GARRY USB RECOVERY AND COMPUTER SECURITY — 2026-09-23

WHAT IS READY
Windows: extract the whole kit, open windows/Run-Security-Check.cmd while in
Windows. The report is private to that computer; it now includes local account
names. No password is retrieved and no sign-in attempt is made. A policy check
does not prove that someone can or cannot bypass Windows. Read unavailable and
owner-check entries. The optional manual password checker is local and does
not verify a password against any account.

USB: this kit adds recovery choices and a Computer Security launcher to the
verified Space-based Garry USB. It does not rewrite the full operating system.
The currently published full ISO is still the earlier Space release.

BEFORE AN ASSISTED USB UPDATE
Return the USB to the home PC after shutting Garry down completely. Identify
the drive by model, size and volume. This kit never formats or repartitions.
Keep existing saved data and backups. Do not update a currently booted live USB.

MAINTAINER PROCEDURE (Python 3.10+)
1. Extract the entire kit. Keep BUILD.json and the squashfs beside install_update.py.
2. Run python install_update.py --media-root E:\
   Replace E:\ with the specifically verified USB root. This writes nothing.
3. Check the proposed paths and verified media identity. Apply only to that USB:
   python install_update.py --media-root E:\ --apply --confirm-root E:\
4. Save the receipt. Safely eject. Restart on the affected computer and verify.

The updater checks the base image, addon and existing menu hashes. It backs up
affected files, commits the addon and menu changes with their integrity entries,
and checks every write. It refuses unknown or changed media. If Rufus legitimately
changed a menu, investigate that exact difference; do not force a checksum match.
An interrupted update requires inspecting/restoring its backup before booting.

RECOVERY CHOICES
Normal and basic graphics keep persistence. Temporary and diagnostic no-save
sessions do not load saved USB changes and cannot save new work across shutdown.
They do not erase the existing saved data. Detailed boot messages retain normal
persistence. Keep the USB plugged in until shutdown, including copy-to-RAM mode.

LIMITS
Tested in isolated environments. The affected physical computer and USB still
need a real boot test. This does not repair failing flash memory or prove a PC
is unhackable. Computer Security inside Garry assesses that Linux session;
use the Windows checker in Windows for that computer's account configuration.
No private reports, credentials, personal account names or enrollment tokens
are included in this download. No scans or checks run automatically at boot.
