14 files changed, 485 insertions, 420 deletions

diff --git a/AGENTS.md b/AGENTS.md
index cd5c71b..ab794f8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -85,10 +85,12 @@
 - The embedded fonts have no suit or arrow glyphs. Draw card suits as shapes
   and use plain words for navigation; a glyph that is not in Open Sans or Hack
   renders as tofu.
-- `scripts/publish.sh` builds the GUI with `gui-release` and renders the
-  installers with the published SHA-256. Installers verify the hash and install
-  per-user; never install system-wide or skip the check. The Windows installer
-  waits for Enter before closing; `-NoPause` is only for automation.
+- `scripts/publish.sh` builds the GUI with `gui-release`; the installers are
+  stable site files (`web/install.sh`, `web/install.ps1`) that read
+  `web/latest.php` for the newest build and its SHA-256. Never regenerate or
+  version the installers per release, install system-wide, or skip the hash
+  check. The Windows installer waits for Enter before closing; `-NoPause` is
+  only for automation.
 - Windows renders through wgpu on Direct3D 12, including the WARP software
   adapter, so a machine with only OpenGL 1.1 (VM, Remote Desktop) still runs.
   Linux keeps the smaller glow renderer. Do not assume OpenGL 2.0 on Windows.
diff --git a/Cargo.toml b/Cargo.toml
index 8897f9d..16ed8c6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["gui"]
 
 [package]
 name = "zagan-bet"
-version = "4.3.1"
+version = "4.4.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 
diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index a322057..c0370a0 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -169,13 +169,13 @@ frame rate on integrated graphics and the Windows interactive pass.
 
 - `publish.sh` builds the GUI with the `gui-release` profile for Linux and
   Windows and names the app `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
-- It renders a bash installer and a PowerShell installer next to each app.
-  Both embed the app's SHA-256, verify the file (or download it), install
-  per-user and add a launcher: `.desktop` plus an SVG icon on Linux, a
-  Start-menu shortcut on Windows. Templates live in `scripts/installers/`;
-  `render-installer.py` fills them in.
+- The installers are stable, unversioned site files: `install.sh` and
+  `install.ps1` read `latest.php`, pick the newest build for the machine,
+  verify its SHA-256, install per-user and add a launcher (`.desktop` plus an
+  SVG icon on Linux, a Start-menu shortcut on Windows). Publishing a new
+  version does not regenerate them.
 - The download page scans `bin/gui`, `bin/client` and `bin/server`, lists
-  apps, installers, clients and servers, and includes every file in the
+  apps, stable installers, clients and servers, and includes every file in the
   `sha256sum` block. A Source section links the public git repository
   (<https://git.2137697.xyz/zagan-bet.git>) for the GPL corresponding source.
   `deploy.sh` verifies every artifact kind over the public URL.
diff --git a/docs/TESTING.md b/docs/TESTING.md
index c32ac22..09ceb82 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -272,14 +272,16 @@ terminal client; a saved login from one signs in the other.
 1. Set the version in `Cargo.toml` and `gui/Cargo.toml` (same MAJOR.MINOR),
    run `cargo test --workspace`, and commit. `publish.sh` refuses a dirty tree
    because the site links the committed git history as the GPL source.
-2. `./scripts/publish.sh` (add `DEST=` and `URL_BASE=` to stage elsewhere). It
-   builds the GUI with `gui-release`, the terminal clients and servers, and
-   renders the bash/PowerShell installers with each app's SHA-256.
+2. `./scripts/publish.sh` (add `DEST=` to stage elsewhere). It builds the GUI
+   with `gui-release` and the terminal clients and servers. The installers are
+   stable site files and are not regenerated.
 3. `php -S 127.0.0.1:8899 -t <staging>` and
    `./scripts/deploy.sh <staging> http://127.0.0.1:8899/` to upload and verify
-   every app, installer, client and server against the page's checksums.
-4. On a clean user account: download an app with its installer, run the
-   installer, and launch the new menu entry. The installer must refuse a
-   corrupted download.
+   every app, client and server against the page's checksums, the stable
+   installers, and the newest-version feed at `latest.php`.
+4. On a clean user account: run the stable installer
+   (`ZAGAN_SITE=http://127.0.0.1:8899 ./web/install.sh`) and launch the new
+   menu entry. It must install the newest version even when an older app sits
+   next to it, and refuse a corrupted download.
 5. Repeat on Windows for the `.ps1` installer and the Start-menu shortcut.
 
diff --git a/gui/Cargo.toml b/gui/Cargo.toml
index 24bf560..e216309 100644
--- a/gui/Cargo.toml
+++ b/gui/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "zagan-bet-gui"
-version = "4.3.1"
+version = "4.4.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 description = "Desktop frontend for zagan-bet"
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b18d462..63bd31c 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -95,6 +95,20 @@ origin=$(printf '%s' "$URL" | sed -E 's#^(https?://[^/]+).*#\1#')
 grep -oE '[0-9a-f]{64}  [A-Za-z0-9._-]+' "$tmp/page.html" > "$tmp/sums" || true
 [ -s "$tmp/sums" ] || die "no SHA-256 lines on the page (is index.php being served?)"
 
+for script in install.sh install.ps1; do
+  grep -qE "href=\"[^\"]*/$script\"" "$tmp/page.html" \
+    || die "$script is not linked from the page"
+  curl -fsSL --max-time 30 "$origin/$script" -o "$tmp/$script" \
+    || die "could not fetch $script"
+  cmp -s "web/$script" "$tmp/$script" \
+    || die "$script served from the site differs from the local file"
+done
+
+curl -fsSL --max-time 30 "$origin/latest.php" -o "$tmp/latest.txt" \
+  || die "could not fetch latest.php"
+newest=$(awk '$1 == "version" { print $2; exit }' "$tmp/latest.txt")
+[ -n "$newest" ] || die "latest.php has no version line"
+
 failed=0
 verified=0
 for local in "${artifacts[@]}"; do
@@ -132,6 +146,16 @@ for local in "${artifacts[@]}"; do
     continue
   fi
 
+  version=$(printf '%s' "$file" | sed -E 's/^zagan-bet-[a-z]+-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+  if [ "$version" = "$newest" ]; then
+    latest_hash=$(awk -v kind="$kind" -v name="$file" '$1 == kind && $5 == name { print $6 }' "$tmp/latest.txt")
+    if [ "$latest_hash" != "$local_hash" ]; then
+      echo "  $file: latest.php shows ${latest_hash:-nothing}, local is $local_hash"
+      failed=1
+      continue
+    fi
+  fi
+
   echo "  $file: ok"
   verified=$((verified + 1))
 done
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 3a04631..fbcd588 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -5,20 +5,19 @@
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-server-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
 # Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
 # here after each build. The version comes from Cargo.toml.
 #
 # The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
-# The public git repository is the GPL source for these binaries, so publish
-# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
+# The installers are stable site files (web/install.sh and web/install.ps1):
+# they ask web/latest.php for the newest build, so they are not regenerated
+# here. The public git repository is the GPL source for these binaries, so
+# publish from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
-#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -31,22 +30,12 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
-URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
 
 if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
   echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
   exit 1
 fi
 
-command -v python3 >/dev/null || {
-  echo "python3 is required to render the installers" >&2
-  exit 1
-}
-
-hash_of() {
-  sha256sum "$1" | awk '{print $1}'
-}
-
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
   local ext=""
@@ -85,23 +74,13 @@ publish_gui() {
 
   mkdir -p "$DEST/gui"
   install -m 0755 "$source" "$DEST/gui/$artifact"
-  local sha
-  sha=$(hash_of "$DEST/gui/$artifact")
   echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
-
-  if [ "$platform" = linux ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/linux.sh.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  elif [ "$platform" = windows ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/windows.ps1.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  fi
 }
 
+rm web/bin/client/*
+rm web/bin/gui/*
+rm web/bin/server/*
+
 publish_gui x86_64-unknown-linux-gnu linux x86_64
 publish_gui x86_64-pc-windows-gnu windows x86_64
 
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
deleted file mode 100644
index 1a00551..0000000
--- a/scripts/render-installer.py
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env python3
-"""Fill an installer template with one published artifact's details.
-
-Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
-
-The Linux template embeds the application icon so the installer works offline.
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-
-
-def main(argv: list[str]) -> int:
-    if len(argv) != 7:
-        print(
-            "usage: render-installer.py <template> <output> <version> "
-            "<binary> <sha256> <url>",
-            file=sys.stderr,
-        )
-        return 2
-
-    template, output, version, binary, sha256, url = argv[1:]
-    root = pathlib.Path(__file__).resolve().parent.parent
-    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
-
-    text = pathlib.Path(template).read_text()
-    replacements = {
-        "__VERSION__": version,
-        "__BINARY__": binary,
-        "__SHA256__": sha256,
-        "__URL__": url,
-        "__ICON__": icon.rstrip("\n"),
-    }
-    for placeholder, value in replacements.items():
-        text = text.replace(placeholder, value)
-
-    destination = pathlib.Path(output)
-    destination.write_text(text)
-    if destination.suffix == ".sh":
-        destination.chmod(0o755)
-
-    print(f"    {destination} ({destination.stat().st_size} bytes)")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv))
diff --git a/web/README.md b/web/README.md
index 1ee794f..13f5f85 100644
--- a/web/README.md
+++ b/web/README.md
@@ -8,10 +8,14 @@ browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ```
 web/
-  index.php
-  bin/gui/       served at /bin/gui/... (app and installers)
-  bin/client/    served at /bin/client/...
-  bin/server/    served at /bin/server/...
+  index.php      the download page
+  latest.php     newest-version feed for the installers
+  releases.php   shared scanner and hash cache
+  install.sh     stable Linux installer
+  install.ps1    stable Windows installer
+  bin/gui/       apps, served at /bin/gui/...
+  bin/client/    terminal clients
+  bin/server/    servers
 ```
 
 Serve `web/` as the document root. Binaries in `bin/` are gitignored.
@@ -23,8 +27,6 @@ those directories is ignored.
 
 ```
 bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
 bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
@@ -32,12 +34,14 @@ bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
-The installers are generated next to their app. They embed the app's SHA-256,
-check the file (or download it) and install it for the current user: Linux
+The installers are not versioned. They read `latest.php`, pick the newest build
+for the machine, verify its SHA-256 and install it for the current user: Linux
 writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
-`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The Windows
-installer waits for Enter before closing (`-NoPause` for automation). The page
-links the public git repository for the GPL corresponding source.
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. Updating the
+site only needs `publish.sh`; the installer links never change. Set
+`ZAGAN_SITE` (Linux) or `-Site` (Windows) to test against a staging site. The
+Windows installer waits for Enter before closing (`-NoPause` for automation).
+The page links the public git repository for the GPL corresponding source.
 
 ## Publishing a build
 
@@ -49,19 +53,17 @@ From the repository root:
 
 It reads the version from `Cargo.toml`, builds every artifact and installs
 them under `web/bin` with the names above. The GUI is built with the
-workspace's `gui-release` profile (LTO, stripped) and the installers are
-rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+workspace's `gui-release` profile (LTO, stripped). Run it from a clean tree so
 the release commit is the source the page links to. Override the destination
-with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
-into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
-`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
+with `DEST=/srv/www/bin ./scripts/publish.sh`; `ALLOW_DIRTY=1` skips the
+clean-tree check for a preview. The installers are static and need no
+regeneration.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only. The GUI needs Python 3 at publish time
-for the installer templates in `scripts/installers/`.
+dependency; the client is rustls-only.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
diff --git a/web/index.php b/web/index.php
index 77edf95..3f0ab92 100644
--- a/web/index.php
+++ b/web/index.php
@@ -1,63 +1,34 @@
 <?php
 declare(strict_types=1);
 
+require __DIR__ . '/releases.php';
+
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/{gui,client,server} and renders every build it finds, with its
- * version, size and SHA-256. The GPL source link points at the public git
- * repository. No database, no JavaScript, no dependencies.
- *
- * Expected file names (anything else is ignored):
- *
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
- *
- * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
- * <arch> is x86_64|i686|aarch64. Example:
- *
- *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
- *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
- *
- * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
- * is only re-read when it changes. The cache lives in the system temp
- * directory by default (the web root is often not writable by the PHP user);
- * set ZAGAN_HASH_CACHE to put it somewhere else.
+ * Lists every published app, terminal client and server, with version, size
+ * and SHA-256. The installers are stable links that ask latest.php for the
+ * newest build. The GPL source link points at the public git repository. No
+ * database, no JavaScript, no dependencies.
  */
 
-const KINDS = [
-    'gui' => [
-        'title' => 'Desktop app',
-        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
-    ],
-    'client' => [
-        'title' => 'Client',
-        'hint' => 'Needs a terminal of at least 80×24 cells.',
-    ],
-    'server' => [
-        'title' => 'Server',
-        'hint' => 'Generates its own TLS identity on first run.',
-    ],
-];
+$scan = scan_releases();
+$releases = $scan['releases'];
+$newest = $scan['newest_mtime'];
 
-const PLATFORMS = [
-    'linux' => 'Linux',
-    'windows' => 'Windows',
-    'macos' => 'macOS',
-];
+$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
+if ($base === '.' || $base === '/') {
+    $base = '';
+}
 
-const ARCHES = [
-    'x86_64' => '64-bit',
-    'i686' => '32-bit',
-    'aarch64' => 'ARM64',
-];
+foreach ($releases as $kind => &$found) {
+    foreach ($found as &$release) {
+        $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
+    }
+}
+unset($found, $release);
 
-// Newest version first, then 64-bit builds before 32-bit.
-const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
-const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+$all = array_merge($releases['gui'], $releases['client'], $releases['server']);
 
 function e(?string $value): string
 {
@@ -74,220 +45,6 @@ function human_size(int $bytes): string
     }
     return $bytes . ' B';
 }
-
-/**
- * Hash to use for a published file, reusing the cached value when the file has
- * not changed since it was hashed.
- *
- * A cached hash is valid only when the size and mtime still match and the hash
- * was taken at or after the file's mtime, so a restored or touched file is
- * re-read.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function cached_hash(
-    string $key,
-    string $path,
-    int $size,
-    int $mtime,
-    array &$cache,
-    bool &$dirty
-): ?string {
-    $entry = $cache['files'][$key] ?? null;
-    if (
-        is_array($entry)
-        && ($entry['size'] ?? null) === $size
-        && ($entry['mtime'] ?? null) === $mtime
-        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
-        && isset($entry['sha256'])
-        && is_string($entry['sha256'])
-        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
-    ) {
-        return $entry['sha256'];
-    }
-
-    $hash = hash_file('sha256', $path);
-    if ($hash === false) {
-        return null;
-    }
-
-    $cache['files'][$key] = [
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-        'hashed_at' => time(),
-    ];
-    $dirty = true;
-
-    return $hash;
-}
-
-/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
-function load_hash_cache(string $path): array
-{
-    $raw = @file_get_contents($path);
-    if ($raw === false || $raw === '') {
-        return ['files' => []];
-    }
-    $decoded = json_decode($raw, true);
-    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
-        return ['files' => []];
-    }
-
-    return ['files' => $decoded['files']];
-}
-
-/**
- * Best effort: a read-only web root, a full disk or a racing writer must never
- * break the page, so failures are ignored and the next request recomputes.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function save_hash_cache(string $path, array $cache): void
-{
-    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
-    if ($json === false) {
-        return;
-    }
-    $directory = dirname($path);
-    $temporary = @tempnam($directory, '.zagan-hashes-');
-    if ($temporary === false) {
-        return;
-    }
-    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
-        @unlink($temporary);
-    }
-}
-
-/**
- * @return array{version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
- */
-function read_release(
-    string $kind,
-    string $directory,
-    string $entry,
-    array &$cache,
-    bool &$dirty
-): ?array {
-    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
-    if (preg_match($pattern, $entry, $matches) !== 1) {
-        return null;
-    }
-
-    $realDirectory = realpath($directory);
-    $real = realpath($directory . '/' . $entry);
-    if ($realDirectory === false || $real === false) {
-        return null;
-    }
-    // Never serve anything that resolves outside the published directory.
-    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
-        return null;
-    }
-    if (!is_file($real)) {
-        return null;
-    }
-
-    $size = filesize($real);
-    $mtime = filemtime($real);
-    if ($size === false || $mtime === false) {
-        return null;
-    }
-
-    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
-    if ($hash === null) {
-        return null;
-    }
-
-    $suffix = strtolower($matches[4] ?? '');
-    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
-
-    return [
-        'version' => $matches[1],
-        'platform' => strtolower($matches[2]),
-        'arch' => strtolower($matches[3]),
-        'variant' => $variant,
-        'file' => $entry,
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-    ];
-}
-
-$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
-if ($base === '.' || $base === '/') {
-    $base = '';
-}
-
-$cachePath = getenv('ZAGAN_HASH_CACHE');
-if (!is_string($cachePath) || $cachePath === '') {
-    $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
-        . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
-        . substr(hash('sha256', __DIR__), 0, 16) . '.json';
-}
-$cache = load_hash_cache($cachePath);
-$cacheDirty = false;
-$seen = [];
-
-$releases = [];
-$newest = 0;
-
-foreach (KINDS as $kind => $meta) {
-    $found = [];
-    $directory = __DIR__ . '/bin/' . $kind;
-
-    if (is_dir($directory)) {
-        $entries = scandir($directory);
-        if ($entries !== false) {
-            foreach ($entries as $entry) {
-                if ($entry === '.' || $entry === '..') {
-                    continue;
-                }
-                $release = read_release($kind, $directory, $entry, $cache, $cacheDirty);
-                if ($release === null) {
-                    continue;
-                }
-                $seen[$kind . '/' . $entry] = true;
-                $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
-                $found[] = $release;
-                $newest = max($newest, $release['mtime']);
-            }
-        }
-    }
-
-    usort($found, static function (array $a, array $b): int {
-        $byVersion = version_compare($b['version'], $a['version']);
-        if ($byVersion !== 0) {
-            return $byVersion;
-        }
-        $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
-        if ($byPlatform !== 0) {
-            return $byPlatform;
-        }
-        $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
-        if ($byArch !== 0) {
-            return $byArch;
-        }
-        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
-        if ($byVariant !== 0) {
-            return $byVariant;
-        }
-        return strcmp($a['file'], $b['file']);
-    });
-
-    $releases[$kind] = $found;
-}
-
-// Drop cache entries for files that are no longer published.
-foreach (array_keys($cache['files']) as $key) {
-    if (!isset($seen[$key])) {
-        unset($cache['files'][$key]);
-        $cacheDirty = true;
-    }
-}
-if ($cacheDirty) {
-    save_hash_cache($cachePath, $cache);
-}
 ?>
 <!doctype html>
 <html lang="en">
@@ -308,24 +65,20 @@ if ($cacheDirty) {
 
 <h2>Desktop app</h2>
 <p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
-<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
-<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
-<?php if ($guiBinaries === []): ?>
+<?php if ($releases['gui'] === []): ?>
 <p>Nothing published yet.</p>
 <?php else: ?>
 <ul>
-<?php foreach ($guiBinaries as $release): ?>
+<?php foreach ($releases['gui'] as $release): ?>
 <li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
 <?php endforeach; ?>
 </ul>
-<?php endif; ?>
-<?php if ($guiInstallers !== []): ?>
+
 <h3>Installers</h3>
-<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<p>Downloads the newest build, checks its SHA-256 and installs it for your user.</p>
 <ul>
-<?php foreach ($guiInstallers as $release): ?>
-<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
-<?php endforeach; ?>
+<li><a href="<?= e($base) ?>/install.sh" download>Linux installer (bash)</a></li>
+<li><a href="<?= e($base) ?>/install.ps1" download>Windows installer (PowerShell)</a></li>
 </ul>
 <?php endif; ?>
 
@@ -353,7 +106,6 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -372,11 +124,11 @@ echo e($sums);
 
 <h2>Running it</h2>
 <p>Desktop app on Linux:</p>
-<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
-./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<pre><code>chmod +x install.sh
+./install.sh</code></pre>
 <p>Desktop app on Windows (PowerShell):</p>
-<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
-<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\install.ps1</code></pre>
+<p>The installers fetch the newest build, verify its SHA-256, install it for your user and add a launcher.</p>
 <p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
diff --git a/scripts/installers/windows.ps1.in b/web/install.ps1
index 4b8e61d..92eef83 100644
--- a/scripts/installers/windows.ps1.in
+++ b/web/install.ps1
@@ -1,21 +1,18 @@
-# Zagan-Bet desktop installer for Windows.
+# Zagan-Bet installer for Windows.
 #
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a Start-menu shortcut. Put the downloaded app next to this
-# script, or run the script on its own and it will fetch the matching binary.
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a Start-menu shortcut. Point it at a staging site
+# with -Site http://127.0.0.1:8899; add -NoPause for automation.
 #
 # Run it with:
-#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
-# Add -NoPause to run it unattended.
-param([switch]$NoPause)
+#   powershell -ExecutionPolicy Bypass -File .\install.ps1
+param(
+    [string]$Site = "https://zagan.2137697.xyz",
+    [switch]$NoPause
+)
 
 $ErrorActionPreference = "Stop"
 
-$Version = "__VERSION__"
-$Binary  = "__BINARY__"
-$Sha256  = "__SHA256__"
-$Url     = "__URL__"
-
 function Finish([int]$Code) {
     if (-not $NoPause) {
         Read-Host "Press Enter to close" | Out-Null
@@ -28,6 +25,30 @@ function Stop-Install([string]$Message) {
     Finish 1
 }
 
+try {
+    $latest = (Invoke-WebRequest -Uri "$Site/latest.php" -UseBasicParsing).Content
+} catch {
+    Stop-Install "could not read $Site/latest.php: $_"
+}
+
+$line = ($latest -split "`r?`n") |
+    Where-Object { $_ -match '^gui windows x86_64 ' } |
+    Select-Object -First 1
+if (-not $line) {
+    Stop-Install "no Windows build is published yet"
+}
+
+$parts = $line.Trim() -split '\s+'
+if ($parts.Count -lt 6) {
+    Stop-Install "the latest-build file is malformed"
+}
+$Version = $parts[3]
+$Binary = $parts[4]
+$Sha256 = $parts[5]
+$Url = "$Site/bin/gui/$Binary"
+
+Write-Host "Newest Zagan-Bet is $Version."
+
 $here = Split-Path -Parent $MyInvocation.MyCommand.Path
 $candidates = @(
     (Join-Path $here $Binary),
diff --git a/scripts/installers/linux.sh.in b/web/install.sh
index 5b53c02..998b262 100644
--- a/scripts/installers/linux.sh.in
+++ b/web/install.sh
@@ -1,24 +1,38 @@
 #!/usr/bin/env bash
-# Zagan-Bet desktop installer for Linux.
+# Zagan-Bet installer for Linux.
 #
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a launcher. Put the downloaded app next to this script, or run
-# the script on its own and it will fetch the matching binary.
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a launcher. Point it at a staging site with
+# ZAGAN_SITE=http://127.0.0.1:8899.
 set -euo pipefail
 
-VERSION="__VERSION__"
-BINARY="__BINARY__"
-SHA256="__SHA256__"
-URL="__URL__"
+SITE=${ZAGAN_SITE:-https://zagan.2137697.xyz}
+PLATFORM=linux
+ARCH=x86_64
 
 say() { printf '%s\n' "$*"; }
 die() { printf 'install: %s\n' "$*" >&2; exit 1; }
 
+command -v curl >/dev/null 2>&1 || die "curl is required"
 command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
 
+latest=$(curl -fsSL --max-time 30 "$SITE/latest.php") \
+  || die "could not read $SITE/latest.php"
+line=$(printf '%s\n' "$latest" \
+  | awk -v p="$PLATFORM" -v a="$ARCH" '$1 == "gui" && $2 == p && $3 == a { print; exit }')
+[ -n "$line" ] || die "no Linux build is published yet"
+
+version=$(printf '%s\n' "$line" | awk '{print $4}')
+binary=$(printf '%s\n' "$line" | awk '{print $5}')
+sha=$(printf '%s\n' "$line" | awk '{print $6}')
+[ -n "$version" ] && [ -n "$binary" ] && [ -n "$sha" ] \
+  || die "the latest-build file is malformed"
+
+say "Newest Zagan-Bet is $version."
+
 here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 source_file=""
-for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
+for candidate in "$here/$binary" "./$binary" "$HOME/Downloads/$binary"; do
   if [ -f "$candidate" ]; then
     source_file=$candidate
     break
@@ -27,16 +41,17 @@ done
 
 cleanup=""
 if [ -z "$source_file" ]; then
-  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
   cleanup=$(mktemp) || die "cannot create a temporary file"
-  say "Downloading $BINARY..."
-  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
+  say "Downloading $binary..."
+  curl -fsSL --max-time 300 "$SITE/bin/gui/$binary" -o "$cleanup" \
+    || die "download failed"
   source_file=$cleanup
 fi
 trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
 
 actual=$(sha256sum "$source_file" | awk '{print $1}')
-[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
+[ "$actual" = "$sha" ] \
+  || die "checksum mismatch: expected $sha, got $actual"
 
 bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
 data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
@@ -48,7 +63,12 @@ mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
 install -m 0755 "$source_file" "$app"
 
 cat > "$icon_dir/zagan-bet.svg" <<'ICON'
-__ICON__
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#0a0e12"/>
+  <rect x="9" y="9" width="46" height="46" rx="10" fill="#0f1a14" stroke="#1f7d52" stroke-width="2"/>
+  <path d="M22 20h20L22 44h20" fill="none" stroke="#4ec27b" stroke-width="6"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
 ICON
 
 cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
@@ -70,7 +90,7 @@ if command -v gtk-update-icon-cache >/dev/null 2>&1; then
   gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
 fi
 
-say "Installed Zagan-Bet $VERSION to $app"
+say "Installed Zagan-Bet $version to $app"
 say "A launcher was added to your applications menu."
 case ":$PATH:" in
   *":$bin_dir:"*) ;;
diff --git a/web/latest.php b/web/latest.php
new file mode 100644
index 0000000..3e7368c
--- /dev/null
+++ b/web/latest.php
@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * The newest published build, for install.sh and install.ps1.
+ *
+ * Plain text, one record per line, so both a shell script and PowerShell can
+ * parse it without a JSON library:
+ *
+ *   version 4.4.0
+ *   gui linux x86_64 4.4.0 zagan-bet-gui-4.4.0-linux-x86_64 <sha256>
+ *   gui windows x86_64 4.4.0 zagan-bet-gui-4.4.0-windows-x86_64.exe <sha256>
+ *   client ...
+ *   server ...
+ *
+ * Only the newest version is listed. The installers verify the SHA-256 they
+ * read here against the bytes they download.
+ */
+
+require __DIR__ . '/releases.php';
+
+$scan = scan_releases();
+$all = array_merge(
+    $scan['releases']['gui'],
+    $scan['releases']['client'],
+    $scan['releases']['server']
+);
+
+$newest = '0.0.0';
+foreach ($all as $release) {
+    if (version_compare($release['version'], $newest, '>')) {
+        $newest = $release['version'];
+    }
+}
+
+header('Content-Type: text/plain; charset=utf-8');
+header('Cache-Control: no-cache');
+
+echo 'version ' . $newest . "\n";
+foreach ($all as $release) {
+    if ($release['version'] !== $newest) {
+        continue;
+    }
+    echo $release['kind'] . ' '
+        . $release['platform'] . ' '
+        . $release['arch'] . ' '
+        . $release['version'] . ' '
+        . $release['file'] . ' '
+        . $release['sha256'] . "\n";
+}
diff --git a/web/releases.php b/web/releases.php
new file mode 100644
index 0000000..b9c7284
--- /dev/null
+++ b/web/releases.php
@@ -0,0 +1,262 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Shared release scanning for the download page and the latest-build endpoint.
+ *
+ * Expected file names under bin/<kind>/ (anything else is ignored):
+ *
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
+ *
+ * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
+ * <arch> is x86_64|i686|aarch64.
+ *
+ * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
+ * is only re-read when it changes. The cache lives in the system temp
+ * directory by default (the web root is often not writable by the PHP user);
+ * set ZAGAN_HASH_CACHE to put it somewhere else.
+ */
+
+const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
+    'client' => [
+        'title' => 'Client',
+        'hint' => 'Needs a terminal of at least 80×24 cells.',
+    ],
+    'server' => [
+        'title' => 'Server',
+        'hint' => 'Generates its own TLS identity on first run.',
+    ],
+];
+
+const PLATFORMS = [
+    'linux' => 'Linux',
+    'windows' => 'Windows',
+    'macos' => 'macOS',
+];
+
+const ARCHES = [
+    'x86_64' => '64-bit',
+    'i686' => '32-bit',
+    'aarch64' => 'ARM64',
+];
+
+// Newest version first, then 64-bit builds before 32-bit.
+const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
+const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+
+/**
+ * Hash to use for a published file, reusing the cached value when the file has
+ * not changed since it was hashed.
+ *
+ * A cached hash is valid only when the size and mtime still match and the hash
+ * was taken at or after the file's mtime, so a restored or touched file is
+ * re-read.
+ *
+ * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
+ */
+function cached_hash(
+    string $key,
+    string $path,
+    int $size,
+    int $mtime,
+    array &$cache,
+    bool &$dirty
+): ?string {
+    $entry = $cache['files'][$key] ?? null;
+    if (
+        is_array($entry)
+        && ($entry['size'] ?? null) === $size
+        && ($entry['mtime'] ?? null) === $mtime
+        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
+        && isset($entry['sha256'])
+        && is_string($entry['sha256'])
+        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
+    ) {
+        return $entry['sha256'];
+    }
+
+    $hash = hash_file('sha256', $path);
+    if ($hash === false) {
+        return null;
+    }
+
+    $cache['files'][$key] = [
+        'size' => $size,
+        'mtime' => $mtime,
+        'sha256' => $hash,
+        'hashed_at' => time(),
+    ];
+    $dirty = true;
+
+    return $hash;
+}
+
+/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
+function load_hash_cache(string $path): array
+{
+    $raw = @file_get_contents($path);
+    if ($raw === false || $raw === '') {
+        return ['files' => []];
+    }
+    $decoded = json_decode($raw, true);
+    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
+        return ['files' => []];
+    }
+
+    return ['files' => $decoded['files']];
+}
+
+/**
+ * Best effort: a read-only web root, a full disk or a racing writer must never
+ * break the page, so failures are ignored and the next request recomputes.
+ *
+ * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
+ */
+function save_hash_cache(string $path, array $cache): void
+{
+    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
+    if ($json === false) {
+        return;
+    }
+    $directory = dirname($path);
+    $temporary = @tempnam($directory, '.zagan-hashes-');
+    if ($temporary === false) {
+        return;
+    }
+    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
+        @unlink($temporary);
+    }
+}
+
+/**
+ * @return array{kind:string,version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
+ */
+function read_release(
+    string $kind,
+    string $directory,
+    string $entry,
+    array &$cache,
+    bool &$dirty
+): ?array {
+    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+    if (preg_match($pattern, $entry, $matches) !== 1) {
+        return null;
+    }
+
+    $realDirectory = realpath($directory);
+    $real = realpath($directory . '/' . $entry);
+    if ($realDirectory === false || $real === false) {
+        return null;
+    }
+    // Never serve anything that resolves outside the published directory.
+    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
+        return null;
+    }
+    if (!is_file($real)) {
+        return null;
+    }
+
+    $size = filesize($real);
+    $mtime = filemtime($real);
+    if ($size === false || $mtime === false) {
+        return null;
+    }
+
+    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
+    if ($hash === null) {
+        return null;
+    }
+
+    return [
+        'kind' => $kind,
+        'version' => $matches[1],
+        'platform' => strtolower($matches[2]),
+        'arch' => strtolower($matches[3]),
+        'file' => $entry,
+        'size' => $size,
+        'mtime' => $mtime,
+        'sha256' => $hash,
+    ];
+}
+
+/**
+ * Scan every kind and return its releases, newest version first.
+ *
+ * @return array{releases:array<string,array<int,array{kind:string,version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}>>,newest_mtime:int}
+ */
+function scan_releases(): array
+{
+    $cachePath = getenv('ZAGAN_HASH_CACHE');
+    if (!is_string($cachePath) || $cachePath === '') {
+        $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
+            . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
+            . substr(hash('sha256', __DIR__), 0, 16) . '.json';
+    }
+    $cache = load_hash_cache($cachePath);
+    $dirty = false;
+    $seen = [];
+
+    $releases = [];
+    $newestMtime = 0;
+
+    foreach (KINDS as $kind => $meta) {
+        $found = [];
+        $directory = __DIR__ . '/bin/' . $kind;
+
+        if (is_dir($directory)) {
+            $entries = scandir($directory);
+            if ($entries !== false) {
+                foreach ($entries as $entry) {
+                    if ($entry === '.' || $entry === '..') {
+                        continue;
+                    }
+                    $release = read_release($kind, $directory, $entry, $cache, $dirty);
+                    if ($release === null) {
+                        continue;
+                    }
+                    $seen[$kind . '/' . $entry] = true;
+                    $found[] = $release;
+                    $newestMtime = max($newestMtime, $release['mtime']);
+                }
+            }
+        }
+
+        usort($found, static function (array $a, array $b): int {
+            $byVersion = version_compare($b['version'], $a['version']);
+            if ($byVersion !== 0) {
+                return $byVersion;
+            }
+            $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
+            if ($byPlatform !== 0) {
+                return $byPlatform;
+            }
+            $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
+            if ($byArch !== 0) {
+                return $byArch;
+            }
+            return strcmp($a['file'], $b['file']);
+        });
+
+        $releases[$kind] = $found;
+    }
+
+    // Drop cache entries for files that are no longer published.
+    foreach (array_keys($cache['files']) as $key) {
+        if (!isset($seen[$key])) {
+            unset($cache['files'][$key]);
+            $dirty = true;
+        }
+    }
+    if ($dirty) {
+        save_hash_cache($cachePath, $cache);
+    }
+
+    return ['releases' => $releases, 'newest_mtime' => $newestMtime];
+}