@@ -300,6 +300,28 @@ if ($LASTEXITCODE -ne 0) {
     exit 1
 }
 
+# Place the installer beside the binary so `update` points at a local file
+# rather than a URL, and so the next update runs THIS release's installer.
+#
+# Sourced from the archive we just checksum-verified, and published by rename
+# rather than written over the live path. PowerShell parses a script fully
+# before executing it, so self-overwrite is less hazardous here than it is for
+# bash -- but rename costs nothing and keeps both platforms on one rule.
+# Best effort: a failure here still leaves a working install.
+$DownloadedInstaller = Join-Path $TmpDir "install.ps1"
+if (Test-Path -LiteralPath $DownloadedInstaller -PathType Leaf) {
+    $InstallerDest = Join-Path $InstallDir "install.ps1"
+    $InstallerTmp = "$InstallerDest.new"
+    try {
+        Copy-Item -LiteralPath $DownloadedInstaller -Destination $InstallerTmp -Force -ErrorAction Stop
+        Move-Item -LiteralPath $InstallerTmp -Destination $InstallerDest -Force -ErrorAction Stop
+        Write-Host "Installed updater -> $InstallerDest"
+    } catch {
+        Remove-Item -LiteralPath $InstallerTmp -Force -ErrorAction SilentlyContinue
+        Write-Host "note: could not place install.ps1 in $InstallDir (update will explain where to find it)"
+    }
+}
+
 # Verify
 try {
     $ver = & $Dest --version 2>&1
 
@@ -268,6 +268,32 @@ if [ "$SKIP_CONFIG" = true ]; then
 fi
 "$DLBIN" install "${INSTALL_ARGS[@]}"
 
+# Place the installer beside the binary so `update` can point at a local file
+# instead of a URL, and so the next update uses THIS release's installer.
+#
+# Two things make this safe. The source is the copy from the archive we just
+# checksum-verified -- never "$0", which does not exist under `curl | bash` and
+# would pin us to the OLD installer forever. And it is published by atomic
+# rename, never by writing over the live path: bash reads a script incrementally
+# by byte offset, so overwriting the file it is executing continues reading the
+# NEW bytes at the OLD offset. That fails silently and bizarrely, which is worse
+# than failing loudly.
+#
+# Best effort by design: a user who cannot write to INSTALL_DIR still gets a
+# working install, and `update` falls back to explaining where to find it.
+DL_INSTALLER="$DLDIR/install.sh"
+if [ -f "$DL_INSTALLER" ]; then
+    INSTALLER_TMP="$INSTALL_DIR/.install.sh.$$"
+    if cp "$DL_INSTALLER" "$INSTALLER_TMP" 2>/dev/null &&
+        chmod 755 "$INSTALLER_TMP" 2>/dev/null &&
+        mv -f "$INSTALLER_TMP" "$INSTALL_DIR/install.sh" 2>/dev/null; then
+        echo "Installed updater -> $INSTALL_DIR/install.sh"
+    else
+        rm -f "$INSTALLER_TMP" 2>/dev/null || true
+        echo "note: could not place install.sh in $INSTALL_DIR (update will explain where to find it)"
+    fi
+fi
+
 # Verify
 VERSION=$("$DEST" --version 2>&1) || {
     echo "error: installed binary failed to run" >&2
 
@@ -113,16 +113,30 @@ NAME="codebase-memory-mcp${SUFFIX}-${GOOS}-${GOARCH}"
 strip_release_binary() {
     local binary="$1"
     [ -f "$binary" ] || return 0
+    # The right flags differ per format, and the WRONG ones fail silently in
+    # the dangerous direction. Measured on the flagged darwin-arm64 artifact:
+    #
+    #   llvm-strip --strip-all   373 symbols   scanned CLEAN
+    #   strip        (no flags)  378 symbols   equivalent
+    #   strip -x -S             4058 symbols   the state VirusTotal FLAGGED
+    #   strip -X / -u -r        4058 symbols   likewise
+    #
+    # Apple's strip returns success for `-x -S`, so a helper that just tries
+    # candidates until one exits 0 would quietly reship the flagged binary.
+    # GNU/LLVM `--strip-all` is not even accepted by Apple's strip, which is why
+    # generalising it to every platform broke the macOS build -- loudly, which
+    # was the lucky outcome.
+    #
+    # So: --strip-all where it is understood, plain `strip` for Mach-O, and a
+    # hard error when no candidate can do the job. Never a weaker fallback.
     local stripped=""
     for tool in "${STRIP:-}" llvm-strip strip; do
         [ -n "$tool" ] || continue
         command -v "$tool" >/dev/null 2>&1 || continue
-        if [ "$GOOS" = "darwin" ]; then
-            # -x keeps external symbols: a full strip of a Mach-O can leave an
-            # image dyld will not load.
-            "$tool" -x "$binary" 2>/dev/null && stripped="$tool"
-        else
-            "$tool" --strip-all "$binary" 2>/dev/null && stripped="$tool"
+        if "$tool" --strip-all "$binary" 2>/dev/null; then
+            stripped="$tool --strip-all"
+        elif [ "$GOOS" = "darwin" ] && "$tool" "$binary" 2>/dev/null; then
+            stripped="$tool"
         fi
         [ -n "$stripped" ] && break
     done
 
@@ -123,15 +123,55 @@ def start_suite(
     )
 
 
+def windows_descendants(pid: int, timeout: int) -> bool:
+    """True if any live process still claims `pid` as its parent.
+
+    Used only when the suite leader has already exited: `taskkill /T` cannot
+    walk a tree from a dead PID, so cleanup is proven by asking whether anything
+    is still parented to it. One level deep on purpose -- Windows does not
+    reparent orphans, so a grandchild keeps pointing at its own (dead) parent
+    and would not be found here. That is a weaker proof than taskkill /T, which
+    is why it is reserved for the case where the strong proof is impossible.
+    """
+    try:
+        completed = subprocess.run(
+            [
+                "powershell.exe",
+                "-NoProfile",
+                "-NonInteractive",
+                "-Command",
+                "@(Get-CimInstance Win32_Process -Filter "
+                f"'ParentProcessId={pid}').Count",
+            ],
+            check=False,
+            stdin=subprocess.DEVNULL,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return True  # cannot prove absence -> assume the worst
+    if completed.returncode != 0:
+        return True
+    return (completed.stdout or "").strip() not in ("0", "")
+
+
 def terminate_process_tree(active: ActiveSuite, kill_grace: int) -> None:
     process = active.process
     leader_exited = process.poll() is not None
     if os.name == "nt":
         if leader_exited:
-            raise RuntimeError(
-                f"suite {active.name!r} leader exited before Windows tree cleanup "
-                "could be proven"
-            )
+            # The leader can exit on its own between the timeout decision and
+            # this call. Refusing outright made the harness itself lose a race:
+            # a natural exit at the wrong moment failed the whole wave, which is
+            # how a deliberately-hanging fixture suite reddened a release run.
+            # taskkill /T cannot walk a tree from a dead PID, so prove cleanup
+            # the only way still available -- nothing is parented to it.
+            if windows_descendants(process.pid, kill_grace):
+                raise RuntimeError(
+                    f"suite {active.name!r} leader exited leaving live descendants"
+                )
+            return
         try:
             completed = subprocess.run(
                 [