# Recovery 3001 0.4.0 Beta 1 Dev 10 R17

R17 turns the remaining commercial acceptance criteria into fail-closed,
versioned qualification tools. The recovery engine and USB-first guided flow
retain the R16 behavior and read-only source policy.

## What changed

- Adds a disposable physical-USB authorization marker. It records only a
  SHA-256 identity and refuses system/boot disks, non-USB buses, identity
  changes, missing labels, missing markers, and disks larger than 32 GiB.
- Adds a two-cycle FAT32/exFAT physical qualification runner for the public
  1,000-file, 41-format corpus. It independently copies and deletes the files,
  images the physical disk with Recovery 3001, and verifies every recovered
  file by byte length and SHA-256.
- Adds a five-participant usability study receipt. A pass requires at least
  four actually observed people to finish without assistance and satisfy
  every safety and comprehension criterion.
- Adds an actual-Windows-10-only installer, UI, and uninstall qualification.
  Windows 11, WSL, and compatibility labels cannot satisfy this gate.
- Parameterizes NSIS product and file versions so versioned releases use the
  same installer source.
- Adds a production release builder that signs the application first, packages
  that signed payload, signs the installer, requires RFC 3161 timestamps, and
  publishes no release EXE when any signing assertion fails.

## Safety

- The normal Recovery 3001 application still requests no write access to the
  source USB.
- Destructive QA requires a dedicated `REC3001_QA` volume, an exact physical
  disk number, an exact stable-identity SHA-256, a disk-specific authorization
  phrase, a matching marker, administrator rights, and the explicit
  `-ExecuteDestructiveTest` switch.
- The runner requires its image/recovery workspace to be on another physical
  disk or a network share with enough free space.
- The connected 61.5 GB SanDisk is outside the qualification capacity policy
  and is rejected before any format, copy, or delete operation.

## Verification in this development environment

- Current SanDisk destructive preflight: blocked before writes for four
  independent reasons (not elevated, over 32 GiB, no QA label, no marker).
- Public corpus input validation: 1,000/1,000 files, 41 formats, 1,000 unique
  SHA-256 hashes.
- Usability empty-study finalization: blocked at 0/5 with five explicit missing
  records; scripted developer evidence cannot pass.
- Windows 10 qualification on Windows 11 build 26200: blocked as not an actual
  Windows 10 target.
- Parameterized R16 installer reproduction: byte-for-byte SHA-256 identical to
  the published R16 installer.

## Remaining commercial gates

R17 provides the execution and evidence paths, but this development host
cannot honestly close the external gates. PASS still requires a separately
provisioned disposable USB of 32 GiB or less, an actual Windows 10 x64 target
at the required display setting, five observed participants, and a trusted
code-signing certificate with its private key. Until then the public build is
a development beta, not a signed commercial release.