Context

Programs built with Microsoft's compiler need its C runtime (VCRUNTIME140.dll), which many Windows PCs don't have. The app already links it statically (tauri-build does that), but leashd and leash didn't, so on such a PC the background service couldn't start. The PHP builds from windows.php.net and the Windows MySQL and PostgreSQL downloads need the same runtime as a DLL, and Short Leash can't rebuild those.

Decision

The release build links the runtime statically into leashd and leash (-C target-feature=+crt-static in scripts/build-sidecars.sh, for *-windows-msvc targets only). The release workflow fails if either still imports VCRUNTIME140.dll.
The NSIS installer carries Microsoft's Visual C++ Redistributable (x64). After installing Short Leash, its hook (src-tauri/windows/hooks.nsh) runs the Redistributable only when the runtime is missing or older than the bundled one: it compares Minor and Bld under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 with the bundled file's version, which the fetch script writes to vc_redist.version.nsh.
The Redistributable is fetched when Short Leash is built (scripts/fetch-vcredist.ps1, from aka.ms/vs/18/release/vc_redist.x64.exe, Visual Studio 2026's: PHP 8.6's builds need 14.51 or later, which Visual Studio 2022's doesn't have). Microsoft publishes no checksum for it, so it's kept only with a valid Authenticode signature from Microsoft Corporation.
The AI helpers (leash-voice.exe and leash-llm.exe) and their engines' DLLs use the runtime as a DLL (0060): the engines are built with /MD, and one C runtime has to be shared across them. Before starting a helper, Short Leash checks that the runtime's DLLs are in System32, and says to run the installer again when they aren't, instead of Windows's own error box.
When a program Short Leash runs exits with STATUS_DLL_NOT_FOUND, whether a supervised process or a database's first-time setup, Short Leash says that a Windows DLL is missing and how to add the runtime, after any output the program printed. When PHP says its VCRUNTIME140.dll is older than the one it was built with, Short Leash says which version that PHP needs and to install the latest Redistributable from Microsoft, when it's installed and when a site's PHP can't start.
CI builds the NSIS installer on Windows with the hook, a stand-in Redistributable and placeholder sidecars, so a broken hook fails the pull request rather than the release.

Consequences

leashd and the CLI start on any 64-bit Windows 10 or 11, whatever is installed.
The installer is about 25 MB larger. On a PC without the runtime, installing shows one more Windows administrator prompt, from Microsoft's installer; declining it leaves Short Leash installed, and PHP and the databases then fail with the message above until the runtime is added.
Updates run the same installer, so existing installs get the runtime on their next update.
Uninstalling Short Leash leaves the runtime in place, since other programs share it.
Building the Windows installer needs the fetch script first; the hook refuses to compile without the file.