v2.0.4 — IDIS GDK 7.0.0.13 migration

InteractiveMask v2.0.4 — Release Notes

Release date: 2026-10-16
Previous release: v2.0.3

---

TL;DR

v2.0.4 migrates InteractiveMask from IDIS GDK 6.6.1.07 to GDK 7.0.0.13 (full bump: managed C# sampler bindings and native G2ClientGDK.dll from the same 7.0.0 package). Empty stubs cover the two new g2watch_listener control-session callbacks required to compile against the 7.0.0 interface.

---

What's new

IDIS GDK 7.0.0.13

• Default GdkPath in Directory.Build.props now points at E:\ISS GDK\GDK-RAS-x64-7.0.0.12-260122\7.0.0 (override remains via IDIS_GDK_PATH).
• Rebuild against 7.0.0 headers/bindings is required: G2LAYOUT array sizes grew from 64 to 256; mixing a 6.6.1 build with the 7.0.0 DLL is unsafe.
• G2FishEye.dll is no longer part of the GDK 7.0.0 package (fish-eye control lives in the core DLL). The csproj still copies it when present for older local packages only.
• Runtime set copied next to the Display EXE: G2ClientGDK.dll, G2LibavMT.dll, SDL2.dll.

Listener interface

• Stub implementations of on_g2watch_receive_control_session_expired and on_g2watch_receive_response_control_session_renew in:
  • NvrSession
  • NvrCameraNameFetcher
  • tools/PoC.GdkConnect
• OTP authentication and control-session renew flows are not enabled in this release; stubs satisfy the interface only.

---

Documentation

• README, developer guide, use-case brief, and product-facing notes updated from GDK 6.6.1 / G2FishEye-required wording to GDK 7.0.0.

---

Upgrade notes

1. Install or point IDIS_GDK_PATH at the GDK 7.0.0 package root (folder that contains bin\ and sampler\csharp\).
2. Rebuild Display + WebHost together (dotnet build InteractiveMask.sln -c Release -p:Platform=x64).
3. Redeploy both assemblies and the new native DLLs from the 7.0.0 package — do not mix 6.6.1 natives with a 7.0.0-built app.
4. No application config migration beyond prior v2.0.x releases.

Hardware / field checks (operator)

After deploy, verify on real NVRs:

• HEVC (H.265) live tiles decode correctly
• Multi-NVR layouts still connect and show video
• Disconnect / reconnect recovery
• Camera-name sync from device status

---

Installer

InteractiveMask-2.0.4.msi (181.8 MB, signed by IDIS Nederland BV)

• SHA-256: 3AE0A8ADB976D6A1FCA56FFFD5185D43D33AA16C857808B0A6B80A1DEE266DC8
• Certificate: CN=IDIS Nederland BV, valid until 4 April 2027
• Upgrade: double-click on a host running v2.0.x / v1.x — old version replaced in-place, configuration preserved.

Unattended deployment

msiexec /i InteractiveMask-2.0.4.msi /qn INTERACTIVEMASK_LANGUAGE=en

(Replace en with nl, de, fr, or es.)

v2.0.2 — live NVR add, AI defaults, overlay cleanup, memory pooling

v2.0.2 — quality-of-life patch

Field-reported bugs and a memory pass. Drop-in over v2.0.1; configuration is preserved.

Fixes

Adding an NVR no longer requires an app restart

Adding, removing, renaming, or reconfiguring an NVR in Setup → NVR → Apply used to trigger a restart prompt. It now lives-applies:

• Add — wires a new NvrSession, connects, and binds cameras on the next reconcile step. New cameras come up without dropping the live image on the other NVRs.
• Remove — detaches every tile bound to that NVR, cancels active AI-reveals on those tiles, clears the per-NVR banner, disposes the session.
• Connection change (host / port / user / password) — tears down the old session and recreates with the new credentials. Restart of just that NVR's connection, not the whole app.
• Rename — propagates through the next camera reconcile; no session restart.

The only remaining structural changes are grid size and privacy mode flip — both rebuild state-contracts that are unsafe to mutate in-place.

AI default for new cameras is now OFF

Previously a freshly-added camera (or a v1.x upgrade) defaulted to AiEnabled=true, which surprised customers who never asked for AI. Default flipped to false in three places (DTO, JSON deserialization default, runtime VM default). Upgrade matrix:

• v1.x → v2.0.2: AI stays off on every camera (matches v1.x behaviour exactly).
• v2.0.0 / v2.0.1 → v2.0.2: explicit values from JSON are preserved; cameras the operator had AI on for stay on.
• Brand-new camera row: AI off, operator opts in via the AI… dialog.

Disabling AI now clears the existing overlay

When the operator turned AI off in Setup → Apply, the last batch of detections stayed painted on the tile until the next mass-mask or restart. The TileViewModel.AiEnabled setter now clears Detections on the true → false transition. Active AI-reveal windows are also cancelled cleanly (audit reason ai-disabled) before the flip — including in the previously-missed step 4 of ApplyCameraChangesLive (existing-tile, config-only edit).

Performance

Memory pooling on the AI hot path

Three per-frame allocations in the AI pipeline now go through ArrayPool<T>.Shared:

Allocation	Size	Where
Per-frame BGRA byte[]	~8 MB @ 1080p, ~33 MB @ 4K	TileViewModel.OnFrameDecoded
YOLO preprocess float[]	~4.9 MB	InferenceCoordinator.PreprocessForYolo
Per-detection protoMask float[]	up to ~100 KB	BuildSegmentationMask

On a populated grid (4 active AI cameras at the configured cadence) this dropped the steady-state AI-pipeline allocation rate by roughly an order of magnitude. BitmapFrameRef became IDisposable with explicit pool-rented vs caller-owned variants; the InferenceCoordinator disposes frames in all three exit paths (slot-drop, processed, shutdown). No behavioural change.

Installer

InteractiveMask-2.0.2.msi (180.9 MB, signed by IDIS Nederland BV)

• SHA-256: E29B8EA1FEB13F021E2BCABA9987FAE73A8B277568329AE365D5EC645AD13881
• Certificate: CN=IDIS Nederland BV, valid until 4 April 2027
• Upgrade: double-click on a host running v2.0.0 / v2.0.1 / v1.x — old version replaced in-place, configuration preserved.

Unattended deployment

msiexec /i InteractiveMask-2.0.2.msi /qn INTERACTIVEMASK_LANGUAGE=en

(Replace en with nl, de, fr, or es.)

Full v2.0 feature list

See v2.0.0 release notes for the headline AI-masking features. Patch history: v2.0.1 (fresh-install crash + mass-mask perf + diagnostic bootstrap log).

v2.0.1 — fresh-install crash fix, mass-mask perf fix

v2.0.1 — bug-fix patch

Two field bugs and one diagnostic add-on. Recommended upgrade for every v2.0.0 install. Drop-in over 2.0.0; configuration is preserved.

Fixes

Bug 1: fresh-install silent exit

On a clean machine (no prior v1.x install, default non-admin user), the app launched, showed the first-run language picker, the user clicked Continue, and the app disappeared silently — no error dialog, no PIN prompt, no log entry. Existing v1.2+ installations with an inherited config.json were unaffected, which is why the bug was missed during pre-release testing.

Two contributing factors fixed:

• ShutdownMode race. WPF's default OnLastWindowClose could trigger application shutdown when the first-run picker closed, before StartupUri created MainWindow. Wrapped the picker in ShutdownMode.OnExplicitShutdown, restored on exit.
• crash.log was unwritable for default users. The previous path resolved to C:\Program Files\InteractiveMask\Display\crash.log, which is read-only for non-admin users on a per-machine install. The crash handler dropped every line. Moved to %PROGRAMDATA%\InteractiveMask\crash.log (writable for any local user), with a %TEMP% fallback.

Bug 2: mass-mask sluggish / unresponsive UI

Long-press mass-mask on a populated grid (4×4 or 5×5) stalled the UI thread for several hundred ms — bug present since v1.0 but masked until v1.3 added the 5×5 grid + mass-mask gesture. Not AI-related (reported on v1.3 too).

Root cause: per-tile BlurEffect Radius="80". Even in RenderingBias="Performance" mode the sample count grows with the radius, and 16-25 simultaneous full-tile blurs on 4K displays exceeded GPU bandwidth. Lowered to Radius=20 — well past the point where faces and bodies become unrecognisable. The dark Background="#60000000" overlay on top of the blur already obscures detail; subjective privacy effectiveness unchanged, render cost roughly 4× cheaper.

Diagnostic

Bootstrap log

New BootstrapLog tracer writes one line per startup step to %PROGRAMDATA%\InteractiveMask\bootstrap.log (truncated on each launch). Captures App.OnStartup phases, MainWindow constructor, OnLoaded phases, and the PIN dialog entry point. Wrapped in try/catch so the tracer can never make a bad startup worse. Lets support read exactly where any future startup-time failure exits.

What to send if you still hit a startup issue

After upgrading to v2.0.1 and reproducing the failure, send us:

• %PROGRAMDATA%\InteractiveMask\bootstrap.log (writable by any user, always present after launch)
• %PROGRAMDATA%\InteractiveMask\crash.log (only present if an unhandled exception was caught)

These two files together should pinpoint any remaining startup-time issue precisely.

Installer

InteractiveMask-2.0.1.msi (180.9 MB, signed by IDIS Nederland BV)

• SHA-256: 222B1DFDB2DE820FEFF91E4DA3922183CCFAD0FF54DD7F92E28BE4987731AC49
• Certificate: CN=IDIS Nederland BV, valid until 4 April 2027
• Upgrade: double-click on a host running v2.0.0 or any v1.x — old version replaced in-place, configuration preserved.

Unattended deployment

msiexec /i InteractiveMask-2.0.1.msi /qn INTERACTIVEMASK_LANGUAGE=en

(Replace en with nl, de, fr, or es.)

Full v2.0 feature list

See v2.0.0 release notes.

v2.0.0 — AI-driven privacy masking

v2.0.0 — major release

InteractiveMask now applies privacy masks per detected object instead of per tile. The system recognises people, cyclists and vehicles by itself via a local AI model and blurs only those — the rest of the camera frame stays fully visible. Fully GDPR-compliant: no facial recognition, no number-plate reading, no external database links.

Backward compatible with v1.3.x. Customers without a suitable GPU keep the v1.x masking behaviour unchanged; AI is strictly opt-in per camera.

What's new

AI-driven object masking

• Three categories, colour-coded: Person (red), TwoWheeler (orange), Vehicle (blue)
• Per-camera configuration: enable / disable, category selection, confidence threshold with hysteresis, mask padding, region-of-interest polygon
• Two rendering styles: colour-coded silhouette or classic CCTV source-blur
• Mask opacity slider (20–100 %) per camera
• Redesigned per-camera AI settings dialog in the app's card style

Per-tile AI reveal (F2)

• Small "AI" pill in the top-left of any tile with active AI detections
• Click → authenticate (PIN or AD, same policy as v1.x unmask) → pick duration (30 s / 1 min / 5 min / until remask)
• Live countdown badge in the top-right, one click to remask early
• Every reveal is audited (reviewer identity + duration + reason)
• Per-detection reveal is intentionally not supported — privacy first

Adaptive load management (F3)

• Runtime monitor watches rolling p95 inference latency
• Three-step degradation ladder with hysteresis to prevent flapping:
  1. Frame-skip multiplier raised per tile
  2. AI auto-disabled on the lowest-priority cameras
  3. Global AI fallback (all tiles show live image without overlay)
• Each transition writes an audit event; affected tiles show a small "AI paused (load)" badge
• Automatic recovery when load drops; no operator action required

Plus

• In-app manual chapter 10 "AI masking" with operator-facing walkthrough (NL + EN)
• About tab shows live AI runtime info: model, execution provider, inference latency, frame counter
• Full audit-log coverage for the AI lifecycle: AiDetectorInit, AiDetectorFault, AiDetectorStopped, AiRevealRequested, AiRevealExpired, AiDetectorDegraded, AiDetectorRestored
• ONNX Runtime DirectML bumped 1.20.1 → 1.24.4
• Centralised inference coordinator (no more native crashes under concurrent submissions)
• Carry-over polish from the v1.3 pre-release review (dead loc keys, persistent audit-log handle, hot-path closure-allocation removal, periodic web-session sweep, PIN-counter consistency fix)

What it does not do

• No facial recognition
• No licence-plate / OCR / plate-string storage
• No links to external databases
• NVR recordings are unaffected — masking is applied on the kiosk screen only

System requirements

• Windows 10 22H2 or Windows 11 23H2 / 24H2, 64-bit
• DirectML-capable GPU (NVIDIA RTX, AMD 700-series, Intel Arc; driver from 2020 or newer)
• 4 GB free on system drive
• LAN access to the IDIS NVR

Installer

InteractiveMask-2.0.0.msi (180.8 MB, signed by IDIS Nederland BV)

• SHA-256: 6D503F5D0C9838C5BBC41DF77FD22896F38E87ACCF3CCA6F94A066386FFB9DEC
• Certificate: CN=IDIS Nederland BV, valid until 4 April 2027
• Self-contained: bundles the .NET 9 runtime, ONNX Runtime DirectML, and the YOLO26 models — no separate runtime install needed
• Upgrade: double-click on a host running v1.x; the old version is replaced in-place and configuration is preserved

Unattended deployment

msiexec /i InteractiveMask-2.0.0.msi /qn INTERACTIVEMASK_LANGUAGE=en

(Replace en with nl, de, fr, or es to pre-seed the UI language for SCCM / Intune rollouts.)

Documentation

• Full release notes: docs/release-notes-2.0.0.md
• Build note (IT / support): docs/buildnote-2.0.0.md
• Architecture: docs/architecture-v2-ai.md
• Roadmap: docs/roadmap.md

v1.3.0 - 5-language UI, mass-mask, NVR-name sync

v1.3.0 — major feature release

Grootste release sinds v1.0. Vijf talen, mass-mask noodgesture, privacy-default modus, NVR-naam sync, drag/drop in Setup, en nog veel meer. Volledig generaliseerd voor breder gebruik dan alleen zorginstellingen — geschikt voor kantoren, recepties, hotels, scholen, zorgomgevingen.

Nieuw

Multi-language UI (5 talen)

• NL, EN, DE, FR, ES volledig vertaald (~226 keys per taal, professioneel-formele toon)
• Setup → Beheerder → Taal: dropdown met native namen (Nederlands / English / Deutsch / Français / Español)
• First-run language picker: bij eerste opstart een modale taalkeuze, voorgeselecteerd op Windows UI-cultuur
• MSI deployment hook: msiexec /i InteractiveMask-1.3.0.msi /qn INTERACTIVEMASK_LANGUAGE=de voor SCCM/Intune mass-rollout zonder UI-prompt
• Live language-switching via INotifyPropertyChanged, geen restart nodig

Mass-mask gesture (long-press)

• Houd de muisknop 500 ms ergens op het scherm vast → alle tegels tegelijk maskeren of vrijgeven
• State-guard: mass-unmask alleen als alle tegels gemaskeerd zijn; gemengde state weigert om accidentele privacy-doorbraak te voorkomen
• Authenticatie volgt de bestaande policy (PIN of AD)
• Optionele bevestigingsdialoog voor mass-unmask, in te schakelen via Setup → Privacy
• Mass-mask negeert per-tegel auto-unmask timers (caregiver-away scenario)

Privacy-default mode

• Setup → Privacy → "Standaard zichtbaarheid": kies tussen OversightDefault (klassiek: tegels starten zichtbaar, klik beschermt) en PrivacyDefault (alle tegels starten geblurd, klik onthult tijdelijk)
• Auto-rollback timer in privacy-default brengt tegels automatisch terug naar geblurd
• Optionele auth bij elke onthulling in privacy-default mode
• Geschikt voor kantoorruimtes, recepties, hotels, scholen, zorginstellingen

NVR camera-naam sync

• Setup → Cameras → "Namen ophalen vanuit NVR": pull camera-titels rechtstreeks vanuit de NVR via request_device_status
• Twee aparte velden: NvrTitle (read-only, NVR is bron-van-waarheid) en Custom Label (admin-bewerkbaar). Sync overschrijft alleen NvrTitle.
• Geen tweede login: hergebruikt de live NVR-sessie van Display, ontwijkt concurrent-session conflicten
• Per-tegel overlay-balk: NVR-titel links, custom label rechts, beide togglebaar via Setup → Privacy → Tegel-overlay

Drag/drop tile reordering

• In Setup → Cameras: grip-icoon links bij elke rij om de slot-volgorde te wijzigen via slepen
• Slot-nummers worden automatisch hernummerd

Kleinere features

• Apply-knop in Setup naast Save: wijzigingen direct toepassen zonder venster te sluiten
• About-tab: versie, uitgever, copyright, open-source componenten, integraties (IDIS Direct IP NVR's), bug-rapportage via mailto, IDIS website link
• 5×5 grid (25 tegels) toegevoegd
• IDIS-watermerk (10% opacity) in lege tegels
• Hover-camera info (verwijderd na feedback — info zit nu permanent in de overlay-balk)
• Aspect-ratio fix: niet-16:9 camera's (4:3, 5:4, 1:1 fish-eye, 21:9) worden nu volledig getoond met letterboxing in plaats van cropping
• Setup-venster vergroot naar 1180 × 1000 px, content-tabs scrollen niet meer

UI-polish

• Volledig dark-themed ComboBox met eigen template (closed control + popup + items)
• Impliciete RadioButton/CheckBox styling — geen zwarte tekst meer op donkere achtergrond
• Setup → Privacy: "Tegel-overlay" card voor de beide tonen-toggles
• Generieke toon: "verzorgers/bewoners" → "operators/tegels" door alle talen heen, voor bredere markt-toepasbaarheid

Onder de motorkap

Pre-release code-review opgeleverd vier HIGH-issues, alle gefixt:

• Mass-mask PIN-bookkeeping (security): counter werd één keer voor de hele batch verhoogd; eerste unmask draineerde counter naar 0 en clearde session-PIN. Nu per nieuw-gemaskeerde tegel.
• Long-press timer leak: per click een nieuwe DispatcherTimer die kon orphan-en bij gemiste mouse-up. Nu één gedeelde timer.
• StreamChoices static-event leak: Strings.PropertyChanged subscription per Setup-open zonder unsubscribe. Nu IDisposable + Closed handler.
• Privacy.Mode live-apply desync: mode-flip swap'te het settings-object zonder de tegelstate te re-primen. Nu structural change → restart prompt.

Plus 3 medium fixes: dead _lastCameraNames field weg, sync abortte bij eerste falende NVR (nu continue + accumulate errors), redundante DataGrid CommitEdit.

ConfigService persistence (kritieke fix)

Nieuwe v1.3 velden waren in-memory wel toegevoegd maar nooit echt naar config.json geschreven. Pre-release-fix bracht alle nieuwe velden in de Stored-DTO's:

• CameraSlotSettings.NvrTitle
• PrivacySettings.Mode, ShowMassUnmaskConfirm, PrivacyDefaultRequireAuthOnReveal, ShowCameraLabel, ShowNvrTitle

Bestaande v1.2 configs blijven werken (System.Text.Json vult missende keys met de defaults; gedrag identiek aan v1.2).

Installer

• Self-contained MSI (109 MB) met .NET 9 + WindowsDesktop + ASP.NET Core ingesloten — installeert op schone Windows 10/11 x64 zonder runtime
• EV-Authenticode ondertekend (IDIS Nederland BV via SafeNet token, SHA-256, DigiCert timestamp) — geen SmartScreen-waarschuwingen, klaar voor SCCM/Intune

Upgrade vanaf v1.2.0

Reguliere MSI-installatie. Bestaande config.json migreert automatisch:

• v1.2 PrivacySettings velden blijven hun waarde behouden
• Nieuwe v1.3 velden krijgen veilige defaults (OversightDefault mode, custom label aan, NVR-titel uit, geen confirm-dialoog)
• Bestaande NVR's en camera-bindings ongewijzigd

Links

• Release MSI: zie hieronder als bijlage (109 MB)
• Volledige changelog: git log v1.2.0..v1.3.0 in de repo

v1.2.0 - Multi-NVR support

v1.2.0 — Multi-NVR support

Eerste release waarin een enkele installatie meerdere IDIS NVR's tegelijk kan tonen in het 4×4 grid. Tegel 1 kan dus NVR 1 / camera 5 zijn terwijl tegel 2 NVR 3 / camera 12 is, alles in dezelfde view.

Nieuw

• Multi-NVR — per tegel kies je welke NVR + camera + stream-kwaliteit; aparte sessies en reconnect-state per NVR. Config migreert automatisch vanaf v1.1.x (de bestaande NVR wordt NVR 1).
• NVR-modaal — NVR toevoegen en het potlood-icoon openen nu een modaal venster voor IP / poort / gebruiker / wachtwoord. Geen verwarring meer met cell-editing in de DataGrid.
• Verbindingsbanner per NVR — als één NVR offline gaat zie je dat in de banner met de naam van die NVR; andere tegels blijven gewoon werken.

Code-kwaliteit (dev-pass)

• Race condition in CameraTile.HandleFrame opgelost (decode-pad volledig onder buffer-lock).
• NvrSession._tilesByCamera nu ConcurrentDictionary — geen kans meer op corruptie bij gelijktijdige callbacks.
• Reconnect CancellationTokenSource wordt nu netjes disposed bij vervanging.
• Syslog-forwarder gebruikt een bounded channel (1024, drop-oldest) tegen onbegrensd geheugengebruik bij netwerkproblemen.

Installer

• Self-contained MSI met .NET 9 + WindowsDesktop + ASP.NET Core ingesloten — installeert op een schone Windows 10/11 x64 machine zonder extra runtime.
• EXE's, DLL's en MSI ondertekend met EV-cert (IDIS Nederland BV) via SafeNet token, SHA-256 met DigiCert timestamp.

Upgrade vanaf v1.1.x

Gewone MSI-upgrade. Bestaande config wordt automatisch gemigreerd: de huidige NVR wordt NVR 1 en alle camera-bindings krijgen NvrId = 0.

InteractiveMask v1.1.1 — UX polish + live-apply

Three customer-feedback follow-ups on v1.1.0.

Fixed

• Slot/camera number columns now show 1..N, matching how a user expects to count tiles. The persisted ints stay 0-based so existing configs and state files keep working untouched.
• EULA replaced with a real Dutch license instead of the WiX Lorem ipsum placeholder. Covers license grant, ownership, restrictions, privacy responsibility, warranty disclaimer, liability cap, termination and applicable law.

Improved

• Live-apply for camera changes. Adding, removing, moving slot, changing stream or label no longer triggers a restart prompt. `NvrSession.UpdateCameras` reconciles the diff against the running GDK subscription and re-pushes the camera/stream lists with `force=true`; `CameraTile.UpdateStreamAndLabel` does in-place updates so unchanged cameras keep their decode buffers and the live image stays uninterrupted. Only NVR connection and grid size still ask for a restart.

Build the signed MSI

```powershell
.\build-installer.ps1 -Version 1.1.1 -Sign -CertSubject 'IDIS Nederland BV'
```

Upgrade from v1.1.0

Pull, rebuild. Major-upgrade rule replaces v1.1.0 in place.

InteractiveMask v1.1.0 — UX polish + crash fix

First minor release with five customer-driven improvements.

Fixed

• Hard crash on duplicate camera index in config.json. The crash also persisted across uninstall because config.json lives in ProgramData by design. Now the Setup window validates duplicates before save and shows a localized error pointing at the offending slot or camera. The Config loader dedupes on read (first-occurrence-wins) so existing bad configs are healed automatically. `MainWindow.OnLoaded` wraps RegisterTile in try/catch and audit-logs any skip, so a corrupt config never prevents the app from starting again.

Added

• Delete icon per camera row (trash-can button on the right) instead of relying on the Del key.
• 1x1 grid choice (single full-screen camera) next to the existing 2x2 / 3x3 / 4x4 options.
• Friendly stream labels in the cameras grid: "Hoog / Normaal / Laag" (NL) and "High / Default / Low" (EN). Stored value stays an int so the config schema is unchanged.
• Desktop shortcut alongside the start-menu shortcut, both with the app icon.
• "Launch InteractiveMask now" checkbox on the final installer page. Fires only on fresh install, not on uninstall or repair.
• Add/Remove Programs entry now shows the app icon (ARPPRODUCTICON).

Build the signed MSI

```powershell
.\build-installer.ps1 -Version 1.1.0 -Sign -CertSubject 'IDIS Nederland BV'
```

Upgrade from v1.0.6

Pull, rebuild. Major-upgrade rule in the WiX package uninstalls v1.0.6 in place. Existing config.json with duplicates is auto-healed on first run of v1.1.0.

InteractiveMask v1.0.6 — self-contained MSI

The MSI now bundles the .NET 9 runtime so it installs cleanly on any Windows x64 machine, even without .NET pre-installed.

Fixed

• "Service InteractiveMask WebHost failed to start" on clean machines. v1.0.5 published with `--self-contained false`, so the WebHost service refused to start unless the target had `Microsoft.AspNetCore.App 9.x` + `Microsoft.NETCore.App 9.x` + `Microsoft.WindowsDesktop.App 9.x` already installed. On a freshly imaged machine with only legacy runtimes, the service host couldn't even load the assemblies, which Windows surfaced as a privilege error.

Changed

• `build-installer.ps1` now publishes both projects with `--self-contained true` for the `win-x64` RID. The .NET 9 + ASP.NET Core 9 + WindowsDesktop 9 runtimes ride along inside the MSI.
• MSI size: 21 MB → 108 MB. Worth it for a no-prerequisites kiosk install in healthcare deployments.

Build the signed self-contained MSI

```powershell
.\build-installer.ps1 -Version 1.0.6 -Sign -CertSubject 'IDIS Nederland BV'
```

Upgrade from v1.0.5

Pull, rebuild, redeploy. The major-upgrade rule in the WiX package uninstalls v1.0.5 in place.

InteractiveMask v1.0.5 — MSI installer + signing pipeline

First release with a working MSI installer and an Authenticode signing flow.

Fixed (WiX 5 SDK migration)

• `DefineConstants` wrapped in a `` element no longer works in WiX 5; moved to a global ``.
• Path-style preprocessor variables get backslash-mangled by the WiX preprocessor. Hardcoded relative paths in `` and `!(bindpath.X)` for the linker-resolved ``. Named `` items now use the `BindName` metadata.
• `` moved out of `util.wixext` into a dedicated `WixToolset.Firewall.wixext` package; added the package and the `fire:` namespace.
• `x64` so harvested files in `ProgramFiles64Folder` no longer trigger ICE80.

Added (Authenticode signing)

• `tools/sign-build.ps1` — signtool wrapper for SafeNet EV-token workflows. Cert in `CurrentUser\My` is selected via `/n ""` or `/sha1 `. SHA-256 file digest + SHA-256 timestamp digest, default timestamp server is DigiCert.
• `build-installer.ps1` gains `-Sign` / `-CertSubject` / `-CertThumbprint` / `-TimestampUrl`. The flow signs every `InteractiveMask.*.exe` / `.dll` BEFORE the WiX harvest (so the embedded cab contains signed binaries) and signs the MSI itself after. Microsoft / IDIS DLLs are not re-signed.

Build the unsigned MSI

```powershell
.\build-installer.ps1 -Version 1.0.5

-> build\publish\InteractiveMask-1.0.5.msi

```

Build a signed MSI (SafeNet token plugged in + unlocked)

```powershell
.\build-installer.ps1 -Version 1.0.5 -Sign -CertSubject 'IDIS Nederland BV'
```

Upgrade

Pull, rebuild — no behaviour change for the kiosk or the WebHost.