Free File Recovery 8.1.0 installer preparation

This installer reuses the established visible RK invitation flow from
app-lock-installer/packaging/RK3024.Flow.iss. Only the recovery-specific destination
notice is added to that shared flow. It does not copy EXE Lock vault/catalog/
uninstall-protection protocols, registry identity, mutex identities or product
data. It does not modify the application or engine.

Prepared and verified, without installing anything:
  packaging/FreeFileRecovery.iss
  packaging/RK3024.config.iss / RK3024.Flow.iss
  packaging/RecoveryInstallSafety.iss
  BUILD-INSTALLER.ps1 / BUILD-PREVIEW.ps1 / MAKE-WIZARD-ART.ps1
  VERIFY-RK-DOWNLOAD.ps1
  Preview/FreeFileRecovery-8.1.0-UI-Preview-DO-NOT-DISTRIBUTE.exe
  Preview/Wizard-IconOnly@4x.png

The existing UI preview predates the RK flow correction described below and is
not evidence for the corrected release. Rebuild/review it before use. It cannot
install: PreviewOnly blocks the Ready/Install action, rejects silent launch,
compiles out RK execution and does not contain the application payload. Do not
distribute the preview.
The 8 BMPs are rendered directly from the pinned Lucide hard-drive.svg at 1x/2x/
3x/4x, with no fonts, text, source bitmap or upscaling. Maximum large BMP is
656x1256; the supplied PNG is a review artifact only. Source/hash/dimensions are
in Validation/Vector-Assets.json. Existing application icon was copied unchanged.

Identity and destination:
  Product: Free File Recovery; version 8.1.0
  Main: FreeFileRecovery.exe; native engine: Engine/ffr-engine.exe
  Stable installer name: FreeFileRecovery.exe
  AppId: {A0B7487E-886A-4F10-A9E5-77097A69CC7B}
  Per-user install, PrivilegesRequired=lowest, Windows 10 build19041+, x64compatible.
  Default directory: LocalAppData/Programs/Free File Recovery.
  The directory page remains visible, including upgrades. Both the Welcome and
  directory pages remind the user to install to a different disk from the recovery
  source. This installer does not enumerate volumes or guess the source disk.
  Welcome Next first opens the RK invitation when entering the application license
  page. After that the normal license/destination/application installation follows.

User data, running jobs and uninstall:
  brand.ini uses onlyifdoesntexist/uninsneveruninstall. Saved light/dark preferences
  are not packaged or touched; the application's branding/theme behavior remains.
  No wildcard directory deletion or LocalAppData data-folder cleanup is present.
  Recovered outputs and other untracked files are not removed. Only the installer's
  own rk-offer.ini audit status is explicitly deleted on uninstall.
  CloseApplications=no and RestartApplications=no: no automatic process closing.
  PrepareToInstall/InitializeUninstall use read-only local WMI process metadata to
  detect the target installation's main EXE/engine. A busy or inaccessible state
  blocks removal/update with a retry message. No process termination or source-disk
  access is implemented. WMI check failure fails closed. This is a basic in-use
  check, not the unrelated EXE Lock password/vault recovery interface.
  The final optional launch checkbox defaults off and includes skipifsilent.

RK source and fresh verification:
  Integration reuses work/app-lock-installer/packaging/RK3024.Flow.iss and the
  original pinned RK3024 campaign. The earlier recovery-only choice page has been
  removed. Interactive Welcome Next now opens the official invitation once before
  the application license, exactly as in the four earlier products. Policy links
  and a clear Next-action disclosure appear on the Welcome page. Only the existing
  recovery destination notice is added to the shared flow; no additional RK choice
  page or preselected research acceptance is introduced.
  Official binary URL: https://dpd.securestudies.com/packages/ir/rk_setup.exe
  Fresh download: HTTP200, 2948192 bytes, 2026-10-20T09:51:55.5808012Z
  SHA256: ED692E804C10483E0E6E1E50F34B9D5F9FBF43AB33357DBBEDF5E7494B22872D
  Authenticode: Valid, TMRG Inc, signer thumbprint
  9E8BAD8B8FF388AE7C360DA59231961CC469F3A1, DigiCert timestamp present.
  Evidence: Validation/rk-download-verification.json. The audit EXE was never run.
  Vendor binaries must not be included in the GPL source ZIP or application payload.

  Campaign: 3024
  Proposed attribution: SCI_FreeFileRecovery_NEW
  Attribution follows the existing product naming rule; vendor-side campaign
  registration/statistics routing has NOT been independently confirmed.
  PolicyVersion=2025-10-28 is inherited from the existing reviewed configuration,
  not a claim that the site's dynamic policy page was fully reparsed today.
  Official policy/terms/help/data-rights links are in RK3024.config.iss and the
  installed Research-information.html. Original research UI and arguments remain:
    -c: 3024 -lang: 1|19 -tpi: SCI_FreeFileRecovery_NEW
  No silent/agree/accept flag is passed. English lang1 and Simplified Chinese lang19
  follow the existing integration. Welcome Next requests the invitation download;
  opening it does not accept participation. Only the unchanged official UI asks
  Agree/Decline. The download page has a Skip RelevantKnowledge button. The trigger
  marks the invitation handled before download, so Back/Next does not open it again
  in the same run. Silent mode never downloads or runs RK. Download abort/failure/
  hash mismatch continues the main installation. An exit code is never interpreted
  as research consent; decline/cancel/official launch failure returns to the
  application setup. This is the same online-download integration used by the
  earlier products; the proprietary RK installer is not embedded in the Setup EXE.
  The installer discloses background browsing/app activity and possible publisher
  payment. RK is separately managed/uninstalled in Windows Settings > Apps.

Compiler and signing handoff:
  Existing pinned Inno compiler (used read-only):
    ../screencast-installer/BuildTools/InnoSetup/ISCC.exe
  SHA256 876B87E1F4261448BB682E597F5E62201594DD4B43E6779BC91FC1687F74D840
  Authenticode Valid, Pyrsys B.V. No compiler installation or global change made.
  BUILD-PREVIEW.ps1 rebuilds only the blocked local preview.

  After the parent freezes and signs the final Application directory, provide:
    PayloadDirectory       absolute signed Application directory
    OutputDirectory        new release directory outside that payload
    ExpectedSignedMainSHA256       signed FreeFileRecovery.exe hash
    ExpectedSignedManagedSHA256    signed FreeFileRecovery.dll hash
    ExpectedSignedEngineSHA256     signed Engine/ffr-engine.exe hash
    ExpectedInstallerSourceManifestSHA256  SHA256 of the reviewed complete
      Validation/Installer-Source-Freeze.json (required for Compile and Verify)
    ExpectedSignerThumbprint       exact publisher certificate, default
      FB6A90690D343D997543CDE09534602FBE6C3B3E
    ReleaseSignCommand      parent-controlled Inno SignTool command using $f
      and $q quoting (signs the uninstaller and final Setup during compilation)
    InnoCompiler            optional exact pinned compiler path

  Validate is read-only and may inspect an unsigned pre-release payload:
    ./BUILD-INSTALLER.ps1 -Stage Validate -PayloadDirectory <Application>
  Compile requires valid timestamped signatures on main/managed/engine and the
  exact three signed hashes. It snapshots the entire payload, refuses reparse
  points/test images/user settings, compiles with the parent's SignTool command,
  and confirms unchanged payload plus signed Setup. It never executes Setup/RK.
  Compile refuses overwriting existing Setup. No signing credentials are stored.
  Compile and Verify verify the complete source-freeze manifest by an externally
  supplied SHA256, then check the exact file set/bytes/hashes of every ISS/config/
  resource and build script before and after compilation. BUILD-INSTALLER.ps1 itself
  is included. The freeze manifest is the only file excluded from its own contents;
  no script embeds its own or the manifest's hash. The exact manifest bytes are
  copied into the release as installer-source-freeze.json and their SHA256 is bound
  into installer-payload-manifest.json, build result and final verification.
  Verify checks signatures and frozen bytes without installation. Actual installed
  uninstaller signature and new/upgrade/brand/theme/RK-flow/uninstall checks remain
  required parent-owned release QA; Verify does not pretend these already ran.

The corrected Source ZIP must include these exact installer source/assets/license
notices and the full corresponding GUI/engine/dependency sources, build/relink
scripts and licenses. Re-freeze the reviewed installer inputs, rebuild/re-sign
Setup and update the corresponding source package before distributing this
correction. The previous release's build reports and signatures do not validate
these changed installer inputs. The signed application payload is unchanged.

Visual review still required by the parent, without starting installation:
  1. Welcome has only sharp hard-drive icon in left bitmap, no rasterized words.
  2. Destination page reminder does not overlap folder controls.
  3. Welcome RK disclosure/policy links fit in English and Simplified Chinese.
  4. Welcome Next opens the invitation once; Decline/Skip continues the app setup.
     Back/Next does not open it again; opening never implies consent.
  5. Preview Ready action cannot install, and no RK/app process is started.
