PrivacyProtect content. State the boundary.保护文件，也说清边界。
Local content processing, a separate licensing connection and recoverable encrypted data are distinct responsibilities.素材本地处理、独立授权联网与加密数据取回，是不同的责任边界。
Protected app boundary软件保护范围
Protected Windows content processes and their children run with restricted networking and paths. Materials, thumbnails, preview frames, segments and content caches must stay off the internal drive within the software-controlled boundary. The computer may remain online. No cloud AI, cloud synchronization or stock-media service is connected.受保护 Windows 素材进程及子进程限制网络和路径。在本软件可控边界内，素材、缩略图、预览帧、片段及含内容缓存不得写入本机内部盘。电脑可正常联网。不接云端 AI、云同步或素材服务。
Limits that remain仍然存在的边界
An already compromised computer, screen capture by another program and system-managed paging, hibernation or dumps are outside full portable-app control. External workspace caches may contain plaintext while unlocked. Abrupt termination can interrupt cleanup. No claim of absolute protection, zero traces under every condition or independent security certification is made.已被控制的电脑、其他程序截屏、系统分页、休眠与转储不在便携软件全面控制内。解锁时外接工作缓存可能含明文，异常终止可能中断清理。不宣称绝对保护、任何情况下无痕或已获独立安全认证。
Originals, keys and backups原件、密钥与备份
Imports create encrypted copies without changing outside originals or their attributes. Edited copies default to encrypted storage in the current vault. Plaintext outside export requires an explicit choice on the bound USB. Offline recovery needs the complete vault and retained recovery material; neither customer support nor the licence service can reconstruct deleted content. Safe-exit backup is a fixed latest encrypted copy, not unlimited history. Same-drive copies do not protect against losing the drive.导入创建加密副本，不修改库外原件及属性。编辑副本默认加密存当前库。库外明文导出须明确选择绑定外接盘位置。离线恢复需要完整库和保留的恢复材料；客服与授权服务不能重建已删除内容。安全退出备份是固定最新加密副本，不是无限历史。同盘副本不能防整盘丢失。
Licensing is separate授权系统独立
The independent module validates necessary licence metadata and a device digest at startup. Ordinary signed access lasts at most seven days offline. Website order, email, referral and advertising data do not enter content processes. A refund revokes related paid rights, not the vault password or stored files. A paid-licence-independent retrieval entry still requires your own valid vault password or recovery material and limits extraction to bound USB.独立模块启动时校验必要许可信息和设备摘要，普通签名授权最多离线七天。网站订单、邮箱、推广及广告资料不会进入素材进程。退款撤销对应付费权益，不改变库密码或文件。独立文件取回入口仍需要用户自己的有效库密码或恢复材料，提取限于绑定外接盘。
Public licensing, production trust/signing, service recovery and a formal long-term paid-use continuity plan remain release gates. The development owner certificate is not a customer fallback.公网授权、生产信任／签名、服务恢复及正式的长期付费使用持续方案仍是发行门槛。开发者内部证书不是客户停服替代方案。