
# Installation and Hermes handoff

## Owner preparation

1. Preserve the downloaded ZIP and checksum.
2. Extract into a private local folder that is not synchronized to an unapproved service.
3. Run the embedded verifier.
4. Give the entire folder to Hermes.
5. Review one combined Activation Card before any mutation.

## Controlled sequence

1. **S0 — Source and preflight:** hashes, environment, copy-on-write path, permissions, dependencies, licenses, network, recovery, and exact plan.
2. **S1 — Offline foundation:** authenticated loopback application, durable persistence, migrations, private profile, Core Four, data admission, recovery, and manual degraded mode.
3. **S2 — ROUNDS overlay:** 24 inactive powers, 24 preview workflows, 30 templates, ATTEND/CIRCLE/ORBIT, and tested overlay removal.
4. **S3 — Bounded AI:** real capability discovery, streaming and cancellation, consent memory, sources, P1/P2 one-run paths—or truthful Setup required.
5. **S4 — Verification:** reconcile 216 controls + 48 scenarios + 160 canonical checks.

A checkpoint is not completion. Keep each receipt and its rollback point.

## Recovery

- S1 is the rollback point for an overlay failure; S0 is the rollback point for a full-build failure.
- Back up the database, permitted attachments, configuration, migrations, manifest, and tombstones as one atomic set.
- Test restore into a separate path.
- ROUNDS-only removal preserves the foundation and unrelated data.
- Full uninstall removes only app-owned state and preserves an owner-approved export if requested.
