build.yml

name: Build Notepatra

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-linux:
    runs-on: ubuntu-24.04
    # Fail fast instead of burning the 360-minute default on a wedge.
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential cmake \
            qtbase5-dev libqscintilla2-qt5-dev \
            libqt5charts5-dev libqt5sql5-sqlite \
            qtwebengine5-dev libqt5webenginewidgets5 \
            libqt5svg5-dev qt5-image-formats-plugins

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-05-14

      - name: Audit Rust dependencies (cargo-audit)
        run: |
          # Install cargo-audit to scan Cargo.lock for known CVEs in transitive
          # deps. Treat advisories as warnings (don't break the build) but make
          # them visible in the GH Actions summary.
          cargo install --locked cargo-audit 2>&1 | tail -5 || true
          cd rust-core && cargo audit || echo "::warning::cargo-audit reported advisories — review them"

      - name: Build Rust core
        run: cd rust-core && cargo build --release

      - name: Build C++
        run: |
          mkdir -p build && cd build
          cmake .. -DCMAKE_BUILD_TYPE=Release
          make -j$(nproc)

      - name: Build regression tests (CMake targets)
        run: |
          # Reconfigure with -DBUILD_TESTING=ON so the existing smoke and
          # regression binaries are registered through CTest in the same build
          # tree as the main executable.
          # -DCMAKE_BUILD_TYPE=Release explicitly re-asserted so a hypothetical
          # generator switch (Ninja Multi-Config) or wiped cache can't silently
          # run Debug binaries through ctest.
          cd build
          cmake .. -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON
          cmake --build . --parallel "$(nproc)" \
            --target notepatra_all_tests

      - name: Run regression suite
        run: |
          ls -lh build/notepatra
          file build/notepatra
          build/notepatra --version || true
          cd build
          QT_QPA_PLATFORM=offscreen ctest --output-on-failure

      # v0.1.118 — MCP sidecar; ships as notepatra-mcp-linux-x64.tar.gz.
      #
      # ORDERING LAW (all four platform jobs): `cargo test --features remote`
      # REBUILDS target/release/notepatra-mcp WITH remote compiled in, because
      # cargo unifies the bin's features when it builds the integration tests
      # that depend on it. So the LAST cargo invocation before the upload must
      # be a plain `cargo build --release`, and we then assert the flavor —
      # otherwise we would silently ship a crypto-linked sidecar.
      - name: Build and test MCP server
        timeout-minutes: 25
        run: |
          cd notepatra-mcp
          cargo test --release
          cargo test --release --features remote
          cargo build --release
          # Flavor assertion. `serve` is remote-only: a std-only build prints
          # "built without remote support" and exits 2 immediately.
          #
          # MUST be time-capped and backgrounded, NOT `OUT=$(... serve)`: on a
          # remote-ENABLED build `serve` binds a port and blocks forever, so a
          # command substitution would wait on an EOF that never comes and hang
          # the job — in precisely the failure case this exists to catch. A
          # hang is not a red state. Capped at 10s, then killed, then we judge
          # by what it printed. </dev/null so it can never wait on stdin.
          ./target/release/notepatra-mcp serve </dev/null >flavor.txt 2>&1 & PID=$!
          for _ in $(seq 1 20); do kill -0 $PID 2>/dev/null || break; sleep 0.5; done
          kill -9 $PID 2>/dev/null || true
          wait $PID 2>/dev/null || true
          grep -q "built without remote support" flavor.txt || { echo "::error::shipped sidecar unexpectedly has remote support compiled in"; cat flavor.txt; exit 1; }

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-x64
          path: build/notepatra

      - name: Upload MCP server artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-mcp-linux-x64
          path: notepatra-mcp/target/release/notepatra-mcp

      # v0.1.64 — "Full" flavor (bundles QtWebEngine). The lite binary
      # above is the default download; users who want inline Vega-Lite
      # chart rendering grab this -full artifact instead. CMake's
      # NOTEPATRA_WITH_WEBENGINE=ON flips on the WebEngine linkage and
      # the renderer's WebEngine code path. ~85 MB extra on disk; ships
      # alongside the lite artifact in every Release.
      - name: Build C++ (full flavor — WebEngine bundled)
        run: |
          rm -rf build-full && mkdir -p build-full && cd build-full
          # v0.1.107 — fetch + SHA-pin DuckDB v1.1.3 *C library* (NOT the CLI)
          # for the Full flavor. libduckdb-linux-amd64.zip ships libduckdb.so +
          # duckdb.h + duckdb.hpp at the zip root; CMake (Full) auto-detects it.
          mkdir -p ../vendor/duckdb
          curl -fL -o /tmp/libduckdb.zip https://github.com/duckdb/duckdb/releases/download/v1.1.3/libduckdb-linux-amd64.zip
          echo "81199bf01b6d49941a38f426cad60e73c1ccd43f1f769a65ed8097d53fc7e40b  /tmp/libduckdb.zip" | sha256sum -c - || { echo "::error::DuckDB x64 SHA256 mismatch"; exit 1; }
          unzip -o /tmp/libduckdb.zip -d ../vendor/duckdb
          test -f ../vendor/duckdb/libduckdb.so || { echo "::error::libduckdb.so missing after unzip"; exit 1; }
          cmake .. -DCMAKE_BUILD_TYPE=Release -DNOTEPATRA_WITH_WEBENGINE=ON
          make -j$(nproc)
          ls -lh notepatra
          ldd notepatra | grep -i webengine | head -3 || echo "WARN: full build did not link WebEngine"
          ldd notepatra | grep -i duckdb || { echo "::error::Full build did not link DuckDB"; exit 1; }
          # Stage libduckdb.so next to the binary so the $ORIGIN rpath resolves it.
          cp ../vendor/duckdb/libduckdb.so .
          # Runtime smoke test — v0.1.63 was a RUNTIME crash behind
          # #ifdef NOTEPATRA_WITH_WEBENGINE; a compile-clean / link-broken
          # binary would pass `ldd` and the lite ctest above, then crash in
          # the wild. Headless --version forces Qt+WebEngine to initialize.
          QT_QPA_PLATFORM=offscreen ./notepatra --version

      - name: Upload artifact (full flavor)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-x64-full
          path: |
            build-full/notepatra
            build-full/libduckdb.so

      # ─── v0.1.72: Fleet-grade Linux installers ───────────────────────
      # .deb + .rpm + AppImage for the regular (lite) flavor, plus a
      # cloud-free .deb (notepatra-local-ai) built from a second pass
      # with -DNOTEPATRA_NO_CLOUD=ON.  All three formats use the lite
      # binary; heavy bits stay opt-in per the project's bare-binary
      # policy.  Local Docker verification is in installers/{debian,rpm,
      # appimage}/build-*.sh — they're authoritative; if anything in this
      # block fails, the scripts themselves work standalone.
      - name: Build C++ (cloud-free flavor for local-ai .deb)
        run: |
          rm -rf build-nocloud && mkdir -p build-nocloud && cd build-nocloud
          cmake .. -DCMAKE_BUILD_TYPE=Release -DNOTEPATRA_NO_CLOUD=ON
          make -j$(nproc) notepatra
          ./notepatra --version

      - name: Install packaging deps
        run: |
          sudo apt-get install -y \
            patchelf fakeroot dpkg-dev rpm \
            curl ca-certificates file zsync libfuse2 \
            qt5-qmake qttranslations5-l10n libqt5svg5 \
            libxcb-cursor0 desktop-file-utils

      - name: Build .deb (regular + cloud-free)
        run: |
          VERSION=$(grep -E "^project.*VERSION" CMakeLists.txt | sed -E 's/.*VERSION ([0-9.]+).*/\1/')
          bash installers/debian/build-deb.sh "$VERSION" amd64 regular  build
          bash installers/debian/build-deb.sh "$VERSION" amd64 local-ai build-nocloud
          ls -lh notepatra*amd64.deb

      - name: Build .rpm
        run: |
          VERSION=$(grep -E "^project.*VERSION" CMakeLists.txt | sed -E 's/.*VERSION ([0-9.]+).*/\1/')
          bash installers/rpm/build-rpm.sh "$VERSION" x86_64 build
          ls -lh notepatra-*x86_64.rpm

      - name: Build AppImage (x86_64)
        run: |
          VERSION=$(grep -E "^project.*VERSION" CMakeLists.txt | sed -E 's/.*VERSION ([0-9.]+).*/\1/')
          bash installers/appimage/build-appimage.sh "$VERSION" x86_64 build
          ls -lh Notepatra-*x86_64.AppImage

      - name: Upload artifact (.deb regular)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-x64-deb
          path: notepatra_*_amd64.deb

      - name: Upload artifact (.deb local-ai cloud-free)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-x64-deb-local-ai
          path: notepatra-local-ai_*_amd64.deb

      - name: Upload artifact (.rpm)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-x64-rpm
          path: notepatra-*x86_64.rpm

      - name: Upload artifact (AppImage)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-x64-appimage
          path: Notepatra-*x86_64.AppImage

  build-linux-arm:
    runs-on: ubuntu-24.04-arm
    # Fail fast instead of burning the 360-minute default on a wedge.
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential cmake \
            qtbase5-dev libqscintilla2-qt5-dev \
            libqt5charts5-dev libqt5sql5-sqlite \
            qtwebengine5-dev libqt5webenginewidgets5 \
            libqt5svg5-dev qt5-image-formats-plugins

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-05-14

      - name: Audit Rust dependencies (cargo-audit)
        run: |
          cargo install --locked cargo-audit 2>&1 | tail -5 || true
          cd rust-core && cargo audit || echo "::warning::cargo-audit reported advisories — review them"

      - name: Build Rust core
        run: cd rust-core && cargo build --release

      - name: Build C++
        run: |
          mkdir -p build && cd build
          cmake .. -DCMAKE_BUILD_TYPE=Release
          make -j$(nproc)

      - name: Build regression tests (CMake targets)
        run: |
          # See x64 job — Release re-asserted so generator switches can't
          # silently swap Debug binaries into ctest.
          cd build
          cmake .. -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON
          cmake --build . --parallel "$(nproc)" \
            --target notepatra_all_tests

      - name: Run regression suite
        run: |
          ls -lh build/notepatra
          file build/notepatra
          build/notepatra --version || true
          cd build
          QT_QPA_PLATFORM=offscreen ctest --output-on-failure

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-arm64
          path: build/notepatra

      # v0.1.118 — MCP sidecar. Runs the full default + remote suites natively
      # on arm64 rather than trusting the x64 job: pointer-width and alignment
      # differences are exactly what a cross-arch suite exists to catch.
      # Same ordering law as the x64 job — plain build LAST, then assert flavor.
      - name: Build and test MCP server
        timeout-minutes: 25
        run: |
          cd notepatra-mcp
          cargo test --release
          cargo test --release --features remote
          cargo build --release
          # Time-capped flavor assertion — see the x64 job for why this cannot
          # be a plain command substitution.
          ./target/release/notepatra-mcp serve </dev/null >flavor.txt 2>&1 & PID=$!
          for _ in $(seq 1 20); do kill -0 $PID 2>/dev/null || break; sleep 0.5; done
          kill -9 $PID 2>/dev/null || true
          wait $PID 2>/dev/null || true
          grep -q "built without remote support" flavor.txt || { echo "::error::shipped sidecar unexpectedly has remote support compiled in"; cat flavor.txt; exit 1; }

      - name: Upload MCP server artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-mcp-linux-arm64
          path: notepatra-mcp/target/release/notepatra-mcp

      # v0.1.64 — Full flavor for ARM. Same dual-output pattern as x64.
      - name: Build C++ (full flavor — WebEngine bundled)
        run: |
          rm -rf build-full && mkdir -p build-full && cd build-full
          # v0.1.107 — fetch + SHA-pin DuckDB v1.1.3 C library (aarch64).
          mkdir -p ../vendor/duckdb
          curl -fL -o /tmp/libduckdb.zip https://github.com/duckdb/duckdb/releases/download/v1.1.3/libduckdb-linux-aarch64.zip
          echo "9069db3627456ab8b14399a73cd8d450c7863b1bc93b2b197d157ea18bad7801  /tmp/libduckdb.zip" | sha256sum -c - || { echo "::error::DuckDB arm64 SHA256 mismatch"; exit 1; }
          unzip -o /tmp/libduckdb.zip -d ../vendor/duckdb
          test -f ../vendor/duckdb/libduckdb.so || { echo "::error::libduckdb.so missing after unzip"; exit 1; }
          cmake .. -DCMAKE_BUILD_TYPE=Release -DNOTEPATRA_WITH_WEBENGINE=ON
          make -j$(nproc)
          ls -lh notepatra
          ldd notepatra | grep -i webengine | head -3 || echo "WARN: full ARM build did not link WebEngine"
          ldd notepatra | grep -i duckdb || { echo "::error::Full ARM build did not link DuckDB"; exit 1; }
          # Stage libduckdb.so next to the binary so the $ORIGIN rpath resolves it.
          cp ../vendor/duckdb/libduckdb.so .
          # Runtime smoke test — see x64 job for v0.1.63 backstory.
          QT_QPA_PLATFORM=offscreen ./notepatra --version

      - name: Upload artifact (full flavor)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-arm64-full
          path: |
            build-full/notepatra
            build-full/libduckdb.so

      # ─── v0.1.72: Fleet-grade Linux installers (ARM64) ───────────────
      # Same .deb + .rpm matrix as x64.  No AppImage on ARM in this
      # release — linuxdeploy's aarch64 plugin support is less mature
      # and we want to ship a known-good initial set; ARM AppImage can
      # land in v0.1.73 after the v0.1.72 .deb/.rpm flow proves out.
      - name: Build C++ (cloud-free flavor for local-ai .deb)
        run: |
          rm -rf build-nocloud && mkdir -p build-nocloud && cd build-nocloud
          cmake .. -DCMAKE_BUILD_TYPE=Release -DNOTEPATRA_NO_CLOUD=ON
          make -j$(nproc) notepatra
          ./notepatra --version

      - name: Install packaging deps
        run: |
          sudo apt-get install -y patchelf fakeroot dpkg-dev rpm

      - name: Build .deb (regular + cloud-free)
        run: |
          VERSION=$(grep -E "^project.*VERSION" CMakeLists.txt | sed -E 's/.*VERSION ([0-9.]+).*/\1/')
          bash installers/debian/build-deb.sh "$VERSION" arm64 regular  build
          bash installers/debian/build-deb.sh "$VERSION" arm64 local-ai build-nocloud
          ls -lh notepatra*arm64.deb

      - name: Build .rpm
        run: |
          VERSION=$(grep -E "^project.*VERSION" CMakeLists.txt | sed -E 's/.*VERSION ([0-9.]+).*/\1/')
          bash installers/rpm/build-rpm.sh "$VERSION" aarch64 build
          ls -lh notepatra-*aarch64.rpm

      - name: Upload artifact (.deb regular ARM)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-arm64-deb
          path: notepatra_*_arm64.deb

      - name: Upload artifact (.deb local-ai ARM)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-arm64-deb-local-ai
          path: notepatra-local-ai_*_arm64.deb

      - name: Upload artifact (.rpm ARM)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-linux-arm64-rpm
          path: notepatra-*aarch64.rpm

  # Note: Intel Mac (macos-13) build was removed — Apple stopped selling Intel Macs in 2023,
  # and the macos-13 free runner has been unreliable. Apple Silicon build covers all current
  # Macs (M1/M2/M3/M4). Intel Mac users can build from source.

  build-macos-arm:
    runs-on: macos-14
    # Fail fast instead of burning the 360-minute default on a wedge.
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install dependencies
        run: |
          brew install qt@5 cmake
          QT_PATH=$(brew --prefix qt@5)
          export PATH="$QT_PATH/bin:$PATH"
          export PKG_CONFIG_PATH="$QT_PATH/lib/pkgconfig:$PKG_CONFIG_PATH"
          curl -L -o qscintilla.tar.gz \
            "https://www.riverbankcomputing.com/static/Downloads/QScintilla/2.14.1/QScintilla_src-2.14.1.tar.gz"
          tar xzf qscintilla.tar.gz
          cd QScintilla_src-2.14.1/src
          "$QT_PATH/bin/qmake" qscintilla.pro
          make VERBOSE=1 2>&1 | tail -200
          sudo make install
          echo "=== Verify QScintilla install ==="
          ls -la "$QT_PATH/lib/"libqscintilla2* 2>/dev/null || true
          ls -la "$QT_PATH/include/Qsci/" 2>/dev/null | head -5 || true

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-05-14

      - name: Build Rust core
        run: cd rust-core && cargo build --release

      - name: Build C++
        run: |
          QT_PATH=$(brew --prefix qt@5)
          export PATH="$QT_PATH/bin:$PATH"

          # Find QScintilla wherever make install put it
          echo "=== Searching for QScintilla ==="
          find /opt/homebrew /usr/local -name "libqscintilla2*" 2>/dev/null
          find /opt/homebrew /usr/local -name "qsciscintilla.h" 2>/dev/null

          QSC_LIB=$(find /opt/homebrew /usr/local -name "libqscintilla2_qt5*dylib" 2>/dev/null | head -1)
          [ -z "$QSC_LIB" ] && QSC_LIB=$(find /opt/homebrew /usr/local -name "libqscintilla2*dylib" 2>/dev/null | head -1)
          [ -z "$QSC_LIB" ] && QSC_LIB=$(find /opt/homebrew /usr/local -name "libqscintilla2*" -not -name "*.dSYM" 2>/dev/null | head -1)

          QSC_HDR=$(find /opt/homebrew /usr/local -name "qsciscintilla.h" 2>/dev/null | head -1)
          QSC_INC=$(dirname $(dirname "$QSC_HDR"))

          echo "Lib: $QSC_LIB"
          echo "Inc: $QSC_INC"

          mkdir -p build && cd build
          cmake .. -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_PREFIX_PATH="$QT_PATH" \
            -DQSCINTILLA_INCLUDE="$QSC_INC" \
            -DQSCINTILLA_LIB="$QSC_LIB"
          make VERBOSE=1 2>&1 | tail -200

      - name: Build C++ (full flavor — WebEngine + DuckDB bundled)
        run: |
          QT_PATH=$(brew --prefix qt@5)
          export PATH="$QT_PATH/bin:$PATH"

          # Find QScintilla location (same as Lite build)
          echo "=== Searching for QScintilla =="
          QSC_LIB=$(find /opt/homebrew /usr/local -name "libqscintilla2_qt5*dylib" 2>/dev/null | head -1)
          [ -z "$QSC_LIB" ] && QSC_LIB=$(find /opt/homebrew /usr/local -name "libqscintilla2*dylib" 2>/dev/null | head -1)
          QSC_HDR=$(find /opt/homebrew /usr/local -name "qsciscintilla.h" 2>/dev/null | head -1)
          QSC_INC=$(dirname $(dirname "$QSC_HDR"))
          echo "Lib: $QSC_LIB"
          echo "Inc: $QSC_INC"

          # v0.1.107 — fetch + SHA-pin DuckDB v1.1.3 macOS universal C library
          mkdir -p vendor/duckdb
          curl -fL -o /tmp/libduckdb-osx.zip https://github.com/duckdb/duckdb/releases/download/v1.1.3/libduckdb-osx-universal.zip
          echo "35d2d1c7da9770ccd70590f50313045382a44d06070580c0abf4e8eb2cccc405  /tmp/libduckdb-osx.zip" | shasum -a 256 -c - || { echo "::error::DuckDB macOS SHA256 mismatch"; exit 1; }
          unzip -o /tmp/libduckdb-osx.zip -d vendor/duckdb
          test -f vendor/duckdb/libduckdb.dylib || { echo "::error::libduckdb.dylib missing after unzip"; exit 1; }
          echo "✓ DuckDB v1.1.3 verified and extracted"

          rm -rf build-full && mkdir -p build-full && cd build-full
          # macOS Full = DuckDB engine. Homebrew qt@5 dropped QtWebEngine
          # (Chromium CVEs) and there is no arm64-native Qt5 WebEngine, so the
          # WebEngine probe downgrades to a stub here — DuckDB is the macOS Full
          # feature. NOTEPATRA_FULL enables DuckDB regardless of WebEngine.
          cmake .. -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_PREFIX_PATH="$QT_PATH" \
            -DQSCINTILLA_INCLUDE="$QSC_INC" \
            -DQSCINTILLA_LIB="$QSC_LIB" \
            -DNOTEPATRA_FULL=ON
          make VERBOSE=1 2>&1 | tail -200
          # macOS links into an app bundle (MACOSX_BUNDLE), NOT a bare ./notepatra
          # like Linux. The binary lives at Notepatra.app/Contents/MacOS/Notepatra.
          BIN=Notepatra.app/Contents/MacOS/Notepatra
          test -f "$BIN" || { echo "::error::macOS Full binary not found at $BIN"; ls -lR . | head -40; exit 1; }
          ls -lh "$BIN"
          otool -L "$BIN" | grep -i webengine | head -3 || echo "note: macOS Full has no WebEngine (brew qt@5 dropped it) — DuckDB only"
          otool -L "$BIN" | grep -i duckdb || { echo "::error::Full build did not link DuckDB"; exit 1; }
          echo "✓ macOS Full binary built (DuckDB engine; WebEngine N/A on brew qt@5)"

      - name: Build and run regression suite
        # ctest's blanket TIMEOUT 600 is per-TEST, not per-step: a systemic wedge across ~48 tests still runs for hours without this.
        timeout-minutes: 75
        run: |
          # Reuse the same Qt5/QScintilla discovery the main build did by
          # reconfiguring the existing build tree with -DBUILD_TESTING=ON.
          QT_PATH=$(brew --prefix qt@5)
          QSC_LIB=$(find /opt/homebrew /usr/local -name "libqscintilla2_qt5*dylib" 2>/dev/null | head -1)
          QSC_HDR=$(find /opt/homebrew /usr/local -name "qsciscintilla.h" 2>/dev/null | head -1)
          QSC_INC=$(dirname $(dirname "$QSC_HDR"))
          cd build
          cmake .. -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_PREFIX_PATH="$QT_PATH" \
            -DQSCINTILLA_INCLUDE="$QSC_INC" \
            -DQSCINTILLA_LIB="$QSC_LIB" \
            -DBUILD_TESTING=ON
          cmake --build . --parallel "$(sysctl -n hw.ncpu)" \
            --target notepatra_all_tests
          QT_QPA_PLATFORM=offscreen ctest --output-on-failure

      - name: Create DMG
        run: |
          QT_PATH=/opt/homebrew/opt/qt@5
          export PATH="$QT_PATH/bin:$PATH"

          APP=build/Notepatra.app
          FW="$APP/Contents/Frameworks"
          mkdir -p "$FW"

          # ─── Step 1: macdeployqt bundles Qt frameworks for the main binary.
          # This also adds an LC_RPATH of @executable_path/../Frameworks to
          # notepatra, which is what lets @rpath/QtCore.framework/... resolve.
          echo "=== macdeployqt ==="
          macdeployqt "$APP"

          # ─── Step 1b: Bundle OpenSSL 3 dylibs — REQUIRED for QNetworkAccessManager HTTPS.
          # Homebrew's qt@5 is built --openssl-linked against openssl@3, and
          # macdeployqt does NOT copy OpenSSL. Without these dylibs, every
          # https:// request from the app silently fails with "TLS
          # initialization failed" on an end-user Mac — including the Help →
          # Check for Updates flow and the safe updater's SHA256SUMS fetch.
          OPENSSL_PREFIX=$(brew --prefix openssl@3 2>/dev/null || echo /opt/homebrew/opt/openssl@3)
          echo "=== OpenSSL source: $OPENSSL_PREFIX ==="
          for lib in libssl.3.dylib libcrypto.3.dylib; do
            SRC="$OPENSSL_PREFIX/lib/$lib"
            if [ ! -f "$SRC" ]; then
              echo "::error::$SRC missing — HTTPS will fail at runtime on user Macs"
              exit 1
            fi
            cp "$SRC" "$FW/$lib"
            chmod u+w "$FW/$lib"
            install_name_tool -id "@rpath/$lib" "$FW/$lib"
            echo "  ✓ bundled $lib"
          done
          # libssl links libcrypto via Homebrew absolute path — rewrite to @rpath.
          install_name_tool -change "$OPENSSL_PREFIX/lib/libcrypto.3.dylib" \
            "@rpath/libcrypto.3.dylib" "$FW/libssl.3.dylib" 2>/dev/null || true
          # Qt5Network.framework binary also references libssl/libcrypto via
          # Homebrew paths — rewrite those to @rpath so the bundle is portable.
          QTNET_BIN="$APP/Contents/Frameworks/QtNetwork.framework/Versions/5/QtNetwork"
          if [ -f "$QTNET_BIN" ]; then
            chmod u+w "$QTNET_BIN"
            install_name_tool -change "$OPENSSL_PREFIX/lib/libssl.3.dylib" \
              "@rpath/libssl.3.dylib" "$QTNET_BIN" 2>/dev/null || true
            install_name_tool -change "$OPENSSL_PREFIX/lib/libcrypto.3.dylib" \
              "@rpath/libcrypto.3.dylib" "$QTNET_BIN" 2>/dev/null || true
            echo "  ✓ rewrote QtNetwork OpenSSL refs → @rpath"
          fi

          # ─── Step 2: Copy QScintilla dylib into the bundle. macdeployqt
          # doesn't know about QScintilla, so we have to drop it in + rewrite
          # its load commands ourselves.
          QSC_SRC=$(find "$QT_PATH/lib" -name "libqscintilla2_qt5*.dylib" -type f 2>/dev/null | head -1)
          if [ -z "$QSC_SRC" ]; then
            QSC_SRC=$(find /opt/homebrew /usr/local -name "libqscintilla2_qt5*.dylib" -type f 2>/dev/null | head -1)
          fi
          if [ -z "$QSC_SRC" ]; then
            echo "::error::QScintilla dylib not found — bundle would be unusable"
            exit 1
          fi
          echo "QScintilla source: $QSC_SRC"
          cp "$QSC_SRC" "$FW/libqscintilla2_qt5.15.dylib"
          chmod u+w "$FW/libqscintilla2_qt5.15.dylib"

          QSC_BUNDLED="$FW/libqscintilla2_qt5.15.dylib"

          # ─── Step 3: Set libqscintilla2's own install_name to @rpath so
          # the main notepatra binary can find it via the LC_RPATH entry
          # macdeployqt added in step 1.
          install_name_tool -id "@rpath/libqscintilla2_qt5.15.dylib" "$QSC_BUNDLED"

          # ─── Step 4: Rewrite every /opt/homebrew or /usr/local reference
          # inside libqscintilla2 to use @rpath/<framework|dylib>. This
          # catches QScintilla's known quirk of baking literal '*' globs
          # into its LC_LOAD_DYLIB entries (e.g.
          # /opt/homebrew/*/QtPrintSupport.framework/Versions/5/QtPrintSupport)
          # which would otherwise crash dyld at launch.
          echo "=== Before rewrite ==="
          otool -L "$QSC_BUNDLED"
          otool -L "$QSC_BUNDLED" | tail -n +2 | awk '{print $1}' | while read -r DEP; do
            case "$DEP" in
              /opt/homebrew*|/usr/local*)
                if echo "$DEP" | grep -q "\.framework/"; then
                  FW_NAME=$(echo "$DEP" | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\1|')
                  FW_VER=$(echo "$DEP"  | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\2|')
                  NEW="@rpath/${FW_NAME}.framework/Versions/${FW_VER}/${FW_NAME}"
                else
                  NEW="@rpath/$(basename "$DEP")"
                fi
                echo "  rewrite: $DEP"
                echo "       -> $NEW"
                install_name_tool -change "$DEP" "$NEW" "$QSC_BUNDLED"
                ;;
            esac
          done
          echo "=== After rewrite ==="
          otool -L "$QSC_BUNDLED"

          # ─── Step 5: Ad-hoc re-sign libqscintilla2 so Gatekeeper accepts
          # the modified Mach-O load commands. Without this the modified
          # dylib has an invalid signature and dyld refuses to load it.
          codesign --force --sign - "$QSC_BUNDLED"

          # ─── Step 6: macdeployqt may not have bundled QtPrintSupport
          # (the main notepatra binary doesn't directly link it — only
          # libqscintilla2 does). Force-copy it if missing.
          if [ ! -d "$FW/QtPrintSupport.framework" ]; then
            echo "=== Copying QtPrintSupport.framework (macdeployqt skipped it) ==="
            cp -R "$QT_PATH/lib/QtPrintSupport.framework" "$FW/"
            # Rewrite the framework's own install_name and its Qt deps
            QTPS_BIN="$FW/QtPrintSupport.framework/Versions/5/QtPrintSupport"
            chmod u+w "$QTPS_BIN"
            install_name_tool -id "@rpath/QtPrintSupport.framework/Versions/5/QtPrintSupport" "$QTPS_BIN"
            otool -L "$QTPS_BIN" | tail -n +2 | awk '{print $1}' | while read -r DEP; do
              case "$DEP" in
                /opt/homebrew*|/usr/local*)
                  if echo "$DEP" | grep -q "\.framework/"; then
                    FW_NAME=$(echo "$DEP" | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\1|')
                    FW_VER=$(echo "$DEP"  | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\2|')
                    NEW="@rpath/${FW_NAME}.framework/Versions/${FW_VER}/${FW_NAME}"
                  else
                    NEW="@rpath/$(basename "$DEP")"
                  fi
                  install_name_tool -change "$DEP" "$NEW" "$QTPS_BIN"
                  ;;
              esac
            done
            codesign --force --sign - "$QTPS_BIN"
          fi

          # ─── Step 7: Final verification — no binary inside the bundle
          # should reference /opt/homebrew or /usr/local anymore.
          echo "=== Final bundle link audit ==="
          LEFTOVER=$(find "$APP" -type f \( -name "*.dylib" -o -name "*.framework" \) -o -perm +111 2>/dev/null | \
                     xargs -I{} sh -c 'otool -L "{}" 2>/dev/null | grep -E "/opt/homebrew|/usr/local" && echo "  ^ in: {}"' | head -40)
          if [ -n "$LEFTOVER" ]; then
            echo "::warning::Some bundled binaries still reference Homebrew paths:"
            echo "$LEFTOVER"
          else
            echo "✓ All bundled binaries use @rpath or system paths — no Homebrew absolutes"
          fi

          # ─── Step 8: Ad-hoc re-sign the whole bundle with hardened
          # runtime + entitlements so macOS Tahoe (26.0) will actually
          # let it launch. Without these flags, Tahoe silently rejects
          # ad-hoc-signed bundles at fork/exec time with no user-visible
          # error, just a failed launch. Order matters:
          #   1. Sign inner frameworks and dylibs first (deepest wins).
          #   2. Sign the main bundle with entitlements last.
          ENTITLEMENTS="$GITHUB_WORKSPACE/resources/entitlements.plist"
          if [ ! -f "$ENTITLEMENTS" ]; then
            echo "::error::entitlements.plist missing — Tahoe launch will fail"
            exit 1
          fi

          # Sign every dylib / framework binary inside the bundle with
          # hardened runtime so library validation doesn't reject them.
          find "$APP/Contents/Frameworks" -type f \( -name "*.dylib" -o -name "*.so" \) 2>/dev/null | \
            while read -r lib; do
              codesign --force --sign - --options runtime --timestamp=none "$lib" 2>/dev/null || true
            done
          find "$APP/Contents/Frameworks" -type d -name "*.framework" 2>/dev/null | \
            while read -r fw; do
              codesign --force --sign - --options runtime --timestamp=none "$fw" 2>/dev/null || true
            done
          # Plugin dylibs under Contents/PlugIns
          find "$APP/Contents/PlugIns" -type f -name "*.dylib" 2>/dev/null | \
            while read -r plug; do
              codesign --force --sign - --options runtime --timestamp=none "$plug" 2>/dev/null || true
            done

          # Sign the main bundle LAST with entitlements + hardened
          # runtime. This is what makes Tahoe's launch service happy.
          codesign --force --deep --sign - \
            --options runtime \
            --entitlements "$ENTITLEMENTS" \
            --timestamp=none \
            "$APP"

          # Verify the signature satisfies Gatekeeper's minimum bar.
          # spctl --assess will still warn (unsigned/unnotarized), but
          # `codesign -v` must pass or the app definitely won't launch.
          codesign -v --verbose=4 "$APP" || {
            echo "::error::codesign verification failed — Tahoe will reject this bundle"
            exit 1
          }
          echo "✓ Bundle signed with hardened runtime + entitlements"

          # ─── Step 9: Create the DMG
          #
          # hdiutil create intermittently fails with "Resource busy" on
          # CI runners when a previous mount hasn't fully settled. Retry
          # up to 3 times with an increasing pause — the workaround
          # documented in multiple well-known Qt CI pipelines.
          rm -f build/Notepatra.dmg
          for attempt in 1 2 3; do
            if hdiutil create -volname "Notepatra" -srcfolder "$APP" -ov \
                              -format UDZO -nospotlight build/Notepatra.dmg; then
              echo "✓ DMG built on attempt $attempt"
              break
            fi
            echo "hdiutil create failed (attempt $attempt) — detaching any stale volumes and retrying"
            hdiutil detach "/Volumes/Notepatra" -force 2>/dev/null || true
            sleep $((attempt * 3))
            if [ "$attempt" = "3" ]; then
              echo "::error::hdiutil create failed after 3 attempts"; exit 1
            fi
          done

      - name: Create DMG (full flavor)
        run: |
          QT_PATH=/opt/homebrew/opt/qt@5
          export PATH="$QT_PATH/bin:$PATH"

          APP=build-full/Notepatra.app
          FW="$APP/Contents/Frameworks"
          mkdir -p "$FW"

          # ─── Step 1: macdeployqt bundles Qt frameworks + QtWebEngine for Full build
          echo "=== macdeployqt (full) =="
          macdeployqt "$APP"

          # ─── Step 1b: Bundle OpenSSL 3 dylibs (same as Lite)
          OPENSSL_PREFIX=$(brew --prefix openssl@3 2>/dev/null || echo /opt/homebrew/opt/openssl@3)
          echo "=== OpenSSL source: $OPENSSL_PREFIX =="
          for lib in libssl.3.dylib libcrypto.3.dylib; do
            SRC="$OPENSSL_PREFIX/lib/$lib"
            if [ ! -f "$SRC" ]; then
              echo "::error::$SRC missing — HTTPS will fail at runtime on user Macs"
              exit 1
            fi
            cp "$SRC" "$FW/$lib"
            chmod u+w "$FW/$lib"
            install_name_tool -id "@rpath/$lib" "$FW/$lib"
            echo "  ✓ bundled $lib"
          done
          install_name_tool -change "$OPENSSL_PREFIX/lib/libcrypto.3.dylib" \
            "@rpath/libcrypto.3.dylib" "$FW/libssl.3.dylib" 2>/dev/null || true
          QTNET_BIN="$APP/Contents/Frameworks/QtNetwork.framework/Versions/5/QtNetwork"
          if [ -f "$QTNET_BIN" ]; then
            chmod u+w "$QTNET_BIN"
            install_name_tool -change "$OPENSSL_PREFIX/lib/libssl.3.dylib" \
              "@rpath/libssl.3.dylib" "$QTNET_BIN" 2>/dev/null || true
            install_name_tool -change "$OPENSSL_PREFIX/lib/libcrypto.3.dylib" \
              "@rpath/libcrypto.3.dylib" "$QTNET_BIN" 2>/dev/null || true
            echo "  ✓ rewrote QtNetwork OpenSSL refs → @rpath"
          fi

          # ─── Step 2: Copy QScintilla dylib (same as Lite)
          QSC_SRC=$(find "$QT_PATH/lib" -name "libqscintilla2_qt5*.dylib" -type f 2>/dev/null | head -1)
          if [ -z "$QSC_SRC" ]; then
            QSC_SRC=$(find /opt/homebrew /usr/local -name "libqscintilla2_qt5*.dylib" -type f 2>/dev/null | head -1)
          fi
          if [ -z "$QSC_SRC" ]; then
            echo "::error::QScintilla dylib not found — bundle would be unusable"
            exit 1
          fi
          echo "QScintilla source: $QSC_SRC"
          cp "$QSC_SRC" "$FW/libqscintilla2_qt5.15.dylib"
          chmod u+w "$FW/libqscintilla2_qt5.15.dylib"
          QSC_BUNDLED="$FW/libqscintilla2_qt5.15.dylib"
          install_name_tool -id "@rpath/libqscintilla2_qt5.15.dylib" "$QSC_BUNDLED"

          # ─── Step 3: Rewrite QScintilla deps (same rewrite logic as Lite)
          echo "=== Before rewrite ==="
          otool -L "$QSC_BUNDLED"
          otool -L "$QSC_BUNDLED" | tail -n +2 | awk '{print $1}' | while read -r DEP; do
            case "$DEP" in
              /opt/homebrew*|/usr/local*)
                if echo "$DEP" | grep -q "\.framework/"; then
                  FW_NAME=$(echo "$DEP" | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\1|')
                  FW_VER=$(echo "$DEP"  | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\2|')
                  NEW="@rpath/${FW_NAME}.framework/Versions/${FW_VER}/${FW_NAME}"
                else
                  NEW="@rpath/$(basename "$DEP")"
                fi
                echo "  rewrite: $DEP"
                echo "       -> $NEW"
                install_name_tool -change "$DEP" "$NEW" "$QSC_BUNDLED"
                ;;
            esac
          done
          echo "=== After rewrite ==="
          otool -L "$QSC_BUNDLED"
          codesign --force --sign - "$QSC_BUNDLED"

          # ─── Step 4: Handle QtPrintSupport.framework (same as Lite)
          if [ ! -d "$FW/QtPrintSupport.framework" ]; then
            echo "=== Copying QtPrintSupport.framework (macdeployqt skipped it) ==="
            cp -R "$QT_PATH/lib/QtPrintSupport.framework" "$FW/"
            QTPS_BIN="$FW/QtPrintSupport.framework/Versions/5/QtPrintSupport"
            chmod u+w "$QTPS_BIN"
            install_name_tool -id "@rpath/QtPrintSupport.framework/Versions/5/QtPrintSupport" "$QTPS_BIN"
            otool -L "$QTPS_BIN" | tail -n +2 | awk '{print $1}' | while read -r DEP; do
              case "$DEP" in
                /opt/homebrew*|/usr/local*)
                  if echo "$DEP" | grep -q "\.framework/"; then
                    FW_NAME=$(echo "$DEP" | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\1|')
                    FW_VER=$(echo "$DEP"  | sed -E 's|.*/([^/]+)\.framework/Versions/([^/]+)/.*|\2|')
                    NEW="@rpath/${FW_NAME}.framework/Versions/${FW_VER}/${FW_NAME}"
                  else
                    NEW="@rpath/$(basename "$DEP")"
                  fi
                  install_name_tool -change "$DEP" "$NEW" "$QTPS_BIN"
                  ;;
              esac
            done
            codesign --force --sign - "$QTPS_BIN"
          fi

          # ─── Step 5: Copy + rewrite libduckdb.dylib (Full-specific)
          echo "=== Bundling libduckdb.dylib ==="
          cp vendor/duckdb/libduckdb.dylib "$APP/Contents/MacOS/libduckdb.dylib"
          chmod u+w "$APP/Contents/MacOS/libduckdb.dylib"
          install_name_tool -id "@rpath/libduckdb.dylib" "$APP/Contents/MacOS/libduckdb.dylib"
          echo "  ✓ bundled libduckdb.dylib with @rpath id"
          # The MAIN binary references libduckdb by the upstream dylib's id, which
          # may NOT be @rpath/libduckdb.dylib. Rewrite whatever it references to
          # @rpath so it resolves to Contents/MacOS/libduckdb.dylib via the
          # @executable_path rpath baked in at link time — else the shipped app
          # would point at a CI build path and crash on a user's Mac.
          MACBIN="$APP/Contents/MacOS/Notepatra"
          DUCKREF=$(otool -L "$MACBIN" | awk '/libduckdb\.dylib/{print $1; exit}')
          if [ -z "$DUCKREF" ]; then
            echo "::error::main binary does not reference libduckdb.dylib at all"; exit 1
          fi
          if [ "$DUCKREF" != "@rpath/libduckdb.dylib" ]; then
            chmod u+w "$MACBIN"
            install_name_tool -change "$DUCKREF" "@rpath/libduckdb.dylib" "$MACBIN"
            echo "  ✓ rewrote main binary libduckdb ref: $DUCKREF -> @rpath/libduckdb.dylib"
          else
            echo "  ✓ main binary already references @rpath/libduckdb.dylib"
          fi
          # Prove it resolves: the @rpath ref + @executable_path rpath + the copy
          # in Contents/MacOS must all line up.
          otool -L "$MACBIN" | grep -i duckdb
          test -f "$APP/Contents/MacOS/libduckdb.dylib" || { echo "::error::libduckdb.dylib not next to binary"; exit 1; }

          # ─── Step 6: Final verification
          echo "=== Final bundle link audit ==="
          LEFTOVER=$(find "$APP" -type f \( -name "*.dylib" -o -name "*.framework" \) -o -perm +111 2>/dev/null | \
                     xargs -I{} sh -c 'otool -L "{}" 2>/dev/null | grep -E "/opt/homebrew|/usr/local" && echo "  ^ in: {}"' | head -40)
          if [ -n "$LEFTOVER" ]; then
            echo "::warning::Some bundled binaries still reference Homebrew paths:"
            echo "$LEFTOVER"
          else
            echo "✓ All bundled binaries use @rpath or system paths — no Homebrew absolutes"
          fi

          # ─── Step 7: Codesigning (same approach + pattern as Lite, including WebEngine helper)
          ENTITLEMENTS="$GITHUB_WORKSPACE/resources/entitlements.plist"
          if [ ! -f "$ENTITLEMENTS" ]; then
            echo "::error::entitlements.plist missing — Tahoe launch will fail"
            exit 1
          fi

          # Sign every dylib / framework binary including QtWebEngineProcess helper
          find "$APP/Contents/Frameworks" -type f \( -name "*.dylib" -o -name "*.so" \) 2>/dev/null | \
            while read -r lib; do
              codesign --force --sign - --options runtime --timestamp=none "$lib" 2>/dev/null || true
            done
          find "$APP/Contents/Frameworks" -type d -name "*.framework" 2>/dev/null | \
            while read -r fw; do
              codesign --force --sign - --options runtime --timestamp=none "$fw" 2>/dev/null || true
            done
          # QtWebEngineProcess helper (in Contents/Frameworks or Contents/PlugIns)
          if [ -f "$APP/Contents/Frameworks/QtWebEngineCore.framework/Helpers/QtWebEngineProcess.app/Contents/MacOS/QtWebEngineProcess" ]; then
            HELPER="$APP/Contents/Frameworks/QtWebEngineCore.framework/Helpers/QtWebEngineProcess.app"
            echo "=== Signing QtWebEngineProcess helper ==="
            codesign --force --sign - --options runtime --timestamp=none "$HELPER" 2>/dev/null || true
            echo "  ✓ signed $HELPER"
          fi
          # Plugin dylibs under Contents/PlugIns
          find "$APP/Contents/PlugIns" -type f -name "*.dylib" 2>/dev/null | \
            while read -r plug; do
              codesign --force --sign - --options runtime --timestamp=none "$plug" 2>/dev/null || true
            done
          # libduckdb.dylib in Contents/MacOS
          codesign --force --sign - --options runtime --timestamp=none "$APP/Contents/MacOS/libduckdb.dylib" 2>/dev/null || true

          # Sign the main bundle LAST with entitlements + hardened runtime
          codesign --force --deep --sign - \
            --options runtime \
            --entitlements "$ENTITLEMENTS" \
            --timestamp=none \
            "$APP"

          # Verify the signature
          codesign -v --verbose=4 "$APP" || {
            echo "::error::codesign verification failed — Tahoe will reject this bundle"
            exit 1
          }
          echo "✓ Full bundle signed with hardened runtime + entitlements"

          # ─── Step 8: Create the DMG
          rm -f build-full/Notepatra-full.dmg
          for attempt in 1 2 3; do
            if hdiutil create -volname "Notepatra" -srcfolder "$APP" -ov \
                              -format UDZO -nospotlight build-full/Notepatra-full.dmg; then
              echo "✓ Full DMG built on attempt $attempt"
              break
            fi
            echo "hdiutil create failed (attempt $attempt) — detaching any stale volumes and retrying"
            hdiutil detach "/Volumes/Notepatra" -force 2>/dev/null || true
            sleep $((attempt * 3))
            if [ "$attempt" = "3" ]; then
              echo "::error::hdiutil create failed after 3 attempts"; exit 1
            fi
          done

      - name: Upload DMG
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-macos-arm64
          path: build/Notepatra.dmg

      - name: Upload DMG (full flavor)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-macos-arm64-full
          path: build-full/Notepatra-full.dmg

      # v0.1.118 — MCP sidecar. As of v0.1.119 ALL FOUR platform jobs run both
      # the default (std-only) and the remote-feature suites natively; there is
      # no longer a single "canonical" test job. macOS additionally lipo's an
      # arm64+x86_64 universal binary, because .mcpb declares ONE `darwin` entry
      # and Claude Desktop on Intel Macs would otherwise get an unrunnable
      # slice. The universal binary is consumed ONLY by the .mcpb — the
      # standalone notepatra-mcp-macos-arm64.tar.gz stays arm64-thin so the
      # released filename keeps meaning what it says.
      #
      # Same ordering law as the linux jobs: `cargo test --features remote`
      # rebuilds the bin WITH remote, so the plain `cargo build --release` must
      # come last, and the flavor assertion proves it did.
      - name: Build and test MCP server (arm64 + x86_64 universal)
        timeout-minutes: 25
        run: |
          cd notepatra-mcp
          cargo test --release
          cargo test --release --features remote
          rustup target add x86_64-apple-darwin
          cargo build --release
          cargo build --release --target x86_64-apple-darwin
          # Time-capped flavor assertion — see the linux x64 job for why this
          # cannot be a plain command substitution.
          ./target/release/notepatra-mcp serve </dev/null >flavor.txt 2>&1 & PID=$!
          for _ in $(seq 1 20); do kill -0 $PID 2>/dev/null || break; sleep 0.5; done
          kill -9 $PID 2>/dev/null || true
          wait $PID 2>/dev/null || true
          grep -q "built without remote support" flavor.txt || { echo "::error::shipped sidecar unexpectedly has remote support compiled in"; cat flavor.txt; exit 1; }
          lipo -create -output target/notepatra-mcp-universal target/release/notepatra-mcp target/x86_64-apple-darwin/release/notepatra-mcp
          lipo -archs target/notepatra-mcp-universal | grep -q x86_64 || { echo "::error::universal sidecar missing x86_64 slice"; exit 1; }
          lipo -archs target/notepatra-mcp-universal | grep -q arm64 || { echo "::error::universal sidecar missing arm64 slice"; exit 1; }
          # Prove the x86_64 slice actually RUNS, not just that it links —
          # </dev/null so the stdio server sees EOF and exits instead of
          # blocking the job forever. Rosetta is absent on some hosted images,
          # so this is a warning, never a hard failure.
          if arch -x86_64 /usr/bin/true 2>/dev/null; then arch -x86_64 ./target/x86_64-apple-darwin/release/notepatra-mcp </dev/null >/dev/null && echo "x86_64 slice executed under Rosetta"; else echo "::warning::Rosetta unavailable — x86_64 slice not smoke-executed"; fi

      - name: Upload MCP server artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-mcp-macos-arm64
          path: notepatra-mcp/target/release/notepatra-mcp

      - name: Upload MCP server universal artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-mcp-macos-universal
          path: notepatra-mcp/target/notepatra-mcp-universal

  build-windows:
    # PINNED (v0.1.113) for determinism: both windows-latest AND windows-2025
    # now carry VS2026 (VS 18, MSVC 14.5x) as of mid-2026 — there is no hosted
    # VS2022 image left. VS2026's STL REMOVED stdext::make_checked_array_iterator,
    # which Qt 5.15.2's qlist.h:915 calls via QT_MAKE_CHECKED_ARRAY_ITERATOR, so
    # every QList-instantiating TU failed C2653/C3861 (this killed v0.1.113's
    # first two release runs). The ACTUAL fix is a force-included stdext shim
    # (src/msvc_stdext_shim.h, wired in CMakeLists); this pin just stops the
    # runner image from moving under us again. Durable path later: KDE-patched
    # Qt 5.15 or the Qt6 migration (see project_qt6_migration_assessment).
    runs-on: windows-2025
    # HANG CONTAINMENT (v0.1.120). Without a job ceiling a wedge anywhere —
    # QScintilla nmake, CMake, NSIS/WiX, an exe probe blocked on a modal
    # Windows error box, or the regression suite — runs to GitHub's
    # 360-minute default and reports NOTHING. This is the outermost net;
    # the per-step ceilings below name the culprit, and the in-test
    # watchdogs name the individual test.
    timeout-minutes: 180
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Qt5
        uses: jurplel/install-qt-action@48d3ad6db93f3627c8ee7a0454bc6f3744f7e730 # v4.3.1
        with:
          version: '5.15.2'
          host: 'windows'
          target: 'desktop'
          arch: 'win64_msvc2019_64'
          # v0.1.43: qtcharts needed for inline AI Data Analyst charts.
          # v0.1.63: qtwebengine needed for the Vega-Lite chart renderer in
          # Data mode. Without it, NOTEPATRA_WITH_WEBENGINE auto-downgrades
          # to OFF and the renderer becomes a stub QLabel — degraded UX,
          # not a crash. We install qtwebengine here so users get a real
          # chart out of the box; CMake's auto-downgrade is the backstop.
          # Qt SQL is part of base Qt; SQLite driver also ships by default.
          modules: 'qtcharts qtwebengine'
          dir: '${{ runner.temp }}/Qt'

      - name: Install OpenSSL 1.1 runtime DLLs (for QNetworkAccessManager HTTPS)
        shell: pwsh
        run: |
          # Qt5 Network on Windows uses OpenSSL 1.1 for HTTPS. The prebuilt
          # Qt 5.15.2 from aqtinstall does NOT include these DLLs — so
          # QNetworkAccessManager silently fails every https:// request
          # with "TLS initialization failed" at runtime, which hits our
          # update checker (Help → Check for Updates) and the safe
          # updater's SHA256SUMS fetch.
          #
          # History of failed attempts on this CI:
          #   v1: aqtinstall tools_openssl_x64 — Qt removed it from their repo.
          #   v2: choco install openssl.light   — Chocolatey removed it too.
          #
          # Current approach: direct download from FireDaemon's public
          # OpenSSL archive. FireDaemon Technologies maintains signed,
          # reproducible OpenSSL 1.1 builds for Windows and has since
          # ~2017; the URL has been stable through multiple OpenSSL
          # point releases. Zip SHA-256 verified inline so a supply-chain
          # swap at the source would fail the build loudly.
          $dst = "${{ runner.temp }}/OpenSSL"
          $zip = "${{ runner.temp }}/openssl.zip"
          $url = "https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-1.1.1w.zip"
          Write-Host "Downloading $url"
          Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing
          Write-Host "=== zip size:"
          (Get-Item $zip).Length
          Expand-Archive -Path $zip -DestinationPath $dst -Force
          Write-Host "=== extracted tree:"
          Get-ChildItem -Path $dst -Recurse -Filter "*.dll" | Select-Object FullName
          # Verify the files we expect actually exist
          $libssl = Get-ChildItem -Path $dst -Recurse -Filter "libssl-1_1-x64.dll" -ErrorAction SilentlyContinue | Select-Object -First 1
          $libcrypto = Get-ChildItem -Path $dst -Recurse -Filter "libcrypto-1_1-x64.dll" -ErrorAction SilentlyContinue | Select-Object -First 1
          if (-not $libssl -or -not $libcrypto) {
            Write-Host "::error::FireDaemon zip didn't contain libssl/libcrypto-1_1-x64.dll"
            exit 1
          }
          Write-Host "  ✓ libssl-1_1-x64.dll       at $($libssl.FullName)"
          Write-Host "  ✓ libcrypto-1_1-x64.dll    at $($libcrypto.FullName)"

      - name: Setup MSVC
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
        with:
          arch: x64

      - name: Build QScintilla from official Riverbank source (qmake + nmake)
        id: qscintilla
        shell: pwsh
        run: |
          # ROOT CAUSE OF 12+ ITERATIONS: the previous code computed qtRoot via
          # `Resolve-Path "$env:Qt5_DIR\..\..\.."` which lands ONE LEVEL TOO HIGH
          # because install-qt-action's Qt5_DIR is at <root>\msvc2019_64\lib\cmake\Qt5
          # (note the \msvc2019_64\ arch dir). Going up 3 levels lands at
          # \5.15.2\ instead of \5.15.2\msvc2019_64\. Then $qtRoot\bin\windeployqt.exe
          # didn't exist and the bundle step bailed at Test-Path. The QScintilla
          # source build accidentally still worked because qmake was already on
          # PATH via install-qt-action's own PATH addition, not via our bogus
          # $qtRoot\bin\ prepend.
          #
          # Fix: discover qtRoot by FINDING qmake.exe directly under the runner
          # temp dir. This is install-qt-action-layout-agnostic.
          $qmakeExe = (Get-ChildItem -Path "$env:RUNNER_TEMP\Qt" -Recurse -Filter "qmake.exe" -ErrorAction SilentlyContinue | Where-Object { $_.FullName -notlike "*\debug\*" -and $_.FullName -notlike "*\Tools\*" } | Select-Object -First 1)
          if (-not $qmakeExe) {
            Write-Host "::error::qmake.exe not found anywhere under $env:RUNNER_TEMP\Qt"
            Write-Host "=== runner temp ==="
            Get-ChildItem -Path "$env:RUNNER_TEMP\Qt" -Recurse -Filter "*.exe" | Select-Object FullName | Format-Table -AutoSize
            exit 1
          }
          $qtRoot = (Split-Path -Parent (Split-Path -Parent $qmakeExe.FullName))
          Write-Host "Qt root (derived from qmake.exe location): $qtRoot"
          Write-Host "qmake.exe at: $($qmakeExe.FullName)"

          # Sanity-check the layout
          if (-not (Test-Path "$qtRoot\bin\qmake.exe"))         { Write-Host "::error::$qtRoot\bin\qmake.exe missing"; exit 1 }
          if (-not (Test-Path "$qtRoot\bin\windeployqt.exe"))   { Write-Host "::error::$qtRoot\bin\windeployqt.exe missing"; exit 1 }
          if (-not (Test-Path "$qtRoot\lib"))                    { Write-Host "::error::$qtRoot\lib missing"; exit 1 }
          if (-not (Test-Path "$qtRoot\plugins\platforms\qwindows.dll")) { Write-Host "::error::$qtRoot\plugins\platforms\qwindows.dll missing"; exit 1 }
          Write-Host "✓ Qt layout sanity check passed"

          # Make sure qmake from install-qt-action is on PATH
          $env:PATH = "$qtRoot\bin;$env:PATH"
          qmake --version
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::qmake not on PATH"; exit 1 }

          curl.exe -L -o qscintilla.tar.gz "https://www.riverbankcomputing.com/static/Downloads/QScintilla/2.14.1/QScintilla_src-2.14.1.tar.gz"
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::QScintilla source download failed"; exit 1 }

          tar xzf qscintilla.tar.gz
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::tar extract failed"; exit 1 }

          Set-Location QScintilla_src-2.14.1\src
          qmake qscintilla.pro
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::qmake failed"; exit 1 }

          nmake
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::nmake build failed"; exit 1 }

          nmake install
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::nmake install failed"; exit 1 }
          Set-Location ..\..

          # nmake install puts files into the Qt prefix that qmake was built
          # against. With install-qt-action's Qt that's $qtRoot. Verify both
          # the lib AND the headers actually landed there before we proceed.
          Write-Host "=== Searching for installed QScintilla artifacts under Qt prefix ==="
          Get-ChildItem -Path $qtRoot -Recurse -Filter "qscintilla2_qt5*" -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "  $($_.FullName)" }
          Get-ChildItem -Path $qtRoot -Recurse -Filter "qsciscintilla.h" -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "  $($_.FullName)" }

          # Locate the lib (release variant). Prefer qtRoot\lib explicitly.
          $lib = $null
          if (Test-Path "$qtRoot\lib\qscintilla2_qt5.lib") {
            $lib = "$qtRoot\lib\qscintilla2_qt5.lib"
          } else {
            $found = Get-ChildItem -Path $qtRoot -Recurse -Filter "qscintilla2_qt5.lib" -ErrorAction SilentlyContinue | Where-Object { $_.Name -notlike "*d.lib" } | Select-Object -First 1
            if ($found) { $lib = $found.FullName }
          }
          if (-not $lib) { Write-Host "::error::qscintilla2_qt5.lib not found anywhere under $qtRoot — install failed silently"; exit 1 }

          # Locate the headers — find qsciscintilla.h, then walk up to the dir
          # that contains Qsci/ as a subdirectory (find_path semantics).
          $hdr = $null
          if (Test-Path "$qtRoot\include\Qsci\qsciscintilla.h") {
            $hdr = "$qtRoot\include\Qsci\qsciscintilla.h"
          } else {
            $found = Get-ChildItem -Path $qtRoot -Recurse -Filter "qsciscintilla.h" -ErrorAction SilentlyContinue | Select-Object -First 1
            if ($found) { $hdr = $found.FullName }
          }
          if (-not $hdr) { Write-Host "::error::qsciscintilla.h not found anywhere under $qtRoot"; exit 1 }
          $inc = (Split-Path -Parent (Split-Path -Parent $hdr))

          # Sanity check: every lexer header that the user reported broken
          # MUST exist at the include path or this build will be broken
          # exactly the same way.
          $required = @("qsciscintilla.h", "qscilexerjson.h", "qscilexersql.h", "qscilexermarkdown.h")
          foreach ($h in $required) {
            $p = Join-Path $inc "Qsci\$h"
            if (-not (Test-Path $p)) {
              Write-Host "::error::Required lexer header missing: $p"
              Write-Host "         The QScintilla build is incomplete — refusing to proceed."
              exit 1
            }
            Write-Host "  ok: $p"
          }

          # Find the runtime DLL too (we'll need to bundle it later).
          $dll = (Get-ChildItem -Path $qtRoot -Recurse -Filter "qscintilla2_qt5.dll" -ErrorAction SilentlyContinue | Select-Object -First 1).FullName
          if (-not $dll) { Write-Host "::warning::qscintilla2_qt5.dll not found — runtime may fail" }

          Write-Host ""
          Write-Host "QScintilla lib: $lib"
          Write-Host "QScintilla inc: $inc"
          Write-Host "QScintilla dll: $dll"
          "QSC_LIB=$lib" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "QSC_INC=$inc" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "QSC_DLL=$dll" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "QT_ROOT=$qtRoot" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "QSC_INSTALL=$qtRoot" | Out-File -FilePath $env:GITHUB_OUTPUT -Append

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-05-14

      - name: Build Rust core
        shell: cmd
        run: cd rust-core && cargo build --release

      # MCP sidecar (Windows, x86_64-pc-windows-msvc — the runner default).
      # Named-pipe transport shipped in v0.1.119 (src/transport/socket.rs
      # cfg(windows)), so a prebuilt Windows binary is honest now. Canonical
      # unit tests run in the linux x64 job; we ALSO run tests here because
      # this is the only job that compiles the cfg(windows) pipe code —
      # tests/socket_bridge.rs is #![cfg(unix)] and compiles to empty, the
      # protocol + mock-transport suites are OS-neutral.
      # Ordering law (see the linux x64 job): the remote-feature test run
      # rebuilds the bin WITH remote compiled in, so the plain build comes LAST.
      # `--test-threads=1` (v0.1.120): tests/pipe_bridge.rs drives REAL named
      # pipes, and under the default parallel harness a hang cannot be pinned on
      # a test — absence of an "ok" line only means "not finished yet", which is
      # exactly how a previous incident burned two ~80-minute cycles. Serial
      # order makes the stdout log alone name the culprit. These suites are
      # ~3 s total, so serializing costs nothing.
      - name: Build and test MCP server
        timeout-minutes: 25
        shell: cmd
        run: cd notepatra-mcp && del /q "%TEMP%\np-*-tracker.log" 2>nul & cargo build --release && cargo test --release -- --test-threads=1 && cargo test --release --features remote -- --test-threads=1 && cargo build --release

      # Every transport suite (named pipe, unix socket, loopback gateway) arms a
      # watchdog that ABORTS on a hang, and abort DISCARDS libtest's captured
      # output — so the culprit's name is written to a file instead. Globbed,
      # not hard-coded to one suite: the previous version only knew about
      # np-pipe-bridge-tracker.log, so a hang in the remote-gateway suite would
      # have printed "no tracker file" and named nothing.
      # `always()` because the only run that matters is the failing one.
      - name: Transport test trackers (localize a hang)
        if: always()
        shell: cmd
        run: |
          if exist "%TEMP%\np-*-tracker.log" (
            for %%F in ("%TEMP%\np-*-tracker.log") do (
              echo === %%~nxF ===
              type "%%F"
            )
            echo === an ENTER with no matching LEAVE is the test that hung ===
          ) else (
            echo no tracker file — no transport suite reached its first test
          )

      # Read the PE version resource back off the built .exe.
      #
      # resources/notepatra.rc carried a hardcoded FILEVERSION 0,1,0,0 for 124
      # releases, so winget / SCCM / Intune and File Properties reported 0.1.0
      # on every machine ever. It is now generated from project(Notepatra
      # VERSION ...) — and this gate is what keeps it that way, because nothing
      # else on any platform can observe an embedded Windows resource.
      # Separate step because the assertion needs pwsh string matching, and cmd
      # has no clean equivalent. `serve` on a std-only build exits 2 after
      # printing this, so we match on the text rather than the exit code.
      - name: Assert shipped MCP server is std-only
        shell: pwsh
        working-directory: notepatra-mcp
        run: |
          # Start-Process + WaitForExit(10s) rather than `$out = & ... | Out-String`
          # for the same reason as the Unix jobs: a remote-ENABLED build's
          # `serve` binds a port and never returns, and the pipeline would block
          # forever instead of failing. Kill at 10s, then judge by the output.
          $p = Start-Process -FilePath .\target\release\notepatra-mcp.exe -ArgumentList 'serve' `
                 -RedirectStandardOutput flavor.txt -RedirectStandardError flavor.err `
                 -PassThru -NoNewWindow
          if (-not $p.WaitForExit(10000)) { $p.Kill(); $p.WaitForExit() }
          $out = ((Get-Content flavor.txt -Raw -ErrorAction SilentlyContinue) + (Get-Content flavor.err -Raw -ErrorAction SilentlyContinue))
          if ($out -notmatch 'built without remote support') { Write-Host '::error::shipped sidecar unexpectedly has remote support compiled in'; Write-Host $out; exit 1 }

      - name: Build C++ with CMake (MSVC)
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path build -Force | Out-Null
          Set-Location build
          # CMAKE_PREFIX_PATH must point to the Qt root, NOT to Qt5_DIR
          # (Qt5_DIR is <root>/lib/cmake/Qt5 — too deep). Use the root so
          # find_package(Qt5) and find_path/find_library both work.
          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          # v0.1.44 — derive the CMake VS generator from whatever
          # Visual Studio major version the MSVC dev shell exposed in
          # $env:VisualStudioVersion. GitHub's windows-latest runner
          # image rolled from VS 17 2022 to VS 18 2026 in May 2026 and
          # a hard pin to "Visual Studio 17 2022" broke configure
          # ("could not find any instance of Visual Studio"). The shell
          # var travels with the toolset, so this stays correct if the
          # runner rolls forward or back.
          $vsMajor = 0
          if ($env:VisualStudioVersion) {
              $vsMajor = [int]($env:VisualStudioVersion.Split('.')[0])
          }
          switch ($vsMajor) {
              18 { $vsGen = "Visual Studio 18 2026" }
              17 { $vsGen = "Visual Studio 17 2022" }
              default {
                  Write-Host "::warning::Unrecognised VisualStudioVersion='$($env:VisualStudioVersion)'; falling back to VS 17 2022."
                  $vsGen = "Visual Studio 17 2022"
              }
          }
          Write-Host "Using CMake generator: $vsGen  (from VisualStudioVersion=$($env:VisualStudioVersion))"
          cmake .. -G "$vsGen" -A x64 `
            "-DCMAKE_PREFIX_PATH=$qtRoot" `
            "-DQSCINTILLA_INCLUDE=${{ steps.qscintilla.outputs.QSC_INC }}" `
            "-DQSCINTILLA_LIB=${{ steps.qscintilla.outputs.QSC_LIB }}" 2>&1 | Tee-Object -FilePath ../cmake-configure.log
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::cmake configure failed"; exit 1 }
          cmake --build . --config Release 2>&1 | Tee-Object -FilePath ../cmake-build.log
          $buildExit = $LASTEXITCODE
          Write-Host "=== First 100 lines of cmake build output ==="
          Get-Content ../cmake-build.log | Select-Object -First 100 | ForEach-Object { Write-Host $_ }
          Write-Host "=== Errors and warnings only ==="
          Get-Content ../cmake-build.log | Select-String -Pattern "error|fatal" | Select-Object -First 50 | ForEach-Object { Write-Host $_ }
          Write-Host "=== Last 100 lines of cmake build output ==="
          Get-Content ../cmake-build.log -Tail 100 | ForEach-Object { Write-Host $_ }
          if ($buildExit -ne 0) { Write-Host "::error::cmake build failed (exit $buildExit)"; exit 1 }
          Write-Host "=== Searching for notepatra.exe ==="
          Get-ChildItem -Path . -Recurse -Filter "notepatra.exe" | ForEach-Object { Write-Host $_.FullName }

      - name: Verify exe, embed icon, bundle Qt + QScintilla DLLs
        shell: pwsh
        run: |
          # Hybrid bundle approach:
          # 1. Copy the exe + QScintilla DLL into the output dir
          # 2. Try windeployqt (twice — once on exe, once on QScintilla DLL)
          #    because it's convenient and handles version/edition specifics
          # 3. Fall through to MANUAL DLL copy as a fallback for anything
          #    windeployqt missed (most importantly: platforms\qwindows.dll)
          # 4. Final assertion that all critical files are present, fail
          #    loudly if not
          #
          # The manual fallback exists because windeployqt does NOT recursively
          # scan third-party DLLs (so qscintilla2_qt5.dll's QtWidgets dep is
          # invisible to it). Two parallel investigation agents converged on
          # this root cause.

          $exe = Get-ChildItem -Path build -Recurse -Filter "notepatra.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
          if (-not $exe) {
            Write-Host "::error::notepatra.exe not found anywhere under build/"
            Get-ChildItem -Path build -Recurse | Select-Object FullName
            exit 1
          }
          Write-Host "Found: $($exe.FullName) ($([math]::Round($exe.Length / 1MB, 2)) MB)"

          $outDir = "notepatra-win"
          New-Item -ItemType Directory -Path $outDir -Force | Out-Null
          Copy-Item $exe.FullName "$outDir\"

          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          $qtBin = "$qtRoot\bin"
          $qtPlugins = "$qtRoot\plugins"

          # Bundle the QScintilla DLL (windeployqt doesn't know about it)
          $qsciDll = "${{ steps.qscintilla.outputs.QSC_DLL }}"
          if ($qsciDll -and (Test-Path $qsciDll)) {
            Copy-Item $qsciDll "$outDir\"
            Write-Host "Bundled QScintilla DLL: $qsciDll"
          } else {
            # Search for it under qtRoot as a last resort
            $found = Get-ChildItem -Path $qtRoot -Recurse -Filter "qscintilla2_qt5.dll" -ErrorAction SilentlyContinue | Select-Object -First 1
            if ($found) {
              Copy-Item $found.FullName "$outDir\"
              Write-Host "Bundled QScintilla DLL (found via search): $($found.FullName)"
            } else {
              Write-Host "::error::qscintilla2_qt5.dll not found anywhere — exe will fail at startup"
              exit 1
            }
          }

          # ── Pass 1: try windeployqt (best effort, never fails the build) ──
          $windeployqt = "$qtRoot\bin\windeployqt.exe"
          if (Test-Path $windeployqt) {
            Write-Host ""
            Write-Host "════════════ windeployqt pass 1: notepatra.exe ════════════"
            & $windeployqt --release --compiler-runtime --no-translations --no-opengl-sw `
              --dir "$outDir" "$outDir\notepatra.exe" 2>&1
            $code1 = $LASTEXITCODE
            Write-Host "windeployqt pass 1 exit: $code1"

            Write-Host ""
            Write-Host "════════════ windeployqt pass 2: qscintilla2_qt5.dll ════════════"
            & $windeployqt --release --no-translations --no-opengl-sw `
              --dir "$outDir" "$outDir\qscintilla2_qt5.dll" 2>&1
            $code2 = $LASTEXITCODE
            Write-Host "windeployqt pass 2 exit: $code2"
          } else {
            Write-Host "::warning::windeployqt not at $windeployqt — skipping, manual copy will handle it"
          }

          # ── Manual DLL copy: deterministic fallback for everything windeployqt missed ──
          # This list is the EXACT set of files needed for a Qt5 Widgets desktop app
          # on Windows. We always copy them, even if windeployqt also did, because
          # Copy-Item -Force is idempotent and we'd rather have the file twice in
          # one place than zero times.
          Write-Host ""
          Write-Host "════════════ Manual DLL copy (deterministic fallback) ════════════"

          $coreDlls = @("Qt5Core.dll", "Qt5Gui.dll", "Qt5Widgets.dll", "Qt5Network.dll", "Qt5PrintSupport.dll")
          foreach ($dll in $coreDlls) {
            $src = Join-Path $qtBin $dll
            if (Test-Path $src) {
              Copy-Item $src "$outDir\" -Force
              Write-Host "  ✓ $dll"
            } else {
              Write-Host "  ✗ MISSING: $src"
            }
          }

          # ── OpenSSL 1.1 DLLs — REQUIRED for QNetworkAccessManager HTTPS ──
          # Without these, every https:// request from the app silently
          # fails with "TLS initialization failed" — Check for Updates
          # and the safe updater are both dead until these are present.
          # Sourced from the FireDaemon OpenSSL 1.1 download step earlier
          # in this job (Chocolatey openssl.light was deprecated and removed;
          # FireDaemon ships the libcrypto-1_1-x64 / libssl-1_1-x64 pair we
          # need). Search dirs below also cover legacy paths just in case.
          $opensslDlls = @("libcrypto-1_1-x64.dll", "libssl-1_1-x64.dll")
          $sslSearchDirs = @(
            "C:\Program Files\OpenSSL-Win64\bin",
            "C:\Program Files\OpenSSL\bin",
            "C:\tools\OpenSSL-Win64\bin",
            "${{ runner.temp }}/OpenSSL"
          )
          foreach ($dll in $opensslDlls) {
            $found = $null
            foreach ($d in $sslSearchDirs) {
              if (Test-Path "$d\$dll") { $found = "$d\$dll"; break }
            }
            # Fallback recursive search if none of the canonical paths hit
            if (-not $found) {
              foreach ($d in $sslSearchDirs) {
                if (Test-Path $d) {
                  $hit = Get-ChildItem -Path $d -Recurse -Filter $dll -ErrorAction SilentlyContinue | Select-Object -First 1
                  if ($hit) { $found = $hit.FullName; break }
                }
              }
            }
            if ($found) {
              Copy-Item $found "$outDir\" -Force
              Write-Host "  ✓ $dll (from $found)"
            } else {
              Write-Host "::error::$dll NOT FOUND — HTTPS will fail at runtime"
              exit 1
            }
          }

          # Qt plugins — must keep the subdirectory structure
          $plugins = @(
            @{src="platforms\qwindows.dll"; dest="platforms"},
            @{src="styles\qwindowsvistastyle.dll"; dest="styles"},
            @{src="imageformats\qico.dll"; dest="imageformats"},
            @{src="imageformats\qjpeg.dll"; dest="imageformats"},
            @{src="imageformats\qsvg.dll"; dest="imageformats"},
            @{src="iconengines\qsvgicon.dll"; dest="iconengines"},
            @{src="printsupport\windowsprintersupport.dll"; dest="printsupport"},
            @{src="bearer\qgenericbearer.dll"; dest="bearer"}
          )
          foreach ($p in $plugins) {
            $src = Join-Path $qtPlugins $p.src
            $destDir = Join-Path $outDir $p.dest
            New-Item -ItemType Directory -Path $destDir -Force | Out-Null
            if (Test-Path $src) {
              Copy-Item $src $destDir -Force
              Write-Host "  ✓ $($p.src)"
            } else {
              Write-Host "  ✗ MISSING: $src"
            }
          }

          $exeSizeKb = [math]::Round((Get-Item "$outDir\notepatra.exe").Length / 1KB)
          Write-Host ""
          Write-Host "notepatra.exe is $exeSizeKb KB"

          Write-Host ""
          Write-Host "════════════ Final bundle contents ════════════"
          Get-ChildItem $outDir -Recurse | Select-Object FullName, Length | Format-Table -AutoSize
          $totalSize = (Get-ChildItem $outDir -Recurse | Measure-Object Length -Sum).Sum / 1MB
          Write-Host "Total package size: $([math]::Round($totalSize, 1)) MB"

          # ── Critical-files assertion ──
          # If any of these are missing, the exe will crash before main() and
          # we should fail the build with a clear message instead of waiting
          # for the smoke test to surface a cryptic STATUS_DLL_NOT_FOUND.
          $critical = @(
            "$outDir\notepatra.exe",
            "$outDir\Qt5Core.dll",
            "$outDir\Qt5Gui.dll",
            "$outDir\Qt5Widgets.dll",
            "$outDir\qscintilla2_qt5.dll",
            "$outDir\platforms\qwindows.dll"
          )
          $missing = @()
          foreach ($f in $critical) {
            if (-not (Test-Path $f)) { $missing += $f }
          }
          if ($missing.Count -gt 0) {
            Write-Host "::error::Critical files missing from bundle:"
            foreach ($f in $missing) { Write-Host "  - $f" }
            exit 1
          }
          Write-Host "✓ All critical files present — exe should start"

          # Bundle the portable-zip file-association helper scripts so
          # users can right-click → "Open with" Notepatra for .py, .txt,
          # .md, etc. without needing the NSIS/MSI installer. These are
          # HKCU-only registry edits (no admin prompt).
          if (Test-Path "installers\register-associations.bat") {
            Copy-Item "installers\register-associations.bat" ".\notepatra-win\" -Force
          }
          if (Test-Path "installers\unregister-associations.bat") {
            Copy-Item "installers\unregister-associations.bat" ".\notepatra-win\" -Force
          }

      # MUST stay AFTER the bundle step. This asserts on a built artifact;
      # sitting above "Build C++ with CMake" it failed every run with
      # "not found" on a binary that did not exist yet.
      - name: Assert PE FileVersion matches the project version
        shell: pwsh
        run: |
          $cmakeVer = (Select-String -Path CMakeLists.txt `
              -Pattern 'project\(Notepatra VERSION ([0-9]+\.[0-9]+\.[0-9]+)' `
              | Select-Object -First 1).Matches.Groups[1].Value
          if (-not $cmakeVer) { Write-Host "::error::could not read version from CMakeLists.txt"; exit 1 }
          $expected = "$cmakeVer.0"
          # The SHIPPED exe, not the one still in the build tree: the bundle
          # step copies it out and embeds the icon, so this is the file a
          # user right-clicks -> Properties -> Details on.
          $exe = Get-ChildItem -Path notepatra-win -Filter notepatra.exe -ErrorAction SilentlyContinue | Select-Object -First 1
          if (-not $exe) { Write-Host "::error::notepatra.exe not found in notepatra-win/ - did the bundle step run?"; exit 1 }
          $actual = (Get-Item $exe.FullName).VersionInfo.FileVersion
          Write-Host "CMakeLists version : $cmakeVer"
          Write-Host "expected FileVersion: $expected"
          Write-Host "actual   FileVersion: $actual"
          if ($actual -ne $expected) {
            Write-Host "::error::PE FileVersion '$actual' != expected '$expected' — the .rc template did not substitute"
            exit 1
          }
          Write-Host "OK: PE version resource matches the project version"

      - name: Diagnose notepatra.exe imports + Qt plugin loading
        # Launches notepatra.exe: a Qt plugin-load stall or a modal error box would otherwise hang here forever.
        timeout-minutes: 5
        shell: pwsh
        run: |
          # Write all diagnostic output to BOTH stdout AND diag.log so the
          # issue-poster can grab the file content and ship it to issue #1.

          # Start a fresh diag.log
          "" | Out-File -FilePath diag.log -Encoding utf8

          function LogBoth($msg) {
            Write-Host $msg
            Add-Content -Path diag.log -Value $msg
          }
          function LogFile($file) {
            if (Test-Path $file) {
              $content = Get-Content $file -Raw
              Write-Host $content
              Add-Content -Path diag.log -Value $content
            }
          }

          LogBoth "════════════ dumpbin /dependents notepatra.exe ════════════"
          dumpbin /dependents .\notepatra-win\notepatra.exe 2>&1 | Tee-Object -FilePath dumpbin1.log
          LogFile dumpbin1.log

          LogBoth ""
          LogBoth "════════════ dumpbin /dependents qscintilla2_qt5.dll ════════════"
          if (Test-Path .\notepatra-win\qscintilla2_qt5.dll) {
            dumpbin /dependents .\notepatra-win\qscintilla2_qt5.dll 2>&1 | Tee-Object -FilePath dumpbin2.log
            LogFile dumpbin2.log
          } else {
            LogBoth "::error::qscintilla2_qt5.dll missing from bundle"
          }

          LogBoth ""
          LogBoth "════════════ Bundle contents ════════════"
          $bundleContents = (Get-ChildItem .\notepatra-win -Recurse | Select-Object FullName, Length | Format-Table -AutoSize | Out-String)
          Write-Host $bundleContents
          Add-Content -Path diag.log -Value $bundleContents

          LogBoth ""
          LogBoth "════════════ Verify Qt platform plugin exists ════════════"
          if (Test-Path .\notepatra-win\platforms\qwindows.dll) {
            LogBoth "✓ platforms\qwindows.dll present"
          } else {
            LogBoth "::error::platforms\qwindows.dll MISSING — exe will crash before main()"
          }

          LogBoth ""
          LogBoth "════════════ Probing notepatra.exe --version with QT_DEBUG_PLUGINS=1 ════════════"
          $env:QT_DEBUG_PLUGINS = "1"
          $env:PATH = "$PWD\notepatra-win;$env:PATH"
          # Capture stdout AND stderr (Qt plugin debug goes to stderr)
          & ".\notepatra-win\notepatra.exe" --version 2>&1 | Tee-Object -FilePath probe.log
          $probeExit = $LASTEXITCODE
          LogFile probe.log
          LogBoth ""
          LogBoth "════════════ Probe exit code: $probeExit ════════════"
          # Decode known Windows exit codes
          switch ($probeExit) {
            0           { LogBoth "  → exit 0 — exe ran successfully" }
            -1073741515 { LogBoth "  → STATUS_DLL_NOT_FOUND (0xC0000135) — a required DLL is missing" }
            -1073741819 { LogBoth "  → STATUS_ACCESS_VIOLATION (0xC0000005) — segfault" }
            -1073741701 { LogBoth "  → STATUS_INVALID_IMAGE_FORMAT (0xC000007B) — wrong-bitness DLL or corrupt import" }
            -1073741795 { LogBoth "  → STATUS_ILLEGAL_INSTRUCTION (0xC000001D)" }
            -1073740940 { LogBoth "  → STATUS_HEAP_CORRUPTION (0xC0000374)" }
            default     { LogBoth "  → unknown exit code" }
          }
          exit 0

      - name: Build C++ (full flavor — WebEngine + DuckDB bundled)
        shell: pwsh
        run: |
          # v0.1.107 — Full Windows variant bundles QtWebEngine (inline
          # Vega-Lite chart rendering) + DuckDB v1.1.3 C library. Build in
          # build-full\ with the same Qt/QScintilla discovery + flags
          # PLUS -DNOTEPATRA_WITH_WEBENGINE=ON.
          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          New-Item -ItemType Directory -Force -Path build-full | Out-Null
          Set-Location build-full

          # Download + SHA-pin DuckDB v1.1.3 C library (Windows x64)
          New-Item -ItemType Directory -Force -Path ..\vendor\duckdb | Out-Null
          Write-Host "Downloading DuckDB v1.1.3 for Windows x64"
          Invoke-WebRequest -Uri "https://github.com/duckdb/duckdb/releases/download/v1.1.3/libduckdb-windows-amd64.zip" `
            -OutFile "libduckdb.zip" -UseBasicParsing
          Write-Host "Verifying DuckDB SHA256"
          $hash = (Get-FileHash libduckdb.zip -Algorithm SHA256).Hash
          if ($hash -ne "c86390b0b5cbabf971e6446b5b59acddf661c098d076633f1f3c93f84b636c22") {
            Write-Host "::error::DuckDB SHA256 mismatch: got $hash"
            exit 1
          }
          Expand-Archive -Path libduckdb.zip -DestinationPath ..\vendor\duckdb -Force
          if (-not (Test-Path ..\vendor\duckdb\duckdb.dll)) {
            Write-Host "::error::duckdb.dll missing after unzip"
            exit 1
          }
          Remove-Item libduckdb.zip

          # CMake configure + build with WebEngine + DuckDB
          $vsMajor = 0
          if ($env:VisualStudioVersion) {
              $vsMajor = [int]($env:VisualStudioVersion.Split('.')[0])
          }
          switch ($vsMajor) {
              18 { $vsGen = "Visual Studio 18 2026" }
              17 { $vsGen = "Visual Studio 17 2022" }
              default {
                  Write-Host "::warning::Unrecognised VisualStudioVersion; falling back to VS 17 2022."
                  $vsGen = "Visual Studio 17 2022"
              }
          }
          Write-Host "Using CMake generator: $vsGen"
          cmake .. -G "$vsGen" -A x64 `
            "-DCMAKE_PREFIX_PATH=$qtRoot" `
            "-DQSCINTILLA_INCLUDE=${{ steps.qscintilla.outputs.QSC_INC }}" `
            "-DQSCINTILLA_LIB=${{ steps.qscintilla.outputs.QSC_LIB }}" `
            -DNOTEPATRA_WITH_WEBENGINE=ON 2>&1 | Tee-Object -FilePath ..\cmake-configure-full.log
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::cmake configure (full) failed"; exit 1 }
          cmake --build . --config Release 2>&1 | Tee-Object -FilePath ..\cmake-build-full.log
          $buildExit = $LASTEXITCODE
          if ($buildExit -ne 0) { Write-Host "::error::cmake build (full) failed (exit $buildExit)"; exit 1 }
          Write-Host "=== Searching for notepatra.exe in full build ==="
          Get-ChildItem -Path . -Recurse -Filter "notepatra.exe" | ForEach-Object { Write-Host $_.FullName }
          if (-not (Test-Path "Release\notepatra.exe")) {
            Write-Host "::error::notepatra.exe not found in Release/ after full build"
            exit 1
          }
          Write-Host "✓ Full build complete"
          Set-Location ..

      - name: Bundle Full variant (WebEngine + DuckDB)
        shell: pwsh
        run: |
          # Mirror the Lite bundle logic but for the Full exe + WebEngine DLLs.
          # windeployqt on the full exe auto-bundles QtWebEngineProcess.exe,
          # .pak resources, ICU, and ANGLE DLLs.

          $exeFull = Get-ChildItem -Path build-full -Recurse -Filter "notepatra.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
          if (-not $exeFull) {
            Write-Host "::error::notepatra.exe not found in build-full/"
            exit 1
          }
          Write-Host "Found Full exe: $($exeFull.FullName) ($([math]::Round($exeFull.Length / 1MB, 2)) MB)"

          $outDirFull = "notepatra-win-full"
          New-Item -ItemType Directory -Path $outDirFull -Force | Out-Null
          Copy-Item $exeFull.FullName "$outDirFull\"

          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          $qtBin = "$qtRoot\bin"
          $qtPlugins = "$qtRoot\plugins"

          # Bundle the QScintilla DLL (same as Lite)
          $qsciDll = "${{ steps.qscintilla.outputs.QSC_DLL }}"
          if ($qsciDll -and (Test-Path $qsciDll)) {
            Copy-Item $qsciDll "$outDirFull\"
            Write-Host "Bundled QScintilla DLL: $qsciDll"
          } else {
            $found = Get-ChildItem -Path $qtRoot -Recurse -Filter "qscintilla2_qt5.dll" -ErrorAction SilentlyContinue | Select-Object -First 1
            if ($found) {
              Copy-Item $found.FullName "$outDirFull\"
              Write-Host "Bundled QScintilla DLL (via search): $($found.FullName)"
            } else {
              Write-Host "::error::qscintilla2_qt5.dll not found"
              exit 1
            }
          }

          # ── windeployqt on Full exe (bundles WebEngine: QtWebEngineProcess.exe + resources) ──
          $windeployqt = "$qtRoot\bin\windeployqt.exe"
          if (Test-Path $windeployqt) {
            Write-Host ""
            Write-Host "════════════ windeployqt (Full): notepatra.exe ════════════"
            & $windeployqt --release --compiler-runtime --no-translations --no-opengl-sw `
              --dir "$outDirFull" "$outDirFull\notepatra.exe" 2>&1
            $code1 = $LASTEXITCODE
            Write-Host "windeployqt (Full) exit: $code1"

            Write-Host ""
            Write-Host "════════════ windeployqt (Full): qscintilla2_qt5.dll ════════════"
            & $windeployqt --release --no-translations --no-opengl-sw `
              --dir "$outDirFull" "$outDirFull\qscintilla2_qt5.dll" 2>&1
            $code2 = $LASTEXITCODE
            Write-Host "windeployqt (Full) pass 2 exit: $code2"
          } else {
            Write-Host "::warning::windeployqt not found — manual copy will handle it"
          }

          # ── Manual DLL copy (same as Lite) ──
          Write-Host ""
          Write-Host "════════════ Manual DLL copy (Full) ════════════"
          $coreDlls = @("Qt5Core.dll", "Qt5Gui.dll", "Qt5Widgets.dll", "Qt5Network.dll", "Qt5PrintSupport.dll")
          foreach ($dll in $coreDlls) {
            $src = Join-Path $qtBin $dll
            if (Test-Path $src) {
              Copy-Item $src "$outDirFull\" -Force
              Write-Host "  ✓ $dll"
            } else {
              Write-Host "  ✗ MISSING: $src"
            }
          }

          # ── OpenSSL DLLs (HTTPS — same as Lite) ──
          $opensslDlls = @("libcrypto-1_1-x64.dll", "libssl-1_1-x64.dll")
          $sslSearchDirs = @(
            "C:\Program Files\OpenSSL-Win64\bin",
            "C:\Program Files\OpenSSL\bin",
            "C:\tools\OpenSSL-Win64\bin",
            "${{ runner.temp }}/OpenSSL"
          )
          foreach ($dll in $opensslDlls) {
            $found = $null
            foreach ($d in $sslSearchDirs) {
              if (Test-Path "$d\$dll") { $found = "$d\$dll"; break }
            }
            if (-not $found) {
              foreach ($d in $sslSearchDirs) {
                if (Test-Path $d) {
                  $hit = Get-ChildItem -Path $d -Recurse -Filter $dll -ErrorAction SilentlyContinue | Select-Object -First 1
                  if ($hit) { $found = $hit.FullName; break }
                }
              }
            }
            if ($found) {
              Copy-Item $found "$outDirFull\" -Force
              Write-Host "  ✓ $dll (from $found)"
            } else {
              Write-Host "::error::$dll NOT FOUND"
              exit 1
            }
          }

          # ── Qt plugins (same as Lite) ──
          $plugins = @(
            @{src="platforms\qwindows.dll"; dest="platforms"},
            @{src="styles\qwindowsvistastyle.dll"; dest="styles"},
            @{src="imageformats\qico.dll"; dest="imageformats"},
            @{src="imageformats\qjpeg.dll"; dest="imageformats"},
            @{src="imageformats\qsvg.dll"; dest="imageformats"},
            @{src="iconengines\qsvgicon.dll"; dest="iconengines"},
            @{src="printsupport\windowsprintersupport.dll"; dest="printsupport"},
            @{src="bearer\qgenericbearer.dll"; dest="bearer"}
          )
          foreach ($p in $plugins) {
            $src = Join-Path $qtPlugins $p.src
            $destDir = Join-Path $outDirFull $p.dest
            New-Item -ItemType Directory -Path $destDir -Force | Out-Null
            if (Test-Path $src) {
              Copy-Item $src $destDir -Force
              Write-Host "  ✓ $($p.src)"
            } else {
              Write-Host "  ✗ MISSING: $src"
            }
          }

          # ── Copy DuckDB DLL into bundle ──
          $duckdbDll = "vendor\duckdb\duckdb.dll"
          if (Test-Path $duckdbDll) {
            Copy-Item $duckdbDll "$outDirFull\" -Force
            Write-Host "  ✓ duckdb.dll"
          } else {
            Write-Host "::error::duckdb.dll not found at $duckdbDll"
            exit 1
          }

          # ── Bundle helper scripts (same as Lite) ──
          if (Test-Path "installers\register-associations.bat") {
            Copy-Item "installers\register-associations.bat" "$outDirFull\" -Force
          }
          if (Test-Path "installers\unregister-associations.bat") {
            Copy-Item "installers\unregister-associations.bat" "$outDirFull\" -Force
          }

          # ── Verify critical files + report ──
          Write-Host ""
          Write-Host "════════════ Full bundle contents ════════════"
          Get-ChildItem $outDirFull -Recurse | Select-Object FullName, Length | Format-Table -AutoSize
          $totalSize = (Get-ChildItem $outDirFull -Recurse | Measure-Object Length -Sum).Sum / 1MB
          Write-Host "Total Full bundle size: $([math]::Round($totalSize, 1)) MB"

          # Critical files
          $critical = @(
            "$outDirFull\notepatra.exe",
            "$outDirFull\Qt5Core.dll",
            "$outDirFull\Qt5Gui.dll",
            "$outDirFull\Qt5Widgets.dll",
            "$outDirFull\qscintilla2_qt5.dll",
            "$outDirFull\platforms\qwindows.dll",
            "$outDirFull\duckdb.dll"
          )
          $missing = @()
          foreach ($f in $critical) {
            if (-not (Test-Path $f)) { $missing += $f }
          }
          if ($missing.Count -gt 0) {
            Write-Host "::error::Critical files missing from Full bundle:"
            foreach ($f in $missing) { Write-Host "  - $f" }
            exit 1
          }
          Write-Host "✓ All critical files present in Full bundle"

      - name: Smoke-test the binary (--version output check)
        # This step EXPECTS a DLL_PROCESS_DETACH crash, which can raise a modal WER/missing-DLL box that blocks cmd /c forever.
        timeout-minutes: 5
        shell: pwsh
        run: |
          # Run notepatra.exe --version via cmd.exe with file redirection.
          # pwsh's `& "...exe"` output capture for native exes is unreliable
          # due to stream buffering quirks. cmd /c with > and 2>&1 works.
          #
          # We check the OUTPUT, not the exit code. Some Qt DLLs on Windows
          # have destructors that crash during DLL_PROCESS_DETACH when the
          # exe exits without ever creating QApplication (which is what
          # --version does). The destructor crash sets a non-zero process
          # exit code, but it does NOT affect the editor — users never exit
          # before QApplication starts. The lexer test (which DOES use
          # QApplication) is the real smoke test.

          $env:PATH = "$PWD\notepatra-win;$env:PATH"
          $outFile = "$PWD\smoke-output.txt"
          Write-Host "Running: cmd /c '.\notepatra-win\notepatra.exe --version > smoke-output.txt 2>&1'"

          # cmd /c is the only invocation method that reliably captures
          # native exe stdout to a file across pwsh versions.
          cmd /c ".\notepatra-win\notepatra.exe --version > `"$outFile`" 2>&1"
          $code = $LASTEXITCODE

          Write-Host "Captured output (smoke-output.txt):"
          if (Test-Path $outFile) {
            $output = Get-Content $outFile -Raw
            $output -split "`n" | ForEach-Object { Write-Host "  | $_" }
          } else {
            Write-Host "  (smoke-output.txt does not exist)"
            $output = ""
          }
          Write-Host ""
          Write-Host "Exit code: $code (informational — destructor cleanup may set this non-zero)"

          # Pass criterion: the exe printed its version banner. Since v0.1.107
          # the banner is flavor-aware — "Notepatra Lite v0.1.x" / "Notepatra
          # Full v0.1.x" (and "Notepatra Local AI Lite/Full ..." for cloud-free
          # builds), so the edition word sits between "Notepatra" and "v0.1".
          # Match with a wildcard between them so every flavor passes; a crash
          # or empty stdout still fails.
          if ($output -like "*Notepatra*v0.1*") {
            Write-Host "✓ Smoke test passed (exe printed a 'Notepatra <flavor> v0.1...' banner)"
          } else {
            Write-Host "::error::notepatra.exe did not print a 'Notepatra ... v0.1' banner to stdout"
            switch ($code) {
              -1073741515 { Write-Host "::error::STATUS_DLL_NOT_FOUND (0xC0000135)" }
              -1073741819 { Write-Host "::error::STATUS_ACCESS_VIOLATION (0xC0000005)" }
              -1073741701 { Write-Host "::error::STATUS_INVALID_IMAGE_FORMAT (0xC000007B)" }
              default     { Write-Host "::error::Unknown exit code $code" }
            }
            exit 1
          }

      - name: Build and run regression suite
        # ctest's blanket TIMEOUT 600 is per-TEST, not per-step: a systemic wedge across ~48 tests still runs for hours without this.
        # 150, not 45: this step legitimately takes ~64 min on Windows (the
        # MSVC + Qt test-target build dominates; ctest itself is ~3 min). A
        # ceiling set near the median KILLS HEALTHY RUNS — a 45 did exactly
        # that once, failing a job whose tests had all passed. These ceilings
        # exist to turn an hours-long wedge into minutes, so set them at >=2x
        # the observed maximum, never near the average. Runner performance
        # varies run to run, and the suite only grows.
        timeout-minutes: 150
        shell: pwsh
        run: |
          # Reconfigure the existing build tree with -DBUILD_TESTING=ON so the
          # full regression suite is registered through CTest using the SAME
          # Qt5 + QScintilla discovery the main exe used.
          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          Set-Location build
          # v0.1.44 — see the configure-step note above. Same VS-major
          # detection so the regression-suite reconfigure picks up
          # whatever VS the runner currently has installed.
          $vsMajor = 0
          if ($env:VisualStudioVersion) {
              $vsMajor = [int]($env:VisualStudioVersion.Split('.')[0])
          }
          switch ($vsMajor) {
              18 { $vsGen = "Visual Studio 18 2026" }
              17 { $vsGen = "Visual Studio 17 2022" }
              default {
                  Write-Host "::warning::Unrecognised VisualStudioVersion='$($env:VisualStudioVersion)'; falling back to VS 17 2022."
                  $vsGen = "Visual Studio 17 2022"
              }
          }
          Write-Host "Using CMake generator: $vsGen  (from VisualStudioVersion=$($env:VisualStudioVersion))"
          cmake .. -G "$vsGen" -A x64 `
            "-DCMAKE_PREFIX_PATH=$qtRoot" `
            "-DQSCINTILLA_INCLUDE=${{ steps.qscintilla.outputs.QSC_INC }}" `
            "-DQSCINTILLA_LIB=${{ steps.qscintilla.outputs.QSC_LIB }}" `
            -DBUILD_TESTING=ON
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::cmake reconfigure for test failed"; exit 1 }
          cmake --build . --config Release --target notepatra_all_tests
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::regression test build failed"; exit 1 }

          # Add Qt + bundled QScintilla DLLs to PATH so CTest can load them.
          $env:PATH = "$qtRoot\bin;$PWD\..\notepatra-win;$env:PATH"
          # Crash-localizer for test_mcp_bridge: ctest discards a crashed test's
          # captured output on Windows, so the test appends each section to this
          # file (survives the access violation); we print it below on failure.
          $env:NP_MCP_PROGRESS = "$env:RUNNER_TEMP\mcp_progress.log"
          if (Test-Path $env:NP_MCP_PROGRESS) { Remove-Item $env:NP_MCP_PROGRESS }
          $ctestLog = "$env:RUNNER_TEMP\ctest.log"
          ctest --output-on-failure -C Release 2>&1 | Tee-Object -FilePath $ctestLog
          $ctestExit = $LASTEXITCODE

          $enters = 0; $leaves = 0; $sectionFailures = 0
          if (Test-Path $env:NP_MCP_PROGRESS) {
            Write-Host "=== test_mcp_bridge section progress (ENTER without LEAVE = crashing section) ==="
            Get-Content $env:NP_MCP_PROGRESS | ForEach-Object {
              Write-Host $_
              if ($_ -like 'ENTER *')  { $enters++ }
              if ($_ -like 'LEAVE *')  { $leaves++ }
              if ($_ -like 'FAILED *') { $sectionFailures++ }
            }
            Write-Host "=== sections entered=$enters passed=$leaves failed=$sectionFailures ==="
          }

          # QtTest's own report, written by `-o <file>,txt` from the test's
          # main(). ctest printed NOTHING for this test even with
          # --output-on-failure — no PASS lines, no failing QCOMPARE, no line
          # number — so three failing sections cost a full cycle each just to
          # identify. This file is independent of ctest's capture and carries
          # actual-vs-expected plus file:line for every failure.
          $qtestLog = "$env:NP_MCP_PROGRESS.qtest.txt"
          if (Test-Path $qtestLog) {
            Write-Host "=== test_mcp_bridge QtTest report (failures with actual/expected + line) ==="
            Select-String -Path $qtestLog -Pattern '^(FAIL!|XFAIL|Totals:)' -Context 0,4 |
              ForEach-Object { Write-Host $_.Line; $_.Context.PostContext | ForEach-Object { Write-Host "    $_" } }
          }

          # NO tolerance clause here, deliberately. One previously existed, for a
          # "teardown crash" that turned out not to exist: the marker it relied
          # on wrote LEAVE even for a FAILED section, so three genuinely failing
          # tests read as "all sections passed, crashes at exit". With the marker
          # recording QTest::currentTestFailed(), the tracker reports
          # entered=76 passed=73 failed=3 and qExec returns normally — there is
          # no crash to forgive. Any failure here is a real failure; fail loudly.
          if ($ctestExit -ne 0) {
            Write-Host "::error::Windows regression suite FAILED"
            exit 1
          }

      # ─── Build the Windows installer with NSIS ───
      # Produces notepatra-setup-<VERSION>.exe which registers in "Installed
      # apps" via HKCU Uninstall key, generates uninstall.exe, creates Start
      # Menu + Desktop shortcuts, and optionally adds notepatra to the user
      # PATH. The runner image no longer ships NSIS pre-installed, so the
      # chocolatey fallback is the normal path; community.chocolatey.org
      # throws transient 504s, hence the retry + hard verify below.
      - name: Build Windows installer (NSIS)
        shell: pwsh
        run: |
          # Resolve version: tag → strip leading 'v' → '0.0.0' for non-tag builds.
          # Must be pure numeric X.X.X because NSIS's VIProductVersion needs X.X.X.X.
          $version = if ($env:GITHUB_REF -like "refs/tags/v*") {
              $env:GITHUB_REF.Substring(11)
          } else { "0.0.0" }
          Write-Host "Building installer for version: $version"

          # Locate makensis.exe
          $makensis = (Get-Command makensis.exe -ErrorAction SilentlyContinue).Source
          if (-not $makensis) {
              $nsisDir = "C:\Program Files (x86)\NSIS"
              if (Test-Path "$nsisDir\makensis.exe") {
                  $makensis = "$nsisDir\makensis.exe"
              }
          }
          if (-not $makensis) {
              Write-Host "::warning::NSIS not found on runner — installing via chocolatey"
              $makensis = "C:\Program Files (x86)\NSIS\makensis.exe"
              foreach ($attempt in 1..3) {
                  choco install nsis -y --no-progress
                  if (Test-Path $makensis) { break }
                  Write-Host "::warning::choco install nsis did not produce makensis.exe (attempt $attempt/3)"
                  if ($attempt -lt 3) { Start-Sleep -Seconds (30 * $attempt) }
              }
          }
          if (-not (Test-Path $makensis)) {
              Write-Host "::error::makensis.exe not found at $makensis — NSIS install failed after retries"
              exit 1
          }
          Write-Host "Using makensis: $makensis"

          # Run NSIS. SOURCE_DIR must be relative to installers/windows.nsi
          # and contain the fully-bundled notepatra-win/ directory.
          & $makensis /V3 "/DVERSION=$version" "/DSOURCE_DIR=..\notepatra-win" installers\windows.nsi
          if ($LASTEXITCODE -ne 0) {
              Write-Host "::error::NSIS compile failed (exit $LASTEXITCODE)"
              exit 1
          }

          # The script writes notepatra-setup-<version>.exe to the installers/ folder
          $installerExe = "installers\notepatra-setup-$version.exe"
          if (-not (Test-Path $installerExe)) {
              Write-Host "::error::Installer EXE missing at $installerExe"
              exit 1
          }
          $installerSize = [math]::Round((Get-Item $installerExe).Length / 1MB, 2)
          Write-Host "✓ Built $installerExe ($installerSize MB)"

          # Copy to workspace root so upload-artifact can pick it up easily
          Copy-Item $installerExe "notepatra-setup-$version.exe" -Force

      - name: Build Windows installer (NSIS Full)
        shell: pwsh
        run: |
          $version = if ($env:GITHUB_REF -like "refs/tags/v*") {
              $env:GITHUB_REF.Substring(11)
          } else { "0.0.0" }
          Write-Host "Building Full installer for version: $version"

          $makensis = (Get-Command makensis.exe -ErrorAction SilentlyContinue).Source
          if (-not $makensis) {
              $nsisDir = "C:\Program Files (x86)\NSIS"
              if (Test-Path "$nsisDir\makensis.exe") {
                  $makensis = "$nsisDir\makensis.exe"
              }
          }
          if (-not $makensis) {
              $makensis = "C:\Program Files (x86)\NSIS\makensis.exe"
              foreach ($attempt in 1..3) {
                  choco install nsis -y --no-progress
                  if (Test-Path $makensis) { break }
                  Write-Host "::warning::choco install nsis did not produce makensis.exe (attempt $attempt/3)"
                  if ($attempt -lt 3) { Start-Sleep -Seconds (30 * $attempt) }
              }
          }
          if (-not (Test-Path $makensis)) {
              Write-Host "::error::makensis.exe not found at $makensis — NSIS install failed after retries"
              exit 1
          }
          Write-Host "Using makensis: $makensis"

          & $makensis /V3 "/DVERSION=$version" "/DSOURCE_DIR=..\notepatra-win-full" installers\windows.nsi
          if ($LASTEXITCODE -ne 0) {
              Write-Host "::error::NSIS compile (Full) failed (exit $LASTEXITCODE)"
              exit 1
          }

          # Rename the exe to -full variant
          $installerExe = "installers\notepatra-setup-$version.exe"
          if (-not (Test-Path $installerExe)) {
              Write-Host "::error::Installer EXE missing at $installerExe"
              exit 1
          }
          $installerFull = "notepatra-setup-$version-full.exe"
          Move-Item $installerExe $installerFull -Force
          $installerSize = [math]::Round((Get-Item $installerFull).Length / 1MB, 2)
          Write-Host "✓ Built $installerFull ($installerSize MB)"

      # ─── Build the Windows MSI with WiX v3 ───
      # Produces notepatra-<VERSION>.msi — enterprise-grade installer with
      # proper upgrade codes, file-type associations, PATH integration, and
      # per-machine install. Preferred over NSIS for corporate/SCCM deploys.
      #
      # continue-on-error: MSI is a nice-to-have; the NSIS installer is the
      # primary distribution channel. If WiX has a hiccup we still ship the
      # .exe + portable .zip rather than block the whole Windows build.
      - name: Build Windows MSI (WiX)
        continue-on-error: true
        shell: pwsh
        run: |
          $version = if ($env:GITHUB_REF -like "refs/tags/v*") {
              $env:GITHUB_REF.Substring(11)
          } else { "0.0.0" }
          Write-Host "Building MSI for version: $version"

          # WiX v3 is pre-installed on windows-latest runners at this path
          $wixBin = "${env:WIX}bin"
          if (-not (Test-Path $wixBin)) {
              Write-Host "::warning::WiX not in WIX env var — installing via chocolatey"
              choco install wixtoolset -y --no-progress
              $wixBin = "C:\Program Files (x86)\WiX Toolset v3.14\bin"
              if (-not (Test-Path $wixBin)) {
                  $wixBin = "C:\Program Files (x86)\WiX Toolset v3.11\bin"
              }
          }
          Write-Host "Using WiX at: $wixBin"

          $candle = Join-Path $wixBin "candle.exe"
          $light  = Join-Path $wixBin "light.exe"
          $heat   = Join-Path $wixBin "heat.exe"

          # 1. Harvest all files from notepatra-win into a component group
          & $heat dir notepatra-win `
              -cg HarvestedComponents `
              -dr INSTALLFOLDER `
              -var var.SourceDir `
              -gg -g1 -sfrag -srd -sreg -scom `
              -out installers\HarvestedFiles.wxs
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::heat.exe failed"; exit 1 }

          # Remove the main executable from harvested file list — it's in
          # the hand-written wxs to avoid duplicate file components.
          (Get-Content installers\HarvestedFiles.wxs) `
              -replace '<Component[^>]*>[^<]*<File[^>]*notepatra\.exe[^>]*/>[^<]*</Component>','' `
              | Set-Content installers\HarvestedFiles.wxs

          # Also need to reference HarvestedComponents in the Feature — patch wxs
          (Get-Content installers\windows.wxs) `
              -replace '<!-- ComponentGroupRef Id="HarvestedComponents" / — injected at build time -->', `
                       '<ComponentGroupRef Id="HarvestedComponents" />' `
              | Set-Content installers\windows.wxs

          # 2. Compile both wxs files with candle
          & $candle -arch x64 "-dVersion=$version" "-dSourceDir=notepatra-win" `
              -ext WixUtilExtension `
              -out installers\ `
              installers\windows.wxs installers\HarvestedFiles.wxs
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::candle.exe failed"; exit 1 }

          # 3. Link into MSI with light
          & $light -ext WixUIExtension -ext WixUtilExtension `
              -cultures:en-us `
              -out "notepatra-$version.msi" `
              installers\windows.wixobj installers\HarvestedFiles.wixobj
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::light.exe failed"; exit 1 }

          if (-not (Test-Path "notepatra-$version.msi")) {
              Write-Host "::error::MSI missing after build"
              exit 1
          }
          $msiSize = [math]::Round((Get-Item "notepatra-$version.msi").Length / 1MB, 2)
          Write-Host "✓ Built notepatra-$version.msi ($msiSize MB)"

      - name: Build Windows MSI (WiX Full)
        continue-on-error: true
        shell: pwsh
        run: |
          $version = if ($env:GITHUB_REF -like "refs/tags/v*") {
              $env:GITHUB_REF.Substring(11)
          } else { "0.0.0" }
          Write-Host "Building Full MSI for version: $version"

          $wixBin = "${env:WIX}bin"
          if (-not (Test-Path $wixBin)) {
              $wixBin = "C:\Program Files (x86)\WiX Toolset v3.14\bin"
              if (-not (Test-Path $wixBin)) {
                  $wixBin = "C:\Program Files (x86)\WiX Toolset v3.11\bin"
              }
          }
          Write-Host "Using WiX at: $wixBin"

          $candle = Join-Path $wixBin "candle.exe"
          $light  = Join-Path $wixBin "light.exe"
          $heat   = Join-Path $wixBin "heat.exe"

          # Harvest Full bundle dir
          & $heat dir notepatra-win-full `
              -cg HarvestedComponentsFull `
              -dr INSTALLFOLDER `
              -var var.SourceDir `
              -gg -g1 -sfrag -srd -sreg -scom `
              -out installers\HarvestedFiles-full.wxs
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::heat (Full) failed"; exit 1 }

          # Remove main exe from harvested list
          (Get-Content installers\HarvestedFiles-full.wxs) `
              -replace '<Component[^>]*>[^<]*<File[^>]*notepatra\.exe[^>]*/>[^<]*</Component>','' `
              | Set-Content installers\HarvestedFiles-full.wxs

          # Create a copy of windows.wxs for the Full variant
          Copy-Item installers\windows.wxs installers\windows-full.wxs -Force
          # Inject the Full component group reference
          (Get-Content installers\windows-full.wxs) `
              -replace '<!-- ComponentGroupRef Id="HarvestedComponents" / — injected at build time -->', `
                       '<ComponentGroupRef Id="HarvestedComponentsFull" />' `
              | Set-Content installers\windows-full.wxs

          # Candle the Full variant
          & $candle -arch x64 "-dVersion=$version" "-dSourceDir=notepatra-win-full" `
              -ext WixUtilExtension `
              -out installers\full\ `
              installers\windows-full.wxs installers\HarvestedFiles-full.wxs
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::candle (Full) failed"; exit 1 }

          # Light the Full MSI
          & $light -ext WixUIExtension -ext WixUtilExtension `
              -cultures:en-us `
              -out "notepatra-$version-full.msi" `
              installers\full\windows-full.wixobj installers\full\HarvestedFiles-full.wixobj
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::light (Full) failed"; exit 1 }

          if (-not (Test-Path "notepatra-$version-full.msi")) {
              Write-Host "::error::Full MSI missing after build"
              exit 1
          }
          $msiSize = [math]::Round((Get-Item "notepatra-$version-full.msi").Length / 1MB, 2)
          Write-Host "✓ Built notepatra-$version-full.msi ($msiSize MB)"

      # ─── v0.1.72: Cloud-free Windows variant (notepatra-local-ai) ───
      # Second compile pass with -DNOTEPATRA_NO_CLOUD=ON produces a
      # notepatra.exe that physically refuses to talk to public LLM
      # endpoints (api.openai.com / api.anthropic.com / etc.).  We then
      # re-use the already-assembled notepatra-win/ directory (Qt + Qt
      # plugins + QScintilla DLL + Rust core) and just swap in the
      # cloud-free exe before re-running heat + candle + light with
      # -dNoCloud to flip the WiX wxs to the Notepatra Local AI variant
      # (different ProductName, UpgradeCode, install dir).
      - name: Build C++ (cloud-free flavor for local-ai MSI)
        continue-on-error: true
        shell: pwsh
        run: |
          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          New-Item -ItemType Directory -Force -Path build-nocloud | Out-Null
          Set-Location build-nocloud
          $vsMajor = 0
          if ($env:VisualStudioVersion) {
              $vsMajor = [int]($env:VisualStudioVersion.Split('.')[0])
          }
          switch ($vsMajor) {
              18 { $vsGen = "Visual Studio 18 2026" }
              17 { $vsGen = "Visual Studio 17 2022" }
              default {
                  Write-Host "::warning::Unrecognised VisualStudioVersion='$($env:VisualStudioVersion)'; falling back to VS 17 2022."
                  $vsGen = "Visual Studio 17 2022"
              }
          }
          cmake .. -G "$vsGen" -A x64 `
              "-DCMAKE_PREFIX_PATH=$qtRoot" `
              "-DQSCINTILLA_INCLUDE=${{ steps.qscintilla.outputs.QSC_INC }}" `
              "-DQSCINTILLA_LIB=${{ steps.qscintilla.outputs.QSC_LIB }}" `
              -DCMAKE_BUILD_TYPE=Release `
              -DNOTEPATRA_NO_CLOUD=ON
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::cmake configure (cloud-free) failed"; exit 1 }
          cmake --build . --config Release --target notepatra
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::cmake build (cloud-free) failed"; exit 1 }
          if (-not (Test-Path "Release\notepatra.exe")) {
              Write-Host "::error::cloud-free notepatra.exe missing"
              exit 1
          }

      - name: Build Windows MSI cloud-free (notepatra-local-ai)
        continue-on-error: true
        shell: pwsh
        run: |
          $version = if ($env:GITHUB_REF -like "refs/tags/v*") {
              $env:GITHUB_REF.Substring(11)
          } else { "0.0.0" }
          Write-Host "Building local-ai MSI for version: $version"

          $wixBin = "${env:WIX}bin"
          if (-not (Test-Path $wixBin)) {
              $wixBin = "C:\Program Files (x86)\WiX Toolset v3.14\bin"
              if (-not (Test-Path $wixBin)) {
                  $wixBin = "C:\Program Files (x86)\WiX Toolset v3.11\bin"
              }
          }
          $candle = Join-Path $wixBin "candle.exe"
          $light  = Join-Path $wixBin "light.exe"
          $heat   = Join-Path $wixBin "heat.exe"

          # Re-use the regular Windows bundle (Qt DLLs + Qt plugins +
          # QScintilla DLL + Rust core dll) but swap in the cloud-free
          # exe.  ~85 MB of shared DLLs not rebuilt redundantly.
          if (Test-Path notepatra-local-ai-win) {
              Remove-Item -Recurse -Force notepatra-local-ai-win
          }
          Copy-Item notepatra-win notepatra-local-ai-win -Recurse -Force
          Copy-Item build-nocloud\Release\notepatra.exe notepatra-local-ai-win\notepatra.exe -Force

          # Harvest the new bundle dir into its own component-group file.
          & $heat dir notepatra-local-ai-win `
              -cg HarvestedComponents `
              -dr INSTALLFOLDER `
              -var var.SourceDir `
              -gg -g1 -sfrag -srd -sreg -scom `
              -out installers\HarvestedFiles-local-ai.wxs
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::heat (local-ai) failed"; exit 1 }
          (Get-Content installers\HarvestedFiles-local-ai.wxs) `
              -replace '<Component[^>]*>[^<]*<File[^>]*notepatra\.exe[^>]*/>[^<]*</Component>','' `
              | Set-Content installers\HarvestedFiles-local-ai.wxs

          # candle: pass -dNoCloud so the wxs's <?ifdef NoCloud ?>
          # branches activate (ProductName, UpgradeCode, INSTALLFOLDER
          # all flip to the Notepatra Local AI variants).  Output goes
          # to installers\nocloud\ so we don't clobber the regular
          # MSI's already-built wixobj files.
          New-Item -ItemType Directory -Force -Path installers\nocloud | Out-Null
          & $candle -arch x64 -dNoCloud "-dVersion=$version" `
              "-dSourceDir=notepatra-local-ai-win" `
              -ext WixUtilExtension `
              -out installers\nocloud\ `
              installers\windows.wxs installers\HarvestedFiles-local-ai.wxs
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::candle (local-ai) failed"; exit 1 }

          & $light -ext WixUIExtension -ext WixUtilExtension `
              -cultures:en-us `
              -out "notepatra-local-ai-$version.msi" `
              installers\nocloud\windows.wixobj installers\nocloud\HarvestedFiles-local-ai.wixobj
          if ($LASTEXITCODE -ne 0) { Write-Host "::error::light (local-ai) failed"; exit 1 }

          if (-not (Test-Path "notepatra-local-ai-$version.msi")) {
              Write-Host "::error::local-ai MSI missing after build"
              exit 1
          }
          $msiSize = [math]::Round((Get-Item "notepatra-local-ai-$version.msi").Length / 1MB, 2)
          Write-Host "✓ Built notepatra-local-ai-$version.msi ($msiSize MB)"

      - name: Upload artifact (portable zip)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-x64
          path: notepatra-win/

      - name: Upload artifact (installer exe)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-installer
          path: notepatra-setup-*.exe
          if-no-files-found: ignore

      - name: Upload artifact (MSI)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-msi
          path: notepatra-0.*.msi
          if-no-files-found: ignore

      - name: Upload artifact (MSI cloud-free / local-ai)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-msi-local-ai
          path: notepatra-local-ai-*.msi
          if-no-files-found: ignore

      - name: Upload artifact (portable zip Full)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-x64-full
          path: notepatra-win-full/
          if-no-files-found: ignore

      - name: Upload artifact (installer exe Full)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-installer-full
          path: notepatra-setup-*-full.exe
          if-no-files-found: ignore

      - name: Upload artifact (MSI Full)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-windows-msi-full
          path: notepatra-*-full.msi
          if-no-files-found: ignore

      - name: Upload MCP server artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: notepatra-mcp-windows-x64
          path: notepatra-mcp/target/release/notepatra-mcp.exe

      # ─── Failure diagnostics — must be LAST so it sees failures from any prior step ───
      # `always()`, NOT `failure()`: a job CANCEL or a job TIMEOUT does not fire
      # `failure()`, so the one run whose logs matter most — the wedged one —
      # used to upload nothing. ctest.log and mcp_progress.log are included
      # because they name WHICH test was running; previously they were printed
      # only from inside the regression step, so if that step was the thing that
      # hung, the operator learned nothing at all.
      - name: Upload build logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: windows-build-logs
          path: |
            cmake-configure.log
            cmake-build.log
            ${{ runner.temp }}/ctest.log
            ${{ runner.temp }}/mcp_progress.log
            # Rust's env::temp_dir() is %TEMP% (C:\Users\runneradmin\AppData\
            # Local\Temp), which on Windows runners is NOT runner.temp
            # (D:\a\_temp) — globbing runner.temp here would silently upload
            # nothing. The printed "Transport test trackers" step already uses
            # %TEMP% correctly; this makes the artifact agree with it.
            ${{ env.TEMP }}/np-*-tracker.log
          if-no-files-found: ignore

      - name: Post Windows failure diagnostics to issue #1
        if: failure()
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: true
        run: |
          # When ANY prior step in the Windows job fails, dump as much state
          # as possible to issue #1 so we can read it via the public API
          # without needing GitHub auth. This step MUST be at the very end
          # of the job — if it's earlier, it gets evaluated and skipped
          # before later steps have a chance to fail.

          $sections = @()
          $sections += "# Windows CI failure on commit $env:GITHUB_SHA"
          $sections += ""
          $sections += "Run: https://github.com/$env:GITHUB_REPOSITORY/actions/runs/$env:GITHUB_RUN_ID"
          $sections += ""

          # diag.log first — this is the most important file. It contains the
          # output of running notepatra.exe with QT_DEBUG_PLUGINS=1 + dumpbin
          # /dependents. If the smoke test fails, the crash reason is here.
          if (Test-Path diag.log) {
            $sections += "## diag.log (notepatra.exe --version with QT_DEBUG_PLUGINS=1 + dumpbin)"
            $sections += '```'
            $sections += (Get-Content diag.log -Raw)
            $sections += '```'
          }

          # cmake-build.log (last 30 KB)
          if (Test-Path cmake-build.log) {
            $log = Get-Content cmake-build.log -Raw
            if ($log.Length -gt 30000) { $log = "...(truncated)...`n" + $log.Substring($log.Length - 30000) }
            $sections += "## cmake-build.log (last 30 KB)"
            $sections += '```'
            $sections += $log
            $sections += '```'
          }

          # bundle dir contents
          if (Test-Path notepatra-win) {
            $sections += ""
            $sections += "## notepatra-win\ contents (full recursive)"
            $sections += '```'
            $sections += (Get-ChildItem notepatra-win -Recurse | Select-Object FullName, Length | Format-Table -AutoSize | Out-String)
            $sections += '```'
          } else {
            $sections += ""
            $sections += "## notepatra-win\ DOES NOT EXIST (bundle step never reached)"
          }

          # build dir exe + dll listing
          if (Test-Path build) {
            $sections += ""
            $sections += "## build\ exe and dll files"
            $sections += '```'
            $sections += ((Get-ChildItem build -Recurse -Filter "*.exe" -ErrorAction SilentlyContinue | Select-Object FullName, Length | Out-String))
            $sections += ((Get-ChildItem build -Recurse -Filter "*.dll" -ErrorAction SilentlyContinue | Select-Object FullName, Length | Out-String))
            $sections += '```'
          }

          # QScintilla install discovery (was the dll built?)
          $qtRoot = "${{ steps.qscintilla.outputs.QT_ROOT }}"
          if ($qtRoot -and (Test-Path $qtRoot)) {
            $sections += ""
            $sections += "## QScintilla artifacts under $qtRoot"
            $sections += '```'
            $sections += ((Get-ChildItem -Path $qtRoot -Recurse -Filter "qscintilla2_qt5*" -ErrorAction SilentlyContinue | Select-Object FullName, Length | Out-String))
            $sections += '```'
          }

          # The step outputs we captured
          $sections += ""
          $sections += "## Step outputs from 'Build QScintilla'"
          $sections += "- QSC_LIB: ${{ steps.qscintilla.outputs.QSC_LIB }}"
          $sections += "- QSC_INC: ${{ steps.qscintilla.outputs.QSC_INC }}"
          $sections += "- QSC_DLL: ${{ steps.qscintilla.outputs.QSC_DLL }}"
          $sections += "- QT_ROOT: ${{ steps.qscintilla.outputs.QT_ROOT }}"

          $body = $sections -join "`n"
          $body | Out-File -FilePath fail-log.md -Encoding utf8

          $exists = gh issue view 1 --repo $env:GITHUB_REPOSITORY --json number 2>$null
          if ($LASTEXITCODE -eq 0) {
            gh issue edit 1 --repo $env:GITHUB_REPOSITORY --body-file fail-log.md
            Write-Host "Updated issue #1 with failure log"
          } else {
            gh issue create --repo $env:GITHUB_REPOSITORY --title "Windows CI failure log (auto)" --body-file fail-log.md
            Write-Host "Created issue #1 with failure log"
          }

  release:
    needs: [build-linux, build-linux-arm, build-macos-arm, build-windows]
    # Pinned to ubuntu-24.04 to match every other Linux job in this file.
    # Was previously ubuntu-latest, which would silently roll forward and
    # could shift cosign / SLSA action runtime expectations under our feet.
    runs-on: ubuntu-24.04
    # Fail fast instead of burning the 360-minute default on a wedge.
    timeout-minutes: 30
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write    # publish the release
      id-token: write    # cosign keyless OIDC signing
      attestations: write  # SLSA build provenance
      issues: write      # post-publish download-size drift issue
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8

      - name: Package
        run: |
          ls -la
          chmod +x notepatra-linux-x64/notepatra || true
          chmod +x notepatra-linux-arm64/notepatra || true
          tar czf notepatra-linux-x64.tar.gz -C notepatra-linux-x64 notepatra
          tar czf notepatra-linux-arm64.tar.gz -C notepatra-linux-arm64 notepatra
          # v0.1.118 — MCP sidecar tarballs (Linux x64/arm64 + macOS arm64;
          # Windows ships as a .zip below). Hard requirement: if a job
          # uploaded the dir, the binary must be in it.
          for P in linux-x64 linux-arm64 macos-arm64; do
            if [ -d "notepatra-mcp-$P" ]; then
              test -f "notepatra-mcp-$P/notepatra-mcp" || { echo "::error::notepatra-mcp-$P artifact dir missing the binary"; exit 1; }
              chmod +x "notepatra-mcp-$P/notepatra-mcp"
              tar czf "notepatra-mcp-$P.tar.gz" -C "notepatra-mcp-$P" notepatra-mcp
            else
              echo "::error::expected MCP artifact dir notepatra-mcp-$P is missing"; exit 1
            fi
          done
          # MCP sidecar Windows zip (zip, not tar — Windows convention).
          # NOTE the name is notepatra-mcp-windows-x64.zip — distinct from the
          # editor's notepatra-windows-x64.zip; every downstream list references
          # it by EXACT filename (prefix-collision lesson, 01d8f08).
          test -f notepatra-mcp-windows-x64/notepatra-mcp.exe || { echo "::error::notepatra-mcp-windows-x64 artifact dir missing notepatra-mcp.exe"; exit 1; }
          (cd notepatra-mcp-windows-x64 && zip ../notepatra-mcp-windows-x64.zip notepatra-mcp.exe)
          # v0.1.64 — Linux "full" flavor tarballs (bundles QtWebEngine for
          # inline Vega-Lite chart rendering). LINUX ONLY for the foreseeable
          # future — Charts Pack is downloaded on-demand on macOS/Windows
          # rather than bundled, so there's no -full artifact for those
          # platforms. If we ever ship bundled WebEngine for mac/Win, this
          # comment + the macOS/Windows jobs above need to grow full-flavor
          # build steps that mirror the Linux pattern.
          if [ -d notepatra-linux-x64-full ]; then
            chmod +x notepatra-linux-x64-full/notepatra
            # v0.1.107 — Full tarball now ships libduckdb.so next to the binary
            # ($ORIGIN rpath resolves it); fail loudly if the lib is missing.
            test -f notepatra-linux-x64-full/libduckdb.so || { echo "::error::x64 Full artifact missing libduckdb.so"; exit 1; }
            tar czf notepatra-linux-x64-full.tar.gz -C notepatra-linux-x64-full notepatra libduckdb.so
          fi
          if [ -d notepatra-linux-arm64-full ]; then
            chmod +x notepatra-linux-arm64-full/notepatra
            test -f notepatra-linux-arm64-full/libduckdb.so || { echo "::error::arm64 Full artifact missing libduckdb.so"; exit 1; }
            tar czf notepatra-linux-arm64-full.tar.gz -C notepatra-linux-arm64-full notepatra libduckdb.so
          fi
          cp notepatra-macos-arm64/Notepatra.dmg notepatra-macos-arm64.dmg
          if [ -d notepatra-macos-arm64-full ]; then
            # The macOS Full build uploads its DMG as Notepatra-full.dmg
            # (build.yml "Upload DMG (full flavor)" → path build-full/Notepatra-full.dmg),
            # NOT Notepatra.dmg. v0.1.107 is the first release to ship a macOS
            # Full DMG, so this path never ran before and the wrong basename
            # (Notepatra.dmg) hard-failed the Package step. Use the real name.
            cp notepatra-macos-arm64-full/Notepatra-full.dmg notepatra-macos-arm64-full.dmg
          fi
          if [ -d notepatra-windows-x64 ]; then
            cd notepatra-windows-x64 && zip -r ../notepatra-windows-x64.zip . && cd ..
          fi
          # Rename Windows installer to the canonical name used in release assets
          TAG="${GITHUB_REF##*/}"
          VERSION="${TAG#v}"
          if [ -d notepatra-windows-installer ]; then
            # Stage the LITE and FULL NSIS installers under DISTINCT canonical
            # names. The old `ls notepatra-setup-*.exe | head -1` lexically
            # picked notepatra-setup-X-full.exe ("-" 0x2D sorts before "." 0x2E)
            # and published the FULL build (WebEngine 102MB + DuckDB 29MB → ~81MB
            # installer) UNDER THE LITE NAME, while the real lite installer was
            # never staged for attachment. Same prefix-collision bug class as the
            # install.sh fix (01d8f08) — exact-match each variant instead of glob
            # + head -1. The downstream SHA256SUMS / cosign / softprops globs
            # (notepatra-setup-*.exe) then correctly pick up BOTH.
            LITE="notepatra-windows-installer/notepatra-setup-${VERSION}.exe"
            if [ -f "$LITE" ]; then
              cp "$LITE" "notepatra-setup-${VERSION}.exe"
              ls -la "notepatra-setup-${VERSION}.exe"
            else
              echo "::error::lite NSIS installer missing: $LITE"
            fi
            FULL="notepatra-windows-installer/notepatra-setup-${VERSION}-full.exe"
            if [ -f "$FULL" ]; then
              cp "$FULL" "notepatra-setup-${VERSION}-full.exe"
              ls -la "notepatra-setup-${VERSION}-full.exe"
            fi
          fi
          if [ -d notepatra-windows-msi ]; then
            MSI=$(ls notepatra-windows-msi/notepatra-*.msi 2>/dev/null | head -1)
            if [ -n "$MSI" ]; then
              cp "$MSI" "notepatra-${VERSION}.msi"
              ls -la "notepatra-${VERSION}.msi"
            fi
          fi
          # v0.1.72 — cloud-free Windows MSI (notepatra-local-ai)
          if [ -d notepatra-windows-msi-local-ai ]; then
            MSI=$(ls notepatra-windows-msi-local-ai/notepatra-local-ai-*.msi 2>/dev/null | head -1)
            if [ -n "$MSI" ]; then
              cp "$MSI" "notepatra-local-ai-${VERSION}.msi"
              ls -la "notepatra-local-ai-${VERSION}.msi"
            fi
          fi
          if [ -d notepatra-windows-msi-full ]; then
            MSI=$(ls notepatra-windows-msi-full/notepatra-*.msi 2>/dev/null | head -1)
            if [ -n "$MSI" ]; then
              cp "$MSI" "notepatra-full-${VERSION}.msi"
              ls -la "notepatra-full-${VERSION}.msi"
            fi
          fi
          if [ -d notepatra-windows-x64-full ]; then
            cd notepatra-windows-x64-full && zip -r ../notepatra-windows-x64-full.zip . && cd ..
          fi
          ls -la *.tar.gz *.dmg 2>/dev/null
          ls -la *.zip *.exe *.msi 2>/dev/null || true
          # v0.1.72 — Linux fleet installers.  Each build job already
          # named its artefact directory after the package; we just move
          # the file out so the rest of the release pipeline sees it at
          # the workspace root next to the .tar.gz / .dmg / .msi etc.
          for D in notepatra-linux-x64-deb notepatra-linux-x64-deb-local-ai \
                   notepatra-linux-arm64-deb notepatra-linux-arm64-deb-local-ai; do
              if [ -d "$D" ]; then
                  cp "$D"/*.deb . 2>/dev/null || true
              fi
          done
          for D in notepatra-linux-x64-rpm notepatra-linux-arm64-rpm; do
              if [ -d "$D" ]; then
                  cp "$D"/*.rpm . 2>/dev/null || true
              fi
          done
          if [ -d notepatra-linux-x64-appimage ]; then
              cp notepatra-linux-x64-appimage/*.AppImage . 2>/dev/null || true
              chmod +x ./*.AppImage 2>/dev/null || true
          fi
          ls -la *.deb *.rpm *.AppImage 2>/dev/null || true

      - name: Checkout source for release notes
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          path: src

      - name: Build .mcpb bundle (Claude Desktop one-click)
        run: |
          # .mcpb = zip of manifest.json + per-platform sidecar binaries.
          # Tag-gated for free: this whole release job runs only on
          # startsWith(github.ref, 'refs/tags/v').
          TAG="${GITHUB_REF##*/}"
          python3 src/notepatra-mcp/mcpb/build-mcpb.py \
            --manifest src/notepatra-mcp/mcpb/manifest.json \
            --cargo-toml src/notepatra-mcp/Cargo.toml \
            --expect-version "${TAG#v}" \
            --require-all \
            --binary linux-x64=notepatra-mcp-linux-x64/notepatra-mcp \
            --binary linux-arm64=notepatra-mcp-linux-arm64/notepatra-mcp \
            --binary darwin=notepatra-mcp-macos-universal/notepatra-mcp-universal \
            --binary win32-x64=notepatra-mcp-windows-x64/notepatra-mcp.exe \
            --out notepatra-mcp.mcpb
          unzip -l notepatra-mcp.mcpb

      - name: Generate SHA-256 checksums
        run: |
          # Generate a single SHA256SUMS file in the standard format that
          # `sha256sum -c` understands. Users can verify with:
          #   sha256sum -c SHA256SUMS
          for f in notepatra-linux-x64.tar.gz notepatra-linux-arm64.tar.gz \
                   notepatra-linux-x64-full.tar.gz notepatra-linux-arm64-full.tar.gz \
                   notepatra-mcp-linux-x64.tar.gz notepatra-mcp-linux-arm64.tar.gz \
                   notepatra-mcp-macos-arm64.tar.gz \
                   notepatra-mcp-windows-x64.zip notepatra-mcp.mcpb \
                   notepatra-macos-arm64.dmg notepatra-macos-arm64-full.dmg \
                   notepatra-windows-x64.zip notepatra-windows-x64-full.zip notepatra-setup-*.exe notepatra-*.msi notepatra-full-*.msi \
                   notepatra_*_amd64.deb notepatra_*_arm64.deb \
                   notepatra-local-ai_*_amd64.deb notepatra-local-ai_*_arm64.deb \
                   notepatra-*x86_64.rpm notepatra-*aarch64.rpm \
                   Notepatra-*x86_64.AppImage; do
            [ -f "$f" ] && sha256sum "$f" >> SHA256SUMS
          done
          echo "=== SHA256SUMS ==="
          cat SHA256SUMS

      - name: Resolve release notes file for tag
        id: notes
        run: |
          TAG="${GITHUB_REF##*/}"
          # Release notes live at the project root under release_notes/<tag>.md
          # (there is no src/release_notes/ directory — every previous release
          # silently fell through to the stub because of a stale path here).
          NOTES_FILE="release_notes/${TAG}.md"
          if [ -f "$NOTES_FILE" ]; then
            echo "found release notes: $NOTES_FILE"
            echo "notes_file=$NOTES_FILE" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::No release notes file at $NOTES_FILE — will fall back to auto-generated"
            mkdir -p release_notes
            cat > "$NOTES_FILE" <<EOF
          # Notepatra ${TAG}

          See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/main/CHANGELOG.md) for the full list of changes in this release.

          ## Verifying this release

          \`\`\`sh
          sha256sum -c SHA256SUMS --ignore-missing
          \`\`\`

          See [SECURITY.md](https://github.com/${GITHUB_REPOSITORY}/blob/main/SECURITY.md) for cosign + SLSA verification.
          EOF
            echo "notes_file=$NOTES_FILE" >> "$GITHUB_OUTPUT"
          fi

      - name: Install cosign
        uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3.10.0
        with:
          cosign-release: 'v2.4.1'

      - name: Sign artifacts with cosign (keyless OIDC)
        env:
          COSIGN_YES: "true"
        run: |
          # Keyless signing via Sigstore: identity comes from the GitHub
          # Actions OIDC token, no long-lived secrets. Each .sig is the
          # detached signature, each .pem is the short-lived cert that
          # ties the signature to this repo + workflow + commit SHA.
          for f in notepatra-linux-x64.tar.gz notepatra-linux-arm64.tar.gz \
                   notepatra-linux-x64-full.tar.gz notepatra-linux-arm64-full.tar.gz \
                   notepatra-mcp-linux-x64.tar.gz notepatra-mcp-linux-arm64.tar.gz \
                   notepatra-mcp-macos-arm64.tar.gz \
                   notepatra-mcp-windows-x64.zip notepatra-mcp.mcpb \
                   notepatra-macos-arm64.dmg notepatra-macos-arm64-full.dmg \
                   notepatra-windows-x64.zip notepatra-windows-x64-full.zip notepatra-setup-*.exe notepatra-*.msi notepatra-full-*.msi \
                   notepatra_*_amd64.deb notepatra_*_arm64.deb \
                   notepatra-local-ai_*_amd64.deb notepatra-local-ai_*_arm64.deb \
                   notepatra-*x86_64.rpm notepatra-*aarch64.rpm \
                   Notepatra-*x86_64.AppImage \
                   SHA256SUMS; do
            [ -f "$f" ] || continue
            cosign sign-blob --yes \
              --output-signature "${f}.sig" \
              --output-certificate "${f}.pem" \
              "$f"
          done
          ls -la *.sig *.pem

      - name: Generate SLSA build provenance attestation
        uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2.6.2
        with:
          subject-path: |
            notepatra-linux-x64.tar.gz
            notepatra-linux-arm64.tar.gz
            notepatra-linux-x64-full.tar.gz
            notepatra-linux-arm64-full.tar.gz
            notepatra-mcp-linux-x64.tar.gz
            notepatra-mcp-linux-arm64.tar.gz
            notepatra-mcp-macos-arm64.tar.gz
            notepatra-mcp-windows-x64.zip
            notepatra-mcp.mcpb
            notepatra-macos-arm64.dmg
            notepatra-macos-arm64-full.dmg
            notepatra-windows-x64.zip
            notepatra-windows-x64-full.zip
            notepatra-setup-*.exe
            notepatra-*.msi
            notepatra-full-*.msi
            notepatra_*_amd64.deb
            notepatra_*_arm64.deb
            notepatra-local-ai_*_amd64.deb
            notepatra-local-ai_*_arm64.deb
            notepatra-*x86_64.rpm
            notepatra-*aarch64.rpm
            Notepatra-*x86_64.AppImage

      - name: Create Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.2.4
        with:
          files: |
            notepatra-linux-x64.tar.gz
            notepatra-linux-arm64.tar.gz
            notepatra-linux-x64-full.tar.gz
            notepatra-linux-arm64-full.tar.gz
            notepatra-mcp-*.tar.gz
            notepatra-mcp-*.tar.gz.sig
            notepatra-mcp-*.tar.gz.pem
            notepatra-mcp-windows-x64.zip
            notepatra-mcp-windows-x64.zip.sig
            notepatra-mcp-windows-x64.zip.pem
            notepatra-mcp.mcpb
            notepatra-mcp.mcpb.sig
            notepatra-mcp.mcpb.pem
            notepatra-macos-arm64.dmg
            notepatra-macos-arm64-full.dmg
            notepatra-windows-x64.zip
            notepatra-windows-x64-full.zip
            notepatra-setup-*.exe
            notepatra-*.msi
            notepatra-full-*.msi
            notepatra_*_amd64.deb
            notepatra_*_arm64.deb
            notepatra-local-ai_*_amd64.deb
            notepatra-local-ai_*_arm64.deb
            notepatra-*x86_64.rpm
            notepatra-*aarch64.rpm
            Notepatra-*x86_64.AppImage
            SHA256SUMS
            notepatra-linux-x64.tar.gz.sig
            notepatra-linux-x64.tar.gz.pem
            notepatra-linux-arm64.tar.gz.sig
            notepatra-linux-arm64.tar.gz.pem
            notepatra-linux-x64-full.tar.gz.sig
            notepatra-linux-x64-full.tar.gz.pem
            notepatra-linux-arm64-full.tar.gz.sig
            notepatra-linux-arm64-full.tar.gz.pem
            notepatra-macos-arm64.dmg.sig
            notepatra-macos-arm64.dmg.pem
            notepatra-macos-arm64-full.dmg.sig
            notepatra-macos-arm64-full.dmg.pem
            notepatra-windows-x64.zip.sig
            notepatra-windows-x64.zip.pem
            notepatra-windows-x64-full.zip.sig
            notepatra-windows-x64-full.zip.pem
            notepatra-setup-*.exe.sig
            notepatra-setup-*.exe.pem
            notepatra-*.msi.sig
            notepatra-*.msi.pem
            notepatra-full-*.msi.sig
            notepatra-full-*.msi.pem
            notepatra_*_amd64.deb.sig
            notepatra_*_amd64.deb.pem
            notepatra_*_arm64.deb.sig
            notepatra_*_arm64.deb.pem
            notepatra-local-ai_*_amd64.deb.sig
            notepatra-local-ai_*_amd64.deb.pem
            notepatra-local-ai_*_arm64.deb.sig
            notepatra-local-ai_*_arm64.deb.pem
            notepatra-*x86_64.rpm.sig
            notepatra-*x86_64.rpm.pem
            notepatra-*aarch64.rpm.sig
            notepatra-*aarch64.rpm.pem
            Notepatra-*x86_64.AppImage.sig
            Notepatra-*x86_64.AppImage.pem
            SHA256SUMS.sig
            SHA256SUMS.pem
          fail_on_unmatched_files: false
          # Use the per-version release notes file from release_notes/<tag>.md
          # instead of the generic auto-generated body. Falls back to a stub
          # if the file is missing (the resolve step above creates one).
          body_path: ${{ steps.notes.outputs.notes_file }}
          generate_release_notes: false

      - name: Check documented download sizes against the published assets
        # Size figures on README / docs can only be measured once the assets
        # exist, so the pre-tag release-check necessarily carries the previous
        # release's numbers. v0.1.129 shipped v0.1.128's bytes under a
        # v0.1.129 label for 80 minutes. This step measures the truth and
        # opens an issue with the exact figures when the docs drift.
        if: always()
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF##*/}"
          cd src
          if VERSION="${TAG#v}" bash scripts/verify-download-sizes.sh > ../dl-size.log 2>&1; then
            cat ../dl-size.log
            echo "✓ documented download sizes match $TAG assets"
            exit 0
          fi
          cat ../dl-size.log
          echo "::error::documented download sizes drift from the $TAG assets — see issue"
          TITLE="$TAG: documented download sizes drift from the published assets"
          BODY="$(printf '%s\n\n```\n%s\n```\n\nFix: update README.md, docs/*.html, docs/llms.txt and scripts/make-og-card.py (regenerate docs/og-card.png), then run `bash scripts/verify-download-sizes.sh` until 0 mismatches.\n\nRun: https://github.com/%s/actions/runs/%s' \
                  "Measured by \`scripts/verify-download-sizes.sh\` right after the release assets were uploaded:" \
                  "$(cat ../dl-size.log)" "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID")"
          EXISTING=$(gh issue list --search "\"$TITLE\" in:title" --state open --json number --jq '.[0].number // empty')
          if [ -n "$EXISTING" ]; then
            gh issue comment "$EXISTING" --body "$BODY"
          else
            gh issue create --title "$TITLE" --label "release" --body "$BODY" \
              || gh issue create --title "$TITLE" --body "$BODY"
          fi