Finish multi-platform release restructuring (previous commit was incomplete)

git add silently staged nothing from the previous attempt because one
pathspec in that batch (scripts/release/repository, already moved) no
longer existed — only the .gitignore-adjacent renames landed. This
commit adds what was actually meant to go in:

- core/updater.py: releases/download/updates-<platform>/ instead of a
  single shared updates/ tag.
- labui.spec: bundles root.json from this platform's own tree.
- scripts/release/repo_init.py, repo_release.py: auto-detect platform,
  operate inside scripts/release/<platform>/.
- .gitignore: per-platform ignore rules (previous commit only carried
  the file renames, not this).
- docs/building.md, scripts/release/README.md: rewritten for the
  per-platform flow.
- Also picks up pre-existing local TUF re-signing (new snapshot/
  timestamp signatures, bumped expiry/version) that was sitting
  uncommitted before this restructuring started.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

10 files changed, 255 insertions, 110 deletions

diff --git a/.gitignore b/.gitignore
index 838f2ca..efc3ac0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,8 +8,14 @@ __pycache__/
 build/
 dist/
 
-# TUF release keystore (private signing keys)
-# generated repository/ is republished to GitHub Releases, not tracked here
+# TUF release keystore (private signing keys), one tree per platform
+# (scripts/release/win/, scripts/release/linux/, scripts/release/mac/).
+# Also covers the pre-migration flat layout (scripts/release/keystore/) —
+# do not remove the flat rules below until that directory is confirmed
+# migrated into scripts/release/win/.
+scripts/release/*/keystore/
+scripts/release/*/repository/
+scripts/release/*/.tufup-repo-config
 scripts/release/keystore/
 scripts/release/repository/
 scripts/release/.tufup-repo-config
diff --git a/core/updater.py b/core/updater.py
index 471ef0b..bbd1bf9 100644
--- a/core/updater.py
+++ b/core/updater.py
@@ -7,11 +7,16 @@ is_frozen()); calling check_for_update()/apply_update() from a
 `python main.py` dev run raises, since there's no installed bundle for
 tufup to update.
 
-Update metadata/targets are hosted on this repo's "updates" GitHub Release
-— a fixed tag that never changes between app versions, unlike a normal
-per-version release tag, because TUF's top-level metadata (timestamp.json,
-snapshot.json, ...) must live at a stable URL the client always checks.
-See scripts/release/README.md for the publishing side.
+Update metadata/targets are hosted on this repo's "updates-<platform>"
+GitHub Release — a fixed tag per platform (never changes between app
+versions of that platform), because TUF's top-level metadata
+(timestamp.json, snapshot.json, ...) must live at a stable URL the client
+always checks. Separate tags per platform (not one shared "updates" tag)
+because a Windows build and a Linux build of the same app version are
+different byte-for-byte archives — TUF metadata filenames aren't
+platform-prefixed, so they can't share one release without one platform's
+metadata silently overwriting the other's. See scripts/release/README.md
+for the publishing side.
 """
 
 import sys
@@ -23,7 +28,21 @@ from core.version import __version__ as CURRENT_VERSION
 
 APP_NAME = "labui"
 
-_RELEASE_BASE_URL  = "https://github.com/c-kolset/labUI-python/releases/download/updates/"
+
+def _platform_key() -> str:
+    """win / mac / linux — must match scripts/release/<key>/ on the
+    publishing side and the "updates-<key>" release tag."""
+    if sys.platform.startswith("win"):
+        return "win"
+    if sys.platform == "darwin":
+        return "mac"
+    return "linux"
+
+
+_RELEASE_BASE_URL = (
+    f"https://github.com/c-kolset/labUI-python/releases/download/"
+    f"updates-{_platform_key()}/"
+)
 METADATA_BASE_URL  = _RELEASE_BASE_URL
 TARGET_BASE_URL    = _RELEASE_BASE_URL
 
diff --git a/docs/building.md b/docs/building.md
index e20bcd3..bdf9ed0 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -2,6 +2,8 @@
 
 Produces a standalone `dist/LabUI/` directory (onedir, not onefile — required for tufup's per-file update patching).
 
+PyInstaller does not cross-compile — build on the same OS you're targeting. For Windows, build on Windows. For Linux, build on Linux (WSL2 works fine if your day-to-day machine is Windows — it produces a real Linux ELF binary, no cross-compilation involved). Each OS gets its own independent TUF signing setup (see below) and its own release tag, since a Windows build and a Linux build of the same version are different byte-for-byte archives.
+
 ## Prerequisites
 
 Python 3.10+ and the dev requirements:
@@ -13,26 +15,26 @@ pip install -r requirements-dev.txt
 
 `requirements-dev.txt` adds PyInstaller and tufup on top of the runtime deps.
 
-## First-time setup — TUF repository
+## First-time setup — TUF repository (once per platform)
 
-Skip this if the `scripts/release/keystore/` directory already exists (i.e. someone else on the team has already initialised the repo and shared the keystore out-of-band).
+Skip this for a given platform if `scripts/release/<platform>/keystore/` already exists (i.e. someone else on the team has already initialised that platform's repo and shared the keystore out-of-band). `<platform>` is `win`, `linux`, or `mac` — `repo_init.py` picks it automatically based on the OS you run it on.
 
 ```bash
 python scripts/release/repo_init.py
 ```
 
-This generates:
+This generates, under `scripts/release/<platform>/`:
 
-- `scripts/release/keystore/` — private + public keys for the TUF root/targets/snapshot/timestamp roles. **Back this up somewhere private outside the repo. Losing the root key means existing installs can never receive trusted updates.**
-- `scripts/release/repository/` — initial signed TUF metadata, including `root.json`.
+- `keystore/` — private + public keys for the TUF root/targets/snapshot/timestamp roles for *this platform*. **Back this up somewhere private outside the repo. Losing a platform's root key means that platform's existing installs can never receive trusted updates again** (other platforms are unaffected — keys are fully independent per platform).
+- `repository/` — initial signed TUF metadata for this platform, including `root.json`.
 
-After init, build once more so the freshly-generated `root.json` gets bundled into the app (the `.spec` file only includes it if it already exists):
+After init, build once more so the freshly-generated `root.json` gets bundled into the app (the `.spec` file only includes it if it already exists, and reads it from this same platform's tree):
 
 ```bash
 pyinstaller labui.spec
 ```
 
-## Building a release
+## Building a release (repeat per platform, on that platform)
 
 ### 1. Bump the version
 
@@ -42,7 +44,7 @@ Edit `core/version.py`:
 __version__ = "1.2.3"
 ```
 
-This single value is read by the auto-updater at runtime (`core/updater.py`) and by the release script when signing the new target.
+This single value is read by the auto-updater at runtime (`core/updater.py`) and by the release script when signing the new target. Use the same version number across all platforms for one release, even though each is built/signed/published as a separate step.
 
 ### 2. Build the executable
 
@@ -50,11 +52,11 @@ This single value is read by the auto-updater at runtime (`core/updater.py`) and
 pyinstaller labui.spec
 ```
 
-Output: `dist/LabUI/LabUI` (Linux/macOS) or `dist/LabUI/LabUI.exe` (Windows).
+Output: `dist/LabUI/LabUI` (Linux/macOS) or `dist/LabUI/LabUI.exe` (Windows) — whichever OS you're currently running on.
 
 The build bundles:
 - `ui/style_dark.qss` and `ui/style_light.qss`
-- `scripts/release/repository/metadata/root.json` (if present — enables trusted updates on fresh installs)
+- `scripts/release/<platform>/repository/metadata/root.json` (if present — enables trusted updates on fresh installs; `<platform>` auto-detected from the OS running PyInstaller)
 
 Plugins are **not bundled**. They are installed at runtime by the user via **Settings → Plugins → Install Plugin…**. Installed plugins and their enabled state live in `~/.labui/plugins/`. Plugin pip dependencies (for machines without Python) land in `~/.labui/plugin_packages/`, which is added to `sys.path` at startup.
 
@@ -64,30 +66,32 @@ Plugins are **not bundled**. They are installed at runtime by the user via **Set
 python scripts/release/repo_release.py
 ```
 
-Creates and signs `scripts/release/repository/targets/labui-<version>.tar.gz` and updates the TUF metadata files in `scripts/release/repository/metadata/`.
+Creates and signs `scripts/release/<platform>/repository/targets/labui-<version>.tar.gz` and updates the TUF metadata files in `scripts/release/<platform>/repository/metadata/`.
 
 ### 4. Publish to GitHub
 
-Upload every file from `scripts/release/repository/metadata/` and `scripts/release/repository/targets/` to the GitHub Release tagged **`updates`** (fixed tag — not a version tag), replacing any same-named files already there.
+Upload every file from `scripts/release/<platform>/repository/metadata/` and `scripts/release/<platform>/repository/targets/` to the GitHub Release tagged **`updates-<platform>`** (e.g. `updates-win`, `updates-linux` — fixed tag per platform, not a version tag), replacing any same-named files already there.
+
+The app's updater always points at `.../releases/download/updates-<platform>/` (platform auto-detected at runtime by `core.updater._platform_key()`), so each platform's tag must stay constant across versions. Don't share one tag across platforms — TUF metadata filenames (`root.json`, `timestamp.json`, ...) aren't platform-prefixed, so one platform's publish would silently overwrite the other's trust root.
 
-The app's updater always points at `.../releases/download/updates/`, so the tag must stay constant across versions.
+A bare `LabUI.exe` does **not** belong on the `updates-<platform>` release — the updater only looks for the TUF metadata + target archive described above; a loose exe there does nothing.
 
-Optionally create a separate human-facing release with a changelog under a version tag (e.g. `v1.2.3`).
+Optionally create a separate human-facing release with a changelog under a version tag (e.g. `v1.2.3`) for people downloading the app for the first time (TUF only handles *updating* an already-installed copy). Since the build is onedir, zip the whole `dist/LabUI/` folder for that release rather than attaching the bare exe — the exe alone won't run without its sibling files. If you support multiple platforms, attach one zip per platform to that same version-tagged release.
 
 ### 5. Verify
 
-Launch a previous installed version → Settings → Check for Updates → confirm it finds and applies the new version.
+Launch a previous installed version of this platform → Settings → Check for Updates → confirm it finds and applies the new version.
 
 ## Re-signing expired metadata
 
-TUF metadata expires even with no new release (`root`: 365 days, others: 90 days). If metadata goes stale before the next release, clients reject it. Re-sign:
+TUF metadata expires even with no new release (`root`: 365 days, others: 90 days) — independently per platform. If metadata goes stale before the next release for a given platform, that platform's clients reject it. Re-sign:
 
 ```bash
-python -m tufup sign snapshot scripts/release/keystore
-python -m tufup sign timestamp scripts/release/keystore
+python -m tufup sign snapshot scripts/release/<platform>/keystore
+python -m tufup sign timestamp scripts/release/<platform>/keystore
 ```
 
-Run from the repo root. Re-upload the resulting files to the `updates` release.
+Run from the repo root, substituting the actual platform directory. Re-upload the resulting files to that platform's `updates-<platform>` release.
 
 ## What's bundled vs. external
 
@@ -98,8 +102,8 @@ Run from the repo root. Re-upload the resulting files to the `updates` release.
 | QSS theme files | Yes | copied from `ui/` |
 | Plugins | No | installed by users into `~/.labui/plugins/` at runtime |
 | Plugin pip deps | No | installed into `~/.labui/plugin_packages/` or vendored inside plugin zip |
-| `root.json` | Yes (if present) | TUF trust bootstrap |
-| `nidaqmx` | No | optional; NI runtime must be installed separately |
+| `root.json` | Yes (if present) | TUF trust bootstrap, this platform's own copy |
+| `nidaqmx` | No | optional; NI runtime is Windows-only, must be installed separately |
 | `opencv-python` | No | optional; only needed if a plugin requires it (vendor it in the plugin zip) |
 
 ## Troubleshooting
@@ -110,4 +114,6 @@ Run from the repo root. Re-upload the resulting files to the `updates` release.
 
 **Plugin dependency not importable after pip install** — the user may need to restart the app so `~/.labui/plugin_packages/` is injected into `sys.path` (this happens in `main.py` at startup).
 
-**`root.json` not bundled** — run `repo_init.py` first (see First-time setup), then rebuild.
+**`root.json` not bundled** — run `repo_init.py` first (see First-time setup), then rebuild, on this same platform.
+
+**Updates work on one platform but not another** — check each platform published to its own `updates-<platform>` tag, not a shared `updates` tag, and that `core.updater._platform_key()`'s mapping (`win`/`mac`/else-`linux`) matches the directory names under `scripts/release/`.
diff --git a/labui.spec b/labui.spec
index 8468909..71d50dd 100644
--- a/labui.spec
+++ b/labui.spec
@@ -17,13 +17,24 @@ root_dir = Path(SPECPATH)
 # root.json is generated by scripts/release/repo_init.py — bundle it once it
 # exists so a fresh install can bootstrap tufup trust without an insecure
 # first fetch. Skip silently before that's ever been run (e.g. first build).
+# Read from this platform's own repo tree (scripts/release/<platform>/) —
+# must match core.updater._platform_key()'s mapping, since a build only ever
+# bundles its own platform's root.json.
+def _platform_key():
+    if sys.platform.startswith("win"):
+        return "win"
+    if sys.platform == "darwin":
+        return "mac"
+    return "linux"
+
 datas = [
     (str(root_dir / "ui" / "style_dark.qss"), "ui"),
     (str(root_dir / "ui" / "style_light.qss"), "ui"),
     (str(root_dir / "ui" / "style.qss"), "ui"),
     (str(root_dir / "plugins"), "plugins"),
 ]
-_root_json = root_dir / "scripts" / "release" / "repository" / "metadata" / "root.json"
+_root_json = (root_dir / "scripts" / "release" / _platform_key()
+              / "repository" / "metadata" / "root.json")
 if _root_json.exists():
     datas.append((str(_root_json), "repository/metadata"))
 
diff --git a/scripts/release/README.md b/scripts/release/README.md
index 54c9086..9d8e85f 100644
--- a/scripts/release/README.md
+++ b/scripts/release/README.md
@@ -1,61 +1,97 @@
-# Release process (manual, local signing)
+# Release process (manual, local signing, per platform)
 
-All TUF signing keys stay on your machine, in `./keystore` (gitignored — never
-commit it). Nothing here touches CI or GitHub Secrets.
+All TUF signing keys stay on your machine, one keystore per platform, in
+`./<platform>/keystore` (gitignored — never commit it). Nothing here touches
+CI or GitHub Secrets — Linux/macOS builds and signing should also happen
+locally (a Linux build machine, or WSL2 on Windows works fine — PyInstaller
+doesn't cross-compile, so you must actually run the build on the target OS).
 
-## One-time setup
+`<platform>` is `win`, `mac`, or `linux` — whichever `python` is currently
+running on (`core.updater._platform_key()` / the matching helper in
+`repo_init.py`/`repo_release.py` decide this automatically; you never pass
+it explicitly). Each platform gets a fully independent tree:
+```
+scripts/release/
+  win/{keystore,repository}/
+  linux/{keystore,repository}/
+  mac/{keystore,repository}/
+```
+Why fully separate rather than shared: a Windows build and a Linux build of
+the same app version are different byte-for-byte archives, and TUF's
+metadata filenames (`root.json`, `timestamp.json`, ...) aren't
+platform-prefixed — sharing one repo/release between platforms means one
+platform's publish silently overwrites the other's trust root and metadata.
+
+## One-time setup (repeat once per platform, on that platform)
 
 ```
 pip install -r requirements-dev.txt
 python scripts/release/repo_init.py
 ```
 
-Generates `scripts/release/keystore/` (private + public keys for the
-root/targets/snapshot/timestamp TUF roles) and `scripts/release/repository/`
-(initial signed metadata, including `root.json`).
+Generates `scripts/release/<platform>/keystore/` (private + public keys for
+the root/targets/snapshot/timestamp TUF roles) and
+`scripts/release/<platform>/repository/` (initial signed metadata, including
+`root.json`).
 
-**Back up `keystore/` immediately, somewhere private and durable outside this
-repo.** Losing the root key means you can never publish a trusted update to
-existing installs again — they'd all need a fresh, non-updating reinstall.
+**Back up `<platform>/keystore/` immediately, somewhere private and durable
+outside this repo — one backup per platform.** Losing a platform's root key
+means you can never publish a trusted update to that platform's existing
+installs again — they'd all need a fresh, non-updating reinstall. Losing one
+platform's key doesn't affect the others (that's the point of keeping them
+separate).
 
 Rebuild once more (`pyinstaller labui.spec`) after this step, so the
 freshly-generated `root.json` gets bundled into the app (see the `.spec`
-file's `_root_json` check — it only bundles the file if it already exists).
+file's `_root_json` check — it only bundles the file if it already exists,
+and it reads from *this platform's* tree).
 
-## Every release
+## Every release (repeat once per platform, on that platform)
 
-1. Bump `__version__` in `core/version.py`.
-2. `pyinstaller labui.spec` → produces `dist/LabUI/`.
+1. Bump `__version__` in `core/version.py` (same version number across all
+   platforms for a given release, even though each is signed/published
+   separately).
+2. `pyinstaller labui.spec` → produces `dist/LabUI/` for *this* OS.
 3. `python scripts/release/repo_release.py` → creates+signs
-   `scripts/release/repository/targets/labui-<version>.tar.gz` and updates
-   the metadata files in `scripts/release/repository/metadata/`.
-4. Create (first time) or reuse the GitHub Release tagged **`updates`** on
-   this repo, and upload every file from `scripts/release/repository/metadata/`
-   and `scripts/release/repository/targets/` as release assets, **replacing**
-   any same-named files already there.
-   - This tag is fixed on purpose — the app's `metadata_base_url` always
-     points at `https://github.com/<owner>/<repo>/releases/download/updates/`.
+   `scripts/release/<platform>/repository/targets/labui-<version>.tar.gz`
+   and updates the metadata files in
+   `scripts/release/<platform>/repository/metadata/`.
+4. Create (first time) or reuse the GitHub Release tagged
+   **`updates-<platform>`** (e.g. `updates-win`, `updates-linux`) on this
+   repo, and upload every file from
+   `scripts/release/<platform>/repository/metadata/` and
+   `scripts/release/<platform>/repository/targets/` as release assets,
+   **replacing** any same-named files already there.
+   - Each platform's tag is fixed on purpose — the app's
+     `metadata_base_url` (computed by `core.updater._platform_key()`)
+     always points at
+     `https://github.com/<owner>/<repo>/releases/download/updates-<platform>/`.
      A normal per-version-tagged release would give every version a
      different URL, which breaks TUF's requirement that top-level metadata
-     (`timestamp.json`, `snapshot.json`, ...) live at a stable location.
+     live at a stable location — and a *shared* tag across platforms would
+     break the platform-isolation described above.
    - Cut a normal, separately-tagged human-facing release too if you want a
-     changelog/download page — this doesn't have to be the same release.
-5. Test: launch a previous installed version, Settings → Check for Updates,
-   confirm it finds and applies the new version.
+     changelog/download page (e.g. `v1.2.3`, one release with per-platform
+     zip assets attached) — this doesn't have to be the same release as the
+     `updates-*` ones, and normally shouldn't be (see `docs/building.md`).
+5. Test: launch a previous installed version of *this platform*,
+   Settings → Check for Updates, confirm it finds and applies the new
+   version.
 
 ## Re-signing without a new release
 
 Metadata expires even if nothing changed (`expiration_days` in
-`repo_init.py`: root 365 days, targets/snapshot/timestamp 90 days). If you
-haven't shipped a release before targets/snapshot/timestamp expire, clients
-will start rejecting the metadata as stale. Re-sign with:
+`repo_init.py`: root 365 days, targets/snapshot/timestamp 90 days) —
+per platform, independently. If you haven't shipped a release for a given
+platform before its targets/snapshot/timestamp expire, that platform's
+clients will start rejecting the metadata as stale. Re-sign:
 
 ```
-python -m tufup sign snapshot scripts/release/keystore
-python -m tufup sign timestamp scripts/release/keystore
+python -m tufup sign snapshot scripts/release/<platform>/keystore
+python -m tufup sign timestamp scripts/release/<platform>/keystore
 ```
 
-(run from the repo root; adjust the key directory path if you invoke this
-from elsewhere) and re-upload the resulting files to the `updates` release.
-Set a calendar reminder — there is no automation for this on purpose (manual
-signing was a deliberate choice, not an oversight).
+(run from the repo root; substitute the actual platform directory) and
+re-upload the resulting files to that platform's `updates-<platform>`
+release. Set a calendar reminder per platform — there is no automation for
+this on purpose (manual signing was a deliberate choice, not an oversight).
diff --git a/scripts/release/repo_init.py b/scripts/release/repo_init.py
index ccbfe17..c0360c0 100644
--- a/scripts/release/repo_init.py
+++ b/scripts/release/repo_init.py
@@ -1,28 +1,55 @@
 """
 scripts/release/repo_init.py
 
-Run ONCE, ever, by the maintainer, locally. Generates the TUF signing keys
-and the initial repository metadata (including root.json, which later gets
-bundled into the app via labui.spec).
+Run ONCE PER PLATFORM, by the maintainer, locally, on a machine running that
+platform (no cross-compiling — build and sign Windows releases on Windows,
+Linux releases on Linux/WSL2, etc.). Generates that platform's TUF signing
+keys and initial repository metadata (including root.json, which later gets
+bundled into that platform's build via labui.spec).
 
-Running this again after the repo already exists is safe (tufup skips
-re-creating keys/roles that already exist) but there is normally no reason
-to run it more than once per project.
+Every platform gets its own keystore/repository tree, under
+scripts/release/<platform>/ — Windows and Linux builds of the same version
+are different byte-for-byte archives, and TUF's metadata filenames
+(root.json, timestamp.json, ...) aren't platform-prefixed, so they can't
+share one repo/release without one platform silently overwriting the
+other's trust root and metadata.
 
-Keys land in ./keystore — never commit that directory (already gitignored).
-Back it up somewhere safe and private; losing the root key means you can
-never publish another trusted update to existing installs.
+Running this again after a platform's repo already exists is safe (tufup
+skips re-creating keys/roles that already exist) but there is normally no
+reason to run it more than once per platform.
+
+Keys land in ./<platform>/keystore — never commit that directory (already
+gitignored). Back it up somewhere safe and private, once per platform;
+losing a platform's root key means you can never publish another trusted
+update to that platform's existing installs.
 """
 
 import os
+import sys
 from pathlib import Path
 
 from tufup.repo import Repository, RolesDict
 
-# Run from this script's own directory — tufup's config file (.tufup-repo-config)
-# and all repo_dir/keys_dir paths are resolved relative to the current working
-# directory, so invocation location must be consistent every time.
-os.chdir(Path(__file__).resolve().parent)
+
+def _platform_key() -> str:
+    """win / mac / linux — must match core.updater._platform_key() and the
+    "updates-<key>" release tag on the publishing side."""
+    if sys.platform.startswith("win"):
+        return "win"
+    if sys.platform == "darwin":
+        return "mac"
+    return "linux"
+
+
+PLATFORM = _platform_key()
+
+# Run from this script's own platform subdirectory — tufup's config file
+# (.tufup-repo-config) and all repo_dir/keys_dir paths are resolved relative
+# to the current working directory, so invocation location must be
+# consistent every time.
+_PLATFORM_DIR = Path(__file__).resolve().parent / PLATFORM
+_PLATFORM_DIR.mkdir(parents=True, exist_ok=True)
+os.chdir(_PLATFORM_DIR)
 
 APP_NAME = "labui"
 
@@ -49,8 +76,10 @@ def main():
     )
     repo.initialize()
     repo.save_config()
-    print(f"Initialized tufup repo for '{APP_NAME}' in ./repository, keys in ./keystore")
-    print("Back up ./keystore now, somewhere private and durable. It is gitignored on purpose.")
+    print(f"Initialized tufup repo for '{APP_NAME}' ({PLATFORM}) in "
+          f"{_PLATFORM_DIR / 'repository'}, keys in {_PLATFORM_DIR / 'keystore'}")
+    print(f"Back up {_PLATFORM_DIR / 'keystore'} now, somewhere private and "
+          f"durable. It is gitignored on purpose.")
 
 
 if __name__ == "__main__":
diff --git a/scripts/release/repo_release.py b/scripts/release/repo_release.py
index d50e458..7e4c382 100644
--- a/scripts/release/repo_release.py
+++ b/scripts/release/repo_release.py
@@ -1,18 +1,23 @@
 """
 scripts/release/repo_release.py
 
-Run after every `pyinstaller labui.spec` build, from anywhere (paths are
-made absolute below before the working directory changes). Packages the
-freshly built dist/LabUI bundle as a new signed tufup target.
+Run after every `pyinstaller labui.spec` build, on the same platform that
+build was produced on (no cross-compiling — this packages whatever
+dist/LabUI/ currently contains, which is only correct for the OS the build
+just ran on). Packages the freshly built dist/LabUI bundle as a new signed
+tufup target, in that platform's own repo tree.
 
 Prerequisites:
-  - repo_init.py has been run once already (./repository and ./keystore exist)
+  - repo_init.py has been run once already for this platform
+    (./<platform>/repository and ./<platform>/keystore exist)
   - core/version.py has been bumped to the new version
-  - dist/LabUI/ exists (pyinstaller labui.spec has just been run)
+  - dist/LabUI/ exists (pyinstaller labui.spec has just been run, on this
+    same machine/OS)
 
 After this completes, see README.md in this directory for how to publish
-the updated ./repository/metadata and ./repository/targets files to the
-"updates" GitHub Release.
+the updated ./<platform>/repository/metadata and
+./<platform>/repository/targets files to the "updates-<platform>" GitHub
+Release.
 """
 
 import os
@@ -23,8 +28,21 @@ _THIS_DIR   = Path(__file__).resolve().parent
 _REPO_ROOT  = _THIS_DIR.parent.parent
 _DIST_DIR   = _REPO_ROOT / "dist" / "LabUI"
 
+
+def _platform_key() -> str:
+    """win / mac / linux — must match core.updater._platform_key() and the
+    "updates-<key>" release tag on the publishing side."""
+    if sys.platform.startswith("win"):
+        return "win"
+    if sys.platform == "darwin":
+        return "mac"
+    return "linux"
+
+
+PLATFORM = _platform_key()
+
 # Import core.version before changing cwd — needs the repo root on sys.path,
-# which won't be true anymore once we chdir into scripts/release below.
+# which won't be true anymore once we chdir into scripts/release/<platform>.
 sys.path.insert(0, str(_REPO_ROOT))
 from core.version import __version__ as APP_VERSION
 
@@ -32,19 +50,25 @@ from tufup.repo import Repository
 
 # tufup's config file / relative repo_dir / keys_dir all resolve against cwd
 # (same reasoning as repo_init.py) — pin it here too, for the same reason.
-os.chdir(_THIS_DIR)
+_PLATFORM_DIR = _THIS_DIR / PLATFORM
+os.chdir(_PLATFORM_DIR)
 
 
 def main():
     if not _DIST_DIR.is_dir():
         raise SystemExit(
             f"{_DIST_DIR} not found — run `pyinstaller labui.spec` from the "
-            f"repo root first."
+            f"repo root first, on this same machine/OS."
+        )
+    if not (_PLATFORM_DIR / "repository").is_dir():
+        raise SystemExit(
+            f"{_PLATFORM_DIR / 'repository'} not found — run "
+            f"`python repo_init.py` once for this platform first."
         )
 
     repo = Repository.from_config()
 
-    changelog = input(f"One-line changelog for v{APP_VERSION} (optional): ").strip()
+    changelog = input(f"One-line changelog for v{APP_VERSION} ({PLATFORM}, optional): ").strip()
     custom_metadata = {"changelog": changelog} if changelog else None
 
     repo.add_bundle(
@@ -55,9 +79,10 @@ def main():
     )
     repo.publish_changes(private_key_dirs=[Path("keystore")])
 
-    print(f"Signed and published v{APP_VERSION} to ./repository")
-    print("Next: upload ./repository/metadata/* and ./repository/targets/* "
-          "to the 'updates' GitHub Release — see README.md in this directory.")
+    print(f"Signed and published v{APP_VERSION} ({PLATFORM}) to {_PLATFORM_DIR / 'repository'}")
+    print(f"Next: upload {_PLATFORM_DIR / 'repository' / 'metadata'}/* and "
+          f"{_PLATFORM_DIR / 'repository' / 'targets'}/* to the "
+          f"'updates-{PLATFORM}' GitHub Release — see README.md in this directory.")
 
 
 if __name__ == "__main__":
diff --git a/scripts/release/win/repository/metadata/snapshot.json b/scripts/release/win/repository/metadata/snapshot.json
index 03821d1..7f786ce 100755
--- a/scripts/release/win/repository/metadata/snapshot.json
+++ b/scripts/release/win/repository/metadata/snapshot.json
@@ -1,19 +1,19 @@
 {
  "signatures": [
   {
-   "keyid": "40e5301cd4b92e4a9c2e63dcca99ffa4a5627c25ac6c254f272bb52c9a076cfc",
-   "sig": "bd89d38c63ddee6537276a13657a2716a1a88346421a8d51db9fa8c12b9dc6b0db57a48bbab616930b6aaaa91c4a12a54909cd9722e07b23632638d68bd08307"
+   "keyid": "11ff37b04d2667afcf5fb55111a279eff51bced328b4bfa5941c6a3fb711b9c8",
+   "sig": "770524d7bd070160a6c5313b26d37e02a28155485f07850edb186173c5dccc3d9c3299756d28db91f6b5bc34e0459059c15d0a6de64ed5616f28bf326e78a70d"
   }
  ],
  "signed": {
   "_type": "snapshot",
-  "expires": "2026-10-30T23:55:23Z",
+  "expires": "2026-11-09T16:56:54Z",
   "meta": {
    "targets.json": {
-    "version": 1
+    "version": 2
    }
   },
   "spec_version": "1.0.31",
-  "version": 1
+  "version": 2
  }
 }
\ No newline at end of file
diff --git a/scripts/release/win/repository/metadata/targets.json b/scripts/release/win/repository/metadata/targets.json
index 6296ebe..9d3a6e3 100755
--- a/scripts/release/win/repository/metadata/targets.json
+++ b/scripts/release/win/repository/metadata/targets.json
@@ -1,15 +1,28 @@
 {
  "signatures": [
   {
-   "keyid": "998b28525eec351c6cdd16d6da3854876e84ab450595feac782ae83d3a8226d6",
-   "sig": "88ebf0eac3bea958b3d5d99e713a2af1a8e6d230c414bca1b22f1bf64ce2a8734b3db5eaa80dcc9fdd31c1954864af2828c122bf6d4354b1a06136e478e6d00d"
+   "keyid": "c62514af706a204d4361859fcd0d329fafaafa8bddf220f6c7ded062bb89dae3",
+   "sig": "d1cfb13f05faf542312c6a1f172571524a397883128c8c9b50ddd684918060272885eebb017972b09ca1a8cac0ad13ddd85b6b2e6f901ff9681416f86a101201"
   }
  ],
  "signed": {
   "_type": "targets",
-  "expires": "2026-10-30T23:55:23Z",
+  "expires": "2026-11-09T16:56:54Z",
   "spec_version": "1.0.31",
-  "targets": {},
-  "version": 1
+  "targets": {
+   "labui-0.0.1.tar.gz": {
+    "custom": {
+     "tufup": {
+      "required": false
+     },
+     "user": null
+    },
+    "hashes": {
+     "sha256": "af8aca1e68c7b6956e39784a91c7e4be21e9413b0c884da90aa58aa1e6a0609a"
+    },
+    "length": 98530091
+   }
+  },
+  "version": 2
  }
 }
\ No newline at end of file
diff --git a/scripts/release/win/repository/metadata/timestamp.json b/scripts/release/win/repository/metadata/timestamp.json
index 12227b6..ac8d542 100755
--- a/scripts/release/win/repository/metadata/timestamp.json
+++ b/scripts/release/win/repository/metadata/timestamp.json
@@ -1,19 +1,19 @@
 {
  "signatures": [
   {
-   "keyid": "4edf46a4cf08f9b2c59cbe9a435024a8498ce68cc63208f1fbb8b69e74768d42",
-   "sig": "b11ee59ed85d21b52d25e676a98232c9d63813ac5236493c11d47264065647933f1c28bc9748f8c880174a3ab3bcb27f6786c1c4a596ef80b70fc11b40f9f002"
+   "keyid": "f3be485915439ccd39ed098391dc89529286dfa7e4aa131585848df1ba2ce589",
+   "sig": "31a93117aeacbd53c276f7520f4ac6f7fce8427977e11e50dffb71062dc4c92cc3fe7364071067ab948c1686116af73afa05795af3c74bd603a60564b49a340d"
   }
  ],
  "signed": {
   "_type": "timestamp",
-  "expires": "2026-10-30T23:55:23Z",
+  "expires": "2026-11-09T16:56:54Z",
   "meta": {
    "snapshot.json": {
-    "version": 1
+    "version": 2
    }
   },
   "spec_version": "1.0.31",
-  "version": 1
+  "version": 2
  }
 }
\ No newline at end of file