{"content":"Release SOP gains section 3.6: manual Windows test-package builds on the win-sign machine (2026-11-05, distilled from the v1.0.11-rc.1 session). Key clarification recorded: formal Windows releases have always been CI-built (fresh environment, proven) and the five pitfalls of the rc session are all specific to manual builds on a warm persistent clone — npmjs egress (switch to npmmirror), warm dsh-runtime/node_modules carrying already-patched files (delete before install), no-op root installs skipping postinstall (explicit nested installs + patch script), pnpm run injecting npm_execpath to a non-executable corepack pnpm.mjs which kills electron-builder's native rebuild (CI-parity fix: run the dist:win sub-steps and package via 'pnpm exec electron-builder', which never injects it), and unverified NSIS script changes (the /SD OK bug, b19b0fa7) now gated by the repo's nsis-syntax-harness in the section-12 checklist. Section includes the full build-script skeleton, the git-bundle code-shipping trick (positive side must be a ref NAME — bare SHAs are refused with a misleading 'empty bundle' error), the schtasks/.cmd execution pattern, and the artifact discipline: test packages never touch update.json/CDN — formal releases return to tag+CI. The harness gate also protects future releases: any .nsh/electron-builder.json change between tags must pass makensis before build (the /SD OK class would otherwise burn a CI round or a release).","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}