cronstable 1.2.11__tar.gz

cronstable-1.2.11/.dockerignore

@@ -0,0 +1,27 @@
+# Keep the build context small. NOTE: .git MUST be included — setuptools_scm
+# derives the version from git tags during `pip install .`. README.md and
+# LICENSE must also stay: pyproject.toml references them at build time.
+.venv
+.venv314
+.tox
+.mypy_cache
+.ruff_cache
+.pytest_cache
+dist
+build
+*.egg-info
+__pycache__
+*.pyc
+
+# Not needed to build the package; excluded to shrink the build context.
+.claude
+.github
+docker
+example
+pyinstaller
+scripts
+target
+tests
+.editorconfig
+.gitignore
+.pre-commit-config.yaml

cronstable-1.2.11/.editorconfig

@@ -0,0 +1,15 @@
+# http://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+insert_final_newline = true
+charset = utf-8
+end_of_line = lf
+
+
+[LICENSE]
+insert_final_newline = false

cronstable-1.2.11/.gitattributes

@@ -0,0 +1,6 @@
+# The example shell scripts (example/*/gen-certs.sh, node-entrypoint.sh) are
+# bind-mounted from the working tree and executed by `sh` inside Linux
+# containers, so they must check out with LF line endings everywhere. Without
+# this, a default Windows clone (core.autocrlf=true) converts them to CRLF and
+# every cluster demo dies at its first line ("set: illegal option -").
+*.sh text eol=lf

cronstable-1.2.11/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Default owner for everything in the repo
+
+* @ptweezy

cronstable-1.2.11/.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,15 @@
+* cronstable version:
+* Python version:
+* Operating System:
+
+### Description
+
+Describe what you were trying to get done.
+Tell us what happened, what went wrong, and what you expected to happen.
+
+### What I Did
+
+```
+Paste the command(s) you ran and the output.
+If there was a crash, please include the traceback here.
+```

cronstable-1.2.11/.github/dependabot.yml

@@ -0,0 +1,59 @@
+# Dependabot keeps the CI/CD supply chain current: it opens PRs to bump the
+# pinned versions as new releases land, so the exact pins in .github/workflows
+# and the Dockerfiles don't silently rot back into known-vulnerable versions.
+#
+# Two mechanisms, one file:
+#   - VERSION updates (configured below) run on the weekly schedule and bump a
+#     dependency simply because a newer release exists.
+#   - SECURITY updates -- the ones that matter most here, where Dependabot raises
+#     a PR the moment a dependency has a published advisory, regardless of
+#     schedule -- are switched on in the repo UI, not here: Settings -> Code
+#     security -> enable "Dependabot alerts" AND "Dependabot security updates".
+#     They reuse the ecosystems declared below to know which manifests to patch,
+#     so keep this file in sync with what the pipeline actually uses.
+#
+# Updates are grouped per ecosystem so a quiet week brings at most one PR per
+# ecosystem to review, not one per dependency.
+version: 2
+updates:
+  # The GitHub Actions pinned in .github/workflows/*.yml. They are exact-pinned
+  # (e.g. actions/checkout@v7.0.0), which is precisely what lets Dependabot see
+  # each one as outdated and open a reviewable bump -- a moving major tag (@v7)
+  # would hide minor/patch drift behind a mutable ref instead.
+  - package-ecosystem: github-actions
+    directory: "/" # scans .github/workflows/ (and any composite actions)
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Python dependencies: the pyproject.toml optional-dependency groups (incl. the
+  # dev extra) and requirements_dev.txt. Catches CVEs in the aiohttp/ruamel stack
+  # and the dev toolchain (tox, ruff, mypy, pytest, uv-via-tox-uv).
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      python:
+        patterns: ["*"]
+
+  # Base images in the Dockerfiles: the published multi-distro image matrix
+  # (/Dockerfile is the default Debian image; docker/Dockerfile.* are the
+  # variants) plus the local PyInstaller build image (pyinstaller/Dockerfile,
+  # which also carries the uv COPY --from pin). Base-image bumps can change a
+  # distro's default Python, so review these rather than automerging.
+  - package-ecosystem: docker
+    directories:
+      - "/"
+      - "/docker"
+      - "/pyinstaller"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      docker:
+        patterns: ["*"]

cronstable-1.2.11/.github/workflows/build.yml

@@ -0,0 +1,517 @@
+name: build
+
+# Per-commit build verification. Runs EVERY build that release.yml performs --
+# the wheel + sdist and the self-contained PyInstaller binaries for Linux
+# (amd64, arm64, i686, armv7, ppc64le, s390x and riscv64 in both glibc and
+# musl/Alpine flavors, plus armv6 in musl only), macOS (arm64 + amd64) and
+# Windows (amd64 + arm64) -- on
+# every push, but WITHOUT publishing,
+# tagging,
+# signing, or pushing anything. A broken build (or a broken bundle the
+# `--version` smoke test
+# catches) fails the commit early instead of only surfacing at release time.
+#
+# This is the package/binary analog of docker.yml's per-commit build-only job:
+#   - no PyPI publish, no git tag, no GitHub Release, no image push;
+#   - the macOS binaries are built and smoke-tested but NOT signed/notarized --
+#     signing needs secrets and is a release-time concern (see release.yml's
+#     binaries-macos "Sign and notarize" step);
+#   - binaries build at the natural setuptools_scm version derived from git
+#     (e.g. 1.0.9.devN+g<sha>) rather than a pinned release version.
+# The real, version-pinned, signed, *published* builds still live in
+# release.yml; this workflow only proves every commit can still build them.
+#
+# The build steps below are kept deliberately identical to their release.yml
+# counterparts (same Python, same pyinstaller==6.21.0 pin, same `--version`
+# smoke test, same matrices) so a change there and a drift here are easy to
+# spot -- only the publish/sign/version-pin differences and the macOS 26
+# coverage are intentional.
+#
+# armv6 note: it is musl-only -- Debian/glibc has no arm32v6 image (it ships
+# arm32v5), so armv6 appears only in binaries-musl (no binaries-glibc-extra
+# entry) and the published container image does not cover it (the Debian-based
+# Dockerfile has no arm32v6 base). riscv64 and armv6 have no precompiled
+# PyInstaller bootloader, so pip compiles it from the sdist via waf under QEMU.
+
+on:
+  push:
+    branches: ["**"]  # build on every commit, on every branch
+  workflow_dispatch:
+
+concurrency:
+  # One in-flight build per ref; a newer commit supersedes an older build.
+  group: build-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Build-only: nothing in this workflow writes anywhere (no PyPI/OIDC, no
+# contents:write, no packages:write). Read is all any job needs.
+permissions:
+  contents: read
+
+# Network hardening for a transient PyPI/network blip. The runner-native jobs
+# (dist, native binaries, macOS, Windows, version) install with uv, which reads
+# UV_HTTP_TIMEOUT for its per-request socket timeout (and retries internally);
+# UV_PYTHON_DOWNLOADS=never keeps uv on the setup-python interpreter rather than
+# fetching a managed one, so the build Python stays exactly the one CI pinned.
+# The emulated foreign-arch binary jobs (binaries-musl, binaries-glibc-extra)
+# stay on pip inside their `docker run` containers -- uv's official image is
+# amd64/arm64 only and its musl ppc64le/s390x wheels don't exist, so pip is the
+# arch-portable choice there -- and read PIP_RETRIES/PIP_TIMEOUT, forwarded into
+# `docker run` with `-e`.
+env:
+  PIP_RETRIES: "5"
+  PIP_TIMEOUT: "60"
+  UV_HTTP_TIMEOUT: "60"
+  UV_PYTHON_DOWNLOADS: "never"
+
+jobs:
+  # Compute the version once on the host (which has git + full history) and feed
+  # it to every build via SETUPTOOLS_SCM_PRETEND_VERSION -- mirroring release.yml,
+  # which pins all its builds to one number. Here the number is the natural
+  # setuptools_scm dev version, not a bumped release version. Pinning it also
+  # lets the musl build run inside an Alpine container with no git installed
+  # (the container can't run `git describe`, so it relies on the pretend value).
+  version:
+    runs-on: ubuntu-latest
+    outputs:
+      new: ${{ steps.ver.outputs.new }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history + tags so setuptools_scm resolves a version
+      - uses: actions/setup-python@v6.3.0
+        with:
+          python-version: '3.14'
+      - uses: astral-sh/setup-uv@v8.3.0
+        with:
+          version: "0.11.26"
+      - name: Compute build version
+        id: ver
+        run: |
+          set -euo pipefail
+          # Resolve setuptools_scm into a throwaway env and read the version off
+          # git -- no venv to create, no install to leave behind.
+          new="$(uv run --no-project --with setuptools-scm python -m setuptools_scm)"
+          echo "new=$new" >> "$GITHUB_OUTPUT"
+          echo "::notice::Build-only at version $new (no release)."
+
+  # Wheel + sdist, built and `twine check`ed exactly as release.yml does for
+  # PyPI -- but never uploaded to PyPI. The artifact is kept only for download.
+  dist:
+    needs: version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history so setuptools_scm has a base (version is pinned below)
+      - uses: actions/setup-python@v6.3.0
+        with:
+          python-version: '3.14'
+      - uses: astral-sh/setup-uv@v8.3.0
+        with:
+          version: "0.11.26"
+      - name: Build distributions
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.version.outputs.new }}
+        run: |
+          set -euo pipefail
+          uv build                                      # wheel + sdist into dist/
+          uvx twine check dist/*.whl dist/*.tar.gz       # twine, run ephemerally
+      - uses: actions/upload-artifact@v7.0.1
+        with:
+          name: dist
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+          retention-days: 7
+
+  # glibc PyInstaller binaries, one per arch on a native runner. Mirrors
+  # release.yml's `binaries` job (same pyinstaller pin, same `--version` smoke
+  # test); the only difference is the version is the dev version, not a release.
+  binaries:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history so setuptools_scm has a base (version is pinned below)
+      - uses: actions/setup-python@v6.3.0
+        with:
+          python-version: '3.14'
+      - uses: astral-sh/setup-uv@v8.3.0
+        with:
+          version: "0.11.26"
+      - name: Build binary
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.version.outputs.new }}
+        run: |
+          set -euo pipefail
+          # Runner-native, all-wheels arch: install into a throwaway uv venv and
+          # freeze from it with `uv run` (uv discovers the setup-python 3.14).
+          uv venv --python 3.14
+          uv pip install pyinstaller==6.21.0  # pin matches pyinstaller/Dockerfile
+          uv pip install .                     # bakes the pinned version into cronstable/version.py
+          # Bundle uvloop (the `speedups` extra) so the binary runs the faster
+          # event loop. Install a wheel where one exists, else build it from
+          # sdist (ship uvloop as broadly as it compiles); a failed install
+          # falls back to asyncio. verify_uvloop.py then proves the result
+          # actually runs a loop (a source build can miscompile under emulation)
+          # and uninstalls it if not, so a broken uvloop is never frozen in and
+          # the binary cleanly uses asyncio.
+          uv pip install "uvloop>=0.19" || echo "uvloop unavailable; using asyncio"
+          uv run python pyinstaller/verify_uvloop.py || uv pip uninstall uvloop || true
+          # Bundle orjson (the `speedups` extra) to accelerate the durable-state
+          # and cluster JSON paths; amd64/arm64 and macOS ship wheels (no Rust
+          # needed). The shared script round-trip-verifies it and drops a broken
+          # build, so the binary falls back to stdlib json (cronstable/_json).
+          PIP="uv pip" PIPUNINST="uv pip uninstall" PY="uv run python" \
+            sh pyinstaller/install_orjson.sh
+          uv run pyinstaller pyinstaller/cronstable.spec
+          dist/cronstable --version            # smoke test: fails the job if the bundle is broken
+          mv dist/cronstable "dist/cronstable-linux-${{ matrix.arch }}"
+      - uses: actions/upload-artifact@v7.0.1
+        with:
+          name: cronstable-linux-${{ matrix.arch }}
+          path: dist/cronstable-linux-${{ matrix.arch }}
+          if-no-files-found: error
+          retention-days: 7
+
+  # musl/Alpine PyInstaller binaries, built inside an Alpine container (see
+  # release.yml's binaries-musl for why it's `docker run`, not a job container).
+  # Mirrors release.yml's binaries-musl; the pinned version is what lets the
+  # no-git Alpine image resolve a setuptools_scm version. Covers all eight Linux
+  # musl arches: amd64/arm64 build natively on a matching runner; i686 (linux/386)
+  # runs natively on the amd64 runner (x86-64 executes 32-bit x86 directly);
+  # armv7, armv6, ppc64le, s390x and riscv64 have no native execution on the
+  # runners, so they run under QEMU emulation. musllinux wheels exist for the
+  # whole stack on armv7/ppc64le/s390x, but NOT for the i686 aiohttp family
+  # (aiohttp/yarl/frozenlist/propcache), nothing at all for armv6 (no musllinux
+  # armv6 wheels exist), or multidict/frozenlist/ruamel.yaml.clib on riscv64 --
+  # build-base compiles those from sdist.
+  binaries-musl:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+            platform: linux/amd64
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+            platform: linux/arm64
+          - arch: i686
+            runner: ubuntu-24.04
+            platform: linux/386
+          - arch: armv7
+            runner: ubuntu-24.04
+            platform: linux/arm/v7
+            qemu: true            # no native 32-bit ARM on the runners -> emulate
+          - arch: ppc64le
+            runner: ubuntu-24.04
+            platform: linux/ppc64le
+            qemu: true            # no native ppc64le on the runners -> emulate
+          - arch: s390x
+            runner: ubuntu-24.04
+            platform: linux/s390x
+            qemu: true            # no native s390x on the runners -> emulate
+          - arch: riscv64
+            runner: ubuntu-24.04
+            platform: linux/riscv64
+            qemu: true            # no native riscv64 on the runners -> emulate
+          # armv6 is musl-only: Debian/glibc ships no arm32v6 image (it ships
+          # arm32v5), so there is no binaries-glibc-extra counterpart. Entire
+          # C-ext stack + PyInstaller bootloader compile from sdist (no musllinux
+          # armv6 wheels) -> slowest leg.
+          - arch: armv6
+            runner: ubuntu-24.04
+            platform: linux/arm/v6
+            qemu: true            # no native armv6 on the runners -> emulate
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history so setuptools_scm has a base (version is pinned below)
+      # Register binfmt/QEMU so `docker run --platform` can execute a foreign-arch
+      # container (armv7, armv6, ppc64le, s390x, riscv64). amd64/arm64/i686 run
+      # natively and skip this.
+      - if: ${{ matrix.qemu }}
+        uses: docker/setup-qemu-action@v4.2.0
+      - name: Build binary (Alpine/musl)
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.version.outputs.new }}
+        run: |
+          set -euo pipefail
+          docker run --rm --platform ${{ matrix.platform }} \
+            -e SETUPTOOLS_SCM_PRETEND_VERSION \
+            -e PIP_RETRIES -e PIP_TIMEOUT \
+            -v "$PWD:/src" -w /src \
+            python:3.14-alpine sh -euc '
+              # build-base brings the C toolchain + strip (the spec sets
+              # strip=True); libffi/zlib headers cover any dep that lacks a
+              # musllinux wheel and falls back to compiling from sdist (notably
+              # the i686 aiohttp stack, which ships no musllinux_i686 wheels).
+              apk add --no-cache build-base libffi-dev zlib-dev
+              pip install --upgrade pip
+              pip install pyinstaller==6.21.0   # pin matches the glibc job (supports 3.14)
+              pip install .                     # bakes the pinned version into cronstable/version.py
+              # Bundle uvloop (the `speedups` extra): a musllinux wheel where one
+              # exists (amd64/arm64), else a source build (ship it as broadly as
+              # it compiles -- build-base above supplies the toolchain).
+              # verify_uvloop.py proves the result runs a loop (a source build can
+              # miscompile under QEMU) and uninstalls it otherwise, so a broken
+              # uvloop is never frozen in; the binary then cleanly falls back to
+              # asyncio.
+              pip install "uvloop>=0.19" || echo "uvloop unavailable; using asyncio"
+              python pyinstaller/verify_uvloop.py || pip uninstall -y uvloop || true
+              # Bundle orjson (the `speedups` extra): a musllinux wheel on amd64/
+              # arm64, else a Rust source build. RUST_SETUP installs a CURRENT
+              # Rust via rustup (distro rustc is older than the orjson MSRV) only
+              # when the wheel is missing; the shared script round-trip-verifies
+              # it and drops a broken QEMU build -> stdlib json fallback.
+              RUST_SETUP="apk add --no-cache curl && curl --proto =https --tlsv1.2 -sSf https://sh.rustup.rs | env CARGO_HOME=/opt/cargo RUSTUP_HOME=/opt/rustup sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path" sh pyinstaller/install_orjson.sh
+              pyinstaller pyinstaller/cronstable.spec
+              dist/cronstable --version            # smoke test: a musl binary on a musl host
+              mv dist/cronstable dist/cronstable-linux-${{ matrix.arch }}-musl
+            '
+      - uses: actions/upload-artifact@v7.0.1
+        with:
+          name: cronstable-linux-${{ matrix.arch }}-musl
+          path: dist/cronstable-linux-${{ matrix.arch }}-musl
+          if-no-files-found: error
+          retention-days: 7
+
+  # glibc PyInstaller binaries for the arches with no native GitHub runner
+  # (i686, armv7, ppc64le, s390x, riscv64). The native `binaries` job covers only
+  # amd64 and arm64 (the runners GitHub hosts) and PyInstaller is not a
+  # cross-compiler, so -- like binaries-musl -- these build inside a container via
+  # `docker run --platform`, here on python:3.14-slim (Debian glibc). i686
+  # (linux/386) runs natively on the amd64 runner; armv7, ppc64le, s390x and
+  # riscv64 run under QEMU. glibc wheel coverage varies: ppc64le/s390x have full
+  # manylinux wheels, while the i686 aiohttp stack, propcache-on-armv7, and
+  # multidict/frozenlist/ruamel.yaml.clib on riscv64 ship no wheel and compile
+  # from sdist -- so build-essential is installed either way. Assets carry no
+  # -musl suffix and sit beside the 64-bit glibc binaries.
+  binaries-glibc-extra:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: i686
+            runner: ubuntu-24.04
+            platform: linux/386
+          - arch: armv7
+            runner: ubuntu-24.04
+            platform: linux/arm/v7
+            qemu: true
+          - arch: ppc64le
+            runner: ubuntu-24.04
+            platform: linux/ppc64le
+            qemu: true
+          - arch: s390x
+            runner: ubuntu-24.04
+            platform: linux/s390x
+            qemu: true
+          - arch: riscv64
+            runner: ubuntu-24.04
+            platform: linux/riscv64
+            qemu: true
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history so setuptools_scm has a base (version is pinned below)
+      - if: ${{ matrix.qemu }}
+        uses: docker/setup-qemu-action@v4.2.0
+      - name: Build binary (Debian/glibc container)
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.version.outputs.new }}
+        run: |
+          set -euo pipefail
+          docker run --rm --platform ${{ matrix.platform }} \
+            -e SETUPTOOLS_SCM_PRETEND_VERSION \
+            -e PIP_RETRIES -e PIP_TIMEOUT \
+            -v "$PWD:/src" -w /src \
+            python:3.14-slim sh -euc '
+              # build-essential brings gcc + strip (the spec sets strip=True);
+              # libffi/zlib headers cover the C-extension deps that ship no glibc
+              # wheel and compile from sdist (the i686 aiohttp stack; propcache on
+              # armv7). ppc64le/s390x have full manylinux wheels, so the toolchain
+              # goes unused there.
+              apt-get update
+              apt-get install -y --no-install-recommends build-essential libffi-dev zlib1g-dev
+              pip install --upgrade pip
+              pip install pyinstaller==6.21.0   # pin matches the other binary jobs
+              pip install .                     # bakes the pinned version into cronstable/version.py
+              # Bundle uvloop (the `speedups` extra): a manylinux wheel where one
+              # exists (amd64/arm64), else a source build (ship it as broadly as
+              # it compiles -- build-essential above supplies the toolchain).
+              # verify_uvloop.py proves the result runs a loop (a source build can
+              # miscompile under QEMU) and uninstalls it otherwise, so a broken
+              # uvloop is never frozen in; the binary then cleanly falls back to
+              # asyncio.
+              pip install "uvloop>=0.19" || echo "uvloop unavailable; using asyncio"
+              python pyinstaller/verify_uvloop.py || pip uninstall -y uvloop || true
+              # Bundle orjson (the `speedups` extra): a manylinux wheel on amd64/
+              # arm64, else a Rust source build. RUST_SETUP installs a CURRENT
+              # Rust via rustup (distro rustc is older than the orjson MSRV) only
+              # when the wheel is missing; the shared script round-trip-verifies
+              # it and drops a broken QEMU build -> stdlib json fallback.
+              RUST_SETUP="apt-get -o Acquire::Retries=5 update && apt-get -o Acquire::Retries=5 install -y --no-install-recommends curl ca-certificates && curl --proto =https --tlsv1.2 -sSf https://sh.rustup.rs | env CARGO_HOME=/opt/cargo RUSTUP_HOME=/opt/rustup sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path" sh pyinstaller/install_orjson.sh
+              pyinstaller pyinstaller/cronstable.spec
+              dist/cronstable --version            # smoke test: native (i686) or emulated (armv7/ppc64le/s390x)
+              mv dist/cronstable dist/cronstable-linux-${{ matrix.arch }}
+            '
+      - uses: actions/upload-artifact@v7.0.1
+        with:
+          name: cronstable-linux-${{ matrix.arch }}
+          path: dist/cronstable-linux-${{ matrix.arch }}
+          if-no-files-found: error
+          retention-days: 7
+
+  # macOS PyInstaller binaries. Per-commit we build on BOTH macOS 15 and macOS
+  # 26 (Tahoe), each on a native runner, arm64 + Intel -- four jobs -- so OS-
+  # version-specific build breakage surfaces early. (release.yml still ships
+  # only the macOS 15 pair; this extra macOS 26 coverage is CI-only.) Mirrors
+  # release.yml's binaries-macos -- including the arch assertion that guards
+  # against Rosetta silently building the wrong arch -- but deliberately OMITS
+  # the "Sign and notarize" step (that needs secrets and only matters for a
+  # published release). The matrix carries an `os` (15/26) discriminator so the
+  # four binaries/artifacts get unique names instead of colliding on arch.
+  binaries-macos:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            runner: macos-15          # macOS 15, Apple Silicon
+            os: '15'
+          - arch: amd64
+            runner: macos-15-intel    # macOS 15, Intel
+            os: '15'
+          - arch: arm64
+            runner: macos-26          # macOS 26 (Tahoe), Apple Silicon
+            os: '26'
+          - arch: amd64
+            runner: macos-26-intel    # macOS 26 (Tahoe), Intel
+            os: '26'
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history so setuptools_scm has a base (version is pinned below)
+      - uses: actions/setup-python@v6.3.0
+        with:
+          python-version: '3.14'  # set explicitly; don't rely on the runner's preinstalled patch level
+      - uses: astral-sh/setup-uv@v8.3.0
+        with:
+          version: "0.11.26"
+      - name: Build binary
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.version.outputs.new }}
+        run: |
+          set -euo pipefail
+          # Runner-native, all-wheels arch: install into a throwaway uv venv and
+          # freeze from it with `uv run` (uv discovers the setup-python 3.14).
+          uv venv --python 3.14
+          uv pip install pyinstaller==6.21.0  # pin matches the Linux jobs
+          uv pip install .                     # bakes the pinned version into cronstable/version.py
+          # Bundle uvloop (the `speedups` extra) for the faster event loop; macOS
+          # ships wheels for both arches. verify_uvloop.py confirms it imports and
+          # runs a loop, else uninstalls it so the binary falls back to asyncio
+          # (cronstable/__main__._new_event_loop).
+          uv pip install "uvloop>=0.19" || echo "uvloop unavailable; using asyncio"
+          uv run python pyinstaller/verify_uvloop.py || uv pip uninstall uvloop || true
+          # Bundle orjson (the `speedups` extra) to accelerate the durable-state
+          # and cluster JSON paths; amd64/arm64 and macOS ship wheels (no Rust
+          # needed). The shared script round-trip-verifies it and drops a broken
+          # build, so the binary falls back to stdlib json (cronstable/_json).
+          PIP="uv pip" PIPUNINST="uv pip uninstall" PY="uv run python" \
+            sh pyinstaller/install_orjson.sh
+          uv run pyinstaller pyinstaller/cronstable.spec
+          dist/cronstable --version            # smoke test: fails the job if the bundle is broken
+          # Assert the binary is the intended native arch: Rosetta would happily
+          # run an x86_64 build on the arm64 runner and let the smoke test pass,
+          # silently producing a mislabelled asset. `file` reports x86_64/arm64.
+          case "${{ matrix.arch }}" in
+            amd64) want=x86_64 ;;
+            arm64) want=arm64 ;;
+          esac
+          file dist/cronstable | grep -q "$want"
+          mv dist/cronstable "dist/cronstable-macos${{ matrix.os }}-${{ matrix.arch }}"
+      - uses: actions/upload-artifact@v7.0.1
+        with:
+          name: cronstable-macos${{ matrix.os }}-${{ matrix.arch }}
+          path: dist/cronstable-macos${{ matrix.os }}-${{ matrix.arch }}
+          if-no-files-found: error
+          retention-days: 7
+
+  # Windows PyInstaller binaries: amd64 on the hosted runner, arm64 on the
+  # windows-11-arm runner. Mirrors release.yml's binaries-windows. Any C-
+  # extension dep without a win_arm64 wheel (parts of the aiohttp stack --
+  # multidict/yarl/frozenlist/propcache -- and ruamel.yaml.clib) compiles from
+  # sdist using the runner's Visual Studio ARM64 toolchain, the same way the
+  # QEMU Linux legs compile from sdist for riscv64/armv6. Same pyinstaller pin
+  # and `--version` smoke test as the other binary jobs; the bundle is a single
+  # self-contained cronstable-windows-<arch>.exe. Steps use bash (git bash ships on
+  # the Windows runners) so they read identically to the Linux/macOS jobs.
+  binaries-windows:
+    needs: version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: windows-latest
+          - arch: arm64
+            runner: windows-11-arm
+    runs-on: ${{ matrix.runner }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0  # full history so setuptools_scm has a base (version is pinned below)
+      - uses: actions/setup-python@v6.3.0
+        with:
+          python-version: '3.14'
+      - uses: astral-sh/setup-uv@v8.3.0
+        with:
+          version: "0.11.26"
+      - name: Build binary
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ needs.version.outputs.new }}
+        run: |
+          set -euo pipefail
+          # Runner-native (uv ships a win_arm64 build too); install into a
+          # throwaway uv venv and freeze from it with `uv run`.
+          uv venv --python 3.14
+          uv pip install pyinstaller==6.21.0  # pin matches the Linux/macOS jobs
+          uv pip install .                     # bakes the pinned version into cronstable/version.py
+          # Bundle orjson (the `speedups` extra) for the durable-state / cluster
+          # JSON paths; Windows amd64 ships a wheel (arm64 falls back if none).
+          # The shared script round-trip-verifies it and drops a broken build,
+          # so the binary falls back to stdlib json (cronstable/_json).
+          PIP="uv pip" PIPUNINST="uv pip uninstall" PY="uv run python" \
+            sh pyinstaller/install_orjson.sh
+          uv run pyinstaller pyinstaller/cronstable.spec
+          ./dist/cronstable.exe --version      # smoke test: fails the job if the bundle is broken
+          mv dist/cronstable.exe "dist/cronstable-windows-${{ matrix.arch }}.exe"
+      - uses: actions/upload-artifact@v7.0.1
+        with:
+          name: cronstable-windows-${{ matrix.arch }}
+          path: dist/cronstable-windows-${{ matrix.arch }}.exe
+          if-no-files-found: error
+          retention-days: 7