From 21f0184115fda650eec0afffddf68adee67cd4de Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sat, 2 May 2026 09:20:28 +0000
Subject: [PATCH] =?UTF-8?q?=D0=A1=D0=BE=D0=B3=D0=BB=D0=B0=D1=81=D0=BE?=
 =?UTF-8?q?=D0=B2=D0=B0=D1=82=D1=8C=20Windows=20=D0=BF=D1=83=D1=82=D0=B8?=
 =?UTF-8?q?=20=D1=81=20InnoSetup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ansible/README.md                             |  6 ++-
 ansible/deploy_aw_windows_phase2.yml          |  6 +--
 ansible/group_vars/windows.example.yml        |  6 +--
 docs/FULL_DEPLOYMENT_MANUAL_RU.md             | 36 +++++++++---------
 docs/windows/deployment.md                    | 38 +++++++++----------
 docs/windows/ensemble.md                      |  6 +--
 docs/windows/troubleshooting.md               |  6 +--
 docs/windows/validation.md                    | 24 ++++++------
 .../ansible/README.md                         |  6 ++-
 .../ansible/deploy_aw_windows_phase2.yml      |  6 +--
 .../ansible/group_vars/windows.example.yml    |  6 +--
 .../browser-domains-native-collector.ps1      |  8 ++--
 .../windows/deploy-domain-users.ps1           |  4 +-
 .../windows/deploy-ensemble.ps1               |  4 +-
 .../windows/deploy-single-user.ps1            |  4 +-
 .../dlp-endpoint-signals-collector.ps1        |  6 +--
 .../windows/hardening-recovery.ps1            |  6 +--
 .../windows/validate-deployment.ps1           |  2 +-
 .../windows/worktime-session-collector.ps1    |  2 +-
 windows/browser-domains-native-collector.ps1  |  8 ++--
 windows/deploy-domain-users.ps1               |  4 +-
 windows/deploy-ensemble.ps1                   |  4 +-
 windows/deploy-single-user.ps1                |  4 +-
 windows/dlp-endpoint-signals-collector.ps1    |  6 +--
 windows/hardening-recovery.ps1                |  6 +--
 .../innosetup-rdp-package-filelist.md         |  8 ++--
 windows/validate-deployment.ps1               |  2 +-
 windows/worktime-session-collector.ps1        |  2 +-
 28 files changed, 117 insertions(+), 109 deletions(-)

diff --git a/ansible/README.md b/ansible/README.md
index a8c77b6..1727108 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -92,7 +92,7 @@ ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml
 
 Playbook:
 
-- выгружает полный `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
+- выгружает полный `windows/*` toolkit на целевой хост в InnoSetup-compatible каталог `C:\Program Files\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
 - выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с phase-2 policy/rules;
 - после deploy принудительно запускает `ActivityWatch Recovery` и все `ActivityWatch Launch *` задачи;
 - выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие `not-afk` события;
@@ -106,6 +106,10 @@ Playbook:
 - `aw_windows_incident_capture_enabled: false` — отключить блок incidentCapture;
 - `aw_windows_incident_screenshot_enabled: false` — не делать скриншот при DLP-инциденте;
 - `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
+- `aw_windows_deploy_root: 'C:\Program Files\AWatch-rus'` — каталог toolkit, совпадает с InnoSetup `{app}`;
+- `aw_windows_install_root: 'C:\Program Files\ActivityWatch-Phase2'` — каталог бинарников, совпадает с InnoSetup `AwDefaultInstallRoot`;
+- `aw_windows_state_root: 'C:\ProgramData\ActivityWatch-Phase2'` — каталог состояния/отчётов, совпадает с InnoSetup `AwDefaultStateRoot`;
+- `aw_windows_validation_remote_path: '{{ aw_windows_state_root }}\aw_validate_phase2_ansible.json'` — отчёт Ansible-валидации хранится рядом с `ensemble-report-*.json`;
 - `aw_windows_package_version`, `aw_windows_package_url`, `aw_windows_package_zip_path` — версия и источник Windows-пакета ActivityWatch;
 - `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<COMPUTERNAME>`;
 - `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
diff --git a/ansible/deploy_aw_windows_phase2.yml b/ansible/deploy_aw_windows_phase2.yml
index 48fa3d8..38b33d8 100644
--- a/ansible/deploy_aw_windows_phase2.yml
+++ b/ansible/deploy_aw_windows_phase2.yml
@@ -5,7 +5,7 @@
 
   vars:
     aw_windows_repo_root: "{{ playbook_dir | dirname }}"
-    aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+    aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
     aw_windows_server_scheme: "http"
     aw_windows_server_host: "10.10.10.13"
     aw_windows_server_port: 5600
@@ -22,7 +22,7 @@
     aw_windows_extra_users: []
     aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
     aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
-    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch"
+    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
     aw_windows_afk_enabled: true
     aw_windows_window_enabled: true
     aw_windows_local_agent_logs_enabled: false
@@ -33,7 +33,7 @@
     aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
     aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
-    aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+    aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_phase2_ansible.json"
     aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
     aw_windows_launch_task_pattern: "ActivityWatch Launch *"
     aw_windows_recovery_task_name: "ActivityWatch Recovery"
diff --git a/ansible/group_vars/windows.example.yml b/ansible/group_vars/windows.example.yml
index 1255298..ecc4c88 100644
--- a/ansible/group_vars/windows.example.yml
+++ b/ansible/group_vars/windows.example.yml
@@ -1,5 +1,5 @@
 aw_windows_repo_root: "{{ playbook_dir | dirname }}"
-aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
 aw_windows_server_scheme: "http"
 aw_windows_server_host: "10.10.10.13"
 aw_windows_server_port: 5600
@@ -20,7 +20,7 @@ aw_windows_extra_users: []
 
 # Рекомендуемый изолированный профиль для фазового раската.
 aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
-aw_windows_state_root: "C:\\ProgramData\\ActivityWatch"
+aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_local_agent_logs_enabled: false
@@ -33,7 +33,7 @@ aw_windows_skip_hardening: false
 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
 aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
 
-aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_phase2_ansible.json"
 aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
 aw_windows_fail_on_validation_error: true
 
diff --git a/docs/FULL_DEPLOYMENT_MANUAL_RU.md b/docs/FULL_DEPLOYMENT_MANUAL_RU.md
index 62224ec..164a151 100755
--- a/docs/FULL_DEPLOYMENT_MANUAL_RU.md
+++ b/docs/FULL_DEPLOYMENT_MANUAL_RU.md
@@ -177,7 +177,7 @@ grep -n 'aw-ru-patch\|aw-sw-cleanup' /opt/activitywatch/webui-ru/index.html
 
 например в:
 
-- `C:\Deploy\ActivityWatch-Russian\windows`
+- `C:\Program Files\AWatch-rus\windows`
 
 Откройте **elevated PowerShell**:
 
@@ -190,12 +190,12 @@ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
 Пример со списком пользователей:
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\deploy-domain-users.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-domain-users.ps1 `
   -ServerHost aw.example.local `
   -ServerPort 5600 `
   -Domain CONTOSO `
   -UserListPath C:\Deploy\aw-users.txt `
-  -CustomRulesPath C:\Deploy\ActivityWatch-Russian\windows\web-category-rules.example.json
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json
 ```
 
 Поддерживаемые варианты:
@@ -207,7 +207,7 @@ C:\Deploy\ActivityWatch-Russian\windows\deploy-domain-users.ps1 `
 ### 3.2.1 Ensemble orchestration (рекомендуется для production)
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\deploy-ensemble.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-ensemble.ps1 `
   -ServerHost aw.example.local `
   -ServerPort 5600 `
   -Domain CONTOSO `
@@ -217,30 +217,30 @@ C:\Deploy\ActivityWatch-Russian\windows\deploy-ensemble.ps1 `
 
 Отчёт сохраняется в:
 
-- `C:\ProgramData\ActivityWatch\ensemble-report-YYYYMMDD-HHMMSS.json`
+- `C:\ProgramData\ActivityWatch-Phase2\ensemble-report-YYYYMMDD-HHMMSS.json`
 
 ### 3.3 Single-user развёртывание
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\deploy-single-user.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-single-user.ps1 `
   -ServerHost aw.example.local `
   -ServerPort 5600 `
   -TargetUser 'CONTOSO\user01' `
-  -CustomRulesPath C:\Deploy\ActivityWatch-Russian\windows\web-category-rules.example.json
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json
 ```
 
 ### 3.4 Recovery / hardening
 
 ```powershell
-C:\Deploy\ActivityWatch-Russian\windows\hardening-recovery.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json
+C:\Program Files\AWatch-rus\windows\hardening-recovery.ps1 `
+  -ConfigPath C:\ProgramData\ActivityWatch-Phase2\deployment-config.json
 ```
 
 ### 3.5 Валидация deployment-а (PowerShell report)
 
 ```powershell
-$report = C:\Deploy\ActivityWatch-Russian\windows\validate-deployment.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json
+$report = C:\Program Files\AWatch-rus\windows\validate-deployment.ps1 `
+  -ConfigPath C:\ProgramData\ActivityWatch-Phase2\deployment-config.json
 $report | ConvertTo-Json -Depth 12
 ```
 
@@ -248,13 +248,13 @@ $report | ConvertTo-Json -Depth 12
 
 ## 4) Что должно появиться на Windows после установки
 
-- `C:\Program Files\ActivityWatch`
-- `C:\ProgramData\ActivityWatch\deployment-config.json`
-- `C:\ProgramData\ActivityWatch\launch-watchers.ps1`
-- `C:\ProgramData\ActivityWatch\recovery-loop.ps1`
-- `C:\ProgramData\ActivityWatch\browser-domains-native-collector.ps1`
-- `C:\ProgramData\ActivityWatch\web-category-rules.json`
-- `C:\ProgramData\ActivityWatch\logs\`
+- `C:\Program Files\ActivityWatch-Phase2`
+- `C:\ProgramData\ActivityWatch-Phase2\deployment-config.json`
+- `C:\ProgramData\ActivityWatch-Phase2\launch-watchers.ps1`
+- `C:\ProgramData\ActivityWatch-Phase2\recovery-loop.ps1`
+- `C:\ProgramData\ActivityWatch-Phase2\browser-domains-native-collector.ps1`
+- `C:\ProgramData\ActivityWatch-Phase2\web-category-rules.json`
+- `C:\ProgramData\ActivityWatch-Phase2\logs\`
 
 Задачи планировщика:
 
diff --git a/docs/windows/deployment.md b/docs/windows/deployment.md
index aa6686f..fc82f21 100755
--- a/docs/windows/deployment.md
+++ b/docs/windows/deployment.md
@@ -15,14 +15,14 @@
 ## Что делает пакет
 
 - Ставит `aw-watcher-afk` и `aw-watcher-window` из официального Windows ZIP ActivityWatch.
-- Копирует browser-domain collector в `C:\ProgramData\ActivityWatch`.
-- Копирует DLP policy в `C:\ProgramData\ActivityWatch\dlp-policy.json`.
+- Копирует browser-domain collector в `C:\ProgramData\ActivityWatch-Phase2`.
+- Копирует DLP policy в `C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json`.
 - Включает `incidentCapture` в `deployment-config.json` для DLP-инцидентов:
   - `incidentCapture.screenshotEnabled = true`
   - `incidentCapture.artifactsRoot = <StateRoot>\incident-artifacts`
 - Создаёт per-user задачи `ActivityWatch Launch [...]` с запуском при логоне.
 - Создаёт системную задачу `ActivityWatch Recovery`, которая циклически перезапускает per-user launch tasks.
-- Применяет ACL к `C:\Program Files\ActivityWatch`, `C:\ProgramData\ActivityWatch` и каталогу логов.
+- Применяет ACL к `C:\Program Files\ActivityWatch-Phase2`, `C:\ProgramData\ActivityWatch-Phase2` и каталогу логов.
 - Не содержит хардкодов инфраструктуры: сервер, домен, список пользователей и правила передаются параметрами.
 - Корректно регистрирует задачи через `-LogonType Interactive` (совместимо с Windows Server, где `InteractiveToken` не поддерживается).
 - Поддерживает отключение шумных watcher'ов через `-AfkEnabled:$false` и `-WindowEnabled:$false`.
@@ -155,8 +155,8 @@ CSV-формат: колонка `User`, `Username`, `SamAccountName` или `Lo
   -Users user2,user3,user4,user5 `
   -InstallRoot 'C:\Program Files\ActivityWatch-Phase2-u2u5' `
   -StateRoot 'C:\ProgramData\ActivityWatch-Phase2-u2u5' `
-  -CustomRulesPath C:\Deploy\AWatch-rus\windows\web-category-rules.example.json `
-  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json `
+  -CustomPolicyPath C:\Program Files\AWatch-rus\windows\dlp-policy.example.json
 ```
 
 Single-user pilot в таком же стиле:
@@ -168,8 +168,8 @@ Single-user pilot в таком же стиле:
   -TargetUser 'SHARKON2025\user1' `
   -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' `
   -StateRoot 'C:\ProgramData\ActivityWatch-Phase2-user1' `
-  -CustomRulesPath C:\Deploy\AWatch-rus\windows\web-category-rules.example.json `
-  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json
+  -CustomRulesPath C:\Program Files\AWatch-rus\windows\web-category-rules.example.json `
+  -CustomPolicyPath C:\Program Files\AWatch-rus\windows\dlp-policy.example.json
 ```
 
 ## Ensemble deploy (production workflow)
@@ -186,31 +186,31 @@ Single-user pilot в таком же стиле:
 
 Итоговый отчёт:
 
-- `C:\ProgramData\ActivityWatch\ensemble-report-YYYYMMDD-HHMMSS.json`
+- `C:\ProgramData\ActivityWatch-Phase2\ensemble-report-YYYYMMDD-HHMMSS.json`
 
 ## Категоризация доменов
 
 - Встроенные категории покрывают базовые рабочие, нейтральные и личные домены.
 - Для кастомизации скопируйте `windows/web-category-rules.example.json` и отредактируйте домены.
-- Передайте файл через `-CustomRulesPath`; он будет сохранён как `C:\ProgramData\ActivityWatch\web-category-rules.json`.
+- Передайте файл через `-CustomRulesPath`; он будет сохранён как `C:\ProgramData\ActivityWatch-Phase2\web-category-rules.json`.
 - Пользовательские правила имеют приоритет над встроенными.
 
 ## Структура после установки
 
-- `C:\Program Files\ActivityWatch` — бинарники watcher'ов.
-- `C:\ProgramData\ActivityWatch\deployment-config.json` — итоговая конфигурация.
-- `C:\ProgramData\ActivityWatch\incident-artifacts\` — скриншоты DLP-инцидентов (если `incidentCapture.screenshotEnabled=true`).
-- `C:\ProgramData\ActivityWatch\launch-watchers.ps1` — per-user launcher.
-- `C:\ProgramData\ActivityWatch\recovery-loop.ps1` — system recovery loop.
-- `C:\ProgramData\ActivityWatch\browser-domains-native-collector.ps1` — runtime collector.
-- `C:\ProgramData\ActivityWatch\dlp-endpoint-signals-collector.ps1` — runtime endpoint collector.
-- `C:\ProgramData\ActivityWatch\dlp-policy.json` — активная DLP-политика.
-- `C:\ProgramData\ActivityWatch\logs\` — логи collector'а.
+- `C:\Program Files\ActivityWatch-Phase2` — бинарники watcher'ов.
+- `C:\ProgramData\ActivityWatch-Phase2\deployment-config.json` — итоговая конфигурация.
+- `C:\ProgramData\ActivityWatch-Phase2\incident-artifacts\` — скриншоты DLP-инцидентов (если `incidentCapture.screenshotEnabled=true`).
+- `C:\ProgramData\ActivityWatch-Phase2\launch-watchers.ps1` — per-user launcher.
+- `C:\ProgramData\ActivityWatch-Phase2\recovery-loop.ps1` — system recovery loop.
+- `C:\ProgramData\ActivityWatch-Phase2\browser-domains-native-collector.ps1` — runtime collector.
+- `C:\ProgramData\ActivityWatch-Phase2\dlp-endpoint-signals-collector.ps1` — runtime endpoint collector.
+- `C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json` — активная DLP-политика.
+- `C:\ProgramData\ActivityWatch-Phase2\logs\` — логи collector'а.
 
 Для phased rollout те же файлы формируются в каталоге `StateRoot`, переданном параметром.
 
 ## Повторный прогон
 
 - Скрипты идемпотентны: переустанавливают задачи и обновляют runtime-файлы.
-- Предыдущая установка ActivityWatch бэкапится в `C:\ProgramData\ActivityWatch\backups\install-YYYYMMDD-HHMMSS`.
+- Предыдущая установка ActivityWatch бэкапится в `C:\ProgramData\ActivityWatch-Phase2\backups\install-YYYYMMDD-HHMMSS`.
 - Для жёсткого восстановления запускайте `windows/hardening-recovery.ps1`.
diff --git a/docs/windows/ensemble.md b/docs/windows/ensemble.md
index d0f5ccb..55aea1e 100644
--- a/docs/windows/ensemble.md
+++ b/docs/windows/ensemble.md
@@ -17,7 +17,7 @@
 ```powershell
 Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
 
-C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 `
+C:\Program Files\AWatch-rus\windows\deploy-ensemble.ps1 `
   -ServerHost 10.10.10.13 `
   -ServerPort 5600 `
   -Domain SHARKON2025 `
@@ -25,7 +25,7 @@ C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 `
   -InstallRoot 'C:\Program Files\ActivityWatch-Phase2' `
   -StateRoot 'C:\ProgramData\ActivityWatch-Phase2' `
   -AfkEnabled:$false `
-  -CustomPolicyPath C:\Deploy\AWatch-rus\windows\dlp-policy.example.json `
+  -CustomPolicyPath C:\Program Files\AWatch-rus\windows\dlp-policy.example.json `
   -ValidateAfterDeploy
 ```
 
@@ -42,7 +42,7 @@ C:\Deploy\AWatch-rus\windows\deploy-ensemble.ps1 `
 ## Быстрый health-check
 
 ```powershell
-$report = C:\Deploy\AWatch-rus\windows\validate-deployment.ps1 `
+$report = C:\Program Files\AWatch-rus\windows\validate-deployment.ps1 `
   -ConfigPath C:\ProgramData\ActivityWatch-Phase2\deployment-config.json
 $report | ConvertTo-Json -Depth 12
 ```
diff --git a/docs/windows/troubleshooting.md b/docs/windows/troubleshooting.md
index 6e0c631..1378b6e 100755
--- a/docs/windows/troubleshooting.md
+++ b/docs/windows/troubleshooting.md
@@ -23,7 +23,7 @@ Start-ScheduledTask -TaskName 'ActivityWatch Launch [CONTOSO_user01]'
 
 - Скрипт работает через UI Automation и foreground window.
 - Некоторые браузеры/страницы могут скрывать адресную строку или блокировать UIA.
-- Проверьте лог `C:\ProgramData\ActivityWatch\logs\browser-domains-<user>.log`.
+- Проверьте лог `C:\ProgramData\ActivityWatch-Phase2\logs\browser-domains-<user>.log`.
 - Убедитесь, что активное окно — поддерживаемый браузер: Edge, Chrome, Brave, Vivaldi, Opera, Firefox.
 
 ### Сервер недоступен
@@ -44,7 +44,7 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/info
 
 ### Неправильная категоризация домена
 
-- Проверьте содержимое `C:\ProgramData\ActivityWatch\web-category-rules.json`.
+- Проверьте содержимое `C:\ProgramData\ActivityWatch-Phase2\web-category-rules.json`.
 - Пользовательские правила должны быть валидным JSON.
 - Один и тот же домен лучше определять только в одной категории.
 - После изменения правил достаточно перезапустить collector или задачу пользователя:
@@ -112,7 +112,7 @@ Get-CimInstance Win32_Process |
 Проверить конфиг:
 
 ```powershell
-Get-Content C:\ProgramData\ActivityWatch\deployment-config.json -Raw
+Get-Content C:\ProgramData\ActivityWatch-Phase2\deployment-config.json -Raw
 ```
 
 ## Когда запускать hardening/recovery
diff --git a/docs/windows/validation.md b/docs/windows/validation.md
index 068948e..03e7398 100755
--- a/docs/windows/validation.md
+++ b/docs/windows/validation.md
@@ -4,7 +4,7 @@
 
 ```powershell
 $report = .\windows\validate-deployment.ps1 `
-  -ConfigPath C:\ProgramData\ActivityWatch\deployment-config.json
+  -ConfigPath C:\ProgramData\ActivityWatch-Phase2\deployment-config.json
 $report | ConvertTo-Json -Depth 12
 ```
 
@@ -19,11 +19,11 @@ $report | ConvertTo-Json -Depth 12
 ### 1. Проверить установленные файлы
 
 ```powershell
-Test-Path 'C:\Program Files\ActivityWatch\aw-watcher-afk\aw-watcher-afk.exe'
-Test-Path 'C:\Program Files\ActivityWatch\aw-watcher-window\aw-watcher-window.exe'
-Test-Path 'C:\ProgramData\ActivityWatch\browser-domains-native-collector.ps1'
-Test-Path 'C:\ProgramData\ActivityWatch\dlp-policy.json'
-Test-Path 'C:\ProgramData\ActivityWatch\deployment-config.json'
+Test-Path 'C:\Program Files\ActivityWatch-Phase2\aw-watcher-afk\aw-watcher-afk.exe'
+Test-Path 'C:\Program Files\ActivityWatch-Phase2\aw-watcher-window\aw-watcher-window.exe'
+Test-Path 'C:\ProgramData\ActivityWatch-Phase2\browser-domains-native-collector.ps1'
+Test-Path 'C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json'
+Test-Path 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json'
 ```
 
 Ожидаемый результат — везде `True`.
@@ -50,7 +50,7 @@ Get-ScheduledTask | Where-Object TaskName -eq 'ActivityWatch Recovery'
 ### 2.1 Проверить incidentCapture в конфиге
 
 ```powershell
-$cfg = Get-Content 'C:\ProgramData\ActivityWatch\deployment-config.json' -Raw | ConvertFrom-Json
+$cfg = Get-Content 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json' -Raw | ConvertFrom-Json
 $cfg.incidentCapture
 ```
 
@@ -119,7 +119,7 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/buckets | Select-Object -Ex
 4. Проверьте локальный лог:
 
 ```powershell
-Get-Content "C:\ProgramData\ActivityWatch\logs\dlp-incidents-$env:USERNAME.log" -Tail 50
+Get-Content "C:\ProgramData\ActivityWatch-Phase2\logs\dlp-incidents-$env:USERNAME.log" -Tail 50
 ```
 
 Если `screenshotEnabled = True`, проверьте наличие скриншота в инциденте:
@@ -188,7 +188,7 @@ Invoke-WebRequest http://aw.example.local:5600/api/0/buckets/aw-dlp-endpoint-sig
 4. Проверьте локальный лог:
 
 ```powershell
-Get-Content "C:\ProgramData\ActivityWatch\logs\endpoint-signals-$env:USERNAME.log" -Tail 50
+Get-Content "C:\ProgramData\ActivityWatch-Phase2\logs\endpoint-signals-$env:USERNAME.log" -Tail 50
 ```
 
 ## Проверка восстановления
@@ -206,9 +206,9 @@ Start-ScheduledTask -TaskName 'ActivityWatch Recovery'
 ## Проверка ACL
 
 ```powershell
-icacls 'C:\Program Files\ActivityWatch'
-icacls 'C:\ProgramData\ActivityWatch'
-icacls 'C:\ProgramData\ActivityWatch\logs'
+icacls 'C:\Program Files\ActivityWatch-Phase2'
+icacls 'C:\ProgramData\ActivityWatch-Phase2'
+icacls 'C:\ProgramData\ActivityWatch-Phase2\logs'
 ```
 
 Ожидаемо:
diff --git a/install-kit-awindows-20260427-211240/ansible/README.md b/install-kit-awindows-20260427-211240/ansible/README.md
index a8c77b6..1727108 100644
--- a/install-kit-awindows-20260427-211240/ansible/README.md
+++ b/install-kit-awindows-20260427-211240/ansible/README.md
@@ -92,7 +92,7 @@ ansible-playbook -i inventory.ini deploy_aw_windows_phase2.yml
 
 Playbook:
 
-- выгружает полный `windows/*` toolkit на целевой хост в `C:\Deploy\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
+- выгружает полный `windows/*` toolkit на целевой хост в InnoSetup-compatible каталог `C:\Program Files\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
 - выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с phase-2 policy/rules;
 - после deploy принудительно запускает `ActivityWatch Recovery` и все `ActivityWatch Launch *` задачи;
 - выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие `not-afk` события;
@@ -106,6 +106,10 @@ Playbook:
 - `aw_windows_incident_capture_enabled: false` — отключить блок incidentCapture;
 - `aw_windows_incident_screenshot_enabled: false` — не делать скриншот при DLP-инциденте;
 - `aw_windows_incident_artifacts_root: 'C:\...\incident-artifacts'` — переопределить путь артефактов;
+- `aw_windows_deploy_root: 'C:\Program Files\AWatch-rus'` — каталог toolkit, совпадает с InnoSetup `{app}`;
+- `aw_windows_install_root: 'C:\Program Files\ActivityWatch-Phase2'` — каталог бинарников, совпадает с InnoSetup `AwDefaultInstallRoot`;
+- `aw_windows_state_root: 'C:\ProgramData\ActivityWatch-Phase2'` — каталог состояния/отчётов, совпадает с InnoSetup `AwDefaultStateRoot`;
+- `aw_windows_validation_remote_path: '{{ aw_windows_state_root }}\aw_validate_phase2_ansible.json'` — отчёт Ansible-валидации хранится рядом с `ensemble-report-*.json`;
 - `aw_windows_package_version`, `aw_windows_package_url`, `aw_windows_package_zip_path` — версия и источник Windows-пакета ActivityWatch;
 - `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<COMPUTERNAME>`;
 - `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
diff --git a/install-kit-awindows-20260427-211240/ansible/deploy_aw_windows_phase2.yml b/install-kit-awindows-20260427-211240/ansible/deploy_aw_windows_phase2.yml
index 48fa3d8..38b33d8 100644
--- a/install-kit-awindows-20260427-211240/ansible/deploy_aw_windows_phase2.yml
+++ b/install-kit-awindows-20260427-211240/ansible/deploy_aw_windows_phase2.yml
@@ -5,7 +5,7 @@
 
   vars:
     aw_windows_repo_root: "{{ playbook_dir | dirname }}"
-    aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+    aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
     aw_windows_server_scheme: "http"
     aw_windows_server_host: "10.10.10.13"
     aw_windows_server_port: 5600
@@ -22,7 +22,7 @@
     aw_windows_extra_users: []
     aw_windows_users_effective: "{{ (aw_windows_users + aw_windows_extra_users) | unique }}"
     aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
-    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch"
+    aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
     aw_windows_afk_enabled: true
     aw_windows_window_enabled: true
     aw_windows_local_agent_logs_enabled: false
@@ -33,7 +33,7 @@
     aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
     aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
-    aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+    aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_phase2_ansible.json"
     aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
     aw_windows_launch_task_pattern: "ActivityWatch Launch *"
     aw_windows_recovery_task_name: "ActivityWatch Recovery"
diff --git a/install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml b/install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml
index 1255298..ecc4c88 100644
--- a/install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml
+++ b/install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml
@@ -1,5 +1,5 @@
 aw_windows_repo_root: "{{ playbook_dir | dirname }}"
-aw_windows_deploy_root: "C:\\Deploy\\AWatch-rus"
+aw_windows_deploy_root: "C:\\Program Files\\AWatch-rus"
 aw_windows_server_scheme: "http"
 aw_windows_server_host: "10.10.10.13"
 aw_windows_server_port: 5600
@@ -20,7 +20,7 @@ aw_windows_extra_users: []
 
 # Рекомендуемый изолированный профиль для фазового раската.
 aw_windows_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
-aw_windows_state_root: "C:\\ProgramData\\ActivityWatch"
+aw_windows_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_local_agent_logs_enabled: false
@@ -33,7 +33,7 @@ aw_windows_skip_hardening: false
 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
 aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
 
-aw_windows_validation_remote_path: "C:\\Windows\\Temp\\aw_validate_phase2_ansible.json"
+aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_phase2_ansible.json"
 aw_windows_validation_local_dir: "/tmp/aw-rus-validation"
 aw_windows_fail_on_validation_error: true
 
diff --git a/install-kit-awindows-20260427-211240/windows/browser-domains-native-collector.ps1 b/install-kit-awindows-20260427-211240/windows/browser-domains-native-collector.ps1
index e04f332..28de28e 100755
--- a/install-kit-awindows-20260427-211240/windows/browser-domains-native-collector.ps1
+++ b/install-kit-awindows-20260427-211240/windows/browser-domains-native-collector.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -52,11 +52,11 @@ $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
 $resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
 $resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
 $resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
-$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\ActivityWatch\web-category-rules.json' }
-$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
+$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\ActivityWatch-Phase2\web-category-rules.json' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json' }
 $resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
 $resolvedPulseSeconds = if ($PSBoundParameters.ContainsKey('PulseSeconds')) { $PulseSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pulseSeconds } else { 30 }
-$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch\logs' }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch-Phase2\logs' }
 $resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("browser-domains-{0}.log" -f $env:USERNAME) }
 $resolvedIncidentLogPath = if ($IncidentLogPath) { $IncidentLogPath } else { Join-Path $resolvedLogsRoot ("dlp-incidents-{0}.log" -f $env:USERNAME) }
 $resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
diff --git a/install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1 b/install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1
index 676fdb9..d441de1 100755
--- a/install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1
+++ b/install-kit-awindows-20260427-211240/windows/deploy-domain-users.ps1
@@ -11,8 +11,8 @@ param(
     [string]$Version = 'v0.13.2',
     [string]$PackageUrl,
     [string]$PackageZipPath,
-    [string]$InstallRoot = 'C:\Program Files\ActivityWatch',
-    [string]$StateRoot = 'C:\ProgramData\ActivityWatch',
+    [string]$InstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$StateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
diff --git a/install-kit-awindows-20260427-211240/windows/deploy-ensemble.ps1 b/install-kit-awindows-20260427-211240/windows/deploy-ensemble.ps1
index 58d514b..45fab28 100644
--- a/install-kit-awindows-20260427-211240/windows/deploy-ensemble.ps1
+++ b/install-kit-awindows-20260427-211240/windows/deploy-ensemble.ps1
@@ -11,8 +11,8 @@ param(
     [string]$Version = 'v0.13.2',
     [string]$PackageUrl,
     [string]$PackageZipPath,
-    [string]$InstallRoot = 'C:\Program Files\ActivityWatch',
-    [string]$StateRoot = 'C:\ProgramData\ActivityWatch',
+    [string]$InstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$StateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
diff --git a/install-kit-awindows-20260427-211240/windows/deploy-single-user.ps1 b/install-kit-awindows-20260427-211240/windows/deploy-single-user.ps1
index 0efd871..d49be48 100755
--- a/install-kit-awindows-20260427-211240/windows/deploy-single-user.ps1
+++ b/install-kit-awindows-20260427-211240/windows/deploy-single-user.ps1
@@ -10,8 +10,8 @@ param(
     [string]$Version = 'v0.13.2',
     [string]$PackageUrl,
     [string]$PackageZipPath,
-    [string]$InstallRoot = 'C:\Program Files\ActivityWatch',
-    [string]$StateRoot = 'C:\ProgramData\ActivityWatch',
+    [string]$InstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$StateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
diff --git a/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1 b/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
index 06d7f21..7c60664 100644
--- a/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
+++ b/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -713,9 +713,9 @@ $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
 $resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
 $resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
 $resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
-$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json' }
 $resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
-$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch\logs' }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch-Phase2\logs' }
 $resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("endpoint-signals-{0}.log" -f $env:USERNAME) }
 $resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
 $resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'ActivityWatch-Phase2\\incident-artifacts' }
diff --git a/install-kit-awindows-20260427-211240/windows/hardening-recovery.ps1 b/install-kit-awindows-20260427-211240/windows/hardening-recovery.ps1
index 95afd22..45aba22 100755
--- a/install-kit-awindows-20260427-211240/windows/hardening-recovery.ps1
+++ b/install-kit-awindows-20260427-211240/windows/hardening-recovery.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -45,8 +45,8 @@ if (-not $existingConfig -and (-not $ServerHost)) {
     throw 'deployment-config.json отсутствует. Укажите -ServerHost и параметры пользователей либо сначала выполните скрипт развёртывания.'
 }
 
-$effectiveStateRoot = if ($StateRoot) { $StateRoot } elseif ($existingConfig) { [string]$existingConfig.paths.stateRoot } else { 'C:\ProgramData\ActivityWatch' }
-$effectiveInstallRoot = if ($InstallRoot) { $InstallRoot } elseif ($existingConfig) { [string]$existingConfig.paths.installRoot } else { 'C:\Program Files\ActivityWatch' }
+$effectiveStateRoot = if ($StateRoot) { $StateRoot } elseif ($existingConfig) { [string]$existingConfig.paths.stateRoot } else { 'C:\ProgramData\ActivityWatch-Phase2' }
+$effectiveInstallRoot = if ($InstallRoot) { $InstallRoot } elseif ($existingConfig) { [string]$existingConfig.paths.installRoot } else { 'C:\Program Files\ActivityWatch-Phase2' }
 $effectiveLogsRoot = if ($existingConfig) { [string]$existingConfig.paths.logsRoot } else { Join-Path $effectiveStateRoot 'logs' }
 $effectiveConfigPath = if ($ConfigPath) { $ConfigPath } else { Join-Path $effectiveStateRoot 'deployment-config.json' }
 $effectiveLaunchScript = Join-Path $effectiveStateRoot 'launch-watchers.ps1'
diff --git a/install-kit-awindows-20260427-211240/windows/validate-deployment.ps1 b/install-kit-awindows-20260427-211240/windows/validate-deployment.ps1
index 15d213c..55202dc 100644
--- a/install-kit-awindows-20260427-211240/windows/validate-deployment.ps1
+++ b/install-kit-awindows-20260427-211240/windows/validate-deployment.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json'
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json'
 )
 
 Set-StrictMode -Version Latest
diff --git a/install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1 b/install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1
index 3750b6a..9259d3c 100644
--- a/install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1
+++ b/install-kit-awindows-20260427-211240/windows/worktime-session-collector.ps1
@@ -1,5 +1,5 @@
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$Hostname,
     [int]$PollSeconds = 30
 )
diff --git a/windows/browser-domains-native-collector.ps1 b/windows/browser-domains-native-collector.ps1
index e04f332..28de28e 100755
--- a/windows/browser-domains-native-collector.ps1
+++ b/windows/browser-domains-native-collector.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -52,11 +52,11 @@ $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
 $resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
 $resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
 $resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
-$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\ActivityWatch\web-category-rules.json' }
-$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
+$resolvedRulesPath = if ($RulesPath) { $RulesPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.rulesPath } else { 'C:\ProgramData\ActivityWatch-Phase2\web-category-rules.json' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig) { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json' }
 $resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
 $resolvedPulseSeconds = if ($PSBoundParameters.ContainsKey('PulseSeconds')) { $PulseSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pulseSeconds } else { 30 }
-$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch\logs' }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch-Phase2\logs' }
 $resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("browser-domains-{0}.log" -f $env:USERNAME) }
 $resolvedIncidentLogPath = if ($IncidentLogPath) { $IncidentLogPath } else { Join-Path $resolvedLogsRoot ("dlp-incidents-{0}.log" -f $env:USERNAME) }
 $resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
diff --git a/windows/deploy-domain-users.ps1 b/windows/deploy-domain-users.ps1
index 676fdb9..d441de1 100755
--- a/windows/deploy-domain-users.ps1
+++ b/windows/deploy-domain-users.ps1
@@ -11,8 +11,8 @@ param(
     [string]$Version = 'v0.13.2',
     [string]$PackageUrl,
     [string]$PackageZipPath,
-    [string]$InstallRoot = 'C:\Program Files\ActivityWatch',
-    [string]$StateRoot = 'C:\ProgramData\ActivityWatch',
+    [string]$InstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$StateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
diff --git a/windows/deploy-ensemble.ps1 b/windows/deploy-ensemble.ps1
index 58d514b..45fab28 100644
--- a/windows/deploy-ensemble.ps1
+++ b/windows/deploy-ensemble.ps1
@@ -11,8 +11,8 @@ param(
     [string]$Version = 'v0.13.2',
     [string]$PackageUrl,
     [string]$PackageZipPath,
-    [string]$InstallRoot = 'C:\Program Files\ActivityWatch',
-    [string]$StateRoot = 'C:\ProgramData\ActivityWatch',
+    [string]$InstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$StateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
diff --git a/windows/deploy-single-user.ps1 b/windows/deploy-single-user.ps1
index 0efd871..d49be48 100755
--- a/windows/deploy-single-user.ps1
+++ b/windows/deploy-single-user.ps1
@@ -10,8 +10,8 @@ param(
     [string]$Version = 'v0.13.2',
     [string]$PackageUrl,
     [string]$PackageZipPath,
-    [string]$InstallRoot = 'C:\Program Files\ActivityWatch',
-    [string]$StateRoot = 'C:\ProgramData\ActivityWatch',
+    [string]$InstallRoot = 'C:\Program Files\ActivityWatch-Phase2',
+    [string]$StateRoot = 'C:\ProgramData\ActivityWatch-Phase2',
     [int]$PollSeconds = 5,
     [int]$PulseSeconds = 30,
     [int]$RecoveryIntervalSeconds = 180,
diff --git a/windows/dlp-endpoint-signals-collector.ps1 b/windows/dlp-endpoint-signals-collector.ps1
index 06d7f21..7c60664 100644
--- a/windows/dlp-endpoint-signals-collector.ps1
+++ b/windows/dlp-endpoint-signals-collector.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -713,9 +713,9 @@ $deploymentConfig = Get-DeploymentConfig -Path $ConfigPath
 $resolvedServerHost = if ($ServerHost) { $ServerHost } elseif ($deploymentConfig) { [string]$deploymentConfig.server.host } else { throw 'Укажите ServerHost или подготовьте deployment-config.json.' }
 $resolvedServerPort = if ($PSBoundParameters.ContainsKey('ServerPort')) { $ServerPort } elseif ($deploymentConfig) { [int]$deploymentConfig.server.port } else { 5600 }
 $resolvedServerScheme = if ($ServerScheme) { $ServerScheme } elseif ($deploymentConfig) { [string]$deploymentConfig.server.scheme } else { 'http' }
-$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch\dlp-policy.json' }
+$resolvedPolicyPath = if ($PolicyPath) { $PolicyPath } elseif ($deploymentConfig -and $deploymentConfig.paths.PSObject.Properties.Name -contains 'policyPath') { [string]$deploymentConfig.paths.policyPath } else { 'C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json' }
 $resolvedPollSeconds = if ($PSBoundParameters.ContainsKey('PollSeconds')) { $PollSeconds } elseif ($deploymentConfig) { [int]$deploymentConfig.collector.pollSeconds } else { 5 }
-$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch\logs' }
+$resolvedLogsRoot = if ($deploymentConfig) { [string]$deploymentConfig.paths.logsRoot } else { 'C:\ProgramData\ActivityWatch-Phase2\logs' }
 $resolvedLogPath = if ($LogPath) { $LogPath } else { Join-Path $resolvedLogsRoot ("endpoint-signals-{0}.log" -f $env:USERNAME) }
 $resolvedLocalAgentLogsEnabled = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'logging' -and $deploymentConfig.logging.PSObject.Properties.Name -contains 'localAgentLogsEnabled') { [bool]$deploymentConfig.logging.localAgentLogsEnabled } else { $true }
 $resolvedIncidentArtifactsRoot = if ($deploymentConfig -and $deploymentConfig.PSObject.Properties.Name -contains 'incidentCapture' -and $deploymentConfig.incidentCapture.PSObject.Properties.Name -contains 'artifactsRoot') { [string]$deploymentConfig.incidentCapture.artifactsRoot } else { Join-Path $env:LOCALAPPDATA 'ActivityWatch-Phase2\\incident-artifacts' }
diff --git a/windows/hardening-recovery.ps1 b/windows/hardening-recovery.ps1
index 95afd22..45aba22 100755
--- a/windows/hardening-recovery.ps1
+++ b/windows/hardening-recovery.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$ServerHost,
     [int]$ServerPort,
     [ValidateSet('http', 'https')]
@@ -45,8 +45,8 @@ if (-not $existingConfig -and (-not $ServerHost)) {
     throw 'deployment-config.json отсутствует. Укажите -ServerHost и параметры пользователей либо сначала выполните скрипт развёртывания.'
 }
 
-$effectiveStateRoot = if ($StateRoot) { $StateRoot } elseif ($existingConfig) { [string]$existingConfig.paths.stateRoot } else { 'C:\ProgramData\ActivityWatch' }
-$effectiveInstallRoot = if ($InstallRoot) { $InstallRoot } elseif ($existingConfig) { [string]$existingConfig.paths.installRoot } else { 'C:\Program Files\ActivityWatch' }
+$effectiveStateRoot = if ($StateRoot) { $StateRoot } elseif ($existingConfig) { [string]$existingConfig.paths.stateRoot } else { 'C:\ProgramData\ActivityWatch-Phase2' }
+$effectiveInstallRoot = if ($InstallRoot) { $InstallRoot } elseif ($existingConfig) { [string]$existingConfig.paths.installRoot } else { 'C:\Program Files\ActivityWatch-Phase2' }
 $effectiveLogsRoot = if ($existingConfig) { [string]$existingConfig.paths.logsRoot } else { Join-Path $effectiveStateRoot 'logs' }
 $effectiveConfigPath = if ($ConfigPath) { $ConfigPath } else { Join-Path $effectiveStateRoot 'deployment-config.json' }
 $effectiveLaunchScript = Join-Path $effectiveStateRoot 'launch-watchers.ps1'
diff --git a/windows/installkit/innosetup/innosetup-rdp-package-filelist.md b/windows/installkit/innosetup/innosetup-rdp-package-filelist.md
index 4b36595..3863d26 100644
--- a/windows/installkit/innosetup/innosetup-rdp-package-filelist.md
+++ b/windows/installkit/innosetup/innosetup-rdp-package-filelist.md
@@ -53,10 +53,10 @@
 
 Эти файлы/папки появляются на целевом Windows-хосте во время/после деплоя:
 
-- `C:\ProgramData\ActivityWatch\deployment-config.json`
-- `C:\ProgramData\ActivityWatch\web-category-rules.json`
-- `C:\ProgramData\ActivityWatch\dlp-policy.json`
-- `C:\ProgramData\ActivityWatch\logs\*`
+- `C:\ProgramData\ActivityWatch-Phase2\deployment-config.json`
+- `C:\ProgramData\ActivityWatch-Phase2\web-category-rules.json`
+- `C:\ProgramData\ActivityWatch-Phase2\dlp-policy.json`
+- `C:\ProgramData\ActivityWatch-Phase2\logs\*`
 - `%LOCALAPPDATA%\ActivityWatch-Phase2\incident-artifacts\*`
 
 ## 4) Опционально приложить в операторский install-kit
diff --git a/windows/validate-deployment.ps1 b/windows/validate-deployment.ps1
index 15d213c..55202dc 100644
--- a/windows/validate-deployment.ps1
+++ b/windows/validate-deployment.ps1
@@ -1,6 +1,6 @@
 [CmdletBinding()]
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json'
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json'
 )
 
 Set-StrictMode -Version Latest
diff --git a/windows/worktime-session-collector.ps1 b/windows/worktime-session-collector.ps1
index 3750b6a..9259d3c 100644
--- a/windows/worktime-session-collector.ps1
+++ b/windows/worktime-session-collector.ps1
@@ -1,5 +1,5 @@
 param(
-    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch\deployment-config.json',
+    [string]$ConfigPath = 'C:\ProgramData\ActivityWatch-Phase2\deployment-config.json',
     [string]$Hostname,
     [int]$PollSeconds = 30
 )