
+        let directory=std::env::temp_dir().join(format!("swan-worker-recipe-{}",random_token()));
+        let store=Arc::new(Store::open(&directory).unwrap());let credential=random_token();
+        {
+            let db=store.db.lock().unwrap();
+            db.execute("INSERT INTO workers(id,token_hash) VALUES('worker',?1)",[digest(&credential)]).unwrap();
+            db.execute("INSERT INTO builds(id,body,state,worker,claimed_at) VALUES('queued','{}','queued','',0),('expired','{}','running','other-worker',0)",[]).unwrap();
+        }
+        let app=router(store.clone());let recipe=company_bundle_recipe().unwrap();
+        let request=axum::http::Request::builder().uri("/api/v1/worker/recipe").body(axum::body::Body::empty()).unwrap();
+        assert_eq!(app.clone().oneshot(request).await.unwrap().status(),StatusCode::UNAUTHORIZED);
+        let request=axum::http::Request::builder().uri("/api/v1/worker/recipe")
+            .header(header::AUTHORIZATION,format!("Bearer {credential}")).body(axum::body::Body::empty()).unwrap();
+        let response=app.clone().oneshot(request).await.unwrap();assert_eq!(response.status(),StatusCode::OK);
+        let bytes=axum::body::to_bytes(response.into_body(),4096).await.unwrap();
+        assert_eq!(serde_json::from_slice::<Value>(&bytes).unwrap(),json!({"schema":1,"bundle_recipe":recipe}));
+        for (token,header,expected) in [
+            ("invalid",None,StatusCode::UNAUTHORIZED),
+            ("invalid",Some(recipe.as_str()),StatusCode::UNAUTHORIZED),
+            (credential.as_str(),None,StatusCode::CONFLICT),
+            (credential.as_str(),Some("old-recipe"),StatusCode::CONFLICT),
+            (credential.as_str(),Some(""),StatusCode::CONFLICT),
+        ] {
+            let mut request=axum::http::Request::builder().method("POST").uri("/api/v1/worker/claim").header(header::AUTHORIZATION,format!("Bearer {token}"));
+            if let Some(value)=header {request=request.header(COMPANY_BUNDLE_RECIPE_HEADER,value);}
+            let response=app.clone().oneshot(request.body(axum::body::Body::empty()).unwrap()).await.unwrap();
+            assert_eq!(response.status(),expected);
+            let db=store.db.lock().unwrap();
+            let queued:(String,String,i64)=db.query_row("SELECT state,worker,claimed_at FROM builds WHERE id='queued'",[],|r|Ok((r.get(0)?,r.get(1)?,r.get(2)?))).unwrap();
+            let expired:(String,String,i64)=db.query_row("SELECT state,worker,claimed_at FROM builds WHERE id='expired'",[],|r|Ok((r.get(0)?,r.get(1)?,r.get(2)?))).unwrap();
+            assert_eq!(queued,("queued".into(),"".into(),0));
+            assert_eq!(expired,("running".into(),"other-worker".into(),0));
+        }
+        let request=axum::http::Request::builder().method("POST").uri("/api/v1/worker/claim")
+            .header(header::AUTHORIZATION,format!("Bearer {credential}")).header(COMPANY_BUNDLE_RECIPE_HEADER,recipe)
+            .body(axum::body::Body::empty()).unwrap();
+        let response=app.clone().oneshot(request).await.unwrap();assert_eq!(response.status(),StatusCode::OK);
+        {
+            let db=store.db.lock().unwrap();
+            let claimed:i64=db.query_row("SELECT COUNT(*) FROM builds WHERE state='running' AND worker=?1",[digest(&credential)],|r|r.get(0)).unwrap();
+            let recovered:i64=db.query_row("SELECT COUNT(*) FROM builds WHERE state='queued'",[],|r|r.get(0)).unwrap();
+            assert_eq!(claimed,1);assert_eq!(recovered,1);
+        }
+        drop(app);drop(store);std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[tokio::test]
+    async fn administrator_revocation_cancels_claims_and_hides_credentials() {
+        let directory=std::env::temp_dir().join(format!("swan-worker-revocation-{}",random_token()));
+        let store=Arc::new(Store::open(&directory).unwrap());
+        let admin=random_token();let technician=random_token();let credential=random_token();let worker=digest(&credential);
+        {
+            let db=store.db.lock().unwrap();
+            for (id,role,token) in [("admin","admin",&admin),("technician","technician",&technician)] {
+                db.execute("INSERT INTO users(id,username,password_hash,totp_secret,role) VALUES(?1,?1,'unused','unused',?2)",params![id,role]).unwrap();
+                db.execute("INSERT INTO sessions VALUES(?1,?2,?3)",params![digest(token),id,now()+3600]).unwrap();
+            }
+            db.execute("INSERT INTO workers(id,token_hash) VALUES('worker',?1)",[&worker]).unwrap();
+            for state in ["running","uploaded","completed"] {
+                db.execute("INSERT INTO builds(id,body,state,worker,claimed_at) VALUES(?1,'{}',?1,?2,0)",params![state,worker]).unwrap();
+            }
+            db.execute("INSERT INTO builds(id,body,state,worker) VALUES('other','{}','running','other-worker')",[]).unwrap();
+        }
+        let headers=|token:&str| {let mut h=HeaderMap::new();h.insert(header::AUTHORIZATION,format!("Bearer {token}").parse().unwrap());h};
+        assert!(workers(State(store.clone()),HeaderMap::new()).await.is_err());
+        assert!(revoke_worker(State(store.clone()),headers(&technician),Path("worker".into())).await.is_err());
+        assert!(store.worker(&headers(&credential)).is_ok());
+        let listing=workers(State(store.clone()),headers(&admin)).await.ok().unwrap().0;
+        assert_eq!(listing,json!([{"worker_id":"worker","disabled":false}]));
+        assert!(!listing.to_string().contains(&worker));assert!(!listing.to_string().contains(&credential));
+        let result=revoke_worker(State(store.clone()),headers(&admin),Path("worker".into())).await.ok().unwrap().0;
+        assert_eq!(result["cancelled_builds"],2);
+        assert!(store.worker(&headers(&credential)).is_err());
+        assert!(claim_build(State(store.clone()),headers(&credential)).await.is_err());
+        assert!(persist_verified_artifact(&store,"uploaded",&worker,b"late bundle").is_err());
+        let result=BuildResult{success:false,artifact_url:String::new(),sha256:String::new(),log:"Late completion".into()};
+        assert!(finish_build(State(store.clone()),headers(&credential),Path("running".into()),Json(result)).await.is_err());
+        assert_eq!(revoke_worker(State(store.clone()),headers(&admin),Path("worker".into())).await.ok().unwrap().0["cancelled_builds"],0);
+        assert!(matches!(revoke_worker(State(store.clone()),headers(&admin),Path("missing".into())).await,Err(ApiError(StatusCode::NOT_FOUND,_))));
+        {
+            let db=store.db.lock().unwrap();
+            for (id,expected) in [("running","failed"),("uploaded","failed"),("completed","completed"),("other","running")] {
+                let state:String=db.query_row("SELECT state FROM builds WHERE id=?1",[id],|r|r.get(0)).unwrap();assert_eq!(state,expected);
+            }
+            let events:i64=db.query_row("SELECT COUNT(*) FROM audit WHERE event='worker.revoked' AND actor='admin' AND target='worker'",[],|r|r.get(0)).unwrap();assert_eq!(events,2);
+        }
+        use tower::ServiceExt;
+        let app=router(store.clone());
+        for (method,path,credential,expected) in [
+            ("GET","/api/v1/workers",None,StatusCode::UNAUTHORIZED),
+            ("GET","/api/v1/workers",Some(technician.as_str()),StatusCode::UNAUTHORIZED),
+            ("GET","/api/v1/workers",Some(admin.as_str()),StatusCode::OK),
+            ("DELETE","/api/v1/workers/worker",Some(technician.as_str()),StatusCode::UNAUTHORIZED),
+            ("DELETE","/api/v1/workers/worker",Some(admin.as_str()),StatusCode::OK),
+            ("DELETE","/api/v1/workers/missing",Some(admin.as_str()),StatusCode::NOT_FOUND),
+            ("POST","/api/v1/worker/claim",Some(credential.as_str()),StatusCode::UNAUTHORIZED),
+            ("PUT","/api/v1/worker/builds/uploaded/artifact",Some(credential.as_str()),StatusCode::UNAUTHORIZED),
+        ] {
+            let mut request=axum::http::Request::builder().method(method).uri(path);
+            if let Some(credential)=credential {request=request.header(header::AUTHORIZATION,format!("Bearer {credential}"));}
+            let response=app.clone().oneshot(request.body(axum::body::Body::empty()).unwrap()).await.unwrap();
+            assert_eq!(response.status(),expected,"{method} {path}");
+        }
+        drop(app);
+        drop(store);std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn compressed_artifact_hash_checks_expanded_limit_and_crc() {
+        use std::io::Write;
+        let payload=vec![42u8;256*1024];
+        let mut writer=zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+        writer.start_file("artifact.exe",zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated)).unwrap();
+        writer.write_all(&payload).unwrap();let bytes=writer.finish().unwrap().into_inner();
+        assert!(bytes.len()<payload.len()/100);
+        let mut archive=zip::ZipArchive::new(std::io::Cursor::new(&bytes)).unwrap();
+        assert_eq!(bounded_artifact_digest(archive.by_name("artifact.exe").unwrap(),payload.len() as u64).ok().unwrap(),digest(&payload));
+        assert!(bounded_artifact_digest(archive.by_name("artifact.exe").unwrap(),64*1024).is_err());
+        let mut corrupt=bytes.clone();
+        let central=corrupt.windows(4).position(|header|header==b"PK\x01\x02").unwrap();
+        corrupt[14]^=1;corrupt[central+16]^=1;
+        let mut archive=zip::ZipArchive::new(std::io::Cursor::new(corrupt)).unwrap();
+        assert!(bounded_artifact_digest(archive.by_name("artifact.exe").unwrap(),payload.len() as u64).is_err());
+    }
+    #[test]
+    fn worker_bundle_requires_complete_exact_recipe_and_company_trust() {
+        // Inert bytes exercise the upload contract; no installer or signing
+        // provider is invoked, and these fixtures are never published.
+        fn archive(entries:&[(String,Vec<u8>)])->Vec<u8> {
+            use std::io::Write;
+            let mut writer=zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+            let options=zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+            for (name,bytes) in entries {writer.start_file(name,options).unwrap();writer.write_all(bytes).unwrap();}
+            writer.finish().unwrap().into_inner()
+        }
+        let company=SigningKey::from_bytes(&[23;32]);let project=SigningKey::from_bytes(&[24;32]);
+        let company_public=STANDARD.encode(company.verifying_key().as_bytes());
+        let trust=STANDARD.encode(project.verifying_key().as_bytes());
+        let profile=CompanyProfile{schema:SCHEMA,company_id:"bundle-test".into(),revision:1,issued_at:now()-1,expires_at:now()+3600,management_url:"https://support.example.com".into(),rendezvous:"support.example.com".into(),relay:"support.example.com".into(),transport_public_key:company_public.clone(),customer:Default::default(),technician:Default::default(),allow_unattended:false,updates_paused:true,rollout_percent:0,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:"test".into(),next_profile_public_key:None};
+        let signed_profile=SignedEnvelope::sign(&profile,&company).unwrap();
+        for edition in [Edition::Customer,Edition::Technician] {for format in ["exe","msi"] {
+            let installer=b"inert installer fixture";let agent=b"inert agent fixture";
+            let executable=if edition==Edition::Customer {"Swan Remote Support.exe"}else{"SwanRemoteSupport-Technician.exe"};
+            let mut installed_files=vec![InstalledFile{path:executable.into(),sha256:digest(installer)}];
+            if edition==Edition::Customer {for name in ["librustdesk.dll","flutter_windows.dll"] {installed_files.push(InstalledFile{path:name.into(),sha256:digest(b"inert library fixture")});}}
+            let release=Release{schema:SCHEMA,product:PRODUCT.into(),version:"2.0.0".into(),sequence:1,edition:edition.clone(),architecture:"x64".into(),channel:"test".into(),expires_at:now()+3600,artifact_url:format!("https://releases.example/install.{format}"),sha256:digest(installer),installed_sha256:digest(installer),installed_files,agent_url:"https://releases.example/agent.exe".into(),agent_sha256:digest(agent),publisher:"Inert fixture".into(),publisher_certificate_sha256:"d".repeat(64),windows_versions:vec!["windows_11".into()],source_url:"https://releases.example/source.tar.gz".into(),format:format.into(),rollback_protocol:1};
+            release.validate(&edition,0,now()).unwrap();
+            let signed_release=SignedEnvelope::sign(&release,&project).unwrap();
+            let job=json!({"profile":signed_profile,"release":signed_release});
+            let bootstrap=swan_agent::Bootstrap{schema:SCHEMA,edition:edition.clone(),company_id:profile.company_id.clone(),management_url:profile.management_url.clone(),profile_public_key:company_public.clone(),release_public_key:trust.clone()};
+            let mut entries=vec![
+                (format!("SwanRemoteSupport-install.{format}"),installer.to_vec()),("swan-agent.exe".into(),agent.to_vec()),
+                ("bootstrap.json".into(),serde_json::to_vec_pretty(&bootstrap).unwrap()),
+                ("company-profile.json".into(),serde_json::to_vec_pretty(&signed_profile).unwrap()),
+                ("release.json".into(),serde_json::to_vec_pretty(&signed_release).unwrap()),
+            ];
+            for (name,bytes) in COMPANY_BUNDLE_TEXT_FILES {entries.push((name.into(),bundle_text(bytes).unwrap()));}
+            let recipe_count=5+COMPANY_BUNDLE_TEXT_FILES.len();
+            assert_eq!(entries.len(),recipe_count);
+            let verify=|bytes:&[u8]|validate_worker_bundle(bytes,&job,&release,&company.verifying_key(),&trust).is_ok();
+            let valid=archive(&entries);assert!(verify(&valid),"Complete {edition:?}/{format} bundle was rejected");
+            let entrypoint=entries.iter().position(|(name,_)|name=="Install-SwanRemoteSupport.cmd").unwrap();
+            let mut altered=entries.clone();altered[entrypoint].1=b"altered setup entry point".to_vec();assert!(!verify(&archive(&altered)));
+            let mut missing=entries.clone();missing.remove(entrypoint);assert!(!verify(&archive(&missing)));
+            let helper=entries.iter().position(|(name,_)|name=="Get-MsiInstallMode.ps1").unwrap();
+            let mut altered=entries.clone();altered[helper].1=b"altered script".to_vec();assert!(!verify(&archive(&altered)));
+            let uninstall=entries.iter().position(|(name,_)|name=="Uninstall-Technician.ps1").unwrap();
+            let mut altered=entries.clone();altered[uninstall].1=b"altered uninstall script".to_vec();assert!(!verify(&archive(&altered)));
+            let mut missing=entries.clone();missing.remove(helper);assert!(!verify(&archive(&missing)));
+            let mut extra=entries.clone();extra.push(("extra.dll".into(),b"unexpected".to_vec()));assert!(!verify(&archive(&extra)));
+            let mut renamed=entries.clone();renamed[helper].0="Get-MsiInstallM0de.ps1".into();assert!(!verify(&archive(&renamed)));
+            let mut binary=entries.clone();binary[0].1=b"different installer".to_vec();assert!(!verify(&archive(&binary)));
+            for index in [3,4] {
+                let mut hidden=entries.clone();let mut metadata:Value=serde_json::from_slice(&hidden[index].1).unwrap();
+                metadata["technician_token"]=json!("inert secret canary");hidden[index].1=serde_json::to_vec_pretty(&metadata).unwrap();
+                assert!(!verify(&archive(&hidden)),"Unsigned fields cannot enter public bundles");
+            }
+            let mut duplicate_json=entries.clone();
+            let mut metadata=b"{\"payload\":\"inert secret canary\",".to_vec();
+            metadata.extend_from_slice(&duplicate_json[3].1[1..]);duplicate_json[3].1=metadata;
+            assert!(!verify(&archive(&duplicate_json)),"Duplicate JSON keys cannot hide discarded metadata");
+            for (field,value) in [("company_id",json!("wrong-company")),("schema",json!(2)),("management_url",json!("https://wrong.example.com")),("edition",json!(if edition==Edition::Customer {"technician"}else{"customer"}))] {
+                let mut wrong=entries.clone();let mut metadata:Value=serde_json::from_slice(&wrong[2].1).unwrap();metadata[field]=value;
+                // Serialize through Bootstrap so the fixture keeps the worker's field order.
+                let bootstrap:swan_agent::Bootstrap=serde_json::from_value(metadata).unwrap();wrong[2].1=serde_json::to_vec_pretty(&bootstrap).unwrap();
+                assert!(!verify(&archive(&wrong)),"Wrong bootstrap {field} accepted");
+            }
+            let mut local_name=valid.clone();local_name[30]=b'X';assert!(!verify(&local_name),"Local and central filenames must agree");
+            let mut truncated=valid.clone();truncated.pop();assert!(!verify(&truncated));
+            let mut prefixed=b"MZ".to_vec();prefixed.extend_from_slice(&valid);assert!(!verify(&prefixed));
+            // zip 2.4.2 hides duplicate names behind its unique-name map. Build
+            // a distinct alias, then change both header names to the real helper.
+            let alias=b"Get-MsiInstallM0de.ps1";let canonical=b"Get-MsiInstallMode.ps1";
+            let mut duplicate=entries.clone();duplicate.push((String::from_utf8(alias.to_vec()).unwrap(),entries[helper].1.clone()));
+            let mut duplicate=archive(&duplicate);
+            for offset in 0..=duplicate.len()-alias.len() {if &duplicate[offset..offset+alias.len()]==alias {duplicate[offset..offset+alias.len()].copy_from_slice(canonical);}}
+            assert_eq!(zip::ZipArchive::new(std::io::Cursor::new(&duplicate)).unwrap().len(),recipe_count,"Regression must exercise hidden physical duplicates");
+            assert!(!verify(&duplicate));
+            let footer=duplicate.len()-22;let count=(recipe_count as u16).to_le_bytes();
+            duplicate[footer+8..footer+10].copy_from_slice(&count);duplicate[footer+10..footer+12].copy_from_slice(&count);
+            assert!(!verify(&duplicate),"Forged entry counts cannot hide duplicate records");
+            let mut expired=profile.clone();expired.expires_at=now();let expired=SignedEnvelope::sign(&expired,&company).unwrap();
+            let mut expired_entries=entries.clone();expired_entries[3].1=serde_json::to_vec_pretty(&expired).unwrap();
+            let expired_job=json!({"profile":expired,"release":signed_release});
+            assert!(validate_worker_bundle(&archive(&expired_entries),&expired_job,&release,&company.verifying_key(),&trust).is_err());
+        }}
+    }
+    #[test]
+    fn legacy_schema_migration_requires_encrypted_backup_and_keeps_original_key() {
+        let directory=std::env::temp_dir().join(format!("swan-key-migration-{}",random_token()));
+        let initial=Store::open(&directory).unwrap();let public=initial.key.verifying_key();
+        initial.db.lock().unwrap().execute_batch("DROP TABLE profile_signing_keys;PRAGMA user_version=1;").unwrap();drop(initial);
+        assert!(Store::open_with_backup_password(&directory,None).is_err());
+        let db=Connection::open(directory.join("management.sqlite3")).unwrap();assert_eq!(db.pragma_query_value(None,"user_version",|r|r.get::<_,u32>(0)).unwrap(),1);drop(db);
+        let upgraded=Store::open_with_backup_password(&directory,Some("schema migration backup password")).unwrap();assert_eq!(upgraded.key.verifying_key(),public);
+        let archive=std::fs::read_dir(&directory).unwrap().map(|e|e.unwrap().path()).find(|path|path.extension().is_some_and(|e|e=="swan-backup")).unwrap();drop(upgraded);
+        let restored_path=directory.with_extension("restored");crate::backup::restore(&restored_path,&archive,"schema migration backup password").unwrap();
+        let db=Connection::open(restored_path.join("management.sqlite3")).unwrap();assert_eq!(db.pragma_query_value(None,"user_version",|r|r.get::<_,u32>(0)).unwrap(),1);drop(db);
+        std::fs::remove_dir_all(directory).unwrap();std::fs::remove_dir_all(restored_path).unwrap();
+    }
+    #[test]
+    fn profile_key_rotation_is_atomic_survives_backup_and_requires_published_transition() {
+        let directory=std::env::temp_dir().join(format!("swan-server-key-rotation-{}",random_token()));
+        let store=Store::open(&directory).unwrap();assert!(Store::open(&directory).is_err());
+        let old=store.key.verifying_key();let old_public=STANDARD.encode(old.as_bytes());
+        let profile=CompanyProfile{schema:1,company_id:"rotation-test".into(),revision:1,issued_at:now()-1,expires_at:now()+3600,management_url:"https://support.example.com".into(),rendezvous:"support.example.com".into(),relay:"support.example.com".into(),transport_public_key:old_public.clone(),customer:Default::default(),technician:Default::default(),allow_unattended:false,updates_paused:true,rollout_percent:0,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:"test".into(),next_profile_public_key:None};
+        store.db.lock().unwrap().execute("INSERT INTO profile VALUES(1,?1)",[serde_json::to_string(&profile).unwrap()]).unwrap();
+        assert!(store.activate_profile_rotation().is_err());
+        let next=store.prepare_profile_rotation().unwrap();assert_ne!(next,old_public);assert!(store.prepare_profile_rotation().is_err());
+        let transition=store.profile().unwrap();assert_eq!(transition.revision,2);assert_eq!(transition.next_profile_public_key.as_ref(),Some(&next));
+        let envelope=SignedEnvelope::sign(&transition,&store.key).unwrap();assert!(envelope.verify::<CompanyProfile>(&old).is_ok());
+        let mut altered=transition.clone();altered.next_profile_public_key=Some(old_public);
+        store.db.lock().unwrap().execute("UPDATE profile SET body=?1 WHERE id=1",[serde_json::to_string(&altered).unwrap()]).unwrap();
+        assert!(store.activate_profile_rotation().is_err());
+        store.db.lock().unwrap().execute("UPDATE profile SET body=?1 WHERE id=1",[serde_json::to_string(&transition).unwrap()]).unwrap();
+        assert_eq!(store.activate_profile_rotation().unwrap(),next);drop(store);
+        let restarted=Store::open(&directory).unwrap();assert_eq!(STANDARD.encode(restarted.key.verifying_key().as_bytes()),next);
+        let activated=restarted.profile().unwrap();assert_eq!(activated.revision,3);assert!(activated.next_profile_public_key.is_none());
+        let signed=SignedEnvelope::sign(&activated,&restarted.key).unwrap();assert!(signed.verify::<CompanyProfile>(&old).is_err());assert!(signed.verify::<CompanyProfile>(&public_key(&next).unwrap()).is_ok());
+        let archive=directory.with_extension("backup");crate::backup::export(&directory,&archive,"rotation backup test passphrase").unwrap();drop(restarted);
+        let restored_path=directory.with_extension("restored");crate::backup::restore(&restored_path,&archive,"rotation backup test passphrase").unwrap();
+        let restored=Store::open(&restored_path).unwrap();assert_eq!(STANDARD.encode(restored.key.verifying_key().as_bytes()),next);assert_eq!(restored.profile().unwrap().revision,3);drop(restored);
+        std::fs::remove_dir_all(directory).unwrap();std::fs::remove_dir_all(restored_path).unwrap();std::fs::remove_file(archive).unwrap();
+    }
+    #[tokio::test]
+    async fn release_withdrawal_requires_admin_and_stops_update_selection() {
+        let directory=std::env::temp_dir().join(format!("swan-release-withdrawal-{}",random_token()));
+        let store=std::sync::Arc::new(Store::open(&directory).unwrap());
+        let public=STANDARD.encode(store.key.verifying_key().as_bytes());
+        let profile=CompanyProfile{schema:1,company_id:"release-test".into(),revision:1,issued_at:now()-1,expires_at:now()+3600,management_url:"https://support.example.com".into(),rendezvous:"support.example.com".into(),relay:"support.example.com".into(),transport_public_key:public,customer:Default::default(),technician:Default::default(),allow_unattended:false,updates_paused:false,rollout_percent:100,maintenance_start_utc:0,maintenance_end_utc:0,update_channel:"stable".into(),next_profile_public_key:None};
+        let release=Release{schema:1,product:PRODUCT.into(),version:"2.0.0".into(),sequence:1,edition:Edition::Technician,architecture:"x64".into(),channel:"stable".into(),expires_at:now()+3600,artifact_url:"https://releases.example/install.msi".into(),sha256:"a".repeat(64),installed_sha256:"b".repeat(64),installed_files:vec![InstalledFile{path:"SwanRemoteSupport-Technician.exe".into(),sha256:"b".repeat(64)}],agent_url:"https://releases.example/agent.exe".into(),agent_sha256:"c".repeat(64),publisher:"Example".into(),publisher_certificate_sha256:"d".repeat(64),windows_versions:vec!["windows_11".into()],source_url:"https://releases.example/source.tar.gz".into(),format:"msi".into(),rollback_protocol:0};
+        let envelope=SignedEnvelope::sign(&release,&store.key).unwrap();
+        let admin_token=random_token();let technician_token=random_token();
+        let completed=Uuid::new_v4().to_string();
+        let in_flight=Uuid::new_v4().to_string();let worker_token=random_token();let worker=digest(&worker_token);
+        {
+            let db=store.db.lock().unwrap();
+            db.execute("INSERT INTO profile VALUES(1,?1)",[serde_json::to_string(&profile).unwrap()]).unwrap();
+            for (id,role,credential) in [("admin","admin",&admin_token),("technician","technician",&technician_token)] {
+                db.execute("INSERT INTO users(id,username,password_hash,totp_secret,role) VALUES(?1,?1,'unused','unused',?2)",params![id,role]).unwrap();
+                db.execute("INSERT INTO sessions VALUES(?1,?2,?3)",params![digest(credential),id,now()+3600]).unwrap();
+            }
+            db.execute("INSERT INTO releases VALUES('release',?1,?2,1)",params![serde_json::to_string(&release).unwrap(),serde_json::to_string(&envelope).unwrap()]).unwrap();
+            let job=json!({"release":envelope}).to_string();
+            for state in ["queued","running","uploaded"] {db.execute("INSERT INTO builds(id,body,state) VALUES(?1,?2,?1)",params![state,job]).unwrap();}
+            db.execute("INSERT INTO builds(id,body,state) VALUES(?1,?2,'completed')",params![completed,job]).unwrap();
+            db.execute("INSERT INTO workers(id,token_hash) VALUES('worker',?1)",[&worker]).unwrap();
+            db.execute("INSERT INTO builds(id,body,state,worker,claimed_at) VALUES(?1,?2,'running',?3,?4)",params![in_flight,job,worker,now()]).unwrap();
+        }
+        persist_verified_artifact(&store,&in_flight,&worker,b"previously validated bundle").ok().unwrap();
+        let headers=|credential:&str| {let mut h=HeaderMap::new();h.insert(header::AUTHORIZATION,format!("Bearer {credential}").parse().unwrap());h};
+        let build_count=||store.db.lock().unwrap().query_row("SELECT COUNT(*) FROM builds",[],|r|r.get::<_,u64>(0)).unwrap();
+        let before=build_count();
+        let request=||Json(BuildRequest{release_id:"release".into()});
+        assert_eq!(create_build(State(store.clone()),HeaderMap::new(),request()).await.err().unwrap().0,StatusCode::UNAUTHORIZED);
+        assert_eq!(create_build(State(store.clone()),headers(&technician_token),request()).await.err().unwrap().0,StatusCode::UNAUTHORIZED);
+        assert_eq!(create_build(State(store.clone()),headers(&admin_token),Json(BuildRequest{release_id:"missing".into()})).await.err().unwrap().0,StatusCode::NOT_FOUND);
+        store.db.lock().unwrap().execute("UPDATE releases SET approved=0 WHERE id='release'",[]).unwrap();
+        assert_eq!(create_build(State(store.clone()),headers(&admin_token),request()).await.err().unwrap().0,StatusCode::CONFLICT);
+        assert_eq!(build_count(),before);
+        store.db.lock().unwrap().execute("UPDATE releases SET approved=1 WHERE id='release'",[]).unwrap();
+        assert!(!select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0.is_null());
+        assert!(select_update(&store,"device",Edition::Customer,None).ok().unwrap().0.is_null());
+        let mut portable=release.clone();portable.sequence=2;portable.format="exe".into();portable.sha256=portable.installed_sha256.clone();
+        release.validate(&Edition::Technician,0,now()).unwrap();portable.validate(&Edition::Technician,0,now()).unwrap();
+        let portable_envelope=SignedEnvelope::sign(&portable,&store.key).unwrap();
+        store.db.lock().unwrap().execute("INSERT INTO releases VALUES('portable-release',?1,?2,1)",params![serde_json::to_string(&portable).unwrap(),serde_json::to_string(&portable_envelope).unwrap()]).unwrap();
+        assert_eq!(select_update(&store,"technician",Edition::Technician,Some("msi")).ok().unwrap().0,serde_json::to_value(&envelope).unwrap());
+        assert_eq!(select_update(&store,"technician",Edition::Technician,Some("exe")).ok().unwrap().0,serde_json::to_value(&portable_envelope).unwrap());
+        assert_eq!(select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0,serde_json::to_value(&portable_envelope).unwrap());
+        assert!(select_update(&store,"technician",Edition::Technician,Some("zip")).is_err());
+        assert!(technician_update(State(store.clone()),HeaderMap::new(),Query(UpdateQuery{format:Some("exe".into())})).await.is_err());
+        assert!(device_update(State(store.clone()),HeaderMap::new(),Query(UpdateQuery{format:Some("msi".into())})).await.is_err());
+        assert_eq!(technician_update(State(store.clone()),headers(&technician_token),Query(UpdateQuery{format:Some("msi".into())})).await.ok().unwrap().0,serde_json::to_value(&envelope).unwrap());
+        store.db.lock().unwrap().execute("UPDATE releases SET approved=0 WHERE id='portable-release'",[]).unwrap();
+        assert!(select_update(&store,"technician",Edition::Technician,Some("exe")).ok().unwrap().0.is_null());
+        let save_policy=|policy:&CompanyProfile| {store.db.lock().unwrap().execute("UPDATE profile SET body=?1 WHERE id=1",[serde_json::to_string(policy).unwrap()]).unwrap();};
+        let mut paused=profile.clone();paused.updates_paused=true;save_policy(&paused);
+        assert!(select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0.is_null());
+        let mut staged=profile.clone();staged.rollout_percent=0;save_policy(&staged);
+        assert!(select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0.is_null());
+        let mut channel=profile.clone();channel.update_channel="test".into();save_policy(&channel);
+        assert!(select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0.is_null());
+        save_policy(&profile);
+        assert!(withdraw_release(State(store.clone()),headers(&technician_token),Path("release".into())).await.is_err());
+        assert!(!select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0.is_null());
+        assert!(withdraw_release(State(store.clone()),headers(&admin_token),Path("release".into())).await.is_ok());
+        assert!(select_update(&store,"technician",Edition::Technician,None).ok().unwrap().0.is_null());
+        assert!(withdraw_release(State(store.clone()),headers(&admin_token),Path("missing".into())).await.is_err());
+        let cancelled:i64=store.db.lock().unwrap().query_row("SELECT COUNT(*) FROM builds WHERE state='failed'",[],|r|r.get(0)).unwrap();assert_eq!(cancelled,4);
+        assert!(persist_verified_artifact(&store,&in_flight,&worker,b"late replacement").is_err());
+        let late_result=BuildResult{success:false,artifact_url:String::new(),sha256:String::new(),log:"Worker reports a different terminal outcome".into()};
+        assert!(finish_build(State(store.clone()),headers(&worker_token),Path(in_flight.clone()),Json(late_result)).await.is_err());
+        let late_success=BuildResult{success:true,artifact_url:format!("{}/api/v1/downloads/{in_flight}",profile.management_url),sha256:digest(b"previously validated bundle"),log:"Worker finished after withdrawal".into()};
+        assert!(finish_build(State(store.clone()),headers(&worker_token),Path(in_flight.clone()),Json(late_success)).await.is_err());
+        assert_eq!(std::fs::read(store.artifact_dir.join(format!("{in_flight}.zip"))).unwrap(),b"previously validated bundle");
+        assert!(matches!(download_artifact(State(store.clone()),Path(completed),HeaderMap::new()).await,Err(ApiError(StatusCode::NOT_FOUND,_))));
+        let audit:i64=store.db.lock().unwrap().query_row("SELECT COUNT(*) FROM audit WHERE event='release.withdrawn'",[],|r|r.get(0)).unwrap();assert_eq!(audit,1);
+        // Restoring release approval cannot revive a cancelled worker claim.
+        store.db.lock().unwrap().execute("UPDATE releases SET approved=1 WHERE id='release'",[]).unwrap();
+        assert!(persist_verified_artifact(&store,&in_flight,&worker,b"late replacement").is_err());
+        let mut matching=headers(&worker_token);matching.insert(COMPANY_BUNDLE_RECIPE_HEADER,company_bundle_recipe().unwrap().parse().unwrap());
+        assert!(claim_build(State(store.clone()),matching).await.ok().unwrap().0.is_null());
+        drop(store);std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[test]
+    fn uploaded_artifact_retry_preserves_bytes_and_owner() {
+        let directory=std::env::temp_dir().join(format!("swan-upload-retry-{}",random_token()));
+        let store=Store::open(&directory).unwrap();let id=Uuid::new_v4().to_string();
+        store.db.lock().unwrap().execute("INSERT INTO builds(id,body,state,worker) VALUES(?1,'{}','running','owner')",[&id]).unwrap();
+        assert!(persist_verified_artifact(&store,&id,"owner",b"validated bundle").is_ok());
+        assert!(persist_verified_artifact(&store,&id,"owner",b"validated bundle").is_ok());
+        assert!(persist_verified_artifact(&store,&id,"owner",b"different bundle").is_err());
+        assert!(persist_verified_artifact(&store,&id,"other-worker",b"validated bundle").is_err());
+        assert_eq!(std::fs::read(store.artifact_dir.join(format!("{id}.zip"))).unwrap(),b"validated bundle");
+        store.db.lock().unwrap().execute("UPDATE builds SET state='completed' WHERE id=?1",[&id]).unwrap();
+        assert!(persist_verified_artifact(&store,&id,"owner",b"validated bundle").is_err());
+        drop(store);std::fs::remove_dir_all(directory).unwrap();
+    }
+    #[tokio::test]
+    async fn lost_completion_response_retries_without_changing_terminal_result() {
+        let directory=std::env::temp_dir().join(format!("swan-worker-retry-{}",random_token()));
+        let store=Arc::new(Store::open(&directory).unwrap());
+        let credential=random_token();let worker=digest(&credential);let id=Uuid::new_v4().to_string();
+        {
+            let db=store.db.lock().unwrap();
+            db.execute("INSERT INTO workers(id,token_hash) VALUES('test',?1)",[&worker]).unwrap();
+            db.execute("INSERT INTO builds(id,body,state,worker) VALUES(?1,'{}','running',?2)",params![id,worker]).unwrap();
+        }
+        let mut headers=HeaderMap::new();headers.insert(header::AUTHORIZATION,format!("Bearer {credential}").parse().unwrap());
+        let result=||BuildResult{success:false,artifact_url:String::new(),sha256:String::new(),log:"Rejected invalid package".into()};
+        assert!(finish_build(State(store.clone()),headers.clone(),Path(id.clone()),Json(result())).await.is_ok());
+        assert!(finish_build(State(store.clone()),headers.clone(),Path(id.clone()),Json(result())).await.is_ok());
+        let mut changed=result();changed.log="Different outcome".into();
+        assert!(finish_build(State(store.clone()),headers.clone(),Path(id.clone()),Json(changed)).await.is_err());
+        store.db.lock().unwrap().execute("UPDATE workers SET disabled=1",[]).unwrap();
+        assert!(finish_build(State(store.clone()),headers,Path(id.clone()),Json(result())).await.is_err());
+        let saved:String=store.db.lock().unwrap().query_row("SELECT result FROM builds WHERE id=?1",[id],|r|r.get(0)).unwrap();
+        assert_eq!(serde_json::from_str::<Value>(&saved).unwrap()["log"],"Rejected invalid package");
+        drop(store);std::fs::remove_dir_all(directory).unwrap();
+    }
+}
+async fn withdraw_release(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>)->ApiResult {
+    let user=s.user(&headers,true)?;
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    if tx.execute("UPDATE releases SET approved=0 WHERE id=?1",[&id])?!=1{return Err(bad("Unknown release"));}
+    let envelope:String=tx.query_row("SELECT envelope FROM releases WHERE id=?1",[&id],|r|r.get(0))?;
+    let envelope:Value=serde_json::from_str(&envelope)?;
+    let jobs={let mut statement=tx.prepare("SELECT id,body FROM builds WHERE state IN ('queued','running','uploaded')")?;
+        let rows=statement.query_map([],|r|Ok((r.get::<_,String>(0)?,r.get::<_,String>(1)?)))?.collect::<Result<Vec<_>,_>>()?;rows};
+    for (job,body) in jobs {
+        if serde_json::from_str::<Value>(&body)?["release"]==envelope {
+            let result=json!({"artifact_url":"","sha256":"","log":"Release approval withdrawn"});
+            tx.execute("UPDATE builds SET state='failed',result=?1 WHERE id=?2",params![result.to_string(),job])?;
+        }
+    }
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'release.withdrawn',?3)",params![now(),user,id])?;
+    tx.commit()?;Ok(Json(json!({"ok":true})))
+}
+async fn revoke_group_access(State(s):State<Shared>,headers:HeaderMap,Path((group,user)):Path<(String,String)>)->ApiResult {
+    let actor=s.user(&headers,true)?;
+    if group.len()>64 || group.is_empty(){return Err(bad("Invalid group"));}
+    let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+    tx.execute("DELETE FROM group_access WHERE group_id=?1 AND user_id=?2",params![group,user])?;
+    // Re-granting access must not revive authorization issued before revocation.
+    tx.execute("UPDATE grants SET closed=1,lease_until=0 WHERE user_id=?1 AND device_id IN (SELECT id FROM devices WHERE group_id=?2)",params![user,group])?;
+    tx.execute("INSERT INTO audit(at,actor,event,target) VALUES(?1,?2,'group.access_revoked',?3)",params![now(),actor,format!("{group}/{user}")])?;
+    tx.commit()?;
+    Ok(Json(json!({"ok":true})))
+}
+async fn finish_build(State(s):State<Shared>,headers:HeaderMap,Path(id):Path<String>,Json(input):Json<BuildResult>)->ApiResult {
+    s.worker(&headers)?;
+    if Uuid::parse_str(&id).is_err(){return Err(bad("Invalid build identity"));}
+    let worker=digest(token(&headers)?);
+    if input.log.len()>8192 || (input.success && (https_url(&input.artifact_url).is_err() || input.sha256.len()!=64 || !input.sha256.bytes().all(|b|b.is_ascii_hexdigit()))) {return Err(bad("Invalid build result"));}
+    let result=json!({"artifact_url":input.artifact_url,"sha256":input.sha256,"log":input.log});
+    let terminal=if input.success{"completed"}else{"failed"};
+    let previous:Option<(String,String)>=s.db.lock().unwrap().query_row(
+        "SELECT state,result FROM builds WHERE id=?1 AND worker=?2",params![id,worker],
+        |r|Ok((r.get(0)?,r.get(1)?))).optional()?;
+    match previous {
+        Some((state,saved)) if state==terminal && serde_json::from_str::<Value>(&saved)?==result=>return Ok(Json(json!({"ok":true}))),
+        Some((state,_)) if state=="running" || state=="uploaded"=>{},
+        _=>return Err(denied()),
+    }
+    if input.success {
+        let expected=format!("{}/api/v1/downloads/{id}",s.profile()?.management_url.trim_end_matches('/'));
+        if input.artifact_url!=expected{return Err(bad("Artifact URL must use this company server"));}
+        let bytes=tokio::fs::read(s.artifact_dir.join(format!("{id}.zip"))).await.map_err(|_|bad("Verified artifact upload required"))?;
+        if !digest(bytes).eq_ignore_ascii_case(&input.sha256){return Err(bad("Uploaded artifact hash mismatch"));}
+    }
+    let db=s.db.lock().unwrap();
+    let count=db.execute("UPDATE builds SET state=?1,result=?2 WHERE id=?3 AND worker=?4 AND (state='uploaded' OR (state='running' AND ?5=0))",params![terminal,result.to_string(),id,worker,input.success])?;
+    if count!=1 {
+        let saved:Option<String>=db.query_row("SELECT result FROM builds WHERE id=?1 AND worker=?2 AND state=?3",params![id,worker,terminal],|r|r.get(0)).optional()?;
+        if saved.map(|value|serde_json::from_str::<Value>(&value)).transpose()?.as_ref()!=Some(&result){return Err(denied());}
+    }
+    Ok(Json(json!({"ok":true})))
+}
+
+async fn upload_artifact(State(s):State<Shared>,Path(id):Path<String>,request:axum::extract::Request)->ApiResult {
+    s.worker(request.headers())?;
+    if id.len()!=36 || !id.bytes().all(|c|c.is_ascii_hexdigit() || c==b'-'){return Err(bad("Invalid build identity"));}
+    let worker=digest(token(request.headers())?);
+    let job:String=s.db.lock().unwrap().query_row("SELECT body FROM builds WHERE id=?1 AND worker=?2 AND state IN ('running','uploaded')",params![id,worker],|r|r.get(0)).optional()?.ok_or_else(denied)?;
+    let bytes=axum::body::to_bytes(request.into_body(),512*1024*1024).await.map_err(|_|bad("Artifact too large"))?;
+    let job:Value=serde_json::from_str(&job)?;
+    let release_envelope:SignedEnvelope=serde_json::from_value(job["release"].clone())?;
+    let trust=std::env::var("SWAN_RELEASE_PUBLIC_KEY").map_err(|_|bad("Release key not configured"))?;
+    let release:Release=release_envelope.verify(&public_key(&trust)?).map_err(|_|denied())?;
+    release.validate(&release.edition,0,now()).map_err(|_|bad("Expired release"))?;
+    let company_key=s.key.verifying_key();
+    let hash=tokio::task::spawn_blocking(move || {
+        validate_worker_bundle(&bytes,&job,&release,&company_key,&trust)?;
+        let hash=digest(&bytes);
+        persist_verified_artifact(&s,&id,&worker,&bytes)?;
+        Ok::<_,ApiError>(hash)
+    })
+        .await.map_err(|_|bad("Artifact persistence failed"))??;
+    Ok(Json(json!({"sha256":hash})))
+}
+
+fn validate_bundle_zip_layout(bytes:&[u8],count:usize)->Result<(),ApiError> {
+    // Admit the worker's bounded, seek-written ZIP32 recipe only. zip 2.4.2
+    // deduplicates central-directory names, so ZipArchive::len alone cannot
+    // establish that an archive has exactly the expected physical entries.
+    let range=|offset:usize,length:usize|->Result<&[u8],ApiError>{
+        bytes.get(offset..offset.checked_add(length).ok_or_else(||bad("Invalid ZIP bounds"))?).ok_or_else(||bad("Invalid ZIP bounds"))
+    };
+    let word=|offset:usize|->Result<usize,ApiError>{let data=range(offset,2)?;Ok(u16::from_le_bytes([data[0],data[1]]) as usize)};
+    let dword=|offset:usize|->Result<usize,ApiError>{let data=range(offset,4)?;Ok(u32::from_le_bytes([data[0],data[1],data[2],data[3]]) as usize)};
+    let end=bytes.len().checked_sub(22).ok_or_else(||bad("Incomplete ZIP footer"))?;
+    if range(end,4)?!=b"PK\x05\x06" || word(end+4)?!=0 || word(end+6)?!=0 || word(end+8)?!=count || word(end+10)?!=count || word(end+20)?!=0 {return Err(bad("Unexpected ZIP footer"));}
+    let start=dword(end+16)?;
+    if start.checked_add(dword(end+12)?)!=Some(end) {return Err(bad("Invalid ZIP directory bounds"));}
+    let mut central=start;let mut local=0;let mut names=std::collections::HashSet::new();
+    for _ in 0..count {
+        let header=range(central,46)?;
+        if &header[..4]!=b"PK\x01\x02" || word(central+30)?!=0 || word(central+32)?!=0 || word(central+34)?!=0 || dword(central+42)?!=local {return Err(bad("Unsupported ZIP entry layout"));}
+        let name_length=word(central+28)?;
+        let name=range(central+46,name_length)?;
+        if !names.insert(name) {return Err(bad("Duplicate ZIP entry"));}
+        let local_header=range(local,30)?;
+        let flags=word(central+8)?;
+        if &local_header[..4]!=b"PK\x03\x04" || flags & !0x0800!=0 || word(local+6)?!=flags || word(central+10)?!=8 || word(local+8)?!=8 || word(local+26)?!=name_length || word(local+28)?!=0 || range(local+30,name_length)?!=name || range(local+14,12)?!=range(central+16,12)? {return Err(bad("Ambiguous ZIP entry headers"));}
+        let compressed=dword(central+20)?;
+        local=local.checked_add(30+name_length).and_then(|offset|offset.checked_add(compressed)).ok_or_else(||bad("Invalid ZIP data bounds"))?;
+        central=central.checked_add(46+name_length).ok_or_else(||bad("Invalid ZIP directory bounds"))?;
+        if local>start || central>end {return Err(bad("ZIP entry exceeds its region"));}
+    }
+    if local!=start || central!=end {return Err(bad("Unaccounted ZIP contents"));}
+    Ok(())
+}
+
+fn validate_worker_bundle(bytes:&[u8],job:&Value,release:&Release,company_key:&ed25519_dalek::VerifyingKey,trust:&str)->Result<(),ApiError> {
+    // Verify content without extracting any paths. Download bundles cannot inject executables or setup scripts.
+    validate_bundle_zip_layout(bytes,5+COMPANY_BUNDLE_TEXT_FILES.len())?;
+    let mut zip=zip::ZipArchive::new(std::io::Cursor::new(bytes)).map_err(|_|bad("Invalid ZIP artifact"))?;
+    if zip.len()!=5+COMPANY_BUNDLE_TEXT_FILES.len() {return Err(bad("Unexpected bundle contents"));}
+    use std::io::Read;
+    for (name,expected) in [(format!("SwanRemoteSupport-install.{}",release.format),&release.sha256),("swan-agent.exe".into(),&release.agent_sha256)] {
+        let file=zip.by_name(&name).map_err(|_|bad("Missing bundle file"))?;
+        if file.is_dir() || file.is_symlink() || file.size()>512*1024*1024{return Err(bad("Invalid bundle entry type or size"));}
+        if bounded_artifact_digest(file,512*1024*1024)?!=expected.to_lowercase(){return Err(bad("Bundle binary hash mismatch"));}
+    }
+    let mut read=|name:&str,limit:u64|->Result<Vec<u8>,ApiError>{
+        let file=zip.by_name(name).map_err(|_|bad("Missing bundle file"))?;
+        if file.is_dir() || file.is_symlink() || file.size()>limit{return Err(bad("Invalid bundle entry type or size"));}
+        let mut output=Vec::new();file.take(limit+1).read_to_end(&mut output).map_err(|_|bad("Unreadable bundle"))?;
+        if output.len() as u64>limit{return Err(bad("Bundle entry too large"));}Ok(output)
+    };
+    for (name,expected) in COMPANY_BUNDLE_TEXT_FILES {let expected=bundle_text(expected)?;if read(name,expected.len() as u64)?!=expected{return Err(bad("Bundle script or license mismatch"));}}
+    let profile_bytes=read("company-profile.json",2*1024*1024)?;
+    let profile:SignedEnvelope=serde_json::from_slice(&profile_bytes)?;
+    if profile_bytes!=serde_json::to_vec_pretty(&profile)? || serde_json::to_value(&profile)?!=job["profile"] {return Err(bad("Wrong company profile"));}
+    let release_bytes=read("release.json",2*1024*1024)?;
+    let copied_release:SignedEnvelope=serde_json::from_slice(&release_bytes)?;
+    if release_bytes!=serde_json::to_vec_pretty(&copied_release)? || serde_json::to_value(&copied_release)?!=job["release"] {return Err(bad("Wrong release metadata"));}
+    let bootstrap_bytes=read("bootstrap.json",16*1024)?;
+    let bootstrap:swan_agent::Bootstrap=serde_json::from_slice(&bootstrap_bytes)?;
+    if bootstrap_bytes!=serde_json::to_vec_pretty(&bootstrap)? {return Err(bad("Noncanonical bootstrap configuration"));}
+    bootstrap.validate().map_err(|_|bad("Invalid bootstrap configuration"))?;
+    let p:CompanyProfile=profile.verify(company_key).map_err(|_|denied())?;
+    p.validate(&p.company_id,0,now()).map_err(|_|bad("Expired or invalid bundle profile"))?;
+    if bootstrap.company_id!=p.company_id || bootstrap.edition!=release.edition || bootstrap.management_url!=p.management_url || bootstrap.profile_public_key!=STANDARD.encode(company_key.as_bytes()) || bootstrap.release_public_key!=trust {return Err(bad("Bootstrap trust mismatch"));}
+    Ok(())
+}
+
+fn bounded_artifact_digest(mut reader:impl std::io::Read,limit:u64)->Result<String,ApiError> {
+    use sha2::{Digest,Sha256};
+    let mut hash=Sha256::new();let mut total=0u64;let mut chunk=[0u8;64*1024];
+    loop {
+        let count=reader.read(&mut chunk).map_err(|_|bad("Unreadable bundle"))?;
+        if count==0 {break;}
+        total=total.checked_add(count as u64).filter(|size|*size<=limit).ok_or_else(||bad("Bundle entry too large"))?;
+        hash.update(&chunk[..count]);
+    }
+    Ok(hex::encode(hash.finalize()))
+}
+
+// Called only after bundle validation, under a blocking task.
+fn persist_verified_artifact(s:&Store,id:&str,worker:&str,bytes:&[u8])->Result<(),ApiError> {
+        let mut db=s.db.lock().unwrap();let tx=db.transaction()?;
+        let state:Option<String>=tx.query_row("SELECT state FROM builds WHERE id=?1 AND worker=?2",params![id,worker],|r|r.get(0)).optional()?;
+        let target=s.artifact_dir.join(format!("{id}.zip"));
+        match state.as_deref() {
+            Some("uploaded")=>{
+                let saved=std::fs::read(&target).map_err(|_|bad("Uploaded artifact missing"))?;
+                if digest(saved)!=digest(bytes){return Err(bad("Conflicting artifact retry"));}
+                return Ok(());
+            },
+            Some("running")=>{},
+            _=>return Err(denied()),
+        }
+        let temporary=s.artifact_dir.join(format!("{id}.partial"));
+        use std::io::Write;
+        let mut artifact=std::fs::File::create(&temporary).map_err(|_|bad("Cannot save artifact"))?;
+        artifact.write_all(&bytes).map_err(|_|bad("Cannot write artifact"))?;
+        artifact.sync_all().map_err(|_|bad("Cannot flush artifact"))?;drop(artifact);
+        if target.exists(){std::fs::remove_file(&target).map_err(|_|bad("Cannot replace retry artifact"))?;}
+        std::fs::rename(&temporary,target).map_err(|_|bad("Cannot publish artifact"))?;
+        tx.execute("UPDATE builds SET state='uploaded' WHERE id=?1",[&id])?;tx.commit()?;Ok(())
+}
+async fn download_artifact(State(s):State<Shared>,Path(id):Path<String>,headers:HeaderMap)->Result<Response,ApiError> {
+    if id.len()!=36 || !id.bytes().all(|c|c.is_ascii_hexdigit() || c==b'-'){return Err(bad("Invalid build identity"));}
+    let job:String=s.db.lock().unwrap().query_row("SELECT body FROM builds WHERE id=?1 AND state='completed'",[&id],|r|r.get(0)).optional()?.ok_or(ApiError(StatusCode::NOT_FOUND,"Artifact unavailable"))?;
+    let job:Value=serde_json::from_str(&job)?;
+    let envelope:SignedEnvelope=serde_json::from_value(job["release"].clone())?;
+    let approved:bool=s.db.lock().unwrap().query_row("SELECT EXISTS(SELECT 1 FROM releases WHERE approved=1 AND envelope=?1)",[serde_json::to_string(&envelope)?],|r|r.get(0))?;
+    if !approved{return Err(ApiError(StatusCode::NOT_FOUND,"Release approval withdrawn"));}
+    let trust=std::env::var("SWAN_RELEASE_PUBLIC_KEY").map_err(|_|bad("Release trust key unavailable"))?;
+    let release:Release=envelope.verify(&public_key(&trust)?).map_err(|_|denied())?;
+    if release.edition==Edition::Technician{s.user(&headers,false)?;}
+    let bytes=tokio::fs::read(s.artifact_dir.join(format!("{id}.zip"))).await.map_err(|_|ApiError(StatusCode::NOT_FOUND,"Artifact unavailable"))?;
+    Ok(([(header::CONTENT_TYPE,"application/zip"),(header::CONTENT_DISPOSITION,"attachment; filename=\"SwanRemoteSupport-company.zip\"")],bytes).into_response())
+}
diff --git a/product/management/src/tests.rs b/product/management/src/tests.rs
new file mode 100644
index 00000000000..6dc92cc6ce6
--- /dev/null
+++ b/product/management/src/tests.rs
@@ -0,0 +1,198 @@
+use super::service::*;
+use axum::{body::Body,http::{Request,StatusCode}};
+use base64::{engine::general_purpose::STANDARD,Engine};
+use ed25519_dalek::SigningKey;
+use http_body_util::BodyExt;
+use serde_json::{json,Value};
+use std::sync::Arc;
+use swan_protocol::*;
+use totp_rs::{Algorithm,Secret,TOTP};
+use tower::ServiceExt;
+
+async fn request(app:&axum::Router,path:&str,method:&str,token:Option<&str>,body:Value)->(StatusCode,Value) {
+    let mut request=Request::builder().uri(path).method(method).header("content-type","application/json");
+    if let Some(token)=token {request=request.header("authorization",format!("Bearer {token}"));}
+    let response=app.clone().oneshot(request.body(Body::from(body.to_string())).unwrap()).await.unwrap();
+    let status=response.status();let bytes=response.into_body().collect().await.unwrap().to_bytes();
+    (status,serde_json::from_slice(&bytes).unwrap())
+}
+fn profile_fixture()->CompanyProfile {
+    let key=SigningKey::from_bytes(&[3;32]);
+    CompanyProfile{schema:1,company_id:"fixture".into(),revision:1,issued_at:now(),expires_at:now()+3600,management_url:"https://support.example.com".into(),rendezvous:"support.example.com".into(),relay:"support.example.com".into(),transport_public_key:STANDARD.encode(key.verifying_key().as_bytes()),customer:Branding::default(),technician:Branding::default(),allow_unattended:true,updates_paused:true,rollout_percent:10,maintenance_start_utc:22,maintenance_end_utc:5,update_channel:"stable".into(),next_profile_public_key:None}
+}
+
+#[tokio::test]
+async fn first_run_preserves_company_branding_and_update_policy_atomically() {
+    let directory=std::env::temp_dir().join(format!("swan-first-run-{}",random_token()));
+    let store=Arc::new(Store::open(&directory).unwrap());let app=router(store.clone());
+    let (_,status)=request(&app,"/api/v1/status","GET",None,Value::Null).await;
+    let key=public_key(status["profile_public_key"].as_str().unwrap()).unwrap();
+    let secret=Secret::generate_secret().to_encoded().to_string();
+    let generator=TOTP::new(Algorithm::SHA1,6,1,30,Secret::Encoded(secret.clone()).to_bytes().unwrap()).unwrap();
+    let mut profile=profile_fixture();
+    for (brand,name,color,url) in [(&mut profile.customer,"Example customer care","#123456","https://example.org/customer"),(&mut profile.technician,"Example service desk","#654321","https://example.org/technician")] {
+        brand.display_name=name.into();brand.primary_color=color.into();brand.support_url=url.into();
+        brand.support_contacts="Company help desk".into();brand.consent_text="Only approve a known technician.".into();
+        brand.logo_svg="<svg><path d=\"M0 0\"/></svg>".into();
+        brand.shortcuts=vec![BrandingShortcut{label:name.into(),url:format!("{url}/help")}];
+    }
+    profile.allow_unattended=false;profile.updates_paused=true;profile.rollout_percent=23;
+    profile.update_channel="test".into();profile.maintenance_start_utc=23;profile.maintenance_end_utc=4;
+    let submitted=serde_json::to_value(&profile).unwrap();
+    let setup=json!({"profile":submitted,"username":"owner","password":"example company setup password","totp_secret":secret,"totp_code":generator.generate(now())});
+    let token=std::fs::read_to_string(directory.join("setup-token.txt")).unwrap();
+    let mut invalid=setup.clone();invalid["profile"]["rollout_percent"]=json!(101);
+    assert_eq!(request(&app,"/api/v1/setup","POST",Some(&token),invalid).await.0,StatusCode::BAD_REQUEST);
+    let db=rusqlite::Connection::open_with_flags(directory.join("management.sqlite3"),rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY).unwrap();
+    for table in ["profile","users","audit"] {
+        let count:i64=db.query_row(&format!("SELECT COUNT(*) FROM {table}"),[],|row|row.get(0)).unwrap();
+        assert_eq!(count,0,"Invalid first-run policy must leave company and account creation uncommitted");
+    }
+    assert_eq!(request(&app,"/api/v1/setup","POST",Some(&token),setup).await.0,StatusCode::OK);
+    let (status,envelope)=request(&app,"/api/v1/profile","GET",None,Value::Null).await;assert_eq!(status,StatusCode::OK);
+    let signed:SignedEnvelope=serde_json::from_value(envelope).unwrap();let received:CompanyProfile=signed.verify(&key).unwrap();
+    assert_ne!(received.company_id,"fixture");assert_eq!(received.revision,1);
+    let stored:String=db.query_row("SELECT body FROM profile WHERE id=1",[],|row|row.get(0)).unwrap();
+    for mut actual in [serde_json::to_value(received).unwrap(),serde_json::from_str::<Value>(&stored).unwrap()] {
+        for field in ["company_id","revision","issued_at","expires_at"] {actual[field]=submitted[field].clone();}
+        assert_eq!(actual,submitted,"Initial signed and persisted policy must retain every submitted company setting");
+    }
+    let admins:i64=db.query_row("SELECT COUNT(*) FROM users WHERE username='owner' AND role='admin' AND disabled=0 AND last_totp_step>=0",[],|row|row.get(0)).unwrap();assert_eq!(admins,1);
+    drop(db);drop(app);drop(store);std::fs::remove_dir_all(directory).unwrap();
+}
+
+#[tokio::test]
+async fn enrollment_mfa_and_grants_fail_closed() {
+    let directory=std::env::temp_dir().join(format!("swan-api-{}",random_token()));
+    let store=Arc::new(Store::open(&directory).unwrap());let app=router(store.clone());
+    assert_eq!(request(&app,"/api/v1/devices","GET",None,Value::Null).await.0,StatusCode::UNAUTHORIZED);
+    assert_eq!(request(&app,"/api/v1/network/check","POST",None,Value::Null).await.0,StatusCode::UNAUTHORIZED);
+    assert_eq!(request(&app,"/api/v1/network/bootstrap","GET",None,Value::Null).await.0,StatusCode::UNAUTHORIZED);
+    let secret=Secret::generate_secret().to_encoded().to_string();
+    let generator=TOTP::new(Algorithm::SHA1,6,1,30,Secret::Encoded(secret.clone()).to_bytes().unwrap()).unwrap();
+    let time=now();let setup_token=std::fs::read_to_string(directory.join("setup-token.txt")).unwrap();
+    let setup=json!({"profile":profile_fixture(),"username":"admin","password":"correct horse battery staple","totp_secret":secret,"totp_code":generator.generate(time)});
+    assert_eq!(request(&app,"/api/v1/setup","POST",Some(&random_token()),setup.clone()).await.0,StatusCode::FORBIDDEN);
+    assert_eq!(request(&app,"/api/v1/setup","POST",Some(&setup_token),setup.clone()).await.0,StatusCode::OK);
+    assert_eq!(request(&app,"/api/v1/setup","POST",Some(&setup_token),setup).await.0,StatusCode::CONFLICT);
+    let login=json!({"username":"admin","password":"correct horse battery staple","totp_code":generator.generate(time)});
+    assert_eq!(request(&app,"/api/v1/login","POST",None,login).await.0,StatusCode::UNAUTHORIZED,"Setup code cannot be replayed for login");
+    let login=json!({"username":"admin","password":"correct horse battery staple","totp_code":generator.generate((time/30+1)*30)});
+    let (status,result)=request(&app,"/api/v1/login","POST",None,login.clone()).await;assert_eq!(status,StatusCode::OK);
+    let admin=result["token"].as_str().unwrap();
+    let (status,probe_bootstrap)=request(&app,"/api/v1/network/bootstrap","GET",Some(admin),Value::Null).await;
+    assert_eq!(status,StatusCode::OK);
+    let bootstrap:swan_agent::Bootstrap=serde_json::from_value(probe_bootstrap.clone()).unwrap();bootstrap.validate().unwrap();
+    let fields=probe_bootstrap.as_object().unwrap().keys().map(String::as_str).collect::<std::collections::BTreeSet<_>>();
+    assert_eq!(fields,["schema","edition","company_id","management_url","profile_public_key","release_public_key"].into_iter().collect());
+    assert!(bootstrap.release_public_key.is_empty());
+    let (_,public_status)=request(&app,"/api/v1/status","GET",None,Value::Null).await;
+    assert_eq!(bootstrap.profile_public_key,public_status["profile_public_key"]);
+    assert_eq!(request(&app,"/api/v1/sessions","GET",None,Value::Null).await.0,StatusCode::UNAUTHORIZED);
+    assert_eq!(request(&app,"/api/v1/login","POST",None,login).await.0,StatusCode::UNAUTHORIZED,"MFA codes are single-use");
+    let (_,device)=request(&app,"/api/v1/enroll","POST",None,json!({"name":"Customer test PC","rustdesk_id":"123456789","unattended_consent":false})).await;
+    let device_id=device["device_id"].as_str().unwrap();let credential=device["device_token"].as_str().unwrap();
+    let (status,identity)=request(&app,"/api/v1/device/status","GET",Some(credential),Value::Null).await;
+    assert_eq!(status,StatusCode::OK);assert_eq!(identity["device_id"],device_id);assert_eq!(identity["rustdesk_id"],"123456789");assert_eq!(identity["state"],"pending");
+    let (status,_)=request(&app,"/api/v1/device/status","GET",Some("wrong-device-token"),Value::Null).await;
+    assert_eq!(status,StatusCode::UNAUTHORIZED);
+    let proof=SigningKey::from_bytes(&[9;32]);let grant_request=json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":false});
+    assert_eq!(request(&app,"/api/v1/grants","POST",Some(admin),grant_request.clone()).await.0,StatusCode::FORBIDDEN,"Pending devices cannot be accessed");
+    assert_eq!(request(&app,&format!("/api/v1/devices/{device_id}/state"),"PUT",Some(admin),json!({"state":"approved","group":"customers"})).await.0,StatusCode::OK);
+    let (status,envelope)=request(&app,"/api/v1/grants","POST",Some(admin),grant_request).await;assert_eq!(status,StatusCode::OK);
+    let claim=json!({"grant":envelope});
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),claim.clone()).await.0,StatusCode::OK);
+    let original:SignedEnvelope=serde_json::from_value(envelope.clone()).unwrap();
+    let issued:SessionGrant=serde_json::from_slice(&STANDARD.decode(&original.payload).unwrap()).unwrap();
+    assert!(issued.permissions.keyboard);assert!(!issued.permissions.recording);
+    let mut reduced=SessionPermissions::support_default();reduced.keyboard=false;
+    assert_eq!(request(&app,"/api/v1/groups/customers/permissions","PUT",Some(admin),serde_json::to_value(&reduced).unwrap()).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",issued.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"Reduced capabilities invalidate existing authorization leases");
+    assert_eq!(request(&app,"/api/v1/groups/customers/permissions","PUT",None,serde_json::to_value(&reduced).unwrap()).await.0,StatusCode::UNAUTHORIZED);
+    assert_eq!(request(&app,"/api/v1/groups/customers/permissions","PUT",Some(admin),serde_json::to_value(SessionPermissions::support_default()).unwrap()).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",issued.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"Restored capabilities cannot revive withdrawn authorization");
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),claim).await.0,StatusCode::FORBIDDEN,"Session ticket is single-use");
+    let (_,history)=request(&app,"/api/v1/sessions","GET",Some(admin),Value::Null).await;
+    assert_eq!(history.as_array().unwrap().len(),1);
+    assert_eq!(history[0]["claimed"],true);
+    assert_eq!(request(&app,"/api/v1/grants","POST",Some(admin),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":true})).await.0,StatusCode::FORBIDDEN,"Unattended access needs device consent");
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":true,"revision":1})).await.0,StatusCode::OK);
+    let (_,attended_envelope)=request(&app,"/api/v1/grants","POST",Some(admin),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":false})).await;
+    let signed:SignedEnvelope=serde_json::from_value(attended_envelope.clone()).unwrap();
+    let attended_grant:SessionGrant=serde_json::from_slice(&STANDARD.decode(&signed.payload).unwrap()).unwrap();
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),json!({"grant":attended_envelope})).await.0,StatusCode::OK);
+    let (_,unattended_envelope)=request(&app,"/api/v1/grants","POST",Some(admin),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":true})).await;
+    let signed:SignedEnvelope=serde_json::from_value(unattended_envelope.clone()).unwrap();
+    let unattended_grant:SessionGrant=serde_json::from_slice(&STANDARD.decode(&signed.payload).unwrap()).unwrap();
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),json!({"grant":unattended_envelope})).await.0,StatusCode::OK);
+    let mut company_policy=profile_fixture();company_policy.allow_unattended=false;
+    assert_eq!(request(&app,"/api/v1/profile","PUT",Some(admin),serde_json::to_value(&company_policy).unwrap()).await.0,StatusCode::OK);
+    company_policy.allow_unattended=true;
+    assert_eq!(request(&app,"/api/v1/profile","PUT",Some(admin),serde_json::to_value(&company_policy).unwrap()).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",unattended_grant.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"Company policy restoration cannot revive old unattended grants");
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",attended_grant.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::OK,"Company unattended policy must preserve attended sessions");
+    let (_,local_envelope)=request(&app,"/api/v1/grants","POST",Some(admin),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":true})).await;
+    let signed:SignedEnvelope=serde_json::from_value(local_envelope.clone()).unwrap();
+    let unattended_grant:SessionGrant=serde_json::from_slice(&STANDARD.decode(&signed.payload).unwrap()).unwrap();
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),json!({"grant":local_envelope})).await.0,StatusCode::OK);
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":false,"revision":2})).await.0,StatusCode::OK);
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":true,"revision":1})).await.0,StatusCode::CONFLICT,"Delayed enable cannot undo revocation");
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":true,"revision":2})).await.0,StatusCode::CONFLICT,"Revocation wins same-revision races");
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":true,"revision":3})).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",unattended_grant.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"New consent cannot revive old unattended authorization");
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",attended_grant.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::OK,"Unattended revocation must preserve attended authorization");
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":false,"revision":2})).await.0,StatusCode::CONFLICT,"Old retry cannot undo newer explicit consent");
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":false,"revision":4})).await.0,StatusCode::OK);
+    assert_eq!(request(&app,"/api/v1/device/consent","PUT",Some(credential),json!({"unattended":false,"revision":4})).await.0,StatusCode::OK,"Revocation retries are idempotent");
+    let (_,new_user)=request(&app,"/api/v1/users","POST",Some(admin),json!({"username":"technician","password":"another long strong password","role":"technician"})).await;
+    let tech_secret=new_user["totp_secret"].as_str().unwrap();
+    let tech_generator=TOTP::new(Algorithm::SHA1,6,1,30,Secret::Encoded(tech_secret.into()).to_bytes().unwrap()).unwrap();
+    let (_,tech_login)=request(&app,"/api/v1/login","POST",None,json!({"username":"technician","password":"another long strong password","totp_code":tech_generator.generate(now())})).await;
+    let technician=tech_login["token"].as_str().unwrap();
+    assert_eq!(request(&app,"/api/v1/network/bootstrap","GET",Some(technician),Value::Null).await.0,StatusCode::UNAUTHORIZED,"Only company administrators may export network bootstrap information");
+    assert_eq!(request(&app,"/api/v1/users","GET",Some(technician),Value::Null).await.0,StatusCode::UNAUTHORIZED);
+    assert_eq!(request(&app,"/api/v1/network/check","POST",Some(technician),Value::Null).await.0,StatusCode::UNAUTHORIZED,"Only company administrators may probe configured endpoints");
+    assert_eq!(request(&app,"/api/v1/grants","POST",Some(technician),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":false})).await.0,StatusCode::FORBIDDEN,"Technicians need explicit group access");
+    let (_,devices)=request(&app,"/api/v1/devices","GET",Some(technician),Value::Null).await;assert_eq!(devices.as_array().unwrap().len(),0);
+    assert_eq!(request(&app,&format!("/api/v1/groups/customers/users/{}",new_user["id"].as_str().unwrap()),"PUT",Some(admin),Value::Null).await.0,StatusCode::OK);
+    let (_,devices)=request(&app,"/api/v1/devices","GET",Some(technician),Value::Null).await;assert_eq!(devices.as_array().unwrap().len(),1);
+    let access_path=format!("/api/v1/groups/customers/users/{}",new_user["id"].as_str().unwrap());
+    let tech_request=json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":false});
+    let (status,tech_envelope)=request(&app,"/api/v1/grants","POST",Some(technician),tech_request.clone()).await;assert_eq!(status,StatusCode::OK);
+    let signed:SignedEnvelope=serde_json::from_value(tech_envelope.clone()).unwrap();
+    let tech_grant:SessionGrant=serde_json::from_slice(&STANDARD.decode(&signed.payload).unwrap()).unwrap();
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),json!({"grant":tech_envelope})).await.0,StatusCode::OK);
+    let renew_path=format!("/api/v1/grants/{}/renew",tech_grant.grant_id);
+    assert_eq!(request(&app,&access_path,"DELETE",Some(technician),Value::Null).await.0,StatusCode::UNAUTHORIZED);
+    assert_eq!(request(&app,&access_path,"DELETE",Some(admin),Value::Null).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&renew_path,"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN);
+    assert_eq!(request(&app,"/api/v1/grants","POST",Some(technician),tech_request.clone()).await.0,StatusCode::FORBIDDEN);
+    let (_,devices)=request(&app,"/api/v1/devices","GET",Some(technician),Value::Null).await;assert_eq!(devices.as_array().unwrap().len(),0);
+    assert_eq!(request(&app,&access_path,"PUT",Some(admin),Value::Null).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&renew_path,"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"Restoring group access cannot revive the old grant");
+    assert_eq!(request(&app,"/api/v1/grants","POST",Some(technician),tech_request).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&format!("/api/v1/users/{}/disable",new_user["id"].as_str().unwrap()),"POST",Some(admin),Value::Null).await.0,StatusCode::OK);
+    assert_eq!(request(&app,"/api/v1/devices","GET",Some(technician),Value::Null).await.0,StatusCode::UNAUTHORIZED,"Disabling an account invalidates its existing session");
+    assert_eq!(request(&app,&format!("/api/v1/devices/{device_id}/state"),"PUT",Some(admin),json!({"state":"revoked","group":"customers"})).await.0,StatusCode::OK);
+    assert_eq!(request(&app,"/api/v1/device/status","GET",Some(credential),Value::Null).await.0,StatusCode::UNAUTHORIZED,"Repair cannot restore a revoked device");
+    assert_eq!(request(&app,"/api/v1/grants","POST",Some(admin),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":false})).await.0,StatusCode::FORBIDDEN);
+    assert_eq!(request(&app,&format!("/api/v1/devices/{device_id}/state"),"PUT",Some(admin),json!({"state":"approved","group":"customers"})).await.0,StatusCode::OK);
+    assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",issued.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"Re-approval cannot revive authorization from before device revocation");
+    let (_,moved_envelope)=request(&app,"/api/v1/grants","POST",Some(admin),json!({"device_id":device_id,"proof_public_key":STANDARD.encode(proof.verifying_key().as_bytes()),"unattended":false})).await;
+    let signed:SignedEnvelope=serde_json::from_value(moved_envelope.clone()).unwrap();
+    let moved_grant:SessionGrant=serde_json::from_slice(&STANDARD.decode(&signed.payload).unwrap()).unwrap();
+    assert_eq!(request(&app,"/api/v1/grants/claim","POST",Some(credential),json!({"grant":moved_envelope})).await.0,StatusCode::OK);
+    for group in ["another-group","customers"] {
+        assert_eq!(request(&app,&format!("/api/v1/devices/{device_id}/state"),"PUT",Some(admin),json!({"state":"approved","group":group})).await.0,StatusCode::OK);
+        assert_eq!(request(&app,&format!("/api/v1/grants/{}/renew",moved_grant.grant_id),"POST",Some(credential),Value::Null).await.0,StatusCode::FORBIDDEN,"Group moves must invalidate old grants, including administrator grants");
+    }
+    drop(app);drop(store);std::fs::remove_dir_all(directory).unwrap();
+}
+
+#[tokio::test]
+async fn profile_revision_is_server_controlled_and_invalid_svg_rejected() {
+    let mut brand=Branding::default();brand.logo_svg="<svg><script>alert(1)</script></svg>".into();assert!(brand.validate().is_err());
+    let mut profile=profile_fixture();assert!(profile.validate("fixture",1,now()).is_ok());
+    assert!(profile.validate("wrong-company",1,now()).is_err());assert!(profile.validate("fixture",2,now()).is_err());
+    profile.expires_at=now();assert!(profile.validate("fixture",1,now()).is_err());
+}
diff --git a/product/management/src/windows.rs b/product/management/src/windows.rs
new file mode 100644
index 00000000000..fe7b0cadf52
--- /dev/null
+++ b/product/management/src/windows.rs
@@ -0,0 +1,30 @@
+use anyhow::Result;
+use std::{ffi::OsString,sync::Mutex,time::Duration};
+use windows_service::{define_windows_service,service::{ServiceControl,ServiceControlAccept,ServiceExitCode,ServiceState,ServiceStatus,ServiceType},service_control_handler::{self,ServiceControlHandlerResult},service_dispatcher};
+const NAME:&str="SwanCompanyServer";
+define_windows_service!(ffi_service_main,service_main);
+pub fn dispatch()->Result<()> {service_dispatcher::start(NAME,ffi_service_main)?;Ok(())}
+fn service_main(_arguments:Vec<OsString>) {
+    let (sender,receiver)=tokio::sync::oneshot::channel();let sender=Mutex::new(Some(sender));
+    let handler=move|control|match control {
+        ServiceControl::Stop|ServiceControl::Shutdown=>{if let Some(sender)=sender.lock().unwrap().take(){let _=sender.send(());}ServiceControlHandlerResult::NoError},
+        ServiceControl::Interrogate=>ServiceControlHandlerResult::NoError,
+        _=>ServiceControlHandlerResult::NotImplemented,
+    };
+    let status_handle=match service_control_handler::register(NAME,handler){Ok(handle)=>handle,Err(error)=>{eprintln!("Service registration failed: {error}");return;}};
+    let status=|state,exit|ServiceStatus{service_type:ServiceType::OWN_PROCESS,current_state:state,controls_accepted:if state==ServiceState::Running{ServiceControlAccept::STOP|ServiceControlAccept::SHUTDOWN}else{ServiceControlAccept::empty()},exit_code:ServiceExitCode::Win32(exit),checkpoint:0,wait_hint:Duration::from_secs(10),process_id:None};
+    if let Err(error)=status_handle.set_service_status(status(ServiceState::Running,0)){eprintln!("Service status failed: {error}");return;}
+    // SCM invokes this entrypoint on its own thread; it owns the only server runtime.
+    let outcome=tokio::runtime::Runtime::new().map_err(anyhow::Error::from).and_then(|runtime|runtime.block_on(async {
+        match std::env::var("SWAN_COMPONENTS") {
+            Ok(value) if value=="1"=>{
+                let specs=tokio::task::spawn_blocking(super::components::installed_specs).await??;
+                super::components::supervise(specs,receiver,super::run).await
+            },
+            Err(std::env::VarError::NotPresent)=>super::run(receiver).await,
+            _=>anyhow::bail!("Invalid company component service mode"),
+        }
+    }));
+    if let Err(error)=&outcome{eprintln!("Company server failed: {error}");}
+    if let Err(error)=status_handle.set_service_status(status(ServiceState::Stopped,if outcome.is_ok(){0}else{1})){eprintln!("Service shutdown status failed: {error}");}
+}
diff --git a/product/management/web/app.js b/product/management/web/app.js
new file mode 100644
index 00000000000..90cd8d4ab7b
--- /dev/null
+++ b/product/management/web/app.js
@@ -0,0 +1,145 @@
+'use strict';
+let accessToken='';
+let viewGeneration=0,installationTimer=null;
+function stopInstallationRefresh(){if(installationTimer!==null){clearTimeout(installationTimer);installationTimer=null;}}
+const content=document.querySelector('#content');
+const notice=document.querySelector('#notice');
+const escapeText=value=>String(value??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+let shortcutCounter=0;
+function shortcutRow(edition,shortcut={label:'',url:''}) {
+  const id=edition+'_shortcut_'+shortcutCounter++;
+  return `<div class="shortcut-row" data-shortcut-row><label for="${id}_label">Name</label><input id="${id}_label" name="${edition}_shortcut_label" maxlength="100" value="${escapeText(shortcut.label)}"><label for="${id}_url">HTTPS address</label><input id="${id}_url" name="${edition}_shortcut_url" type="url" maxlength="2048" value="${escapeText(shortcut.url)}"><button type="button" class="secondary" data-remove-shortcut>Remove shortcut</button></div>`;
+}
+function shortcutFields(edition,shortcuts=[]) {
+  return `<fieldset class="shortcut-editor" id="${edition}_shortcut_editor"><legend>Website shortcuts</legend><div data-shortcut-rows>${shortcuts.map(shortcut=>shortcutRow(edition,shortcut)).join('')}</div><button type="button" class="secondary" data-add-shortcut>Add shortcut</button><small>Up to eight website shortcuts. Each shortcut has a name and an HTTPS address.</small></fieldset>`;
+}
+function bindShortcuts(edition) {
+  const editor=document.querySelector('#'+edition+'_shortcut_editor');
+  const rows=editor.querySelector('[data-shortcut-rows]'),add=editor.querySelector('[data-add-shortcut]');
+  const refresh=()=>{add.disabled=rows.children.length>=8;};
+  add.onclick=()=>{if(rows.children.length>=8)return;rows.insertAdjacentHTML('beforeend',shortcutRow(edition));refresh();};
+  rows.onclick=event=>{const button=event.target.closest('[data-remove-shortcut]');if(button&&rows.contains(button)){button.closest('[data-shortcut-row]').remove();refresh();}};
+  refresh();
+}
+function readShortcuts(values,edition) {
+  const labels=values.getAll(edition+'_shortcut_label'),urls=values.getAll(edition+'_shortcut_url');
+  if(labels.length!==urls.length||labels.length>8)throw new Error('Up to eight complete website shortcuts are allowed.');
+  return labels.flatMap((label,index)=>{const url=urls[index];if(!label.trim()&&!url.trim())return [];if(!label.trim()||!url.trim())throw new Error('Each website shortcut needs a name and an HTTPS address.');return [{label,url}];});
+}
+async function api(path,method='GET',body,token=accessToken){
+  const generation=viewGeneration;
+  const response=await fetch('/api/v1/'+path,{method,headers:{'Content-Type':'application/json',...(token?{Authorization:'Bearer '+token}:{})},body:body===undefined?undefined:JSON.stringify(body),redirect:'error',cache:'no-store'});
+  const result=await response.json();if(generation!==viewGeneration)throw Object.assign(new Error('The page changed before this request finished.'),{superseded:true});if(!response.ok)throw new Error(result.error||'Request failed');return result;
+}
+function showError(error){if(!error.superseded)notice.textContent=error.message;}
+function bindForm(id,callback){document.querySelector('#'+id).addEventListener('submit',async event=>{event.preventDefault();notice.textContent='';const button=event.target.querySelector('button[type=submit]');if(button)button.disabled=true;try{await callback(new FormData(event.target));}catch(error){showError(error);}finally{if(button)button.disabled=false;}});}
+function field(name,label,type='text',value=''){return `<label for="${name}">${label}</label><input id="${name}" name="${name}" type="${type}" value="${escapeText(value)}" required>`;}
+function title(text,description=''){document.querySelector('#title').textContent=text;document.querySelector('#description').textContent=description;}
+function base32(bytes){let bits=0,value=0,out='';for(const byte of bytes){value=(value<<8)|byte;bits+=8;while(bits>=5){out+='ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'[(value>>>(bits-5))&31];bits-=5;}}if(bits)out+='ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'[(value<<(5-bits))&31];return out;}
+function defaultProfile(brand){return {schema:1,company_id:'setup',revision:1,issued_at:0,expires_at:0,management_url:'',rendezvous:'',relay:'',transport_public_key:'',customer:{...brand},technician:{...brand},allow_unattended:true,updates_paused:true,rollout_percent:10,maintenance_start_utc:22,maintenance_end_utc:5,update_channel:'stable',next_profile_public_key:null};}
+function profileFields(p){return `<div class="grid"><div><h2>Customer app</h2>${field('customer_name','Display name','text',p.customer.display_name)}${field('customer_color','Primary color','color',p.customer.primary_color)}${field('customer_support','Support HTTPS URL','url',p.customer.support_url||p.management_url)}<label for="customer_contacts">Support contact details</label><textarea id="customer_contacts" name="customer_contacts">${escapeText(p.customer.support_contacts||'')}</textarea>${shortcutFields('customer',p.customer.shortcuts||[])}<label for="customer_consent">Consent wording</label><textarea id="customer_consent" name="customer_consent">${escapeText(p.customer.consent_text)}</textarea><label for="customer_logo">Logo SVG (optional)</label><textarea id="customer_logo" name="customer_logo">${escapeText(p.customer.logo_svg)}</textarea></div><div><h2>Technician app</h2>${field('technician_name','Display name','text',p.technician.display_name)}${field('technician_color','Primary color','color',p.technician.primary_color)}${field('technician_support','Support HTTPS URL','url',p.technician.support_url||p.management_url)}<label for="technician_contacts">Support contact details</label><textarea id="technician_contacts" name="technician_contacts">${escapeText(p.technician.support_contacts||'')}</textarea>${shortcutFields('technician',p.technician.shortcuts||[])}<label for="technician_consent">Consent wording</label><textarea id="technician_consent" name="technician_consent">${escapeText(p.technician.consent_text)}</textarea><label for="technician_logo">Logo SVG (optional)</label><textarea id="technician_logo" name="technician_logo">${escapeText(p.technician.logo_svg)}</textarea></div></div><label class="check"><input name="unattended" type="checkbox" ${p.allow_unattended?'checked':''}>Allow customers to opt into unattended support</label><label class="check"><input name="paused" type="checkbox" ${p.updates_paused?'checked':''}>Pause automatic updates</label>${field('rollout','Rollout percentage','number',p.rollout_percent)}<div class="grid"><div><label for="update_channel">Update channel</label><select id="update_channel" name="update_channel"><option value="stable" ${p.update_channel==='stable'?'selected':''}>Stable</option><option value="test" ${p.update_channel==='test'?'selected':''}>Test</option></select></div><div>${field('maintenance_start','Maintenance start hour (UTC, 0–23)','number',p.maintenance_start_utc)}${field('maintenance_end','Maintenance end hour (UTC, 0–23)','number',p.maintenance_end_utc)}</div></div><small>Windows can cross midnight. Equal start and end hours allow updates throughout the day. Releases still require administrator approval.</small>`;}
+function bindProfileFields(){for(const edition of ['customer','technician'])bindShortcuts(edition);}
+function readProfileFields(p,v){for(const edition of ['customer','technician']){p[edition].display_name=v.get(edition+'_name');p[edition].primary_color=v.get(edition+'_color');p[edition].support_url=v.get(edition+'_support');p[edition].logo_svg=v.get(edition+'_logo');p[edition].consent_text=v.get(edition+'_consent');p[edition].support_contacts=v.get(edition+'_contacts');p[edition].shortcuts=readShortcuts(v,edition);}p.allow_unattended=v.has('unattended');p.updates_paused=v.has('paused');p.rollout_percent=Number(v.get('rollout'));p.update_channel=v.get('update_channel');p.maintenance_start_utc=Number(v.get('maintenance_start'));p.maintenance_end_utc=Number(v.get('maintenance_end'));}
+async function initialize(){try{const state=await api('status');if(!state.configured)setupScreen(await api('default-branding'));else loginScreen();}catch(error){showError(error);}}
+function setupScreen(brand){
+  title('Set up your company server','Use your public HTTPS domain and a publicly reachable rendezvous and relay server.');
+  const secret=base32(crypto.getRandomValues(new Uint8Array(20)));
+  const profile=defaultProfile(brand);
+  content.innerHTML=`<form class="card" id="setup"><h2>Company and network</h2><div class="grid"><div>${field('url','Management HTTPS URL','url','https://support.example.com')}${field('rendezvous','ID server hostname','text','support.example.com')}${field('relay','Relay server hostname','text','support.example.com')}${field('key','RustDesk server public key')}</div><div>${field('setup_token','Setup token from the server data directory','password')}${field('username','Administrator username')}${field('password','Administrator password (at least 14 characters)','password')}<label>Authenticator secret</label><code>${escapeText(secret)}</code><small>Add this secret to your authenticator, then enter its current code. Store recovery access to the server separately.</small>${field('code','Authenticator code','text')}</div></div><p class="muted">HTTPS is provided by the deployment reverse proxy. Clients need TCP 21115–21117 and UDP 21116 to the transport server. An office connection behind CGNAT needs a public relay. This form does not expose or change your firewall.</p><h2>Endpoint branding and policies</h2><p class="muted">Choose the identity customers and technicians see. New devices require company approval. Allowing unattended support still requires each customer to opt in.</p>${profileFields(profile)}<button type="submit">Create company server</button></form>`;
+  bindProfileFields();
+  bindForm('setup',async values=>{readProfileFields(profile,values);profile.management_url=values.get('url').replace(/\/$/,'');profile.rendezvous=values.get('rendezvous');profile.relay=values.get('relay');profile.transport_public_key=values.get('key');await api('setup','POST',{profile,username:values.get('username'),password:values.get('password'),totp_secret:secret,totp_code:values.get('code')},values.get('setup_token'));loginScreen();notice.textContent='Server configured. Wait for the next authenticator code, then sign in.';});
+}
+function loginScreen(){viewGeneration++;stopInstallationRefresh();title('Sign in to your company server','Administrator and technician accounts require an authenticator code.');document.querySelector('#nav').hidden=true;content.innerHTML=`<form class="card" id="login">${field('username','Username')}${field('password','Password','password')}${field('code','Authenticator code')}<button type="submit">Sign in</button><p class="muted">Your session stays in this page’s memory and expires after one hour.</p></form>`;bindForm('login',async values=>{const login=await api('login','POST',{username:values.get('username'),password:values.get('password'),totp_code:values.get('code')});accessToken=login.token;document.querySelector('#nav').hidden=false;await view('devices');});}
+async function view(name){const generation=++viewGeneration;stopInstallationRefresh();notice.textContent='';for(const button of document.querySelectorAll('[data-view]'))button.classList.toggle('active',button.dataset.view===name);try{await screens[name](generation);}catch(error){if(generation===viewGeneration)showError(error);}}
+const installationPhases={current:'Installed',checking:'Checking for updates',downloading:'Downloading update',preparing:'Preparing update',installing:'Installing update',recovering:'Recovering update',deferred:'Update deferred',failed:'Update needs attention'};
+function installationRows(rows){
+  return rows.map(row=>{
+    const report=row.report||{},received=Number(row.received_at),date=new Date(received*1000);
+    const stamp=Number.isFinite(received)&&!Number.isNaN(date.getTime())?date.toLocaleString():'Unknown';
+    const old=Number.isFinite(received)&&Date.now()/1000-received>900;
+    const total=report.total_bytes,done=report.downloaded_bytes;
+    const progress=['downloading','preparing'].includes(report.phase)&&Number.isSafeInteger(total)&&total>0&&total<=4294967296&&Number.isSafeInteger(done)&&done>=0&&done<=total?`<progress max="${total}" value="${done}"></progress><small>${Math.floor(done*100/total)}%</small>`:'';
+    return `<tr><td>${escapeText(row.owner_name)}<small>${row.edition==='technician'?'Technician app':'Customer app'} · ${escapeText(row.owner_state)}</small></td><td>${escapeText(report.installed_version||'Not yet recorded')}</td><td>${escapeText(installationPhases[report.phase]||'Unknown update status')}${progress}</td><td>${escapeText(stamp)}${old?'<small>Report is over 15 minutes old</small>':''}</td></tr>`;
+  }).join('');
+}
+const screens={
+  async installations(generation){
+    title('Installed versions and updates','Versions and progress reported by your company’s apps. This page refreshes every 10 seconds.');
+    let requestNumber=0;
+    const load=async offset=>{
+      if(generation!==viewGeneration||!accessToken)return;
+      const number=++requestNumber;stopInstallationRefresh();
+      const page=await api('installations?offset='+encodeURIComponent(offset));
+      if(generation!==viewGeneration||number!==requestNumber||!accessToken)return;
+      const next=Number.isSafeInteger(page.next_offset)&&page.next_offset>=0?page.next_offset:null;
+      content.innerHTML=`<div class="card"><div class="actions"><button id="installation-refresh" class="secondary">Refresh latest</button><button id="installation-next" class="secondary" ${next===null?'disabled':''}>Next page</button></div><table><thead><tr><th>Installation</th><th>Reported version</th><th>Update status</th><th>Last report</th></tr></thead><tbody>${installationRows(page.reports)}</tbody></table>${page.reports.length?'':'<p>No installation reports yet. Apps report after enrollment or technician sign-in.</p>'}</div>`;
+      const failed=error=>{if(generation===viewGeneration&&accessToken)showError(error);};
+      document.querySelector('#installation-refresh').onclick=()=>load(0).catch(failed);
+      document.querySelector('#installation-next').onclick=()=>{if(next!==null)return load(next).catch(failed);};
+      installationTimer=setTimeout(()=>{installationTimer=null;load(offset).catch(failed);},10000);
+    };
+    await load(0);
+  },
+  async network(){
+    title('Company network','Configure company-owned public endpoints and check them from this server. External access needs a separate test.');
+    const envelope=await api('profile');
+    const profile=JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(envelope.payload),c=>c.charCodeAt(0))));
+    content.innerHTML=`<form class="card" id="network"><h2>Transport and management</h2>${field('management-url','Management HTTPS URL','url',profile.management_url)}${field('rendezvous-host','ID server hostname and optional port','text',profile.rendezvous)}${field('relay-host','Relay hostname and optional port','text',profile.relay)}${field('transport-key','Public transport trust key','text',profile.transport_public_key)}<p class="muted">These settings publish signed client configuration. DNS, HTTPS certificates, server processes and port forwarding must also match. Changing the URL does not move this server.</p><button type="submit">Publish network configuration</button></form><div class="card"><h2>Reachability check</h2><p>This check uses the saved company configuration. It can detect DNS, TCP and management trust problems from this server, and checks a native UDP response. Outside access and NAT traversal require separate tests.</p><button id="check-network" class="secondary">Check saved endpoints</button><h3>Check from a separate connection</h3><p>Copy the public network configuration and the matching swan-management executable to a computer on a separate Internet connection.</p><button id="download-network-bootstrap" class="secondary">Network configuration for outside checks</button><p><code>swan-management check-network company-network-bootstrap.json --outside-network</code></p><small>The checker reports connectivity from that computer. Confirm its location yourself and test actual direct and relay support sessions before distribution.</small><div id="network-result" role="status"></div><p class="muted">Office hosting behind CGNAT may need a company-controlled public relay. Test direct and relay sessions externally before publishing customer packages. HTTPS-only corporate proxies are not guaranteed.</p></div>`;
+    bindForm('network',async values=>{
+      profile.management_url=String(values.get('management-url')).replace(/\/$/,'');profile.rendezvous=String(values.get('rendezvous-host'));profile.relay=String(values.get('relay-host'));profile.transport_public_key=String(values.get('transport-key'));
+      await api('profile','PUT',profile);notice.textContent='Signed network configuration published. Check the saved endpoints before distribution.';
+    });
+    document.querySelector('#download-network-bootstrap').onclick=async event=>{
+      event.target.disabled=true;
+      try {
+        const bootstrap=await api('network/bootstrap');
+        const url=URL.createObjectURL(new Blob([JSON.stringify(bootstrap,null,2)],{type:'application/json'}));
+        const link=document.createElement('a');link.href=url;link.download='company-network-bootstrap.json';link.click();
+        setTimeout(()=>URL.revokeObjectURL(url),1000);
+        notice.textContent='Public network configuration downloaded. Run the check from a separate Internet connection.';
+      } catch(error){showError(error);} finally {event.target.disabled=false;}
+    };
+    document.querySelector('#check-network').onclick=async event=>{
+      event.target.disabled=true;
+      try {
+        const result=await api('network/check','POST');
+        document.querySelector('#network-result').innerHTML=`<p>Vantage point: this company server. Management HTTPS and company signature: ${result.https_and_company_signature_valid?'verified':'failed'}.</p><table><thead><tr><th>Endpoint</th><th>Result</th><th>Resolved addresses</th></tr></thead><tbody>${result.tcp_checks.map(check=>`<tr><td>${escapeText(check.name)}<small>${escapeText(check.host)}:${escapeText(check.port)}</small></td><td>${escapeText(check.result)}</td><td>${check.addresses.map(address=>`${escapeText(address.ip)} (${escapeText(address.classification)})`).join('<br>')}</td></tr>`).join('')}</tbody></table><p>Rendezvous UDP: ${result.udp_check?.reachable?'native response received':'failed or no response'}. This result is from the company server.</p><p>${escapeText(result.guidance)}</p>`;
+      } catch(error){showError(error);} finally {event.target.disabled=false;}
+    };
+  },
+  async permissions(){
+    title('Group session permissions','Set what technicians may do on devices in each group. Reducing permissions prevents existing sessions from renewing their authorization.');
+    const capabilities={keyboard:'Keyboard and mouse control',clipboard:'Clipboard',audio:'Audio',file:'File transfer',restart:'Restart device',recording:'Session recording',block_input:'Block customer input',privacy_mode:'Privacy mode'};
+    content.innerHTML=`<form id="select-policy" class="card">${field('policy-group','Device group','text','default')}<button type="submit">Load permissions</button></form><div id="policy"></div>`;
+    bindForm('select-policy',async values=>{
+      const group=String(values.get('policy-group')).trim();
+      const policy=await api('groups/'+encodeURIComponent(group)+'/permissions');
+      document.querySelector('#policy').innerHTML=`<form id="save-policy" class="card"><h2>${escapeText(group)}</h2><p>Desktop viewing requires device approval and technician group access. The permissions below limit additional actions.</p>${Object.entries(capabilities).map(([key,label])=>`<label><input type="checkbox" name="${key}" ${policy[key]===true?'checked':''}> ${label}</label>`).join('')}<button type="submit">Save permissions</button></form>`;
+      bindForm('save-policy',async selected=>{
+        const updated=Object.fromEntries(Object.keys(capabilities).map(key=>[key,selected.has(key)]));
+        await api('groups/'+encodeURIComponent(group)+'/permissions','PUT',updated);
+        notice.textContent='Permissions saved. New grants use this policy; existing sessions must reauthorize within five minutes.';
+      });
+    });
+  },
+  async devices(){title('Devices','Approve new devices and choose which support group can access them.');const devices=await api('devices');content.innerHTML='<div class="card"><table><thead><tr><th>Device</th><th>Status</th><th>Access</th><th>Actions</th></tr></thead><tbody>'+devices.map(d=>`<tr><td>${escapeText(d.name)}<small>${escapeText(d.rustdesk_id)}</small></td><td><span class="badge">${escapeText(d.state)}</span></td><td>${escapeText(d.group)}<small>${d.unattended?'Unattended consent recorded':'Customer approval required'}</small></td><td><div class="actions"><button data-approve="${escapeText(d.id)}" class="secondary">Approve / group</button><button data-revoke="${escapeText(d.id)}" class="danger">Revoke</button></div></td></tr>`).join('')+'</tbody></table><p class="muted">Only enrolled and approved devices are available to authorized technicians. Use the technician app for remote sessions.</p></div>';
+    for(const button of document.querySelectorAll('[data-approve]'))button.onclick=async()=>{const group=prompt('Device group','default');if(!group)return;try{await api('devices/'+encodeURIComponent(button.dataset.approve)+'/state','PUT',{state:'approved',group});await view('devices');}catch(error){showError(error);}};
+    for(const button of document.querySelectorAll('[data-revoke]'))button.onclick=async()=>{try{await api('devices/'+encodeURIComponent(button.dataset.revoke)+'/state','PUT',{state:'revoked',group:'default'});await view('devices');}catch(error){showError(error);}};
+  },
+  async branding(){
+    title('Branding and policies','Company changes synchronize with your installed customer and technician apps.');
+    const envelope=await api('profile');const p=JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(envelope.payload),c=>c.charCodeAt(0))));
+    content.innerHTML=`<form class="card" id="branding">${profileFields(p)}<button type="submit">Publish signed company profile</button></form>`;
+    bindProfileFields();bindForm('branding',async v=>{readProfileFields(p,v);await api('profile','PUT',p);notice.textContent='Company profile published.';});
+  },
+  async users(){title('Technicians and access','Every technician needs MFA and explicit device-group access.');const users=await api('users');content.innerHTML=`<div class="card"><table><thead><tr><th>Username</th><th>Role</th><th>Identifier</th><th>Account access</th></tr></thead><tbody>${users.map(u=>`<tr><td>${escapeText(u.username)}${u.disabled?' (disabled)':''}</td><td>${escapeText(u.role)}</td><td><code>${escapeText(u.id)}</code></td><td>${u.disabled?'Disabled':`<button data-disable-user="${escapeText(u.id)}">Disable account</button>`}</td></tr>`).join('')}</tbody></table></div><div class="grid"><form class="card" id="user"><h2>Add technician</h2>${field('username','Username')}${field('password','Initial password (14+ characters)','password')}<button type="submit">Create account</button><div id="secret"></div></form><form class="card" id="access"><h2>Manage group access</h2>${field('user_id','Technician identifier')}${field('group','Device group','text','default')}<label for="access_action">Action</label><select id="access_action" name="access_action"><option value="PUT">Grant access</option><option value="DELETE">Revoke access</option></select><button type="submit">Apply group access</button></form></div>`;bindForm('user',async v=>{const result=await api('users','POST',{username:v.get('username'),password:v.get('password'),role:'technician'});document.querySelector('#secret').textContent='Transfer privately: '+JSON.stringify(result);});bindForm('access',async v=>{await api('groups/'+encodeURIComponent(v.get('group'))+'/users/'+encodeURIComponent(v.get('user_id')),v.get('access_action'));notice.textContent=v.get('access_action')==='DELETE'?'Group access revoked. Existing sessions cannot renew authorization.':'Group access granted.';});for(const button of document.querySelectorAll('[data-disable-user]'))button.onclick=async()=>{button.disabled=true;try{await api('users/'+encodeURIComponent(button.dataset.disableUser)+'/disable','POST');await view('users');notice.textContent='Account disabled. New access and authorization renewals are denied.';}catch(error){showError(error);button.disabled=false;}};
+  },
+  async releases(){title('Software releases','Import verified project releases, then approve them for company rollout.');const rows=await api('releases');content.innerHTML=`<form id="release" class="card"><h2>Import signed release</h2>${field('public_key','Configured project release public key')}<label for="release_json">Signed release envelope JSON</label><textarea id="release_json" name="envelope" required></textarea><button type="submit">Verify and import</button></form><div class="card">${rows.map(r=>`<p><code>${escapeText(r.id)}</code> ${escapeText(r.data.version)} · ${escapeText(r.data.edition)} · ${r.approved?`Approved <button class="danger" data-withdraw="${escapeText(r.id)}">Withdraw</button>`:`<button class="secondary" data-release="${escapeText(r.id)}">Approve</button>`}</p>`).join('')||'No releases imported.'}</div>`;bindForm('release',async v=>{await api('releases','POST',{public_key:v.get('public_key'),envelope:JSON.parse(v.get('envelope'))});await view('releases');});for(const button of document.querySelectorAll('[data-release]'))button.onclick=async()=>{try{await api('releases/'+encodeURIComponent(button.dataset.release)+'/approve','POST');await view('releases');}catch(error){showError(error);}};for(const button of document.querySelectorAll('[data-withdraw]'))button.onclick=async()=>{try{await api('releases/'+encodeURIComponent(button.dataset.withdraw)+'/approve','DELETE');await view('releases');}catch(error){showError(error);}};
+  },
+  async builds(){title('Installer generation','Your Windows worker creates company bundles from approved signed releases.');const [rows,workers]=await Promise.all([api('builds'),api('workers')]);content.innerHTML=`<div class="grid"><form id="build" class="card"><h2>Generate installer bundle</h2>${field('release_id','Approved release identifier')}<button type="submit">Queue generation</button></form><div class="card"><h2>Connect a Windows worker</h2><p class="muted">Run swan-worker on a dedicated Windows machine. Keep its enrollment token private.</p><button id="worker" class="secondary">Create worker credential</button><pre id="worker_secret"></pre><h3>Registered workers</h3>${workers.map(w=>`<p><code>${escapeText(w.worker_id)}</code> ${w.disabled?'Disabled':`<button class="danger" data-revoke-worker="${escapeText(w.worker_id)}">Revoke worker</button>`}</p>`).join('')||'<p>No workers registered.</p>'}<small>Revocation cancels unfinished jobs. Completed bundles remain available until their release is withdrawn.</small></div></div><div class="card"><table><thead><tr><th>Job</th><th>Status</th><th>Result</th></tr></thead><tbody>${rows.map(r=>`<tr><td>${escapeText(r.id)}</td><td>${escapeText(r.state)}</td><td><pre>${escapeText(r.result)}</pre>${r.state==='completed'?`<button data-download="${escapeText(r.id)}">Download bundle</button><small>Website link: /api/v1/downloads/${escapeText(r.id)}</small>`:''}</td></tr>`).join('')}</tbody></table></div>`;bindForm('build',async v=>{await api('builds','POST',{release_id:v.get('release_id')});await view('builds');});for(const button of document.querySelectorAll('[data-download]'))button.onclick=async()=>{try{const response=await fetch('/api/v1/downloads/'+encodeURIComponent(button.dataset.download),{headers:{Authorization:'Bearer '+accessToken},redirect:'error'});if(!response.ok)throw new Error('Bundle download failed');const url=URL.createObjectURL(await response.blob());const link=document.createElement('a');link.href=url;link.download='SwanRemoteSupport-company.zip';link.click();setTimeout(()=>URL.revokeObjectURL(url),1000);}catch(error){showError(error);}};for(const button of document.querySelectorAll('[data-revoke-worker]'))button.onclick=async()=>{button.disabled=true;try{await api('workers/'+encodeURIComponent(button.dataset.revokeWorker),'DELETE');await view('builds');notice.textContent='Worker revoked. Its unfinished builds were cancelled.';}catch(error){showError(error);button.disabled=false;}};document.querySelector('#worker').onclick=async()=>{try{document.querySelector('#worker_secret').textContent=JSON.stringify(await api('workers','POST'),null,2);}catch(error){showError(error);}};
+  },
+  async audit(){title('Audit history','Account, enrollment, permission, release and session events.');const rows=await api('audit');content.innerHTML=`<div class="card"><table><thead><tr><th>Time</th><th>Event</th><th>Actor</th><th>Target</th></tr></thead><tbody>${rows.map(r=>`<tr><td>${escapeText(new Date(r.at*1000).toISOString())}</td><td>${escapeText(r.event)}</td><td>${escapeText(r.actor)}</td><td>${escapeText(r.target)}</td></tr>`).join('')}</tbody></table></div>`;}
+};
+for(const button of document.querySelectorAll('[data-view]'))button.onclick=()=>view(button.dataset.view);
+document.querySelector('#logout').onclick=async()=>{const token=accessToken;accessToken='';loginScreen();try{await api('logout','POST',undefined,token);}catch{}};
+initialize();
diff --git a/product/management/web/index.html b/product/management/web/index.html
new file mode 100644
index 00000000000..18c0db18540
--- /dev/null
+++ b/product/management/web/index.html
@@ -0,0 +1,3 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Swan Remote Support — Company server</title><link rel="stylesheet" href="/style.css"><script defer src="/app.js"></script></head><body>
+<aside><div class="brand"><img class="mark" src="/swan-support-mark.svg" alt="Swan Remote Support"><div>Swan<br><strong>Remote Support</strong></div></div><p class="subtitle">COMPANY SERVER</p><nav id="nav" hidden><button data-view="devices">Devices</button><button data-view="installations">Update status</button><button data-view="branding">Branding &amp; policies</button><button data-view="network">Company network</button><button data-view="users">Technicians &amp; access</button><button data-view="permissions">Session permissions</button><button data-view="releases">Software releases</button><button data-view="builds">Installer generation</button><button data-view="audit">Audit history</button><button id="logout">Sign out</button></nav><footer>Open source · AGPL-3.0<br>Powered by RustDesk</footer></aside>
+<main><header><p class="eyebrow">YOUR SUPPORT INFRASTRUCTURE</p><h1 id="title">Welcome to Swan Remote Support</h1><p id="description">Configure your company once. Keep your devices and support team connected.</p></header><div id="notice" role="status" aria-live="polite"></div><section id="content"></section></main></body></html>
diff --git a/product/management/web/style.css b/product/management/web/style.css
new file mode 100644
index 00000000000..e051cd9487d
--- /dev/null
+++ b/product/management/web/style.css
@@ -0,0 +1,3 @@
+:root{font-family:Segoe UI,system-ui,sans-serif;color:#183140;background:#f3f6f7;font-synthesis:none}*{box-sizing:border-box}body{margin:0;display:flex;min-height:100vh}aside{width:252px;position:fixed;inset:0 auto 0 0;padding:32px 24px;background:#007f82;color:white;display:flex;flex-direction:column}.brand{display:flex;gap:13px;align-items:center;font-size:19px;line-height:1.35}.brand strong{font-size:17px}.mark{height:49px;width:49px;flex-shrink:0}.subtitle{font-size:11px;letter-spacing:2px;color:#b1d0da;margin:28px 0 20px}nav button{display:block;width:100%;padding:13px 12px;margin:4px 0;text-align:left;background:transparent;color:#e3f2f5;border:none}nav button:hover,nav button.active{background:#ffffff1c}footer{margin-top:auto;color:#b1d0da;font-size:12px;line-height:1.8}main{margin-left:252px;padding:45px 55px;width:calc(100% - 252px);max-width:1450px}.eyebrow{font-size:11px;letter-spacing:2px;color:#567a8e}h1{font-size:32px;font-weight:600;margin:12px 0}header>p:last-child{color:#617b89;line-height:1.6}section{margin-top:28px}.card{background:white;border:1px solid #dce6ea;border-radius:12px;padding:28px;margin:18px 0;box-shadow:0 5px 16px #00375205}.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:20px}h2{font-size:20px;margin-top:0}label{display:block;font-size:13px;font-weight:600;margin:18px 0 7px}input,textarea,select{display:block;width:100%;padding:12px;border:1px solid #c9d9e0;border-radius:6px;font:inherit;background:#fff}textarea{min-height:260px;font-family:Consolas,monospace;font-size:13px}button{background:#007f82;color:white;border:0;border-radius:6px;padding:12px 18px;font:inherit;cursor:pointer}button.secondary{background:#e8f0f3;color:#007f82}button.danger{background:#9a3333}button:disabled{opacity:.5;cursor:wait}form>button{margin-top:22px}.actions{display:flex;gap:8px;flex-wrap:wrap}.muted{color:#607b89;font-size:13px;line-height:1.6}.badge{display:inline-block;background:#e8f2f4;color:#005374;padding:5px 10px;border-radius:20px;font-size:12px}table{border-collapse:collapse;width:100%;font-size:14px}th,td{text-align:left;border-bottom:1px solid #e3ebee;padding:14px 8px;vertical-align:top}th{color:#67818e;font-weight:500}code,pre{overflow-wrap:anywhere;white-space:pre-wrap;background:#eef3f5;padding:8px;border-radius:5px;font-size:12px}#notice:not(:empty){padding:15px;border-radius:8px;background:#fff3db;border:1px solid #ead6af}small{display:block;margin-top:7px;color:#6b7e88}.check{display:flex;align-items:center;gap:10px}.check input{width:auto}a{color:#006b88}@media(max-width:800px){aside{position:static;width:190px;padding:20px 12px}main{margin:0;width:calc(100% - 190px);padding:25px 20px}.grid{display:block}table{display:block;overflow:auto}}@media(max-width:560px){body{display:block}aside{width:100%;position:static}nav{display:flex;flex-wrap:wrap}nav button{width:auto;padding:8px}.subtitle,footer{display:none}main{width:100%;padding:24px}h1{font-size:26px}}
+.shortcut-editor{margin-top:20px;padding:16px;border:1px solid #c9d9e0;border-radius:6px}.shortcut-editor legend{padding:0 6px;font-size:13px;font-weight:600}.shortcut-row{padding-bottom:18px;margin-bottom:18px;border-bottom:1px solid #e3ebee}.shortcut-row label:first-child{margin-top:0}.shortcut-row button{margin-top:12px}
+input[type=color]{height:46px;padding:6px;cursor:pointer}
diff --git a/product/protocol/Cargo.toml b/product/protocol/Cargo.toml
new file mode 100644
index 00000000000..9a17c042dcb
--- /dev/null
+++ b/product/protocol/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+workspace = ".."
+name = "swan-protocol"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+base64.workspace = true
+ed25519-dalek.workspace = true
+rand.workspace = true
+sha2.workspace = true
+hex.workspace = true
+url.workspace = true
diff --git a/product/protocol/src/installation.rs b/product/protocol/src/installation.rs
new file mode 100644
index 00000000000..a8746e35fb7
--- /dev/null
+++ b/product/protocol/src/installation.rs
@@ -0,0 +1,79 @@
+//! Installation diagnostics are authenticated reports, never authorization or
+//! proof of installed bytes. Signed release verification remains mandatory.
+use crate::*;
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum UpdatePhase { Current, Checking, Downloading, Preparing, Installing, Recovering, Deferred, Failed }
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct InstallationIdentity {
+    pub edition: Edition,
+    pub installation_id: String,
+}
+impl InstallationIdentity {
+    pub fn validate(&self) -> Result<()> {
+        let bytes = self.installation_id.as_bytes();
+        ensure!(bytes.len() == 36 && bytes.iter().enumerate().all(|(index, byte)| {
+            if [8, 13, 18, 23].contains(&index) { *byte == b'-' }
+            else { byte.is_ascii_digit() || (b'a'..=b'f').contains(byte) }
+        }), "Expected canonical installation UUID");
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct InstallationReport {
+    pub schema: u32,
+    pub identity: InstallationIdentity,
+    /// Persisted by the reporter; equal revisions are idempotent, older ones fail.
+    pub revision: u64,
+    pub installed_sequence: u64,
+    pub installed_version: Option<String>,
+    pub phase: UpdatePhase,
+    pub target_sequence: Option<u64>,
+    pub downloaded_bytes: u64,
+    pub total_bytes: Option<u64>,
+}
+impl InstallationReport {
+    pub fn validate(&self) -> Result<()> {
+        ensure!(self.schema == 1, "Unsupported installation report schema");
+        self.identity.validate()?;
+        ensure!(self.revision > 0 && self.revision <= i64::MAX as u64, "Invalid installation report revision");
+        ensure!((self.installed_sequence == 0) == self.installed_version.is_none(), "Installed version and sequence disagree");
+        if let Some(version) = &self.installed_version {
+            let parts: Vec<_> = version.split('.').collect();
+            ensure!(version.len() <= 32 && parts.len() == 3 && parts.iter().all(|part| !part.is_empty() && part.bytes().all(|byte| byte.is_ascii_digit())), "Invalid reported version");
+        }
+        ensure!(!matches!(self.phase, UpdatePhase::Current) || self.installed_sequence > 0, "Installed state requires a recorded version");
+        ensure!(self.target_sequence != Some(0), "Invalid target sequence");
+        ensure!(!matches!(self.phase, UpdatePhase::Downloading | UpdatePhase::Preparing | UpdatePhase::Installing | UpdatePhase::Recovering) || self.target_sequence.is_some(), "Update phase requires a target release");
+        const LIMIT: u64 = 4 * 1024 * 1024 * 1024;
+        ensure!(self.downloaded_bytes <= LIMIT && self.total_bytes.is_none_or(|total| total <= LIMIT && total >= self.downloaded_bytes), "Invalid download progress");
+        ensure!(matches!(self.phase, UpdatePhase::Downloading | UpdatePhase::Preparing) || (self.downloaded_bytes == 0 && self.total_bytes.is_none()), "Byte progress requires a download phase");
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn reports_reject_unbounded_or_conflicting_status_and_active_content() {
+        let report = InstallationReport { schema: 1, identity: InstallationIdentity { edition: Edition::Customer, installation_id: "a0000000-0000-4000-8000-000000000001".into() }, revision: 1, installed_sequence: 9, installed_version: Some("1.5.7".into()), phase: UpdatePhase::Downloading, target_sequence: Some(10), downloaded_bytes: 25, total_bytes: Some(100) };
+        report.validate().unwrap();
+        for invalid in ["../another-device", "A0000000-0000-4000-8000-000000000001", "a0000000000040008000000000000001"] {
+            let mut bad = report.clone(); bad.identity.installation_id = invalid.into(); assert!(bad.validate().is_err());
+        }
+        let mut bad = report.clone(); bad.installed_version = Some("<script>".into()); assert!(bad.validate().is_err());
+        let mut bad = report.clone(); bad.total_bytes = Some(24); assert!(bad.validate().is_err());
+        let mut bad = report.clone(); bad.downloaded_bytes = u64::MAX; assert!(bad.validate().is_err());
+        let mut bad = report.clone(); bad.revision = u64::MAX; assert!(bad.validate().is_err());
+        let mut bad = report.clone(); bad.target_sequence = None; assert!(bad.validate().is_err());
+        let mut bad = report.clone(); bad.phase = UpdatePhase::Current; assert!(bad.validate().is_err());
+        let mut value = serde_json::to_value(&report).unwrap(); value["device_token"] = "never include credentials".into();
+        assert!(serde_json::from_value::<InstallationReport>(value).is_err());
+    }
+}
diff --git a/product/protocol/src/lib.rs b/product/protocol/src/lib.rs
new file mode 100644
index 00000000000..3234808d545
--- /dev/null
+++ b/product/protocol/src/lib.rs
@@ -0,0 +1,413 @@
+//! Signed company configuration and authorization. Sign the serialized payload bytes,
+//! not a re-serialization, so verifiers never depend on JSON object ordering.
+use anyhow::{ensure, Context, Result};
+use base64::{engine::general_purpose::STANDARD, Engine};
+use ed25519_dalek::{Signature, Signer, SigningKey, VerifyingKey};
+use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+pub mod installation;
+pub use installation::{InstallationIdentity,InstallationReport,UpdatePhase};
+
+pub const SCHEMA: u32 = 1;
+pub const PRODUCT: &str = "Swan Remote Support";
+pub const WIRE_PREFIX: &[u8] = b"SWAN1:";
+// Worker output and server upload validation must use the same trusted recipe.
+pub const COMPANY_BUNDLE_TEXT_FILES:[(&str,&[u8]);7]=[
+    ("Install-SwanRemoteSupport.cmd",include_bytes!("../../../deployment/windows/Install-SwanRemoteSupport.cmd")),
+    ("Install-Company.ps1",include_bytes!("../../../deployment/windows/Install-Company.ps1")),
+    ("Get-MsiInstallMode.ps1",include_bytes!("../../../deployment/windows/Get-MsiInstallMode.ps1")),
+    ("Open-Technician.ps1",include_bytes!("../../../deployment/windows/Open-Technician.ps1")),
+    ("Uninstall-Technician.ps1",include_bytes!("../../../deployment/windows/Uninstall-Technician.ps1")),
+    ("Verify-Package.ps1",include_bytes!("../../../deployment/windows/Verify-Package.ps1")),
+    ("LICENSE.txt",include_bytes!("../../../LICENCE")),
+];
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum Edition { Customer, Technician }
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct BrandingShortcut { pub label:String, pub url:String }
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Branding {
+    pub display_name: String,
+    pub primary_color: String,
+    pub logo_svg: String,
+    pub support_url: String,
+    pub consent_text: String,
+    #[serde(default,skip_serializing_if="String::is_empty")]
+    pub support_contacts: String,
+    #[serde(default,skip_serializing_if="Vec::is_empty")]
+    pub shortcuts: Vec<BrandingShortcut>,
+}
+impl Default for Branding {
+    fn default() -> Self {
+        Self { display_name: PRODUCT.into(), primary_color: "#007F82".into(),
+            logo_svg: include_str!("../../../branding/swan-support-mark.svg").into(),
+            support_url: String::new(), support_contacts:String::new(), shortcuts:Vec::new(),
+            consent_text: "Only allow remote support from a technician you trust. You can stop support or revoke ongoing access at any time.".into() }
+    }
+}
+impl Branding {
+    pub fn validate(&self) -> Result<()> {
+        ensure!(!self.display_name.trim().is_empty() && self.display_name.len() <= 100, "Invalid display name");
+        ensure!(self.primary_color.len() == 7 && self.primary_color.starts_with('#') && self.primary_color[1..].bytes().all(|b| b.is_ascii_hexdigit()), "Invalid color");
+        ensure!(self.consent_text.len() <= 4000 && !self.consent_text.trim().is_empty(), "Invalid consent text");
+        ensure!(self.logo_svg.len() <= 128 * 1024, "Logo too large");
+        // SVG is displayed as an image, never injected as HTML. Reject active/external content as defense in depth.
+        let svg = self.logo_svg.to_ascii_lowercase();
+        for forbidden in ["<script", "<foreignobject", "<!entity", "<!doctype", "javascript:", "href=", "href =", "url(", "onload", "onerror", "<image", "<use", "<style"] {
+            ensure!(!svg.contains(forbidden), "Unsupported SVG content");
+        }
+        if !self.support_url.is_empty() { https_url(&self.support_url)?; }
+        ensure!(self.support_contacts.len()<=2000 && self.support_contacts.chars().all(|c|!c.is_control() || matches!(c,'\n'|'\r'|'\t')),"Invalid support contacts");
+        ensure!(self.shortcuts.len()<=8,"Too many company shortcuts");
+        for shortcut in &self.shortcuts {
+            ensure!(!shortcut.label.trim().is_empty() && shortcut.label.len()<=100 && !shortcut.label.chars().any(char::is_control),"Invalid shortcut label");
+            ensure!(shortcut.url.len()<=2048,"Shortcut URL too long");
+            https_url(&shortcut.url)?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CompanyProfile {
+    pub schema: u32,
+    pub company_id: String,
+    pub revision: u64,
+    pub issued_at: u64,
+    pub expires_at: u64,
+    pub management_url: String,
+    pub rendezvous: String,
+    pub relay: String,
+    pub transport_public_key: String,
+    pub customer: Branding,
+    pub technician: Branding,
+    pub allow_unattended: bool,
+    pub updates_paused: bool,
+    pub rollout_percent: u8,
+    pub maintenance_start_utc: u8,
+    pub maintenance_end_utc: u8,
+    pub update_channel: String,
+    pub next_profile_public_key: Option<String>,
+}
+impl CompanyProfile {
+    pub fn validate(&self, company: &str, minimum_revision: u64, now: u64) -> Result<()> {
+        ensure!(self.schema == SCHEMA && self.company_id == company, "Wrong company or schema");
+        ensure!(self.revision >= minimum_revision && self.revision > 0, "Replayed profile");
+        ensure!(self.issued_at <= now + 60 && self.expires_at > now && self.expires_at > self.issued_at, "Expired or future profile");
+        https_url(&self.management_url)?;
+        validate_host(&self.rendezvous)?;
+        validate_host(&self.relay)?;
+        public_key(&self.transport_public_key)?;
+        self.customer.validate()?;
+        self.technician.validate()?;
+        ensure!(self.rollout_percent <= 100 && self.maintenance_start_utc <= 23 && self.maintenance_end_utc <= 23, "Invalid update policy");
+        ensure!(["stable", "test"].contains(&self.update_channel.as_str()), "Invalid channel");
+        if let Some(key) = &self.next_profile_public_key { public_key(key)?; }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SignedEnvelope { pub payload: String, pub signature: String }
+impl SignedEnvelope {
+    pub fn sign<T: Serialize>(value: &T, key: &SigningKey) -> Result<Self> {
+        let bytes = serde_json::to_vec(value)?;
+        Ok(Self { payload: STANDARD.encode(&bytes), signature: STANDARD.encode(key.sign(&bytes).to_bytes()) })
+    }
+    pub fn verify<T: DeserializeOwned>(&self, key: &VerifyingKey) -> Result<T> {
+        ensure!(self.payload.len() <= 1024 * 1024, "Payload too large");
+        let bytes = STANDARD.decode(&self.payload)?;
+        let signature = Signature::from_slice(&STANDARD.decode(&self.signature)?)?;
+        key.verify_strict(&bytes, &signature).context("Invalid signature")?;
+        Ok(serde_json::from_slice(&bytes)?)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionPermissions {
+    pub keyboard:bool,pub clipboard:bool,pub audio:bool,pub file:bool,
+    pub restart:bool,pub recording:bool,pub block_input:bool,pub privacy_mode:bool,
+}
+impl SessionPermissions {
+    pub fn support_default()->Self {Self{keyboard:true,clipboard:true,audio:true,file:true,restart:true,recording:false,block_input:false,privacy_mode:false}}
+    pub fn allows(&self,requested:&Self)->bool {
+        (!requested.keyboard || self.keyboard) && (!requested.clipboard || self.clipboard) &&
+        (!requested.audio || self.audio) && (!requested.file || self.file) &&
+        (!requested.restart || self.restart) && (!requested.recording || self.recording) &&
+        (!requested.block_input || self.block_input) && (!requested.privacy_mode || self.privacy_mode)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionGrant {
+    pub schema: u32,
+    pub company_id: String,
+    pub grant_id: String,
+    pub technician_id: String,
+    pub device_id: String,
+    pub rustdesk_id: String,
+    pub proof_public_key: String,
+    pub unattended: bool,
+    pub permissions:SessionPermissions,
+    pub issued_at: u64,
+    pub expires_at: u64,
+}
+impl SessionGrant {
+    pub fn validate(&self, company: &str, device: &str, peer: &str, now: u64) -> Result<()> {
+        ensure!(self.schema == SCHEMA && self.company_id == company && self.device_id == device && self.rustdesk_id == peer, "Wrong grant target");
+        ensure!(self.issued_at <= now + 30 && self.expires_at > now && self.expires_at <= self.issued_at + 60, "Grant expired or lifetime invalid");
+        public_key(&self.proof_public_key)?;
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ManagedLogin { pub grant: SignedEnvelope, pub challenge_signature: String }
+impl ManagedLogin {
+    pub fn to_wire(&self) -> Result<Vec<u8>> {
+        let mut wire = WIRE_PREFIX.to_vec();
+        wire.extend(serde_json::to_vec(self)?);
+        Ok(wire)
+    }
+    pub fn from_wire(wire: &[u8]) -> Result<Self> {
+        ensure!(wire.len() <= 16384, "Login payload too large");
+        ensure!(wire.starts_with(WIRE_PREFIX), "Managed grant required");
+        Ok(serde_json::from_slice(&wire[WIRE_PREFIX.len()..])?)
+    }
+    pub fn prove(grant: SignedEnvelope, key: &SigningKey, challenge: &str) -> Self {
+        Self { grant, challenge_signature: STANDARD.encode(key.sign(challenge.as_bytes()).to_bytes()) }
+    }
+    pub fn verify_proof(&self, grant: &SessionGrant, challenge: &str) -> Result<()> {
+        public_key(&grant.proof_public_key)?.verify_strict(challenge.as_bytes(), &Signature::from_slice(&STANDARD.decode(&self.challenge_signature)?)?).context("Invalid session proof")
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct InstalledFile { pub path:String,pub sha256:String }
+impl InstalledFile {
+    pub fn validate(&self)->Result<()> {
+        ensure!(!self.path.is_empty() && self.path.len()<=240 && self.sha256.len()==64 && self.sha256.bytes().all(|byte|byte.is_ascii_hexdigit()),"Invalid installed file identity");
+        for component in self.path.split('/') {
+            ensure!(!component.is_empty() && component!="." && component!=".." && !component.ends_with(['.',' ']) && component.bytes().all(|byte|byte.is_ascii_alphanumeric() || b" _-.@+".contains(&byte)),"Unsafe installed file path");
+            let stem=component.split('.').next().unwrap_or("").to_ascii_uppercase();
+            ensure!(!["CON","PRN","AUX","NUL","COM1","COM2","COM3","COM4","COM5","COM6","COM7","COM8","COM9","LPT1","LPT2","LPT3","LPT4","LPT5","LPT6","LPT7","LPT8","LPT9"].contains(&stem.as_str()),"Reserved installed file path");
+        }
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Release {
+    pub schema: u32,
+    pub product: String,
+    pub version: String,
+    pub sequence: u64,
+    pub edition: Edition,
+    pub architecture: String,
+    pub channel: String,
+    pub expires_at: u64,
+    pub artifact_url: String,
+    pub sha256: String,
+    pub installed_sha256: String,
+    pub installed_files:Vec<InstalledFile>,
+    pub agent_url: String,
+    pub agent_sha256: String,
+    pub publisher: String,
+    pub publisher_certificate_sha256: String,
+    pub windows_versions: Vec<String>,
+    pub source_url: String,
+    pub format: String,
+    #[serde(default)]
+    pub rollback_protocol:u32,
+}
+impl Release {
+    pub fn validate(&self, edition: &Edition, minimum_sequence: u64, now: u64) -> Result<()> {
+        ensure!(self.schema == SCHEMA && self.product == PRODUCT && &self.edition == edition, "Wrong product or edition");
+        ensure!(self.architecture == "x64" && self.sequence > minimum_sequence && self.expires_at > now, "Incompatible, expired or replayed release");
+        ensure!(["stable", "test"].contains(&self.channel.as_str()) && ["exe", "msi"].contains(&self.format.as_str()), "Invalid release type");
+        ensure!(self.rollback_protocol<=1,"Unsupported rollback protocol");
+        ensure!(self.sha256.len() == 64 && self.sha256.bytes().all(|x| x.is_ascii_hexdigit()) && !self.publisher.is_empty(), "Invalid artifact identity");
+        ensure!(self.installed_sha256.len()==64 && self.installed_sha256.bytes().all(|x|x.is_ascii_hexdigit()),"Invalid installed executable identity");
+        ensure!(!self.installed_files.is_empty() && self.installed_files.len()<=4096,"Installed payload manifest required");
+        let mut paths=std::collections::HashSet::new();
+        for file in &self.installed_files {file.validate()?;ensure!(!file.path.eq_ignore_ascii_case("RuntimeBroker_rustdesk.exe"),"Windows-owned helper cannot be supplied by project release metadata");ensure!(paths.insert(file.path.to_ascii_lowercase()),"Duplicate installed file path");}
+        let executable=if self.edition==Edition::Technician {"SwanRemoteSupport-Technician.exe"}else{"Swan Remote Support.exe"};
+        ensure!(self.installed_files.iter().any(|file|file.path.eq_ignore_ascii_case(executable) && file.sha256.eq_ignore_ascii_case(&self.installed_sha256)),"Manifest must contain the installed executable identity");
+        if self.edition==Edition::Customer {
+            for library in ["librustdesk.dll","flutter_windows.dll"]{ensure!(paths.contains(library),"Customer payload manifest lacks a required native library");}
+        }else{ensure!(self.installed_files.len()==1,"Portable technician payload must identify its complete packed executable");}
+        ensure!(self.publisher_certificate_sha256.len()==64 && self.publisher_certificate_sha256.bytes().all(|x|x.is_ascii_hexdigit()),"Invalid publisher certificate identity");
+        ensure!(!self.windows_versions.is_empty() && self.windows_versions.len()<=6 && self.windows_versions.iter().all(|v|WINDOWS_VERSIONS.contains(&v.as_str())),"Invalid Windows compatibility declaration");
+        let fields: Vec<_> = self.version.split('.').collect();
+        ensure!(fields.len() == 3 && fields.iter().all(|v| !v.is_empty() && v.bytes().all(|c| c.is_ascii_digit())), "Expected numeric major.minor.patch");
+        https_url(&self.artifact_url)?;
+        https_url(&self.agent_url)?;
+        ensure!(self.agent_sha256.len() == 64 && self.agent_sha256.bytes().all(|x| x.is_ascii_hexdigit()), "Invalid agent hash");
+        https_url(&self.source_url)?;
+        Ok(())
+    }
+}
+
+pub const WINDOWS_VERSIONS:&[&str]=&["windows_10","windows_11","server_2016","server_2019","server_2022","server_2025"];
+
+pub fn https_url(value: &str) -> Result<url::Url> {
+    let url = url::Url::parse(value)?;
+    ensure!(url.scheme() == "https" && url.host_str().is_some() && url.username().is_empty() && url.password().is_none() && url.fragment().is_none(), "Expected HTTPS URL without credentials or fragment");
+    Ok(url)
+}
+pub fn validate_host(value: &str) -> Result<()> {
+    ensure!(!value.is_empty() && value.len() <= 253, "Invalid transport endpoint");
+    ensure!(value.bytes().all(|c| c.is_ascii_alphanumeric() || b".-:[]".contains(&c)), "Invalid transport address");
+    let endpoint=url::Url::parse(&format!("tcp://{value}"))?;
+    ensure!(endpoint.host_str().is_some() && endpoint.username().is_empty() && endpoint.password().is_none() && endpoint.query().is_none() && endpoint.fragment().is_none() && ["","/"].contains(&endpoint.path()),"Expected transport hostname and optional port");
+    ensure!(endpoint.port()!=Some(0),"Transport port zero is invalid");
+    Ok(())
+}
+pub fn transport_socket(value:&str,default_port:u16)->Result<(String,u16)> {
+    validate_host(value)?;ensure!(default_port>0,"Transport port zero is invalid");
+    let endpoint=url::Url::parse(&format!("tcp://{value}"))?;
+    let host=endpoint.host_str().context("Missing transport hostname")?.trim_matches(['[',']']).to_string();
+    Ok((host,endpoint.port().unwrap_or(default_port)))
+}
+pub fn public_key(value: &str) -> Result<VerifyingKey> {
+    let bytes: [u8; 32] = STANDARD.decode(value)?.try_into().map_err(|_| anyhow::anyhow!("Expected 32-byte key"))?;
+    let key = VerifyingKey::from_bytes(&bytes)?;
+    ensure!(!key.is_weak(), "Weak configuration or session proof key");
+    Ok(key)
+}
+pub fn random_token() -> String {
+    use rand::RngCore;
+    let mut bytes = [0u8; 32]; rand::rngs::OsRng.fill_bytes(&mut bytes); hex::encode(bytes)
+}
+pub fn signing_key_from_hex(value:&str)->Result<SigningKey> {
+    let bytes:[u8;32]=hex::decode(value)?.try_into().map_err(|_|anyhow::anyhow!("Expected 32-byte signing key"))?;
+    Ok(SigningKey::from_bytes(&bytes))
+}
+pub fn digest(bytes: impl AsRef<[u8]>) -> String { hex::encode(Sha256::digest(bytes.as_ref())) }
+pub fn bundle_text(bytes:&[u8])->Result<Vec<u8>> {
+    // Windows and Linux source checkouts must produce identical bundled scripts.
+    Ok(std::str::from_utf8(bytes)?.replace("\r\n","\n").into_bytes())
+}
+pub const COMPANY_BUNDLE_RECIPE_HEADER:&str="x-swan-bundle-recipe";
+pub fn company_bundle_recipe()->Result<String> {
+    bundle_recipe(&COMPANY_BUNDLE_TEXT_FILES)
+}
+fn bundle_recipe(files:&[(&str,&[u8])])->Result<String> {
+    // Version the fixed ZIP layout, then frame names and normalized contents.
+    // This is a compatibility check, never a replacement for upload validation.
+    let mut hash=Sha256::new();hash.update(b"swan-company-bundle-v1\0");
+    hash.update((files.len() as u64).to_be_bytes());
+    for (name,bytes) in files {
+        let bytes=bundle_text(bytes)?;
+        hash.update((name.len() as u64).to_be_bytes());hash.update(name.as_bytes());
+        hash.update((bytes.len() as u64).to_be_bytes());hash.update(bytes);
+    }
+    Ok(hex::encode(hash.finalize()))
+}
+pub fn now() -> u64 { std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0) }
+pub fn maintenance_open(start: u8, end: u8, now: u64) -> bool {
+    let hour = ((now / 3600) % 24) as u8;
+    if start == end { true } else if start < end { hour >= start && hour < end } else { hour >= start || hour < end }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn bundle_recipe_tracks_exact_names_and_normalized_contents() {
+        let original=bundle_recipe(&[("setup.ps1",b"one\r\ntwo\r\n")]).unwrap();
+        assert_eq!(original,bundle_recipe(&[("setup.ps1",b"one\ntwo\n")]).unwrap());
+        assert_ne!(original,bundle_recipe(&[("other.ps1",b"one\ntwo\n")]).unwrap());
+        assert_ne!(original,bundle_recipe(&[("setup.ps1",b"changed\n")]).unwrap());
+        assert_ne!(bundle_recipe(&[("ab",b"c")]).unwrap(),bundle_recipe(&[("a",b"bc")]).unwrap());
+        assert_ne!(company_bundle_recipe().unwrap(),bundle_recipe(&COMPANY_BUNDLE_TEXT_FILES[1..]).unwrap());
+        assert!(bundle_recipe(&[("invalid",&[0xff])]).is_err());
+    }
+    #[test]
+    fn company_contact_shortcuts_validate_and_old_profiles_keep_defaults() {
+        let value=serde_json::to_value(Branding::default()).unwrap();
+        assert!(value.get("support_contacts").is_none());assert!(value.get("shortcuts").is_none());
+        let mut brand:Branding=serde_json::from_value(value).unwrap();
+        brand.support_contacts="Support: help@example.com\nPhone: +27 10 123 4567".into();
+        brand.shortcuts=vec![BrandingShortcut{label:"Help centre".into(),url:"https://example.com/help".into()}];
+        assert!(brand.validate().is_ok());
+        for url in ["http://example.com","https://user:password@example.com","file:///C:/Windows","javascript:alert(1)"] {
+            brand.shortcuts[0].url=url.into();assert!(brand.validate().is_err());
+        }
+        brand.shortcuts[0].url="https://example.com/help".into();brand.shortcuts[0].label="\n".into();assert!(brand.validate().is_err());
+        brand.shortcuts[0].label="Help".into();brand.shortcuts=vec![brand.shortcuts[0].clone();9];assert!(brand.validate().is_err());
+        brand.shortcuts.clear();brand.support_contacts="Hidden\0contact".into();assert!(brand.validate().is_err());
+    }
+    #[test]
+    fn public_keys_reject_small_order_points() {
+        let mut identity = [0u8; 32];
+        identity[0] = 1;
+        assert!(public_key(&STANDARD.encode(identity)).is_err());
+        assert!(public_key(&STANDARD.encode([0u8; 32])).is_err());
+        let signing = SigningKey::from_bytes(&[42u8; 32]);
+        assert!(public_key(&STANDARD.encode(signing.verifying_key().to_bytes())).is_ok());
+    }
+    #[test]
+    fn signed_payload_rejects_tampering_and_wrong_key() {
+        let key = SigningKey::from_bytes(&[7;32]);
+        let mut envelope = SignedEnvelope::sign(&"company", &key).unwrap();
+        assert_eq!(envelope.verify::<String>(&key.verifying_key()).unwrap(), "company");
+        assert!(envelope.verify::<String>(&SigningKey::from_bytes(&[8;32]).verifying_key()).is_err());
+        envelope.payload = STANDARD.encode(b"\"attacker\"");
+        assert!(envelope.verify::<String>(&key.verifying_key()).is_err());
+    }
+    #[test]
+    fn grant_is_target_bound_expiring_and_requires_challenge_proof() {
+        let key = SigningKey::from_bytes(&[3;32]);
+        let grant = SessionGrant { schema: 1, company_id: "a".into(), grant_id: "jti".into(), technician_id:"t".into(), device_id:"d".into(), rustdesk_id:"123".into(), proof_public_key: STANDARD.encode(key.verifying_key().as_bytes()), unattended:false, permissions:SessionPermissions::support_default(), issued_at:100, expires_at:160 };
+        assert!(grant.validate("a","d","123",101).is_ok());
+        assert!(grant.validate("b","d","123",101).is_err());
+        assert!(grant.validate("a","d","124",101).is_err());
+        assert!(grant.validate("a","d","123",160).is_err());
+        let login = ManagedLogin::prove(SignedEnvelope::sign(&grant,&key).unwrap(), &key,"nonce");
+        assert!(login.verify_proof(&grant,"nonce").is_ok());
+        assert!(login.verify_proof(&grant,"different nonce").is_err());
+        assert!(ManagedLogin::from_wire(b"legacy-password").is_err());
+    }
+    #[test]
+    fn maintenance_windows_wrap_midnight() {
+        assert!(maintenance_open(22,3,23*3600)); assert!(maintenance_open(22,3,3600));
+        assert!(!maintenance_open(22,3,12*3600)); assert!(maintenance_open(0,0,12*3600));
+    }
+    #[test]
+    fn installed_file_paths_reject_windows_aliases_and_traversal() {
+        for path in ["../outside.dll","/absolute.dll","C:/outside.dll","data\\outside.dll","file.dll:stream","file.dll.","data//file.dll","CON.txt","data/LPT1.dll","data/../file.dll"] {
+            assert!(InstalledFile{path:path.into(),sha256:"a".repeat(64)}.validate().is_err(),"Accepted unsafe path {path}");
+        }
+        assert!(InstalledFile{path:"data/flutter_assets/fonts/MaterialIcons-Regular.otf".into(),sha256:"a".repeat(64)}.validate().is_ok());
+    }
+    #[test]
+    fn releases_reject_replay_wrong_edition_expiry_and_missing_installed_identity() {
+        let mut release=Release {schema:1,product:PRODUCT.into(),version:"1.5.0".into(),sequence:2,edition:Edition::Customer,architecture:"x64".into(),channel:"stable".into(),expires_at:200,artifact_url:"https://releases.example/package.exe".into(),sha256:"a".repeat(64),installed_sha256:"b".repeat(64),installed_files:vec![InstalledFile{path:"Swan Remote Support.exe".into(),sha256:"b".repeat(64)},InstalledFile{path:"librustdesk.dll".into(),sha256:"c".repeat(64)},InstalledFile{path:"flutter_windows.dll".into(),sha256:"d".repeat(64)}],agent_url:"https://releases.example/agent.exe".into(),agent_sha256:"c".repeat(64),publisher:"Example".into(),publisher_certificate_sha256:"d".repeat(64),windows_versions:vec!["windows_11".into()],source_url:"https://releases.example/source.tar.gz".into(),format:"exe".into(),rollback_protocol:0};
+        assert!(release.validate(&Edition::Customer,1,100).is_ok());
+        let mut legacy=serde_json::to_value(&release).unwrap();legacy.as_object_mut().unwrap().remove("rollback_protocol");
+        assert_eq!(serde_json::from_value::<Release>(legacy).unwrap().rollback_protocol,0);
+        release.rollback_protocol=2;assert!(release.validate(&Edition::Customer,1,100).is_err());
+        release.rollback_protocol=1;assert!(release.validate(&Edition::Customer,1,100).is_ok());
+        assert!(release.validate(&Edition::Customer,2,100).is_err());
+        assert!(release.validate(&Edition::Technician,0,100).is_err());
+        assert!(release.validate(&Edition::Customer,0,200).is_err());
+        release.windows_versions=vec!["server_core".into()];assert!(release.validate(&Edition::Customer,0,100).is_err());
+        release.windows_versions=vec!["windows_11".into()];release.publisher_certificate_sha256="publisher label".into();assert!(release.validate(&Edition::Customer,0,100).is_err());
+        release.publisher_certificate_sha256="d".repeat(64);release.installed_sha256.clear();assert!(release.validate(&Edition::Customer,0,100).is_err());
+    }
+}
diff --git a/product/worker/Cargo.toml b/product/worker/Cargo.toml
new file mode 100644
index 00000000000..aa62909eaaf
--- /dev/null
+++ b/product/worker/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+workspace = ".."
+name = "swan-worker"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+swan-protocol = { path = "../protocol" }
+swan-agent = { path = "../agent" }
+anyhow.workspace = true
+serde_json.workspace = true
+reqwest.workspace = true
+tokio.workspace = true
+zip = { version = "2", default-features = false, features = ["deflate"] }
+
+[target.'cfg(windows)'.dependencies]
+windows-service = "0.8"
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_System_Console"] }
diff --git a/product/worker/src/configuration.rs b/product/worker/src/configuration.rs
new file mode 100644
index 00000000000..ca26eec3144
--- /dev/null
+++ b/product/worker/src/configuration.rs
@@ -0,0 +1,84 @@
+use anyhow::{ensure,Context,Result};
+use serde_json::Value;
+use std::{ffi::OsStr,path::PathBuf};
+use swan_protocol::{https_url,public_key};
+
+pub struct Configuration {
+    pub management_url:String,
+    pub worker_token:String,
+    pub release_public_key:String,
+    pub profile_public_key:String,
+}
+
+impl Configuration {
+    fn decode(bytes:&[u8])->Result<Self> {
+        ensure!(!bytes.is_empty() && bytes.len()<=16*1024,"Invalid worker configuration size");
+        let mut value:Value=serde_json::from_slice(bytes).map_err(|_|anyhow::anyhow!("Invalid worker configuration JSON"))?;
+        let fields=value.as_object_mut().context("Worker configuration must be an object")?;
+        ensure!(fields.len()==4 && fields.keys().all(|key|matches!(key.as_str(),"management_url"|"worker_token"|"release_public_key"|"profile_public_key")),"Worker configuration requires exactly the documented fields");
+        let mut take=|name|match fields.remove(name) {Some(Value::String(value))=>Ok(value),_=>Err(anyhow::anyhow!("Worker configuration fields must be strings"))};
+        let result=Self{management_url:take("management_url")?,worker_token:take("worker_token")?,release_public_key:take("release_public_key")?,profile_public_key:take("profile_public_key")?};
+        result.validate()?;Ok(result)
+    }
+    fn validate(&self)->Result<()> {
+        ensure!(self.management_url.len()<=2048,"Worker management URL is too long");
+        let url=https_url(&self.management_url)?;
+        ensure!(url.query().is_none() && url.fragment().is_none(),"Worker requires an HTTPS origin without query or fragment");
+        ensure!((32..=256).contains(&self.worker_token.len()) && self.worker_token.bytes().all(|byte|byte.is_ascii_graphic()),"Invalid worker credential format");
+        public_key(&self.release_public_key)?;public_key(&self.profile_public_key)?;
+        Ok(())
+    }
+}
+
+fn configuration_path(service:bool,path:Option<&OsStr>)->Result<Option<PathBuf>> {
+    if let Some(path)=path {
+        let path=PathBuf::from(path);ensure!(path.is_absolute(),"Private worker configuration path must be absolute");
+        Ok(Some(path))
+    }else{
+        ensure!(!service,"Worker services require protected file configuration; revoke legacy registry credentials before upgrading");
+        Ok(None)
+    }
+}
+
+pub fn load(service:bool)->Result<Configuration> {
+    let selected=std::env::var_os("SWAN_WORKER_CONFIG");
+    if let Some(path)=configuration_path(service,selected.as_deref())? {
+        #[cfg(windows)] {return Configuration::decode(&swan_agent::update::read_worker_configuration(&path)?);}
+        #[cfg(not(windows))] {let _=path;anyhow::bail!("Private installer worker configuration requires Windows");}
+    }
+    // Foreground operator processes may supply environment credentials. SCM
+    // services must never fall back to registry-persisted secret environment.
+    let result=Configuration{
+        management_url:std::env::var("SWAN_MANAGEMENT_URL").context("Set worker company HTTPS URL")?,
+        worker_token:std::env::var("SWAN_WORKER_TOKEN").context("Set foreground worker credential")?,
+        release_public_key:std::env::var("SWAN_RELEASE_PUBLIC_KEY").context("Pin project release public key")?,
+        profile_public_key:std::env::var("SWAN_PROFILE_PUBLIC_KEY").context("Pin company profile public key")?,
+    };
+    result.validate()?;Ok(result)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn fixture()->Value {serde_json::json!({"management_url":"https://company.example.test","worker_token":"fixture-secret-worker-credential-00000000","release_public_key":"11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=","profile_public_key":"11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo="})}
+    #[test]
+    fn service_cannot_downgrade_to_registry_environment_or_relative_configuration() {
+        assert!(configuration_path(true,None).is_err());
+        assert!(configuration_path(true,Some(OsStr::new("relative.json"))).is_err());
+        assert!(configuration_path(false,None).unwrap().is_none());
+        assert!(configuration_path(true,Some(std::env::temp_dir().as_os_str())).unwrap().is_some());
+    }
+    #[test]
+    fn private_configuration_rejects_wrong_fields_and_invalid_trust_without_echoing_secrets() {
+        assert!(Configuration::decode(&serde_json::to_vec(&fixture()).unwrap()).is_ok());
+        for field in ["management_url","worker_token","release_public_key","profile_public_key"] {
+            let mut invalid=fixture();invalid[field]=Value::String("fixture-secret".into());
+            let error=Configuration::decode(&serde_json::to_vec(&invalid).unwrap()).err().unwrap();
+            assert!(!error.to_string().contains("fixture-secret"));
+        }
+        let mut invalid=fixture();invalid["command"]=Value::String("fixture-secret".into());
+        assert!(Configuration::decode(&serde_json::to_vec(&invalid).unwrap()).is_err());
+        assert!(Configuration::decode(&vec![b'x';16385]).is_err());
+        assert!(Configuration::decode(b"fixture-secret").is_err());
+    }
+}
diff --git a/product/worker/src/main.rs b/product/worker/src/main.rs
new file mode 100644
index 00000000000..e8b7a8597d4
--- /dev/null
+++ b/product/worker/src/main.rs
@@ -0,0 +1,397 @@
+use anyhow::{ensure,Context,Result};
+use serde_json::{json,Value};
+use std::{io::Write,path::{Path,PathBuf}};
+use swan_agent::Bootstrap;
+use swan_protocol::*;
+mod configuration;
+
+#[cfg(windows)]
+mod windows;
+
+fn main()->Result<()> {
+    #[cfg(windows)]
+    if std::env::args().any(|argument|argument=="--service") {return windows::dispatch();}
+    let arguments:Vec<String>=std::env::args().collect();
+    #[cfg(windows)]
+    if arguments.get(1).map(String::as_str)==Some("prepare-worker-directory") {
+        ensure!(arguments.len()==3,"Usage: swan-worker prepare-worker-directory PATH");
+        swan_agent::update::prepare_worker_directory(Path::new(&arguments[2]))?;
+        println!("Fresh private worker directory created; no job claimed.");return Ok(());
+    }
+    if arguments.get(1).map(String::as_str)==Some("check-configuration") {
+        ensure!(arguments.len()==2,"Usage: swan-worker check-configuration");configuration::load(true)?;
+        println!("Protected worker configuration verified; no job claimed.");return Ok(());
+    }
+    ensure!(arguments.len()==1,"Unknown worker command; no job claimed");
+    // This executable entrypoint owns the foreground runtime; SCM creates its
+    // runtime on the separate service entrypoint thread before calling run.
+    let (_stop,receiver)=tokio::sync::oneshot::channel();
+    tokio::runtime::Runtime::new()?.block_on(run(receiver))
+}
+
+async fn run(mut stop:tokio::sync::oneshot::Receiver<()>)->Result<()> {
+    tokio::select! {
+        _=&mut stop=>Ok(()),
+        outcome=run_worker()=>outcome,
+    }
+}
+
+async fn run_worker()->Result<()> {
+    ensure!(cfg!(windows),"Installer worker requires Windows for Authenticode verification");
+    let service=std::env::args().any(|argument|argument=="--service");
+    let configuration=tokio::task::spawn_blocking(move ||configuration::load(service)).await.context("Worker configuration task failed")??;
+    let server=configuration.management_url;let token=configuration.worker_token;
+    let release_key=configuration.release_public_key;let company_key=configuration.profile_public_key;
+    let output=if service {
+        PathBuf::from(std::env::var_os("ProgramData").context("Missing worker ProgramData")?).join("SwanInstallerWorker/artifacts")
+    }else{PathBuf::from(std::env::var("SWAN_ARTIFACT_DIR").context("Set worker artifact output directory")?)};
+    tokio::fs::create_dir_all(&output).await?;
+    let client=swan_agent::http_client(600,false)?;
+    let recipe=company_bundle_recipe()?;
+    loop {
+        // Older servers do not understand the claim header. Check their recipe
+        // endpoint first so upgrading only the worker cannot strand their jobs.
+        if let Err(error)=check_server_recipe(&client,&server,&token,&recipe).await {
+            eprintln!("Worker compatibility check failed: {error:#}. Install matching server and worker releases; no build was requested.");
+            tokio::time::sleep(std::time::Duration::from_secs(15)).await;
+            continue;
+        }
+        let response=client.post(format!("{}/api/v1/worker/claim",server.trim_end_matches('/'))).bearer_auth(&token).header(COMPANY_BUNDLE_RECIPE_HEADER,&recipe).send().await;
+        match response {
+            Ok(response) if response.status().is_success()=>{
+                if let Err(error)=process_claim(response,&client,&server,&token,&output,&release_key,&company_key).await {
+                    eprintln!("Worker job processing failed: {error:#}. Continuing polling; the server retains the job for recovery.");
+                }
+            }
+            Ok(response) if response.status()==reqwest::StatusCode::CONFLICT=>eprintln!("Company bundle recipe mismatch; install matching server and worker releases. No build was claimed."),
+            Ok(response)=>eprintln!("Worker polling failed: {}",response.status()),
+            Err(_)=>eprintln!("Worker management endpoint unavailable; retrying"),
+        }
+        tokio::time::sleep(std::time::Duration::from_secs(15)).await;
+    }
+}
+
+async fn check_server_recipe(client:&reqwest::Client,server:&str,token:&str,recipe:&str)->Result<()> {
+    let response=client.get(format!("{}/api/v1/worker/recipe",server.trim_end_matches('/'))).bearer_auth(token).send().await?.error_for_status()?;
+    let value:Value=response.json().await?;
+    ensure!(value["schema"].as_u64()==Some(1) && value["bundle_recipe"].as_str()==Some(recipe),"Company bundle recipe mismatch");
+    Ok(())
+}
+
+async fn process_claim(response:reqwest::Response,client:&reqwest::Client,server:&str,token:&str,output:&Path,release_key:&str,company_key:&str)->Result<()> {
+                let value:Value=response.json().await?;
+                if !value.is_null(){
+                    let id=value["id"].as_str().context("Missing build identity")?;
+                    // Server-generated UUIDs become filenames, never executable commands.
+                    ensure!(id.len()==36 && id.bytes().all(|c|c.is_ascii_hexdigit() || c==b'-'),"Invalid job identity");
+                    let outcome=build(&client,&value["job"],&output,id,&release_key,&company_key).await;
+                    let result=match outcome {
+                        Ok((name,hash))=>{
+                            let bytes=tokio::fs::read(output.join(name)).await?;
+                            upload_build(client,server,token,id,bytes,&hash).await?
+                        },
+                        Err(error)=>{eprintln!("Build {id} failed: {error}");json!({"success":false,"artifact_url":"","sha256":"","log":"Build failed; see the protected worker log. No package was published."})}
+                    };
+                    report_completion(client,server,token,id,&result).await?;
+                }
+    Ok(())
+}
+
+async fn report_completion(client:&reqwest::Client,server:&str,token:&str,id:&str,result:&Value)->Result<()> {
+    send_idempotent(client.put(format!("{}/api/v1/worker/builds/{id}",server.trim_end_matches('/'))).bearer_auth(token).json(result)).await
+}
+
+#[derive(Debug)]
+struct ControlRejection { status:reqwest::StatusCode,reason:&'static str }
+impl std::fmt::Display for ControlRejection {
+    fn fmt(&self,formatter:&mut std::fmt::Formatter<'_>)->std::fmt::Result {
+        write!(formatter,"{}: {}",self.status,self.reason)
+    }
+}
+impl std::error::Error for ControlRejection {}
+impl ControlRejection {
+    fn invalid_bundle(&self)->bool {
+        matches!(self.status,reqwest::StatusCode::BAD_REQUEST|reqwest::StatusCode::PAYLOAD_TOO_LARGE|
+            reqwest::StatusCode::UNSUPPORTED_MEDIA_TYPE|reqwest::StatusCode::UNPROCESSABLE_ENTITY)
+    }
+}
+
+fn public_rejection_reason(body:&[u8])->&'static str {
+    // Never copy arbitrary server text, credentials, URLs or headers into logs.
+    const REASONS:&[&str]=&[
+        "Unexpected ZIP footer","Unsupported ZIP entry layout","Ambiguous ZIP entry headers",
+        "Unexpected bundle contents","Missing bundle file","Bundle script or license mismatch",
+        "Bundle binary hash mismatch","Wrong company profile","Wrong release metadata",
+        "Noncanonical bootstrap configuration","Invalid bootstrap configuration",
+        "Expired or invalid bundle profile","Bootstrap trust mismatch","Expired release",
+        "Artifact too large","Conflicting artifact retry","Duplicate ZIP entry",
+        "Unaccounted ZIP contents","Invalid ZIP bounds","Invalid ZIP directory bounds",
+        "Invalid bundle entry type or size","Bundle entry too large","Invalid ZIP artifact",
+    ];
+    const UNKNOWN:&str="Unrecognized server rejection; review company server logs";
+    if body.len()>4096{return UNKNOWN;}
+    let Ok(value)=serde_json::from_slice::<Value>(body) else{return UNKNOWN;};
+    let Some(reason)=value.get("error").and_then(Value::as_str) else{return UNKNOWN;};
+    REASONS.iter().copied().find(|candidate|*candidate==reason).unwrap_or(UNKNOWN)
+}
+
+async fn control_rejection(mut response:reqwest::Response)->ControlRejection {
+    let status=response.status();
+    let details=tokio::time::timeout(std::time::Duration::from_secs(2),async {
+        let mut body=Vec::new();
+        while let Some(chunk)=response.chunk().await? {
+            ensure!(body.len()+chunk.len()<=4096,"Worker rejection details exceed diagnostic limit");
+            body.extend_from_slice(&chunk);
+        }
+        Ok::<_,anyhow::Error>(body)
+    }).await;
+    let reason=match details {
+        Ok(Ok(body))=>public_rejection_reason(&body),
+        Ok(Err(_))=>"Server rejection details could not be read within the diagnostic limit",
+        Err(_)=>"Server rejection details timed out",
+    };
+    ControlRejection{status,reason}
+}
+
+async fn upload_build(client:&reqwest::Client,server:&str,token:&str,id:&str,bytes:Vec<u8>,hash:&str)->Result<Value> {
+    let uploaded=send_idempotent(client.put(format!("{}/api/v1/worker/builds/{id}/artifact",server.trim_end_matches('/')))
+        .bearer_auth(token).header("Content-Type","application/zip").body(bytes)).await;
+    match uploaded {
+        Ok(())=>Ok(json!({"success":true,"artifact_url":format!("{}/api/v1/downloads/{id}",server.trim_end_matches('/')),"sha256":hash,"log":"Verified signed inputs and uploaded company bundle."})),
+        Err(error) if error.downcast_ref::<ControlRejection>().is_some_and(ControlRejection::invalid_bundle)=>{
+            eprintln!("Build {id} upload rejected: {error}");
+            Ok(json!({"success":false,"artifact_url":"","sha256":"","log":format!("Bundle upload rejected ({error}). No package was published; retained output requires review.")}))
+        },
+        Err(error)=>Err(error),
+    }
+}
+
+async fn send_idempotent(request:reqwest::RequestBuilder)->Result<()> {
+    for attempt in 0..3 {
+        let response=request.try_clone().context("Worker retry requires a buffered request")?.send().await;
+        match response {
+            Ok(response) if response.status().is_success()=>return Ok(()),
+            Ok(response) if !response.status().is_server_error() && response.status()!=reqwest::StatusCode::TOO_MANY_REQUESTS=>{
+                return Err(control_rejection(response).await.into());
+            },
+            _=>{},
+        }
+        if attempt<2 {tokio::time::sleep(std::time::Duration::from_secs(5*(attempt+1))).await;}
+    }
+    anyhow::bail!("Worker upload or report unavailable after bounded retries; server retains job recovery")
+}
+
+async fn build(_client:&reqwest::Client,job:&Value,output:&Path,id:&str,release_key:&str,company_key:&str)->Result<(String,String)> {
+    ensure!(job["release_public_key"].as_str()==Some(release_key) && job["profile_public_key"].as_str()==Some(company_key),"Worker trust pins do not match the company job");
+    let release_envelope:SignedEnvelope=serde_json::from_value(job["release"].clone())?;
+    let release:Release=release_envelope.verify(&public_key(release_key)?)?;
+    release.validate(&release.edition,0,now())?;
+    let profile_envelope:SignedEnvelope=serde_json::from_value(job["profile"].clone())?;
+    let profile:CompanyProfile=profile_envelope.verify(&public_key(company_key)?)?;
+    profile.validate(&profile.company_id,0,now())?;
+    let work=output.join(format!("work-{id}"));tokio::fs::create_dir_all(&work).await?;
+    let installer=work.join(format!("SwanRemoteSupport-install.{}",release.format));
+    let agent=work.join("swan-agent.exe");
+    let artifact_client=swan_agent::http_client(600,true)?;
+    download(&artifact_client,&release.artifact_url,&installer,&release.sha256).await?;
+    download(&artifact_client,&release.agent_url,&agent,&release.agent_sha256).await?;
+    let output=output.to_owned();let id=id.to_owned();let company_key=company_key.to_owned();let release_key=release_key.to_owned();
+    tokio::task::spawn_blocking(move ||package_verified(output,&id,work,installer,agent,release,profile,release_envelope,profile_envelope,&release_key,&company_key))
+        .await.context("Installer verification and packaging task failed")?
+}
+
+fn package_verified(output:PathBuf,id:&str,work:PathBuf,installer:PathBuf,agent:PathBuf,release:Release,profile:CompanyProfile,release_envelope:SignedEnvelope,profile_envelope:SignedEnvelope,release_key:&str,company_key:&str)->Result<(String,String)> {
+    verify_artifacts(&installer,&agent,&release.format,|path,check_msi|verify_windows(path,&release,&work,check_msi))?;
+    let bootstrap=Bootstrap{schema:SCHEMA,edition:release.edition.clone(),company_id:profile.company_id,management_url:profile.management_url,profile_public_key:company_key.into(),release_public_key:release_key.into()};
+    let file_name=format!("SwanRemoteSupport-{}-{}-{}.zip",if release.edition==Edition::Customer{"Customer"}else{"Technician"},release.version,id);
+    let temporary=output.join(format!("{file_name}.partial"));
+    let mut zip=zip::ZipWriter::new(std::fs::File::create(&temporary)?);
+    let options=zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+    for path in [&installer,&agent] {zip.start_file(path.file_name().context("Missing artifact name")?.to_string_lossy(),options)?;zip.write_all(&std::fs::read(path)?)?;}
+    for (name,bytes) in [
+        ("bootstrap.json",serde_json::to_vec_pretty(&bootstrap)?),
+        ("company-profile.json",serde_json::to_vec_pretty(&profile_envelope)?),
+        ("release.json",serde_json::to_vec_pretty(&release_envelope)?),
+    ] {zip.start_file(name,options)?;zip.write_all(&bytes)?;}
+    for (name,bytes) in COMPANY_BUNDLE_TEXT_FILES {zip.start_file(name,options)?;zip.write_all(&bundle_text(bytes)?)?;}
+    zip.finish()?.sync_all()?;
+    let hash=digest(std::fs::read(&temporary)?);
+    let final_name=file_name.replace(".zip",&format!("-{}.zip",&hash[..16]));let target=output.join(&final_name);
+    if target.exists(){ensure!(digest(std::fs::read(&target)?)==hash,"Conflicting immutable artifact");std::fs::remove_file(&temporary)?;}else{std::fs::rename(&temporary,target)?;}
+    Ok((final_name,hash))
+}
+pub async fn download(client:&reqwest::Client,url:&str,path:&Path,hash:&str)->Result<()> {
+    https_url(url)?;
+    let mut response=client.get(url).send().await?.error_for_status()?;
+    ensure!(response.content_length().map(|n|n<=512*1024*1024).unwrap_or(true),"Artifact too large");
+    let mut bytes=Vec::new();
+    while let Some(chunk)=response.chunk().await?{ensure!(bytes.len()+chunk.len()<=512*1024*1024,"Artifact too large");bytes.extend(chunk);}
+    ensure!(digest(&bytes).eq_ignore_ascii_case(hash),"Artifact hash mismatch");
+    tokio::fs::write(path,bytes).await?;Ok(())
+}
+fn verify_artifacts(installer:&Path,agent:&Path,format:&str,mut verify:impl FnMut(&Path,bool)->Result<()>)->Result<()> {
+    verify(installer,format=="msi")?;
+    verify(agent,false)
+}
+#[cfg(windows)]
+fn verify_windows(path:&Path,release:&Release,directory:&Path,check_msi:bool)->Result<()> {
+    let verifier=directory.join("Verify-Package.ps1");std::fs::write(&verifier,include_bytes!("../../../deployment/windows/Verify-Package.ps1"))?;
+    let status=swan_agent::update::powershell_command()?.args(["-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-File"]).arg(verifier).arg("-Path").arg(path).arg("-Publisher").arg(&release.publisher).arg("-CertificateSha256").arg(&release.publisher_certificate_sha256).status()?;
+    ensure!(status.success(),"Artifact signature or publisher rejected");
+    if check_msi {swan_agent::update::verify_msi_release_identity(path,release)?;}
+    Ok(())
+}
+
+#[cfg(not(windows))]
+fn verify_windows(_path:&Path,_release:&Release,_directory:&Path,_check_msi:bool)->Result<()> {
+    anyhow::bail!("Artifact signature verification requires a Windows worker")
+}
+
+#[cfg(test)]
+mod verification_tests {
+    use super::*;
+
+    async fn control_server(responses:Vec<(&'static str,String)>)->(String,tokio::task::JoinHandle<Vec<(String,Vec<u8>)>>) {
+        use tokio::io::{AsyncReadExt,AsyncWriteExt};
+        let listener=tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address=listener.local_addr().unwrap();
+        let server=tokio::spawn(async move {
+            let mut requests=Vec::new();
+            for (status,body) in responses {
+                let (mut stream,_)=listener.accept().await.unwrap();let mut headers=Vec::new();
+                while !headers.ends_with(b"\r\n\r\n") {
+                    headers.push(stream.read_u8().await.unwrap());assert!(headers.len()<8192);
+                }
+                let headers=String::from_utf8(headers).unwrap();let lower=headers.to_ascii_lowercase();
+                assert!(lower.contains("authorization: bearer fixture-worker\r\n"));
+                let length=lower.lines().find_map(|line|line.strip_prefix("content-length:")).map(|value|value.trim().parse::<usize>().unwrap()).unwrap_or(0);
+                assert!(length<65536);let mut request_body=vec![0;length];stream.read_exact(&mut request_body).await.unwrap();
+                requests.push((headers.lines().next().unwrap().to_owned(),request_body));
+                let response=format!("HTTP/1.1 {status}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",body.len());
+                stream.write_all(response.as_bytes()).await.unwrap();
+            }
+            requests
+        });
+        (format!("http://{address}"),server)
+    }
+
+    fn control_client()->reqwest::Client {
+        reqwest::Client::builder().no_proxy().timeout(std::time::Duration::from_secs(3)).build().unwrap()
+    }
+
+    #[tokio::test]
+    async fn permanent_bundle_rejection_is_reported_as_failure_without_a_download_link() {
+        let (endpoint,server)=control_server(vec![
+            ("400 Bad Request",json!({"error":"Unexpected ZIP footer"}).to_string()),
+            ("200 OK",json!({"ok":true}).to_string()),
+        ]).await;
+        let id="00000000-0000-4000-8000-000000000001";let client=control_client();
+        let result=upload_build(&client,&endpoint,"fixture-worker",id,b"retained original bundle".to_vec(),&"a".repeat(64)).await.unwrap();
+        assert_eq!(result["success"],false);assert_eq!(result["artifact_url"],"");assert_eq!(result["sha256"],"");
+        assert!(result["log"].as_str().unwrap().contains("Unexpected ZIP footer"));
+        report_completion(&client,&endpoint,"fixture-worker",id,&result).await.unwrap();
+        let requests=tokio::time::timeout(std::time::Duration::from_secs(5),server).await.unwrap().unwrap();
+        assert_eq!(requests.len(),2);
+        assert_eq!(requests[0].0,format!("PUT /api/v1/worker/builds/{id}/artifact HTTP/1.1"));
+        assert_eq!(requests[0].1,b"retained original bundle");
+        assert_eq!(requests[1].0,format!("PUT /api/v1/worker/builds/{id} HTTP/1.1"));
+        assert_eq!(serde_json::from_slice::<Value>(&requests[1].1).unwrap(),result);
+    }
+
+    #[tokio::test]
+    async fn validation_rejections_fail_but_authentication_and_conflicts_retain_recovery() {
+        for (status,failed) in [
+            ("400 Bad Request",true),("413 Payload Too Large",true),
+            ("415 Unsupported Media Type",true),("422 Unprocessable Entity",true),
+            ("401 Unauthorized",false),("403 Forbidden",false),("409 Conflict",false),
+        ] {
+            let (endpoint,server)=control_server(vec![(status,json!({"error":"fixture-worker private response https://example.invalid/?secret=value"}).to_string())]).await;
+            let result=upload_build(&control_client(),&endpoint,"fixture-worker","fixture-job",b"original".to_vec(),&"a".repeat(64)).await;
+            if failed {
+                let result=result.unwrap();assert_eq!(result["success"],false);
+                let log=result["log"].as_str().unwrap();assert!(!log.contains("fixture-worker") && !log.contains("secret=value") && !log.contains("example.invalid"));
+            }else{
+                let error=result.unwrap_err();let rejected=error.downcast_ref::<ControlRejection>().unwrap();
+                assert!(!rejected.invalid_bundle());assert!(!error.to_string().contains("fixture-worker"));
+            }
+            assert_eq!(tokio::time::timeout(std::time::Duration::from_secs(5),server).await.unwrap().unwrap().len(),1);
+        }
+    }
+
+    #[tokio::test]
+    async fn transient_upload_errors_retry_identical_bytes_before_reporting_success() {
+        let (endpoint,server)=control_server(vec![
+            ("503 Service Unavailable","{}".into()),("429 Too Many Requests","{}".into()),
+            ("200 OK","{}".into()),("200 OK","{}".into()),
+        ]).await;
+        let client=control_client();let id="00000000-0000-4000-8000-000000000002";let hash="a".repeat(64);
+        let result=tokio::time::timeout(std::time::Duration::from_secs(25),upload_build(&client,&endpoint,"fixture-worker",id,b"same verified bytes".to_vec(),&hash)).await.unwrap().unwrap();
+        assert_eq!(result["success"],true);assert_eq!(result["sha256"],hash);
+        report_completion(&client,&endpoint,"fixture-worker",id,&result).await.unwrap();
+        let requests=tokio::time::timeout(std::time::Duration::from_secs(5),server).await.unwrap().unwrap();
+        assert_eq!(requests.len(),4);
+        for request in &requests[..3]{assert_eq!(request.0,requests[0].0);assert_eq!(request.1,b"same verified bytes");}
+        assert_eq!(serde_json::from_slice::<Value>(&requests[3].1).unwrap(),result);
+    }
+
+    #[test]
+    fn server_error_details_are_bounded_and_never_reflect_arbitrary_remote_text() {
+        assert_eq!(public_rejection_reason(br#"{"error":"Unexpected ZIP footer","private":"fixture-secret"}"#),"Unexpected ZIP footer");
+        for body in [
+            br#"{"error":"fixture-secret"}"#.to_vec(),
+            br#"{"error":"Unexpected ZIP footer\nfixture-secret"}"#.to_vec(),
+            br#"{"error":{"password":"fixture-secret"}}"#.to_vec(),
+            b"not JSON fixture-secret".to_vec(),
+            json!({"error":"Unexpected ZIP footer","private":"fixture-secret".repeat(1000)}).to_string().into_bytes(),
+        ] {
+            let reason=public_rejection_reason(&body);
+            assert!(!reason.contains("fixture-secret"));assert_ne!(reason,"Unexpected ZIP footer");
+        }
+    }
+
+    #[tokio::test]
+    async fn server_recipe_preflight_rejects_old_or_incompatible_servers() {
+        use tokio::io::{AsyncReadExt,AsyncWriteExt};
+        let recipe=company_bundle_recipe().unwrap();
+        let client=reqwest::Client::builder().no_proxy().timeout(std::time::Duration::from_secs(3)).build().unwrap();
+        for (status,body,accepted) in [
+            ("200 OK",json!({"schema":1,"bundle_recipe":recipe}).to_string(),true),
+            ("200 OK",json!({"schema":1,"bundle_recipe":"old"}).to_string(),false),
+            ("200 OK",json!({"schema":2,"bundle_recipe":recipe}).to_string(),false),
+            ("200 OK","null".into(),false),
+            ("404 Not Found","{}".into(),false),
+            ("401 Unauthorized","{}".into(),false),
+        ] {
+            let listener=tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();let address=listener.local_addr().unwrap();
+            let server=tokio::spawn(async move {
+                let (mut stream,_)=listener.accept().await.unwrap();let mut request=Vec::new();
+                while !request.ends_with(b"\r\n\r\n") {
+                    let byte=stream.read_u8().await.unwrap();request.push(byte);assert!(request.len()<4096);
+                }
+                let request=String::from_utf8(request).unwrap();
+                assert!(request.starts_with("GET /api/v1/worker/recipe HTTP/1.1\r\n"));
+                assert!(request.to_ascii_lowercase().contains("authorization: bearer fixture-worker\r\n"));
+                let response=format!("HTTP/1.1 {status}\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",body.len());
+                stream.write_all(response.as_bytes()).await.unwrap();
+            });
+            assert_eq!(check_server_recipe(&client,&format!("http://{address}"),"fixture-worker",&recipe).await.is_ok(),accepted);
+            tokio::time::timeout(std::time::Duration::from_secs(5),server).await.unwrap().unwrap();
+        }
+    }
+
+    #[test]
+    fn both_artifacts_require_trust_but_only_msi_installer_requires_msi_identity() {
+        let agent=Path::new("swan-agent.exe");
+        for format in ["exe","msi"] {
+            let installer=PathBuf::from(format!("installer.{format}"));
+            let mut checked=Vec::new();
+            verify_artifacts(&installer,agent,format,|path,msi|{checked.push((path.to_owned(),msi));Ok(())}).unwrap();
+            assert_eq!(checked,vec![(installer.clone(),format=="msi"),(agent.to_owned(),false)]);
+            for rejected in [&installer,agent] {
+                assert!(verify_artifacts(&installer,agent,format,|path,_|{
+                    ensure!(path!=rejected,"Untrusted artifact");Ok(())
+                }).is_err());
+            }
+        }
+    }
+}
diff --git a/product/worker/src/windows.rs b/product/worker/src/windows.rs
new file mode 100644
index 00000000000..4ab112be192
--- /dev/null
+++ b/product/worker/src/windows.rs
@@ -0,0 +1,51 @@
+use anyhow::{ensure,Context,Result};
+use std::{ffi::OsString,sync::Mutex,time::Duration};
+use windows_service::{define_windows_service,service::{ServiceControl,ServiceControlAccept,ServiceExitCode,ServiceState,ServiceStatus,ServiceType},service_control_handler::{self,ServiceControlHandlerResult},service_dispatcher};
+const NAME:&str="SwanInstallerWorker";
+define_windows_service!(ffi_service_main,service_main);
+pub fn dispatch()->Result<()> {service_dispatcher::start(NAME,ffi_service_main)?;Ok(())}
+fn service_log()->Result<std::fs::File> {
+    use std::os::windows::{fs::MetadataExt,io::AsRawHandle};
+    use windows_sys::Win32::System::Console::{SetStdHandle,STD_ERROR_HANDLE,STD_OUTPUT_HANDLE};
+    let parent=std::path::PathBuf::from(std::env::var_os("ProgramData").context("Missing ProgramData")?);
+    let directory=parent.join("SwanInstallerWorker");
+    for path in [&parent,&directory] {
+        let metadata=std::fs::symlink_metadata(path)?;
+        ensure!(metadata.is_dir() && metadata.file_attributes()&0x400==0,"Worker log directory must be a regular protected directory");
+    }
+    let path=directory.join("worker-service.log");
+    match std::fs::symlink_metadata(&path) {
+        Ok(metadata)=>ensure!(metadata.is_file() && metadata.file_attributes()&0x400==0,"Worker log must be a regular file"),
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>{},
+        Err(error)=>return Err(error.into()),
+    }
+    let file=std::fs::OpenOptions::new().create(true).append(true).open(path)?;
+    // Keep the file alive throughout the service; the installer protects its
+    // parent directory before SCM can launch this process.
+    for handle in [STD_ERROR_HANDLE,STD_OUTPUT_HANDLE] {
+        if unsafe {SetStdHandle(handle,file.as_raw_handle())}==0 {return Err(std::io::Error::last_os_error().into());}
+    }
+    Ok(file)
+}
+fn service_main(_arguments:Vec<OsString>) {
+    let (sender,receiver)=tokio::sync::oneshot::channel();let sender=Mutex::new(Some(sender));
+    let handler=move|control|match control {
+        ServiceControl::Stop|ServiceControl::Shutdown=>{if let Some(sender)=sender.lock().unwrap().take(){let _=sender.send(());}ServiceControlHandlerResult::NoError},
+        ServiceControl::Interrogate=>ServiceControlHandlerResult::NoError,
+        _=>ServiceControlHandlerResult::NotImplemented,
+    };
+    let status_handle=match service_control_handler::register(NAME,handler){Ok(handle)=>handle,Err(error)=>{eprintln!("Service registration failed: {error}");return;}};
+    let status=|state,exit|ServiceStatus{service_type:ServiceType::OWN_PROCESS,current_state:state,controls_accepted:if state==ServiceState::Running{ServiceControlAccept::STOP|ServiceControlAccept::SHUTDOWN}else{ServiceControlAccept::empty()},exit_code:ServiceExitCode::Win32(exit),checkpoint:0,wait_hint:Duration::from_secs(10),process_id:None};
+    let _log=match service_log(){Ok(file)=>file,Err(error)=>{
+        eprintln!("Worker log initialization failed: {error}");
+        if let Err(error)=status_handle.set_service_status(status(ServiceState::Stopped,1)){eprintln!("Service failure status could not be reported: {error}");}
+        return;
+    }};
+    if let Err(error)=status_handle.set_service_status(status(ServiceState::Running,0)){eprintln!("Service status failed: {error}");return;}
+    // SCM invokes this entrypoint on its own thread; it owns the only worker runtime.
+    let outcome=tokio::runtime::Runtime::new().map_err(anyhow::Error::from).and_then(|runtime|runtime.block_on(async {
+        super::run(receiver).await
+    }));
+    if let Err(error)=&outcome{eprintln!("Installer worker failed: {error}");}
+    if let Err(error)=status_handle.set_service_status(status(ServiceState::Stopped,if outcome.is_ok(){0}else{1})){eprintln!("Service shutdown status failed: {error}");}
+}
diff --git a/src/build_metadata.rs b/src/build_metadata.rs
new file mode 100644
index 00000000000..6670c77e67f
--- /dev/null
+++ b/src/build_metadata.rs
@@ -0,0 +1,44 @@
+/// Render managed build metadata from a recorded UTC source timestamp.
+/// The caller supplies Cargo's package version and SOURCE_DATE_EPOCH; wall-clock
+/// time and the machine's local timezone must not affect managed binaries.
+pub fn render_version(version: &str, epoch: &str) -> Result<String, String> {
+    let seconds = epoch
+        .parse::<i64>()
+        .map_err(|_| "SOURCE_DATE_EPOCH must be an integer Unix timestamp".to_owned())?;
+    if seconds < 0 {
+        return Err("SOURCE_DATE_EPOCH cannot be negative".to_owned());
+    }
+    let date = hbb_common::chrono::DateTime::<hbb_common::chrono::Utc>::from_timestamp(seconds, 0)
+        .ok_or_else(|| "SOURCE_DATE_EPOCH is outside the supported date range".to_owned())?;
+    Ok(format!(
+        "pub const VERSION: &str = {version:?};\n#[allow(dead_code)]\npub const BUILD_DATE: &str = \"{}\";\n",
+        date.format("%Y-%m-%d %H:%M")
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::render_version;
+
+    #[test]
+    fn source_timestamp_has_fixed_utc_date() {
+        let metadata = render_version("1.5.0", "1704067200").unwrap();
+        assert!(metadata.contains("VERSION: &str = \"1.5.0\""));
+        assert!(metadata.contains("BUILD_DATE: &str = \"2024-01-01 00:00\""));
+        assert_eq!(metadata, render_version("1.5.0", "1704067200").unwrap());
+    }
+
+    #[test]
+    fn missing_invalid_and_out_of_range_epochs_are_rejected() {
+        for epoch in ["", "yesterday", "-1", "9223372036854775807"] {
+            assert!(render_version("1.5.0", epoch).is_err(), "{epoch}");
+        }
+    }
+
+    #[test]
+    fn cargo_version_is_escaped_as_a_rust_literal() {
+        assert!(render_version("test\"\\\n", "0")
+            .unwrap()
+            .starts_with("pub const VERSION: &str = \"test\\\"\\\\\\n\";\n"));
+    }
+}
diff --git a/src/client.rs b/src/client.rs
index dcd5941dfbe..c41e82b931c 100644
--- a/src/client.rs
+++ b/src/client.rs
@@ -2547,10 +2547,21 @@ impl LoginConfigHandler {
         };
         let mut config = self.load_config();
         config.info = serde;
+        #[cfg(feature = "swan_custom")]
+        {
+            // Managed authorization is never a saved peer password. Remove
+            // inherited credentials rather than syncing them to address books.
+            self.password.clear();self.remember=false;config.password.clear();
+        }
+        #[cfg(not(feature = "swan_custom"))]
         let password = self.password.clone();
+        #[cfg(not(feature = "swan_custom"))]
         let password0 = config.password.clone();
+        #[cfg(not(feature = "swan_custom"))]
         let remember = self.remember;
+        #[cfg(not(feature = "swan_custom"))]
         let hash = self.hash.clone();
+        #[cfg(not(feature = "swan_custom"))]
         if remember {
             // remember is true: use PeerConfig password or ui login
             // not sync shared password to recent
@@ -2583,7 +2594,7 @@ impl LoginConfigHandler {
                 .options
                 .insert("force-always-relay".to_owned(), "Y".to_owned());
         }
-        #[cfg(feature = "flutter")]
+        #[cfg(all(feature = "flutter",not(feature = "swan_custom")))]
         {
             // sync connected password to personal ab automatically if it is not shared password
             if !config.password.is_empty()
@@ -3480,6 +3491,15 @@ pub async fn handle_hash(
     peer: &mut Stream,
 ) {
     lc.write().unwrap().hash = hash.clone();
+    #[cfg(feature = "swan_custom")]
+    {
+        let target = lc.read().unwrap().id.clone();
+        match crate::managed::login(&hash.challenge, &target, password_preset).await {
+            Ok(proof) => send_login(lc, String::new(), String::new(), proof, peer).await,
+            Err(_) => interface.msgbox("error", "Company authorization required", "Sign in and request a new session from the company technician device list.", ""),
+        }
+        return;
+    }
     // Take care of password application order
 
     // switch_uuid
@@ -3656,6 +3676,12 @@ pub async fn handle_login_from_ui(
     remember: bool,
     peer: &mut Stream,
 ) {
+    #[cfg(feature = "swan_custom")]
+    {
+        let _=(&lc,&os_username,&os_password,&password,remember,&peer);
+        log::warn!("Managed login requires company authorization; legacy UI password submission refused");
+        return;
+    }
     let mut hash_password = if password.is_empty() {
         let mut password2 = lc.read().unwrap().password.clone();
         if password2.is_empty() {
@@ -3984,6 +4010,19 @@ lazy_static::lazy_static! {
 /// * `text` - The text of the message.
 #[inline]
 pub fn check_if_retry(msgtype: &str, title: &str, text: &str, retry_for_relay: bool) -> bool {
+    #[cfg(feature = "swan_custom")]
+    if matches!(text,
+        "Company session authorization expired or revoked" |
+        "Company session authorization denied" |
+        "A valid company session grant is required" |
+        "Customer paused support" |
+        "Customer paused support during authorization")
+        || text.starts_with("Company grant denies ")
+    {
+        // Authorization closure is definitive even when relay retry is enabled.
+        // A new customer-approved request must start a new managed session.
+        return false;
+    }
     msgtype == "error"
         && title == "Connection Error"
         && ((text.contains("10054") || text.contains("104")) && retry_for_relay
@@ -4002,6 +4041,30 @@ pub fn check_if_retry(msgtype: &str, title: &str, text: &str, retry_for_relay: b
                 && !text.to_lowercase().contains("not allowed")))
 }
 
+#[cfg(all(test, feature = "swan_custom"))]
+mod managed_retry_tests {
+    use super::check_if_retry;
+
+    #[test]
+    fn authorization_closure_never_retries_but_network_fallback_remains() {
+        for reason in [
+            "Company session authorization expired or revoked",
+            "Company session authorization denied",
+            "A valid company session grant is required",
+            "Customer paused support",
+            "Customer paused support during authorization",
+            "Company grant denies file transfer",
+            "Closed manually by the peer",
+        ] {
+            for retry_for_relay in [false, true] {
+                assert!(!check_if_retry("error", "Connection Error", reason, retry_for_relay));
+            }
+        }
+        assert!(check_if_retry("error", "Connection Error", "Connection reset by peer (10054)", true));
+        assert!(check_if_retry("error", "Connection Error", "Connection timed out", false));
+    }
+}
+
 pub async fn hc_connection(
     feedback: i32,
     rendezvous_server: String,
diff --git a/src/client/io_loop.rs b/src/client/io_loop.rs
index c0eb7fb57fd..e5cbc96c4f9 100644
--- a/src/client/io_loop.rs
+++ b/src/client/io_loop.rs
@@ -58,6 +58,14 @@ use std::{
     },
 };
 
+fn bound_file_transfer_writes(peer: &mut Stream, conn_type: ConnType) {
+    if conn_type == ConnType::FILE_TRANSFER {
+        // A blocked write otherwise prevents the loop's no-data timer and UI
+        // cancellation messages from running after a network interruption.
+        peer.set_send_timeout(30_000);
+    }
+}
+
 pub struct Remote<T: InvokeUiSession> {
     handler: Session<T>,
     audio_sender: MediaSender,
@@ -136,6 +144,17 @@ impl<T: InvokeUiSession> Remote<T> {
     }
 
     pub async fn io_loop(&mut self, key: &str, token: &str, round: u32) {
+        // Cover connection establishment as well as the authenticated session.
+        // Each loop owns its lock, so retries and multiple windows cannot let
+        // installation race a connection or retain a lock after disconnection.
+        #[cfg(feature = "swan_custom")]
+        let _managed_activity = match swan_agent::lock_session(&swan_agent::state_directory()) {
+            Ok(activity) => activity,
+            Err(_) => {
+                self.handler.msgbox("error", "Company update in progress", "Wait for company setup or update recovery to finish before connecting.", "");
+                return;
+            }
+        };
         #[cfg(target_os = "windows")]
         let _file_clip_context_holder = {
             // `is_port_forward()` will not reach here, but we still check it for clarity.
@@ -179,6 +198,7 @@ impl<T: InvokeUiSession> Remote<T> {
         .await
         {
             Ok(((mut peer, direct, pk, kcp, stream_type), (feedback, rendezvous_server))) => {
+                bound_file_transfer_writes(&mut peer, conn_type);
                 self.handler
                     .connection_round_state
                     .lock()
@@ -2547,3 +2567,53 @@ impl Drop for VideoThread {
         *self.discard_queue.write().unwrap() = true;
     }
 }
+
+#[cfg(test)]
+mod transfer_write_tests {
+    use super::*;
+    use hbb_common::tcp::FramedStream;
+
+    fn blocked_stream() -> (Stream, tokio::io::DuplexStream) {
+        let (writer, reader) = tokio::io::duplex(64);
+        (
+            Stream::Tcp(FramedStream::from(writer, "127.0.0.1:1".parse().unwrap())),
+            reader,
+        )
+    }
+
+    #[hbb_common::tokio::test(crate = "hbb_common::tokio")]
+    async fn unbounded_control_reproduces_write_backpressure() {
+        let (mut peer, _reader) = blocked_stream();
+        bound_file_transfer_writes(&mut peer, ConnType::DEFAULT_CONN);
+        assert!(time::timeout(Duration::from_millis(150), peer.send_raw(vec![0; 4096]))
+            .await
+            .is_err());
+    }
+
+    #[hbb_common::tokio::test(crate = "hbb_common::tokio")]
+    async fn blocked_file_write_returns_a_timeout() {
+        let (mut peer, _reader) = blocked_stream();
+        bound_file_transfer_writes(&mut peer, ConnType::FILE_TRANSFER);
+        let started = Instant::now();
+        let error = time::timeout(Duration::from_secs(35), peer.send_raw(vec![0; 4096]))
+            .await
+            .expect("File writes must return before the outer test deadline")
+            .expect_err("A full, unread transport must time out");
+        assert!(started.elapsed() >= Duration::from_secs(29));
+        assert!(error.to_string().contains("deadline"), "{error}");
+    }
+
+    #[hbb_common::tokio::test(crate = "hbb_common::tokio")]
+    async fn responsive_file_write_preserves_framed_bytes() {
+        let (writer, reader) = tokio::io::duplex(1024);
+        let address = "127.0.0.1:1".parse().unwrap();
+        let mut peer = Stream::Tcp(FramedStream::from(writer, address));
+        let mut receiver = Stream::Tcp(FramedStream::from(reader, address));
+        bound_file_transfer_writes(&mut peer, ConnType::FILE_TRANSFER);
+        let expected = b"Swan bounded file transfer frame";
+        peer.send_raw(expected.to_vec()).await.unwrap();
+        let received = time::timeout(Duration::from_secs(1), receiver.next())
+            .await.unwrap().unwrap().unwrap();
+        assert_eq!(&received[..], &expected[..]);
+    }
+}
diff --git a/src/common.rs b/src/common.rs
index 5b06a6930d8..83f95092deb 100644
--- a/src/common.rs
+++ b/src/common.rs
@@ -939,7 +939,7 @@ pub fn is_modifier(evt: &KeyEvent) -> bool {
 }
 
 pub fn check_software_update() {
-    if is_custom_client() {
+    if cfg!(feature = "swan_custom") || is_custom_client() {
         return;
     }
     let opt = LocalConfig::get_option(keys::OPTION_ENABLE_CHECK_UPDATE);
@@ -948,8 +948,14 @@ pub fn check_software_update() {
     }
 }
 
+#[cfg(feature = "swan_custom")]
+pub fn do_check_software_update() -> hbb_common::ResultType<()> {
+    bail!("Managed editions require company-approved releases")
+}
+
 // No need to check `danger_accept_invalid_cert` for now.
 // Because the url is always `https://api.rustdesk.com/version/latest`.
+#[cfg(not(feature = "swan_custom"))]
 #[tokio::main(flavor = "current_thread")]
 pub async fn do_check_software_update() -> hbb_common::ResultType<()> {
     let (request, url) =
@@ -1116,11 +1122,21 @@ pub fn get_local_option(key: &str) -> String {
 }
 
 pub fn get_audit_server(api: String, custom: String, typ: String) -> String {
-    let url = get_api_server(api, custom);
-    if url.is_empty() || is_public(&url) {
-        return "".to_owned();
+    #[cfg(feature = "swan_custom")]
+    {
+        // Company session events use the authenticated HTTPS management API.
+        // Never derive legacy OSS/Pro audit targets from rendezvous addresses.
+        let _ = (api, custom, typ);
+        String::new()
+    }
+    #[cfg(not(feature = "swan_custom"))]
+    {
+        let url = get_api_server(api, custom);
+        if url.is_empty() || is_public(&url) {
+            return "".to_owned();
+        }
+        format!("{}/api/audit/{}", url, typ)
     }
-    format!("{}/api/audit/{}", url, typ)
 }
 
 /// Check if we should use raw TCP proxy for API calls.
@@ -2082,7 +2098,12 @@ pub fn rustdesk_interval(i: Interval) -> ThrottledInterval {
 
 pub fn load_custom_client() {
     #[cfg(feature = "swan_custom")]
-    load_swan_client_defaults();
+    {
+        load_swan_client_defaults();
+        // Company configuration has its own pinned trust key. Never load an
+        // upstream custom.txt over the managed security and routing policy.
+        return;
+    }
 
     #[cfg(debug_assertions)]
     if let Ok(data) = std::fs::read_to_string("./custom.txt") {
@@ -2107,79 +2128,7 @@ pub fn load_custom_client() {
 
 #[cfg(feature = "swan_custom")]
 fn load_swan_client_defaults() {
-    const APP_NAME: &str = "Swan Remote Support";
-    const RENDEZVOUS_SERVER: &str = env!("RENDEZVOUS_SERVER");
-    const RS_PUB_KEY: &str = env!("RS_PUB_KEY");
-    const RELAY_SERVER: Option<&str> = option_env!("RELAY_SERVER");
-    const API_SERVER: Option<&str> = option_env!("API_SERVER");
-
-    *config::APP_NAME.write().unwrap() = APP_NAME.to_owned();
-
-    // Keep every Swan build pinned to the intended self-hosted network. The
-    // Tailscale rendezvous/relay address and Ed25519 public key are public
-    // routing/trust configuration values, not credentials.
-    let mut overrides = config::OVERWRITE_SETTINGS.write().unwrap();
-    overrides.insert(
-        keys::OPTION_CUSTOM_RENDEZVOUS_SERVER.to_owned(),
-        RENDEZVOUS_SERVER.to_owned(),
-    );
-    overrides.insert(keys::OPTION_KEY.to_owned(), RS_PUB_KEY.to_owned());
-    if let Some(relay_server) = RELAY_SERVER.filter(|value| !value.trim().is_empty()) {
-        overrides.insert(
-            keys::OPTION_RELAY_SERVER.to_owned(),
-            relay_server.to_owned(),
-        );
-    }
-    if let Some(api_server) = API_SERVER.filter(|value| !value.trim().is_empty()) {
-        overrides.insert(keys::OPTION_API_SERVER.to_owned(), api_server.to_owned());
-    }
-    // Never replace this branded client with an upstream public-network build.
-    // Swan updates must be built, tested, and signed through the Swan release
-    // process.
-    overrides.insert(keys::OPTION_ALLOW_AUTO_UPDATE.to_owned(), "N".to_owned());
-    drop(overrides);
-
-    // This managed-support edition is installed in person by Swan Computing.
-    // It is ready for unattended operation only after the express setup tool
-    // creates a unique permanent password on that specific device.
-    let mut defaults = config::DEFAULT_SETTINGS.write().unwrap();
-    defaults.insert(keys::OPTION_APPROVE_MODE.to_owned(), "password".to_owned());
-    defaults.insert(
-        keys::OPTION_VERIFICATION_METHOD.to_owned(),
-        "use-permanent-password".to_owned(),
-    );
-    defaults.insert(
-        keys::OPTION_TEMPORARY_PASSWORD_LENGTH.to_owned(),
-        "10".to_owned(),
-    );
-    defaults.insert(
-        keys::OPTION_ALLOW_ONLY_CONN_WINDOW_OPEN.to_owned(),
-        "N".to_owned(),
-    );
-    drop(defaults);
-
-    // Customer devices receive support but do not initiate outbound RustDesk
-    // sessions. Network/server controls are hidden so the embedded Tailscale
-    // configuration cannot be accidentally replaced. The tray and stop-service
-    // controls remain visible so the computer owner can see and pause support.
-    let mut hard_settings = config::HARD_SETTINGS.write().unwrap();
-    hard_settings.insert("conn-type".to_owned(), "incoming".to_owned());
-    hard_settings.insert("disable-account".to_owned(), "Y".to_owned());
-    hard_settings.insert("disable-ab".to_owned(), "Y".to_owned());
-    drop(hard_settings);
-
-    let mut builtin_settings = config::BUILTIN_SETTINGS.write().unwrap();
-    builtin_settings.insert(
-        keys::OPTION_HIDE_NETWORK_SETTINGS.to_owned(),
-        "Y".to_owned(),
-    );
-    builtin_settings.insert(keys::OPTION_HIDE_SERVER_SETTINGS.to_owned(), "Y".to_owned());
-    builtin_settings.insert(keys::OPTION_HIDE_PROXY_SETTINGS.to_owned(), "Y".to_owned());
-    builtin_settings.insert(keys::OPTION_DISABLE_CHANGE_ID.to_owned(), "Y".to_owned());
-    builtin_settings.insert(
-        keys::OPTION_ALLOW_LOGON_SCREEN_PASSWORD.to_owned(),
-        "Y".to_owned(),
-    );
+    crate::managed::apply_defaults();
 }
 
 fn read_custom_client_advanced_settings(
@@ -2706,6 +2655,17 @@ pub fn is_direct_ip_access(peer: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[cfg(feature = "swan_custom")]
+    #[test]
+    fn managed_edition_never_derives_legacy_audit_targets() {
+        for api in ["", "http://legacy.example:21114", "https://company.example"] {
+            for custom in ["", "support.example:21116"] {
+                for typ in ["conn", "file", "alarm"] {
+                    assert!(get_audit_server(api.into(), custom.into(), typ.into()).is_empty());
+                }
+            }
+        }
+    }
     use hbb_common::tokio::{
         self,
         time::{interval, interval_at, sleep, Duration, Instant, Interval},
diff --git a/src/core_main.rs b/src/core_main.rs
index 6b437a98845..a048f933b92 100644
--- a/src/core_main.rs
+++ b/src/core_main.rs
@@ -33,6 +33,11 @@ pub fn core_main() -> Option<Vec<String>> {
         return None;
     }
     crate::load_custom_client();
+    #[cfg(all(windows,feature = "swan_custom"))]
+    if crate::managed::start_technician_lifecycle().is_err() {
+        log::error!("Technician removal is in progress or its lifecycle registration is unavailable");
+        return None;
+    }
     #[cfg(windows)]
     if !crate::platform::windows::bootstrap() {
         // return None to terminate the process
@@ -138,11 +143,15 @@ pub fn core_main() -> Option<Vec<String>> {
     }
     #[cfg(windows)]
     {
-        _is_quick_support |= !crate::platform::is_installed()
-            && args.is_empty()
-            && (is_quick_support_exe(&arg_exe)
-                || config::LocalConfig::get_option("pre-elevate-service") == "Y"
-                || (!click_setup && crate::platform::is_elevated(None).unwrap_or(false)));
+        if config::is_outgoing_only() {
+            _is_quick_support = false;
+        } else {
+            _is_quick_support |= !crate::platform::is_installed()
+                && args.is_empty()
+                && (is_quick_support_exe(&arg_exe)
+                    || config::LocalConfig::get_option("pre-elevate-service") == "Y"
+                    || (!click_setup && crate::platform::is_elevated(None).unwrap_or(false)));
+        }
         crate::portable_service::client::set_quick_support(_is_quick_support);
     }
     let mut log_name = "".to_owned();
@@ -222,6 +231,12 @@ pub fn core_main() -> Option<Vec<String>> {
                 }
                 return None;
             } else if args[0] == "--update" {
+                #[cfg(feature = "swan_custom")]
+                {
+                    log::warn!("Managed updates require the approved company update agent");
+                }
+                #[cfg(not(feature = "swan_custom"))]
+                {
                 if config::is_disable_installation() {
                     return None;
                 }
@@ -247,6 +262,7 @@ pub fn core_main() -> Option<Vec<String>> {
                     .duration(Duration::Short)
                     .show()
                     .ok();
+                }
                 return None;
             } else if args[0] == "--after-install" {
                 if let Err(err) = platform::run_after_install() {
@@ -269,6 +285,8 @@ pub fn core_main() -> Option<Vec<String>> {
                     Ok(_) => translate("Installation Successful!".to_string()),
                     Err(err) => {
                         println!("Failed with error: {err}");
+                        #[cfg(feature = "swan_custom")]
+                        std::process::exit(1);
                         translate("Installation failed!".to_string())
                     }
                 };
@@ -293,6 +311,10 @@ pub fn core_main() -> Option<Vec<String>> {
                 }
                 return None;
             } else if args[0] == "--portable-service" {
+                if config::is_outgoing_only() {
+                    log::warn!("Outgoing-only editions cannot run an incoming portable service");
+                    return None;
+                }
                 crate::platform::elevate_or_run_as_system(
                     click_setup,
                     _is_elevate,
diff --git a/src/flutter.rs b/src/flutter.rs
index e6b325cbeb6..39748588c18 100644
--- a/src/flutter.rs
+++ b/src/flutter.rs
@@ -136,6 +136,23 @@ pub extern "C" fn rustdesk_core_main_args(args_len: *mut c_int) -> *mut *mut c_c
     return std::ptr::null_mut() as _;
 }
 
+#[cfg(all(windows, feature = "swan_custom"))]
+#[no_mangle]
+pub extern "C" fn swan_service_bootstrap(
+    report: Option<crate::platform::windows::BootstrapServiceStatus>,
+) -> u32 {
+    match report {
+        Some(report) => crate::platform::windows::run_bootstrapped_service(report),
+        None => winapi::shared::winerror::ERROR_INVALID_PARAMETER,
+    }
+}
+
+#[cfg(all(windows, feature = "swan_custom"))]
+#[no_mangle]
+pub extern "C" fn swan_service_control(control: u32) -> u32 {
+    crate::platform::windows::bootstrap_service_control(control)
+}
+
 // https://gist.github.com/iskakaushik/1c5b8aa75c77479c33c4320913eebef6
 #[cfg(windows)]
 fn rust_args_to_c_args(args: Vec<String>, outlen: *mut c_int) -> *mut *mut c_char {
@@ -2317,19 +2334,25 @@ pub(super) mod async_tasks {
     use std::{
         collections::HashMap,
         sync::{
-            mpsc::{sync_channel, SyncSender},
             Arc, Mutex,
         },
     };
 
-    type TxQueryOnlines = SyncSender<Vec<String>>;
+    type TxQueryOnlines = tokio::sync::mpsc::Sender<Vec<String>>;
+    #[cfg(feature = "swan_custom")]
+    type CompanyTask = (String, flutter_rust_bridge::StreamSink<String>);
     lazy_static::lazy_static! {
         static ref TX_QUERY_ONLINES: Arc<Mutex<Option<TxQueryOnlines>>> = Default::default();
     }
+    #[cfg(feature = "swan_custom")]
+    lazy_static::lazy_static! {
+        static ref TX_COMPANY: Mutex<Option<tokio::sync::mpsc::Sender<CompanyTask>>> = Default::default();
+    }
 
     #[inline]
     pub fn start_flutter_async_runner() {
-        std::thread::spawn(start_flutter_async_runner_);
+        static STARTED:std::sync::Once=std::sync::Once::new();
+        STARTED.call_once(|| {std::thread::spawn(start_flutter_async_runner_);});
     }
 
     #[allow(dead_code)]
@@ -2340,12 +2363,29 @@ pub(super) mod async_tasks {
     #[tokio::main(flavor = "current_thread")]
     async fn start_flutter_async_runner_() {
         // Only one task is allowed to run at the same time.
-        let (tx_onlines, rx_onlines) = sync_channel::<Vec<String>>(1);
+        let (tx_onlines, mut rx_onlines) = tokio::sync::mpsc::channel::<Vec<String>>(1);
         TX_QUERY_ONLINES.lock().unwrap().replace(tx_onlines);
+        #[cfg(feature = "swan_custom")]
+        let mut rx_company = {
+            let (tx,rx)=tokio::sync::mpsc::channel::<CompanyTask>(16);
+            *TX_COMPANY.lock().unwrap()=Some(tx);rx
+        };
 
         loop {
-            match rx_onlines.recv() {
-                Ok(ids) => {
+            #[cfg(feature = "swan_custom")]
+            tokio::select! {
+                task=rx_company.recv()=>match task {
+                    Some((request,sink))=>{let response=crate::managed::technician_request(&request).await;sink.add(response);},
+                    None=>break,
+                },
+                ids=rx_onlines.recv()=>match ids {
+                    Some(ids)=>crate::client::peer_online::query_online_states(ids,handle_query_onlines).await,
+                    None=>break,
+                }
+            }
+            #[cfg(not(feature = "swan_custom"))]
+            match rx_onlines.recv().await {
+                Some(ids) => {
                     crate::client::peer_online::query_online_states(ids, handle_query_onlines).await
                 }
                 _ => {
@@ -2356,6 +2396,14 @@ pub(super) mod async_tasks {
         }
     }
 
+    #[cfg(feature = "swan_custom")]
+    pub fn company_request(request:String,sink:flutter_rust_bridge::StreamSink<String>)->ResultType<()> {
+        if let Some(tx)=TX_COMPANY.lock().unwrap().as_ref(){
+            if tx.try_send((request,sink)).is_err(){bail!("Company request queue is full");}Ok(())
+        }
+        else {bail!("Company request runner is not ready")}
+    }
+
     pub fn query_onlines(ids: Vec<String>) -> ResultType<()> {
         if let Some(tx) = TX_QUERY_ONLINES.lock().unwrap().as_ref() {
             // Ignore if the channel is full.
diff --git a/src/flutter_ffi.rs b/src/flutter_ffi.rs
index 0777443cf3b..60db4ae8d80 100644
--- a/src/flutter_ffi.rs
+++ b/src/flutter_ffi.rs
@@ -958,6 +958,11 @@ pub fn main_get_option(key: String) -> String {
 }
 
 pub fn main_get_option_sync(key: String) -> SyncReturn<String> {
+    #[cfg(feature = "swan_custom")]
+    if key == "managed-company-display-name" {
+        // Computed from signed state, not from a writable local option.
+        return SyncReturn(crate::managed::display_name());
+    }
     SyncReturn(get_option(key))
 }
 
@@ -2810,7 +2815,20 @@ pub fn main_get_printer_names() -> SyncReturn<String> {
     return SyncReturn("".to_owned());
 }
 
+/// Login tokens and grant proof keys stay in Rust process memory, shared by
+/// this app's Flutter window engines. Connections return opaque local handles.
+pub fn main_company_request(request:String,sink:StreamSink<String>)->ResultType<()> {
+    #[cfg(feature = "swan_custom")]
+    {return flutter::async_tasks::company_request(request,sink);}
+    #[cfg(not(feature = "swan_custom"))]
+    {let _=request; sink.add("{\"ok\":false,\"error\":\"Managed company edition required\"}".into());Ok(())}
+}
+
 pub fn main_get_common(key: String) -> String {
+    #[cfg(feature = "swan_custom")]
+    if key == "company-overview" {
+        return crate::ipc::get_config("company-overview").ok().flatten().unwrap_or_else(crate::managed::overview);
+    }
     if key == "is-printer-installed" {
         #[cfg(target_os = "windows")]
         {
@@ -2900,6 +2918,13 @@ pub fn main_get_common_sync(key: String) -> SyncReturn<String> {
 }
 
 pub fn main_set_common(_key: String, _value: String) {
+    #[cfg(feature = "swan_custom")]
+    if (_key == "company-revoke-unattended" && _value == "N") || (_key == "company-allow-unattended" && _value == "Y") {
+        if let Err(error) = crate::ipc::set_config(&_key, _value) {
+            log::error!("Cannot change company unattended support: {}", error);
+        }
+        return;
+    }
     #[cfg(target_os = "windows")]
     if _key == "install-printer" && crate::platform::is_win_10_or_greater() {
         std::thread::spawn(move || {
diff --git a/src/hbbs_http/sync.rs b/src/hbbs_http/sync.rs
index 1bb61943f86..aa26506b619 100644
--- a/src/hbbs_http/sync.rs
+++ b/src/hbbs_http/sync.rs
@@ -273,6 +273,14 @@ async fn start_hbbs_sync_async() {
     }
 }
 
+#[cfg(feature = "swan_custom")]
+fn heartbeat_url() -> String {
+    // Managed editions use authenticated company APIs and signed profiles.
+    // The legacy Pro API may use HTTP and accept unsigned strategy options.
+    String::new()
+}
+
+#[cfg(not(feature = "swan_custom"))]
 fn heartbeat_url() -> String {
     let url = crate::common::get_api_server(
         Config::get_option("api-server"),
@@ -284,6 +292,12 @@ fn heartbeat_url() -> String {
     format!("{}/api/heartbeat", url)
 }
 
+#[cfg(feature = "swan_custom")]
+fn handle_config_options(_config_options: HashMap<String, String>) {
+    // Even a legacy sync response must never replace signed company policy.
+}
+
+#[cfg(not(feature = "swan_custom"))]
 fn handle_config_options(config_options: HashMap<String, String>) {
     let mut options = Config::get_options();
     let default_settings = config::DEFAULT_SETTINGS.read().unwrap().clone();
@@ -308,3 +322,23 @@ fn handle_config_options(config_options: HashMap<String, String>) {
 pub fn is_pro() -> bool {
     PRO.lock().unwrap().clone()
 }
+
+#[cfg(all(test, feature = "swan_custom"))]
+mod managed_sync_tests {
+    use super::*;
+
+    #[test]
+    fn managed_sync_rejects_legacy_endpoint_and_unsigned_options() {
+        assert!(heartbeat_url().is_empty());
+        let key = "swan-unsigned-policy-regression-test";
+        let previous = Config::get_option(key);
+        let mut options = HashMap::new();
+        options.insert(key.to_owned(), "unsigned-remote-policy".to_owned());
+        handle_config_options(options);
+        let actual = Config::get_option(key);
+        if actual != previous {
+            Config::set_option(key.to_owned(), previous.clone());
+        }
+        assert_eq!(actual, previous);
+    }
+}
diff --git a/src/ipc.rs b/src/ipc.rs
index 68c987f4ece..9e4b86d4080 100644
--- a/src/ipc.rs
+++ b/src/ipc.rs
@@ -827,6 +827,11 @@ async fn handle(data: Data, stream: &mut Connection) {
                 let value;
                 if name == "id" {
                     value = Some(Config::get_id());
+                } else if name == "company-overview" {
+                    #[cfg(feature = "swan_custom")]
+                    { value = Some(crate::managed::overview()); }
+                    #[cfg(not(feature = "swan_custom"))]
+                    { value = None; }
                 } else if name == "temporary-password" {
                     value = Some(password::temporary_password());
                 } else if name == "permanent-password-storage-and-salt" {
@@ -879,6 +884,47 @@ async fn handle(data: Data, stream: &mut Connection) {
                 allow_err!(stream.send(&Data::Config((name, value))).await);
             }
             Some(value) => {
+                #[cfg(feature = "swan_custom")]
+                if (name=="company-pause-support" && value=="Y") || (name=="company-resume-support" && value=="N") {
+                    let paused=name=="company-pause-support";
+                    let response=if config::is_outgoing_only() {
+                        serde_json::json!({"ok":false})
+                    }else{
+                        match tokio::task::spawn_blocking(move || {
+                            let _chk=CheckIfRestart::new();
+                            crate::managed::update_support_pause(paused);
+                            Config::set_option("stop-service".into(),if paused{"Y"}else{""}.into());
+                            serde_json::json!({"ok":Config::get_option("stop-service")==if paused{"Y"}else{""},"paused":paused})
+                        }).await {
+                            Ok(response)=>response,
+                            Err(error)=>{log::error!("Support pause task failed: {}",error);serde_json::json!({"ok":false})}
+                        }
+                    };
+                    allow_err!(stream.send(&Data::Config((name,Some(response.to_string())))).await);
+                    return;
+                }
+                #[cfg(feature = "swan_custom")]
+                if (name == "company-allow-unattended" && value == "Y") || (name == "company-revoke-unattended" && value == "N") {
+                    let enabled=name=="company-allow-unattended";
+                    let result=async {
+                        let directory=swan_agent::state_directory();
+                        let mut state=if enabled{swan_agent::AgentState::load(&directory)?}else{swan_agent::AgentState::load_for_refresh(&directory)?};
+                        let synced=if enabled {
+                            state.consent(true).await?;
+                            state.set_local_consent(&directory,true)?;true
+                        }else{
+                            state.set_local_consent(&directory,false)?;
+                            match state.consent(false).await {Ok(())=>true,Err(error)=>{log::warn!("Server consent synchronization failed: {}",error);false}}
+                        };
+                        Ok::<_,hbb_common::anyhow::Error>(serde_json::json!({"ok":true,"unattended":enabled,"server_synced":synced}))
+                    }.await;
+                    let response=match result {
+                        Ok(response)=>response,
+                        Err(error)=>{log::error!("Cannot persist company consent: {}",error);serde_json::json!({"ok":false})}
+                    };
+                    allow_err!(stream.send(&Data::Config((name,Some(response.to_string())))).await);
+                    return;
+                }
                 let mut updated = true;
                 if name == "id" {
                     Config::set_key_confirmed(false);
@@ -917,6 +963,8 @@ async fn handle(data: Data, stream: &mut Connection) {
                 allow_err!(stream.send(&Data::Options(Some(v))).await);
             }
             Some(value) => {
+                #[cfg(feature = "swan_custom")]
+                crate::managed::update_support_pause(value.get("stop-service").map(String::as_str)==Some("Y"));
                 let _chk = CheckIfRestart::new();
                 let _nat = CheckTestNatType::new();
                 if let Some(v) = value.get("privacy-mode-impl-key") {
@@ -1508,6 +1556,34 @@ async fn get_config_async(name: &str, ms_timeout: u64) -> ResultType<Option<Stri
     return Ok(None);
 }
 
+#[cfg(feature = "swan_custom")]
+pub async fn set_company_support_paused(paused:bool)->ResultType<serde_json::Value> {
+    let name=if paused{"company-pause-support"}else{"company-resume-support"};
+    let mut connection=connect(1000, "").await?;
+    connection.send(&Data::Config((name.into(),Some(if paused{"Y"}else{"N"}.into())))).await?;
+    if let Some(Data::Config((returned,Some(value))))=connection.next_timeout(5000).await? {
+        if returned==name {
+            let response:serde_json::Value=serde_json::from_str(&value)?;
+            if response["ok"]==true && response["paused"]==paused{return Ok(response);}
+        }
+    }
+    bail!("Support pause change was not confirmed")
+}
+
+#[cfg(feature = "swan_custom")]
+pub async fn set_company_consent(enabled:bool)->ResultType<serde_json::Value> {
+    let name=if enabled{"company-allow-unattended"}else{"company-revoke-unattended"};
+    let mut connection=connect(1000, "").await?;
+    connection.send(&Data::Config((name.into(),Some(if enabled{"Y"}else{"N"}.into())))).await?;
+    if let Some(Data::Config((returned,Some(value))))=connection.next_timeout(20_000).await? {
+        if returned==name {
+            let response:serde_json::Value=serde_json::from_str(&value)?;
+            if response["ok"]==true && response["unattended"]==enabled{return Ok(response);}
+        }
+    }
+    bail!("Company consent change was not confirmed")
+}
+
 pub async fn set_config_async(name: &str, value: String) -> ResultType<()> {
     let mut c = connect(1000, "").await?;
     c.send_config(name, value).await?;
diff --git a/src/lib.rs b/src/lib.rs
index 49cb2b7e97c..45f3d06151a 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -28,6 +28,8 @@ pub mod ipc;
 )))]
 pub mod ui;
 mod version;
+#[cfg(test)]
+mod build_metadata;
 pub use version::*;
 #[cfg(any(target_os = "android", target_os = "ios", feature = "flutter"))]
 mod bridge_generated;
@@ -58,6 +60,8 @@ mod whiteboard;
 
 #[cfg(not(any(target_os = "android", target_os = "ios")))]
 mod updater;
+#[cfg(feature = "swan_custom")]
+mod managed;
 
 mod ui_cm_interface;
 mod ui_interface;
diff --git a/src/managed.rs b/src/managed.rs
new file mode 100644
index 00000000000..d520431e7b1
--- /dev/null
+++ b/src/managed.rs
@@ -0,0 +1,517 @@
+//! Managed edition authorization is enforced on the receiving device, independent
+//! of the ID server, relay, direct transport, or customer approval UI.
+use hbb_common::{config::{self, keys}, log, ResultType};
+use swan_agent::{protocol::{self, Edition, ManagedLogin, SignedEnvelope}, AgentState, Lease};
+
+struct TechnicianLogin {token:String,company:String,username:String}
+struct PendingTicket {envelope:SignedEnvelope,key_hex:String,expires_at:u64,company:String,peer:String}
+#[derive(Clone)]
+struct ReconnectRequest {device:String,unattended:bool,company:String,peer:String,generation:u64,expires_at:u64}
+#[derive(Default)]
+struct TechnicianMemory {
+    generation:u64,
+    login:Option<TechnicianLogin>,
+    tickets:std::collections::HashMap<String,PendingTicket>,
+    reconnects:std::collections::HashMap<String,ReconnectRequest>,
+    update_running:bool,
+    update_handed_off:bool,
+    update_failed:bool,
+}
+hbb_common::lazy_static::lazy_static! {
+    static ref TECHNICIAN:std::sync::Mutex<TechnicianMemory>=Default::default();
+    static ref SUPPORT_PAUSE_SIGNAL:hbb_common::tokio::sync::watch::Sender<u64>=hbb_common::tokio::sync::watch::channel(0).0;
+}
+
+#[cfg(windows)]
+pub fn start_technician_lifecycle()->ResultType<()> {
+    static STARTED:std::sync::Mutex<bool>=std::sync::Mutex::new(false);
+    let mut started=STARTED.lock().unwrap();
+    if *started {return Ok(());}
+    let directory=swan_agent::state_directory();
+    let state=match AgentState::load_for_refresh(&directory) {
+        Ok(state)=>state,
+        Err(_)=>{
+            // Preserve the existing unconfigured customer UI; managed access
+            // still requires validated company state on both ends.
+            log::debug!("Technician lifecycle unavailable without valid company configuration");
+            return Ok(());
+        }
+    };
+    if state.bootstrap.edition!=Edition::Technician {return Ok(());}
+    let runtime=swan_agent::technician_runtime::register(&directory)?;
+    std::thread::Builder::new().name("swan-technician-lifecycle".into()).spawn(move || {
+        let _runtime=runtime;
+        loop {
+            if directory.join("pending-uninstall").try_exists().unwrap_or(true) {
+                // Exit all windows and connections, including an idle signed-in
+                // UI. The OS releases credentials, transports and registration.
+                std::process::exit(0);
+            }
+            std::thread::sleep(std::time::Duration::from_millis(250));
+        }
+    })?;
+    *started=true;
+    Ok(())
+}
+
+pub async fn technician_request(request:&str)->String {
+    match technician_request_inner(request).await {
+        Ok(value)=>serde_json::json!({"ok":true,"data":value}).to_string(),
+        // Avoid including HTTP request or credential details in UI errors/logs.
+        Err(_)=>serde_json::json!({"ok":false,"error":"Company request failed. Check login, authenticator code, permissions and server availability."}).to_string(),
+    }
+}
+
+async fn technician_request_inner(request:&str)->ResultType<serde_json::Value> {
+    use serde_json::json;
+    use hbb_common::bail;
+    use hbb_common::anyhow::anyhow;
+    if request.len()>8192 {bail!("Request too large");}
+    let input:serde_json::Value=serde_json::from_str(request)?;
+    let action=input["action"].as_str().ok_or_else(||anyhow!("Missing action"))?;
+    if action=="customer-consent" {
+        let enabled=input["enabled"].as_bool().ok_or_else(||anyhow!("Missing consent choice"))?;
+        return crate::ipc::set_company_consent(enabled).await;
+    }
+    if action=="customer-support" {
+        let paused=input["paused"].as_bool().ok_or_else(||anyhow!("Missing support choice"))?;
+        return crate::ipc::set_company_support_paused(paused).await;
+    }
+    let directory=swan_agent::state_directory();
+    let state=AgentState::load_for_refresh(&directory)?;
+    if state.bootstrap.edition!=Edition::Technician {bail!("Technician edition required");}
+    if action=="update-progress" {
+        let memory=TECHNICIAN.lock().unwrap();
+        return Ok(json!({"running":memory.update_running,"handed_off":memory.update_handed_off,"failed":memory.update_failed}));
+    }
+    #[cfg(all(windows,feature="flutter"))]
+    if action=="resume-update" {
+        // Recovery can finish an already authorized installation offline. It
+        // cannot select a new release and does not require a reusable login.
+        let pending=directory.join("pending-update.json").exists();
+        if !pending || !crate::flutter::sessions::get_sessions().is_empty(){return Ok(json!({"handed_off":false,"pending":pending}));}
+        {let mut memory=TECHNICIAN.lock().unwrap();
+            if memory.update_running || memory.update_handed_off{return Ok(json!({"handed_off":memory.update_handed_off,"pending":pending}));}
+            memory.update_running=true;memory.update_failed=false;
+        }
+        hbb_common::tokio::spawn(async move {
+            let result=state.resume_pending_update_online(&directory,false).await;
+            let mut memory=TECHNICIAN.lock().unwrap();
+            memory.update_running=false;memory.update_failed=result.is_err();
+            memory.update_handed_off=matches!(result,Ok(true));
+            if memory.update_handed_off {
+                memory.generation=memory.generation.wrapping_add(1);memory.login=None;memory.tickets.clear();memory.reconnects.clear();
+            }
+        });
+        return Ok(json!({"handed_off":false,"pending":true,"started":true}));
+    }
+    if action=="sync" {
+        let mut state=state;state.sync().await?;state.save(&directory)?;
+        // Technician editions do not run the incoming rendezvous mediator,
+        // whose timer normally applies changes to the running transport.
+        refresh_defaults();
+        return Ok(json!({"revision":state.accepted_revision}));
+    }
+    if action=="status" {
+        let memory=TECHNICIAN.lock().unwrap();
+        return Ok(json!({"logged_in":memory.login.as_ref().map(|l|l.company==state.bootstrap.company_id).unwrap_or(false),"username":memory.login.as_ref().map(|l|l.username.as_str())}));
+    }
+    if action=="login" {
+        let username=input["username"].as_str().ok_or_else(||anyhow!("Missing username"))?;
+        let password=input["password"].as_str().ok_or_else(||anyhow!("Missing password"))?;
+        let code=input["code"].as_str().ok_or_else(||anyhow!("Missing code"))?;
+        let generation={let mut memory=TECHNICIAN.lock().unwrap();memory.generation=memory.generation.wrapping_add(1);memory.login=None;memory.tickets.clear();memory.reconnects.clear();memory.generation};
+        let token=state.technician_login(username,password,code).await?;
+        let accepted={let mut memory=TECHNICIAN.lock().unwrap();
+            if memory.generation==generation {memory.login=Some(TechnicianLogin{token:token.clone(),company:state.bootstrap.company_id.clone(),username:username.into()});true}else{false}
+        };
+        if !accepted {state.technician_logout(&token).await?;bail!("Login superseded");}
+        swan_agent::reporting::heartbeat(&directory,Some(&token)).await;
+        return Ok(json!({"username":username}));
+    }
+    let (token,generation)={let memory=TECHNICIAN.lock().unwrap();
+        let login=memory.login.as_ref().ok_or_else(||anyhow!("Login required"))?;
+        if login.company!=state.bootstrap.company_id {bail!("Wrong company login");}
+        (login.token.clone(),memory.generation)
+    };
+    if action=="logout" {
+        {let mut memory=TECHNICIAN.lock().unwrap();memory.generation=memory.generation.wrapping_add(1);memory.login=None;memory.tickets.clear();memory.reconnects.clear();}
+        // Local logout is immediate even if the server cannot receive revocation.
+        state.technician_logout(&token).await?;
+        return Ok(json!({"logged_in":false}));
+    }
+    if action=="devices" {
+        let devices=state.technician_inventory(&token).await?;
+        let updating={let memory=TECHNICIAN.lock().unwrap();memory.update_running || memory.update_handed_off};
+        if !updating {swan_agent::reporting::heartbeat(&directory,Some(&token)).await;}
+        return Ok(devices);
+    }
+    if action=="history" {return Ok(state.technician_history(&token).await?);}
+    #[cfg(all(windows,feature="flutter"))]
+    if action=="update" {
+        // Include disconnected/reconnecting windows, not just authenticated
+        // sessions. The file lock and pending receipt guard other processes.
+        if !crate::flutter::sessions::get_sessions().is_empty(){return Ok(json!({"handed_off":false}));}
+        {let mut memory=TECHNICIAN.lock().unwrap();
+            if memory.generation!=generation || memory.login.is_none(){bail!("Login changed before update");}
+            if memory.update_running || memory.update_handed_off{return Ok(json!({"handed_off":memory.update_handed_off}));}
+            memory.update_running=true;memory.update_failed=false;
+        }
+        let mut state=state;
+        hbb_common::tokio::spawn(async move {
+            // Authentication remains in native memory. Final server approval,
+            // receipt creation and session exclusion remain inside the updater.
+            let result=state.update(&directory,Some(&token)).await;
+            let mut memory=TECHNICIAN.lock().unwrap();
+            memory.update_running=false;memory.update_failed=result.is_err();
+            memory.update_handed_off=matches!(result,Ok(true));
+            if memory.update_handed_off {
+                memory.generation=memory.generation.wrapping_add(1);memory.login=None;memory.tickets.clear();memory.reconnects.clear();
+            }
+        });
+        return Ok(json!({"handed_off":false,"started":true}));
+    }
+    if action=="update-status" {
+        let envelope=state.approved_update(&directory,Some(&token)).await?;
+        let memory=TECHNICIAN.lock().unwrap();
+        if memory.generation!=generation || memory.login.is_none(){bail!("Login changed during update discovery");}
+        let Some(envelope)=envelope else{return Ok(serde_json::Value::Null);};
+        let release:swan_agent::protocol::Release=envelope.verify(&protocol::public_key(&state.bootstrap.release_public_key)?)?;
+        return Ok(json!({"version":release.version,"sequence":release.sequence,"channel":release.channel}));
+    }
+    if action=="connect" {
+        // Also consume profiles synchronized by the background agent before
+        // creating an outgoing window or selecting its server and trust key.
+        refresh_defaults();
+        let device=input["device_id"].as_str().ok_or_else(||anyhow!("Missing device"))?;
+        let key=protocol::signing_key_from_hex(&protocol::random_token())?;
+        let (envelope,grant)=state.technician_ticket(&token,device,input["unattended"].as_bool().unwrap_or(false),&key).await?;
+        let mut memory=TECHNICIAN.lock().unwrap();
+        if memory.generation!=generation || memory.login.is_none(){bail!("Login changed during authorization");}
+        memory.tickets.retain(|_,ticket|ticket.expires_at>protocol::now());
+        memory.reconnects.retain(|_,request|request.expires_at>protocol::now());
+        if memory.tickets.len()>=32 {bail!("Too many pending connections");}
+        if memory.reconnects.len()>=1024 {bail!("Too many connection requests; sign in again");}
+        // The proof is consumed inside native handle_hash, never sent to Dart,
+        // command-line arguments, another app instance or IPC configuration.
+        let handle=format!("SWT1.{}",protocol::random_token());
+        memory.reconnects.insert(handle.clone(),ReconnectRequest{device:device.into(),unattended:grant.unattended,company:grant.company_id.clone(),peer:grant.rustdesk_id.clone(),generation,expires_at:protocol::now()+86400});
+        memory.tickets.insert(handle.clone(),PendingTicket{envelope,key_hex:hex::encode(key.to_bytes()),expires_at:grant.expires_at,company:grant.company_id,peer:grant.rustdesk_id.clone()});
+        return Ok(json!({"rustdesk_id":grant.rustdesk_id,"ticket_handle":handle}));
+    }
+    bail!("Unknown technician action")
+}
+
+pub fn apply_defaults() {
+    let state = AgentState::load_for_refresh(&swan_agent::state_directory());
+    let profile = state.as_ref().ok().and_then(|s| s.company_profile().ok());
+    let technician = state.as_ref().map(|s| s.bootstrap.edition == Edition::Technician).unwrap_or(false);
+    // Stable edition identifiers keep customer service/configuration separate
+    // from a technician app running on the same Windows machine.
+    *config::APP_NAME.write().unwrap() = if technician{"Swan Remote Support Technician"}else{"Swan Remote Support"}.into();
+    let mut overrides = config::OVERWRITE_SETTINGS.write().unwrap();
+    // Fail closed before setup; never use an upstream public server or legacy tailnet.
+    overrides.insert(keys::OPTION_CUSTOM_RENDEZVOUS_SERVER.into(), profile.as_ref().map(|p|p.rendezvous.clone()).unwrap_or_else(||"unconfigured.invalid".into()));
+    overrides.insert(keys::OPTION_RELAY_SERVER.into(), profile.as_ref().map(|p|p.relay.clone()).unwrap_or_else(||"unconfigured.invalid".into()));
+    overrides.insert(keys::OPTION_KEY.into(),profile.as_ref().map(|p|p.transport_public_key.clone()).unwrap_or_default());
+    overrides.insert(keys::OPTION_API_SERVER.into(),String::new());
+    // Company release updates are handled by the configuration agent, not upstream.
+    overrides.insert(keys::OPTION_ALLOW_AUTO_UPDATE.into(),"N".into());
+    overrides.insert(keys::OPTION_ENABLE_RECORD_SESSION.into(),"N".into());
+    overrides.insert(keys::OPTION_APPROVE_MODE.into(),"click".into());
+    overrides.insert(keys::OPTION_ALLOW_ONLY_CONN_WINDOW_OPEN.into(),"N".into());
+    drop(overrides);
+    let mut hard=config::HARD_SETTINGS.write().unwrap();
+    hard.insert("conn-type".into(),if technician{"outgoing"}else{"incoming"}.into());
+    hard.insert("disable-account".into(),"Y".into());hard.insert("disable-ab".into(),"Y".into());
+    drop(hard);
+    let mut builtin=config::BUILTIN_SETTINGS.write().unwrap();
+    for key in [keys::OPTION_HIDE_NETWORK_SETTINGS,keys::OPTION_HIDE_SERVER_SETTINGS,keys::OPTION_HIDE_PROXY_SETTINGS,keys::OPTION_DISABLE_CHANGE_ID] {builtin.insert(key.into(),"Y".into());}
+    // Consent and signed grants, rather than Windows-lock-screen password fallback, authorize sessions.
+    builtin.insert(keys::OPTION_ALLOW_LOGON_SCREEN_PASSWORD.into(),"N".into());
+    // The managed customer UI supplies an acknowledged pause control. The
+    // upstream tray's stop command uninstalls the Windows service instead.
+    builtin.insert(keys::OPTION_HIDE_STOP_SERVICE.into(),"Y".into());
+}
+
+pub fn refresh_defaults()->bool {
+    static MODIFIED:std::sync::Mutex<Option<std::time::SystemTime>>=std::sync::Mutex::new(None);
+    let modified=match std::fs::metadata(swan_agent::state_directory().join("managed-state.json")).and_then(|m|m.modified()) {
+        Ok(modified)=>modified,
+        Err(_)=>return false,
+    };
+    let mut last=MODIFIED.lock().unwrap();if *last==Some(modified){return false;}*last=Some(modified);drop(last);
+    let before=(config::Config::get_option(keys::OPTION_CUSTOM_RENDEZVOUS_SERVER),config::Config::get_option(keys::OPTION_RELAY_SERVER),config::Config::get_option(keys::OPTION_KEY));
+    apply_defaults();
+    before!=(config::Config::get_option(keys::OPTION_CUSTOM_RENDEZVOUS_SERVER),config::Config::get_option(keys::OPTION_RELAY_SERVER),config::Config::get_option(keys::OPTION_KEY))
+}
+
+static SUPPORT_PAUSE_GENERATION:std::sync::atomic::AtomicU64=std::sync::atomic::AtomicU64::new(0);
+static SUPPORT_PAUSING:std::sync::atomic::AtomicBool=std::sync::atomic::AtomicBool::new(false);
+
+pub fn pause_generation()->u64 {
+    SUPPORT_PAUSE_GENERATION.load(std::sync::atomic::Ordering::SeqCst)
+}
+
+pub fn update_support_pause(paused:bool) {
+    SUPPORT_PAUSING.store(paused,std::sync::atomic::Ordering::SeqCst);
+    if !paused{return;}
+    // Local generations are process-scoped; old connections never survive a
+    // process restart. Increment before accepting the stop option so even an
+    // immediate resume cannot revive a connection from before the pause.
+    let generation=SUPPORT_PAUSE_GENERATION.fetch_add(1,std::sync::atomic::Ordering::SeqCst).wrapping_add(1);
+    SUPPORT_PAUSE_SIGNAL.send_replace(generation);
+}
+
+fn support_paused()->bool {
+    SUPPORT_PAUSING.load(std::sync::atomic::Ordering::SeqCst)
+        || config::option2bool("stop-service",&config::Config::get_option("stop-service"))
+}
+
+pub fn authorization_current(expires_at:Option<u64>,generation:u64)->bool {
+    !support_paused() && generation==pause_generation()
+        && expires_at.map(|expiry|protocol::now()<expiry)==Some(true)
+}
+
+pub fn subsession_handle(handle:&str,peer:&str)->Option<String> {
+    if !handle.starts_with("SWT1."){return None;}
+    let memory=TECHNICIAN.lock().unwrap();
+    let login=memory.login.as_ref()?;
+    let request=memory.reconnects.get(handle)?;
+    if request.peer!=peer || request.company!=login.company || request.generation!=memory.generation || request.expires_at<=protocol::now(){return None;}
+    // This is an opaque lookup key only. Every new connection must obtain a
+    // fresh server grant and prove its own challenge in login().
+    Some(handle.to_owned())
+}
+
+pub async fn claim(password:&[u8],challenge:&str,peer:&str)->ResultType<(Lease,u64)> {
+    let generation=pause_generation();
+    hbb_common::anyhow::ensure!(!support_paused() && generation==pause_generation(),"Customer paused support");
+    let login=ManagedLogin::from_wire(password)?;
+    let state=AgentState::load(&swan_agent::state_directory())?;
+    let lease=state.claim(&login,challenge,peer).await?;
+    if !authorization_current(Some(lease.expires_at),generation) {
+        if state.close(&lease.grant_id).await.is_err(){log::warn!("Paused company session cleanup could not reach the server");}
+        hbb_common::bail!("Customer paused support during authorization");
+    }
+    Ok((lease,generation))
+}
+
+pub async fn renew(lease:&mut Lease,generation:u64)->ResultType<()> {
+    hbb_common::anyhow::ensure!(authorization_current(Some(lease.expires_at),generation),"Customer paused support or authorization expired");
+    let state=AgentState::load(&swan_agent::state_directory())?;
+    interrupt_on_pause(generation,state.renew(lease)).await?;
+    hbb_common::anyhow::ensure!(authorization_current(Some(lease.expires_at),generation),"Customer paused support during renewal");
+    Ok(())
+}
+
+async fn interrupt_on_pause<T>(generation:u64,operation:impl std::future::Future<Output=ResultType<T>>)->ResultType<T> {
+    let mut pause=SUPPORT_PAUSE_SIGNAL.subscribe();
+    hbb_common::anyhow::ensure!(!support_paused() && generation==pause_generation(),"Customer paused support");
+    let result;
+    hbb_common::tokio::select! {
+        value=operation=>result=value?,
+        _=pause.changed()=>hbb_common::bail!("Customer paused support during renewal"),
+    }
+    hbb_common::anyhow::ensure!(!support_paused() && generation==pause_generation(),"Customer paused support during renewal");
+    Ok(result)
+}
+
+#[cfg(test)]
+mod pause_tests {
+    use super::*;
+    use hbb_common::tokio;
+    #[tokio::test]
+    async fn pause_denies_claims_and_resume_cannot_revive_old_authorization() {
+        struct Restore(String);
+        impl Drop for Restore {fn drop(&mut self){config::Config::set_option("stop-service".into(),self.0.clone());update_support_pause(false);}}
+        let _restore=Restore(config::Config::get_option("stop-service"));
+        config::Config::set_option("stop-service".into(),String::new());
+        update_support_pause(false);
+        let generation=pause_generation();let expiry=Some(protocol::now()+120);
+        assert!(authorization_current(expiry,generation));
+        let (entered,waiting)=tokio::sync::oneshot::channel();
+        let renewal=tokio::spawn(interrupt_on_pause(generation,async move {
+            entered.send(()).unwrap();
+            std::future::pending::<ResultType<()>>().await
+        }));
+        waiting.await.unwrap();
+        update_support_pause(true);
+        // Stop blocks authorization before its persistent option is written.
+        assert!(!authorization_current(expiry,pause_generation()));
+        assert!(tokio::time::timeout(std::time::Duration::from_secs(5),renewal).await.unwrap().unwrap().is_err());
+        config::Config::set_option("stop-service".into(),"Y".into());
+        assert!(!authorization_current(expiry,generation));
+        assert!(!authorization_current(expiry,pause_generation()));
+        let error=claim(b"invalid-wire","challenge","peer").await.err().unwrap();
+        assert!(error.to_string().contains("Customer paused support"));
+        update_support_pause(false);
+        // Resume cannot admit a session until the persisted stop is cleared.
+        assert!(!authorization_current(expiry,pause_generation()));
+        config::Config::set_option("stop-service".into(),String::new());
+        assert!(!authorization_current(expiry,generation));
+        assert!(authorization_current(expiry,pause_generation()));
+        assert!(!authorization_current(None,pause_generation()));
+        assert!(!authorization_current(Some(protocol::now()),pause_generation()));
+    }
+}
+
+#[cfg(test)]
+mod subsession_tests {
+    use super::*;
+    #[test]
+    fn file_transfer_handle_is_bound_to_target_company_and_current_login() {
+        struct Restore(Option<TechnicianMemory>);
+        impl Drop for Restore {fn drop(&mut self){*TECHNICIAN.lock().unwrap()=self.0.take().unwrap();}}
+        let original=std::mem::take(&mut *TECHNICIAN.lock().unwrap());let _restore=Restore(Some(original));
+        let handle=format!("SWT1.{}",protocol::random_token());
+        {
+            let mut memory=TECHNICIAN.lock().unwrap();
+            memory.generation=7;
+            memory.login=Some(TechnicianLogin{token:"not-a-real-credential".into(),company:"lab".into(),username:"tech".into()});
+            memory.reconnects.insert(handle.clone(),ReconnectRequest{device:"device".into(),unattended:false,company:"lab".into(),peer:"123456789".into(),generation:7,expires_at:protocol::now()+120});
+        }
+        assert_eq!(subsession_handle(&handle,"123456789"),Some(handle.clone()));
+        assert!(subsession_handle(&handle,"987654321").is_none());
+        assert!(subsession_handle("legacy-password","123456789").is_none());
+        TECHNICIAN.lock().unwrap().generation=8;
+        assert!(subsession_handle(&handle,"123456789").is_none());
+        {
+            let mut memory=TECHNICIAN.lock().unwrap();memory.generation=7;
+            memory.login.as_mut().unwrap().company="other-company".into();
+        }
+        assert!(subsession_handle(&handle,"123456789").is_none());
+        {
+            let mut memory=TECHNICIAN.lock().unwrap();memory.login.as_mut().unwrap().company="lab".into();
+            memory.reconnects.get_mut(&handle).unwrap().expires_at=protocol::now();
+        }
+        assert!(subsession_handle(&handle,"123456789").is_none());
+        TECHNICIAN.lock().unwrap().login=None;
+        assert!(subsession_handle(&handle,"123456789").is_none());
+    }
+}
+
+pub async fn login(challenge:&str,target:&str,local_ticket:&str)->ResultType<Vec<u8>> {
+    // The outgoing connection loop retains its own shared lock through close.
+    // Recheck pending installation here as well before consuming a proof ticket.
+    {let _activity=swan_agent::lock_session(&swan_agent::state_directory())?;}
+    let state=AgentState::load(&swan_agent::state_directory())?;
+    if state.bootstrap.edition!=Edition::Technician {hbb_common::bail!("Technician edition required");}
+    // The opaque handle identifies one window's pending request. It contains
+    // no grant or proof key and cannot overwrite another request to this peer.
+    let pending=if local_ticket.is_empty(){None}else{
+        if !local_ticket.starts_with("SWT1."){hbb_common::bail!("Managed ticket required; legacy passwords are disabled");}
+        TECHNICIAN.lock().unwrap().tickets.remove(local_ticket)
+    };
+    let (envelope,key)=if let Some(ticket)=pending {
+        if ticket.company!=state.bootstrap.company_id || ticket.peer!=target || ticket.expires_at<=protocol::now(){hbb_common::bail!("Expired or wrong-target ticket");}
+        (ticket.envelope,protocol::signing_key_from_hex(&ticket.key_hex)?)
+    }else if !local_ticket.is_empty(){
+        // A consumed proof is never replayed. Reconnection requires current
+        // native login and a new target-bound server grant and proof key.
+        let (request,token)={let memory=TECHNICIAN.lock().unwrap();
+            let request=memory.reconnects.get(local_ticket).ok_or_else(||hbb_common::anyhow::anyhow!("Unknown connection request"))?.clone();
+            let login=memory.login.as_ref().ok_or_else(||hbb_common::anyhow::anyhow!("Login required for reconnection"))?;
+            if request.company!=state.bootstrap.company_id || login.company!=request.company || request.peer!=target || request.generation!=memory.generation || request.expires_at<=protocol::now(){hbb_common::bail!("Expired or wrong-target reconnection");}
+            (request,login.token.clone())
+        };
+        let key=protocol::signing_key_from_hex(&protocol::random_token())?;
+        let (envelope,grant)=state.technician_ticket(&token,&request.device,request.unattended,&key).await?;
+        {let memory=TECHNICIAN.lock().unwrap();if memory.generation!=request.generation || memory.login.is_none(){hbb_common::bail!("Login changed during reconnection");}}
+        if grant.device_id!=request.device || grant.unattended!=request.unattended{hbb_common::bail!("Wrong reconnection grant");}
+        (envelope,key)
+    }else{
+        (serde_json::from_str(&std::env::var("SWAN_SESSION_GRANT")?)?,protocol::signing_key_from_hex(&std::env::var("SWAN_SESSION_PROOF_KEY")?)?)
+    };
+    let grant:protocol::SessionGrant=envelope.verify(&protocol::public_key(&state.bootstrap.profile_public_key)?)?;
+    grant.validate(&state.bootstrap.company_id,&grant.device_id,target,protocol::now())?;
+    let _activity=swan_agent::lock_session(&swan_agent::state_directory())?;
+    // A ticket stolen from a connection cannot be used without this ephemeral proof key.
+    Ok(ManagedLogin::prove(envelope,&key,challenge).to_wire()?)
+}
+
+/// Visible branding only. Never use this name for services, paths or device identity.
+pub fn display_name() -> String {
+    let name = AgentState::load_for_refresh(&swan_agent::state_directory())
+        .and_then(|state| display_name_from_state(&state));
+    // A verified cached profile can supply offline branding, never authorization.
+    match name {
+        Ok(name) if !name.trim().is_empty() => name,
+        _ => crate::get_app_name(),
+    }
+}
+
+fn display_name_from_state(state: &AgentState) -> ResultType<String> {
+    let profile = state.display_profile()?;
+    Ok(if state.bootstrap.edition == Edition::Technician {
+        profile.technician.display_name.clone()
+    } else {
+        profile.customer.display_name.clone()
+    })
+}
+
+#[cfg(test)]
+mod branding_tests {
+    use super::*;
+    use hbb_common::base64::{self, Engine};
+    use protocol::{Branding, CompanyProfile};
+
+    #[test]
+    fn signed_display_names_do_not_change_identity_or_authorize_expired_policy() {
+        let key = protocol::signing_key_from_hex(&"07".repeat(32)).unwrap();
+        let public = base64::engine::general_purpose::STANDARD.encode(key.verifying_key().as_bytes());
+        let now = protocol::now();
+        let mut profile = CompanyProfile {
+            schema: 1, company_id: "test-company".into(), revision: 1,
+            issued_at: now - 1000, expires_at: now - 1,
+            management_url: "https://support.example.com".into(),
+            rendezvous: "support.example.com".into(), relay: "support.example.com".into(),
+            transport_public_key: public.clone(),
+            customer: Branding::default(), technician: Branding::default(),
+            allow_unattended: false, updates_paused: true, rollout_percent: 100,
+            maintenance_start_utc: 0, maintenance_end_utc: 0,
+            update_channel: "test".into(), next_profile_public_key: None,
+        };
+        profile.customer.display_name = "Company Customer".into();
+        profile.technician.display_name = "Company Technician".into();
+        let mut state = AgentState {
+            bootstrap: swan_agent::Bootstrap {
+                schema: 1, edition: Edition::Customer, company_id: profile.company_id.clone(),
+                management_url: profile.management_url.clone(),
+                profile_public_key: public.clone(), release_public_key: public,
+            },
+            profile: SignedEnvelope::sign(&profile, &key).unwrap(), accepted_revision: 1,
+            device_id: Some("unchanged-device".into()), device_token: None,
+            unattended_consent: false, consent_revision: 0, last_release_sequence: 0,
+        };
+        let internal_name = crate::get_app_name();
+        assert_eq!(display_name_from_state(&state).unwrap(), "Company Customer");
+        assert!(state.company_profile().is_err());
+        state.bootstrap.edition = Edition::Technician;
+        assert_eq!(display_name_from_state(&state).unwrap(), "Company Technician");
+        assert_eq!(state.device_id.as_deref(), Some("unchanged-device"));
+        assert_eq!(crate::get_app_name(), internal_name);
+        state.accepted_revision = 2;
+        assert!(display_name_from_state(&state).is_err());
+        state.accepted_revision = 1;
+        state.bootstrap.company_id = "other-company".into();
+        assert!(display_name_from_state(&state).is_err());
+        state.bootstrap.company_id = profile.company_id;
+        state.profile.signature = "invalid-signature".into();
+        assert!(display_name_from_state(&state).is_err());
+    }
+}
+
+pub fn overview()->String {
+    let state=AgentState::load_for_refresh(&swan_agent::state_directory());
+    match state {
+        Ok(state)=>match state.display_profile(){
+            Ok(profile)=>{
+                let brand=if state.bootstrap.edition==Edition::Technician{&profile.technician}else{&profile.customer};
+                serde_json::json!({"configured":true,"profile_valid":state.company_profile().is_ok(),"edition":state.bootstrap.edition,"enrolled":state.device_id.is_some(),"unattended":state.unattended_consent,"allow_unattended":profile.allow_unattended,"display_name":brand.display_name,"primary_color":brand.primary_color,"logo_svg":brand.logo_svg,"support_url":brand.support_url,"support_contacts":brand.support_contacts,"shortcuts":brand.shortcuts,"consent_text":brand.consent_text,"domain":profile.management_url}).to_string()
+            }
+            Err(_)=>"{\"configured\":false}".into()
+        },
+        Err(_)=>"{\"configured\":false}".into()
+    }
+}
diff --git a/src/platform/windows.rs b/src/platform/windows.rs
index b6b5b39d9b8..c7155552646 100644
--- a/src/platform/windows.rs
+++ b/src/platform/windows.rs
@@ -33,8 +33,10 @@ use std::{
     time::{Duration, Instant},
 };
 use wallpaper;
-#[cfg(not(debug_assertions))]
-use winapi::um::libloaderapi::{LoadLibraryExW, LOAD_LIBRARY_SEARCH_USER_DIRS};
+#[cfg(any(not(debug_assertions), test))]
+use winapi::um::libloaderapi::{
+    LoadLibraryExW, LOAD_LIBRARY_SEARCH_APPLICATION_DIR, LOAD_LIBRARY_SEARCH_USER_DIRS,
+};
 use winapi::{
     ctypes::c_void,
     shared::{minwindef::*, ntdef::NULL, windef::*, winerror::*},
@@ -523,11 +525,96 @@ fn fix_cursor_mask(
 define_windows_service!(ffi_service_main, service_main);
 
 fn service_main(arguments: Vec<OsString>) {
-    if let Err(e) = run_service(arguments) {
+    if let Err(e) = run_service(arguments, None) {
         log::error!("run_service failed: {}", e);
     }
 }
 
+pub(crate) type BootstrapServiceStatus = extern "C" fn(u32, u32) -> i32;
+
+enum ServiceStatusReporter {
+    Native(service_control_handler::ServiceStatusHandle),
+    Bootstrap(BootstrapServiceStatus),
+}
+
+impl ServiceStatusReporter {
+    fn set_service_status(&self, status: ServiceStatus) -> ResultType<()> {
+        match self {
+            Self::Native(handle) => handle.set_service_status(status).map_err(Into::into),
+            Self::Bootstrap(report) => {
+                let state = match status.current_state {
+                    ServiceState::Running => winapi::um::winsvc::SERVICE_RUNNING,
+                    ServiceState::Stopped => winapi::um::winsvc::SERVICE_STOPPED,
+                    _ => bail!("Unexpected bootstrapped service state"),
+                };
+                let code = match status.exit_code {
+                    ServiceExitCode::Win32(code) => code,
+                    _ => bail!("Unexpected bootstrapped service exit code"),
+                };
+                if report(state, code) == 0 {
+                    bail!("Service status report failed: {}", io::Error::last_os_error());
+                }
+                Ok(())
+            }
+        }
+    }
+}
+
+fn service_control_event(control_event: ServiceControl) -> ServiceControlHandlerResult {
+    log::info!("Got service control event: {:?}", control_event);
+    match control_event {
+        ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
+        ServiceControl::Stop | ServiceControl::Preshutdown | ServiceControl::Shutdown => {
+            send_close(crate::POSTFIX_SERVICE).ok();
+            ServiceControlHandlerResult::NoError
+        }
+        _ => ServiceControlHandlerResult::NotImplemented,
+    }
+}
+
+#[cfg(feature = "swan_custom")]
+pub(crate) fn bootstrap_service_control(control: u32) -> u32 {
+    use winapi::um::winsvc::*;
+    let event = match control {
+        SERVICE_CONTROL_INTERROGATE => ServiceControl::Interrogate,
+        SERVICE_CONTROL_STOP => ServiceControl::Stop,
+        SERVICE_CONTROL_SHUTDOWN => ServiceControl::Shutdown,
+        SERVICE_CONTROL_PRESHUTDOWN => ServiceControl::Preshutdown,
+        _ => return ERROR_CALL_NOT_IMPLEMENTED,
+    };
+    if matches!(service_control_event(event), ServiceControlHandlerResult::NoError) {
+        NO_ERROR
+    } else {
+        ERROR_CALL_NOT_IMPLEMENTED
+    }
+}
+
+// The managed launcher has already connected to SCM and is reporting bounded
+// StartPending checkpoints before it loads this DLL or company configuration.
+#[cfg(feature = "swan_custom")]
+pub(crate) fn run_bootstrapped_service(report: BootstrapServiceStatus) -> u32 {
+    if std::env::args().skip(1).collect::<Vec<_>>() != ["--service"] {
+        return ERROR_INVALID_PARAMETER;
+    }
+    if !crate::common::global_init() {
+        return ERROR_GEN_FAILURE;
+    }
+    crate::load_custom_client();
+    if crate::get_app_name() != "Swan Remote Support" || !bootstrap() {
+        return ERROR_INVALID_DATA;
+    }
+    #[cfg(not(debug_assertions))]
+    hbb_common::platform::register_breakdown_handler(crate::platform::breakdown_callback);
+    hbb_common::init_log(false, "service");
+    match run_service(Vec::new(), Some(report)) {
+        Ok(()) => NO_ERROR,
+        Err(error) => {
+            log::error!("Bootstrapped service failed: {}", error);
+            ERROR_GEN_FAILURE
+        }
+    }
+}
+
 pub fn start_os_service() {
     if let Err(e) =
         windows_service::service_dispatcher::start(crate::get_app_name(), ffi_service_main)
@@ -637,22 +724,14 @@ extern "system" {
 }
 
 #[tokio::main(flavor = "current_thread")]
-async fn run_service(_arguments: Vec<OsString>) -> ResultType<()> {
-    let event_handler = move |control_event| -> ServiceControlHandlerResult {
-        log::info!("Got service control event: {:?}", control_event);
-        match control_event {
-            ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
-            ServiceControl::Stop | ServiceControl::Preshutdown | ServiceControl::Shutdown => {
-                send_close(crate::POSTFIX_SERVICE).ok();
-                ServiceControlHandlerResult::NoError
-            }
-            _ => ServiceControlHandlerResult::NotImplemented,
-        }
+async fn run_service(_arguments: Vec<OsString>, bootstrap: Option<BootstrapServiceStatus>) -> ResultType<()> {
+    let status_handle = match bootstrap {
+        Some(report) => ServiceStatusReporter::Bootstrap(report),
+        None => ServiceStatusReporter::Native(service_control_handler::register(
+            crate::get_app_name(), service_control_event,
+        )?),
     };
 
-    // Register system service event handler
-    let status_handle = service_control_handler::register(crate::get_app_name(), event_handler)?;
-
     let next_status = ServiceStatus {
         // Should match the one from system service registry
         service_type: SERVICE_TYPE,
@@ -1286,7 +1365,34 @@ fn get_subkey(name: &str, wow: bool) -> String {
     }
 }
 
+#[cfg(feature = "swan_custom")]
+fn swan_msi_product_code() -> ResultType<Option<String>> {
+    if crate::get_app_name()!="Swan Remote Support" {return Ok(None);}
+    let machine=RegKey::predef(HKEY_LOCAL_MACHINE);
+    let registration=match machine.open_subkey(r"Software\SwanRemoteSupport\Customer") {
+        Ok(key)=>key,
+        Err(error) if error.kind()==std::io::ErrorKind::NotFound=>return Ok(None),
+        Err(error)=>return Err(error.into()),
+    };
+    let code:String=registration.get_value("ProductCode")?;
+    let bytes=code.as_bytes();
+    if bytes.len()!=38 || bytes[0]!=b'{' || bytes[37]!=b'}' || !bytes[1..37].iter().enumerate().all(|(index,byte)| {
+        if [8,13,18,23].contains(&index){*byte==b'-'}else{byte.is_ascii_hexdigit()}
+    }) {bail!("Invalid Swan MSI product identity");}
+    let uninstall=machine.open_subkey(format!(r"Software\Microsoft\Windows\CurrentVersion\Uninstall\{code}"))?;
+    let installer:u32=uninstall.get_value("WindowsInstaller")?;
+    let name:String=uninstall.get_value("DisplayName")?;
+    if installer!=1 || name!="Swan Remote Support" {bail!("Swan MSI identity does not match the installed product");}
+    Ok(Some(code))
+}
+
 fn get_valid_subkey() -> String {
+    #[cfg(feature = "swan_custom")]
+    match swan_msi_product_code() {
+        Ok(Some(code))=>return get_subkey(&code,false),
+        Ok(None)=>{},
+        Err(error)=>log::error!("Swan MSI registration could not be verified: {error}"),
+    }
     let subkey = get_subkey(IS1, false);
     if !get_reg_of(&subkey, "InstallLocation").is_empty() {
         return subkey;
@@ -1773,10 +1879,10 @@ fn get_before_uninstall(kill_self: bool) -> String {
     format!(
         "
     chcp 65001
-    sc stop {app_name}
-    sc delete {app_name}
+    sc stop \"{app_name}\"
+    sc delete \"{app_name}\"
     taskkill /F /IM {broker_exe}
-    taskkill /F /IM {app_name}.exe{filter}
+    taskkill /F /IM \"{app_name}.exe\"{filter}
     reg delete HKEY_CLASSES_ROOT\\.{ext} /f
     reg delete HKEY_CLASSES_ROOT\\{ext} /f
     netsh advfirewall firewall delete rule name=\"{app_name} Service\"
@@ -1798,6 +1904,15 @@ fn get_before_uninstall(kill_self: bool) -> String {
 /// is included in the generated uninstall script. If `uninstall_printer` is `false`, the printer
 /// related command is omitted from the script.
 fn get_uninstall(kill_self: bool, uninstall_printer: bool) -> String {
+    #[cfg(feature = "swan_custom")]
+    match swan_msi_product_code() {
+        Ok(Some(code))=>return format!("msiexec.exe /x {code} /passive /norestart"),
+        Ok(None)=>{},
+        Err(error)=>{
+            log::error!("Refusing uninstall with invalid Swan MSI registration: {error}");
+            return "echo Swan MSI registration is invalid. Use Windows installed apps to remove the package.\r\nexit /b 1".into();
+        }
+    }
     let reg_uninstall_string = get_reg("UninstallString");
     if reg_uninstall_string.to_lowercase().contains("msiexec.exe") {
         return reg_uninstall_string;
@@ -1833,7 +1948,46 @@ fn get_uninstall(kill_self: bool, uninstall_printer: bool) -> String {
 }
 
 pub fn uninstall_me(kill_self: bool) -> ResultType<()> {
-    run_cmds(get_uninstall(kill_self, true), true, "uninstall")
+    #[cfg(feature = "swan_custom")]
+    if let Some(code) = swan_msi_product_code()? {
+        // Resolve the Windows-owned executable without PATH or environment lookup.
+        let mut directory = vec![0u16; 32768];
+        let length = unsafe {
+            winapi::um::sysinfoapi::GetSystemDirectoryW(
+                directory.as_mut_ptr(), directory.len() as u32,
+            )
+        } as usize;
+        if length == 0 || length >= directory.len() {
+            bail!("Unable to resolve the Windows Installer executable");
+        }
+        let executable = PathBuf::from(OsString::from_wide(&directory[..length]))
+            .join("msiexec.exe");
+        if !run_uac(&executable.to_string_lossy(), &format!("/x {code} /passive /norestart"))? {
+            bail!("Windows Installer was not started; uninstall was cancelled or failed");
+        }
+        if kill_self {
+            std::process::exit(0);
+        }
+        return Ok(());
+    }
+    let commands=get_uninstall(kill_self,true);
+    #[cfg(feature = "swan_custom")]
+    let commands=if crate::get_app_name()=="Swan Remote Support" {
+        let mut directory=vec![0u16;32768];
+        let length=unsafe{winapi::um::sysinfoapi::GetSystemDirectoryW(directory.as_mut_ptr(),directory.len() as u32)} as usize;
+        if length==0 || length>=directory.len(){bail!("Cannot resolve trusted Windows PowerShell for uninstall cancellation");}
+        let powershell=PathBuf::from(OsString::from_wide(&directory[..length])).join("WindowsPowerShell/v1.0/powershell.exe");
+        let script=include_str!("../../deployment/windows/Cancel-CustomerExeRecovery.ps1");
+        let bytes:Vec<u8>=script.encode_utf16().flat_map(|word|word.to_le_bytes()).collect();
+        let encoded=crate::encode64(bytes);
+        // This fixed script runs inside the existing elevated uninstall batch,
+        // before stopping the service or deleting any installed files.
+        let completion=include_str!("../../deployment/windows/Complete-CustomerExeUninstall.ps1");
+        let completion_bytes:Vec<u8>=completion.encode_utf16().flat_map(|word|word.to_le_bytes()).collect();
+        let completion_encoded=crate::encode64(completion_bytes);
+        format!("\"{}\" -NoLogo -NoProfile -NonInteractive -EncodedCommand {}\r\nif errorlevel 1 exit /b 1\r\n{}\r\n\"{}\" -NoLogo -NoProfile -NonInteractive -EncodedCommand {}\r\nif errorlevel 1 exit /b 1",powershell.display(),encoded,commands,powershell.display(),completion_encoded)
+    }else{commands};
+    run_cmds(commands, true, "uninstall")
 }
 
 fn write_cmds(cmds: String, ext: &str, tip: &str) -> ResultType<std::path::PathBuf> {
@@ -1897,11 +2051,20 @@ fn run_cmds(cmds: String, show: bool, tip: &str) -> ResultType<()> {
     let tmp_fn = tmp.to_str().unwrap_or("");
     // https://github.com/rustdesk/rustdesk/issues/6786#issuecomment-1879655410
     // Specify cmd.exe explicitly to avoid the replacement of cmd commands.
-    let res = runas::Command::new("cmd.exe")
+    let res = if is_root() {
+        // SYSTEM update workers run without an interactive UAC desktop.
+        let mut directory=vec![0u16;32768];
+        let length=unsafe{winapi::um::sysinfoapi::GetSystemDirectoryW(directory.as_mut_ptr(),directory.len() as u32)} as usize;
+        if length==0 || length>=directory.len(){bail!("Cannot resolve Windows command processor");}
+        let system=PathBuf::from(OsString::from_wide(&directory[..length]));
+        std::process::Command::new(system.join("cmd.exe")).args(["/C",tmp_fn]).current_dir(&system)
+            .creation_flags(if show {0}else{winapi::um::winbase::CREATE_NO_WINDOW}).status()
+            .and_then(|status|if status.success(){Ok(())}else{Err(std::io::Error::new(std::io::ErrorKind::Other,"SYSTEM installation command failed"))})
+    }else{runas::Command::new("cmd.exe")
         .args(&["/C", &tmp_fn])
         .show(show)
         .force_prompt(true)
-        .status();
+        .status().map(|_| ())};
     if !show {
         allow_err!(std::fs::remove_file(tmp));
     }
@@ -2181,7 +2344,7 @@ pub fn bootstrap() -> bool {
     }
 }
 
-#[cfg(not(debug_assertions))]
+#[cfg(any(not(debug_assertions), test))]
 fn set_safe_load_dll() -> bool {
     if !unsafe { set_default_dll_directories() } {
         return false;
@@ -2198,7 +2361,7 @@ fn set_safe_load_dll() -> bool {
 }
 
 // https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-setdefaultdlldirectories
-#[cfg(not(debug_assertions))]
+#[cfg(any(not(debug_assertions), test))]
 unsafe fn set_default_dll_directories() -> bool {
     let module = LoadLibraryExW(
         wide_string("Kernel32.dll").as_ptr(),
@@ -2222,7 +2385,9 @@ unsafe fn set_default_dll_directories() -> bool {
             }
             type SetDefaultDllDirectories = unsafe extern "system" fn(DWORD) -> BOOL;
             let func: SetDefaultDllDirectories = std::mem::transmute(func);
-            if func(LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS) == FALSE {
+            // Desktop DLLs are delay loaded after bootstrap. Keep their executable
+            // directory available without restoring current-directory or PATH search.
+            if func(LOAD_LIBRARY_SEARCH_APPLICATION_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS) == FALSE {
                 eprintln!(
                     "SetDefaultDllDirectories failed: {}",
                     io::Error::last_os_error()
@@ -2234,6 +2399,79 @@ unsafe fn set_default_dll_directories() -> bool {
     true
 }
 
+#[cfg(test)]
+mod dll_search_tests {
+    use super::*;
+    use std::process::{Command, Stdio};
+    use winapi::um::libloaderapi::{FreeLibrary, LoadLibraryW};
+
+    #[test]
+    fn loader_child() {
+        let Ok(application) = std::env::var("SWAN_DLL_SEARCH_APP_PROBE") else { return; };
+        let cwd = std::env::var("SWAN_DLL_SEARCH_CWD_PROBE").unwrap();
+        let path = std::env::var("SWAN_DLL_SEARCH_PATH_PROBE").unwrap();
+        for name in [&application, &cwd, &path] {
+            assert!(name.starts_with("swan-dll-search-") && name.ends_with(".dll"));
+            assert!(!name.contains(['\\', '/', ':']));
+        }
+        // Only the child changes this process-wide loader policy.
+        assert!(set_safe_load_dll());
+        for name in [application.as_str(), "version.dll"] {
+            let module = unsafe { LoadLibraryW(wide_string(name).as_ptr()) };
+            assert!(!module.is_null(), "Expected DLL unavailable: {name}: {}", io::Error::last_os_error());
+            unsafe { FreeLibrary(module); }
+        }
+        for name in [cwd, path] {
+            let module = unsafe { LoadLibraryW(wide_string(&name).as_ptr()) };
+            if !module.is_null() { unsafe { FreeLibrary(module); } }
+            assert!(module.is_null(), "Untrusted CWD or PATH DLL was loaded");
+        }
+    }
+
+    #[test]
+    fn hardened_search_loads_application_dlls_but_rejects_cwd_and_path() {
+        let executable = std::env::current_exe().unwrap();
+        let application_dir = executable.parent().unwrap().canonicalize().unwrap();
+        let nonce = format!("{}-{}", std::process::id(), std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos());
+        let root = std::env::temp_dir().join(format!("swan-dll-search-{nonce}"));
+        fs::create_dir(&root).unwrap();
+        let cwd_dir = root.join("cwd");
+        let path_dir = root.join("path");
+        fs::create_dir(&cwd_dir).unwrap();
+        fs::create_dir(&path_dir).unwrap();
+        let names = [format!("swan-dll-search-app-{nonce}.dll"), format!("swan-dll-search-cwd-{nonce}.dll"), format!("swan-dll-search-path-{nonce}.dll")];
+        let files = [application_dir.join(&names[0]), cwd_dir.join(&names[1]), path_dir.join(&names[2])];
+        let source = PathBuf::from(std::env::var_os("SystemRoot").unwrap()).join("System32/version.dll");
+        for destination in &files {
+            let mut input = fs::File::open(&source).unwrap();
+            let mut output = fs::OpenOptions::new().write(true).create_new(true).open(destination).unwrap();
+            io::copy(&mut input, &mut output).unwrap();
+        }
+        let mut child = Command::new(executable)
+            .args(["--exact", "platform::windows::dll_search_tests::loader_child", "--nocapture"])
+            .current_dir(&cwd_dir).env("PATH", &path_dir)
+            .env("SWAN_DLL_SEARCH_APP_PROBE", &names[0])
+            .env("SWAN_DLL_SEARCH_CWD_PROBE", &names[1])
+            .env("SWAN_DLL_SEARCH_PATH_PROBE", &names[2])
+            .stdin(Stdio::null()).spawn().unwrap();
+        let started = Instant::now();
+        let status = loop {
+            if let Some(status) = child.try_wait().unwrap() { break status; }
+            if started.elapsed() > Duration::from_secs(30) {
+                child.kill().unwrap(); child.wait().unwrap();
+                panic!("DLL-search child did not finish; fixture retained");
+            }
+            std::thread::sleep(Duration::from_millis(20));
+        };
+        assert!(status.success(), "DLL-search child failed; fixture retained");
+        // Remove only the exact created files and empty fixture directories.
+        for file in files { fs::remove_file(file).unwrap(); }
+        fs::remove_dir(cwd_dir).unwrap();
+        fs::remove_dir(path_dir).unwrap();
+        fs::remove_dir(root).unwrap();
+    }
+}
+
 fn get_custom_icon(install_dir: &str, exe: &str) -> Option<String> {
     const RELATIVE_ICON_PATH: &str = "data\\flutter_assets\\assets\\icon.ico";
     if crate::is_custom_client() {
@@ -3165,11 +3403,11 @@ pub fn uninstall_service(show_new_window: bool, _: bool) -> bool {
     let cmds = format!(
         "
     chcp 65001
-    sc stop {app_name}
-    sc delete {app_name}
+    sc stop \"{app_name}\"
+    sc delete \"{app_name}\"
     if exist \"%PROGRAMDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\{app_name} Tray.lnk\" del /f /q \"%PROGRAMDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\{app_name} Tray.lnk\"
     taskkill /F /IM {broker_exe}
-    taskkill /F /IM {app_name}.exe{filter}
+    taskkill /F /IM \"{app_name}.exe\"{filter}
     ",
         app_name = crate::get_app_name(),
         broker_exe = WIN_TOPMOST_INJECTED_PROCESS_EXE,
@@ -3195,7 +3433,7 @@ pub fn install_service() -> bool {
     let cmds = format!(
         "
 chcp 65001
-taskkill /F /IM {app_name}.exe{filter}
+taskkill /F /IM \"{app_name}.exe\"{filter}
 cscript \"{tray_shortcut}\"
 copy /Y \"{tmp_path}\\{app_name} Tray.lnk\" \"%PROGRAMDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\"
 {import_config}
@@ -3399,8 +3637,8 @@ reg add {subkey} /f /v EstimatedSize /t REG_DWORD /d {size}
     let cmds = format!(
         "
 chcp 65001
-sc stop {app_name}
-taskkill /F /IM {app_name}.exe{filter}
+sc stop \"{app_name}\"
+taskkill /F /IM \"{app_name}.exe\"{filter}
 {reg_cmd}
 {copy_exe}
 {rename_exe}
@@ -3688,12 +3926,12 @@ fn get_import_config(exe: &str) -> String {
         return "".to_string();
     }
     format!("
-sc stop {app_name}
-sc delete {app_name}
-sc create {app_name} binpath= \"\\\"{exe}\\\" --import-config \\\"{config_path}\\\"\" start= auto DisplayName= \"{app_name} Service\"
-sc start {app_name}
-sc stop {app_name}
-sc delete {app_name}
+sc stop \"{app_name}\"
+sc delete \"{app_name}\"
+sc create \"{app_name}\" binpath= \"\\\"{exe}\\\" --import-config \\\"{config_path}\\\"\" start= auto DisplayName= \"{app_name} Service\"
+sc start \"{app_name}\"
+sc stop \"{app_name}\"
+sc delete \"{app_name}\"
 ",
     app_name = crate::get_app_name(),
     config_path=Config::file().to_str().unwrap_or(""),
@@ -3711,8 +3949,8 @@ if exist \"%PROGRAMDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\{ap
 ", app_name = crate::get_app_name())
     } else {
         format!("
-sc create {app_name} binpath= \"\\\"{exe}\\\" --service\" start= auto DisplayName= \"{app_name} Service\"
-sc start {app_name}
+sc create \"{app_name}\" binpath= \"\\\"{exe}\\\" --service\" start= auto DisplayName= \"{app_name} Service\"
+sc start \"{app_name}\"
 ",
     app_name = crate::get_app_name())
     }
diff --git a/src/rendezvous_mediator.rs b/src/rendezvous_mediator.rs
index 4f5c8fee82d..8927581a7b7 100644
--- a/src/rendezvous_mediator.rs
+++ b/src/rendezvous_mediator.rs
@@ -151,6 +151,11 @@ impl RendezvousMediator {
         scrap::codec::test_av1();
         *LAST_NOT_DEPLOYED_REGISTER.lock().await = None;
         loop {
+            // DNS failure can prevent either transport's refresh timer from
+            // starting, including the fail-closed unconfigured endpoint after
+            // a long offline period. Consume newly signed policy on retries.
+            #[cfg(feature = "swan_custom")]
+            crate::managed::refresh_defaults();
             let timeout = Arc::new(RwLock::new(CONNECT_TIMEOUT));
             let conn_start_time = Instant::now();
             *SOLVING_PK_MISMATCH.lock().await = "".to_owned();
@@ -280,6 +285,8 @@ impl RendezvousMediator {
                     }
                 },
                 _ = timer.tick() => {
+                    #[cfg(feature = "swan_custom")]
+                    if crate::managed::refresh_defaults() {Self::restart();}
                     if SHOULD_EXIT.load(Ordering::SeqCst) {
                         break;
                     }
@@ -459,6 +466,8 @@ impl RendezvousMediator {
                     rz.handle_resp(msg.union, Sink::Stream(&mut conn), &server, &mut update_latency).await?
                 }
                 _ = timer.tick() => {
+                    #[cfg(feature = "swan_custom")]
+                    if crate::managed::refresh_defaults() {Self::restart();}
                     if SHOULD_EXIT.load(Ordering::SeqCst) {
                         break;
                     }
diff --git a/src/server/connection.rs b/src/server/connection.rs
index bdf9cba8b18..0141dd1ae35 100644
--- a/src/server/connection.rs
+++ b/src/server/connection.rs
@@ -316,6 +316,10 @@ pub struct Connection {
     port_forward_address: String,
     tx_to_cm: mpsc::UnboundedSender<ipc::Data>,
     authorized: bool,
+    #[cfg(feature = "swan_custom")]
+    managed_lease: Option<swan_agent::Lease>,
+    #[cfg(feature = "swan_custom")]
+    managed_pause_generation: u64,
     require_2fa: Option<totp_rs::TOTP>,
     keyboard: bool,
     clipboard: bool,
@@ -449,6 +453,17 @@ const SEND_TIMEOUT_OTHER: u64 = SEND_TIMEOUT_VIDEO * 10;
 const SESSION_TIMEOUT: Duration = Duration::from_secs(30);
 
 impl Connection {
+    #[cfg(feature = "swan_custom")]
+    fn managed_authorization_current(&self)->bool {
+        crate::managed::authorization_current(self.managed_lease.as_ref().map(|lease|lease.expires_at),self.managed_pause_generation)
+    }
+    #[cfg(feature = "swan_custom")]
+    fn managed_permission_cap(&self,name:&str)->bool {
+        if !self.managed_authorization_current(){return false;}
+        let Some(lease)=self.managed_lease.as_ref() else {return false};
+        let p=&lease.permissions;
+        match name {"keyboard"=>p.keyboard,"clipboard"=>p.clipboard,"audio"=>p.audio,"file"=>p.file,"restart"=>p.restart,"recording"=>p.recording,"block_input"=>p.block_input,"privacy_mode"=>p.privacy_mode,_=>false}
+    }
     pub async fn start(
         addr: SocketAddr,
         stream: super::Stream,
@@ -517,6 +532,10 @@ impl Connection {
             port_forward_address: "".to_owned(),
             tx_to_cm,
             authorized: false,
+            #[cfg(feature = "swan_custom")]
+            managed_lease: None,
+            #[cfg(feature = "swan_custom")]
+            managed_pause_generation: 0,
             keyboard: Self::permission(keys::OPTION_ENABLE_KEYBOARD, &control_permissions),
             clipboard: Self::permission(keys::OPTION_ENABLE_CLIPBOARD, &control_permissions),
             audio: Self::permission(keys::OPTION_ENABLE_AUDIO, &control_permissions),
@@ -709,6 +728,8 @@ impl Connection {
                             conn.chat_unanswered = false;
                         }
                         ipc::Data::SwitchPermission{name, enabled} => {
+                            #[cfg(feature = "swan_custom")]
+                            let enabled=enabled && conn.managed_permission_cap(&name);
                             log::info!("Change permission {} -> {}", name, enabled);
                             if &name == "keyboard" {
                                 conn.keyboard = enabled;
@@ -1065,6 +1086,18 @@ impl Connection {
                     }
                 }
                 _ = second_timer.tick() => {
+                    #[cfg(feature = "swan_custom")]
+                    if let Some(lease) = conn.managed_lease.as_mut() {
+                        let invalid = !crate::managed::authorization_current(Some(lease.expires_at),conn.managed_pause_generation);
+                        let renewal_failed = !invalid
+                            && swan_agent::protocol::now().saturating_sub(lease.last_renewed) >= 60
+                            && crate::managed::renew(lease,conn.managed_pause_generation).await.is_err();
+                        if invalid || renewal_failed {
+                            conn.send_close_reason_no_retry("Company session authorization expired or revoked").await;
+                            conn.on_close("Managed authorization unavailable", true).await;
+                            break;
+                        }
+                    }
                     #[cfg(windows)]
                     conn.portable_check();
                     raii::AuthedConnID::check_wake_lock_on_setting_changed();
@@ -1613,6 +1646,11 @@ impl Connection {
     // Returns whether this connection should be kept alive.
     // `true` does not necessarily mean authorization succeeded (e.g. REQUIRE_2FA case).
     async fn send_logon_response_and_keep_alive(&mut self) -> bool {
+        #[cfg(feature = "swan_custom")]
+        if !self.managed_authorization_current() {
+            self.send_login_error("A valid company session grant is required").await;
+            return false;
+        }
         if self.authorized {
             return true;
         }
@@ -2514,6 +2552,14 @@ impl Connection {
             }
         }
         if self.authorized {
+            #[cfg(feature = "swan_custom")]
+            if !self.managed_authorization_current() {
+                // Reject input immediately at expiry instead of relying on the
+                // next timer tick while packets continue to arrive.
+                self.send_close_reason_no_retry("Company session authorization expired or revoked").await;
+                self.on_close("Managed authorization unavailable", true).await;
+                return false;
+            }
             if matches!(msg.union.as_ref(), Some(message::Union::LoginRequest(_))) {
                 return true;
             }
@@ -2523,13 +2569,60 @@ impl Connection {
         }
         // After handling CloseReason messages, proceed to process other message types
         if let Some(message::Union::LoginRequest(lr)) = msg.union {
+            #[cfg(feature = "swan_custom")]
+            let mut lr=lr;
+            #[cfg(feature = "swan_custom")]
+            if self.managed_lease.is_none() {
+                match crate::managed::claim(&lr.password, &self.hash.challenge, &Config::get_id()).await {
+                    Ok((lease,generation)) => {
+                        self.managed_pause_generation=generation;
+                        let p=&lease.permissions;
+                        self.keyboard &= p.keyboard;self.clipboard &= p.clipboard;
+                        self.audio &= p.audio;self.file &= p.file;self.restart &= p.restart;
+                        self.recording &= p.recording;self.block_input &= p.block_input;
+                        self.privacy_mode &= p.privacy_mode;self.managed_lease=Some(lease);
+                        // Advertise the actual grant bounds before processing
+                        // login options or any subsequent privileged packets.
+                        for (permission,enabled) in [
+                            (Permission::Keyboard,self.keyboard),(Permission::Clipboard,self.clipboard),
+                            (Permission::Audio,self.audio),(Permission::File,self.file),
+                            (Permission::Restart,self.restart),(Permission::Recording,self.recording),
+                            (Permission::BlockInput,self.block_input),(Permission::PrivacyMode,self.privacy_mode),
+                        ] {self.send_permission(permission,enabled).await;}
+                    },
+                    Err(_) => {
+                        // Invalid wire credentials can fail before management is
+                        // contacted. Keep local evidence without logging the
+                        // supplied password, grant, or underlying error text.
+                        log::warn!("Connection {}: company session authorization denied", self.inner.id());
+                        self.send_login_error("Company session authorization denied").await;
+                        return false;
+                    }
+                }
+            }
+            #[cfg(feature = "swan_custom")]
+            if let Some(lease)=self.managed_lease.as_ref() {
+                // Approval prompts, connection manager and audit must name the
+                // company-authenticated account, never a peer-supplied label.
+                lr.my_name.clone_from(&lease.technician_name);
+            }
             self.handle_login_request_without_validation(&lr).await;
             if self.authorized {
                 return true;
             }
             self.reset_session_scope_for_login();
+            #[cfg(feature = "swan_custom")]
+            if matches!(lr.union.as_ref(), Some(login_request::Union::Terminal(_)) | Some(login_request::Union::PortForward(_)) | Some(login_request::Union::ViewCamera(_))) {
+                self.send_login_error("This company edition permits desktop support and file transfer only").await;
+                return false;
+            }
             match lr.union {
                 Some(login_request::Union::FileTransfer(ft)) => {
+                    #[cfg(feature = "swan_custom")]
+                    if !self.managed_permission_cap("file") {
+                        self.send_login_error("Company grant denies file transfer").await;
+                        return false;
+                    }
                     if !Self::permission(
                         keys::OPTION_ENABLE_FILE_TRANSFER,
                         &self.control_permissions,
@@ -2673,6 +2766,19 @@ impl Connection {
                 crate::get_builtin_option(keys::OPTION_ALLOW_LOGON_SCREEN_PASSWORD) == "Y"
                     && is_logon();
 
+            #[cfg(feature = "swan_custom")]
+            {
+                // Server-verified technician identity replaces all password/recent-session paths.
+                if self.managed_lease.as_ref().map(|lease| lease.unattended) == Some(true) {
+                    if !self.send_logon_response_and_keep_alive().await { return false; }
+                    self.try_start_cm(lr.my_id, lr.my_name, self.authorized);
+                } else {
+                    self.try_start_cm(lr.my_id, lr.my_name, false);
+                    self.send_login_error(crate::client::LOGIN_MSG_NO_PASSWORD_ACCESS).await;
+                }
+                return true;
+            }
+
             if (password::approve_mode() == ApproveMode::Click && !allow_logon_screen_password)
                 || password::approve_mode() == ApproveMode::Both && !password::has_valid_password()
             {
@@ -4781,6 +4887,17 @@ impl Connection {
     }
 
     async fn on_close(&mut self, reason: &str, lock: bool) {
+        #[cfg(feature = "swan_custom")]
+        if let Some(lease)=self.managed_lease.take() {
+            let grant_id=lease.grant_id.clone();drop(lease);
+            // Local stop does not wait for a management endpoint to respond.
+            tokio::spawn(async move {
+                match swan_agent::AgentState::load_for_refresh(&swan_agent::state_directory()) {
+                    Ok(state)=>if let Err(error)=state.close(&grant_id).await {log::warn!("Cannot report company session closure: {}",error);},
+                    Err(error)=>log::warn!("Cannot load company state for session closure: {}",error),
+                }
+            });
+        }
         if self.closed {
             return;
         }
@@ -5325,12 +5442,59 @@ impl Connection {
     }
 
     fn authorized_scope_violation(&self, msg: &Message) -> Option<&'static str> {
+        #[cfg(all(feature = "swan_custom", windows))]
+        let current_session_id = match msg.union.as_ref() {
+            Some(message::Union::Misc(misc))
+                if matches!(misc.union.as_ref(), Some(misc::Union::SelectedSid(_))) =>
+            {
+                crate::platform::get_current_process_session_id()
+            }
+            _ => None,
+        };
+        #[cfg(all(feature = "swan_custom", not(windows)))]
+        let current_session_id = None;
+        #[cfg(feature = "swan_custom")]
+        if let Some(violation) = Self::managed_control_scope_violation(
+            self.keyboard && self.managed_permission_cap("keyboard"),
+            current_session_id,
+            msg,
+        ) {
+            return Some(violation);
+        }
+        #[cfg(feature = "swan_custom")]
+        match msg.union.as_ref() {
+            Some(message::Union::AudioFrame(_)) | Some(message::Union::VoiceCallRequest(_)) | Some(message::Union::VoiceCallResponse(_)) if !self.managed_permission_cap("audio") => return Some("Company grant denies audio"),
+            Some(message::Union::FileAction(_)) | Some(message::Union::FileResponse(_)) if !self.managed_permission_cap("file") => return Some("Company grant denies file transfer"),
+            Some(message::Union::Cliprdr(_)) if !self.managed_permission_cap("file") || !self.managed_permission_cap("clipboard") => return Some("Company grant denies clipboard file transfer"),
+            _=>{}
+        }
         let Some(conn_type) = self.authed_conn_type() else {
             return (!Self::is_connection_housekeeping_message(msg)).then_some("session.auth_type");
         };
         Self::authorized_message_scope_violation(conn_type, msg)
     }
 
+    #[cfg(feature = "swan_custom")]
+    fn managed_control_scope_violation(
+        keyboard: bool,
+        current_session_id: Option<u32>,
+        msg: &Message,
+    ) -> Option<&'static str> {
+        if keyboard { return None; }
+        let Some(message::Union::Misc(misc)) = msg.union.as_ref() else { return None; };
+        match misc.union.as_ref() {
+            Some(misc::Union::ToggleVirtualDisplay(_))
+            | Some(misc::Union::ElevationRequest(_))
+            | Some(misc::Union::ChangeResolution(_))
+            | Some(misc::Union::ChangeDisplayResolution(_)) => Some("Company grant denies system control"),
+            // Acknowledging the current session starts monitor/camera subscriptions
+            // and delayed directory reads. Only switching sessions needs control.
+            Some(misc::Union::SelectedSid(sid)) if Some(*sid) != current_session_id =>
+                Some("Company grant denies system control"),
+            _ => None,
+        }
+    }
+
     async fn update_scoped_login_options(&mut self) {
         let Some(option) = self.options_in_login.take() else {
             return;
@@ -6740,6 +6904,46 @@ mod test {
         })
     }
 
+    #[cfg(feature = "swan_custom")]
+    #[test]
+    fn managed_view_only_packets_cannot_change_system_control() {
+        use hbb_common::protobuf::Message as ProtobufMessage;
+
+        let mut virtual_display_on = ToggleVirtualDisplay::new();
+        virtual_display_on.on = true;
+        let controls = [
+            misc_msg(|m| m.set_toggle_virtual_display(virtual_display_on)),
+            misc_msg(|m| m.set_toggle_virtual_display(ToggleVirtualDisplay::new())),
+            misc_msg(|m| m.set_elevation_request(ElevationRequest::new())),
+            misc_msg(|m| m.set_change_resolution(Resolution::new())),
+            misc_msg(|m| m.set_change_display_resolution(DisplayResolution::new())),
+            misc_msg(|m| m.set_selected_sid(2)),
+        ];
+        for packet in controls {
+            // Exercise the same parsed wire message used by the receiving guard.
+            let wire = packet.write_to_bytes().unwrap();
+            let received = Message::parse_from_bytes(&wire).unwrap();
+            assert_eq!(Connection::managed_control_scope_violation(false, Some(1), &received),
+                Some("Company grant denies system control"));
+            assert_eq!(Connection::managed_control_scope_violation(true, Some(1), &received), None);
+        }
+        let wire = misc_msg(|m| m.set_selected_sid(1)).write_to_bytes().unwrap();
+        let current_session = Message::parse_from_bytes(&wire).unwrap();
+        assert_eq!(Connection::managed_control_scope_violation(false, Some(1), &current_session), None);
+        // A failed OS lookup must not make an arbitrary requested session trusted.
+        assert_eq!(Connection::managed_control_scope_violation(false, None, &current_session),
+            Some("Company grant denies system control"));
+        // View-only support must still select and capture existing monitors.
+        for packet in [
+            misc_msg(|m| m.set_switch_display(SwitchDisplay::new())),
+            misc_msg(|m| m.set_capture_displays(CaptureDisplays::new())),
+            misc_msg(|m| m.set_refresh_video(true)),
+            misc_msg(|m| m.set_chat_message(ChatMessage::new())),
+        ] {
+            assert_eq!(Connection::managed_control_scope_violation(false, Some(1), &packet), None);
+        }
+    }
+
     fn set_supported_decoding(option: &mut OptionMessage) {
         option.supported_decoding = hbb_common::protobuf::MessageField::some(Default::default());
     }
diff --git a/src/server/portable_service.rs b/src/server/portable_service.rs
index 23b69a70c24..bc0c3b03fce 100644
--- a/src/server/portable_service.rs
+++ b/src/server/portable_service.rs
@@ -994,6 +994,11 @@ pub mod client {
     // 2) Start helper process (direct or logon) with shmem argument.
     // 3) Keep STARTING=true until IPC ping/pong marks RUNNING, or timeout watchdog resets it.
     pub(crate) fn start_portable_service(para: StartPara) -> ResultType<()> {
+        // A portable technician is outgoing-only even when run as administrator.
+        // Reject before display discovery, shared memory allocation or elevation.
+        if hbb_common::config::is_outgoing_only() {
+            bail!("Outgoing-only editions cannot start an incoming portable service");
+        }
         log::info!("start portable service");
         let launch_token = {
             // Keep lock guards in explicit short scopes to make it obvious
@@ -1181,7 +1186,43 @@ pub mod client {
     }
 
     pub fn set_quick_support(v: bool) {
-        *QUICK_SUPPORT.lock().unwrap() = v;
+        let enabled = v && !hbb_common::config::is_outgoing_only();
+        *QUICK_SUPPORT.lock().unwrap() = enabled;
+    }
+
+    #[cfg(test)]
+    mod edition_tests {
+        use super::*;
+
+        #[test]
+        fn outgoing_only_refuses_capture_helper_before_runtime_initialization() {
+            struct RestoreEdition(Option<String>, bool);
+            impl Drop for RestoreEdition {
+                fn drop(&mut self) {
+                    let mut settings = hbb_common::config::HARD_SETTINGS.write().unwrap();
+                    if let Some(value) = self.0.take() {
+                        settings.insert("conn-type".into(), value);
+                    } else {
+                        settings.remove("conn-type");
+                    }
+                    drop(settings);
+                    *QUICK_SUPPORT.lock().unwrap() = self.1;
+                }
+            }
+            let previous = hbb_common::config::HARD_SETTINGS.write().unwrap()
+                .insert("conn-type".into(), "outgoing".into());
+            let _restore = RestoreEdition(previous, *QUICK_SUPPORT.lock().unwrap());
+            let starting = *STARTING.lock().unwrap();
+            let had_memory = SHMEM.lock().unwrap().is_some();
+            set_quick_support(true);
+            assert!(!*QUICK_SUPPORT.lock().unwrap());
+            for mode in [StartPara::Direct, StartPara::Logon("unused".into(), "unused".into())] {
+                let error = start_portable_service(mode).unwrap_err();
+                assert_eq!(error.to_string(), "Outgoing-only editions cannot start an incoming portable service");
+                assert_eq!(*STARTING.lock().unwrap(), starting);
+                assert_eq!(SHMEM.lock().unwrap().is_some(), had_memory);
+            }
+        }
     }
 
     pub struct CapturerPortable {
diff --git a/src/tray.rs b/src/tray.rs
index bd2952cdff2..4120db1b5ba 100644
--- a/src/tray.rs
+++ b/src/tray.rs
@@ -8,6 +8,13 @@ use std::sync::{Arc, Mutex};
 #[cfg(windows)]
 use std::time::Duration;
 
+fn display_name() -> String {
+    #[cfg(feature = "swan_custom")]
+    { crate::managed::display_name() }
+    #[cfg(not(feature = "swan_custom"))]
+    { crate::get_app_name() }
+}
+
 pub fn start_tray() {
     if crate::ui_interface::get_builtin_option(hbb_common::config::keys::OPTION_HIDE_TRAY) == "Y" {
         #[cfg(not(target_os = "macos"))]
@@ -74,13 +81,13 @@ fn make_tray() -> hbb_common::ResultType<()> {
         if count == 0 {
             format!(
                 "{} {}",
-                crate::get_app_name(),
+                display_name(),
                 translate("Service is running".to_owned()),
             )
         } else {
             format!(
                 "{} - {}\n{}",
-                crate::get_app_name(),
+                display_name(),
                 translate("Ready".to_owned()),
                 translate("{".to_string() + &format!("{count}") + "} sessions"),
             )
@@ -238,6 +245,7 @@ fn make_tray() -> hbb_common::ResultType<()> {
 #[tokio::main(flavor = "current_thread")]
 async fn start_query_session_count(sender: std::sync::mpsc::Sender<Data>) {
     let mut last_count = 0;
+    let mut branding_refresh = std::time::Instant::now();
     loop {
         if let Ok(mut c) = crate::ipc::connect(1000, "").await {
             let mut timer = crate::rustdesk_interval(tokio::time::interval(Duration::from_secs(1)));
@@ -251,8 +259,9 @@ async fn start_query_session_count(sender: std::sync::mpsc::Sender<Data>) {
                             }
 
                             Ok(Some(Data::ControlledSessionCount(count))) => {
-                                if count != last_count {
+                                if count != last_count || branding_refresh.elapsed() >= Duration::from_secs(30) {
                                     last_count = count;
+                                    branding_refresh = std::time::Instant::now();
                                     sender.send(Data::ControlledSessionCount(count)).ok();
                                 }
                             }
diff --git a/src/ui_interface.rs b/src/ui_interface.rs
index 1a892784072..626de58c7d3 100644
--- a/src/ui_interface.rs
+++ b/src/ui_interface.rs
@@ -98,13 +98,20 @@ pub fn get_id() -> String {
 
 #[inline]
 pub fn goto_install() {
+    #[cfg(feature = "swan_custom")]
+    log::warn!("Managed installation requires the company bundle or approved update agent");
+    #[cfg(not(feature = "swan_custom"))]
+    {
     allow_err!(crate::run_me(vec!["--install"]));
     std::process::exit(0);
+    }
 }
 
 #[inline]
 pub fn install_me(_options: String, _path: String, _silent: bool, _debug: bool) {
-    #[cfg(windows)]
+    #[cfg(feature = "swan_custom")]
+    log::warn!("Managed installation requires the company bundle or approved update agent");
+    #[cfg(all(windows, not(feature = "swan_custom")))]
     std::thread::spawn(move || {
         allow_err!(crate::platform::windows::install_me(
             &_options, _path, _silent, _debug
@@ -430,7 +437,11 @@ pub fn set_option(key: String, value: String) {
         }
         #[cfg(any(target_os = "windows", target_os = "linux"))]
         {
-            if crate::platform::is_installed() {
+            // Managed Windows support pauses through the existing service IPC;
+            // stopping support must not uninstall it or require elevation.
+            if crate::platform::is_installed()
+                && !cfg!(all(target_os = "windows", feature = "swan_custom"))
+            {
                 if value == "Y" {
                     if crate::platform::uninstall_service(true, false) {
                         return;
diff --git a/src/ui_session_interface.rs b/src/ui_session_interface.rs
index bf2e04c6ba7..cf95f632411 100644
--- a/src/ui_session_interface.rs
+++ b/src/ui_session_interface.rs
@@ -1662,7 +1662,13 @@ impl<T: InvokeUiSession> Session<T> {
     }
 
     pub fn get_conn_token(&self) -> Option<String> {
-        self.lc.read().unwrap().get_conn_token()
+        #[cfg(feature = "swan_custom")]
+        {
+            let peer=self.lc.read().unwrap().get_id().to_owned();
+            crate::managed::subsession_handle(&self.password,&peer)
+        }
+        #[cfg(not(feature = "swan_custom"))]
+        {self.lc.read().unwrap().get_conn_token()}
     }
 
     pub fn printer_response(&self, id: i32, path: String, printer_name: String) {
diff --git a/src/updater.rs b/src/updater.rs
index 56fdc1d2a8c..a8b403a8199 100644
--- a/src/updater.rs
+++ b/src/updater.rs
@@ -22,6 +22,9 @@ lazy_static::lazy_static! {
 
 static CONTROLLING_SESSION_COUNT: AtomicUsize = AtomicUsize::new(0);
 
+#[cfg(test)]
+static LEGACY_WORKER_STARTS: AtomicUsize = AtomicUsize::new(0);
+
 const DUR_ONE_DAY: Duration = Duration::from_secs(60 * 60 * 24);
 
 pub fn update_controlling_session_count(count: usize) {
@@ -30,11 +33,19 @@ pub fn update_controlling_session_count(count: usize) {
 
 #[allow(dead_code)]
 pub fn start_auto_update() {
+    // Managed editions use signed, company-approved releases through swan-agent.
+    // Do not initialize the upstream worker, including through its stop path.
+    if cfg!(feature = "swan_custom") {
+        return;
+    }
     let _sender = TX_MSG.lock().unwrap();
 }
 
 #[allow(dead_code)]
 pub fn manually_check_update() -> ResultType<()> {
+    if cfg!(feature = "swan_custom") {
+        bail!("Managed editions require company-approved releases");
+    }
     let sender = TX_MSG.lock().unwrap();
     sender.send(UpdateMsg::CheckUpdate)?;
     Ok(())
@@ -42,6 +53,9 @@ pub fn manually_check_update() -> ResultType<()> {
 
 #[allow(dead_code)]
 pub fn stop_auto_update() {
+    if cfg!(feature = "swan_custom") {
+        return;
+    }
     let sender = TX_MSG.lock().unwrap();
     sender.send(UpdateMsg::Exit).unwrap_or_default();
 }
@@ -76,6 +90,8 @@ fn has_no_controlling_conns() -> bool {
 }
 
 fn start_auto_update_check() -> Sender<UpdateMsg> {
+    #[cfg(test)]
+    LEGACY_WORKER_STARTS.fetch_add(1, Ordering::SeqCst);
     let (tx, rx) = channel();
     std::thread::spawn(move || start_auto_update_check_(rx));
     return tx;
@@ -118,6 +134,10 @@ fn start_auto_update_check_(rx_msg: Receiver<UpdateMsg>) {
 }
 
 fn check_update(manually: bool) -> ResultType<()> {
+    // Keep the trust boundary even if another caller bypasses the public helpers.
+    if cfg!(feature = "swan_custom") {
+        bail!("Managed editions require company-approved releases");
+    }
     #[cfg(target_os = "windows")]
     let update_msi = crate::platform::is_msi_installed()? && !crate::is_custom_client();
     if !(manually || config::Config::get_bool_option(config::keys::OPTION_ALLOW_AUTO_UPDATE)) {
@@ -295,3 +315,28 @@ pub fn get_download_file_from_url(url: &str) -> Option<PathBuf> {
     let filename = url.split('/').last()?;
     Some(std::env::temp_dir().join(filename))
 }
+
+#[cfg(all(test, feature = "swan_custom"))]
+mod managed_update_tests {
+    use super::*;
+
+    #[test]
+    fn managed_edition_rejects_every_legacy_update_entry_point() {
+        let starts = LEGACY_WORKER_STARTS.load(Ordering::SeqCst);
+        start_auto_update();
+        stop_auto_update();
+        crate::common::check_software_update();
+        for result in [
+            manually_check_update(),
+            check_update(false),
+            check_update(true),
+            crate::common::do_check_software_update(),
+        ] {
+            assert!(result
+                .unwrap_err()
+                .to_string()
+                .contains("company-approved releases"));
+        }
+        assert_eq!(LEGACY_WORKER_STARTS.load(Ordering::SeqCst), starts);
+    }
+}