[thcp]

The portable Windows build now keeps what it writes inside its own folder. Before this change a portable run still wrote a copy of settings.json to %LOCALAPPDATA%\StemDeck, matplotlib's font cache to %LOCALAPPDATA%\matplotlib, its temporary files (WebView2, Python, uploads over 1 MB) to the Windows temp folder, and on the NVIDIA build pip's cache of the CUDA torch wheels to %LOCALAPPDATA%\pip. Follows #897, which moved the WebView2 profile to data\webview. Part of #399.

What changes

• desktop/src-tauri/src/main.rs
  • portable_env and apply_portable_env: one place, first thing in main, before Tauri starts any thread. For a portable package only, the process sets TEMP, TMP, TMPDIR to data\tmp, PIP_CACHE_DIR to data\cache\pip and MPLCONFIGDIR to data\cache\matplotlib. The shell, WebView2 and every child (backend, model warmup, pip) inherit them, so no spawn site needs its own patch.
  • If data\tmp cannot be created, nothing is redirected and data\logs\setup.log says so.
  • with_user_env: open_url and Reveal start explorer.exe with the user's own TEMP, TMP, TMPDIR, PIP_CACHE_DIR and MPLCONFIGDIR, so a browser started cold from it does not keep the portable folder as its temp folder.
  • settings_mirror: the backend is no longer given STEMDECK_SETTINGS_MIRROR in a portable package. An installed app gets exactly the value it got before.
• app/core/settings.py: docstring of _mirror_settings only, to match.
• packaging/windows/README-WINDOWS.txt: says what stays in the folder, what is outside only because the user chose it, and what Windows writes that StemDeck cannot move.

Nothing changes for installed builds, macOS or Linux: portable.txt only ships in the Windows zip, and without it portable_env is empty and settings_mirror is unchanged.

Every location a portable run writes

Measured by running the real CPU package, built with scripts/windows/make-portable.ps1 -CpuOnly, with LOCALAPPDATA, APPDATA, TEMP, TMP, USERPROFILE and HOME pointed at empty throwaway folders, through first-run setup, one upload separated end to end (a 12 s, 2.1 MB WAV), and quit. Two runs of the old build and three of the fixed build (the last one on the final commit); listings after each phase.

Location	Before	After	Evidence	Fix
data\ settings, config, logs, ffmpeg, models, jobs, certs, downloads, webview	in folder	in folder	package data\ listing	none needed
data\cache\huggingface (model downloads)	in folder	in folder	data\cache\ listing	none needed (shell sets XDG_CACHE_HOME, TORCH_HOME)
%LOCALAPPDATA%\StemDeck\settings.json	outside	gone	old runs: LocalAppData\StemDeck\settings.json (14 B) written when the backend started; fixed runs: absent	settings_mirror returns None for portable
%LOCALAPPDATA%\matplotlib\fontlist-v3.11.0.json	outside	data\cache\matplotlib	old runs: 83 634 B file during setup; fixed runs: absent, data\cache\matplotlib present	MPLCONFIGDIR
%TEMP%	outside	data\tmp	old runs: Temp\<guid>.tmp while running; fixed runs: Temp empty in every phase, data\tmp holds msedgeedge_BITS_* (WebView2) and the <guid>.tmp	TEMP, TMP, TMPDIR
Upload spool (Starlette rolls a multipart body over 1 MB to tempfile)	outside (transient)	data\tmp	not visible in a listing because it is deleted when the request ends; tempfile.gettempdir() under the same environment printed the sandbox Temp folder	same as above
%LOCALAPPDATA%\pip\Cache (NVIDIA build, CUDA torch install)	outside	data\cache\pip	not exercised by the CPU build; the packaged python -m pip cache dir printed the profile path without the variable and data\cache\pip with it	PIP_CACHE_DIR
%USERPROFILE%\AppData\Local\Microsoft\{IdentityCache, Windows\INetCache, INetCookies, History, Feeds Cache, Internet Explorer}	outside	not seen	written at quit in both old runs, absent in both fixed runs	not identified which component wrote them; the fixed runs simply do not show them
%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.3.db	outside	outside	both builds, when the main page loads	cannot be moved: Windows shell cache, written by Windows components
%USERPROFILE%\AppData\Local\NVIDIA\DXCache, LocalLow\NVIDIA\DXCache	outside	outside	both builds, when WebView2's GPU process starts	cannot be moved: the graphics driver's shader cache
Prefetch, file dialog folder history (registry), Windows Firewall rule	outside	outside	not measured, Windows behaviour for any program	cannot be moved
WebView2 runtime	system	system	installed by Windows	cannot be moved
Library moved in Settings, export and save folders the user picks	outside by choice	outside by choice	by design	allowed by the rule
Documents\StemDeck\jobs, only when it already holds a library from an older install	outside	outside	documents_dir_for_jobs	kept on purpose: switching it off would hide an existing library
%LOCALAPPDATA%\StemDeck\settings.json read on first run of a fresh folder	read only	read only	ensure_workspace	reading is not writing; kept

The real profile was never used: during every run the real %LOCALAPPDATA%\app.stemdeck.desktop\EBWebView and %LOCALAPPDATA%\StemDeck had no new or modified entries.

Tests

• New Rust tests in main.rs: a_portable_package_sends_temp_and_tool_caches_into_data, an_installed_app_keeps_the_system_temp_and_caches, only_an_installed_app_mirrors_its_settings_to_the_profile, a_program_started_for_the_user_gets_the_users_temp_back. Against the old code they do not build (error[E0425]: cannot find function portable_env and settings_mirror), and the old code passed the mirror to every backend; with the change all three pass.
• cargo fmt --check, cargo clippy --tests -- -D warnings, cargo test (216 passed, 0 failed) in desktop/src-tauri.
• No Python change, so no new Python test: the backend already resolves its cache, logs, models and downloads inside STEMDECK_DATA_DIR (tests/test_config.py::test_data_dir_moves_default_runtime_dirs); the stray writes came from what the shell handed it and from third-party libraries, which the shell now points into the folder.

How installed behaviour was kept

• portable_env returns nothing without portable.txt in the app root, so apply_portable_env sets no variable (an_installed_app_keeps_the_system_temp_and_caches).
• settings_mirror returns the same shared_settings_dir()\settings.json the old inline code passed (only_an_installed_app_mirrors_its_settings_to_the_profile).
• Not run as an installed build: on Windows Tauri resolves an installed app's WebView2 profile through the known-folder API, so a sandboxed run would have used the real %LOCALAPPDATA%\app.stemdeck.desktop.

Not verified

• The NVIDIA build's CUDA install end to end (no NVIDIA package was run); PIP_CACHE_DIR is proven by pip cache dir only.
• Clicking a link or Reveal in the running app, which now passes the user's own environment to explorer.exe (unit-tested through restore_env, not clicked by hand).
• data\tmp is not swept at startup. After quit it was empty in two of the three fixed runs; the third left one WebView2 msedgeedge_BITS_* folder left by WebView2.

Review

Rust and security reviewers read the diff. Taken: log a failed data\tmp to setup.log instead of stderr; give Explorer the user's environment back; look TEMP up by name; update the Python docstring. Not taken: both suggested matplotlib uses %USERPROFILE%\.matplotlib on Windows, but matplotlib 3.11 in this package was measured writing %LOCALAPPDATA%\matplotlib\fontlist-v3.11.0.json, so the comment stays. The security reviewer also noted that C:\StemDeck, the folder the not-writable message suggests, inherits Modify for Authenticated Users from C:\; that predates this change and applies equally to python\ and StemDeck.exe, so it is a separate item.

Does not touch uv.lock. Changes the shell binary, so it reaches users through the app update.