Think in Snapshots
The exported kit preserves the encrypted permission records present at that moment. It is not a live mirror of every later change. A newly protected app needs a newer export; a kit made before that record existed cannot recover it.
Keep the kit outside the active vault directory and give it a filename you can distinguish. Export uses a new filename rather than silently replacing an existing backup.
Keep the Matching Password
A kit is opened with the password in effect when it was exported. If you change the management password, existing exports keep their earlier password. Re-export afterwards and record which password belongs to which kit in a safe place.
There is no forgotten-password bypass inside the kit. It does not expose the password or turn encrypted records into a public reset token.
Rehearse the Recovery Route
If normal local settings are unavailable, work from a copy in a separate data directory. Keep the source export unchanged and preserve your newer vault. The recovery-workspace instructions explain the filename, command-line option and safe-uninstall implications.
Make Maintenance a Checkpoint
- After adding or restoring files, export the current state when records have changed.
- After changing a password, export again and keep the correct password with each required kit.
- Before updates, moves or removal, restore the affected files and confirm the result.
- Keep registered profile folders available until safe uninstall has checked them.