@@ -50,7 +50,7 @@ on:
   workflow_dispatch:
     inputs:
       only:
-        description: "Run just this job (debian, vendored-inventor, ubuntu, rocky, fedora, macos); empty runs all"
+        description: "Run just this job (debian, vendored-inventor, ubuntu, rocky, fedora, macos, windows); empty runs all"
         required: false
         default: ""
 
@@ -427,3 +427,180 @@ jobs:
           name: macos-app-run-${{ matrix.arch }}
           path: macos-app-run/
           if-no-files-found: ignore
+
+  # Windows client (#133), experimental: MSYS2 UCRT64 toolchain, the same
+  # package set as tests/windows/README.md.  Never turns the workflow red.
+  windows:
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.only == '' || inputs.only == 'windows' }}
+    name: Windows (MSYS2 UCRT64)
+    runs-on: windows-latest
+    timeout-minutes: 120
+    continue-on-error: true
+    steps:
+      # LF in the checkout: fixtures and shell scripts must not get CRLF.
+      - run: git config --global core.autocrlf false
+
+      - uses: actions/checkout@v4
+
+      - uses: msys2/setup-msys2@v2
+        with:
+          msystem: UCRT64
+          update: false
+          cache: true
+          install: >-
+            base git
+            mingw-w64-ucrt-x86_64-apr-util mingw-w64-ucrt-x86_64-ccache mingw-w64-ucrt-x86_64-cmake
+            mingw-w64-ucrt-x86_64-coin mingw-w64-ucrt-x86_64-freetype
+            mingw-w64-ucrt-x86_64-gcc mingw-w64-ucrt-x86_64-gcc-fortran
+            mingw-w64-ucrt-x86_64-glib2 mingw-w64-ucrt-x86_64-libjpeg-turbo
+            mingw-w64-ucrt-x86_64-libssh mingw-w64-ucrt-x86_64-mosquitto
+            mingw-w64-ucrt-x86_64-ninja mingw-w64-ucrt-x86_64-pkgconf
+            mingw-w64-ucrt-x86_64-python mingw-w64-ucrt-x86_64-wxwidgets3.2-msw
+            mingw-w64-ucrt-x86_64-xerces-c
+
+      # The build is ~20 minutes cold; ccache makes a rerun after a small
+      # change a few.
+      - uses: actions/cache@v4
+        with:
+          path: .ccache
+          key: ccache-windows-${{ github.run_id }}
+          restore-keys: ccache-windows-
+
+      - name: Configure
+        shell: msys2 {0}
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          CCACHE_MAXSIZE: 600M
+        run: |
+          cmake -G Ninja -B build -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_BUILD_TYPE=Release -DECCE_REQUIRE_LIBSSH=ON \
+            -DECCE_HOME_DIR="$PWD/stage/ecce" -DCMAKE_INSTALL_PREFIX="$PWD/stage/ecce"
+
+      - name: Build
+        shell: msys2 {0}
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          CCACHE_MAXSIZE: 600M
+        # -k 0: report every failing file, not only the first few.
+        run: cmake --build build -- -k 0
+
+      - name: Tests
+        id: tests
+        shell: msys2 {0}
+        continue-on-error: true
+        run: |
+          cd build
+          ctest -R 'transport_process|fragreaders|fragreaders_de|parsers' --output-on-failure --timeout 600 \
+            | tee ../ctest.log
+          exit "${PIPESTATUS[0]}"
+
+      - name: Install to a staging tree
+        shell: msys2 {0}
+        run: |
+          cmake --install build > install.log 2>&1 || { tail -30 install.log; exit 1; }
+          ls stage/ecce stage/ecce/bin
+
+      # The shell the job scripts run with, next to the apps (#133).
+      - name: Bundle the POSIX shell
+        shell: msys2 {0}
+        run: packaging/windows/bundle-shell.sh "$PWD/stage/ecce" "$(cygpath -m /)"
+
+      # MinGW runtime DLLs and the broker, then Perl and Python, so the tree
+      # runs with no MSYS2 on the machine.
+      - name: Bundle the runtime
+        shell: msys2 {0}
+        run: |
+          packaging/windows/bundle-runtime.sh "$PWD/stage/ecce"
+          cp packaging/windows/ecce.cmd packaging/windows/make-shortcuts.ps1 stage/ecce/
+
+      - name: Download cache (Strawberry Perl, Python, wxPython)
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/ecce-dl
+          key: windows-tools-${{ hashFiles('packaging/windows/bundle-tools.ps1') }}
+
+      - name: Bundle Perl and Python
+        shell: pwsh
+        run: packaging/windows/bundle-tools.ps1 -Install stage\ecce -Cache "$env:RUNNER_TEMP\ecce-dl"
+
+      - name: Zip the install tree
+        shell: pwsh
+        run: |
+          $v = (Get-Content data/client/config/Version -TotalCount 1).Trim()
+          New-Item -ItemType Directory -Force dist | Out-Null
+          Compress-Archive -Path stage\ecce -DestinationPath "dist\ECCE-windows-$v.zip"
+          Get-ChildItem dist | Format-Table Name, Length
+          $d = "$env:RUNNER_TEMP\unpacked"
+          Remove-Item -Recurse -Force $d -ErrorAction SilentlyContinue
+          Expand-Archive "dist\ECCE-windows-$v.zip" $d
+          "unpacked: $((Get-ChildItem $d -Recurse -File | Measure-Object Length -Sum).Sum / 1MB) MB" | Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+          Get-ChildItem "$d\ecce" | Format-Table Name
+          # launchjob is a test driver, not part of the package.
+          Copy-Item build\launchjob.exe "$d\ecce\bin\"
+
+      # Local job end to end from the unpacked zip, with System32 as the only
+      # PATH outside it (tests/windows/launch_local.py): no MSYS2 involved.
+      - name: Local jobs (complete, cancel)
+        id: localjobs
+        shell: pwsh
+        continue-on-error: true
+        run: |
+          $r = "$env:RUNNER_TEMP\unpacked\ecce"
+          New-Item -ItemType Directory -Force localjobs | Out-Null
+          $sys = "$env:SystemRoot\System32;$env:SystemRoot"
+          $env:Path = $sys
+          $env:WINTEST_HOME = $r
+          $env:WINTEST_BASE_PATH = "$r\bin;$r\usr\bin;$r\python;$r\strawberry\perl\site\bin;$r\strawberry\perl\bin;$r\strawberry\c\bin;$sys"
+          $env:Path = $env:WINTEST_BASE_PATH
+          & "$r\usr\bin\bash.exe" -c 'echo "$PATH"; command -v mosquitto mosquitto_sub perl python3; ls -l "$ECCE_HOME/bin/mosquitto.exe"' 2>&1 | Tee-Object localjobs\probe.log
+          $env:Path = $sys
+          $rc = 0
+          foreach ($c in "complete", "cancel") {
+            & "$r\python\python3.exe" tests/windows/launch_local.py $c --build "$r\bin" --state "$PWD\localjobs\state-$c" 2>&1 | Tee-Object "localjobs\$c.log"
+            "$c rc=$LASTEXITCODE" | Tee-Object -Append localjobs\summary.txt
+            if ($LASTEXITCODE -ne 0) { $rc = 1 }
+          }
+          Get-Content localjobs\summary.txt >> $env:GITHUB_STEP_SUMMARY
+          exit $rc
+
+      # Does it run? (#133) Starts the unpacked apps on the runner's desktop
+      # (PATH: the package and System32 only) and screenshots them.  Allowed
+      # to fail; see summary.txt.
+      - name: Start the apps
+        id: apps
+        shell: pwsh
+        continue-on-error: true
+        timeout-minutes: 20
+        run: |
+          $env:Path = "$env:SystemRoot\System32;$env:SystemRoot"
+          tests\windows\ci-run.ps1 -Stage "$env:RUNNER_TEMP\unpacked" -Out windows-run
+          Get-Content windows-run\summary.txt >> $env:GITHUB_STEP_SUMMARY
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ECCE-windows-zip
+          path: dist/*.zip
+          if-no-files-found: ignore
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: windows-run
+          path: |
+            windows-run/
+            localjobs/
+            ctest.log
+            install.log
+          if-no-files-found: ignore
+
+      # continue-on-error steps show green; say what really happened, and
+      # fail this (experimental) job when any of them did.
+      - name: Verdict
+        if: always()
+        shell: bash
+        run: |
+          { echo '### Windows'
+            echo "- ctest: ${{ steps.tests.outcome }}"
+            echo "- local jobs: ${{ steps.localjobs.outcome }}"
+            echo "- start the apps: ${{ steps.apps.outcome }}"; } >> "$GITHUB_STEP_SUMMARY"
+          [ "${{ steps.tests.outcome }}${{ steps.localjobs.outcome }}${{ steps.apps.outcome }}" = successsuccesssuccess ]
@@ -97,7 +97,9 @@ endif()
 # "...-NOTFOUND" rather than erroring, which only surfaces later as a
 # baffling "Found relative path while evaluating include directories"
 # CMake generate-step error. Confirmed via a real macOS CI run.
+# PATH_SUFFIXES covers prefixes such as MSYS2's /ucrt64 (#133).
 find_path(FREETYPE_UNQUALIFIED_INCLUDE_DIR ftoutln.h
+  PATH_SUFFIXES freetype2/freetype
   PATHS /usr/include/freetype2/freetype /usr/include/freetype
         /opt/homebrew/include/freetype2/freetype
         /usr/local/include/freetype2/freetype)
@@ -137,6 +139,21 @@ if(ECCE_USE_COIN)
   find_library(COIN_LIBRARY Coin REQUIRED)
 endif()
 
+if(WIN32)
+  # MSYS2's Coin is a DLL; moiv is a static library of ours. GL/gl.h pulls in
+  # <windows.h>, whose full form drags in rpcndr.h's `byte`, ambiguous with
+  # std::byte under `using namespace std`; and its min/max macros break
+  # std::min/std::max. _POSIX_THREAD_SAFE_FUNCTIONS declares gmtime_r and
+  # localtime_r (#133).
+  add_compile_definitions(COIN_DLL CHEMKIT_NOT_DLL WIN32_LEAN_AND_MEAN NOMINMAX
+                          _POSIX_THREAD_SAFE_FUNCTIONS=200112L)
+  # PosixCompat.H in every C++ file: it supplies the POSIX calls and strips
+  # the windows.h macros (ERROR, OPAQUE, ...) that wx pulls in first.
+  # win32compat/ stands in for the <sys/wait.h>-style headers MinGW lacks.
+  add_compile_options("$<$<COMPILE_LANGUAGE:CXX>:SHELL:-include ${CMAKE_SOURCE_DIR}/include/util/PosixCompat.H>")
+  include_directories(${CMAKE_SOURCE_DIR}/include/win32compat)
+endif()
+
 if(APPLE)
   # ~90 files across the tree spell OpenGL headers the Linux/X11 way
   # ("GL/gl.h", "GL/glu.h") -- Apple's own OpenGL framework headers live
@@ -173,6 +190,10 @@ function(ecce_library name)
   endforeach()
   add_library(${name} STATIC ${_srcs})
   target_include_directories(${name} PRIVATE ${XercesC_INCLUDE_DIRS})
+  if(WIN32)
+    # The libraries reference each other in cycles; GNU ld needs them repeated.
+    set_target_properties(${name} PROPERTIES LINK_INTERFACE_MULTIPLICITY 3)
+  endif()
 endfunction()
 
 # --- src/util -> libecceutil.a ---
@@ -189,6 +210,10 @@ target_compile_definitions(ecceutil PRIVATE ECCE_VERSION=\"${ECCE_VERSION_RAW}\"
 # Messaging (src/util/jms) is MQTT 5 on libmosquitto.
 pkg_check_modules(MOSQUITTO REQUIRED IMPORTED_TARGET libmosquitto)
 target_link_libraries(ecceutil PUBLIC PkgConfig::MOSQUITTO)
+if(WIN32)
+  # POSIX regex (libtre) and Winsock, which libssh's callers use directly.
+  target_link_libraries(ecceutil PUBLIC regex ws2_32)
+endif()
 
 # ------------------------------------------------------------------------
 # Where an installed ECCE lives, and where its ecce-<app> wrappers go.
@@ -226,6 +251,9 @@ ecce_library(eccetdat
 # --- src/dsm -> 5 separate libraries, matching the old per-subdir mapping ---
 ecce_library(eccexml    src/dsm/chemistry src/dsm/xml)
 ecce_library(eccecipc   src/dsm/cipc)
+if(WIN32)
+  target_link_libraries(eccecipc PUBLIC ws2_32)
+endif()
 find_package(OpenSSL REQUIRED)
 target_link_libraries(eccecipc PUBLIC OpenSSL::SSL OpenSSL::Crypto)
 ecce_library(eccedav    src/dsm/dav)
@@ -268,6 +296,7 @@ endif()
 # this codebase) live one level down - both are needed.
 # Same Homebrew-path gap as FREETYPE_UNQUALIFIED_INCLUDE_DIR above.
 find_path(FREETYPE_ROOT_INCLUDE_DIR ft2build.h
+  PATH_SUFFIXES freetype2
   PATHS /usr/include/freetype2 /usr/include
         /opt/homebrew/include/freetype2
         /usr/local/include/freetype2)
@@ -414,7 +443,13 @@ function(ecce_app name dir)
   if(ECCE_APP_GL)
     target_link_libraries(${name} PRIVATE OpenGL::GL OpenGL::GLU)
   endif()
-  target_link_libraries(${name} PRIVATE ${ECCE_APP_LINK} ${XercesC_LIBRARIES})
+  if(WIN32)
+    # The static libraries reference each other in cycles; GNU ld rescans a group.
+    target_link_libraries(${name} PRIVATE
+      "$<LINK_GROUP:RESCAN,${ECCE_APP_LINK}>" ${XercesC_LIBRARIES})
+  else()
+    target_link_libraries(${name} PRIVATE ${ECCE_APP_LINK} ${XercesC_LIBRARIES})
+  endif()
 endfunction()
 
 # --- apps with no wx dependency ---
@@ -442,7 +477,9 @@ target_link_libraries(mocomp PRIVATE
   eccedsi eccedav eccecipc eccefaces eccexml eccetdat eccedsi eccexml ecceutil
   ${XercesC_LIBRARIES})
 # flock(1) for the session scripts where util-linux is absent (macOS).
-add_executable(ecce-flock src/apps/flock/ecce-flock.c)
+if(NOT WIN32)   # the Windows client has no session scripts (#133)
+  add_executable(ecce-flock src/apps/flock/ecce-flock.c)
+endif()
 # The server half of "ecce -admin" on a -remote client (SiteRequest).
 add_executable(ecce-site-admin src/apps/siteadmin/ecce-site-admin.C)
 target_link_libraries(ecce-site-admin PRIVATE eccetdat ecceutil)
@@ -742,6 +779,7 @@ install(PROGRAMS
           ${CMAKE_SOURCE_DIR}/packaging/gateway/ecce-gateway-status
           ${CMAKE_SOURCE_DIR}/packaging/gateway/ecce-gateway-reap
           ${CMAKE_SOURCE_DIR}/packaging/gateway/ecce-find-mosquitto
+          ${CMAKE_SOURCE_DIR}/packaging/windows/ecce-broker-win
           ${CMAKE_SOURCE_DIR}/packaging/nwchem/ecce-nwchem-datadir
         DESTINATION bin
         COMPONENT client)
@@ -771,7 +809,7 @@ install(FILES ${CMAKE_BINARY_DIR}/systemd/ecce-broker.service
 # file (a central server's broker, ecce-gateway-start). Needs mosquitto's
 # plugin header and apr-util, whose apr_password_validate reads htpasswd's
 # hash formats.
-if(NOT APPLE)   # macOS runs no central server
+if(NOT APPLE AND NOT WIN32)   # macOS and Windows run no central server
   pkg_check_modules(APRUTIL REQUIRED IMPORTED_TARGET apr-util-1)
   find_path(MOSQUITTO_PLUGIN_INCLUDE_DIR mosquitto_plugin.h REQUIRED)
   add_library(ecce_users_auth MODULE src/mqttauth/ecce_users_auth.c)
@@ -906,8 +944,21 @@ set(ECCE_GUI_APPS
   mddynamics mdenergy mdoptimize mdprepare msgdialog metadyn organizer
   passdialog hostkeydialog pertable polyed solvate builder vizthumbnail)
 set(ECCE_CLI_APPS
-  load_tgbs ecmd eccejobmaster eccejobstore ecce-localdata ecce-flock ecce-site-admin mocomp
+  load_tgbs ecmd eccejobmaster eccejobstore ecce-localdata ecce-site-admin mocomp
   autosym getfrag genmol genmollat cleansym symops)
+if(NOT WIN32)
+  list(APPEND ECCE_CLI_APPS ecce-flock)
+endif()
+
+if(WIN32)
+  # GUI subsystem: no console window opens behind the apps. The command-line
+  # programs (ECCE_CLI_APPS, the parsers) keep theirs.
+  foreach(_app ${ECCE_GUI_APPS})
+    if(TARGET ${_app})
+      set_target_properties(${_app} PROPERTIES WIN32_EXECUTABLE ON)
+    endif()
+  endforeach()
+endif()
 
 install(TARGETS ${ECCE_GUI_APPS} ${ECCE_CLI_APPS} RUNTIME DESTINATION bin
         COMPONENT client)
@@ -1691,10 +1742,12 @@ add_executable(session_key_test tests/session/session_key_test.C)
 target_link_libraries(session_key_test PRIVATE ecceutil)
 add_test(NAME session-key COMMAND session_key_test
          ${CMAKE_SOURCE_DIR}/packaging/gateway/ecce-session-lib.sh)
+if(NOT WIN32)   # POSIX-only test programs
 add_executable(session_lease_test tests/session/session_lease_test.C)
 target_link_libraries(session_lease_test PRIVATE ecceutil)
 add_test(NAME session-lease COMMAND session_lease_test
          ${CMAKE_SOURCE_DIR}/packaging/gateway/ecce-session-lib.sh)
+endif()
 add_test(NAME session-display-gate COMMAND bash
          ${CMAKE_SOURCE_DIR}/tests/session/display_gate.sh ${CMAKE_SOURCE_DIR})
 set_tests_properties(session-display-gate PROPERTIES SKIP_RETURN_CODE 77)
@@ -1703,6 +1756,7 @@ set_tests_properties(session-display-gate PROPERTIES SKIP_RETURN_CODE 77)
 # socket; checks delivery, not just acknowledgement.  "auth" is the same on
 # a TCP broker with two accounts and the shipped access rules.  SKIPs (77)
 # without the mosquitto binary.
+if(NOT WIN32)
 add_executable(mqtt_test tests/mqtt/mqtt_test.C)
 target_include_directories(mqtt_test PRIVATE ${XercesC_INCLUDE_DIRS})
 target_link_libraries(mqtt_test PRIVATE ecceutil ${XercesC_LIBRARIES})
@@ -1714,6 +1768,7 @@ if(TARGET ecce_users_auth)
   set_tests_properties(mqtt-auth-plugin PROPERTIES TIMEOUT 120 SKIP_RETURN_CODE 77)
 endif()
 set_tests_properties(mqtt mqtt-auth PROPERTIES TIMEOUT 120 SKIP_RETURN_CODE 77)
+endif()
 
 # tests/tls -- https data-server client (#236): pinned certificate, CA mode
 # with host-name check, certificate rejection, no fallback to plain http.
@@ -1923,10 +1978,18 @@ if(PYTHON3_EXECUTABLE)
   set_tests_properties(filedsi PROPERTIES TIMEOUT 300)
 
   # tests/transport -- DirectTransport against a real /bin/sh (#204).
-  add_executable(testTransport tests/transport/testTransport.C)
-  target_link_libraries(testTransport PRIVATE eccercmd ecceutil)
-  add_test(NAME transport COMMAND testTransport)
-  set_tests_properties(transport PROPERTIES TIMEOUT 120)
+  if(NOT WIN32)
+    add_executable(testTransport tests/transport/testTransport.C)
+    target_link_libraries(testTransport PRIVATE eccercmd ecceutil)
+    add_test(NAME transport COMMAND testTransport)
+    set_tests_properties(transport PROPERTIES TIMEOUT 120)
+  endif()
+
+  # Process launch (POSIX fork/exec and the Windows CreateProcess path, #133).
+  add_executable(testWinProcess tests/transport/testWinProcess.C)
+  target_link_libraries(testWinProcess PRIVATE eccercmd ecceutil)
+  add_test(NAME transport_process COMMAND testWinProcess)
+  set_tests_properties(transport_process PROPERTIES TIMEOUT 180)
 
   # RCommand on a local machine against results recorded from the old pty
   # path (#204).
@@ -1994,6 +2057,9 @@ if(PYTHON3_EXECUTABLE)
     eccewxguicomm eccewxgui eccecomm eccercmd eccedsi eccedav eccecipc
     eccefaces eccexml eccetdat ecceutil ${wxWidgets_LIBRARIES}
     ${XercesC_LIBRARIES})
+  if(WIN32)   # GNU ld resolves static libraries in order (#133)
+    target_link_libraries(tailwindow PRIVATE "$<LINK_GROUP:RESCAN,eccewxguicomm;eccewxgui;eccecomm;eccercmd;eccedsi;eccedav;eccecipc;eccefaces;eccexml;eccetdat;ecceutil>" ${XercesC_LIBRARIES})
+  endif()
   add_test(NAME transport_tail_window
            COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/tests/transport/tail_window_test.sh
                    $<TARGET_FILE:tailwindow> ${CMAKE_CURRENT_SOURCE_DIR})
 
@@ -47,5 +47,6 @@ what the deployment mode needs (GETTING_STARTED, "Deployment modes"):
 - [Waiting for login: a lost monitor parks the job, session start catches it up](waiting-for-login.md)
 - [Test suites get a per-run state directory, ports and X display](test-suites-isolate-per-run.md)
 - [Full builds and long suites go to radium/tellurium via tools/offload](long-suites-go-to-offload-hosts.md)
+- [Windows local jobs: paths in sh scripts, the job id, Strawberry perl, the broker](windows-local-jobs-pitfalls.md)
 - [A remote view rides ECCE's own login, not an ssh of its own (Tail)](remote-views-use-ecces-own-login.md)
 - [A calculation's molecule and basis properties are stored below it](calculation-properties-live-below-it.md)