[EVMCOD]

What and why

PR 1 of the Windows packaging, done the way Linux was (#69): a script that builds the installer. Experimental and unsigned. It does not publish anything and does not touch the macOS release.

• scripts/build-windows.ps1 (new, PowerShell, ASCII only, consistent with build-linux.sh): freezes the PyInstaller sidecar, copies it to desktop/src-tauri/binaries/conductloop-server-x86_64-pc-windows-msvc.exe (Tauri's triple naming), then runs tauri build --bundles nsis (default) or -Bundles nsis,msi. Options: -SidecarOnly, -SkipSidecar, -Bundles, -Help. Builds in its own venv (build\windows-venv), drops sentence-transformers from the sidecar like the other builds, strips TAURI_SIGNING_* from the environment, remaps the user profile out of the Rust binary, refuses to run off 64-bit Windows, prints sizes and sha256 at the end.
• desktop/src-tauri/tauri.windows.conf.json (new): applies on Windows only (Tauri merges it over tauri.conf.json). NSIS target, per-user install (currentUser, no admin prompt), WebView2 downloadBootstrapper, no updater artifacts. macOS and Linux configs are untouched.
• Updater off on Windows, as on Linux: the only endpoint is the macOS manifest and nothing is signed, so desktop/src-tauri/src/lib.rs now runs the startup update check on macOS only (cfg!(target_os = "macos")). The plugin and its config stay registered on every platform; the "Check for Updates" menu item was already macOS-only.
• desktop/conductloop_server.spec: on win32 only, the frozen server starts with -X utf8 (frozen executables ignore PYTHONUTF8; the Windows console and file default is cp1252). Other platforms: no change.
• Docs: docs/PORTABILITY.md has a new "Windows status" section: experimental, unsigned, WebView2 requirement, SmartScreen ("More info" then "Run anyway"), possible antivirus false positives, known limits.
• CHANGELOG: entry under Unreleased (the section did not exist after 1.2.3, so it is created here).
• Existing tests that pinned the old lib.rs line (test_linux_packaging.py, test_linux_update_manifest.py) now assert the macOS-only line.

Not touched: release-desktop.sh, the macOS CI, build-linux.sh, Stripe, the license worker, Apple secrets. No secrets, no signing, no .sig.

How it was tested

• scripts/verify.sh --offline on this branch (final commit 3ea5063): passed, ruff, mypy ratchet, pytest -m "not live" with coverage, evals, package build, gitleaks (excluded as they hang on the box: tests/test_browser_visibility_js.py, tests/test_desktop_nav_js.py; tests/test_license_worker.py not run).
• tests/test_windows_packaging.py (new): override touches only bundle; macOS/Linux configs unchanged; NSIS, currentUser, WebView2; no updater artifacts or signing keys; plugin config kept; sidecar and icon.ico exist; macOS-only update check; the updater endpoint is still the macOS one; spec option on win32 only; script structure (triple, sidecar name, bundle validation, no signing or publishing words, ASCII only); release-desktop.sh and build-linux.sh do not reference it; docs mention SmartScreen, "More info", "Run anyway", WebView2. With pwsh on the box also: the script parses, -Help works, bad options are refused (-Bundles dmg, nsis;calc, -SidecarOnly -SkipSidecar), and it refuses to run off Windows.
• On a real windows-latest runner (the box has no Windows and cannot compile Rust), through the workflow of the next PR in the stack (ci/windows-bundles, on a scratch branch): the script built the NSIS installer and the MSI from this branch's code (run 40946201670, success), the frozen server answered /api/health, and the silently installed app started its server on :7777. The first run (40945979171) failed in 27 s on a bug in this script (-Bundles nsis,msi bound to a [string]); fixed in 3ea5063, the cause is in the commit message.

Untested ("sin probar", nothing here was run on a real Windows machine)

• Running the installer by hand on a real Windows 10/11 desktop: window, tray, icon, Start menu entry, uninstall.
• SmartScreen behavior (the installer is unsigned; the docs say "More info" then "Run anyway", not observed).
• The WebView2 bootstrapper path on a machine without WebView2 (the runner already has it).
• Antivirus false positives on the PyInstaller sidecar.
• The MSI install path (it is built on CI, never installed).
• Upgrade over a previous install; behavior of the app with -X utf8 beyond the server answering health.
• The lib.rs change was compiled only by CI (the box cannot build Rust).
• x64 only; no ARM64.

Checklist

• Verified locally with scripts/verify.sh.
• Tests added or updated.
• CHANGELOG.md entry under Unreleased.
• No personal data, no secrets.
• Docs updated (docs/PORTABILITY.md).
• No workflow touched in this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T20:29:07.651258Z	—	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".