Upgrade desk + heart-encrypted backup

1. Correct free system (do not download the wrong ZIP)

Free School Golden Ticket only through the claim path:

Includes MATH1 · CALC1 · CEL1 · ES1 · FIN1 free. No checkout inside free carts.

2. Upgrade / checkout → website download (both free upgrades and paid upgrades)

Checkout does not scatter random files. It returns you to this site to download a versioned upgrade cartridge pack (SHA published). OCC retrofits load only through Admin after lab test.

• Free path upgrades: claim / free pack only
• Paid STEM path: upgrade pack after entitlement (payment still gated until GO)
• OCC retrofit: Admin installs lab-tested OneCharacterCode packs

3. Admin encrypted backup (device death recovery)

Export progress/settings and optional personal vault. Encryption is salted by Member Heart (ID + ZIP + user#) plus your passphrase — a found file does nothing without both.

4. Site smoke (known issues)

• OK: homepage, contact, school claim, holder, free carts, OCC site
• FIX staged: restore Free Golden Ticket v1.4 ZIP under downloads (if still 404)
• FIX/retire: /staging/free-shelf.html returns 403 — do not send users there