Windows cold-start shim for the binary: a PowerShell twin of hooks/bootstrap.sh for the no-binary cold start on Windows. Trigger: Windows target work begins (abcd ships Windows binaries one day). itd-130's abcd update core is the compiled updater that runs on Windows once a binary exists — it already uses minio/selfupdate's rename-dance for the running-exe swap — but the hook ladder in hooks.json and bootstrap.sh are POSIX shell and do not run on Windows. This seed is the cold-start shim only; the steady-state updater is itd-130.

Windows cold-start shim for the binary: a PowerShell twin of hooks/bootstrap.sh for the no-binary cold start on Windows. Trigger: Windows target work begins (abcd ships Windows binaries one day). itd-130's abcd update core is the compiled updater that runs on Windows once a binary exists — it already uses minio/selfupdate's rename-dance for the running-exe swap — but the hook ladder in hooks.json and bootstrap.sh are POSIX shell and do not run on Windows. This seed is the cold-start shim only; the steady-state updater is itd-130.

Remedy grounds (2026-09-29)

• Microsoft's reference calls the execution policy defence in depth rather than a security boundary, and a policy given on the command line lasts only for that process and its children (https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies, consulted 2026-09-29), so the shim changes no machine setting and its integrity comes from the checksum, as in bootstrap.sh.
• Rejected: asking the person to change their machine's execution policy.