site+docs: Windows ships day one, and links unfurl as share cards

Windows day-one shipping (v0.0.8 publishes the signed x64 Setup):
- /download/windows resolves the newest -windows-x64-setup.exe from
  the latest GitHub release, same cached resolver as macOS
- /docs/install/windows-wsl becomes a real install guide; /docs and
  /docs/getting-started drop the withheld-until-Authenticode language
- README badge row, download links, platform truth table, install
  section, and not-yet-shipped list updated; manual FAQ says all
  three platforms, day one
- site tests flipped to assert the Windows download exists

Social sharing:
- hand-drawn 1200x630 Open Graph card (captain, Skipper, the crew,
  "Intelligence should not be temporary") at /assets/story/og-card.png
- full Open Graph + Twitter summary_large_image meta and canonical
  URLs on the story, manual, terms, and privacy pages
- legacy template pages now share the same card instead of the
  square sailboat logo

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gitcommit90

README.md

@@ -12,7 +12,11 @@
 </p>
 
 <p align="center">
-  <a href="https://1helm.com/download/macos"><strong>Download for Apple Silicon</strong></a>
+  <a href="https://1helm.com/download/macos"><strong>Download for Mac</strong></a>
+  &nbsp;·&nbsp;
+  <a href="https://1helm.com/download/windows"><strong>for Windows</strong></a>
+  &nbsp;·&nbsp;
+  <a href="https://1helm.com/docs/install/linux"><strong>for Linux</strong></a>
   &nbsp;·&nbsp;
   <a href="https://1helm.com">The story</a>
   &nbsp;·&nbsp;
@@ -30,7 +34,7 @@
   <code>Self-hosted</code>&nbsp;&nbsp;
   <code>Model-agnostic</code>&nbsp;&nbsp;
   <code>Signed + notarized</code>&nbsp;&nbsp;
-  <code>macOS · Linux · Windows soon</code>
+  <code>macOS · Windows · Linux</code>
 </p>
 
 ---
@@ -106,7 +110,9 @@ Skipper ─── crosses the boundary ─────────┘
 - **The computer, memory, skills, and obligations** belong to the channel and
   survive model changes and application restarts.
 
-## Install on Apple Silicon
+## Install
+
+On Apple Silicon:
 
 1. [Download the current signed DMG](https://1helm.com/download/macos).
 2. Open it and drag **1Helm** to Applications.
@@ -120,11 +126,13 @@ update preserves it — credentials, databases, resident state, files, and
 workspaces. Profile → Check for updates asks the Mac running 1Helm—not the
 device displaying the web UI—to download and verify the signed update.
 
-Linux hosts use a verified installer that provisions a durable systemd service
-with an atomic, digest-verified, health-checked updater — see the
-[Linux install guide](https://1helm.com/docs/install/linux). Either way, it
-works best on a dedicated machine: your crew works around the clock, and your
-everyday computer takes naps.
+Windows 11 x64 gets a [signed Setup executable](https://1helm.com/download/windows)
+that provisions one private WSL 2 world per channel. Linux hosts use a verified
+installer that provisions a durable systemd service with an atomic,
+digest-verified, health-checked updater — see the
+[Linux install guide](https://1helm.com/docs/install/linux). Whichever platform,
+it works best on a dedicated machine: your crew works around the clock, and
+your everyday computer takes naps.
 
 ## Ready on day one. Specialized by day one hundred.
 
@@ -221,11 +229,11 @@ and an audit trail. A prompt saying “use this service” is not a connector.
 |---|---|
 | **Apple Silicon macOS 26** | Native desktop product and real isolated Linux computer per resident (Apple `container machine`, `home-mount=none`). |
 | **Linux / CI** | Supported headless systemd host with one unprivileged LXC per resident (subordinate UID/GID mapping, exact ownership checks); CI may select an explicit test backend. |
-| **Windows + WSL** | Native x64 Electron and private WSL 2 worlds (Windows-drive mounts and interop disabled) have passed real-host acceptance; the public installer awaits Authenticode signing. |
+| **Windows 11 x64** | Native desktop product with one private WSL 2 world per resident (Windows-drive mounts and interop disabled); the signed Setup executable ships with every release. |
 
-Not yet shipped: a signed public Windows installer, a native Linux desktop
-shell, mobile clients, a hosted control plane, rich Photon attachment fidelity,
-or blind execution of community skills.
+Not yet shipped: a native Linux desktop shell, mobile clients, a hosted
+control plane, rich Photon attachment fidelity, or blind execution of
+community skills.
 
 ## Run the source workspace
 

site/content.mjs

@@ -4,6 +4,19 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <meta name="description" content="The 1Helm ship's manual — quick start, the crew, channels, memory, skills, models and providers, connections, workflows, security, and FAQ.">
+<meta property="og:type" content="website">
+<meta property="og:site_name" content="1Helm">
+<meta property="og:title" content="1Helm — The Ship's Manual">
+<meta property="og:description" content="Everything you need to run your helm: quick start, the crew, channels, memory, skills, models, connections, and FAQ.">
+<meta property="og:url" content="https://1helm.com/manual">
+<meta property="og:image" content="https://1helm.com/assets/story/og-card.png">
+<meta property="og:image:width" content="2400">
+<meta property="og:image:height" content="1260">
+<meta name="twitter:card" content="summary_large_image">
+<meta name="twitter:title" content="1Helm — The Ship's Manual">
+<meta name="twitter:description" content="Everything you need to run your helm: quick start, the crew, channels, memory, skills, models, connections, and FAQ.">
+<meta name="twitter:image" content="https://1helm.com/assets/story/og-card.png">
+<link rel="canonical" href="https://1helm.com/manual">
 <title>1Helm — The Ship's Manual</title>
 <link rel="icon" type="image/png" href="/assets/story/app-icon.png">
 <link rel="stylesheet" href="/assets/manual.css">
@@ -200,7 +213,7 @@ <h2><span class="mark">FAQ</span></h2>
 
     <details>
       <summary>What operating systems does it run on?</summary>
-      <p>macOS (signed Apple Silicon app), Linux (systemd install with a verified updater), and Windows via WSL&nbsp;2. Resident computers work the same way on all three — one isolated machine per agent.</p>
+      <p>All three, day one: macOS (signed Apple Silicon app), Windows 11 (signed x64 installer with one private WSL&nbsp;2 world per agent), and Linux (systemd install with a verified updater). Resident computers work the same way everywhere — one isolated machine per agent.</p>
     </details>
 
     <details>

site/manual.html

@@ -4,6 +4,19 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <meta name="description" content="Privacy policy for 1helm.com and the self-hosted 1Helm software: your workspace lives on your machine.">
+<meta property="og:type" content="website">
+<meta property="og:site_name" content="1Helm">
+<meta property="og:title" content="1Helm — Privacy Policy">
+<meta property="og:description" content="1Helm is self-hosted: your workspace lives on your machine. Here's what that means.">
+<meta property="og:url" content="https://1helm.com/privacy">
+<meta property="og:image" content="https://1helm.com/assets/story/og-card.png">
+<meta property="og:image:width" content="2400">
+<meta property="og:image:height" content="1260">
+<meta name="twitter:card" content="summary_large_image">
+<meta name="twitter:title" content="1Helm — Privacy Policy">
+<meta name="twitter:description" content="1Helm is self-hosted: your workspace lives on your machine. Here's what that means.">
+<meta name="twitter:image" content="https://1helm.com/assets/story/og-card.png">
+<link rel="canonical" href="https://1helm.com/privacy">
 <title>1Helm — Privacy Policy</title>
 <link rel="icon" type="image/png" href="/assets/story/app-icon.png">
 <link rel="stylesheet" href="/assets/manual.css">

site/privacy.html

@@ -26,19 +26,22 @@ const REPO = "gitcommit90/1Helm";
 const RELEASE_PAGE = `https://github.com/${REPO}/releases/latest`;
 const RELEASE_CACHE_MS = 10 * 60_000;
 
-let releaseCache = { at: 0, url: "" };
-async function latestDmgUrl() {
-  if (Date.now() - releaseCache.at < RELEASE_CACHE_MS && releaseCache.url) return releaseCache.url;
+let releaseCache = { at: 0, assets: null };
+async function latestReleaseAssets() {
+  if (Date.now() - releaseCache.at < RELEASE_CACHE_MS && releaseCache.assets) return releaseCache.assets;
   const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
     headers: { "user-agent": "1helm-site", accept: "application/vnd.github+json" },
     signal: AbortSignal.timeout(8000),
   });
   if (!response.ok) throw new Error(`GitHub API ${response.status}`);
   const release = await response.json();
-  const asset = (release.assets || []).find((entry) => /-arm64\.dmg$/i.test(String(entry.name || "")));
-  if (!asset?.browser_download_url) throw new Error("no arm64 DMG asset on latest release");
-  releaseCache = { at: Date.now(), url: asset.browser_download_url };
-  return releaseCache.url;
+  releaseCache = { at: Date.now(), assets: release.assets || [] };
+  return releaseCache.assets;
+}
+async function latestAssetUrl(pattern) {
+  const asset = (await latestReleaseAssets()).find((entry) => pattern.test(String(entry.name || "")));
+  if (!asset?.browser_download_url) throw new Error("no matching asset on latest release");
+  return asset.browser_download_url;
 }
 
 const mime = {
@@ -125,7 +128,13 @@ const server = createServer((req, res) => {
     return;
   }
   if (path === "/download/macos") {
-    latestDmgUrl()
+    latestAssetUrl(/-arm64\.dmg$/i)
+      .then((url) => redirect(res, url))
+      .catch(() => redirect(res, RELEASE_PAGE));
+    return;
+  }
+  if (path === "/download/windows") {
+    latestAssetUrl(/-windows-x64-setup\.exe$/i)
       .then((url) => redirect(res, url))
       .catch(() => redirect(res, RELEASE_PAGE));
     return;

site/public/assets/story/og-card.png

@@ -4,6 +4,19 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <meta name="description" content="1Helm turns one computer into your own always-on AI workspace — a crew of resident agents, each with a private computer, durable memory, and real skills, reachable from any device.">
+<meta property="og:type" content="website">
+<meta property="og:site_name" content="1Helm">
+<meta property="og:title" content="1Helm — Intelligence should not be temporary">
+<meta property="og:description" content="Give every job a permanent AI crew member with its own computer, real memory, and skills that compound. Self-hosted, open source, model-agnostic.">
+<meta property="og:url" content="https://1helm.com/">
+<meta property="og:image" content="https://1helm.com/assets/story/og-card.png">
+<meta property="og:image:width" content="2400">
+<meta property="og:image:height" content="1260">
+<meta name="twitter:card" content="summary_large_image">
+<meta name="twitter:title" content="1Helm — Intelligence should not be temporary">
+<meta name="twitter:description" content="Give every job a permanent AI crew member with its own computer, real memory, and skills that compound. Self-hosted, open source, model-agnostic.">
+<meta name="twitter:image" content="https://1helm.com/assets/story/og-card.png">
+<link rel="canonical" href="https://1helm.com/">
 <title>1Helm — Intelligence should not be temporary</title>
 <link rel="icon" type="image/png" href="/assets/story/app-icon.png">
 <link rel="stylesheet" href="/assets/story.css">

site/server.mjs

@@ -50,7 +50,8 @@ export function renderPage(page) {
   <meta property="og:title" content="${esc(title)}">
   <meta property="og:description" content="${esc(page.description)}">
   <meta property="og:url" content="${canonical}">
-  <meta property="og:image" content="https://1helm.com/brand/1helm-sailboat.png">
+  <meta property="og:image" content="https://1helm.com/assets/story/og-card.png">
+  <meta name="twitter:image" content="https://1helm.com/assets/story/og-card.png">
   <meta name="twitter:card" content="summary_large_image">
   <link rel="canonical" href="${canonical}">
   <link rel="icon" href="/brand/1helm-sailboat.png" type="image/png">

site/story.html

@@ -4,6 +4,19 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <meta name="description" content="Terms of service for the 1Helm website and the open-source, self-hosted 1Helm software.">
+<meta property="og:type" content="website">
+<meta property="og:site_name" content="1Helm">
+<meta property="og:title" content="1Helm — Terms of Service">
+<meta property="og:description" content="Terms for the 1Helm website and the open-source, self-hosted 1Helm software.">
+<meta property="og:url" content="https://1helm.com/terms">
+<meta property="og:image" content="https://1helm.com/assets/story/og-card.png">
+<meta property="og:image:width" content="2400">
+<meta property="og:image:height" content="1260">
+<meta name="twitter:card" content="summary_large_image">
+<meta name="twitter:title" content="1Helm — Terms of Service">
+<meta name="twitter:description" content="Terms for the 1Helm website and the open-source, self-hosted 1Helm software.">
+<meta name="twitter:image" content="https://1helm.com/assets/story/og-card.png">
+<link rel="canonical" href="https://1helm.com/terms">
 <title>1Helm — Terms of Service</title>
 <link rel="icon" type="image/png" href="/assets/story/app-icon.png">
 <link rel="stylesheet" href="/assets/manual.css">

site/template.mjs

@@ -27,13 +27,15 @@ test("standalone 1helm.com website serves independent product and documentation
     const privacy = await (await fetch(`${base}/privacy`)).text();
     assert.match(privacy, /build@1helm\.com/);
     assert.match(home, /build@1helm\.com/);
+    assert.match(home, /og:image/);
+    assert.match(home, /assets\/story\/og-card\.png/);
     for (const path of ["/manual", "/terms", "/privacy", "/product", "/manifesto", "/security", "/faq", "/docs", "/docs/install/macos", "/docs/install/linux", "/docs/install/windows-wsl", "/docs/skills", "/docs/verification", "/docs/connections"]) {
       const response = await fetch(base + path); assert.equal(response.status, 200, path);
       assert.match(response.headers.get("content-security-policy") || "", /default-src 'self'/);
     }
     const gettingStarted = await (await fetch(`${base}/docs/getting-started`)).text();
-    assert.match(gettingStarted, /Windows 11 x64 implementation is accepted.*public Setup executable is withheld.*Authenticode/is);
-    assert.doesNotMatch(gettingStarted, /On Windows 11 x64, download the signed Setup executable/i);
+    assert.match(gettingStarted, /On Windows 11 x64, download the signed Setup executable/i);
+    assert.doesNotMatch(gettingStarted, /withheld/i);
     assert.equal((await fetch(`${base}/assets/site.css`)).status, 200);
     const windowsIcon = await fetch(`${base}/icons/icon-sailboat.ico`);
     assert.equal(windowsIcon.status, 200);
@@ -49,7 +51,8 @@ test("standalone 1helm.com website serves independent product and documentation
     assert.equal(download.status, 302);
     assert.match(download.headers.get("location") || "", /1Helm-[\d.]+-arm64\.dmg$|\/releases\/latest$/);
     const windowsDownload = await fetch(`${base}/download/windows`, { redirect: "manual" });
-    assert.equal(windowsDownload.status, 404, "the website never advertises a Windows artifact before a signed build exists");
+    assert.equal(windowsDownload.status, 302);
+    assert.match(windowsDownload.headers.get("location") || "", /-windows-x64-setup\.exe$|\/releases\/latest$/);
   } finally { child.kill("SIGTERM"); await new Promise((resolve) => child.once("exit", resolve)); }
 });