Windows: fix installer crash (electron-builder bump), memry-file paths, and cloud-lock write retries

[h4yfans]

Why

A Windows user (Reddit r/MemryNote) hit three independent failures, all confirmed from his main.log + Event Viewer data:

1. MemryNote-*-setup.exe crashes before showing any UI — faulting module System.dll (NSIS plugin), 0xc0000005 at offset 0x1581, 3× deterministic. Root cause is a buffer over-read in electron-builder 26.7.0's stock multiUser.nsh per-user fresh-install branch (System::Call '*$2(&w${NSIS_MAX_STRLEN} .s)' reading a small SHGetKnownFolderPath buffer), fixed upstream in 26.9.0+. It only fires when no HKCU InstallLocation exists — which is why updates worked for years but a clean install after uninstall dies instantly, and why his in-app update "got stuck" (the app quit cleanly; the silent NSIS run crashed after exit).
2. Every PDF/image opened from Collections shows "server error" on Windows — two stacked path bugs: renderer built memry-file://local${absolutePath}, so C: was parsed as the URL host and the handler resolved a relative path against the install dir; and the handler allowlist compared with startsWith(dir + '/'), which never matches Windows backslash paths, so even a well-formed URL was 403'd. His log shows the exact mangled path (...\Programs\@memrydesktop\Users\Leib.000\Koofr\...).
3. Clicking an attachment link inside a note did nothing — memry-file: fell into the openExternal scheme allowlist and was silently denied (8× in his log).

His vault also lives inside a Koofr cloud-sync folder, which holds transient locks on vault files.

What

• Bump electron-builder ^26.0.12 → ^26.15.6 — the fixed template uses a bounded lstrcpynW copy. Verified by cross-building the actual Windows targets on macOS with the new version: real MemryNote-*-setup.exe (146 MB) + MemryNote-*-win.zip (191 MB) produced.
• Publish a MemryNote-<version>-win.zip alongside the setup exe (installer-free escape hatch for support). latest.yml still lists only the setup exe, so electron-updater behavior is unchanged; landing download API keeps resolving -setup.exe (fixture test with the zip listed first).
• toMemryFileUrl renderer helper (leading slash, backslash→slash, per-segment percent-encoding) replacing both string-concat build sites; round-trip tests for Windows drive paths, spaces, Hebrew filenames, and URL-hostile chars.
• isPathInsideDirs platform-separator containment used by the protocol handler and the window-open route; win32 behavior unit-tested (prefix-sibling dirs rejected).
• memry-file window opens route to shell.openPath after the same containment check, never shell.openExternal; unknown schemes still blocked, https still allowed (tests extended).
• Atomic vault writes retry EBUSY/EPERM/EACCES with bounded backoff (~3 attempts, <1s total) for cloud-sync/AV locks; tests cover transient-then-success, persistent failure, and immediate ENOENT propagation.
• Startup log line with app version + channel — his log's binary change was only detectable via an unrelated log-text diff.
• Docs: memry-file path rules + retry semantics in architecture/local-storage.md, zip fallback in guide/install.md.

Proof

• Focused + full suites green locally: main 3487 / renderer 5096 / shared 2074 passed; lint 0 errors; typecheck 16/16 tasks; docs:impact --strict + docs:build green.
• New tests: memry-file-url.test.ts (8), external-url.test.ts (+10 incl. 5 win32 containment), index.phase2.test.ts (+2 wiring), file-ops.test.ts (retry matrix), apps/landing/api/download.test.ts (zip fixture).
• Local electron-builder 26.15.6 Windows build artifacts produced end-to-end (unsigned, version-unstamped — CI holds secrets/version).

Notes

• The -win.zip won't exist until the next release runs publish-release.yml; the workflow's staging filter and verify step now require it.
• Not in scope: PR fix(desktop): preflight the CRDT store in a disposable child process #729 (utilityProcess classic-level preflight) — this user's log independently re-confirms that failure pattern on Windows; fix(desktop): preflight the CRDT store in a disposable child process #729 remains the fix for the silent pre-window aborts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
memry-docs	Ready	Preview, Comment	Jul 10, 2026 12:44pm
memrynote-landing	Ready	Preview, Comment	Jul 10, 2026 12:44pm

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 655dc9b.}

[codecov]

Codecov Report

❌ Patch coverage is 91.54930% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
apps/desktop/src/main/sync/attachments.ts	64.28%	5 Missing ⚠️
apps/desktop/src/main/lib/external-url.ts	94.73%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!