cj-tauri 0.8.0 → 1.1.0

package/native/platforms/windows/bridge_win.c

@@ -0,0 +1,3248 @@
+/*
+ * cj-tauri C 桥（Windows 平台层）：Win32 窗口 + WebView2 宿主原语
+ *
+ * 本文件只实现 bridge_core.h 的「平台原语清单」+ 宿主线程装配；平台无关逻辑
+ * （IPC 回投队列与批处理、对话框单槽状态机、窗口配置存储、生命周期标志、全部导出）
+ * 都在 native/bridge_core.c，两平台共用。分层原因见 docs/架构演进-多平台与多窗口.md §2.2。
+ *
+ * 分层对标 Tauri 2：本文件 = tao(窗口/事件循环) + wry(WebView 抽象) 的 Windows 后端，
+ * 上层 IPC 桥 / capability 安全模型（src 目录下的 .cj）跨平台复用。
+ *
+ * 与 Linux 桥（bridge_linux.c）的差异：
+ *  - Windows 的 JS 引擎（V8）运行在 msedgewebview2.exe 独立进程，宿主进程内不跑 JS 引擎，
+ *    因此 Linux 上 JSC 栈边界校验导致的「WebView 调用必须在原生 pthread」约束在此不适用；
+ *    这里仍保持「独立宿主线程 + JS FIFO 投递」的同构结构，两端 API 与行为一致。
+ *  - JS → 宿主：window.chrome.webview.postMessage(JSON.stringify(obj))
+ *  - 宿主 → JS：ExecuteScript("window.postMessage(json,'*')")，与 Linux 端完全一致
+ *
+ * 编译（mingw-w64 / llvm-mingw gcc，见 native/build_win.bat）：
+ *   gcc -shared -O2 bridge_core.c bridge_win.c -o libcjtbridge.dll \
+ *       -Wl,--out-implib,libcjtbridge.dll.a \
+ *       -I<WebView2 SDK>/build/native/include \
+ *       -lole32 -loleaut32 -luuid -luser32 -lgdi32
+ * 运行期要求：libcjtbridge.dll 与 WebView2Loader.dll 位于 exe 目录或 PATH 中。
+ */
+#define UNICODE
+#define _UNICODE
+/* 条件变量（CONDITION_VARIABLE）要 Vista+ 的头；WebView2 本身就要求 Win10，写 0x0601 足够 */
+#define _WIN32_WINNT 0x0601
+#include <windows.h>
+#include <commdlg.h>
+#include <objbase.h>
+#include <shellapi.h> /* DragQueryFileW / DragFinish（CF_HDROP → 文件列表，shell32） */
+#include <shobjidl.h> /* IFileOpenDialog + FOS_PICKFOLDERS（选目录，kind 6；ole32 已在链接项里）*/
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <wchar.h>   /* wmemcpy / wcslen（EOF 白名单与对话框预置文件名都要用）*/
+#include "WebView2.h"
+#include "bridge_core.h"
+
+/* ===== COM 回调对象（每个宿主一套）=====
+   原先 4 个 handler 是静态单例（AddRef/Release 硬编码 return 1），多窗口一落地就分不清是谁的回调；
+   现在按宿主内嵌，This 直接转回本结构就能拿到 cj_host。引用计数仍恒 1：对象随宿主句柄存续
+    （句柄壳活到 cj_bridge_destroy），这是 WebView2 手工 COM 的惯用写法，也是 AGENTS.md §4 里
+   hr=0x8007139F 那个坑的由来——AddRef 若返回 0 / 不自持有，注册给 WebView2 的回调会被提前回收。 */
+typedef struct env_handler {
+    ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler iface; /* 首成员：This == &iface */
+    cj_host *h;
+} env_handler;
+
+typedef struct ctrl_handler {
+    ICoreWebView2CreateCoreWebView2ControllerCompletedHandler iface;
+    cj_host *h;
+} ctrl_handler;
+
+typedef struct msg_handler {
+    ICoreWebView2WebMessageReceivedEventHandler iface;
+    cj_host *h;
+} msg_handler;
+
+typedef struct nav_handler {
+    ICoreWebView2NavigationCompletedEventHandler iface;
+    cj_host *h;
+} nav_handler;
+
+/* ===== 菜单栏（RFC-002 §5.4 / §5.5）=====
+   core 把线路文本交下来，本文件翻译成 Win32 菜单栏。菜单栏是**每窗口**资源（HMENU 挂在窗口上），
+   建 / 换 / 改都必须在 UI 线程上做——跨线程调用一律 PostMessage 到宿主线程。 */
+#define CJ_MENU_MAX_ITEMS 64
+#define CJ_MENU_MAX_DEPTH 8
+
+typedef struct menu_slot {
+    UINT cmd_id;   /* 建菜单时分配的命令 id（WM_COMMAND 带回来的那个），从 1 开始 */
+    char *app_id;  /* 应用给的稳定 id：回投仓颉侧，也是 set_menu_item_state 的查找键 */
+    char kind;     /* 'n' 普通 / 'c' 勾选（点击时由我们自己翻转勾选状态）*/
+    int enabled;
+    int checked;
+} menu_slot;
+
+/* ===== 全局快捷键（RFC-003 第 5 期）=====
+   线路文本一行一条 `<accel>:<id>`（见 bridge_core.h 的 pending_hotkeys 注释）。
+   RegisterHotKey 只认「修饰键位掩码 + 虚拟键码」，本层负责把 accel 词法翻译成这两样；
+   解析不了 / 被系统占用的那条整行丢弃并出声（不静默吞，与 Linux 的 X11 grab 口径一致）。 */
+#define CJ_HOTKEY_MAX 16
+
+typedef struct hotkey_slot {
+    int id;         /* RegisterHotKey 的 id（1..CJ_HOTKEY_MAX）；WM_HOTKEY 的 wParam 就是它 */
+    char *app_id;   /* 应用给的稳定标识：回投 core 的 cj_core_hotkey_pressed 用它 */
+    UINT mods;      /* MOD_CONTROL / MOD_ALT / MOD_SHIFT / MOD_WIN 的按位或（0 = 无修饰）*/
+    UINT vk;        /* 虚拟键码（VK_*）*/
+    int registered; /* RegisterHotKey 成功；失败的那条不参与回投 */
+} hotkey_slot;
+
+/* ===== 每个宿主的平台私有状态 =====
+   原先是一堆进程级单例（g_hwnd / g_controller / g_environment / g_webview / g_host_thread_id …）。
+   现在挂在自己的 cj_host->plat 上，平台函数一律从入参句柄取状态。 */
+typedef struct plat_host {
+    HWND hwnd;                                /* 主窗口；WM_DESTROY 后置空 */
+    ICoreWebView2Controller *controller;
+    ICoreWebView2Environment *environment;    /* 必须自己持有一份引用（见 env_Invoke）*/
+    ICoreWebView2 *webview;
+    HANDLE thread;                            /* 宿主线程句柄（cj_plat_fini 里 join 用）*/
+    DWORD thread_id;                          /* 宿主线程 id：判断「调用方是否已在宿主线程」*/
+    int thread_started;
+    int thread_set;
+    volatile int thread_done;                 /* 宿主线程跑完（收尾最后一步）：见 cj_plat_fini */
+    HMODULE loader;                           /* WebView2Loader.dll */
+    env_handler env;
+    ctrl_handler ctrl;
+    msg_handler msg;
+    nav_handler nav;
+    /* --- 菜单栏（只在 UI 线程上建 / 换 / 改）--- */
+    HMENU menu;                               /* 当前菜单栏；NULL = 没有 */
+    menu_slot menu_items[CJ_MENU_MAX_ITEMS];  /* 命令 id ↔ 应用 id 映射：WM_COMMAND 靠它回投 */
+    int menu_item_count;
+    /* --- 拖放（7.B Windows 真实现，只在 UI 线程挂 / 摘）--- */
+    IDropTarget *drop_target;                 /* 我们的拖放目标；NULL = 尚未创建 */
+    /* --- 托盘（Shell_NotifyIconW，只在 UI 线程上建 / 换 / 拆）--- */
+    NOTIFYICONDATAW nid;                      /* 图标注册块：hWnd/uID/uCallbackMessage 一次填好 */
+    int tray_added;                           /* 图标真挂上去了（最小化拦截拿它做降级判据）*/
+    HMENU tray_menu;                          /* 托盘菜单（左键 / 右键都弹它）；NULL = 没有 */
+    menu_slot tray_items[CJ_MENU_MAX_ITEMS];  /* 命令 id ↔ 应用 id：WM_COMMAND 靠它回投 */
+    int tray_item_count;
+    /* --- 全局快捷键（RegisterHotKey，只在 UI 线程上注册 / 注销）--- */
+    hotkey_slot hotkeys[CJ_HOTKEY_MAX];
+    int hotkey_count;
+    /* --- 最小化到托盘：托盘没装上时「降级为普通最小化」只出声一次 --- */
+    int min_to_tray_warned;
+} plat_host;
+
+/* 拖放目标的挂/摘（定义在文件后部）：controller 完成回调与 wnd_proc 都要调 */
+static void drag_dest_apply(cj_host *h, plat_host *p, int enabled);
+
+/* ===== 同步原语（core 只用这些，绝不直接碰 Win32）=====
+   与 Linux 桥的 pthread_mutex + pthread_cond 一一对应；用条件变量而不是「事件」的好处是
+   谓词在锁内检查，不存在「先 SetEvent 后 CreateEvent 丢唤醒」的时序坑。 */
+
+struct cj_sync {
+    CRITICAL_SECTION cs;
+    CONDITION_VARIABLE cv;
+};
+
+cj_sync *cj_plat_sync_create(void) {
+    cj_sync *s = (cj_sync *)calloc(1, sizeof(cj_sync));
+    if (!s) return NULL;
+    InitializeCriticalSection(&s->cs);
+    InitializeConditionVariable(&s->cv);
+    return s;
+}
+
+void cj_plat_sync_destroy(cj_sync *s) {
+    if (!s) return;
+    DeleteCriticalSection(&s->cs); /* CONDITION_VARIABLE 无需销毁 */
+    free(s);
+}
+
+void cj_plat_sync_lock(cj_sync *s) {
+    if (s) EnterCriticalSection(&s->cs);
+}
+
+void cj_plat_sync_unlock(cj_sync *s) {
+    if (s) LeaveCriticalSection(&s->cs);
+}
+
+void cj_plat_sync_wait(cj_sync *s, int *ready) {
+    if (!s || !ready) return;
+    while (!*ready) {
+        SleepConditionVariableCS(&s->cv, &s->cs, INFINITE);
+    }
+}
+
+void cj_plat_sync_signal(cj_sync *s) {
+    if (s) WakeConditionVariable(&s->cv);
+}
+
+/* ===== UTF-8 <-> UTF-16 ===== */
+
+static wchar_t *utf8_to_wide(const char *s) {
+    if (!s) return NULL;
+    int n = MultiByteToWideChar(CP_UTF8, 0, s, -1, NULL, 0);
+    if (n <= 0) return NULL;
+    wchar_t *w = (wchar_t *)malloc((size_t)n * sizeof(wchar_t));
+    if (!w) return NULL;
+    MultiByteToWideChar(CP_UTF8, 0, s, -1, w, n);
+    return w;
+}
+
+static char *wide_to_utf8(const wchar_t *w) {
+    if (!w) return NULL;
+    int n = WideCharToMultiByte(CP_UTF8, 0, w, -1, NULL, 0, NULL, NULL);
+    if (n <= 0) return NULL;
+    char *s = (char *)malloc((size_t)n);
+    if (!s) return NULL;
+    WideCharToMultiByte(CP_UTF8, 0, w, -1, s, n, NULL, NULL);
+    return s;
+}
+
+/* 关键 WebView2 调用的 HRESULT 上报 */
+static void log_hr(const char *what, HRESULT hr) {
+    fprintf(stderr, "[cj-bridge] %s -> hr=0x%08lx\n", what, (unsigned long)hr);
+}
+
+/* ===== 注入前端桥接脚本（暴露 window.__CJ_TAURI__，对标 @tauri-apps/api）===== */
+
+/* 平台唯一差异行（其余 JS 见 native/bridge_js.h，两平台共用一份，防漂移）：
+   post 通道 = chrome.webview；reload 控制消息同通道发字面量。宽字符：本文件要 wchar_t。 */
+#define CJ_LIT(s) L##s
+#define CJ_POST_STMT L"    window.chrome.webview.postMessage(JSON.stringify(obj));"
+#define CJ_RELOAD_STMT L"      window.chrome.webview.postMessage('__cj_tauri_reload__');"
+#include "bridge_js.h"
+
+static const wchar_t *BRIDGE_JS = CJ_BRIDGE_JS(CJ_POST_STMT, CJ_RELOAD_STMT);
+
+/* ===== 投递通道用到的窗口消息（PostMessage 按窗口寻址，句柄从窗口 USERDATA 取）===== */
+
+#define WM_CJT_FLUSH (WM_APP + 1)
+#define WM_CJT_QUIT (WM_APP + 2)
+#define WM_CJT_DEVTOOLS (WM_APP + 3)
+#define WM_CJT_LOAD_URL (WM_APP + 4)
+#define WM_CJT_RELOAD (WM_APP + 5)
+#define WM_CJT_DIALOG (WM_APP + 6)
+#define WM_CJT_MENU (WM_APP + 7)       /* 运行期换菜单：lParam = strdup 的线路文本（UI 线程释放）*/
+#define WM_CJT_MENU_ITEM (WM_APP + 8)  /* 运行期改单项状态：lParam = menu_state_msg*（UI 线程释放）*/
+#define WM_CJT_UI (WM_APP + 9)         /* 通用 UI 投递（剪贴板等）：lParam = cj_ui_msg*（UI 线程释放）*/
+#define WM_CJT_DRAG_DROP (WM_APP + 10) /* 运行期挂/摘拖放：lParam = drag_drop_msg*（UI 线程释放）*/
+#define WM_CJT_TRAY (WM_APP + 11)      /* 运行期换托盘：lParam = strdup 的线路文本（UI 线程释放）*/
+#define WM_CJT_HOTKEYS (WM_APP + 12)   /* 运行期换快捷键表：lParam = strdup 的线路文本（UI 线程释放）*/
+#define WM_CJT_VISIBLE (WM_APP + 13)   /* 运行期改可见性：wParam = 0 隐藏 / 1 显示 */
+#define WM_CJT_TRAY_NOTIFY (WM_APP + 14) /* 托盘图标的回调消息（Shell_NotifyIconW 的 uCallbackMessage）*/
+
+/* 托盘菜单项的命令 id 从 1000 起：TrackPopupMenu 的 WM_COMMAND 也落到本窗口，
+   与菜单栏的命令 id（从 1 起）分开放，WM_COMMAND 才能判别是哪一个表。 */
+#define CJ_TRAY_CMD_BASE 1000
+#define CJ_TRAY_UID 1 /* NOTIFYICONDATAW.uID：一个进程一个托盘图标 */
+
+/* 运行期改单项状态：跨线程传递的小包裹（谁 post 谁分配，UI 线程处理完释放）*/
+typedef struct menu_state_msg {
+    char *id;
+    int enabled;
+    int checked;
+} menu_state_msg;
+
+/* 运行期挂/摘拖放：跨线程传递的小包裹（谁 post 谁分配，UI 线程处理完释放）*/
+typedef struct drag_drop_msg {
+    int enabled;
+} drag_drop_msg;
+
+/* 通用 UI 投递的包裹：PostMessage 一次带一个 fn + ud（UI 线程处理完释放）*/
+typedef struct cj_ui_msg {
+    cj_ui_fn fn;
+    void *ud;
+} cj_ui_msg;
+
+static LRESULT CALLBACK wnd_proc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp);
+/* 错误格式化助手（定义在串口区，剪贴板也用它） */
+static void serial_err(char *err, int err_len, const char *fmt, ...);
+/* 菜单实现集中在文件末尾；宿主线程与窗口过程要用，先声明 */
+static void menu_apply_wire(cj_host *h, plat_host *p, const char *wire);
+static void menu_apply_item_state(plat_host *p, const char *id, int enabled, int checked);
+static void menu_clear_slots(plat_host *p);
+/* 托盘 / 全局快捷键 / 窗口可见性实现同样在文件末尾；宿主线程与窗口过程要用，先声明 */
+static void tray_apply_wire(cj_host *h, plat_host *p, const char *wire);
+static void tray_remove(plat_host *p);
+static void hotkey_apply_wire(plat_host *p, const char *wire);
+static void hotkey_unregister_all(plat_host *p);
+static void window_apply_visible(plat_host *p, int visible);
+static int accel_parse(const char *accel, UINT *mods, UINT *vk);
+
+/* ===== COM 回调实现（完成/事件 handler）===== */
+
+/* --- 环境创建完成 --- */
+
+static HRESULT STDMETHODCALLTYPE env_QueryInterface(
+        ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler *This, REFIID riid, void **ppvObject) {
+    if (ppvObject) *ppvObject = This;
+    return S_OK;
+}
+
+static ULONG STDMETHODCALLTYPE env_AddRef(
+        ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler *This) {
+    return 1;
+}
+
+static ULONG STDMETHODCALLTYPE env_Release(
+        ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler *This) {
+    return 1;
+}
+
+static HRESULT STDMETHODCALLTYPE env_Invoke(
+        ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler *This,
+        HRESULT errorCode, ICoreWebView2Environment *result) {
+    env_handler *self = (env_handler *)This;
+    cj_host *h = self ? self->h : NULL;
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+
+    if (!h || !p) return S_OK;
+    if (FAILED(errorCode) || !result) {
+        fprintf(stderr, "[cj-bridge] create WebView2 environment failed: 0x%08lx\n",
+                (unsigned long)errorCode);
+        h->should_quit = 1;
+        cj_core_window_destroyed(h); /* 通知仓颉侧（onDestroy 恰好一次）+ 作废对话框 */
+        if (p->hwnd) PostMessageW(p->hwnd, WM_CJT_QUIT, 0, 0);
+        return S_OK;
+    }
+    /* 必须自己持有一份环境引用：否则本回调返回后环境对象被释放，
+       WebView2 会随即关闭浏览器进程，表现为导航不完成、ExecuteScript 返回 0x8007139F */
+    p->environment = result;
+    p->environment->lpVtbl->AddRef(p->environment);
+    result->lpVtbl->CreateCoreWebView2Controller(result, p->hwnd, &p->ctrl.iface);
+    fprintf(stderr, "[cj-bridge] WebView2 environment ready\n");
+    return S_OK;
+}
+
+static ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandlerVtbl g_env_vtbl = {
+    env_QueryInterface, env_AddRef, env_Release, env_Invoke
+};
+
+/* --- 控制器（WebView）创建完成：装配 WebView、注入桥、加载 HTML --- */
+
+static HRESULT STDMETHODCALLTYPE ctrl_QueryInterface(
+        ICoreWebView2CreateCoreWebView2ControllerCompletedHandler *This, REFIID riid, void **ppvObject) {
+    if (ppvObject) *ppvObject = This;
+    return S_OK;
+}
+
+static ULONG STDMETHODCALLTYPE ctrl_AddRef(
+        ICoreWebView2CreateCoreWebView2ControllerCompletedHandler *This) {
+    return 1;
+}
+
+static ULONG STDMETHODCALLTYPE ctrl_Release(
+        ICoreWebView2CreateCoreWebView2ControllerCompletedHandler *This) {
+    return 1;
+}
+
+static HRESULT STDMETHODCALLTYPE ctrl_Invoke(
+        ICoreWebView2CreateCoreWebView2ControllerCompletedHandler *This,
+        HRESULT errorCode, ICoreWebView2Controller *result) {
+    ctrl_handler *self = (ctrl_handler *)This;
+    cj_host *h = self ? self->h : NULL;
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    RECT rc;
+    int i;
+
+    if (!h || !p) return S_OK;
+    if (FAILED(errorCode) || !result) {
+        fprintf(stderr, "[cj-bridge] create WebView2 controller failed: 0x%08lx\n",
+                (unsigned long)errorCode);
+        h->should_quit = 1;
+        cj_core_window_destroyed(h);
+        if (p->hwnd) PostMessageW(p->hwnd, WM_CJT_QUIT, 0, 0);
+        return S_OK;
+    }
+    p->controller = result;
+    p->controller->lpVtbl->AddRef(p->controller);
+    result->lpVtbl->get_CoreWebView2(result, &p->webview);
+    if (!p->webview) {
+        fprintf(stderr, "[cj-bridge] get_CoreWebView2 failed\n");
+        return S_OK;
+    }
+
+    /* 先让父窗口可见，再摆放 WebView：不可见的父窗口会挂起渲染 */
+    ShowWindow(p->hwnd, SW_SHOW);
+    UpdateWindow(p->hwnd);
+
+    GetClientRect(p->hwnd, &rc);
+    result->lpVtbl->put_Bounds(result, rc);
+    result->lpVtbl->put_IsVisible(result, TRUE);
+
+    /* WebView 行为设置 */
+    {
+        ICoreWebView2Settings *settings = NULL;
+        HRESULT hr = p->webview->lpVtbl->get_Settings(p->webview, &settings);
+        if (SUCCEEDED(hr) && settings) {
+            settings->lpVtbl->put_IsStatusBarEnabled(settings, FALSE);
+            settings->lpVtbl->put_IsZoomControlEnabled(settings, FALSE);
+            settings->lpVtbl->put_AreDefaultContextMenusEnabled(settings, TRUE);
+            settings->lpVtbl->put_AreDevToolsEnabled(settings, h->devtools ? TRUE : FALSE);
+            settings->lpVtbl->Release(settings);
+        }
+    }
+
+    /* 拖放：先关掉 WebView2 自己的外部拖放（不关的话它先吃掉 drop，默认行为是导航到文件）；
+       装配期已 set_drag_drop 过的（pending 非 0）这时挂我们的 IDropTarget */
+    {
+        ICoreWebView2Controller4 *c4 = NULL;
+        if (SUCCEEDED(p->controller->lpVtbl->QueryInterface(p->controller,
+                &IID_ICoreWebView2Controller4, (void **)&c4)) && c4) {
+            c4->lpVtbl->put_AllowExternalDrop(c4, FALSE);
+            c4->lpVtbl->Release(c4);
+        }
+    }
+    if (h->pending_drop_enabled) {
+        drag_dest_apply(h, p, h->pending_drop_enabled);
+    }
+
+    /* 注入桥接脚本（页面脚本执行前）+ 注册 JS 消息通道 */
+    p->webview->lpVtbl->AddScriptToExecuteOnDocumentCreated(p->webview, BRIDGE_JS, NULL);
+    /* 预执行脚本按注册顺序追加在桥之后（WebView2 按注册顺序执行），脚本里可直接用 window.__CJ_TAURI__ */
+    for (i = 0; i < h->init_script_count; i++) {
+        wchar_t *w = utf8_to_wide(h->init_scripts[i]);
+        if (w) {
+            p->webview->lpVtbl->AddScriptToExecuteOnDocumentCreated(p->webview, w, NULL);
+            free(w);
+        }
+    }
+    fprintf(stderr, "[cj-bridge] init scripts injected: %d\n", h->init_script_count);
+    p->webview->lpVtbl->add_WebMessageReceived(p->webview, &p->msg.iface, NULL);
+    p->webview->lpVtbl->add_NavigationCompleted(p->webview, &p->nav.iface, NULL);
+
+    cj_core_set_ready(h);
+    fprintf(stderr, "[cj-bridge] controller ready, loading page\n");
+
+    /* 页面来源：URL 优先（cj_bridge_load_url），否则内联 HTML（cj_bridge_start） */
+    if (h->pending_url) {
+        wchar_t *w = utf8_to_wide(h->pending_url);
+        if (w) {
+            log_hr("Navigate", p->webview->lpVtbl->Navigate(p->webview, w));
+            free(w);
+        }
+        fprintf(stderr, "[cj-bridge] url navigation requested: %s\n", h->pending_url);
+    } else if (h->pending_html) {
+        wchar_t *w = utf8_to_wide(h->pending_html);
+        if (w) {
+            log_hr("NavigateToString", p->webview->lpVtbl->NavigateToString(p->webview, w));
+            free(w);
+        }
+        fprintf(stderr, "[cj-bridge] html navigation requested\n");
+    }
+    /* 宿主就绪前可能已有排队脚本（如启动即推送的事件） */
+    cj_core_flush_js(h);
+    return S_OK;
+}
+
+static ICoreWebView2CreateCoreWebView2ControllerCompletedHandlerVtbl g_ctrl_vtbl = {
+    ctrl_QueryInterface, ctrl_AddRef, ctrl_Release, ctrl_Invoke
+};
+
+/* --- JS → 宿主的消息（chrome.webview.postMessage 的字符串载荷）--- */
+
+static HRESULT STDMETHODCALLTYPE msg_QueryInterface(
+        ICoreWebView2WebMessageReceivedEventHandler *This, REFIID riid, void **ppvObject) {
+    if (ppvObject) *ppvObject = This;
+    return S_OK;
+}
+
+static ULONG STDMETHODCALLTYPE msg_AddRef(ICoreWebView2WebMessageReceivedEventHandler *This) {
+    return 1;
+}
+
+static ULONG STDMETHODCALLTYPE msg_Release(ICoreWebView2WebMessageReceivedEventHandler *This) {
+    return 1;
+}
+
+static HRESULT STDMETHODCALLTYPE msg_Invoke(
+        ICoreWebView2WebMessageReceivedEventHandler *This,
+        ICoreWebView2 *sender, ICoreWebView2WebMessageReceivedEventArgs *args) {
+    msg_handler *self = (msg_handler *)This;
+    cj_host *h = self ? self->h : NULL;
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    LPWSTR payload = NULL;
+
+    if (SUCCEEDED(args->lpVtbl->TryGetWebMessageAsString(args, &payload)) && payload) {
+        char *utf8 = wide_to_utf8(payload);
+        CoTaskMemFree(payload);
+        if (utf8) {
+            /* 前端 __CJ_TAURI__.reload()：宿主控制消息，不进 IPC hub */
+            if (strcmp(utf8, CJT_RELOAD_MSG) == 0) {
+                fprintf(stderr, "[cj-bridge] frontend requested reload\n");
+                if (p && p->hwnd) PostMessageW(p->hwnd, WM_CJT_RELOAD, 0, 0);
+                free(utf8);
+                return S_OK;
+            }
+            fprintf(stderr, "[cj-bridge] js -> native (%d bytes)\n", (int)strlen(utf8));
+            if (h && h->on_message) h->on_message(utf8); /* 回调仓颉（IPC hub） */
+            free(utf8);
+        }
+    }
+    return S_OK;
+}
+
+static ICoreWebView2WebMessageReceivedEventHandlerVtbl g_msg_vtbl = {
+    msg_QueryInterface, msg_AddRef, msg_Release, msg_Invoke
+};
+
+/* --- 导航完成：仅在失败时上报（成功无需打扰用户）--- */
+
+static HRESULT STDMETHODCALLTYPE nav_QueryInterface(
+        ICoreWebView2NavigationCompletedEventHandler *This, REFIID riid, void **ppvObject) {
+    if (ppvObject) *ppvObject = This;
+    return S_OK;
+}
+
+static ULONG STDMETHODCALLTYPE nav_AddRef(ICoreWebView2NavigationCompletedEventHandler *This) {
+    return 1;
+}
+
+static ULONG STDMETHODCALLTYPE nav_Release(ICoreWebView2NavigationCompletedEventHandler *This) {
+    return 1;
+}
+
+static HRESULT STDMETHODCALLTYPE nav_Invoke(
+        ICoreWebView2NavigationCompletedEventHandler *This,
+        ICoreWebView2 *sender, ICoreWebView2NavigationCompletedEventArgs *args) {
+    BOOL ok = FALSE;
+    COREWEBVIEW2_WEB_ERROR_STATUS status = COREWEBVIEW2_WEB_ERROR_STATUS_UNKNOWN;
+    args->lpVtbl->get_IsSuccess(args, &ok);
+    args->lpVtbl->get_WebErrorStatus(args, &status);
+    if (!ok) {
+        fprintf(stderr, "[cj-bridge] navigation failed: web error status=%d\n", (int)status);
+    }
+    return S_OK;
+}
+
+static ICoreWebView2NavigationCompletedEventHandlerVtbl g_nav_vtbl = {
+    nav_QueryInterface, nav_AddRef, nav_Release, nav_Invoke
+};
+
+/* ===== 原生对话框（原生弹窗部分；状态机在 core）===== */
+
+/* "描述|模式|描述|模式" → Win32 双 NUL 过滤器串（末尾落单的描述段按 *.* 处理） */
+static wchar_t *build_win_filter(const char *filter) {
+    const char *p;
+    wchar_t *out;
+    size_t cap, len = 0;
+
+    if (!filter || !filter[0]) {
+        filter = "所有文件 (*.*)|*.*";
+    }
+    cap = strlen(filter) * 4 + 8; /* UTF-8 → UTF-16 上界，末尾留双 NUL 位 */
+    out = (wchar_t *)calloc(cap, sizeof(wchar_t));
+    if (!out) return NULL;
+
+    p = filter;
+    while (p && p[0]) {
+        const char *bar = strchr(p, '|');
+        size_t seg = bar ? (size_t)(bar - p) : strlen(p);
+        int n = MultiByteToWideChar(CP_UTF8, 0, p, (int)seg, out + len, (int)(cap - len - 2));
+        if (n > 0) {
+            len += (size_t)n;
+            out[len++] = 0; /* 段结束符 */
+        }
+        if (!bar) {
+            break;
+        }
+        if (!bar[1]) { /* 末尾落单的描述段：补一个 *.* 当模式 */
+            int m = MultiByteToWideChar(CP_UTF8, 0, "*.*", 3, out + len, (int)(cap - len - 2));
+            if (m > 0) {
+                len += (size_t)m;
+                out[len++] = 0;
+            }
+            break;
+        }
+        p = bar + 1;
+    }
+    out[len] = 0; /* 双 NUL 收尾（上一格已经是 0） */
+    return out;
+}
+
+/* 已经站在宿主线程上：直接弹一次，返回 1 = 确认；选中路径写入 *out_path（由调用方 free） */
+static int show_dialog_here(cj_host *h, int kind, const char *title, const char *message,
+                            const char *filter, char **out_path) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    HWND owner = p ? p->hwnd : NULL;
+    int ok = 0;
+
+    *out_path = NULL;
+    if (kind == 6) {
+        /* 选目录：GetOpenFileName 没有选目录能力，走 shell 的 IFileOpenDialog + FOS_PICKFOLDERS。
+           COM 套间在 WebView2 宿主线程上已初始化（WebView2 自身的前提），这里不再 CoInitialize——
+           重复初始化会多一次配平负担（且 STA 下 CoUninitialize 归谁都是麻烦）。
+           失败一律留一行 stderr 凭证：这个 API 家族「静默失败」的形状是弹了框但拿不到路径。 */
+        IFileOpenDialog *fd = NULL;
+        HRESULT hr = CoCreateInstance(&CLSID_FileOpenDialog, NULL, CLSCTX_INPROC_SERVER,
+                                      &IID_IFileOpenDialog, (void **)&fd);
+        if (SUCCEEDED(hr) && fd) {
+            DWORD opts = 0;
+            if (SUCCEEDED(fd->lpVtbl->GetOptions(fd, &opts))) {
+                fd->lpVtbl->SetOptions(fd, opts | FOS_PICKFOLDERS | FOS_FORCEFILESYSTEM);
+            }
+            if (title[0]) {
+                wchar_t *title_w = utf8_to_wide(title);
+                if (title_w) {
+                    fd->lpVtbl->SetTitle(fd, title_w);
+                    free(title_w);
+                }
+            }
+            hr = fd->lpVtbl->Show(fd, owner);
+            if (SUCCEEDED(hr)) {
+                IShellItem *item = NULL;
+                if (SUCCEEDED(fd->lpVtbl->GetResult(fd, &item)) && item) {
+                    PWSTR psz = NULL;
+                    if (SUCCEEDED(item->lpVtbl->GetDisplayName(item, SIGDN_FILESYSPATH, &psz)) && psz) {
+                        char *u8 = wide_to_utf8(psz);
+                        if (u8) {
+                            *out_path = u8;
+                            ok = 1;
+                        }
+                        CoTaskMemFree(psz);
+                    }
+                    item->lpVtbl->Release(item);
+                }
+            } else if (hr != HRESULT_FROM_WIN32(ERROR_CANCELLED)) {
+                /* 取消不是失败（用户按了取消 / 关了框）：只有真错才落凭证 */
+                fprintf(stderr, "[cj-bridge] folder dialog failed: hr=0x%08lx\n", (unsigned long)hr);
+            }
+            fd->lpVtbl->Release(fd);
+        } else {
+            fprintf(stderr, "[cj-bridge] folder dialog failed: CoCreateInstance hr=0x%08lx\n",
+                    (unsigned long)hr);
+        }
+    } else if (kind <= 1) {
+        wchar_t path[32768];
+        wchar_t *title_w = utf8_to_wide(title[0] ? title : (kind == 1 ? "保存文件" : "打开文件"));
+        wchar_t *filter_w = build_win_filter(filter);
+        OPENFILENAMEW ofn;
+
+        /* message 参数在文件类对话框里当**默认文件名**用（showFileDialogPreset 的通道）：
+           探针的自动确认（对 #32770 发 IDOK）需要框里已有名字才能关——多窗并发取证靠它 */
+        path[0] = 0;
+        if (message && message[0]) {
+            wchar_t *preset = utf8_to_wide(message);
+            if (preset) {
+                size_t plen = wcslen(preset);
+                if (plen >= 32768) plen = 32767;
+                wmemcpy(path, preset, plen);
+                path[plen] = 0;
+                free(preset);
+            }
+        }
+        ZeroMemory(&ofn, sizeof(ofn));
+        ofn.lStructSize = sizeof(ofn);
+        ofn.hwndOwner = owner;
+        ofn.lpstrFile = path;
+        ofn.nMaxFile = (DWORD)(sizeof(path) / sizeof(path[0]));
+        ofn.lpstrFilter = filter_w;
+        ofn.nFilterIndex = 1;
+        ofn.lpstrTitle = title_w;
+        ofn.Flags = OFN_EXPLORER | OFN_PATHMUSTEXIST | OFN_NOCHANGEDIR |
+                    ((kind == 1) ? OFN_OVERWRITEPROMPT : OFN_FILEMUSTEXIST);
+        {
+            BOOL got = (kind == 1) ? GetSaveFileNameW(&ofn) : GetOpenFileNameW(&ofn);
+            if (got) {
+                *out_path = wide_to_utf8(path);
+                ok = 1;
+            } else {
+                DWORD err = CommDlgExtendedError();
+                if (err) {
+                    fprintf(stderr, "[cj-bridge] dialog failed: CommDlgExtendedError=0x%lx\n",
+                            (unsigned long)err);
+                }
+            }
+        }
+        free(title_w);
+        free(filter_w);
+    } else {
+        UINT flags = MB_OK | MB_ICONINFORMATION | MB_SETFOREGROUND;
+        wchar_t *title_w, *msg_w;
+
+        if (kind == 3) {
+            flags = MB_OK | MB_ICONWARNING | MB_SETFOREGROUND;
+        } else if (kind == 4) {
+            flags = MB_OK | MB_ICONERROR | MB_SETFOREGROUND;
+        } else if (kind == 5) {
+            flags = MB_OKCANCEL | MB_ICONQUESTION | MB_SETFOREGROUND;
+        }
+        title_w = utf8_to_wide(title[0] ? title : "cj-tauri");
+        msg_w = utf8_to_wide(message[0] ? message : " ");
+        {
+            int res = MessageBoxW(owner, msg_w, title_w, flags);
+            ok = (kind == 5) ? (res == IDOK) : 1;
+        }
+        free(title_w);
+        free(msg_w);
+    }
+    return ok;
+}
+
+int cj_plat_run_dialog(cj_host *h, dlg_req *req) {
+    if (!req) return 0;
+    req->ok = show_dialog_here(h, req->kind, req->title, req->message, req->filter, &req->path);
+    return req->ok;
+}
+
+void cj_plat_post_dialog(cj_host *h, dlg_req *req) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p || !p->hwnd) {
+        fprintf(stderr, "[cj-bridge] dialog post failed: window not ready\n");
+        cj_core_dialog_abort(h); /* 投不出去就别让调用方干等 */
+        return;
+    }
+    if (!PostMessageW(p->hwnd, WM_CJT_DIALOG, 0, (LPARAM)req)) {
+        fprintf(stderr, "[cj-bridge] dialog post failed: %lu\n", (unsigned long)GetLastError());
+        cj_core_dialog_abort(h);
+    }
+}
+
+int cj_plat_post_ui(cj_host *h, cj_ui_fn fn, void *ud) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    cj_ui_msg *m;
+
+    if (!p || !p->hwnd) {
+        fprintf(stderr, "[cj-bridge] post ui failed: window not ready\n");
+        return 0;
+    }
+    m = (cj_ui_msg *)malloc(sizeof(cj_ui_msg));
+    if (!m) {
+        return 0;
+    }
+    m->fn = fn;
+    m->ud = ud;
+    if (!PostMessageW(p->hwnd, WM_CJT_UI, 0, (LPARAM)m)) {
+        fprintf(stderr, "[cj-bridge] post ui failed: %lu\n", (unsigned long)GetLastError());
+        free(m);
+        return 0;
+    }
+    return 1;
+}
+
+/* ===== 剪贴板（plugin_clipboard 的平台层）：Win32 clipboard =====
+   调用方保证已在宿主 UI 线程上（core 的 UI 线程分流负责）。OpenClipboard 带重试：
+   剪贴板是系统单例，别的进程可能正占着（MSDN 建议的做法）。 */
+
+static int clip_open_retry(HWND hwnd) {
+    int i;
+    for (i = 0; i < 10; i++) {
+        if (OpenClipboard(hwnd)) return 1;
+        Sleep(2);
+    }
+    return 0;
+}
+
+int cj_plat_clipboard_write_text(cj_host *h, const char *text, char *err, int err_len) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    int wlen;
+    wchar_t *wtext;
+    HGLOBAL glob;
+    wchar_t *dst;
+    size_t bytes;
+
+    if (!clip_open_retry(p ? p->hwnd : NULL)) {
+        if (err && err_len > 0) serial_err(err, err_len, "clipboard: OpenClipboard 失败（被别的进程占用？）");
+        return -3;
+    }
+    EmptyClipboard();
+    wlen = MultiByteToWideChar(CP_UTF8, 0, text ? text : "", -1, NULL, 0);
+    if (wlen <= 0) {
+        CloseClipboard();
+        if (err && err_len > 0) serial_err(err, err_len, "clipboard: 文本不是合法 UTF-8");
+        return -1;
+    }
+    bytes = (size_t)wlen * sizeof(wchar_t);
+    glob = GlobalAlloc(GMEM_MOVEABLE, bytes);
+    if (!glob) {
+        CloseClipboard();
+        if (err && err_len > 0) serial_err(err, err_len, "clipboard: GlobalAlloc 失败");
+        return -3;
+    }
+    dst = (wchar_t *)GlobalLock(glob);
+    if (!dst) {
+        GlobalFree(glob);
+        CloseClipboard();
+        if (err && err_len > 0) serial_err(err, err_len, "clipboard: GlobalLock 失败");
+        return -3;
+    }
+    MultiByteToWideChar(CP_UTF8, 0, text ? text : "", -1, dst, wlen);
+    GlobalUnlock(glob);
+    /* SetClipboardData 交出所有权：成功后 glob 归系统，不再 free */
+    if (!SetClipboardData(CF_UNICODETEXT, glob)) {
+        GlobalFree(glob);
+        CloseClipboard();
+        if (err && err_len > 0) serial_err(err, err_len, "clipboard: SetClipboardData 失败");
+        return -3;
+    }
+    CloseClipboard();
+    return 0;
+}
+
+char *cj_plat_clipboard_read_text(cj_host *h, char *err, int err_len) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    HANDLE hd;
+    const wchar_t *wtext;
+    int len;
+    char *out;
+
+    if (!clip_open_retry(p ? p->hwnd : NULL)) {
+        if (err && err_len > 0) serial_err(err, err_len, "clipboard: OpenClipboard 失败（被别的进程占用？）");
+        return NULL;
+    }
+    hd = GetClipboardData(CF_UNICODETEXT);
+    if (!hd) {
+        CloseClipboard();
+        return NULL; /* 空 / 非文本，不是错误 */
+    }
+    wtext = (const wchar_t *)GlobalLock(hd);
+    if (!wtext) {
+        CloseClipboard();
+        return NULL;
+    }
+    len = WideCharToMultiByte(CP_UTF8, 0, wtext, -1, NULL, 0, NULL, NULL);
+    out = NULL;
+    if (len > 0) {
+        out = (char *)malloc((size_t)len);
+        if (out) {
+            WideCharToMultiByte(CP_UTF8, 0, wtext, -1, out, len, NULL, NULL);
+        }
+    }
+    GlobalUnlock(hd);
+    CloseClipboard();
+    return out; /* NULL = 空 / 非文本 / 转换失败 */
+}
+
+/* ===== 通知（plugin_notification 的平台层）：Windows Toast =====
+   v1 实现走 PowerShell 的 WinRT 投影（系统自带，零新增依赖、MIT 口径不变）：
+   脚本整体经 -EncodedCommand（UTF-16LE 的 base64）传入——不碰 cmd 的引号转义，
+   也避开 AGENTS §4 的「PowerShell 按 OEM 码页读错误」一整类坑；标题/正文先做 XML 转义。
+   AUMID 借用 PowerShell 自己的（未注册 AUMID 的 toast 在 Win10+ 不显示，这是通行做法）。
+   发送语义：CreateProcess 成功即返回 0（fire-and-forget，toast 的可见与否由系统托盘设置决定）；
+   spawn 失败（无 powershell 等）返回 -3，stderr 带原因。 */
+
+/* 小工具：标准 base64（RFC 4648，带填充）。输入 UTF-16LE 字节流。 */
+static BOOL toast_b64(const unsigned char *in, size_t n, char **out) {
+    static const char tab[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    size_t olen = ((n + 2) / 3) * 4;
+    size_t i, o = 0;
+    char *buf = (char *)malloc(olen + 1);
+    if (!buf) return FALSE;
+    for (i = 0; i + 2 < n; i += 3) {
+        unsigned v = (in[i] << 16) | (in[i + 1] << 8) | in[i + 2];
+        buf[o++] = tab[(v >> 18) & 63]; buf[o++] = tab[(v >> 12) & 63];
+        buf[o++] = tab[(v >> 6) & 63];  buf[o++] = tab[v & 63];
+    }
+    if (i < n) {
+        unsigned v = in[i] << 16;
+        int pad = (i + 1 < n) ? 1 : 2;
+        if (i + 1 < n) v |= in[i + 1] << 8;
+        buf[o++] = tab[(v >> 18) & 63]; buf[o++] = tab[(v >> 12) & 63];
+        buf[o++] = pad == 1 ? tab[(v >> 6) & 63] : '=';
+        buf[o++] = '=';
+    }
+    buf[o] = '\0';
+    *out = buf;
+    return TRUE;
+}
+
+/* XML 文本转义（& < > ' " 追加进 buf，容量不足截断） */
+static void toast_xml_escape(const char *s, char *buf, size_t cap) {
+    size_t o = 0, i;
+    for (i = 0; s[i] && o + 8 < cap; i++) {
+        const char *rep = NULL;
+        if (s[i] == '&') rep = "&amp;";
+        else if (s[i] == '<') rep = "&lt;";
+        else if (s[i] == '>') rep = "&gt;";
+        else if (s[i] == '\'') rep = "&apos;";
+        else if (s[i] == '"') rep = "&quot;";
+        if (rep) {
+            size_t l = strlen(rep);
+            if (o + l + 1 >= cap) break;
+            memcpy(buf + o, rep, l);
+            o += l;
+        } else {
+            buf[o++] = s[i];
+        }
+    }
+    buf[o] = '\0';
+}
+
+int cj_plat_notification_notify(cj_host *h, const char *title, const char *body,
+                                char *err, int err_len) {
+    char t_esc[1024];
+    char b_esc[16384];
+    char *script;      /* UTF-8 PowerShell 脚本 */
+    char *b64;         /* -EncodedCommand 载荷 */
+    unsigned char *u16;
+    size_t n16 = 0, slen, i;
+    wchar_t *cmdline;
+    STARTUPINFOW si;
+    PROCESS_INFORMATION pi;
+    BOOL ok;
+
+    (void)h;
+    toast_xml_escape(title ? title : "", t_esc, sizeof(t_esc));
+    toast_xml_escape(body ? body : "", b_esc, sizeof(b_esc));
+
+    slen = strlen(t_esc) + strlen(b_esc) + 512;
+    script = (char *)malloc(slen);
+    if (!script) {
+        if (err && err_len > 0) serial_err(err, err_len, "%s", "notification: out of memory");
+        return -3;
+    }
+    snprintf(script, slen,
+             "$a='{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe';"
+             "[Windows.UI.Notifications.ToastNotificationManager,Windows.UI.Notifications,"
+             "ContentType=WindowsRuntime]>$null;"
+             "$t=[Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent("
+             "[Windows.UI.Notifications.ToastTemplateType]::ToastText02);"
+             "$x=$t.GetElementsByTagName('text');"
+             "$x.Item(0).AppendChild($t.CreateTextNode('%s'))|Out-Null;"
+             "$x.Item(1).AppendChild($t.CreateTextNode('%s'))|Out-Null;"
+             "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($a)"
+             ".Show([Windows.UI.Notifications.ToastNotification]::new($t))",
+             t_esc, b_esc);
+
+    /* UTF-8 → UTF-16LE → base64（-EncodedCommand 的口径） */
+    u16 = (unsigned char *)malloc((slen + 1) * 2);
+    if (!u16) {
+        free(script);
+        if (err && err_len > 0) serial_err(err, err_len, "%s", "notification: out of memory");
+        return -3;
+    }
+    for (i = 0; i < slen; i++) {
+        unsigned char c = (unsigned char)script[i];
+        if (c < 0x80) {
+            u16[n16++] = c; u16[n16++] = 0;
+        } else {
+            /* 非 ASCII（如中文标题）：走 MultiByteToWideChar，别手工拆 UTF-8 */
+            wchar_t *w = utf8_to_wide(script);
+            if (!w) { free(u16); free(script); return -3; }
+            n16 = 0;
+            for (i = 0; w[i]; i++) {
+                u16[n16++] = (unsigned char)(w[i] & 0xFF);
+                u16[n16++] = (unsigned char)((w[i] >> 8) & 0xFF);
+            }
+            free(w);
+            break;
+        }
+    }
+    free(script);
+    if (!toast_b64(u16, n16, &b64)) {
+        free(u16);
+        if (err && err_len > 0) serial_err(err, err_len, "%s", "notification: out of memory");
+        return -3;
+    }
+    free(u16);
+
+    cmdline = (wchar_t *)malloc((strlen(b64) + 128) * sizeof(wchar_t));
+    if (!cmdline) {
+        free(b64);
+        if (err && err_len > 0) serial_err(err, err_len, "%s", "notification: out of memory");
+        return -3;
+    }
+    /* 手拼宽串：mingw 的 swprintf %s 在默认方言里收 char*（AGENTS §4），base64 是纯 ASCII
+       逐字节提升即可，不经过任何 printf 家族，避免方言歧义。 */
+    {
+        wchar_t prefix[] = L"powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ";
+        size_t plen = wcslen(prefix);
+        wcscpy(cmdline, prefix);
+        for (i = 0; b64[i]; i++) {
+            cmdline[plen + i] = (wchar_t)(unsigned char)b64[i];
+        }
+        cmdline[plen + i] = 0;
+    }
+    free(b64);
+
+    ZeroMemory(&si, sizeof(si));
+    si.cb = sizeof(si);
+    si.dwFlags = STARTF_USESHOWWINDOW;
+    si.wShowWindow = SW_HIDE;
+    ZeroMemory(&pi, sizeof(pi));
+    ok = CreateProcessW(NULL, cmdline, NULL, NULL, FALSE,
+                        CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
+    free(cmdline);
+    if (!ok) {
+        if (err && err_len > 0) {
+            serial_err(err, err_len, "notification: CreateProcessW failed (%lu)",
+                       (unsigned long)GetLastError());
+        }
+        return -3;
+    }
+    CloseHandle(pi.hThread);
+    CloseHandle(pi.hProcess);
+    return 0;
+}
+
+static LRESULT CALLBACK wnd_proc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp) {
+    /* 句柄从窗口自己的 USERDATA 取：PostMessage 按窗口寻址，谁收到就是谁的宿主 */
+    cj_host *h = (cj_host *)GetWindowLongPtrW(hwnd, GWLP_USERDATA);
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+
+    switch (msg) {
+    case WM_NCCREATE: {
+        /* 唯一安全时机：CreateWindowExW 的 lpParam 在这里交回来，之后这个窗口就知道自己属于谁 */
+        CREATESTRUCTW *cs = (CREATESTRUCTW *)lp;
+        if (cs) {
+            SetWindowLongPtrW(hwnd, GWLP_USERDATA, (LONG_PTR)cs->lpCreateParams);
+        }
+        break; /* 交给 DefWindowProcW 继续（它对 WM_NCCREATE 返回 TRUE）*/
+    }
+    case WM_SIZE:
+        if (p && p->controller) {
+            RECT rc;
+            GetClientRect(hwnd, &rc);
+            p->controller->lpVtbl->put_Bounds(p->controller, rc);
+        }
+        return 0;
+    case WM_CJT_FLUSH:
+        cj_core_flush_js(h);
+        return 0;
+    case WM_CJT_QUIT:
+        DestroyWindow(hwnd);
+        return 0;
+    case WM_CJT_DEVTOOLS:
+        if (p && p->webview) {
+            p->webview->lpVtbl->OpenDevToolsWindow(p->webview);
+        }
+        return 0;
+    case WM_CJT_RELOAD:
+        if (p && p->webview) {
+            log_hr("Reload", p->webview->lpVtbl->Reload(p->webview));
+        }
+        return 0;
+    case WM_CJT_LOAD_URL: {
+        /* lParam 是跨线程传过来的宽字符串，由宿主线程负责释放 */
+        wchar_t *w = (wchar_t *)lp;
+        if (p && p->webview && w) {
+            log_hr("Navigate", p->webview->lpVtbl->Navigate(p->webview, w));
+        }
+        free(w);
+        return 0;
+    }
+    case WM_CJT_MENU: {
+        /* lParam 是调用方 strdup 的线路文本：宿主线程用完即释放（与 WM_CJT_LOAD_URL 同规）*/
+        char *wire = (char *)lp;
+        if (wire && h && p) {
+            menu_apply_wire(h, p, wire);
+        }
+        free(wire);
+        return 0;
+    }
+    case WM_CJT_MENU_ITEM: {
+        menu_state_msg *m = (menu_state_msg *)lp;
+        if (m) {
+            if (p) {
+                menu_apply_item_state(p, m->id, m->enabled, m->checked);
+            }
+            free(m->id);
+            free(m);
+        }
+        return 0;
+    }
+    case WM_COMMAND: {
+        /* 菜单项：LOWORD(wp) 是建菜单时分配的命令 id；0 = 没有命令（分隔线 / 子菜单标题）*/
+        UINT cmd = (UINT)LOWORD(wp);
+        if (h && p && cmd >= CJ_TRAY_CMD_BASE) {
+            /* 托盘项：命令 id 从 CJ_TRAY_CMD_BASE 起，与菜单栏的命令 id 空间分开放，
+               否则两个表（menu_items / tray_items）会互相抢同一个 id。 */
+            int ti = (int)(cmd - CJ_TRAY_CMD_BASE);
+            if (ti >= 0 && ti < p->tray_item_count) {
+                menu_slot *s = &p->tray_items[ti];
+                if (s->kind == 'c') {
+                    s->checked = s->checked ? 0 : 1;
+                    CheckMenuItem(p->tray_menu, cmd,
+                                  MF_BYCOMMAND | (s->checked ? MF_CHECKED : MF_UNCHECKED));
+                }
+                cj_core_tray_clicked(h, s->app_id);
+            }
+            return 0;
+        }
+        if (h && p && cmd) {
+            int i;
+            for (i = 0; i < p->menu_item_count; i++) {
+                menu_slot *s = &p->menu_items[i];
+                if (s->cmd_id != cmd) continue;
+                if (s->kind == 'c') {
+                    /* Win32 不会替我们翻转勾选：自己翻，并同步菜单上的勾 */
+                    s->checked = s->checked ? 0 : 1;
+                    CheckMenuItem(p->menu, cmd,
+                                  MF_BYCOMMAND | (s->checked ? MF_CHECKED : MF_UNCHECKED));
+                }
+                cj_core_menu_clicked(h, s->app_id, s->enabled, s->checked);
+                break;
+            }
+        }
+        return 0;
+    }
+    case WM_HOTKEY: {
+        /* wParam = RegisterHotKey 时给的 id；只回投真的注册成功的那条 */
+        int i;
+        if (p) {
+            for (i = 0; i < p->hotkey_count; i++) {
+                if (p->hotkeys[i].id == (int)wp && p->hotkeys[i].registered) {
+                    cj_core_hotkey_pressed(h, p->hotkeys[i].app_id);
+                    break;
+                }
+            }
+        }
+        return 0;
+    }
+    case WM_SYSCOMMAND:
+        /* 最小化到托盘：把「最小化」改写成「隐藏」。**只在托盘真挂上时才拦**——
+           没有托盘还把窗口藏起来，用户就再也点不回来了；宁可如实降级为普通最小化并出声一次。 */
+        if (p && h && (wp & 0xFFF0) == SC_MINIMIZE && h->minimize_to_tray) {
+            if (p->tray_added) {
+                ShowWindow(hwnd, SW_HIDE);
+                fprintf(stderr, "[cj-bridge] minimize -> hidden to tray\n");
+                return 0;
+            }
+            if (!p->min_to_tray_warned) {
+                p->min_to_tray_warned = 1;
+                fprintf(stderr, "[cj-bridge] minimize_to_tray ignored: no tray icon yet "
+                                "(set_tray / CJ_CAP_TRAY) - normal minimize\n");
+            }
+        }
+        return DefWindowProcW(hwnd, msg, wp, lp);
+    case WM_CJT_TRAY: {
+        /* lParam 是调用方 strdup 的线路文本：宿主线程用完即释放（与 WM_CJT_MENU 同规）*/
+        char *wire = (char *)lp;
+        if (wire && h && p) {
+            tray_apply_wire(h, p, wire);
+        }
+        free(wire);
+        return 0;
+    }
+    case WM_CJT_HOTKEYS: {
+        char *wire = (char *)lp;
+        if (p) {
+            hotkey_apply_wire(p, wire ? wire : "");
+        }
+        free(wire);
+        return 0;
+    }
+    case WM_CJT_VISIBLE:
+        if (p && p->hwnd) {
+            window_apply_visible(p, (int)wp);
+        }
+        return 0;
+    case WM_CJT_TRAY_NOTIFY: {
+        /* 托盘图标回调：NOTIFYICON_VERSION_4 口径下 wParam 是图标坐标、lParam 低位是事件。
+           左键与右键都弹菜单——Linux 的 appindicator 本来就只有菜单（没有「图标激活」语义），
+           两边行为一致，应用侧就不必为平台分叉写代码。 */
+        UINT ev = (UINT)LOWORD(lp);
+        if (p && p->tray_menu &&
+            (ev == WM_LBUTTONUP || ev == NIN_SELECT ||
+             ev == WM_RBUTTONUP || ev == WM_CONTEXTMENU)) {
+            POINT pt;
+            pt.x = (LONG)(short)LOWORD(wp);
+            pt.y = (LONG)(short)HIWORD(wp);
+            /* SetForegroundWindow + 事后 WM_NULL 是 TrackPopupMenu 的老规矩：
+               少了前者菜单不会消失，少了后者菜单会残留到下次点击 */
+            SetForegroundWindow(hwnd);
+            TrackPopupMenu(p->tray_menu, TPM_RIGHTBUTTON | TPM_BOTTOMALIGN,
+                           pt.x, pt.y, 0, hwnd, NULL);
+            PostMessageW(hwnd, WM_NULL, 0, 0);
+        }
+        return 0;
+    }
+    case WM_CJT_DIALOG:
+        /* lParam 是调用方（仓颉线程）堆上的请求：宿主线程只填结果，释放仍归调用方 */
+        if (lp) {
+            cj_core_dialog_tick(h, (dlg_req *)lp);
+        }
+        return 0;
+    case WM_CJT_UI:
+        /* 通用 UI 投递：lParam 是调用方栈上的包裹（fn + ud），处理完就地释放 */
+        if (lp) {
+            cj_ui_msg *m = (cj_ui_msg *)lp;
+            if (m->fn) {
+                m->fn(m->ud);
+            }
+            free(m);
+        }
+        return 0;
+    case WM_CJT_DRAG_DROP: {
+        /* 运行期挂/摘拖放：OLE 注册只能在建它的 STA（宿主 UI 线程）上做 */
+        drag_drop_msg *m = (drag_drop_msg *)lp;
+        if (m) {
+            if (p) {
+                drag_dest_apply(h, p, m->enabled);
+            }
+            free(m);
+        }
+        return 0;
+    }
+    case WM_DESTROY:
+        if (p) {
+            /* 托盘图标先摘：不摘的话进程退出后系统托盘里会留一个点不动的幽灵图标 */
+            tray_remove(p);
+            hotkey_unregister_all(p);
+            /* 拖放目标先摘：RevokeDragDrop 释放系统对我们 COM 对象的引用 */
+            drag_dest_apply(h, p, 0);
+            if (p->drop_target) {
+                p->drop_target->lpVtbl->Release(p->drop_target);
+                p->drop_target = NULL;
+            }
+            p->hwnd = NULL; /* 窗口没了：别再往它 PostMessage */
+        }
+        /* 置 should_quit + 触发 onDestroy（每个宿主恰好一次）+ 作废进行中的对话框 */
+        cj_core_window_destroyed(h);
+        PostQuitMessage(0);
+        return 0;
+    default:
+        return DefWindowProcW(hwnd, msg, wp, lp);
+    }
+    /* Cases above that break instead of returning (currently WM_NCCREATE) land
+       here. Returning DefWindowProcW is mandatory: it is the one that answers
+       TRUE to WM_NCCREATE. Falling off the end leaves the return value
+       indeterminate, CreateWindowExW reads it as FALSE and the window creation
+       fails with GetLastError() == 0 -- which is exactly what it looks like. */
+    return DefWindowProcW(hwnd, msg, wp, lp);
+}
+
+/* ===== 宿主线程（对标 tao 的事件循环线程）===== */
+
+/* WebView2Loader 的两种加载方式：
+     · 默认（动态桥 / 便携包）：运行期按名字找 WebView2Loader.dll（exe 目录或 PATH）；
+     · 单文件产物（-DCJ_EMBED_WEBVIEW2_LOADER）：把 loader 的字节直接编进 exe，首次运行时
+       释放到 %TEMP%\cj-tauri-loader\ 再按绝对路径加载（幂等：大小一致就不重写）。
+   为什么不是「静态链 WebView2LoaderStatic.lib」：那份 .lib 是 MSVC 编的，要 /GS 的
+   __security_cookie 与 C++ 运行时符号（?nothrow@std@@、_Init_thread_epoch …），
+   2026-10-07 mingw 实测链接失败（ld.lld: undefined symbol: __security_cookie）。 */
+#ifdef CJ_EMBED_WEBVIEW2_LOADER
+#include "webview2_loader_embed.h"   /* 打包脚本生成的 C 头：字节数组 + 长度 */
+
+static int write_bytes(HANDLE f, const unsigned char *p, DWORD total) {
+    DWORD off = 0;
+    while (off < total) {
+        DWORD wrote = 0;
+        if (!WriteFile(f, p + off, total - off, &wrote, NULL) || wrote == 0) {
+            return 0;
+        }
+        off += wrote;
+    }
+    return 1;
+}
+
+/* 把内嵌的 loader 释放成文件，成功时把绝对路径写进 out。
+   路径拼接一律用 lstrcpyW/lstrcatW：mingw 的 swprintf 在默认方言下走 MSVCRT 语义，
+   `%s` 收的是 char* 而不是 wchar_t* —— 拼出来是垃圾路径，而且失败时一声不响
+   （2026-10-07 实测：日志只有一句 "failed to unpack embedded WebView2Loader.dll"）。 */
+static int unpack_embedded_loader(wchar_t *out, DWORD cap) {
+    wchar_t tmp[MAX_PATH];
+    wchar_t dir[MAX_PATH];
+    DWORD n = GetTempPathW(MAX_PATH, tmp);
+    if (n == 0 || n + 32 >= MAX_PATH) {
+        fprintf(stderr, "[cj-bridge] embedded loader: GetTempPathW failed: err=%lu\n",
+                GetLastError());
+        return 0;
+    }
+    lstrcpyW(dir, tmp);
+    lstrcatW(dir, L"cj-tauri-loader");
+    if (!CreateDirectoryW(dir, NULL) && GetLastError() != ERROR_ALREADY_EXISTS) {
+        fprintf(stderr, "[cj-bridge] embedded loader: CreateDirectoryW(%ls) err=%lu\n",
+                dir, GetLastError());
+        /* 建不出来也不立刻放弃：目录可能本来就存在且可写 */
+    }
+    lstrcpyW(out, dir);
+    lstrcatW(out, L"\\WebView2Loader.dll");
+    {
+        WIN32_FILE_ATTRIBUTE_DATA attr;
+        if (GetFileAttributesExW(out, GetFileExInfoStandard, &attr)) {
+            LARGE_INTEGER sz;
+            sz.HighPart = (LONG)attr.nFileSizeHigh;
+            sz.LowPart = attr.nFileSizeLow;
+            if (sz.QuadPart == (LONGLONG)CJ_WV2_LOADER_SIZE) {
+                return 1;                  /* 已经释放过同一份 */
+            }
+        }
+    }
+    {
+        HANDLE f = CreateFileW(out, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
+                               FILE_ATTRIBUTE_NORMAL, NULL);
+        int ok;
+        if (f == INVALID_HANDLE_VALUE) {
+            fprintf(stderr, "[cj-bridge] embedded loader: CreateFileW(%ls) err=%lu\n",
+                    out, GetLastError());
+            return 0;
+        }
+        ok = write_bytes(f, CJ_WV2_LOADER_BYTES, (DWORD)CJ_WV2_LOADER_SIZE);
+        CloseHandle(f);
+        if (!ok) {
+            fprintf(stderr, "[cj-bridge] embedded loader: WriteFile failed: err=%lu\n",
+                    GetLastError());
+        }
+        return ok;
+    }
+}
+
+static HMODULE load_webview2_loader(void) {
+    wchar_t path[MAX_PATH];
+    if (unpack_embedded_loader(path, MAX_PATH)) {
+        HMODULE m = LoadLibraryW(path);
+        if (m) {
+            fprintf(stderr, "[cj-bridge] WebView2Loader unpacked to %%TEMP%% and loaded\n");
+            return m;
+        }
+        fprintf(stderr, "[cj-bridge] unpacked WebView2Loader refused to load: err=%lu\n",
+                GetLastError());
+    } else {
+        fprintf(stderr, "[cj-bridge] failed to unpack embedded WebView2Loader.dll\n");
+    }
+    /* 退回按名字找：失败文案与默认模式一致，便于对照 */
+    return LoadLibraryW(L"WebView2Loader.dll");
+}
+#else
+static HMODULE load_webview2_loader(void) {
+    return LoadLibraryW(L"WebView2Loader.dll");
+}
+#endif
+
+typedef HRESULT(STDMETHODCALLTYPE *pfn_create_env)(
+        PCWSTR, PCWSTR, ICoreWebView2EnvironmentOptions *,
+        ICoreWebView2CreateCoreWebView2EnvironmentCompletedHandler *);
+
+static const wchar_t *WINDOW_CLASS = L"CjTauriWindow";
+
+/*
+ * 用户数据档案（UserDataFolder）的选择：
+ *   1) 环境变量 WEBVIEW2_USER_DATA_FOLDER 优先——E2E 每轮给独立目录防实例互锁，就靠它；
+ *   2) 默认 %LOCALAPPDATA%\cj-tauri\<exe名>.WebView2——不再落在 exe 旁边（旧行为）。
+ *      exe 旁那份对单文件包是噪音（分发目录里凭空多 10M+ 的缓存堆），挪进
+ *      LOCALAPPDATA 也是 Windows 应用的惯例位置；localStorage（主题/上次打开）照常持久。
+ * 返回 1 = buf 里是可用目录（会就地建目录）；0 = 没定下来（调用方传 NULL 回默认行为）。
+ * 宽字符串拼接一律 lstrcpyW/lstrcatW——本机 mingw 的 swprintf %s 按 MSVCRT 语义收 char*，
+ * 拼出来的宽字符串是垃圾且不报错（AGENTS §4 实测坑）。
+ */
+static int compute_user_data_folder(wchar_t *buf, DWORD cap) {
+    wchar_t exe[MAX_PATH];
+    wchar_t *name;
+    /* 1) 显式环境变量优先（不校验存在性——WebView2 自己会对坏目录报错） */
+    if (GetEnvironmentVariableW(L"WEBVIEW2_USER_DATA_FOLDER", buf, cap) > 0) {
+        return 1;
+    }
+    if (GetEnvironmentVariableW(L"LOCALAPPDATA", buf, cap) == 0 || buf[0] == 0) {
+        return 0;
+    }
+    if (!GetModuleFileNameW(NULL, exe, MAX_PATH)) {
+        return 0;
+    }
+    name = wcsrchr(exe, L'\\');
+    name = name ? name + 1 : exe;   /* exe 基名（不含目录） */
+    if (wcslen(buf) + wcslen(name) + wcslen(L"\\cj-tauri\\.WebView2") + 1 >= cap) {
+        return 0;   /* 拼不下就回默认行为，不截断 */
+    }
+    lstrcatW(buf, L"\\cj-tauri");
+    CreateDirectoryW(buf, NULL);           /* 已存在静默跳过 */
+    lstrcatW(buf, L"\\");
+    lstrcatW(buf, name);
+    lstrcatW(buf, L".WebView2");
+    CreateDirectoryW(buf, NULL);
+    return 1;
+}
+
+static DWORD WINAPI host_thread_main(LPVOID param) {
+    cj_host *h = (cj_host *)param;
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    pfn_create_env create_env = NULL;
+    WNDCLASSEXW wc;
+    MSG msg;
+    wchar_t *title_w = NULL;  /* 宽字符标题（用完即 free）*/
+    wchar_t *icon_w = NULL;
+    HICON icon_big = NULL;    /* 窗口图标（h->win_icon 非空时才加载）*/
+    HICON icon_small = NULL;
+
+    if (!p) return 0;
+    CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
+    fprintf(stderr, "[cj-bridge] host thread started\n");
+
+    /* WebView2 的入口在 WebView2Loader.dll 中（默认按名字找；单文件产物从内嵌字节释放） */
+    p->loader = load_webview2_loader();
+    if (!p->loader) {
+        fprintf(stderr, "[cj-bridge] WebView2Loader.dll not found: "
+                        "put it next to the exe or on PATH\n");
+        goto done;
+    }
+    create_env = (pfn_create_env)GetProcAddress(p->loader, "CreateCoreWebView2EnvironmentWithOptions");
+    if (!create_env) {
+        fprintf(stderr, "[cj-bridge] CreateCoreWebView2EnvironmentWithOptions not found\n");
+        goto done;
+    }
+    {
+        /* 诊断：x64 宿主是否能看到可用运行时（排障用，可删） */
+        typedef HRESULT(STDAPICALLTYPE *pfn_getver)(PCWSTR, LPWSTR *);
+        pfn_getver getver =
+            (pfn_getver)GetProcAddress(p->loader, "GetAvailableCoreWebView2BrowserVersionString");
+        if (getver) {
+            LPWSTR ver = NULL;
+            HRESULT hr = getver(NULL, &ver);
+            char *v8 = ver ? wide_to_utf8(ver) : NULL;
+            fprintf(stderr, "[cj-bridge] WebView2 runtime: hr=0x%08lx ver=%s\n",
+                    (unsigned long)hr, v8 ? v8 : "(none)");
+            free(v8);
+            if (ver) CoTaskMemFree(ver);
+        }
+    }
+    fprintf(stderr, "[cj-bridge] WebView2Loader loaded\n");
+
+    /* 标题/图标在 core 里是 UTF-8，窗口类与窗口要宽字符，在这里转换 */
+    title_w = h->win_title ? utf8_to_wide(h->win_title) : NULL;
+    icon_w = h->win_icon ? utf8_to_wide(h->win_icon) : NULL;
+
+    /* 窗口图标：在 RegisterClassExW 之前加载并挂到窗口类上，
+       这样任务栏与 Alt-Tab 也用同一个图标；失败只是回到系统默认图标，不阻断启动。 */
+    if (icon_w) {
+        icon_big = (HICON)LoadImageW(NULL, icon_w, IMAGE_ICON,
+                                     GetSystemMetrics(SM_CXICON), GetSystemMetrics(SM_CYICON),
+                                     LR_LOADFROMFILE);
+        icon_small = (HICON)LoadImageW(NULL, icon_w, IMAGE_ICON,
+                                       GetSystemMetrics(SM_CXSMICON), GetSystemMetrics(SM_CYSMICON),
+                                       LR_LOADFROMFILE);
+        /* GetLastError 只在失败时才有意义：成功时它是上一次调用的残留值（常见 6 = 无效句柄） */
+        if (icon_big && icon_small) {
+            fprintf(stderr, "[cj-bridge] window icon: path=%s loaded (big=%p small=%p)\n",
+                    h->win_icon, (void *)icon_big, (void *)icon_small);
+        } else {
+            fprintf(stderr, "[cj-bridge] window icon FAILED: path=%s hIcon=%p/%p err=%lu\n",
+                    h->win_icon, (void *)icon_big, (void *)icon_small,
+                    (unsigned long)GetLastError());
+        }
+    }
+
+    ZeroMemory(&wc, sizeof(wc));
+    wc.cbSize = sizeof(wc);
+    wc.lpfnWndProc = wnd_proc;
+    wc.hInstance = GetModuleHandleW(NULL);
+    wc.hCursor = LoadCursorW(NULL, IDC_ARROW);
+    wc.lpszClassName = WINDOW_CLASS;
+    wc.hIcon = icon_big; /* 可空：空则用系统默认 */
+    wc.hIconSm = icon_small;
+    RegisterClassExW(&wc);
+
+    /* 先记下宿主线程身份：对话框要靠它判断「调用方是不是已经在本线程上」 */
+    p->thread_id = GetCurrentThreadId();
+    p->thread_set = 1;
+
+    /* lpParam = 宿主句柄：WM_NCCREATE 里存进窗口 USERDATA，之后 PostMessage 按窗口寻址即找到宿主 */
+    p->hwnd = CreateWindowExW(0, WINDOW_CLASS, title_w ? title_w : L"cj-tauri", WS_OVERLAPPEDWINDOW,
+                              CW_USEDEFAULT, CW_USEDEFAULT, h->win_w, h->win_h,
+                              NULL, NULL, wc.hInstance, h);
+    if (!p->hwnd) {
+        fprintf(stderr, "[cj-bridge] CreateWindowExW failed: %lu\n", GetLastError());
+        goto done;
+    }
+    /* 类图标只管新窗口的默认值；对已存在的窗口再显式设一次，标题栏立刻生效 */
+    if (icon_big) {
+        SendMessageW(p->hwnd, WM_SETICON, ICON_BIG, (LPARAM)icon_big);
+    }
+    if (icon_small) {
+        SendMessageW(p->hwnd, WM_SETICON, ICON_SMALL, (LPARAM)icon_small);
+    }
+    /* 菜单栏：装配期就先建好（仓颉侧可能在 start() 之前就 set_menu 了）；
+       运行期再改的走 WM_CJT_MENU 到本线程重建。 */
+    if (h->pending_menu_text && h->pending_menu_text[0]) {
+        menu_apply_wire(h, p, h->pending_menu_text);
+    }
+    /* 托盘 / 快捷键同规：装配期把「start() 之前设好的」线路落下去（运行期改动走 WM_CJT_*）。
+       RegisterHotKey 要求窗口已存在，所以不能更早做。 */
+    if (h->pending_tray && h->pending_tray[0]) {
+        tray_apply_wire(h, p, h->pending_tray);
+    }
+    if (h->pending_hotkeys && h->pending_hotkeys[0]) {
+        hotkey_apply_wire(p, h->pending_hotkeys);
+    }
+    /* 窗口初始可见性：**建窗后立刻定稿**（比「先显示再藏起来」少一次闪烁）。
+       WebView2 还没就绪也无妨——SW_HIDE 是窗口层状态，页面照常加载。 */
+    if (!h->win_visible) {
+        window_apply_visible(p, 0);
+    }
+    /* 创建 WebView2 环境（完成/失败都在回调 env_Invoke 中处理）。
+       用户数据档案：显式选目录（env 覆盖优先，默认 %LOCALAPPDATA%\cj-tauri\<exe名>.WebView2），
+       不再让它默认堆在 exe 旁边；选不下来才传 NULL 回 WebView2 默认行为。
+       磁盘缓存经 WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS 限到 32MB——loader 原生认这个环境
+       变量（options 传空时生效），免去手写 COM options 对象（WebView2.h 的 C 模式连
+       coclass 的 CLSID 都不声明，CoCreateInstance 路线走不通）。 */
+    {
+        wchar_t udf[1024];
+        PCWSTR udf_arg = NULL;
+        if (compute_user_data_folder(udf, 1024)) {
+            udf_arg = udf;
+            char *udf8 = wide_to_utf8(udf);
+            fprintf(stderr, "[cj-bridge] user data folder: %s\n", udf8 ? udf8 : "(?)");
+            if (udf8) free(udf8);
+        }
+        SetEnvironmentVariableW(L"WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS",
+                                L"--disk-cache-size=33554432");
+        fprintf(stderr, "[cj-bridge] window created, requesting WebView2 environment\n");
+        log_hr("CreateCoreWebView2EnvironmentWithOptions",
+               create_env(NULL, udf_arg, NULL, &p->env.iface));
+    }
+
+    while (GetMessageW(&msg, NULL, 0, 0)) {
+        TranslateMessage(&msg);
+        DispatchMessageW(&msg);
+    }
+
+done:
+    if (title_w) free(title_w);
+    if (icon_w) free(icon_w);
+    if (p->menu) { /* 窗口没了，菜单栏也要回收（HMENU 归本线程建、也归本线程销毁）*/
+        DestroyMenu(p->menu);
+        p->menu = NULL;
+    }
+    menu_clear_slots(p);
+    /* 托盘图标与全局快捷键也归本线程回收：图标不摘会让系统托盘留幽灵图标，
+       快捷键不注销会跟着窗口句柄一起失效——WM_DESTROY 里已摘过一次，两个函数都幂等 */
+    tray_remove(p);
+    hotkey_unregister_all(p);
+    if (p->controller) {
+        p->controller->lpVtbl->Close(p->controller);
+        p->controller = NULL;
+    }
+    /* COM 引用（controller / environment / webview）不在这里 Release：
+       它们都在本线程的 STA 上创建，且进程随之结束——沿用原实现的「活到进程退出」口径，
+       只把指针置空，避免收尾后再被别的路径碰到。 */
+    p->webview = NULL;
+    p->hwnd = NULL;
+    if (p->loader) {
+        FreeLibrary(p->loader);
+        p->loader = NULL;
+    }
+    CoUninitialize();
+    /* 兜底：非关窗路径退出消息循环（Loader 缺失 / 环境创建失败）也要通知一次（幂等）*/
+    cj_core_window_destroyed(h);
+    /* 最后一步才立这个标记：cj_plat_fini 见到它才 free 平台状态（此刻本线程已不再碰 p）*/
+    p->thread_done = 1;
+    return 0;
+}
+
+/* ===== 平台原语（bridge_core.h 的清单；导出不在这里，全在 core）===== */
+
+void cj_plat_init(cj_host *h) {
+    plat_host *p;
+    if (!h) return;
+    p = (plat_host *)calloc(1, sizeof(plat_host));
+    if (!p) {
+        fprintf(stderr, "[cj-bridge] init failed: out of memory\n");
+        return;
+    }
+    p->env.h = h;
+    p->ctrl.h = h;
+    p->msg.h = h;
+    p->nav.h = h;
+    p->env.iface.lpVtbl = &g_env_vtbl;
+    p->ctrl.iface.lpVtbl = &g_ctrl_vtbl;
+    p->msg.iface.lpVtbl = &g_msg_vtbl;
+    p->nav.iface.lpVtbl = &g_nav_vtbl;
+    h->plat = p;
+    fprintf(stderr, "[cj-bridge] init (on_message=%p on_destroy=%p)\n",
+            (void *)h->on_message, (void *)h->on_destroy);
+}
+
+int cj_plat_fini(cj_host *h) {
+    plat_host *p;
+    if (!h) return 1;
+    p = (plat_host *)h->plat;
+    if (!p) return 1;
+    /* 宿主线程还活着（事件循环没退出）：不能在这里 free 平台状态——它正被那条线程用着。
+       等待必须有界：宿主线程收尾时要进入仓颉运行时（onDestroy），无限等会与运行时的线程
+       退出握手互等（Linux 侧实测过，见 bridge_linux.c 同名函数）；超时就状态与句柄一起留着。 */
+    if (p->thread_started && p->thread) {
+        WaitForSingleObject(p->thread, 5000);
+        CloseHandle(p->thread);
+        p->thread = NULL;
+        p->thread_started = 0;
+    }
+    if (!p->thread_done) {
+        fprintf(stderr, "[cj-bridge] fini: host thread still running, platform state kept\n");
+        return 0;
+    }
+    h->plat = NULL;
+    free(p);
+    return 1;
+}
+
+void cj_plat_start(cj_host *h) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    DWORD tid = 0;
+    if (!p) {
+        fprintf(stderr, "[cj-bridge] start failed: platform not initialized\n");
+        if (h) h->should_quit = 1; /* 起不来就别让 run() 干等 */
+        return;
+    }
+    p->thread = CreateThread(NULL, 0, host_thread_main, h, 0, &tid);
+    if (!p->thread) {
+        fprintf(stderr, "[cj-bridge] start failed: cannot create host thread\n");
+        h->should_quit = 1;
+        return;
+    }
+    p->thread_id = tid;
+    p->thread_started = 1;
+}
+
+void cj_plat_quit(cj_host *h) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (p && p->hwnd) {
+        PostMessageW(p->hwnd, WM_CJT_QUIT, 0, 0);
+    } else if (h) {
+        h->should_quit = 1;
+    }
+}
+
+void cj_plat_wake_ui(cj_host *h) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (p && p->hwnd) {
+        PostMessageW(p->hwnd, WM_CJT_FLUSH, 0, 0);
+    }
+}
+
+void cj_plat_post_js(cj_host *h, const char *script_utf8) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    wchar_t *w;
+    if (!p || !p->webview || !script_utf8) return;
+    w = utf8_to_wide(script_utf8);
+    if (!w) return;
+    log_hr("ExecuteScript", p->webview->lpVtbl->ExecuteScript(p->webview, w, NULL));
+    free(w);
+}
+
+int cj_plat_is_ui_thread(cj_host *h) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    return (p && p->thread_set && GetCurrentThreadId() == p->thread_id) ? 1 : 0;
+}
+
+void cj_plat_open_devtools(cj_host *h) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p || !p->hwnd) {
+        fprintf(stderr, "[cj-bridge] open devtools ignored: window not ready\n");
+        return;
+    }
+    PostMessageW(p->hwnd, WM_CJT_DEVTOOLS, 0, 0);
+}
+
+void cj_plat_load_url(cj_host *h, const char *url) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!h || !url || !url[0]) {
+        return;
+    }
+    if (p && p->hwnd) {
+        wchar_t *w = utf8_to_wide(url);
+        if (!w) return;
+        /* pending_url 由 core 拥有（cj_bridge_load_url 已经记过一份），这里只投当次导航 */
+        fprintf(stderr, "[cj-bridge] load url (runtime): %s\n", url);
+        PostMessageW(p->hwnd, WM_CJT_LOAD_URL, 0, (LPARAM)w);
+        return;
+    }
+    fprintf(stderr, "[cj-bridge] load url: %s\n", url);
+}
+
+void cj_plat_reload(cj_host *h) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p || !p->hwnd) {
+        fprintf(stderr, "[cj-bridge] reload ignored: window not ready\n");
+        return;
+    }
+    PostMessageW(p->hwnd, WM_CJT_RELOAD, 0, 0);
+}
+
+/* ===== 菜单栏翻译层（RFC-002 §5.4）：线路文本 → HMENU =====
+   格式解析不在这里重复实现：走 core 的 cj_core_menu_walk（两平台共用一份，桩平台已自检）。
+   本层只做三件事：把行翻译成 Win32 项、维护「命令 id ↔ 应用 id」映射、把点击经 core 回投。 */
+
+static void menu_clear_slots(plat_host *p) {
+    int i;
+    if (!p) return;
+    for (i = 0; i < p->menu_item_count; i++) {
+        free(p->menu_items[i].app_id);
+        p->menu_items[i].app_id = NULL;
+    }
+    p->menu_item_count = 0;
+}
+
+static void menu_apply_item_state(plat_host *p, const char *id, int enabled, int checked) {
+    int i;
+    if (!p || !id || !id[0] || !p->menu) return;
+    for (i = 0; i < p->menu_item_count; i++) {
+        menu_slot *s = &p->menu_items[i];
+        if (!s->app_id || strcmp(s->app_id, id) != 0) continue;
+        s->enabled = enabled ? 1 : 0;
+        s->checked = checked ? 1 : 0;
+        EnableMenuItem(p->menu, s->cmd_id, MF_BYCOMMAND | (s->enabled ? MF_ENABLED : MF_GRAYED));
+        CheckMenuItem(p->menu, s->cmd_id,
+                      MF_BYCOMMAND | (s->checked ? MF_CHECKED : MF_UNCHECKED));
+        DrawMenuBar(p->hwnd);
+        return;
+    }
+    fprintf(stderr, "[cj-bridge] menu item not found: %s\n", id);
+}
+
+/* 建菜单时的上下文：层级用一张 HMENU 栈表示（行按文档顺序来，深度只会 +1 或回退）*/
+typedef struct menu_build_ctx {
+    plat_host *p;
+    HMENU bar;
+    HMENU stack[CJ_MENU_MAX_DEPTH]; /* stack[d]：深度 d 的行往哪个菜单里追加 */
+    int ok[CJ_MENU_MAX_DEPTH];      /* 该层是否已经有子菜单可挂（没有就退回上一层）*/
+} menu_build_ctx;
+
+static void menu_add_row(void *ctx, int depth, char kind, const char *id,
+                         const char *label, int flags, const char *accel) {
+    menu_build_ctx *c = (menu_build_ctx *)ctx;
+    plat_host *p;
+    HMENU target;
+    wchar_t *wlabel = NULL;
+    int enabled = (flags & 1) ? 1 : 0;
+    int checked = (flags & 2) ? 1 : 0;
+
+    if (!c || !c->p) return;
+    p = c->p;
+    if (depth < 0) depth = 0;
+    if (depth >= CJ_MENU_MAX_DEPTH) depth = CJ_MENU_MAX_DEPTH - 1;
+    target = (depth > 0 && c->ok[depth]) ? c->stack[depth] : c->bar;
+
+    if (kind == 's') { /* 分隔线：既没有命令 id，也没有文字 */
+        AppendMenuW(target, MF_SEPARATOR, 0, NULL);
+        return;
+    }
+
+    /* 标签：accel 非空时用制表符并进去——Win32 会把 \t 之后的部分右对齐，正是快捷键栏的位置 */
+    {
+        size_t n = strlen(label) + (accel[0] ? strlen(accel) + 1 : 0) + 1;
+        char *tmp = (char *)malloc(n);
+        if (!tmp) return;
+        snprintf(tmp, n, "%s%s%s", label, accel[0] ? "\t" : "", accel);
+        wlabel = utf8_to_wide(tmp);
+        free(tmp);
+    }
+    if (!wlabel) return;
+
+    if (kind == 'm') { /* 子菜单：建出 HMENU 挂进父项，并让深一层的行知道往哪挂 */
+        HMENU sub = CreatePopupMenu();
+        if (!sub) {
+            free(wlabel);
+            return;
+        }
+        if (!AppendMenuW(target, MF_POPUP | (enabled ? 0 : MF_GRAYED), (UINT_PTR)sub, wlabel)) {
+            fprintf(stderr, "[cj-bridge] menu: append submenu failed: %lu\n",
+                    (unsigned long)GetLastError());
+            DestroyMenu(sub);
+            free(wlabel);
+            return;
+        }
+        free(wlabel);
+        if (depth + 1 < CJ_MENU_MAX_DEPTH) {
+            c->stack[depth + 1] = sub;
+            c->ok[depth + 1] = 1;
+        }
+        return;
+    }
+
+    if (p->menu_item_count >= CJ_MENU_MAX_ITEMS) {
+        fprintf(stderr, "[cj-bridge] menu: item limit reached, dropped: %s\n", id);
+        free(wlabel);
+        return;
+    }
+    {
+        UINT item_flags = MF_STRING;
+        UINT cmd_id = (UINT)(p->menu_item_count + 1); /* 0 保留给「没有命令」*/
+        menu_slot *s = &p->menu_items[p->menu_item_count];
+        if (!enabled) item_flags |= MF_GRAYED;
+        if (kind == 'c' && checked) item_flags |= MF_CHECKED;
+        if (!AppendMenuW(target, item_flags, cmd_id, wlabel)) {
+            fprintf(stderr, "[cj-bridge] menu: append item failed: %lu (id=%s)\n",
+                    (unsigned long)GetLastError(), id);
+            free(wlabel);
+            return;
+        }
+        free(wlabel);
+        ZeroMemory(s, sizeof(*s));
+        s->cmd_id = cmd_id;
+        s->app_id = strdup(id);
+        s->kind = kind;
+        s->enabled = enabled;
+        s->checked = checked;
+        p->menu_item_count++;
+    }
+}
+
+static void menu_apply_wire(cj_host *h, plat_host *p, const char *wire) {
+    menu_build_ctx c;
+    HMENU old;
+
+    if (!p) return;
+    if (!wire || !wire[0]) {
+        /* 空串 = 清空菜单栏：SetMenu(hwnd, NULL) 才是真的没有菜单栏（空 popup 会留一条空条）*/
+        menu_clear_slots(p);
+        if (p->menu) {
+            SetMenu(p->hwnd, NULL);
+            DestroyMenu(p->menu);
+            p->menu = NULL;
+        }
+        DrawMenuBar(p->hwnd);
+        fprintf(stderr, "[cj-bridge] menu cleared\n");
+        return;
+    }
+    ZeroMemory(&c, sizeof(c));
+    c.p = p;
+    /* 顶层必须是「菜单栏」：SetMenu 只接受 CreateMenu 出来的句柄，塞一个 CreatePopupMenu
+       的 popup 句柄进去会以 ERROR_INVALID_PARAMETER(87) **静默失败**——实测就是这样：
+       menu applied 照打、窗口上却查不到菜单（GetMenu 一直是 NULL）。子菜单才用 popup。 */
+    c.bar = CreateMenu();
+    if (!c.bar) {
+        fprintf(stderr, "[cj-bridge] menu: CreateMenu failed: %lu\n",
+                (unsigned long)GetLastError());
+        return;
+    }
+    c.stack[0] = c.bar;
+    c.ok[0] = 1;
+    menu_clear_slots(p); /* 旧映射整体作废：新菜单的命令 id 从 1 重新分配 */
+    cj_core_menu_walk(wire, menu_add_row, &c);
+    old = p->menu;
+    p->menu = c.bar;
+    /* SetMenu 会静默失败（返回 FALSE），此时日志照样说「已应用」而窗口上什么都没有——
+       Windows 上「真挂上了」的唯一凭证就是这两行：返回值 + 事后 GetMenu 复核。 */
+    if (!SetMenu(p->hwnd, p->menu)) {
+        fprintf(stderr, "[cj-bridge] menu: SetMenu failed: %lu\n", (unsigned long)GetLastError());
+    }
+    DrawMenuBar(p->hwnd);
+    if (old) DestroyMenu(old);
+    fprintf(stderr, "[cj-bridge] menu applied: items=%d hwnd=%p bar=%p GetMenu=%p\n",
+            p->menu_item_count, (void *)p->hwnd, (void *)p->menu, (void *)GetMenu(p->hwnd));
+}
+
+/* 窗口顶部副标题：Windows 侧菜单栏是 SetMenu 挂上的系统菜单，那一行没有自绘区，
+   如实降级（CJ_CAP_SUBTITLE 也不置位）。应用据能力位决定是否自己画页面顶栏。
+   提示只打一次：页面可能每次编辑都调（字数变化），刷屏不如一行够用。 */
+int cj_plat_set_titlebar_subtitle(cj_host *h, const char *text) {
+    static int warned = 0;
+    (void)text;
+    if (!h) return -1;
+    if (!warned) {
+        warned = 1;
+        fprintf(stderr, "[cj-bridge] titlebar subtitle not implemented on windows (capability CJ_CAP_SUBTITLE off)\n");
+    }
+    return -4;
+}
+
+void cj_plat_set_menu(cj_host *h, const char *wire) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p || !wire) return;
+    if (!p->hwnd) {
+        /* 未就绪：core 已把线路文本记在 h->pending_menu_text，宿主线程建窗时取用 */
+        fprintf(stderr, "[cj-bridge] menu deferred: window not ready\n");
+        return;
+    }
+    if (cj_plat_is_ui_thread(h)) {
+        menu_apply_wire(h, p, wire);
+        return;
+    }
+    {
+        char *copy = strdup(wire); /* 跨线程：谁 post 谁分配，UI 线程在 WM_CJT_MENU 分支里释放 */
+        if (!copy) return;
+        if (!PostMessageW(p->hwnd, WM_CJT_MENU, 0, (LPARAM)copy)) {
+            fprintf(stderr, "[cj-bridge] menu post failed: %lu\n", (unsigned long)GetLastError());
+            free(copy);
+            return;
+        }
+        fprintf(stderr, "[cj-bridge] menu posted to ui thread (%d bytes)\n", (int)strlen(wire));
+    }
+}
+
+void cj_plat_menu_item_state(cj_host *h, const char *id, int enabled, int checked) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p || !id || !id[0]) return;
+    if (!p->hwnd || !p->menu) {
+        fprintf(stderr, "[cj-bridge] menu item state ignored: menu not ready (%s)\n", id);
+        return;
+    }
+    if (cj_plat_is_ui_thread(h)) {
+        menu_apply_item_state(p, id, enabled, checked);
+        return;
+    }
+    {
+        menu_state_msg *m = (menu_state_msg *)malloc(sizeof(*m));
+        if (!m) return;
+        m->id = strdup(id);
+        m->enabled = enabled ? 1 : 0;
+        m->checked = checked ? 1 : 0;
+        if (!m->id || !PostMessageW(p->hwnd, WM_CJT_MENU_ITEM, 0, (LPARAM)m)) {
+            fprintf(stderr, "[cj-bridge] menu item state post failed: %lu\n",
+                    (unsigned long)GetLastError());
+            free(m->id);
+            free(m);
+        }
+    }
+}
+
+int cj_plat_host_capabilities(cj_host *h) {
+    (void)h;
+    /* 本平台的静态能力：菜单栏、拖放（OLE IDropTarget）、通知（PowerShell toast）已落地；
+       托盘（Shell_NotifyIconW）与全局快捷键（RegisterHotKey）2026-10-15 随剪贴板历史示例落地——
+       托盘菜单与窗口菜单共用线路格式与回投通道，点击都经 on_shell（{"kind":"tray","id":"…"}）。 */
+    return CJ_CAP_MENU | CJ_CAP_DRAG_DROP | CJ_CAP_NOTIFICATION | CJ_CAP_TRAY | CJ_CAP_HOTKEY;
+}
+
+/* ===== 全局快捷键（RFC-003 第 5 期，Windows 真实现）=====
+   分工与 Linux 侧逐条对齐：wire 解析在平台层（core 只把线路文本交下来），词法也是同一套
+   （修饰键名 Ctrl/Control、Alt、Shift、Super/Win；键名 Enter/Esc 两个别名 + 常用键表）——
+   同一份应用配置两平台都认，认不出的那条整行丢弃并出声。
+
+   RegisterHotKey 要求窗口已存在，所以整表在**宿主线程建窗之后**应用一次（host_thread_main，
+   见 core 的装配点）；运行期改动一律 PostMessage(WM_CJT_HOTKEYS) 回宿主线程做，
+   与菜单 / 拖放同一纪律：绝不在别的线程碰窗口。 */
+
+/** 修饰键名 → MOD_*；认不出返回 -1（整行丢弃并打日志） */
+static int hk_mod_bit(const char *name, UINT *out) {
+    if (strcmp(name, "Ctrl") == 0 || strcmp(name, "Control") == 0) { *out = MOD_CONTROL; return 0; }
+    if (strcmp(name, "Alt") == 0) { *out = MOD_ALT; return 0; }
+    if (strcmp(name, "Shift") == 0) { *out = MOD_SHIFT; return 0; }
+    if (strcmp(name, "Super") == 0 || strcmp(name, "Win") == 0) { *out = MOD_WIN; return 0; }
+    return -1;
+}
+
+/** 键名 → 虚拟键码；认不出返回 0（整行丢弃并打日志）。
+    XStringToKeysym 的镜像：单字符 / F1..F24 / 常用编辑与导航键，外加 Enter、Esc 两个别名。 */
+static UINT hk_vk_of(const char *name) {
+    size_t n = strlen(name);
+    if (n == 1) {
+        char c = name[0];
+        if (c >= 'a' && c <= 'z') return (UINT)(c - 'a' + 'A'); /* VK_A..VK_Z 与 ASCII 大写同值 */
+        if ((c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9')) return (UINT)c;
+    }
+    if ((name[0] == 'F' || name[0] == 'f') && n >= 2 && n <= 3) {
+        int num = atoi(name + 1);
+        if (num >= 1 && num <= 24) return (UINT)(VK_F1 + num - 1);
+    }
+    if (strcmp(name, "Enter") == 0 || strcmp(name, "Return") == 0) return VK_RETURN;
+    if (strcmp(name, "Esc") == 0 || strcmp(name, "Escape") == 0) return VK_ESCAPE;
+    if (strcmp(name, "Space") == 0) return VK_SPACE;
+    if (strcmp(name, "Tab") == 0) return VK_TAB;
+    if (strcmp(name, "Backspace") == 0) return VK_BACK;
+    if (strcmp(name, "Delete") == 0) return VK_DELETE;
+    if (strcmp(name, "Insert") == 0) return VK_INSERT;
+    if (strcmp(name, "Home") == 0) return VK_HOME;
+    if (strcmp(name, "End") == 0) return VK_END;
+    if (strcmp(name, "PgUp") == 0 || strcmp(name, "PageUp") == 0) return VK_PRIOR;
+    if (strcmp(name, "PgDn") == 0 || strcmp(name, "PageDown") == 0) return VK_NEXT;
+    if (strcmp(name, "Up") == 0) return VK_UP;
+    if (strcmp(name, "Down") == 0) return VK_DOWN;
+    if (strcmp(name, "Left") == 0) return VK_LEFT;
+    if (strcmp(name, "Right") == 0) return VK_RIGHT;
+    return 0;
+}
+
+/** 注销整表并清空槽位（幂等：WM_DESTROY 与宿主线程收尾都会调） */
+static void hotkey_unregister_all(plat_host *p) {
+    int i;
+    if (!p) return;
+    for (i = 0; i < p->hotkey_count; i++) {
+        if (p->hotkeys[i].registered && p->hwnd) {
+            UnregisterHotKey(p->hwnd, p->hotkeys[i].id);
+        }
+        p->hotkeys[i].registered = 0;
+        free(p->hotkeys[i].app_id);
+        p->hotkeys[i].app_id = NULL;
+    }
+    p->hotkey_count = 0;
+}
+
+/** 整表替换：注销旧表 → 逐行解析 wire → 注册新表（解析不了 / 被占用的那条出局，其余照常） */
+static void hotkey_apply_wire(plat_host *p, const char *wire) {
+    char *copy, *line, *nl;
+    if (!p || !p->hwnd) return;
+    hotkey_unregister_all(p);
+    if (!wire || !wire[0]) {
+        fprintf(stderr, "[cj-bridge] hotkeys cleared\n");
+        return;
+    }
+    copy = strdup(wire);
+    if (!copy) return;
+    line = copy;
+    while (line && line[0]) {
+        char *colon, *accel, *id, *tok, *save;
+        char accel_orig[128];
+        UINT mods = 0, vk = 0;
+        int ok = 1;
+        nl = strchr(line, '\n');
+        if (nl) *nl = '\0';
+        colon = strchr(line, ':');
+        if (!colon || colon == line) {
+            fprintf(stderr, "[cj-bridge] hotkey line skipped (no 'accel:id'): %s\n", line);
+            goto next_line;
+        }
+        *colon = '\0';
+        accel = line;
+        id = colon + 1;
+        snprintf(accel_orig, sizeof(accel_orig), "%s", accel); /* strtok 会原地改坏 accel，日志留原文 */
+        /* 修饰键：'+' 分隔逐个解析，最后一个 token 是键名（与 Linux 同一个循环）*/
+        save = NULL;
+        tok = strtok_r(accel, "+", &save);
+        while (tok) {
+            UINT bit;
+            char *next = strtok_r(NULL, "+", &save);
+            if (!next) break; /* tok 是键名 */
+            if (hk_mod_bit(tok, &bit) == 0) {
+                mods |= bit;
+            } else {
+                fprintf(stderr, "[cj-bridge] hotkey: unknown modifier \"%s\" in: %s:%s\n",
+                        tok, accel_orig, id);
+                ok = 0;
+                break;
+            }
+            tok = next;
+        }
+        if (ok && tok) {
+            vk = hk_vk_of(tok);
+            if (vk == 0) {
+                fprintf(stderr, "[cj-bridge] hotkey: unknown key \"%s\" in: %s:%s\n",
+                        tok, accel_orig, id);
+                ok = 0;
+            }
+        }
+        if (ok && tok) {
+            if (p->hotkey_count >= CJ_HOTKEY_MAX) {
+                fprintf(stderr, "[cj-bridge] hotkey: table full (%d), dropped: %s\n", CJ_HOTKEY_MAX, id);
+            } else {
+                hotkey_slot *s = &p->hotkeys[p->hotkey_count];
+                s->id = p->hotkey_count + 1; /* WM_HOTKEY 的 wParam：从 1 起，0 不用 */
+                s->mods = mods;
+                s->vk = vk;
+                s->app_id = strdup(id);
+                s->registered = RegisterHotKey(p->hwnd, s->id, mods, vk) ? 1 : 0;
+                if (s->registered) {
+                    fprintf(stderr, "[cj-bridge] hotkey registered: %s:%s (vk=0x%02x mods=0x%04x)\n",
+                            accel_orig, id, (unsigned)vk, (unsigned)mods);
+                    p->hotkey_count++;
+                } else {
+                    /* ERROR_HOTKEY_ALREADY_REGISTERED(1409) = 已被别的程序占用：如实报，不致命 */
+                    fprintf(stderr, "[cj-bridge] hotkey register failed (in use?): %s:%s (err=%lu)\n",
+                            accel_orig, id, (unsigned long)GetLastError());
+                    free(s->app_id);
+                    s->app_id = NULL;
+                }
+            }
+        }
+next_line:
+        line = nl ? nl + 1 : NULL;
+    }
+    free(copy);
+}
+
+/* 全局快捷键：装配期（窗口尚未建）静默退出——host_thread_main 建窗后会拿 pending 再应用一次；
+   运行期改动投到宿主线程做（RegisterHotKey / UnregisterHotKey 都必须与窗口同线程）。 */
+void cj_plat_set_global_hotkeys(cj_host *h, const char *wire) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p) return;
+    if (!p->hwnd) return; /* 见上：pending 由 host_thread_main 应用，这里重复应用只会重复注册 */
+    if (cj_plat_is_ui_thread(h)) {
+        hotkey_apply_wire(p, wire ? wire : "");
+        return;
+    }
+    {
+        char *dup = strdup(wire ? wire : "");
+        if (!dup) return;
+        if (!PostMessageW(p->hwnd, WM_CJT_HOTKEYS, 0, (LPARAM)dup)) {
+            fprintf(stderr, "[cj-bridge] hotkeys: post failed: %lu\n", (unsigned long)GetLastError());
+            free(dup);
+        }
+    }
+}
+
+/* ===== 托盘（RFC-002 §7.C，Windows 真实现）=====
+   线路与菜单共用一套格式（前两行 icon / tooltip，其后是平铺一层的菜单行，见 bridge_core.h 的
+   pending_tray 注释）：行解析照样走 core 的 cj_core_menu_walk，本层只把行翻成 HMENU + 图标。
+
+   托盘菜单用 **CreatePopupMenu**（只弹不挂窗口）：AGENTS §4 那条坑（SetMenu 只收 CreateMenu
+   的菜单栏句柄，塞 popup 进去以 ERROR_INVALID_PARAMETER(87) 静默失败）在托盘侧不存在——
+   托盘菜单从不交给 SetMenu，只交给 TrackPopupMenu。
+
+   图标：应用给的是 png / ico 路径。LoadImageW(IMAGE_ICON) 只认 .ico（png 失败**不报错**，
+   只是拿到 NULL），而 IMAGE_BITMAP 拿到的句柄不是 HICON、塞进 NOTIFYICONDATAW.hIcon 画不出来——
+   所以口径是：.ico 按 SM_CXSMICON 载入；其它扩展名出声跳过，用系统缺省图标（比给一个画不出来的
+   句柄诚实）；空路径直接用缺省图标。**图标必须在窗口销毁前 NIM_DELETE**（WM_DESTROY 里做），
+   否则进程退出后系统托盘会留一个点不动的幽灵图标。 */
+
+typedef struct tray_build_ctx {
+    plat_host *p;
+    HMENU menu;
+} tray_build_ctx;
+
+static void tray_clear_slots(plat_host *p) {
+    int i;
+    if (!p) return;
+    for (i = 0; i < p->tray_item_count; i++) {
+        free(p->tray_items[i].app_id);
+        p->tray_items[i].app_id = NULL;
+    }
+    p->tray_item_count = 0;
+}
+
+/** 摘掉托盘图标与菜单（幂等：WM_DESTROY 与宿主线程收尾都会调） */
+static void tray_remove(plat_host *p) {
+    if (!p) return;
+    if (p->tray_added) {
+        Shell_NotifyIconW(NIM_DELETE, &p->nid);
+        p->tray_added = 0;
+        /* 句柄归谁：LoadImageW 出来的是我们自己的一份，得 DestroyIcon；
+           LoadIconW(NULL, IDI_APPLICATION) 是共享资源，绝不能销毁 */
+        if (p->nid.hIcon && p->nid.hIcon != LoadIconW(NULL, IDI_APPLICATION)) {
+            DestroyIcon(p->nid.hIcon);
+        }
+        p->nid.hIcon = NULL;
+        fprintf(stderr, "[cj-bridge] tray removed\n");
+    }
+    if (p->tray_menu) {
+        DestroyMenu(p->tray_menu);
+        p->tray_menu = NULL;
+    }
+    tray_clear_slots(p);
+}
+
+/** 载入托盘图标：拿不到就回落到系统缺省图标（永远返回一个可用句柄） */
+static HICON tray_load_icon(const char *path) {
+    HICON ic = NULL;
+    if (path && path[0]) {
+        wchar_t *w = utf8_to_wide(path);
+        if (w) {
+            ic = (HICON)LoadImageW(NULL, w, IMAGE_ICON, GetSystemMetrics(SM_CXSMICON),
+                                   GetSystemMetrics(SM_CYSMICON), LR_LOADFROMFILE);
+            if (!ic) {
+                fprintf(stderr, "[cj-bridge] tray: icon load failed (%s) - system default used "
+                                "(Windows sidebar icons must be .ico, png is not loadable)\n", path);
+            }
+            free(w);
+        }
+    }
+    if (!ic) ic = LoadIconW(NULL, IDI_APPLICATION);
+    return ic;
+}
+
+/** 平铺一层的托盘菜单：kind 与菜单线路同码（n 普通 / c 勾选 / s 分隔线；m 丢弃——v1 托盘菜单平铺）*/
+static void tray_add_row(void *ctx, int depth, char kind, const char *id,
+                         const char *label, int flags, const char *accel) {
+    tray_build_ctx *c = (tray_build_ctx *)ctx;
+    plat_host *p;
+    UINT cmd, mflags;
+    int enabled = (flags & 1) ? 1 : 0;
+    int checked = (flags & 2) ? 1 : 0;
+    (void)depth; /* 托盘菜单平铺：层级位忽略 */
+    if (!c || !c->p || !c->menu) return;
+    p = c->p;
+    if (kind == 's') {
+        AppendMenuW(c->menu, MF_SEPARATOR, 0, NULL);
+        return;
+    }
+    if (kind == 'm') {
+        fprintf(stderr, "[cj-bridge] tray: submenu dropped (v1 tray menu is flat): %s\n", label);
+        return;
+    }
+    if (p->tray_item_count >= CJ_MENU_MAX_ITEMS) {
+        fprintf(stderr, "[cj-bridge] tray: item limit reached, dropped: %s\n", id);
+        return;
+    }
+    cmd = (UINT)(CJ_TRAY_CMD_BASE + p->tray_item_count); /* 与菜单栏命令 id 空间分开，见 WM_COMMAND */
+    mflags = enabled ? 0 : MF_GRAYED;
+    if (kind == 'c' && checked) mflags |= MF_CHECKED;
+    {
+        /* 标签：accel 非空时用制表符并进去（Win32 会把 \t 之后右对齐——正是快捷键栏位置）*/
+        size_t n = strlen(label) + (accel && accel[0] ? strlen(accel) + 1 : 0) + 1;
+        char *tmp = (char *)malloc(n);
+        wchar_t *wlabel;
+        if (!tmp) return;
+        snprintf(tmp, n, "%s%s%s", label, (accel && accel[0]) ? "\t" : "", accel ? accel : "");
+        wlabel = utf8_to_wide(tmp);
+        free(tmp);
+        if (!wlabel) return;
+        if (!AppendMenuW(c->menu, mflags, cmd, wlabel)) {
+            fprintf(stderr, "[cj-bridge] tray: append item failed: %lu\n",
+                    (unsigned long)GetLastError());
+            free(wlabel);
+            return;
+        }
+        free(wlabel);
+    }
+    {
+        menu_slot *s = &p->tray_items[p->tray_item_count];
+        s->cmd_id = cmd;
+        s->app_id = strdup(id);
+        s->kind = kind;
+        s->enabled = enabled;
+        s->checked = checked;
+        p->tray_item_count++;
+    }
+}
+
+/** 跳下一行行首（与 Linux 侧同名同义：最后一行没有 \n 就到串尾）*/
+static const char *tray_next_line(const char *p) {
+    const char *nl = strchr(p, '\n');
+    return nl ? nl + 1 : p + strlen(p);
+}
+
+/** 整表替换：空线路 = 移除托盘；否则重建图标 + 菜单（重复 setTray = 整体换）*/
+static void tray_apply_wire(cj_host *h, plat_host *p, const char *wire) {
+    char icon[512];
+    char tooltip[512];
+    const char *menu_part;
+    tray_build_ctx ctx;
+    wchar_t *wtip;
+    HICON new_icon;
+    DWORD op;
+
+    if (!p || !p->hwnd) return;
+    if (!wire || !wire[0]) {
+        tray_remove(p);
+        return;
+    }
+    /* 逐行推进：第 1 行 icon、第 2 行 tooltip、剩下全是菜单行。
+       （第一版「先跳两行再找 tooltip」永远找不着——tooltip 在第 2 行，跳两行已经越过它了） */
+    icon[0] = '\0';
+    tooltip[0] = '\0';
+    menu_part = wire;
+    if (strncmp(menu_part, "icon\t", 5) == 0) {
+        const char *v = menu_part + 5;
+        const char *nl = strchr(v, '\n');
+        size_t n = nl ? (size_t)(nl - v) : strlen(v);
+        if (n >= sizeof(icon)) n = sizeof(icon) - 1;
+        memcpy(icon, v, n);
+        icon[n] = '\0';
+        menu_part = tray_next_line(menu_part);
+    }
+    if (strncmp(menu_part, "tooltip\t", 8) == 0) {
+        const char *v = menu_part + 8;
+        const char *nl = strchr(v, '\n');
+        size_t n = nl ? (size_t)(nl - v) : strlen(v);
+        if (n >= sizeof(tooltip)) n = sizeof(tooltip) - 1;
+        memcpy(tooltip, v, n);
+        tooltip[n] = '\0';
+        menu_part = tray_next_line(menu_part);
+    }
+
+    /* 菜单整表重建（与菜单栏同规：旧 HMENU 与旧映射一起作废）*/
+    if (p->tray_menu) {
+        DestroyMenu(p->tray_menu);
+        p->tray_menu = NULL;
+    }
+    tray_clear_slots(p);
+    {
+        HMENU menu = CreatePopupMenu();
+        if (menu) {
+            ctx.p = p;
+            ctx.menu = menu;
+            cj_core_menu_walk(menu_part, tray_add_row, &ctx);
+            p->tray_menu = menu;
+        }
+    }
+
+    /* 图标 + 提示 + 回调消息：三者每次整体重填（NOTIFYICONDATAW 由平台层持有）*/
+    if (p->nid.hIcon && p->nid.hIcon != LoadIconW(NULL, IDI_APPLICATION)) {
+        DestroyIcon(p->nid.hIcon); /* 换图标前先放掉上一份（LoadImageW 的所有权在我们手上）*/
+    }
+    memset(&p->nid, 0, sizeof(p->nid));
+    p->nid.cbSize = sizeof(p->nid);
+    p->nid.hWnd = p->hwnd;
+    p->nid.uID = CJ_TRAY_UID;
+    p->nid.uFlags = NIF_ICON | NIF_MESSAGE | NIF_TIP;
+    p->nid.uCallbackMessage = WM_CJT_TRAY_NOTIFY;
+    p->nid.hIcon = tray_load_icon(icon);
+    wtip = utf8_to_wide(tooltip);
+    if (wtip) {
+        /* szTip 是定长宽字符数组：lstrcpynW 会保证 NUL 收尾（宽字符拷贝一律走 Win32，
+           mingw 的 swprintf %s 收的是 char*，拿它拼宽串会静默出垃圾——见 AGENTS §4）*/
+        lstrcpynW(p->nid.szTip, wtip, (int)(sizeof(p->nid.szTip) / sizeof(wchar_t)));
+        free(wtip);
+    }
+
+    op = p->tray_added ? NIM_MODIFY : NIM_ADD;
+    if (Shell_NotifyIconW(op, &p->nid)) {
+        p->tray_added = 1;
+        p->nid.uVersion = NOTIFYICON_VERSION_4; /* 回调口径：wParam 坐标 / lParam 事件 */
+        Shell_NotifyIconW(NIM_SETVERSION, &p->nid);
+        fprintf(stderr, "[cj-bridge] tray %s: items=%d icon=%s tooltip=%s\n",
+                op == NIM_ADD ? "added" : "updated", p->tray_item_count,
+                icon[0] ? icon : "(system default)", tooltip[0] ? tooltip : "(none)");
+    } else {
+        fprintf(stderr, "[cj-bridge] tray add failed: %lu\n", (unsigned long)GetLastError());
+    }
+}
+
+/* 托盘：装配期（窗口尚未建）静默退出——host_thread_main 建窗后会拿 pending 再应用一次；
+   运行期改动投到宿主线程做（Shell_NotifyIconW 的回调消息落在窗口上，必须与窗口同线程）。 */
+void cj_plat_set_tray(cj_host *h, const char *wire) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p) return;
+    if (!p->hwnd) return; /* 见上：pending 由 host_thread_main 应用 */
+    if (cj_plat_is_ui_thread(h)) {
+        tray_apply_wire(h, p, wire ? wire : "");
+        return;
+    }
+    {
+        char *dup = strdup(wire ? wire : "");
+        if (!dup) return;
+        if (!PostMessageW(p->hwnd, WM_CJT_TRAY, 0, (LPARAM)dup)) {
+            fprintf(stderr, "[cj-bridge] tray: post failed: %lu\n", (unsigned long)GetLastError());
+            free(dup);
+        }
+    }
+}
+
+/* ===== 窗口可见性 / 最小化到托盘（RFC-003 第 5 期余项）=====
+   两条都只动**窗口层**：ShowWindow(SW_HIDE / SW_SHOW) 不销毁 WebView2，页面照旧跑、轮询照旧，
+   只是看不见——所以「最小化到托盘」不需要任何页面侧配合。还原入口是应用自己的事
+   （托盘菜单 / 全局快捷键里调 setWindowVisible(true)），框架不替它决定。
+
+   WM_SYSCOMMAND 的拦截在 wnd_proc：那条路径要求托盘**真的挂上了**（p->tray_added），
+   没挂就如实降级为普通最小化并打一行 stderr——理由见那里的注释。 */
+
+static void window_apply_visible(plat_host *p, int visible) {
+    if (!p || !p->hwnd) return;
+    ShowWindow(p->hwnd, visible ? SW_SHOW : SW_HIDE);
+    if (visible) {
+        SetForegroundWindow(p->hwnd); /* 藏过的窗口 SW_SHOW 不会自己激活：顺手提到前面 */
+    }
+    fprintf(stderr, "[cj-bridge] window %s\n", visible ? "shown" : "hidden");
+}
+
+void cj_plat_set_window_visible(cj_host *h, int visible) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p) return;
+    if (!p->hwnd) return; /* 建窗前设的可见性由 host_thread_main 按 h->win_visible 定稿 */
+    if (cj_plat_is_ui_thread(h)) {
+        window_apply_visible(p, visible);
+        return;
+    }
+    PostMessageW(p->hwnd, WM_CJT_VISIBLE, visible ? 1 : 0, 0);
+}
+
+/* 最小化到托盘这里只**记一条策略**（并重置提醒位）：真正的拦截发生在用户按下最小化的那一刻
+   （WM_SYSCOMMAND），那时才知道托盘到底挂上了没有；此刻窗口层没有可做的事。 */
+void cj_plat_set_minimize_to_tray(cj_host *h, int enabled) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    if (!p) return;
+    p->min_to_tray_warned = 0;
+    fprintf(stderr, "[cj-bridge] minimize_to_tray: %s\n", enabled ? "on" : "off");
+}
+
+/* IDropTarget COM 对象（mingw C 模式，与文件里其余 COM 对象同风格）。
+   iface 必须在首位：RegisterDragDrop 收的就是 IDropTarget*。 */
+typedef struct cjt_drop_target {
+    IDropTarget iface;
+    LONG refcount;
+    cj_host *h;   /* 回投宿主：Drop 落地时交 core（宿主销毁前必然先 Revoke，见 WM_DESTROY） */
+} cjt_drop_target;
+
+static HRESULT STDMETHODCALLTYPE drop_QueryInterface(IDropTarget *This, REFIID riid, void **ppv) {
+    if (!ppv) return E_POINTER;
+    if (IsEqualIID(riid, &IID_IUnknown) || IsEqualIID(riid, &IID_IDropTarget)) {
+        *ppv = This;
+        This->lpVtbl->AddRef(This);
+        return S_OK;
+    }
+    *ppv = NULL;
+    return E_NOINTERFACE;
+}
+
+static ULONG STDMETHODCALLTYPE drop_AddRef(IDropTarget *This) {
+    cjt_drop_target *t = (cjt_drop_target *)This;
+    return (ULONG)InterlockedIncrement(&t->refcount);
+}
+
+static ULONG STDMETHODCALLTYPE drop_Release(IDropTarget *This) {
+    cjt_drop_target *t = (cjt_drop_target *)This;
+    ULONG rc = (ULONG)InterlockedDecrement(&t->refcount);
+    if (rc == 0) {
+        free(t);
+    }
+    return rc;
+}
+
+/* Drop 的载荷只认 CF_HDROP：拖进来的如果是别的东西（文本等），v1 如实不收 */
+static const FORMATETC g_drop_fmt = { CF_HDROP, NULL, DVASPECT_CONTENT, -1, TYMED_HGLOBAL };
+
+static HRESULT STDMETHODCALLTYPE drop_DragEnter(IDropTarget *This, IDataObject *dobj,
+                                                DWORD key_state, POINTL pt, DWORD *effect) {
+    (void)This; (void)key_state; (void)pt;
+    *effect = (dobj && dobj->lpVtbl->QueryGetData(dobj, (FORMATETC *)&g_drop_fmt) == S_OK)
+                  ? DROPEFFECT_COPY : DROPEFFECT_NONE;
+    return S_OK;
+}
+
+static HRESULT STDMETHODCALLTYPE drop_DragOver(IDropTarget *This, DWORD key_state, POINTL pt,
+                                               DWORD *effect) {
+    (void)This; (void)key_state; (void)pt;
+    *effect = DROPEFFECT_COPY; /* 光标策略沿用 DragEnter 的判定；这里保持 COPY */
+    return S_OK;
+}
+
+static HRESULT STDMETHODCALLTYPE drop_DragLeave(IDropTarget *This) {
+    (void)This;
+    return S_OK;
+}
+
+/* 把一个宽字符路径转成 file:/// URI（百分号编码，'\' → '/'）。
+   core 的 drop_uri_to_path 会剥 file:// 前缀并解码 %XX——两平台同一出口。 */
+static void drop_append_uri(char **buf, size_t *cap, size_t *len, const wchar_t *path) {
+    static const char hex[] = "0123456789ABCDEF";
+    char *utf8 = wide_to_utf8(path);
+    size_t i;
+    if (!utf8) return;
+    if (*len + strlen(utf8) * 3 + 12 > *cap) { /* 超出总量上限：丢弃这一条 */
+        free(utf8);
+        return;
+    }
+    *len += (size_t)snprintf(*buf + *len, 9, "file:///");
+    for (i = 0; utf8[i]; i++) {
+        unsigned char c = (unsigned char)utf8[i];
+        if (c == '\\') {
+            (*buf)[(*len)++] = '/';
+        } else if ((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') ||
+                   strchr("-._~/", c)) {
+            (*buf)[(*len)++] = (char)c;
+        } else {
+            (*buf)[(*len)++] = '%';
+            (*buf)[(*len)++] = hex[c >> 4];
+            (*buf)[(*len)++] = hex[c & 0x0F];
+        }
+    }
+    (*buf)[(*len)++] = '\n';
+    free(utf8);
+}
+
+static HRESULT STDMETHODCALLTYPE drop_Drop(IDropTarget *This, IDataObject *dobj,
+                                           DWORD key_state, POINTL pt, DWORD *effect) {
+    cjt_drop_target *t = (cjt_drop_target *)This;
+    STGMEDIUM stg;
+    (void)key_state; (void)pt;
+    *effect = DROPEFFECT_COPY;
+    if (!dobj || FAILED(dobj->lpVtbl->GetData(dobj, (FORMATETC *)&g_drop_fmt, &stg))) {
+        return S_OK;
+    }
+    if (stg.hGlobal) {
+        HDROP hd = (HDROP)stg.hGlobal;
+        UINT i, count = DragQueryFileW(hd, 0xFFFFFFFF, NULL, 0);
+        size_t cap = 32 * (12 + 3 * 4096) + 1; /* 与 core 的上限同量级（32 个 × 4096 字节） */
+        char *list = (char *)malloc(cap);
+        size_t len = 0;
+        if (list) {
+            for (i = 0; i < count; i++) {
+                UINT wlen = DragQueryFileW(hd, i, NULL, 0);
+                wchar_t *wpath;
+                if (wlen == 0 || wlen > 32768) continue;
+                wpath = (wchar_t *)malloc((wlen + 1) * sizeof(wchar_t));
+                if (!wpath) continue;
+                if (DragQueryFileW(hd, i, wpath, wlen + 1) > 0) {
+                    drop_append_uri(&list, &cap, &len, wpath);
+                }
+                free(wpath);
+            }
+            if (len > 0) {
+                list[len] = '\0';
+                cj_core_drop_files(t->h, list); /* 解码 / 上限 / 报文都在 core */
+            }
+            free(list);
+        }
+        DragFinish(hd);
+    }
+    if (stg.pUnkForRelease) {
+        stg.pUnkForRelease->lpVtbl->Release(stg.pUnkForRelease);
+    }
+    return S_OK;
+}
+
+static IDropTargetVtbl g_drop_vtbl = {
+    drop_QueryInterface, drop_AddRef, drop_Release,
+    drop_DragEnter, drop_DragOver, drop_DragLeave, drop_Drop
+};
+
+/* 对一个子窗口（含间接后代）撤销 WebView2 自己的目标并注册我们的 */
+static BOOL CALLBACK drop_inject_child(HWND child, LPARAM lp) {
+    IDropTarget *t = (IDropTarget *)lp;
+    /* WebView2 已注册了自己的 drop target：先撤销再覆盖（没有注册时撤销失败，忽略） */
+    RevokeDragDrop(child);
+    return SUCCEEDED(RegisterDragDrop(child, t)) ? TRUE : TRUE;
+}
+
+static BOOL CALLBACK drop_revoke_child(HWND child, LPARAM lp) {
+    (void)lp;
+    RevokeDragDrop(child);
+    return TRUE;
+}
+
+/* 挂/摘拖放目标（只在宿主 UI 线程调）：enabled=0 摘除。挂时枚举全部子窗口逐个覆盖。 */
+static void drag_dest_apply(cj_host *h, plat_host *p, int enabled) {
+    if (!p || !p->hwnd) return;
+    if (enabled) {
+        if (!p->drop_target) {
+            cjt_drop_target *t = (cjt_drop_target *)calloc(1, sizeof(cjt_drop_target));
+            if (!t) return;
+            t->iface.lpVtbl = &g_drop_vtbl;
+            t->refcount = 1;
+            t->h = h;
+            p->drop_target = &t->iface;
+        }
+        EnumChildWindows(p->hwnd, drop_inject_child, (LPARAM)p->drop_target);
+        fprintf(stderr, "[cj-bridge] drag dest attached (CF_HDROP)\n");
+    } else {
+        EnumChildWindows(p->hwnd, drop_revoke_child, 0);
+        fprintf(stderr, "[cj-bridge] drag dest detached\n");
+    }
+}
+
+/* 拖放策略（7.B Windows 真实现）：与 Linux 侧同签名同语义——
+   未就绪（窗口还没建）时 core 已把策略写进 h->pending_drop_*，controller 建好时读；
+   就绪后投 UI 线程重挂（Windows 的 OLE 注册表项只能在建它的 STA 线程碰）。 */
+void cj_plat_set_drag_drop(cj_host *h, int enabled, int files) {
+    plat_host *p = h ? (plat_host *)h->plat : NULL;
+    (void)files; /* v1 载荷只有「文件列表」一种形态，files 开关不改变 Windows 侧的注册方式 */
+    if (!p || !p->hwnd) {
+        return;
+    }
+    {
+        drag_drop_msg *m = (drag_drop_msg *)calloc(1, sizeof(drag_drop_msg));
+        if (!m) return;
+        m->enabled = enabled ? 1 : 0;
+        if (!PostMessageW(p->hwnd, WM_CJT_DRAG_DROP, 0, (LPARAM)m)) {
+            fprintf(stderr, "[cj-bridge] drag drop post failed: %lu\n",
+                    (unsigned long)GetLastError());
+            free(m);
+        }
+    }
+}
+
+/* =========================================================================
+ *  串口（plugin_serial 的平台层）：Windows 侧
+ *
+ *  四个原语的**名字与返回码口径**与 Linux 侧逐字一致（见 bridge_core.h），所以上层不必写平台分支。
+ *  实现：CreateFileW("\\\\.\\COMx", …, FILE_FLAG_OVERLAPPED) + DCB 配参；
+ *  读写都走 OVERLAPPED——超时由 WaitForSingleObject 的预算控制，不会把调用线程钉死在
+ *  驱动内部的阻塞读上（SetCommTimeouts 的总超时只对「等到第一个字节」可控，
+ *  OVERLAPPED 才能像 Linux 的 poll 那样精确按剩余预算等）。
+ * ========================================================================= */
+
+#define CJ_SERIAL_MAX_HANDLES 8
+
+typedef struct serial_slot {
+    int used;
+    long long id;
+    HANDLE h;
+    char path[256];
+} serial_slot;
+
+static serial_slot g_serial_slots[CJ_SERIAL_MAX_HANDLES];
+static long long g_serial_next_id = 1;
+static CRITICAL_SECTION g_serial_lock;
+static INIT_ONCE g_serial_lock_once = INIT_ONCE_STATIC_INIT;
+
+static BOOL CALLBACK serial_lock_init_once(PINIT_ONCE once, PVOID param, PVOID *ctx) {
+    (void)once; (void)param; (void)ctx;
+    InitializeCriticalSection(&g_serial_lock);
+    return TRUE;
+}
+
+static void serial_lock(void) {
+    InitOnceExecuteOnce(&g_serial_lock_once, serial_lock_init_once, NULL, NULL);
+    EnterCriticalSection(&g_serial_lock);
+}
+
+static void serial_unlock(void) {
+    LeaveCriticalSection(&g_serial_lock);
+}
+
+static void serial_err(char *err, int err_len, const char *fmt, ...) {
+    va_list ap;
+    if (!err || err_len <= 0) return;
+    va_start(ap, fmt);
+    vsnprintf(err, (size_t)err_len, fmt, ap);
+    va_end(ap);
+}
+
+static serial_slot *serial_find_locked(long long id) {
+    int i;
+    for (i = 0; i < CJ_SERIAL_MAX_HANDLES; i++) {
+        if (g_serial_slots[i].used && g_serial_slots[i].id == id) return &g_serial_slots[i];
+    }
+    return NULL;
+}
+
+/* 句柄 → HANDLE；无效时填 err 返回 NULL。HANDLE 值本身取出后在锁外用：
+   close 会先置 used=0 再 CloseHandle，所以锁外使用期间句柄不会被本表回收。 */
+static HANDLE serial_handle_of(long long h, char *err, int err_len) {
+    serial_slot *s;
+    HANDLE hd = NULL;
+    serial_lock();
+    s = serial_find_locked(h);
+    if (s) hd = s->h;
+    serial_unlock();
+    if (!hd) serial_err(err, err_len, "serial: 句柄 %lld 无效（未打开或已关闭）", h);
+    return hd;
+}
+
+/* "COM3"（白名单放行的形状）→ "\\.\COM3"：Win32 打开串口必须走设备命名空间，
+   普通文件语义的 "COM3" 会被当成当前目录下的同名文件。 */
+static int serial_win_path(const char *path, wchar_t *out, int out_chars) {
+    wchar_t w[256];
+    int n;
+    if (MultiByteToWideChar(CP_UTF8, 0, path, -1, w, 256) <= 0) return 0;
+    if (wcsncmp(w, L"\\\\.\\", 4) == 0) {
+        n = _snwprintf(out, (size_t)out_chars, L"%s", w);
+    } else {
+        n = _snwprintf(out, (size_t)out_chars, L"\\\\.\\%s", w);
+    }
+    return (n > 0 && n < out_chars) ? 1 : 0;
+}
+
+/* 数值波特率 → DCB：DCB.BaudRate 本身收数值，但沿用 Linux「只收常见档位」的口径——
+   不认识的值拒绝而不是透传给驱动（两端行为一致，上层不用猜哪边支持哪档） */
+static int serial_baud_known(int baud) {
+    switch (baud) {
+        case 300: case 600: case 1200: case 2400: case 4800: case 9600:
+        case 19200: case 38400: case 57600: case 115200: case 230400:
+        case 460800: case 500000: case 921600: case 1000000:
+            return 1;
+        default:
+            return 0;
+    }
+}
+
+static long long serial_now_ms(void) {
+    return (long long)GetTickCount64();
+}
+
+long long cj_plat_serial_open(const char *path, const cj_serial_cfg *cfg, char *err, int err_len) {
+    wchar_t wpath[280];
+    HANDLE hd;
+    DCB dcb;
+    COMMTIMEOUTS to;
+    int i;
+    long long id;
+
+    if (!path || !cfg) {
+        serial_err(err, err_len, "serial: 空路径 / 空配置");
+        return -1;
+    }
+    if (!serial_baud_known(cfg->baud)) {
+        serial_err(err, err_len, "serial: 本平台不支持的波特率 %d（只收常见档位）", cfg->baud);
+        return -1;
+    }
+    if (!serial_win_path(path, wpath, (int)(sizeof(wpath) / sizeof(wpath[0])))) {
+        serial_err(err, err_len, "serial: 设备路径转宽字符失败（过长或非 UTF-8？）: %s", path);
+        return -1;
+    }
+
+    serial_lock();
+    for (i = 0; i < CJ_SERIAL_MAX_HANDLES; i++) {
+        if (!g_serial_slots[i].used) break;
+    }
+    if (i == CJ_SERIAL_MAX_HANDLES) {
+        serial_unlock();
+        serial_err(err, err_len, "serial: 句柄表满（最多 %d 个并发串口）", CJ_SERIAL_MAX_HANDLES);
+        return -2;
+    }
+
+    /* 独占打开（共享模式 0）：串口是物理独占资源，两个进程同开一个口只会互咬数据 */
+    hd = CreateFileW(wpath, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
+                     FILE_FLAG_OVERLAPPED, NULL);
+    if (hd == INVALID_HANDLE_VALUE) {
+        serial_err(err, err_len, "serial: CreateFileW(%s) 失败: lu=%lu（口不存在 / 被占用？）",
+                   path, (unsigned long)GetLastError());
+        serial_unlock();
+        return -3;
+    }
+
+    /* GetCommState 拿驱动现状打底再覆盖：DCB 结构里有几十个流控/二进制位，
+       全零起步会把 fBinary=0 这类非法组合交给驱动，行为随驱动版本漂移 */
+    memset(&dcb, 0, sizeof(dcb));
+    dcb.DCBlength = sizeof(dcb);
+    if (!GetCommState(hd, &dcb)) {
+        serial_err(err, err_len, "serial: GetCommState(%s) 失败: lu=%lu",
+                   path, (unsigned long)GetLastError());
+        CloseHandle(hd);
+        serial_unlock();
+        return -3;
+    }
+    dcb.BaudRate = (DWORD)cfg->baud;
+    dcb.ByteSize = (BYTE)cfg->data_bits;
+    dcb.Parity = (cfg->parity == 1) ? ODDPARITY : (cfg->parity == 2) ? EVENPARITY : NOPARITY;
+    dcb.StopBits = (cfg->stop_bits == 2) ? TWOSTOPBITS : ONESTOPBIT;
+    dcb.fBinary = TRUE;
+    dcb.fParity = (cfg->parity != 0) ? TRUE : FALSE;
+    /* 硬件/软件流控不替应用开（与 Linux 侧同一条铁律：框架自作主张会改握手语义） */
+    dcb.fOutxCtsFlow = FALSE;
+    dcb.fOutxDsrFlow = FALSE;
+    dcb.fDtrControl = DTR_CONTROL_DISABLE;
+    dcb.fRtsControl = RTS_CONTROL_DISABLE;
+    dcb.fOutX = FALSE;
+    dcb.fInX = FALSE;
+    if (!SetCommState(hd, &dcb)) {
+        serial_err(err, err_len, "serial: SetCommState(%s) 失败: lu=%lu（设备不接受这组参数？）",
+                   path, (unsigned long)GetLastError());
+        CloseHandle(hd);
+        serial_unlock();
+        return -3;
+    }
+
+    /* 超时全部归零：等待交给 OVERLAPPED 的 WaitForSingleObject（我们控制预算），
+       驱动层不再叠加自己的阻塞语义。PURGE 清掉打开瞬间的残留字节 */
+    memset(&to, 0, sizeof(to));
+    to.ReadIntervalTimeout = MAXDWORD;
+    to.ReadTotalTimeoutConstant = 0;
+    to.ReadTotalTimeoutMultiplier = 0;
+    to.WriteTotalTimeoutConstant = 0;
+    to.WriteTotalTimeoutMultiplier = 0;
+    if (!SetCommTimeouts(hd, &to)) {
+        serial_err(err, err_len, "serial: SetCommTimeouts(%s) 失败: lu=%lu",
+                   path, (unsigned long)GetLastError());
+        CloseHandle(hd);
+        serial_unlock();
+        return -3;
+    }
+    PurgeComm(hd, PURGE_TXABORT | PURGE_RXABORT | PURGE_TXCLEAR | PURGE_RXCLEAR);
+
+    id = g_serial_next_id++;
+    if (g_serial_next_id <= 0) g_serial_next_id = 1; /* 溢出兜底：句柄永不为 0 */
+    g_serial_slots[i].used = 1;
+    g_serial_slots[i].id = id;
+    g_serial_slots[i].h = hd;
+    snprintf(g_serial_slots[i].path, sizeof(g_serial_slots[i].path), "%s", path);
+    serial_unlock();
+
+    /* 落地一行：参数与句柄都打全，串口问题基本都是拿这行对账（AGENTS §1 的取证口径） */
+    fprintf(stderr, "[cj-bridge] serial win32: path=%s baud=%d data=%d parity=%d stop=%d handle=%p\n",
+            path, cfg->baud, cfg->data_bits, cfg->parity, cfg->stop_bits, (void *)hd);
+    return id;
+}
+
+/* 读：OVERLAPPED 发起，等事件最多 timeout_ms；0 = 超时无数据（与 Linux poll 口径一致）
+ *
+ * 预算必须**按每次调用逐次下发给驱动**：打开时那套 `ReadIntervalTimeout=MAXDWORD` + 两个
+ * total 全 0 是「立即交回已有字节」语义——没数据时驱动当场把请求完成成 0 字节、ReadFile
+ * 返回 TRUE，下面按预算等事件的分支根本进不去（实测 2026-10-15：预算 1000ms 的读 0ms 就
+ * 交回 0 字节，`serial:read` 的 timeoutMs 形同虚设，前端只能靠高频轮询碰运气）。
+ * 这里改成 `ReadIntervalTimeout=0` + `ReadTotalTimeoutConstant=预算`：有第一个字节就立刻
+ * 完成、没有就等满预算，与 Linux 的 poll 同一口径；只有预算为 0 才用「立即返回」那套。
+ * WaitForSingleObject 继续留着，作为驱动不按套路完成时的兜底（比预算多给一点余量）。 */
+int cj_plat_serial_read(long long h, unsigned char *buf, int len, int timeout_ms, char *err, int err_len) {
+    HANDLE hd = serial_handle_of(h, err, err_len);
+    COMMTIMEOUTS to;
+    OVERLAPPED ov;
+    DWORD got = 0;
+    BOOL ok;
+
+    if (!hd) return -4;
+
+    memset(&to, 0, sizeof(to));
+    if (timeout_ms > 0) {
+        to.ReadIntervalTimeout = 0;
+        to.ReadTotalTimeoutMultiplier = 0;
+        to.ReadTotalTimeoutConstant = (DWORD)timeout_ms;
+    } else {
+        to.ReadIntervalTimeout = MAXDWORD;
+        to.ReadTotalTimeoutMultiplier = 0;
+        to.ReadTotalTimeoutConstant = 0;
+    }
+    if (!SetCommTimeouts(hd, &to)) {
+        serial_err(err, err_len, "serial: SetCommTimeouts(预算 %d ms) 失败: lu=%lu",
+                   timeout_ms, (unsigned long)GetLastError());
+        return -3;
+    }
+
+    memset(&ov, 0, sizeof(ov));
+    ov.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
+    if (!ov.hEvent) {
+        serial_err(err, err_len, "serial: CreateEvent 失败: lu=%lu", (unsigned long)GetLastError());
+        return -3;
+    }
+    ok = ReadFile(hd, buf, (DWORD)len, &got, &ov);
+    if (!ok && GetLastError() == ERROR_IO_PENDING) {
+        DWORD w = WaitForSingleObject(ov.hEvent, (DWORD)(timeout_ms > 0 ? timeout_ms + 250 : 0));
+        if (w == WAIT_TIMEOUT) {
+            /* 预算用尽：撤销这次读再走，驱动里不挂未完成请求 */
+            CancelIo(hd);
+            GetOverlappedResult(hd, &ov, &got, TRUE); /* 等 CancelIo 本身落定 */
+            CloseHandle(ov.hEvent);
+            return 0;
+        }
+        ok = (w == WAIT_OBJECT_0) ? GetOverlappedResult(hd, &ov, &got, FALSE) : FALSE;
+        if (!ok && GetLastError() == ERROR_OPERATION_ABORTED) {
+            CloseHandle(ov.hEvent);
+            return 0;
+        }
+    } else if (!ok && GetLastError() == ERROR_IO_INCOMPLETE) {
+        /* 理论上只在无事件句柄时出现；按「本轮无数据」降级，别当错误放大 */
+        CloseHandle(ov.hEvent);
+        return 0;
+    }
+    CloseHandle(ov.hEvent);
+    if (!ok) {
+        serial_err(err, err_len, "serial: ReadFile 失败: lu=%lu", (unsigned long)GetLastError());
+        return -3;
+    }
+    return (int)got;
+}
+
+/* 写：在 timeout_ms 总预算内有界写完（与 Linux 侧同一口径：返回已写入量，预算用尽即交回） */
+int cj_plat_serial_write(long long h, const unsigned char *buf, int len, int timeout_ms,
+                         char *err, int err_len) {
+    HANDLE hd = serial_handle_of(h, err, err_len);
+    long long deadline = serial_now_ms() + (timeout_ms > 0 ? (long long)timeout_ms : 0);
+    int written = 0;
+
+    if (!hd) return -4;
+
+    while (written < len) {
+        OVERLAPPED ov;
+        DWORD put = 0, w;
+        long long budget;
+        BOOL ok;
+
+        memset(&ov, 0, sizeof(ov));
+        ov.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
+        if (!ov.hEvent) {
+            serial_err(err, err_len, "serial: CreateEvent 失败: lu=%lu", (unsigned long)GetLastError());
+            return written > 0 ? written : -3;
+        }
+        ok = WriteFile(hd, buf + written, (DWORD)(len - written), &put, &ov);
+        if (!ok && GetLastError() == ERROR_IO_PENDING) {
+            budget = deadline - serial_now_ms();
+            w = WaitForSingleObject(ov.hEvent, budget > 0 ? (DWORD)budget : 0);
+            if (w == WAIT_TIMEOUT) {
+                CancelIo(hd);
+                GetOverlappedResult(hd, &ov, &put, TRUE);
+                CloseHandle(ov.hEvent);
+                break; /* 预算用尽：返回已写入量 */
+            }
+            ok = (w == WAIT_OBJECT_0) ? GetOverlappedResult(hd, &ov, &put, FALSE) : FALSE;
+            if (!ok && GetLastError() == ERROR_OPERATION_ABORTED) {
+                CloseHandle(ov.hEvent);
+                break;
+            }
+        }
+        CloseHandle(ov.hEvent);
+        if (!ok) {
+            serial_err(err, err_len, "serial: WriteFile 失败: lu=%lu", (unsigned long)GetLastError());
+            return written > 0 ? written : -3;
+        }
+        if (put == 0) break; /* 驱动收了请求却 0 字节：别空转，交回上层 */
+        written += (int)put;
+    }
+    return written;
+}
+
+int cj_plat_serial_close(long long h, char *err, int err_len) {
+    HANDLE hd = NULL;
+    int i;
+
+    serial_lock();
+    for (i = 0; i < CJ_SERIAL_MAX_HANDLES; i++) {
+        if (g_serial_slots[i].used && g_serial_slots[i].id == h) {
+            hd = g_serial_slots[i].h;
+            g_serial_slots[i].used = 0;
+            g_serial_slots[i].id = 0;
+            g_serial_slots[i].h = NULL;
+            g_serial_slots[i].path[0] = '\0';
+            break;
+        }
+    }
+    serial_unlock();
+    if (!hd) {
+        serial_err(err, err_len, "serial: 句柄 %lld 无效（未打开或已关闭）", h);
+        return -4;
+    }
+    if (!CloseHandle(hd)) {
+        serial_err(err, err_len, "serial: CloseHandle 失败: lu=%lu", (unsigned long)GetLastError());
+        return -3;
+    }
+    return 0;
+}
+
+/* 串口枚举（cj_bridge_serial_list 的平台层）：QueryDosDeviceW 扫全部 MS-DOS 设备名，
+   收「COM + 全数字」的形状。相比翻注册表（枚举值随驱动形态漂移：有 00xx 子键的、
+   有 Device Parameters 的），QueryDosDevice 一次调用给全系统当前真实存在的设备名，
+   虚拟口（com0com、驱动模拟）也在其中。 */
+int cj_plat_serial_list(char *out, int out_len) {
+    wchar_t *buf;
+    DWORD need = 65536, got, i;
+    int count = 0, pos = 0;
+
+    if (!out || out_len <= 0) return -1;
+    out[0] = '\0';
+    for (;;) {
+        buf = (wchar_t *)malloc((size_t)need * sizeof(wchar_t));
+        if (!buf) return -1;
+        got = QueryDosDeviceW(NULL, buf, need);
+        if (got > 0) break;
+        free(buf);
+        if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) return -1;
+        need *= 2; /* 缓冲不够就翻倍重试；QueryDosDevice 无返回所需大小的口径 */
+    }
+    for (i = 0; buf[i] != L'\0'; i += wcslen(buf + i) + 1) {
+        wchar_t *name = buf + i;
+        const wchar_t *p = name;
+        int digits = 0;
+        if (wcsncmp(p, L"COM", 3) != 0) continue;
+        p += 3;
+        while (*p >= L'0' && *p <= L'9') { p++; digits++; }
+        if (digits == 0 || digits > 3 || *p != L'\0') continue; /* COMfoo / 超长号一律不要 */
+        {
+            char ascii[16];
+            int n = WideCharToMultiByte(CP_UTF8, 0, name, -1, ascii, (int)sizeof(ascii), NULL, NULL);
+            if (n <= 0) continue;
+            if (pos + n >= out_len) break; /* 放不下就到此为止：串口数量不会真到溢出 */
+            if (count > 0) out[pos++] = '\n';
+            memcpy(out + pos, ascii, (size_t)n);
+            pos += n - 1; /* 不含收尾 '\0' */
+            count++;
+        }
+    }
+    free(buf);
+    out[pos] = '\0';
+    return count;
+}
+
+/* ===== 静默子进程（cj_plat_spawn_hidden / kill / alive 的平台层）=====
+   为什么是 DETACHED_PROCESS 而不是 SW_HIDE / CREATE_NO_WINDOW：
+   - SW_HIDE 只是「先建出来再藏起来」，控制台窗口会先闪一下；
+   - CREATE_NO_WINDOW 不显示窗口，但子进程**仍然拥有一个控制台对象**，conhost.exe 照样为它挂一个
+     隐藏的 console 宿主（`GetConsoleWindow` 非空、进程树里多一个 conhost）；
+   - DETACHED_PROCESS 让子进程**根本没有控制台**，连隐藏的都不创建。
+   后台服务进程（cjh 这类）要的就是最后这一种：它不需要 console，也不该让用户看见任何窗口。
+   代价是它的标准 I/O 没有去处——没有控制台时那三个句柄是无效值，而控制台程序（cjh 启动第一件事
+   就是打 banner）一 println 就可能死在自己的控制台上，所以三个句柄显式指到 NUL。诊断仍在父进程
+   的 stderr 上，「诊断输出走 stderr」的约定不受影响（AGENTS §4）。 */
+
+/* 按 CommandLineToArgvW 的规则给一个参数加引号：只在含空格 / 制表 / 引号时才加；加引号时，
+   引号前 n 个反斜杠要变 2n+1 个、结尾 n 个要变 2n 个——否则 `C:\dir\` 这种尾部反斜杠会把收尾
+   引号转义掉、参数被吃掉。UTF-8 逐字节处理是安全的：要判的字符都 < 0x80，多字节序列的每个字节
+   都 ≥ 0x80，不会误判。缓冲容量最坏情况是「每个字节都翻倍 + 两个引号」。 */
+static int append_quoted_arg(char *buf, size_t cap, size_t *len, const char *s, size_t n) {
+    size_t i, k, bs = 0;
+    int need = 0;
+
+    for (i = 0; i < n; i++) {
+        char c = s[i];
+        if (c == ' ' || c == '\t' || c == '"') {
+            need = 1;
+            break;
+        }
+    }
+    if (*len + n * 2 + 4 > cap) return 0;
+    if (!need) {
+        if (n) memcpy(buf + *len, s, n);
+        *len += n;
+        return 1;
+    }
+    buf[(*len)++] = '"';
+    for (i = 0; i < n; i++) {
+        char c = s[i];
+        if (c == '\\') {
+            bs++;
+            continue;
+        }
+        if (c == '"') {
+            for (k = 0; k < bs * 2 + 1; k++) buf[(*len)++] = '\\';
+            buf[(*len)++] = '"';
+        } else {
+            for (k = 0; k < bs; k++) buf[(*len)++] = '\\';
+            buf[(*len)++] = c;
+        }
+        bs = 0;
+    }
+    for (k = 0; k < bs * 2; k++) buf[(*len)++] = '\\'; /* 结尾反斜杠翻倍，别把收尾引号吃了 */
+    buf[(*len)++] = '"';
+    return 1;
+}
+
+/* 拼命令行：argv[0] = 程序路径（带引号），后面是把 \x1f 切开的参数。 */
+static wchar_t *build_cmdline_wide(const char *exe, const char *args) {
+    size_t elen = strlen(exe);
+    size_t alen = args ? strlen(args) : 0;
+    size_t cap = (elen + alen) * 2 + 64;
+    size_t len = 0;
+    char *buf = (char *)malloc(cap);
+    wchar_t *w;
+
+    if (!buf) return NULL;
+    if (!append_quoted_arg(buf, cap, &len, exe, elen)) {
+        free(buf);
+        return NULL;
+    }
+    if (alen > 0) {
+        const char *p = args;
+        while (*p) {
+            const char *q = strchr(p, 0x1f);
+            size_t seg = q ? (size_t)(q - p) : strlen(p);
+            if (len + 1 >= cap) {
+                free(buf);
+                return NULL;
+            }
+            buf[len++] = ' ';
+            if (!append_quoted_arg(buf, cap, &len, p, seg)) {
+                free(buf);
+                return NULL;
+            }
+            if (!q) break;
+            p = q + 1;
+        }
+    }
+    buf[len] = '\0';
+    w = utf8_to_wide(buf);
+    free(buf);
+    return w;
+}
+
+long long cj_plat_spawn_hidden(const char *exe, const char *args, char *err, int err_len) {
+    wchar_t *wexe, *wcmd;
+    STARTUPINFOW si;
+    PROCESS_INFORMATION pi;
+    SECURITY_ATTRIBUTES sa;
+    HANDLE hNul = INVALID_HANDLE_VALUE;
+    BOOL ok;
+
+    if (!exe || !*exe) {
+        serial_err(err, err_len, "spawn hidden: 程序路径为空");
+        return 0;
+    }
+    wexe = utf8_to_wide(exe);
+    wcmd = build_cmdline_wide(exe, args);
+    if (!wexe || !wcmd) {
+        free(wexe);
+        free(wcmd);
+        serial_err(err, err_len, "spawn hidden: UTF-8 转 UTF-16 / 拼命令行失败");
+        return 0;
+    }
+    ZeroMemory(&sa, sizeof(sa));
+    sa.nLength = (DWORD)sizeof(sa);
+    sa.bInheritHandle = TRUE;
+    hNul = CreateFileW(L"NUL", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE,
+                       &sa, OPEN_EXISTING, 0, NULL);
+    ZeroMemory(&si, sizeof(si));
+    si.cb = sizeof(si);
+    si.dwFlags = STARTF_USESHOWWINDOW;
+    si.wShowWindow = SW_HIDE;
+    if (hNul != INVALID_HANDLE_VALUE) {
+        si.dwFlags |= STARTF_USESTDHANDLES;
+        si.hStdInput = hNul;
+        si.hStdOutput = hNul;
+        si.hStdError = hNul;
+    }
+    ZeroMemory(&pi, sizeof(pi));
+    /* DETACHED_PROCESS：完全不给子进程 console（见本段开头，连隐藏的都不建）；
+       CREATE_NEW_PROCESS_GROUP：让它不受父进程 Ctrl-C 的影响。 */
+    ok = CreateProcessW(wexe, wcmd, NULL, NULL, TRUE,
+                        DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP, NULL, NULL, &si, &pi);
+    if (hNul != INVALID_HANDLE_VALUE) CloseHandle(hNul);
+    free(wexe);
+    free(wcmd);
+    if (!ok) {
+        serial_err(err, err_len, "spawn hidden: CreateProcessW 失败（GetLastError=%lu）",
+                   (unsigned long)GetLastError());
+        return 0;
+    }
+    CloseHandle(pi.hThread);
+    CloseHandle(pi.hProcess);
+    return (long long)pi.dwProcessId;
+}
+
+/* 幂等口径：进程已经不在了算成功（调用方只是想让它结束）。 */
+int cj_plat_kill_pid(long long pid) {
+    HANDLE h;
+    DWORD wr;
+
+    if (pid <= 0) return 0;
+    h = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, (DWORD)pid);
+    if (!h) {
+        /* 打不开基本就是已经不在了（或不是我们有权碰的进程）：按「已结束」上报，幂等 */
+        fprintf(stderr, "[cj-bridge] kill pid %lld: OpenProcess 失败（%lu），按已退出处理\n", pid,
+                (unsigned long)GetLastError());
+        return 1;
+    }
+    if (!TerminateProcess(h, 0)) {
+        fprintf(stderr, "[cj-bridge] kill pid %lld: TerminateProcess 失败（%lu）\n", pid,
+                (unsigned long)GetLastError());
+        CloseHandle(h);
+        return 0;
+    }
+    wr = WaitForSingleObject(h, 3000);
+    CloseHandle(h);
+    if (wr == WAIT_TIMEOUT) {
+        fprintf(stderr, "[cj-bridge] kill pid %lld: 3s 内没等到退出\n", pid);
+        return 0;
+    }
+    return 1;
+}
+
+int cj_plat_pid_alive(long long pid) {
+    HANDLE h;
+    DWORD code = 0;
+
+    if (pid <= 0) return 0;
+    /* 打不开＝已经不在了（或不是我们有权碰的进程）：按「不在」上报，调用方据此重新拉起 */
+    h = OpenProcess(SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION, FALSE, (DWORD)pid);
+    if (!h) return 0;
+    if (!GetExitCodeProcess(h, &code)) {
+        CloseHandle(h);
+        return 0;
+    }
+    CloseHandle(h);
+    return (code == STILL_ACTIVE) ? 1 : 0;
+}
+
+/* ===== 内嵌资源释放（cj_plat_extract_assets 的平台层）=====
+   单文件包（scripts/pack-win-single.sh）把随包的外部程序与它的依赖 DLL 作为 RT_RCDATA 资源嵌进
+   exe，这里运行期取出来写盘——cjh 这种独立程序没法静态链接进来。
+
+   表从哪来：打包器同时生成 `pack_assets_map.h`（资源 ID -> 释放出来的文件名），编桥时带
+   `-DCJ_PACK_ASSETS_EMBEDDED` 才会包含它。普通构建（包括 native/build_win.bat 编的动态桥）
+   没有这个宏、也就没有表，函数如实返回 0 =「这个产物里没有内嵌资源」——不假装释放成功。
+
+   为什么不是「按资源名枚举」：资源名只能用数字 ID，因为 llvm-rc 不认字符串资源名（实测
+   `expected int or identifier, got "cjh.exe"`），而数字 ID 本身说不出文件名。
+
+   幂等：目标已存在且大小与资源一致就跳过。几十 MB 的资源每次启动重写一遍是不可接受的。
+   写文件用宽字符 API（CreateFileW / GetFileAttributesExW），不碰 CRT 的新旧方言。 */
+
+#ifdef CJ_PACK_ASSETS_EMBEDDED
+#include "pack_assets_map.h"
+
+static int cj_asset_size_w(const wchar_t *path, long long *out) {
+    WIN32_FILE_ATTRIBUTE_DATA fa;
+
+    if (!GetFileAttributesExW(path, GetFileExInfoStandard, &fa)) return 0;
+    if (fa.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) return 0;
+    *out = ((long long)fa.nFileSizeHigh << 32) | (long long)fa.nFileSizeLow;
+    return 1;
+}
+
+static int cj_asset_write_w(const wchar_t *path, const void *data, DWORD size) {
+    HANDLE h;
+    const BYTE *p = (const BYTE *)data;
+    DWORD left = size;
+    DWORD done = 0;
+
+    h = CreateFileW(path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (h == INVALID_HANDLE_VALUE) return 0;
+    while (left > 0) {
+        if (!WriteFile(h, p, left, &done, NULL) || done == 0) {
+            CloseHandle(h);
+            return 0;
+        }
+        p += done;
+        left -= done;
+    }
+    CloseHandle(h);
+    return 1;
+}
+#endif
+
+int cj_plat_extract_assets(const char *dir, char *err, int err_len) {
+#ifdef CJ_PACK_ASSETS_EMBEDDED
+    wchar_t *wdir;
+    wchar_t dst[1024];
+    size_t i;
+    size_t count = sizeof(CJ_PACK_ASSETS) / sizeof(CJ_PACK_ASSETS[0]);
+    int ready = 0;
+
+    if (err && err_len > 0) err[0] = '\0';
+    if (!dir || !*dir) {
+        serial_err(err, err_len, "extract assets: 目录为空");
+        return -1;
+    }
+    wdir = utf8_to_wide(dir);
+    if (!wdir) {
+        serial_err(err, err_len, "extract assets: UTF-8 转 UTF-16 失败");
+        return -1;
+    }
+    /* 已存在算成功；多级目录由调用方（仓颉侧）先建好——桥不该替应用决定目录层级 */
+    CreateDirectoryW(wdir, NULL);
+    for (i = 0; i < count; i++) {
+        const char *name = CJ_PACK_ASSETS[i].name;
+        HRSRC hres;
+        HGLOBAL hg;
+        DWORD size;
+        const void *data;
+        wchar_t *wname;
+        long long have = 0;
+
+        if (!name || !*name) continue;
+        /* 名字来自编译期生成的表、不是外部输入，这条只是兜底：不含分隔符就不会写到目录外 */
+        if (strchr(name, '\\') || strchr(name, '/') || strchr(name, ':')) {
+            serial_err(err, err_len, "资源名不合法（%s），已跳过", name);
+            continue;
+        }
+        hres = FindResourceW(NULL, MAKEINTRESOURCEW(CJ_PACK_ASSETS[i].id), RT_RCDATA);
+        if (!hres) {
+            serial_err(err, err_len, "找不到内嵌资源（%s）", name);
+            continue;
+        }
+        size = SizeofResource(NULL, hres);
+        hg = LoadResource(NULL, hres);
+        if (!hg) {
+            serial_err(err, err_len, "LoadResource 失败（%s）", name);
+            continue;
+        }
+        data = LockResource(hg);
+        if (!data) {
+            serial_err(err, err_len, "LockResource 失败（%s）", name);
+            continue;
+        }
+        wname = utf8_to_wide(name);
+        if (!wname) {
+            serial_err(err, err_len, "文件名 UTF-8 转 UTF-16 失败（%s）", name);
+            continue;
+        }
+        if (wcslen(wdir) + 1 + wcslen(wname) + 1 > (sizeof(dst) / sizeof(dst[0]))) {
+            serial_err(err, err_len, "目标路径过长（%s）", name);
+            free(wname);
+            continue;
+        }
+        lstrcpyW(dst, wdir);
+        lstrcatW(dst, L"\\");
+        lstrcatW(dst, wname);
+        free(wname);
+        if (cj_asset_size_w(dst, &have) && have == (long long)size) {
+            ready++; /* 已经在盘上且大小一致：不重写 */
+            continue;
+        }
+        if (!cj_asset_write_w(dst, data, size)) {
+            serial_err(err, err_len, "写盘失败（%s，GetLastError=%lu）", name,
+                       (unsigned long)GetLastError());
+            continue;
+        }
+        ready++;
+    }
+    free(wdir);
+    return ready;
+#else
+    (void)dir;
+    (void)err;
+    (void)err_len;
+    return 0; /* 普通构建没有内嵌资源——如实回报，调用方据此走 vendor 目录 */
+#endif
+}
+
+/* ===== 动态库预加载（cj_plat_preload_library 的平台层）=====
+   一句话：按**绝对路径**先 LoadLibraryW 一次，之后运行时按裸名去找同名 DLL 时就会命中
+   已加载的那个模块。为什么要这么绕，见 bridge_core.h 同名段落（2026-10-21：单文件包在
+   别人的机器上连明文 ws:// 都挂在 `Can not load openssl library or function RAND_bytes.`）。 */
+int cj_plat_preload_library(const char *path, char *err, int err_len) {
+    wchar_t *wpath;
+    HMODULE h;
+
+    if (err && err_len > 0) err[0] = '\0';
+    if (!path || !*path) {
+        serial_err(err, err_len, "preload: 路径为空");
+        return 0;
+    }
+    wpath = utf8_to_wide(path);
+    if (!wpath) {
+        serial_err(err, err_len, "preload: UTF-8 转 UTF-16 失败");
+        return 0;
+    }
+    h = LoadLibraryW(wpath);
+    free(wpath);
+    if (!h) {
+        serial_err(err, err_len, "LoadLibraryW 失败（GetLastError=%lu）",
+                   (unsigned long)GetLastError());
+        return 0;
+    }
+    return 1;
+}
+