13 files changed, 416 insertions, 46 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 368a348..7258710 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -85,6 +85,12 @@
 - The embedded fonts have no suit or arrow glyphs. Draw card suits as shapes
   and use plain words for navigation; a glyph that is not in Open Sans or Hack
   renders as tofu.
+- `scripts/publish.sh` builds the GUI with `gui-release` and renders the
+  installers with the published SHA-256. Installers verify the hash and install
+  per-user; never install system-wide or skip the check.
+- The download page links the public git repository
+  (https://git.2137697.xyz/zagan-bet.git) for the GPL corresponding source.
+  Run publish from a clean tree so the linked history matches the binaries.
 
 ## Client TUI
 - `render_lines()` and `render()` must agree. If `render()` uses `\r\n`,
diff --git a/Cargo.toml b/Cargo.toml
index 179cb39..22a6ec7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["gui"]
 
 [package]
 name = "zagan-bet"
-version = "4.2.1"
+version = "4.3.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 
diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index 89cf495..f058e41 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -162,18 +162,29 @@ Measured on Linux at 1080p with llvmpipe software GL:
 **Gate:** the screenshot set is ready for review. Remaining for the gate:
 frame rate on integrated graphics and the Windows interactive pass.
 
-## Phase 5 — packaging
-## Phase 5 — packaging
-
-- `publish.sh` emits `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
-- Bash and PowerShell installers that verify the SHA-256, install to the user
-  directory, and create `.desktop`/Start-menu entries.
-- Download page lists raw binaries and installers; add the source-code link.
-
-**Gate:** `deploy.sh` verifies both artifact kinds; a clean machine installs
-from the page and launches.
+## Phase 5 — packaging (code complete, v4.3.0)
+
+- `publish.sh` builds the GUI with the `gui-release` profile for Linux and
+  Windows and names the app `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
+- It renders a bash installer and a PowerShell installer next to each app.
+  Both embed the app's SHA-256, verify the file (or download it), install
+  per-user and add a launcher: `.desktop` plus an SVG icon on Linux, a
+  Start-menu shortcut on Windows. Templates live in `scripts/installers/`;
+  `render-installer.py` fills them in.
+- The download page scans `bin/gui`, `bin/client` and `bin/server`, lists
+  apps, installers, clients and servers, and includes every file in the
+  `sha256sum` block. A Source section links the public git repository
+  (<https://git.2137697.xyz/zagan-bet.git>) for the GPL corresponding source.
+  `deploy.sh` verifies every artifact kind over the public URL.
+- `publish.sh` refuses to run from a dirty tree so the linked history matches
+  the binaries.
+
+**Gate:** deploy verification passes for apps, installers, clients and
+servers; the Linux installer is exercised in a clean HOME. The Windows
+installer needs a Windows machine before the gate closes.
 
 ## Testing split
+## Testing split
 
 - `View`/`Command` tests in the core: flows, gating, state. Always.
 - The TUI adapter remains the regression net through Phases 1–2.
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 613cd08..c32ac22 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -266,3 +266,20 @@ terminal client; a saved login from one signs in the other.
   the row is upgraded to bcrypt.
 - Spin several times and confirm `plays` grows by one row per spin while
   `users.balance` changes by `winnings - bet`.
+
+## Packaging checklist
+
+1. Set the version in `Cargo.toml` and `gui/Cargo.toml` (same MAJOR.MINOR),
+   run `cargo test --workspace`, and commit. `publish.sh` refuses a dirty tree
+   because the site links the committed git history as the GPL source.
+2. `./scripts/publish.sh` (add `DEST=` and `URL_BASE=` to stage elsewhere). It
+   builds the GUI with `gui-release`, the terminal clients and servers, and
+   renders the bash/PowerShell installers with each app's SHA-256.
+3. `php -S 127.0.0.1:8899 -t <staging>` and
+   `./scripts/deploy.sh <staging> http://127.0.0.1:8899/` to upload and verify
+   every app, installer, client and server against the page's checksums.
+4. On a clean user account: download an app with its installer, run the
+   installer, and launch the new menu entry. The installer must refuse a
+   corrupted download.
+5. Repeat on Windows for the `.ps1` installer and the Start-menu shortcut.
+
diff --git a/gui/Cargo.toml b/gui/Cargo.toml
index 5418794..8bcbda0 100644
--- a/gui/Cargo.toml
+++ b/gui/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "zagan-bet-gui"
-version = "4.2.1"
+version = "4.3.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 description = "Desktop frontend for zagan-bet"
diff --git a/gui/assets/zagan-bet.svg b/gui/assets/zagan-bet.svg
new file mode 100644
index 0000000..74e5a3a
--- /dev/null
+++ b/gui/assets/zagan-bet.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#0a0e12"/>
+  <rect x="9" y="9" width="46" height="46" rx="10" fill="#0f1a14" stroke="#1f7d52" stroke-width="2"/>
+  <path d="M22 20h20L22 44h20" fill="none" stroke="#4ec27b" stroke-width="6"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 99129ad..b18d462 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Upload web/ and verify every published artifact over the public URL.
+# Upload web/ and verify every published artifact (GUI app and installers,
+# terminal client and server) over the public URL.
 #
 # Usage:
 #   ./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/
@@ -50,7 +51,11 @@ done
 [ -f web/index.php ] || die "web/index.php is missing"
 
 shopt -s nullglob
-artifacts=(web/bin/client/zagan-bet-* web/bin/server/zagan-bet-*)
+artifacts=(
+  web/bin/gui/zagan-bet-*
+  web/bin/client/zagan-bet-*
+  web/bin/server/zagan-bet-*
+)
 shopt -u nullglob
 [ ${#artifacts[@]} -gt 0 ] || die "no artifacts in web/bin; run scripts/publish.sh first"
 
diff --git a/scripts/installers/linux.sh.in b/scripts/installers/linux.sh.in
new file mode 100644
index 0000000..5b53c02
--- /dev/null
+++ b/scripts/installers/linux.sh.in
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Zagan-Bet desktop installer for Linux.
+#
+# Verifies the app against its published SHA-256, installs it for the current
+# user and adds a launcher. Put the downloaded app next to this script, or run
+# the script on its own and it will fetch the matching binary.
+set -euo pipefail
+
+VERSION="__VERSION__"
+BINARY="__BINARY__"
+SHA256="__SHA256__"
+URL="__URL__"
+
+say() { printf '%s\n' "$*"; }
+die() { printf 'install: %s\n' "$*" >&2; exit 1; }
+
+command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
+
+here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source_file=""
+for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
+  if [ -f "$candidate" ]; then
+    source_file=$candidate
+    break
+  fi
+done
+
+cleanup=""
+if [ -z "$source_file" ]; then
+  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
+  cleanup=$(mktemp) || die "cannot create a temporary file"
+  say "Downloading $BINARY..."
+  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
+  source_file=$cleanup
+fi
+trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
+
+actual=$(sha256sum "$source_file" | awk '{print $1}')
+[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
+
+bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
+data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
+app="$bin_dir/zagan-bet-gui"
+desktop_dir="$data_dir/applications"
+icon_dir="$data_dir/icons/hicolor/scalable/apps"
+
+mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
+install -m 0755 "$source_file" "$app"
+
+cat > "$icon_dir/zagan-bet.svg" <<'ICON'
+__ICON__
+ICON
+
+cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
+[Desktop Entry]
+Type=Application
+Name=Zagan-Bet
+Comment=Slots, roulette, blackjack and crash
+Exec=$app
+Icon=zagan-bet
+Terminal=false
+Categories=Game;
+DESKTOP
+chmod 0644 "$desktop_dir/zagan-bet.desktop" "$icon_dir/zagan-bet.svg"
+
+if command -v update-desktop-database >/dev/null 2>&1; then
+  update-desktop-database "$desktop_dir" >/dev/null 2>&1 || true
+fi
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
+fi
+
+say "Installed Zagan-Bet $VERSION to $app"
+say "A launcher was added to your applications menu."
+case ":$PATH:" in
+  *":$bin_dir:"*) ;;
+  *) say "Add $bin_dir to PATH to start it as 'zagan-bet-gui'." ;;
+esac
diff --git a/scripts/installers/windows.ps1.in b/scripts/installers/windows.ps1.in
new file mode 100644
index 0000000..fd2b8b3
--- /dev/null
+++ b/scripts/installers/windows.ps1.in
@@ -0,0 +1,75 @@
+# Zagan-Bet desktop installer for Windows.
+#
+# Verifies the app against its published SHA-256, installs it for the current
+# user and adds a Start-menu shortcut. Put the downloaded app next to this
+# script, or run the script on its own and it will fetch the matching binary.
+#
+# Run it with:
+#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
+$ErrorActionPreference = "Stop"
+
+$Version = "__VERSION__"
+$Binary  = "__BINARY__"
+$Sha256  = "__SHA256__"
+$Url     = "__URL__"
+
+function Stop-Install([string]$Message) {
+    Write-Host "install: $Message" -ForegroundColor Red
+    exit 1
+}
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$candidates = @(
+    (Join-Path $here $Binary),
+    (Join-Path (Get-Location) $Binary),
+    (Join-Path $env:USERPROFILE "Downloads\$Binary")
+)
+$sourceFile = $null
+foreach ($candidate in $candidates) {
+    if (Test-Path -LiteralPath $candidate) {
+        $sourceFile = $candidate
+        break
+    }
+}
+
+$temporary = $null
+if (-not $sourceFile) {
+    $temporary = Join-Path ([System.IO.Path]::GetTempPath()) $Binary
+    Write-Host "Downloading $Binary..."
+    try {
+        Invoke-WebRequest -Uri $Url -OutFile $temporary -UseBasicParsing
+    } catch {
+        Stop-Install "download failed: $_"
+    }
+    $sourceFile = $temporary
+}
+
+try {
+    $actual = (Get-FileHash -LiteralPath $sourceFile -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actual -ne $Sha256.ToLowerInvariant()) {
+        Stop-Install "checksum mismatch: expected $Sha256, got $actual"
+    }
+
+    $installDir = Join-Path $env:LOCALAPPDATA "Programs\Zagan-Bet"
+    New-Item -ItemType Directory -Force -Path $installDir | Out-Null
+    $target = Join-Path $installDir "zagan-bet-gui.exe"
+    Copy-Item -LiteralPath $sourceFile -Destination $target -Force
+
+    $startMenu = Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs"
+    New-Item -ItemType Directory -Force -Path $startMenu | Out-Null
+    $shortcutPath = Join-Path $startMenu "Zagan-Bet.lnk"
+    $shell = New-Object -ComObject WScript.Shell
+    $shortcut = $shell.CreateShortcut($shortcutPath)
+    $shortcut.TargetPath = $target
+    $shortcut.WorkingDirectory = $installDir
+    $shortcut.IconLocation = "$target,0"
+    $shortcut.Description = "Slots, roulette, blackjack and crash"
+    $shortcut.Save()
+
+    Write-Host "Installed Zagan-Bet $Version to $target"
+    Write-Host "A Start-menu shortcut was created."
+} finally {
+    if ($temporary -and (Test-Path -LiteralPath $temporary)) {
+        Remove-Item -LiteralPath $temporary -Force
+    }
+}
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 8240859..3a04631 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -3,14 +3,22 @@
 # download page expects:
 #
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-server-<version>-<platform>-<arch>
+#   zagan-bet-server-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
-# Cargo always writes target/<triple>/release/<bin>, so the rename happens here
-# after each build. The version comes from Cargo.toml.
+# Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
+# here after each build. The version comes from Cargo.toml.
+#
+# The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
+# The public git repository is the GPL source for these binaries, so publish
+# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
+#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -23,6 +31,21 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
+URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
+
+if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
+  echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
+  exit 1
+fi
+
+command -v python3 >/dev/null || {
+  echo "python3 is required to render the installers" >&2
+  exit 1
+}
+
+hash_of() {
+  sha256sum "$1" | awk '{print $1}'
+}
 
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
@@ -47,11 +70,46 @@ publish() {
   echo "    $DEST/$kind/$artifact ($(du -h "$DEST/$kind/$artifact" | cut -f1))"
 }
 
+publish_gui() {
+  local triple=$1 platform=$2 arch=$3
+  local ext=""
+  if [ "$platform" = windows ]; then
+    ext=".exe"
+  fi
+
+  local artifact="zagan-bet-gui-$VERSION-$platform-$arch$ext"
+  local source="target/$triple/gui-release/zagan-bet-gui$ext"
+
+  echo "==> $artifact"
+  cargo build -p zagan-bet-gui --profile gui-release --quiet --target "$triple"
+
+  mkdir -p "$DEST/gui"
+  install -m 0755 "$source" "$DEST/gui/$artifact"
+  local sha
+  sha=$(hash_of "$DEST/gui/$artifact")
+  echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
+
+  if [ "$platform" = linux ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/linux.sh.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  elif [ "$platform" = windows ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/windows.ps1.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  fi
+}
+
+publish_gui x86_64-unknown-linux-gnu linux x86_64
+publish_gui x86_64-pc-windows-gnu windows x86_64
+
 publish x86_64-unknown-linux-gnu client linux x86_64
 publish i686-unknown-linux-gnu   client linux i686
 publish x86_64-pc-windows-gnu    client windows x86_64
 publish x86_64-unknown-linux-gnu server linux x86_64
-publish x86_64-pc-windows-gnu    server windows x86_64
+publish x86_64-pc-windows-gnu    server windows x86_64
 
 echo
 echo "published $VERSION to $DEST"
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
new file mode 100644
index 0000000..1a00551
--- /dev/null
+++ b/scripts/render-installer.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Fill an installer template with one published artifact's details.
+
+Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
+
+The Linux template embeds the application icon so the installer works offline.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import sys
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 7:
+        print(
+            "usage: render-installer.py <template> <output> <version> "
+            "<binary> <sha256> <url>",
+            file=sys.stderr,
+        )
+        return 2
+
+    template, output, version, binary, sha256, url = argv[1:]
+    root = pathlib.Path(__file__).resolve().parent.parent
+    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
+
+    text = pathlib.Path(template).read_text()
+    replacements = {
+        "__VERSION__": version,
+        "__BINARY__": binary,
+        "__SHA256__": sha256,
+        "__URL__": url,
+        "__ICON__": icon.rstrip("\n"),
+    }
+    for placeholder, value in replacements.items():
+        text = text.replace(placeholder, value)
+
+    destination = pathlib.Path(output)
+    destination.write_text(text)
+    if destination.suffix == ".sh":
+        destination.chmod(0o755)
+
+    print(f"    {destination} ({destination.stat().st_size} bytes)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))
diff --git a/web/README.md b/web/README.md
index e79abd4..bd87e11 100644
--- a/web/README.md
+++ b/web/README.md
@@ -1,15 +1,15 @@
 # Download page
 
-`index.php` scans `bin/client` and `bin/server` on every request and renders
-whatever builds it finds, with version, size and SHA-256. No database, no
-JavaScript, no CSS, no dependencies. The page is plain browser defaults:
-black text, blue links, monospace checksums. PHP 8.0+.
+`index.php` scans `bin/gui`, `bin/client` and `bin/server` on every request and
+renders whatever builds it finds, with version, size and SHA-256. No database, no JavaScript, no CSS, no dependencies. The page is plain
+browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ## Layout
 
 ```
 web/
   index.php
+  bin/gui/       served at /bin/gui/... (app and installers)
   bin/client/    served at /bin/client/...
   bin/server/    served at /bin/server/...
 ```
@@ -22,13 +22,22 @@ The page only lists files that match the release pattern; anything else in
 those directories is ignored.
 
 ```
-zagan-bet-client-<version>-<platform>-<arch>[.exe]
-zagan-bet-server-<version>-<platform>-<arch>
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
 
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
+The installers are generated next to their app. They embed the app's SHA-256,
+check the file (or download it) and install it for the current user: Linux
+writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The source
+archives satisfy the GPL's corresponding-source requirement.
+
 ## Publishing a build
 
 From the repository root:
@@ -37,15 +46,21 @@ From the repository root:
 ./scripts/publish.sh
 ```
 
-It reads the version from `Cargo.toml`, builds all four artifacts and installs
-them under `web/bin` with the names above. Override the destination with
-`DEST=/srv/www/bin ./scripts/publish.sh`.
+It reads the version from `Cargo.toml`, builds every artifact and installs
+them under `web/bin` with the names above. The GUI is built with the
+workspace's `gui-release` profile (LTO, stripped) and the installers are
+rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+the release commit is the source the page links to. Override the destination
+with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
+into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
+`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only.
+dependency; the client is rustls-only. The GUI needs Python 3 at publish time
+for the installer templates in `scripts/installers/`.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
@@ -100,8 +115,9 @@ Then open <http://127.0.0.1:8899/>.
 ```
 
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
-half-written binary, then fetches the live page and every artifact it lists and
-compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
+half-written binary, then fetches the live page and every artifact it lists —
+GUI apps, installers, terminal clients and servers — and compares the
+downloaded bytes with the local SHA-256. `--verify-only` skips the
 upload and only checks the live site. Old versions are left on the server;
 prune them by hand.
 
@@ -124,3 +140,6 @@ php -S 127.0.0.1:8899 -t /srv/staging
   stay downloadable until you remove them from `bin/`.
 - The checksum block is in `sha256sum` format, so visitors can save it as
   `SHA256SUMS` and run `sha256sum -c SHA256SUMS`.
+- The page links <https://git.2137697.xyz/zagan-bet.git> for the GPL
+  corresponding source; publish only from a committed release so that link
+  contains the exact source.
diff --git a/web/index.php b/web/index.php
index 7ed79da..77edf95 100644
--- a/web/index.php
+++ b/web/index.php
@@ -4,20 +4,23 @@ declare(strict_types=1);
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/client and ./bin/server and renders every build it finds, with
- * its version, size and SHA-256. No database, no JavaScript, no dependencies.
+ * Scans ./bin/{gui,client,server} and renders every build it finds, with its
+ * version, size and SHA-256. The GPL source link points at the public git
+ * repository. No database, no JavaScript, no dependencies.
  *
  * Expected file names (anything else is ignored):
  *
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>.exe
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
  *
  * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
  * <arch> is x86_64|i686|aarch64. Example:
  *
- *   bin/client/zagan-bet-client-3.1.1-linux-x86_64
- *   bin/server/zagan-bet-server-3.1.1-linux-x86_64
+ *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
+ *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
  *
  * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
  * is only re-read when it changes. The cache lives in the system temp
@@ -26,6 +29,10 @@ declare(strict_types=1);
  */
 
 const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
     'client' => [
         'title' => 'Client',
         'hint' => 'Needs a terminal of at least 80×24 cells.',
@@ -163,7 +170,7 @@ function read_release(
     bool &$dirty
 ): ?array {
     $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
     if (preg_match($pattern, $entry, $matches) !== 1) {
         return null;
     }
@@ -192,10 +199,14 @@ function read_release(
         return null;
     }
 
+    $suffix = strtolower($matches[4] ?? '');
+    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
+
     return [
         'version' => $matches[1],
         'platform' => strtolower($matches[2]),
         'arch' => strtolower($matches[3]),
+        'variant' => $variant,
         'file' => $entry,
         'size' => $size,
         'mtime' => $mtime,
@@ -257,6 +268,10 @@ foreach (KINDS as $kind => $meta) {
         if ($byArch !== 0) {
             return $byArch;
         }
+        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
+        if ($byVariant !== 0) {
+            return $byVariant;
+        }
         return strcmp($a['file'], $b['file']);
     });
 
@@ -280,18 +295,41 @@ if ($cacheDirty) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>żagań.bet</title>
-<meta name="description" content="Official zagan.bet client and server downloads.">
+<meta name="description" content="Official zagan.bet desktop app, terminal client and server downloads.">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'">
 </head>
 <body>
 
 <h1>żagań.bet</h1>
-<p>Official client and server builds.</p>
+<p>Official desktop app, terminal client and server builds.</p>
 <?php if ($newest > 0): ?>
 <p>Builds published <?= e(gmdate('j M Y H:i', $newest)) ?> UTC.</p>
 <?php endif; ?>
 
-<h2>Client</h2>
+<h2>Desktop app</h2>
+<p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
+<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
+<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
+<?php if ($guiBinaries === []): ?>
+<p>Nothing published yet.</p>
+<?php else: ?>
+<ul>
+<?php foreach ($guiBinaries as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+<?php if ($guiInstallers !== []): ?>
+<h3>Installers</h3>
+<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<ul>
+<?php foreach ($guiInstallers as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+
+<h2>Terminal client</h2>
 <p>Needs a terminal of at least 80×24 cells.</p>
 <?php if ($releases['client'] === []): ?>
 <p>Nothing published yet.</p>
@@ -315,7 +353,7 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['client'], $releases['server']); ?>
+<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -329,8 +367,17 @@ echo e($sums);
 ?></pre>
 <?php endif; ?>
 
+<h2>Source</h2>
+<p>Zagan-Bet is free software under the GNU GPL v3 or later. The source for these builds is at <a href="https://git.2137697.xyz/zagan-bet.git">https://git.2137697.xyz/zagan-bet.git</a>.</p>
+
 <h2>Running it</h2>
-<p>Client:</p>
+<p>Desktop app on Linux:</p>
+<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
+./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<p>Desktop app on Windows (PowerShell):</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
+<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
 <p>Server, first run creates <code>identity.p12</code>, <code>key.pem</code> and <code>cert.pem</code>:</p>
@@ -338,8 +385,7 @@ echo e($sums);
 ./&lt;downloaded-server&gt; --init
 ./&lt;downloaded-server&gt; -i 0.0.0.0 -p 11525</code></pre>
 
-<p>Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
-
-<p>When lost, execute <code>help</code> command inside zagan.bet client. Server binary supports <code>--help</code> flag</p>
+<p>Terminal client on Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
+<p>Run <code>help</code> inside the terminal client; the server binary supports <code>--help</code>.</p>
 </body>
 </html>