@@ -433,9 +433,6 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 120
     continue-on-error: true
-    env:
-      STRAWBERRY_URL: https://github.com/StrawberryPerl/Perl-Dist-Strawberry/releases/download/SP_54051_64bit/strawberry-perl-5.40.5.1-64bit-portable.zip
-      STRAWBERRY_SHA256: 6619fe7eeef921ccddb4aac3972fb602a0c690a3074205b863ade998d7bc79a6
     steps:
       # LF in the checkout: fixtures and shell scripts must not get CRLF.
       - run: git config --global core.autocrlf false
@@ -504,67 +501,74 @@ jobs:
         shell: msys2 {0}
         run: packaging/windows/bundle-shell.sh "$PWD/stage/ecce" "$(cygpath -m /)"
 
-      - name: Strawberry Perl (portable)
-        id: perl
+      # MinGW runtime DLLs and the broker, then Perl and Python, so the tree
+      # runs with no MSYS2 on the machine.
+      - name: Bundle the runtime
+        shell: msys2 {0}
+        run: |
+          packaging/windows/bundle-runtime.sh "$PWD/stage/ecce"
+          cp packaging/windows/ecce.cmd packaging/windows/make-shortcuts.ps1 stage/ecce/
+
+      - name: Download cache (Strawberry Perl, Python, wxPython)
         uses: actions/cache@v4
         with:
-          path: ${{ runner.temp }}/strawberry
-          key: strawberry-5.40.5.1-${{ env.STRAWBERRY_SHA256 }}
+          path: ${{ runner.temp }}/ecce-dl
+          key: windows-tools-${{ hashFiles('packaging/windows/bundle-tools.ps1') }}
+
+      - name: Bundle Perl and Python
+        shell: pwsh
+        run: packaging/windows/bundle-tools.ps1 -Install stage\ecce -Cache "$env:RUNNER_TEMP\ecce-dl"
 
-      - name: Download Strawberry Perl
-        if: steps.perl.outputs.cache-hit != 'true'
+      - name: Zip the install tree
         shell: pwsh
         run: |
-          $zip = "$env:RUNNER_TEMP\strawberry.zip"
-          Invoke-WebRequest $env:STRAWBERRY_URL -OutFile $zip
-          $h = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLower()
-          if ($h -ne $env:STRAWBERRY_SHA256) { throw "sha256 $h" }
-          Expand-Archive $zip "$env:RUNNER_TEMP\strawberry"
-
-      # Local job end to end with the bundled shell and a PATH that has no
-      # MSYS2 usr\bin (tests/windows/launch_local.py).
+          $v = (Get-Content data/client/config/Version -TotalCount 1).Trim()
+          New-Item -ItemType Directory -Force dist | Out-Null
+          Compress-Archive -Path stage\ecce -DestinationPath "dist\ECCE-windows-$v.zip"
+          Get-ChildItem dist | Format-Table Name, Length
+          $d = "$env:RUNNER_TEMP\unpacked"
+          Remove-Item -Recurse -Force $d -ErrorAction SilentlyContinue
+          Expand-Archive "dist\ECCE-windows-$v.zip" $d
+          "unpacked: $((Get-ChildItem $d -Recurse -File | Measure-Object Length -Sum).Sum / 1MB) MB" | Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+          Get-ChildItem "$d\ecce" | Format-Table Name
+          # launchjob is a test driver, not part of the package.
+          Copy-Item build\launchjob.exe "$d\ecce\bin\"
+
+      # Local job end to end from the unpacked zip, with System32 as the only
+      # PATH outside it (tests/windows/launch_local.py): no MSYS2 involved.
       - name: Local jobs (complete, cancel)
         id: localjobs
         shell: pwsh
         continue-on-error: true
         run: |
-          $msys = (msys2 -c 'cygpath -m /' 2>$null)
-          if (-not $msys) { $msys = "$env:RUNNER_TEMP\msys64" }
-          $msys = $msys -replace '/', '\'
+          $r = "$env:RUNNER_TEMP\unpacked\ecce"
           New-Item -ItemType Directory -Force localjobs | Out-Null
-          $sb = "$env:RUNNER_TEMP\strawberry"
-          $env:WINTEST_HOME = "$PWD\stage\ecce"
-          $env:WINTEST_BASE_PATH = "$msys\ucrt64\bin;$sb\perl\site\bin;$sb\perl\bin;$sb\c\bin;C:\Windows\System32;C:\Windows"
+          $sys = "$env:SystemRoot\System32;$env:SystemRoot"
+          $env:Path = $sys
+          $env:WINTEST_HOME = $r
+          $env:WINTEST_BASE_PATH = "$r\bin;$r\usr\bin;$r\python;$r\strawberry\perl\site\bin;$r\strawberry\perl\bin;$r\strawberry\c\bin;$sys"
           $rc = 0
           foreach ($c in "complete", "cancel") {
-            & "$msys\ucrt64\bin\python3.exe" tests/windows/launch_local.py $c --build "$PWD\build" --state "$PWD\localjobs\state-$c" 2>&1 | Tee-Object "localjobs\$c.log"
+            & "$r\python\python3.exe" tests/windows/launch_local.py $c --build "$r\bin" --state "$PWD\localjobs\state-$c" 2>&1 | Tee-Object "localjobs\$c.log"
             "$c rc=$LASTEXITCODE" | Tee-Object -Append localjobs\summary.txt
             if ($LASTEXITCODE -ne 0) { $rc = 1 }
           }
           Get-Content localjobs\summary.txt >> $env:GITHUB_STEP_SUMMARY
           exit $rc
 
-      # Does it run? (#133) Starts the installed apps on the runner's desktop
-      # and screenshots them.  Allowed to fail; see summary.txt.
+      # Does it run? (#133) Starts the unpacked apps on the runner's desktop
+      # (PATH: the package and System32 only) and screenshots them.  Allowed
+      # to fail; see summary.txt.
       - name: Start the apps
         id: apps
         shell: pwsh
         continue-on-error: true
         timeout-minutes: 20
         run: |
-          $msys = (msys2 -c 'cygpath -m /' 2>$null) -replace '/', '\'
-          tests\windows\ci-run.ps1 -Stage stage -Out windows-run -Msys $msys -Strawberry "$env:RUNNER_TEMP\strawberry"
+          $env:Path = "$env:SystemRoot\System32;$env:SystemRoot"
+          tests\windows\ci-run.ps1 -Stage "$env:RUNNER_TEMP\unpacked" -Out windows-run
           Get-Content windows-run\summary.txt >> $env:GITHUB_STEP_SUMMARY
 
-      - name: Zip the install tree
-        if: always()
-        shell: pwsh
-        run: |
-          $v = (Get-Content data/client/config/Version -TotalCount 1).Trim()
-          New-Item -ItemType Directory -Force dist | Out-Null
-          Compress-Archive -Path stage\ecce -DestinationPath "dist\ECCE-windows-$v.zip"
-          Get-ChildItem dist | Format-Table Name, Length
-
       - uses: actions/upload-artifact@v4
         if: always()
         with:
 
@@ -931,6 +931,16 @@ if(NOT WIN32)
   list(APPEND ECCE_CLI_APPS ecce-flock)
 endif()
 
+if(WIN32)
+  # GUI subsystem: no console window opens behind the apps. The command-line
+  # programs (ECCE_CLI_APPS, the parsers) keep theirs.
+  foreach(_app ${ECCE_GUI_APPS})
+    if(TARGET ${_app})
+      set_target_properties(${_app} PROPERTIES WIN32_EXECUTABLE ON)
+    endif()
+  endforeach()
+endif()
+
 install(TARGETS ${ECCE_GUI_APPS} ${ECCE_CLI_APPS} RUNTIME DESTINATION bin
         COMPONENT client)
 # data/ splits cleanly along its own top-level directories: data/client
 
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Copies the MinGW/UCRT64 runtime DLLs every installed program needs, and
+# mosquitto and mosquitto_passwd (the session broker, ecce-broker-win), from
+# an MSYS2 UCRT64 install into <ECCE install>/bin, so that the install runs
+# on a machine without MSYS2.
+#
+#   packaging/windows/bundle-runtime.sh <install-dir> [ucrt64-bin]
+#
+# Run it from an MSYS2 UCRT64 shell after `cmake --install`.  Only DLLs found
+# in the UCRT64 bin directory are copied; Windows' own DLLs stay where they are.
+set -eu
+dest="${1:?usage: bundle-runtime.sh <install-dir> [ucrt64-bin]}/bin"
+src="${2:-/ucrt64/bin}"
+src="$(cd "$src" && pwd)"
+
+for p in mosquitto mosquitto_passwd; do
+  [ -f "$src/$p.exe" ] || { echo "bundle-runtime: $src/$p.exe is missing" >&2; exit 1; }
+  cp -f "$src/$p.exe" "$dest/"
+done
+
+# ldd lists a program's DLLs, but not always the DLLs' own; repeat on the
+# newly copied files until nothing new turns up.
+todo="$(ls "$dest"/*.exe)"
+n=0
+while [ -n "$todo" ]; do
+  new=""
+  for f in $todo; do
+    for dll in $(ldd "$f" 2>/dev/null | awk -v s="$src/" 'index($3, s) == 1 {print $3}'); do
+      if [ ! -f "$dest/${dll##*/}" ]; then cp -f "$dll" "$dest/"; new="$new $dest/${dll##*/}"; n=$((n+1)); fi
+    done
+  done
+  todo="$new"
+done
+echo "bundled mosquitto and $n DLLs into $dest ($(du -sh "$dest" | cut -f1) in bin)"
@@ -0,0 +1,80 @@
+# Adds Strawberry Perl (portable, trimmed) and an embeddable Python with
+# wxPython to an ECCE install tree, so gensub, the importers and the
+# code-registration dialogs run without anything installed on the machine.
+#
+#   bundle-tools.ps1 -Install <install-dir> [-Cache <download-dir>]
+#
+# Result: <install>\strawberry\{perl,c\bin} and <install>\python (python.exe
+# and python3.exe: the scripts call python3).  The pins below are the source
+# of truth; tests/windows/README.md lists them.
+param([Parameter(Mandatory)][string]$Install, [string]$Cache = "$env:TEMP\ecce-dl")
+$ErrorActionPreference = "Stop"
+$ProgressPreference = "SilentlyContinue"
+$pins = @{
+  strawberry = @{ url = "https://github.com/StrawberryPerl/Perl-Dist-Strawberry/releases/download/SP_54051_64bit/strawberry-perl-5.40.5.1-64bit-portable.zip";
+                  sha256 = "6619fe7eeef921ccddb4aac3972fb602a0c690a3074205b863ade998d7bc79a6" }
+  python     = @{ url = "https://www.python.org/ftp/python/3.13.5/python-3.13.5-embed-amd64.zip";
+                  sha256 = "7d2650fd9d1b9d002d4a315d5f354247fd6a44f30517c7ef577b08f57a0fb6d9" }
+  # pythonhosted.org file path of wxpython-4.3.1-cp313-cp313-win_amd64.whl
+  wxpython   = @{ url = "";
+                  sha256 = "0ae85e266dbb99fe46bc26920aa87b22fa3f83dc51b321bcd9afa51fa68340e7" }
+}
+
+function Fetch($name, $url, $sha, $file) {
+  New-Item -ItemType Directory -Force $Cache | Out-Null
+  $f = Join-Path $Cache $file
+  if (-not (Test-Path $f)) { Invoke-WebRequest $url -OutFile $f }
+  $h = (Get-FileHash $f -Algorithm SHA256).Hash.ToLower()
+  if ($h -ne $sha) { Remove-Item $f; throw "$name`: sha256 $h, expected $sha" }
+  return $f
+}
+function Unzip($zip, $to) {
+  if (Test-Path $to) { Remove-Item -Recurse -Force $to }
+  New-Item -ItemType Directory -Force $to | Out-Null
+  Add-Type -AssemblyName System.IO.Compression.FileSystem
+  [System.IO.Compression.ZipFile]::ExtractToDirectory($zip, $to)
+}
+function Size($d) { "{0:N0} MB" -f ((Get-ChildItem $d -Recurse -File | Measure-Object Length -Sum).Sum / 1MB) }
+
+$Install = (Resolve-Path $Install).Path
+
+# --- Strawberry Perl: perl itself and the DLLs its modules load; no compiler.
+$zip = Fetch "strawberry" $pins.strawberry.url $pins.strawberry.sha256 "strawberry.zip"
+$tmp = Join-Path $Cache "strawberry-unpacked"
+Unzip $zip $tmp
+"strawberry unpacked: $(Size $tmp)"
+$sb = Join-Path $Install "strawberry"
+if (Test-Path $sb) { Remove-Item -Recurse -Force $sb }
+New-Item -ItemType Directory -Force "$sb\c\bin" | Out-Null
+Move-Item "$tmp\perl" "$sb\perl"
+Get-ChildItem "$tmp\c\bin" -Filter *.dll | Move-Item -Destination "$sb\c\bin"
+foreach ($d in "perl\html", "perl\man", "perl\lib\pods", "perl\site\lib\auto\share\dist\Alien-Build") {
+  if (Test-Path "$sb\$d") { Remove-Item -Recurse -Force "$sb\$d" }
+}
+Get-ChildItem "$sb\perl" -Recurse -Include *.pod, *.a, *.h -File | Remove-Item -Force
+Remove-Item -Recurse -Force $tmp
+"strawberry bundled: $(Size $sb)"
+
+# --- Python: python.org's embeddable zip, plus the wxPython wheel unpacked
+# into its site-packages (the embeddable build has no pip).
+$py = Join-Path $Install "python"
+Unzip (Fetch "python" $pins.python.url $pins.python.sha256 "python-embed.zip") $py
+$whl = Join-Path $Cache "wxpython-4.3.1-cp313-cp313-win_amd64.whl"
+if (-not (Test-Path $whl)) {
+  # The wheel's pythonhosted URL has a content hash in it; ask PyPI.
+  $meta = Invoke-RestMethod "https://pypi.org/pypi/wxPython/4.3.1/json"
+  $u = ($meta.urls | Where-Object { $_.filename -eq "wxpython-4.3.1-cp313-cp313-win_amd64.whl" }).url
+  $pins.wxpython.url = $u
+}
+$whl = Fetch "wxpython" $pins.wxpython.url $pins.wxpython.sha256 "wxpython-4.3.1-cp313-cp313-win_amd64.whl"
+$site = "$py\Lib\site-packages"
+New-Item -ItemType Directory -Force $site | Out-Null
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+[System.IO.Compression.ZipFile]::ExtractToDirectory($whl, $site)
+Get-ChildItem $site -Recurse -Include *.pyi -File | Remove-Item -Force
+# site-packages on sys.path, and `import site` on (the embeddable default is off).
+$pth = Get-ChildItem $py -Filter "python*._pth" | Select-Object -First 1
+Set-Content -Encoding ascii $pth.FullName @("python313.zip", ".", "Lib\site-packages", "import site")
+Copy-Item "$py\python.exe" "$py\python3.exe"
+Copy-Item "$py\pythonw.exe" "$py\python3w.exe"
+"python bundled: $(Size $py)"
@@ -0,0 +1,20 @@
+@echo off
+rem Starts ECCE (the Organizer) from an unpacked Windows package, using only
+rem what is in the package.  Nothing needs to be installed on the machine.
+setlocal
+set "ECCE_ROOT=%~dp0"
+if "%ECCE_ROOT:~-1%"=="\" set "ECCE_ROOT=%ECCE_ROOT:~0,-1%"
+rem Forward slashes: ECCE_HOME ends up in sh scripts, where a backslash is an escape.
+set "ECCE_HOME=%ECCE_ROOT:\=/%"
+set "PATH=%ECCE_ROOT%\bin;%ECCE_ROOT%\usr\bin;%ECCE_ROOT%\python;%ECCE_ROOT%\strawberry\perl\site\bin;%ECCE_ROOT%\strawberry\perl\bin;%ECCE_ROOT%\strawberry\c\bin;%SystemRoot%\System32;%SystemRoot%"
+set "ECCE_REALUSER=%USERNAME%"
+set "HOST=%COMPUTERNAME%"
+set "UH=%USERPROFILE:\=/%"
+set "ECCE_REALUSERHOME=%UH%"
+set "ECCE_LOCAL_DATA=%UH%/ecce-local"
+if not exist "%USERPROFILE%\ecce-local" mkdir "%USERPROFILE%\ecce-local"
+rem Local mode without messaging and without a data server, as tested in CI.
+set ECCE_NO_MESSAGING=1
+set ECCE_NO_DATASERVER=1
+set ECCE_SESSION_LIVENESS=lease
+start "" "%ECCE_ROOT%\bin\organizer.exe" %*
@@ -0,0 +1,15 @@
+# Adds an "ECCE" entry to the current user's Start menu that runs ecce.cmd
+# of the package this script sits in (the package root, next to ecce.cmd).
+#   powershell -ExecutionPolicy Bypass -File make-shortcuts.ps1
+$root = Split-Path -Parent $MyInvocation.MyCommand.Path
+$dir = Join-Path ([Environment]::GetFolderPath("Programs")) "ECCE"
+New-Item -ItemType Directory -Force $dir | Out-Null
+$sh = New-Object -ComObject WScript.Shell
+$l = $sh.CreateShortcut("$dir\ECCE.lnk")
+$l.TargetPath = "$env:SystemRoot\System32\cmd.exe"
+$l.Arguments = "/c `"`"$root\ecce.cmd`"`""
+$l.WorkingDirectory = $env:USERPROFILE
+$l.WindowStyle = 7
+$l.IconLocation = "$root\bin\organizer.exe,0"
+$l.Save()
+"Start menu: $dir\ECCE.lnk"
@@ -32,11 +32,24 @@ sha256 6619fe7eeef921ccddb4aac3972fb602a0c690a3074205b863ade998d7bc79a6;
 the `portable` entry of strawberryperl.com/releases.json lists the msi URL
 with this zip's hash and size).
 
+## The self-contained package
+`ECCE-windows-<version>.zip` runs on a Windows 10/11 with nothing installed.
+Pieces, all from `packaging/windows/`:
+- `bundle-shell.sh` - sh and coreutils (MSYS2 `usr\bin`).
+- `bundle-runtime.sh` - the UCRT64 DLLs (`ldd`, only from `/ucrt64/bin`), `mosquitto` and `mosquitto_passwd` into `bin`.
+- `bundle-tools.ps1` - Strawberry Perl portable (pinned above; only `perl\` and the `c\bin` DLLs kept) and Python 3.13.5 embeddable
+  (https://www.python.org/ftp/python/3.13.5/python-3.13.5-embed-amd64.zip, sha256
+  7d2650fd9d1b9d002d4a315d5f354247fd6a44f30517c7ef577b08f57a0fb6d9) with the wxPython 4.3.1 cp313 win_amd64 wheel
+  (sha256 0ae85e266dbb99fe46bc26920aa87b22fa3f83dc51b321bcd9afa51fa68340e7) unpacked into its `Lib\site-packages`.
+  `python3.exe` is a copy of `python.exe`, because the scripts call `python3`.
+- `ecce.cmd` starts the Organizer with the package's own PATH; `make-shortcuts.ps1` adds the Start menu entry.
+
 ## CI
 `build.yml`, job "Windows (MSYS2 UCRT64)" (experimental, `continue-on-error`):
 same packages, ccache, build, ctest (transport_process, fragreaders,
 fragreaders_de, parsers), install to `stage/ecce`, `bundle-shell.sh`,
-`launch_local.py complete|cancel` against the bundled shell, `ci-run.ps1`
-(starts each app on the runner desktop, screenshots), then the install tree as
-`ECCE-windows-<version>.zip` and the `windows-run` artifact (shots, logs).
+the three bundle steps, the zip, then, from the unpacked zip with only
+System32 on PATH, `launch_local.py complete|cancel` and `ci-run.ps1` (starts
+each app on the runner desktop, screenshots; without `-Msys` it is that
+clean-PATH mode), and the `windows-run` artifact (shots, logs).
 Run it with `gh workflow run build.yml --ref <branch> -f only=windows`.
@@ -2,7 +2,9 @@
 # the runner's desktop, screenshots it, records how it ended.  Never fails
 # the job; the verdict is in <Out>\summary.txt.
 #   ci-run.ps1 -Stage <dir with ecce\bin> -Out <dir> [-Msys D:\a\_temp\msys64] [-Strawberry <dir>]
-param([string]$Stage, [string]$Out, [string]$Msys = "C:\msys64", [string]$Strawberry = "")
+# Without -Msys the PATH is the package's own (ecce.cmd's) and System32 only:
+# the run from an unpacked ECCE-windows zip, with no MSYS2 anywhere.
+param([string]$Stage, [string]$Out, [string]$Msys = "", [string]$Strawberry = "")
 $ErrorActionPreference = "Continue"
 $Stage = (Resolve-Path $Stage).Path
 New-Item -ItemType Directory -Force "$Out\shots", "$Out\logs", "$Out\home", "$Out\local" | Out-Null
@@ -11,11 +13,14 @@ $summary = "$Out\summary.txt"
 function Say($t) { Write-Host $t; Add-Content $summary $t }
 
 $perl = ""
-if ($Strawberry -ne "" -and (Test-Path "$Strawberry\perl\bin\perl.exe")) {
+if ($Msys -eq "") {
+  $r = "$Stage\ecce"
+  $env:Path = "$r\bin;$r\usr\bin;$r\python;$r\strawberry\perl\site\bin;$r\strawberry\perl\bin;$r\strawberry\c\bin;$env:SystemRoot\System32;$env:SystemRoot"
+} elseif ($Strawberry -ne "" -and (Test-Path "$Strawberry\perl\bin\perl.exe")) {
   $perl = "$Strawberry\perl\site\bin;$Strawberry\perl\bin;$Strawberry\c\bin;"
 }
 # ucrt64 first: Strawberry's c\bin has its own libstdc++/libgcc that crash our exes.
-$env:Path = "$Msys\ucrt64\bin;" + $perl + $env:Path + ";$Msys\usr\bin"
+if ($Msys -ne "") { $env:Path = "$Msys\ucrt64\bin;" + $perl + $env:Path + ";$Msys\usr\bin" }
 $env:ECCE_HOME = ("$Stage\ecce" -replace "\\", "/")
 $env:ECCE_REALUSER = $env:USERNAME
 $env:ECCE_REALUSERHOME = ("$Out\home" -replace "\\", "/")
@@ -65,6 +70,12 @@ Say "Windows $([System.Environment]::OSVersion.Version)"
 Get-CimInstance Win32_VideoController | ForEach-Object { Say "video: $($_.Name)" }
 Say ("screen: " + [System.Windows.Forms.SystemInformation]::VirtualScreen)
 Shot "$Out\shots\00-desktop.png"
+if ($Msys -eq "") {
+  Say ("path: " + $env:Path)
+  Say ("python wx: " + (& "$Stage\ecce\python\python3.exe" -c "import wx; print(wx.version())" 2>&1))
+  Say ("perl: " + ((& "$Stage\ecce\strawberry\perl\bin\perl.exe" -e 'print qq($^V $^O)') 2>&1))
+  Say ("sh: " + ((& "$Stage\ecce\usr\bin\sh.exe" -c "echo ok") 2>&1))
+}
 
 $bin = "$Stage\ecce\bin"
 Get-ChildItem $bin -Filter *.exe | ForEach-Object { $_.Name } | Out-File "$Out\logs\bin.txt"