docs: document verified Windows 0.4.0 release

docs/gitea-release.md

@@ -2,8 +2,8 @@
 
 The release destination is
 https://server2.sorokin-oleg-edu.xyz/replicated/learnharness.
-Version **0.4.0 targets Linux x64**. Windows is deferred until a native Windows
-builder is available. The upstream GitHub workflow and three-platform packaging
+Version **0.4.0 targets Linux x64 and Windows x64**, with each platform built
+and verified on its native operating system. The upstream GitHub workflow and three-platform packaging
 configuration remain available as reference in `.github/workflows/release.yml`
 and `electron-builder.yml`.
 
@@ -48,14 +48,55 @@ node scripts/smoke-provider-runtime.mjs --standalone dist/linux-unpacked/resourc
 xvfb-run -a node scripts/smoke-demo-runtime.mjs --standalone dist/linux-unpacked/resources/server/standalone --runtime dist/linux-unpacked/learnharness --browser
 ```
 
-The Linux 0.4.0 release has exactly four attachments:
+The Linux portion of 0.4.0 has these attachments:
 
 - `LearnHarness-0.4.0-x86_64.AppImage`
 - `LearnHarness-0.4.0-amd64.deb`
 - `latest-linux.yml`
 - `SHA256SUMS`
 
-## Preparing the Gitea draft
+## Preparing Windows packages
+
+Use a clean checkout of the same `v0.4.0` tag on Windows x64 with Node 26 and Git
+for Windows. Keep build tools and logs outside the checkout. The local Windows
+checkout used for this release is `~/Documents/Gitea/learnharness`.
+
+In PowerShell, stop after any failed command:
+
+```powershell
+npm.cmd ci
+$env:NODE_ENV = 'test'
+$env:ELECTRON_RUN_AS_NODE = '1'
+node node_modules/electron/cli.js --import tsx --test tests/pdf-native-render.test.ts tests/pdf-ops.test.ts tests/svg-native-render.test.ts tests/browser-service.test.ts
+Remove-Item Env:ELECTRON_RUN_AS_NODE
+node --import tsx --test tests/i18n.test.tsx
+Remove-Item Env:NODE_ENV
+node node_modules/next/dist/bin/next build
+node scripts/smoke-provider-runtime.mjs
+node scripts/build-server.mjs
+node scripts/smoke-server.mjs --electron
+node node_modules/electron-builder/out/cli/cli.js --config electron-builder.gitea.yml --win --x64 --publish never
+node scripts/gitea-release.mjs verify-package dist/win-unpacked
+node scripts/smoke-provider-runtime.mjs --standalone dist/win-unpacked/resources/server/standalone
+node scripts/smoke-provider-runtime.mjs --standalone dist/win-unpacked/resources/server/standalone --runtime dist/win-unpacked/LearnHarness.exe
+node scripts/smoke-demo-runtime.mjs --standalone dist/win-unpacked/resources/server/standalone --runtime dist/win-unpacked/LearnHarness.exe --browser
+```
+
+Windows contributes three attachments:
+
+- `LearnHarness-0.4.0-x64-setup.exe`
+- `LearnHarness-0.4.0-x64-setup.exe.blockmap`
+- `latest.yml`
+
+The combined release has **seven attachments**, including one `SHA256SUMS`
+covering all six other files. Verify that `latest.yml` names the Windows
+installer exactly, reports version `0.4.0`, and matches the installer's actual
+size and SHA-512. Its gzip blockmap must cover the installer and match every
+block checksum. Confirm the packaged `resources/app-update.yml` uses the Gitea
+generic provider. Windows builds follow upstream's unsigned, per-user installer
+configuration.
+
+## Preparing a Linux-only Gitea draft
 
 Commit and push the release source, then push its exact annotated tag:
 
@@ -77,6 +118,14 @@ SHA-256 against the local verified build. Existing mismatched attachments and
 published releases are refused. It never publishes or changes repository
 visibility. Release notes come from `docs/release-0.4.0.md`.
 
+This uploader and its remote verifier enforce a **Linux-only** inventory. They
+will refuse a combined Linux/Windows draft. For the combined 0.4.0 release, add
+the verified Windows attachments to the existing draft and replace `SHA256SUMS`
+with the combined manifest. Keep the Linux installers and feed unchanged. Check
+all seven attachment names, sizes, and actual downloaded hashes against the
+verified local builds; update the bilingual release notes to include Windows.
+Do not publish until both platforms' checks pass.
+
 A separate verification can be repeated without changing the draft:
 
 ```sh
@@ -98,6 +147,6 @@ does not queue a job that cannot run.
 The workflow uses the repository's ephemeral `GITEA_TOKEN` with release-write
 permission only in the final upload step. It checks out the requested tag without
 persisting credentials and leaves the result as a verified draft. Public pull
-requests cannot trigger this publishing workflow. Add Windows only with a native
-Windows build and its corresponding smoke checks; do not substitute a Linux
-standalone payload into a Windows installer.
+requests cannot trigger this publishing workflow. This workflow remains
+Linux-only; the combined 0.4.0 draft was assembled from local native builds.
+Windows has its own standalone payload and smoke checks, as described above.