[AbirAbbas]

Summary

The desktop app bundles the engine that make app-sidecar builds. For APP_GOOS=windows that recipe still ran rm -f internal/furrowbin/cache/furrow-*.gz and built with no furrow. That rule came in with #1882, before Windows had a furrow. #1888 pinned the furrow v0.2.0 Windows artifacts and made make build embed them, but this recipe was missed, so the Windows desktop app shipped an engine that cannot move chats.

• app-sidecar now fetches and checks the pinned furrow for every platform before compiling, Windows included. A failed fetch stops the build, under the same rule as Linux and macOS.
• Windows keeps its plain go build, because Defender quarantined the garbled binary. It no longer installs garble it never uses.
• FURROW_ARTIFACT and FURROW_SOURCE still stage an unpinned furrow, on purpose, for developers. The fetcher now prints one line naming what it staged and the pinned version, so that's never silent.
• The Makefile's offline example pointed at ~/.agentfield/bin/furrow, which on dev machines is another product's furrow 0.1.0. That's how a local build ended up carrying 0.1.0. It now names a release artifact.
• docs/testing-anywhere.md dropped the retired CODEAF_CELLS switch and the "Windows users run codeaf in WSL" line.

release.yml already fetches before both Windows release builds; the sidecar recipe was the only shipping path that dropped furrow.

Verification

• make app-sidecar APP_GOOS=windows APP_GOARCH=amd64 downloaded furrow-windows-amd64.exe from the v0.2.0 release. Both the cached artifact and the inflated staged archive hash to the pin's 327cc313….
• On real Windows: with a fresh state root in Windows temp, the built codeaf-x86_64-pc-windows-msvc.exe identity show exits 0. It wrote out bin/furrow-0.2.0-e5e27527772c.exe (sha256 matches the pin), and that file runs and prints furrow 0.2.0. The scratch root was removed.
• New tests (each failed before the change):
  • TestW1WindowsSidecarFetchesBeforeBuilding drives the real make recipe against an offline toolchain fixture. It checks that the fetch runs before the build, and that a fetch failure stops the build with its message.
  • TestW3BuiltArtifactAnnouncesOverride checks the override is staged and announced exactly once.
• Existing tests: all 18 internal/furrowbin and 13 fetch tests pass by name with the pinned furrow. Both new tests also pass under -race. go vet is clean.

---

🤖 Generated with Claude Code

[AbirAbbas]

Gate (run 40433301860): the touched packages (internal/furrowbin/cmd/fetch) pass. The light gate's only failure is the pre-existing go vet lostcancel error at internal/factory/run/chatstage.go:402, which #1988 fixes.