Zero warnings: dish-windows (#89)

## Summary

The dish-windows part of the fleet-wide zero-warnings, zero-suppressions
pass. Every warning the three CI lanes printed on `main` (Windows CI,
CodeQL, Security) is fixed at its cause, every first-party `(void)`
discard and `NOLINT` is gone, the clang-tidy sweep now blocks, and the
tests build under `/WX` like the rest of the code.

## What was fixed, by category

**Compiler warnings (214 lines on the last `main` run of Windows CI, 9
in CodeQL)**

- `C5287` x 18 (9 per configuration): the cgutman ENet fork ORs an
`ENetProtocolCommand` with an `ENetProtocolFlag` in nine places.
`cmake/enet-msvc-c5287.patch` adds the `enet_uint8` casts the compiler
asks for (the assigned field is an `enet_uint8` already, so the runtime
bytes do not change) and `cmake/PatchEnet.cmake` applies it as the
FetchContent patch step, recognising an already patched tree because
ExternalProject re-runs the step on every update. Documented in
`THIRD_PARTY.md`; the `.patch` is pinned to LF in `.gitattributes`.
- `D9025` x 181 ("overriding '/Zi' with '/Z7'", every TU of `dish_core`
and `Dish` in Debug): the sentry block's raw `/Z7` sat on top of the
`/Zi` CMake bakes into the Debug flags. With CMake 3.25 (CMP0141) the
format is a target property, so `MSVC_DEBUG_INFORMATION_FORMAT=Embedded`
replaces the flag instead of overriding it. Same flags as before on
every target and configuration. The CMake floor moves from 3.21 to 3.25
(CMakeLists, presets, README).
- `C4244` x 4: the two ranged-for loops over brace lists in the tests
iterate a `std::array` of the element type.

**clang-tidy findings (20 on `main`, plus 1 that clang-tidy 22 adds)**

- `modernize-return-braced-init-list` x 7,
`bugprone-misplaced-widening-cast` x 5, `cert-err34-c` x 2
(`std::from_chars` replaces `atoi`), `bugprone-exception-escape` x 3 and
`performance-unnecessary-copy-initialization` x 1 in `MoonlightSession`
(the lambdas capture non-const movable copies through init-captures, so
the closures' implicit special members move instead of copy),
`readability-inconsistent-declaration-parameter-name` x 1,
`performance-no-automatic-move` x 1,
`bugprone-throwing-static-initialization` x 1 (`kFallbackUniqueId` is a
`constexpr QStringView`).
- `main.cpp`: the two pre-logger stderr lines go through
`QTextStream(stderr)`, the same bytes `fprintf` wrote, with no result to
discard (`cert-err33-c`) and no iostream failure path for
`bugprone-exception-escape` to report on `main`.

**Discards and suppressions removed (first-party)**

- 32 `(void)` discards: replaced by logging where the result carries
information (`dish.update.staging`, `dish.update.download`,
`dish.update`), by a returned value (`publishMotion`), by unnamed
parameters (`UsbDeviceGateway`), and in tests by assertions where the
value is known or plain calls where only the absence of a throw is under
test.
- 4 `NOLINT`s: the two empty catch blocks in the audio engines'
destructors now log through `dish.audio`; `SDLGamepadBridge.h` includes
`SDL_events.h` instead of forward-declaring SDL's reserved-identifier
struct tags.
- `_CRT_SECURE_NO_WARNINGS` and `_WINSOCK_DEPRECATED_NO_WARNINGS`
dropped from `dish_warnings`: both configurations build clean without
them.
- `-Wno-unused-command-line-argument` dropped from the tidy script: the
sweep reads a copy of the compile database with `/Zc:preprocessor`
removed (clang-cl's preprocessor conforms already, so the flag is
meaningless to it and its driver reported it as unused). Every other
MSVC flag clang-cl understands, so nothing is silenced.
- `/wd4702` on the whole `Dish` target narrowed to the
qmlcachegen-generated units it exists for (see "Left in place" below).

**Gates**

- `scripts/check-tidy.ps1` passes `--warnings-as-errors='*'` on the
command line, the way `linux-ci.yml` gates its sweep, so findings fail
CI while the fleet-canonical `.clang-tidy` (`WarningsAsErrors: ''`)
stays unforked. The script takes `-Files`, and the pre-commit hook runs
it over the staged sources in CI's file set, so a finding stops the
commit before it would stop the PR.
- Tests link `dish_strict` (`/WX`); Catch2's FetchContent declaration
takes `SYSTEM` (CMake 3.25) so its headers are external includes under
`-external:W0`.
- `codeql.yml`: the analyze step loses `continue-on-error` and `upload:
failure-only`, as its own comment said to do once the repository went
public (code scanning is active, 0 open alerts).
`CODEQL_OVERLAY_DATABASE_MODE=none` declares the mode the action fell
back to on every run after warning that a traced build cannot use
overlay analysis.
- `_security.yml`: dependency review loses its `continue-on-error` for
the same reason. That exposed the truth: the action fails with
"Dependency review is not supported on this repository. Please ensure
that Dependency graph is enabled", so it had never reviewed anything
here. `security.yml` now passes `dependency_review_enabled: false` with
the precondition spelled out (see below). `CONTRIBUTING.md`,
`SECURITY.md` and the PR template follow.
- `lukka/run-vcpkg` v11.5 -> v11.6 in all three workflows: it runs on
Node 24, which ends the "Node.js 20 is deprecated" notice for that
action. Nothing in its behaviour changed between the tags.

## qmllint: the last lowered level, closed

The one item this pass had left open. `scripts/check-qml.ps1` ran
`qmllint` with `--unqualified info` because `App` was a runtime context
property, so all 386 `App.x` reads in the QML tree came back as
`Unqualified access`, 278 diagnostics, and the category could not gate
anything. That level is back at its default, and `qmllint` over all 68
tracked QML files now reports nothing, in any category, at every
category's default level. No `// qmllint disable`, no pragma, no other
level touched.

`App` is a `Dish.Chrome` singleton now, spelled exactly as before in
QML. `AppViewModel` and the two role models stay in `dish_core`, which
links no Qml so the tests can keep exercising them without the Quick
stack, so they cannot carry `QML_ELEMENT` themselves;
`src/qml/chrome/ForeignTypes.h` declares their QML identities from the
`Dish` target with `QML_FOREIGN` instead, and
`qt_extract_metatypes(dish_core)` is what lets `qmltyperegistrar` read
their meta-objects and expand those declarations into the module's
generated `qmltypes`. That header is the whole of the new C++: 67 lines,
no logic.

Runtime behaviour is unchanged. `App` is registered by instance in
`QmlEntryPoint` exactly as `ChromeBridge`, `Theme` and `Tokens` already
are, for the reason those three already document: this target's LTCG
strips the generated `QQmlModuleRegistration` initializer, so a
declarative-only name would never reach the engine. The foreign
declaration's `create()` returns that same instance, so it cannot matter
which of the two registrations the engine resolves, and an explicit
`CppOwnership` keeps the engine from deleting a stack object.

One QML file changed, by one line: `shared/BindingDraft.qml` reads `App`
and was the only one of the 68 not already importing `Dish.Chrome` for
`Theme` and `Tokens`.

Verified past the linter, because the registration-stripping risk lives
in the shipping configuration: the Debug tree's 2229 tests pass, and the
Release build with LTCG, staged through `scripts/stage-bundle.ps1` and
launched from a scratch directory by `scripts/test-portable-bundle.ps1`,
stays up with an otherwise empty stderr. A singleton that failed to
resolve would print a binding error for every page that reads it, and
that gate reads stderr. `docs/QML_CONTRACT.md`, `docs/QML_UI_KIT.md` and
`CONTRIBUTING.md` no longer describe a gap that is not there.

## Left in place, with the reason

- `/wd4702` on the qmlcachegen-generated `*_qml.cpp` units only. MSVC's
optimizer reports unreachable code inside Qt's own `QJSEngine` and
`QVariant` templates (their `if constexpr` early returns) when the
AOT-compiled QML instantiates them; it fires in Release with and without
LTCG, and Qt 6.9 still has the pattern. `C4702` is a back-end warning,
which `/external:W0` cannot reach: Microsoft documents this under
`/external`, "Limitations", and names `/wd47XX` as the remedy. The only
alternatives change the shipped binary (`NO_CACHEGEN`, or `/Od` for
those units), so the option stays, scoped to the generated files;
`main.cpp`, the crash handler and the bridges keep `C4702` live.
- Dependency review: it needs the repository's Dependency graph, a
setting under Settings, Code security that I could not change (the
permission was denied, rightly). Enable it, flip
`dependency_review_enabled` to `true` in `security.yml`, and the job
blocks from then on.
- The `::warning::` the OSV-Scanner job prints on every run ("found no
package sources"): OSV-Scanner has no support for `vcpkg.json`, so the
job scans nothing in this repository; the shared security workflow
deliberately reports that rather than hiding it. Worth a fleet-level
decision (feed it an SBOM, or skip the job here), not a unilateral
change in this PR.
- `ilammy/msvc-dev-cmd` still declares Node 20 (no release targets Node
24), so its half of the deprecation notice remains; replacing the action
with a vswhere/vcvars import step is out of scope here.
- The release lane's best-effort `continue-on-error` steps (Sentry
symbol upload, Sentry release, Grype SARIF upload) are deliberate
release semantics and were not touched.
- `N warnings generated.` lines in the clang-tidy step's log are clang's
count of findings in Qt's and the STL's headers, which the header filter
drops; they are not findings.

## Judgment calls recorded

- CMake floor 3.21 -> 3.25 (November 2022): needed for CMP0141 and
FetchContent `SYSTEM`; the CI image and the documented local setup are
far newer.
- `dish.audio` (not `dish.audio.teardown`) for the new logging category,
following the `dish.<area>` convention of the existing categories.
- The RTSP `CSeq` parse accepts only a whole-value integer; `atoi` used
to return the digit prefix of a malformed value. Nothing but the tests
reads the field.
- The pre-commit hook now blocks on tidy findings (it used to be
advisory), matching the CI gate; it only ever ran when `core.hooksPath`
points at `.githooks`.

## Verification

- `cmake --preset debug` (fresh tree) + `cmake --build --parallel 8`:
637 steps, 0 warnings. `ctest --parallel --output-on-failure`: 2227/2227
passed.
- `cmake --preset release` from a wiped `build-release` (fresh ENet
population, patch applied: 2 + 6 + 1 casts in `host.c`, `peer.c`,
`protocol.c`) + build of `Dish` and `dish_setup_image`: 346 steps, 0
warnings, LTCG link included. The already populated debug tree was
patched in place on the next reconfigure, and the reverse check leaves a
patched tree alone.
- `scripts/check-tidy.ps1`: `clang-tidy: OK (100 files)`, 0 findings,
under the gate.
- `scripts/check-format.ps1` (clang-format 22.1.4): OK (495 files).
- `scripts/check-qml.ps1`: OK (68 files).
- No em-dashes in any added text; every diff is line-level (CRLF files
kept their endings).

## Review follow-ups (three commits on the same branch)

- `tests/test_moonlight_rtsp.cpp`: two cases pin the edges that
`std::from_chars` changed. A trimmed, whole-integer `CSeq` still counts
(padding, tabs, `INT_MAX`, a negative); a digit prefix with trailing
text, a leading `+`, an empty value or an overflow leaves the default,
where `atoi` answered the prefix or had no defined answer. `server_port`
reads the digit run after the key whatever follows it (`\r`, `;`,
letters); a space or sign directly after the key, or a run that does not
fit an `int`, is no port.
- `CMakeLists.txt` + `CONTRIBUTING.md`: the D9025 fix only held for a
fresh tree. CMake fills `CMAKE_<LANG>_FLAGS_<CONFIG>` once, so a
`build/` configured before the 3.25 floor keeps `/Zi` in its cached
Debug flags, and on that tree the Embedded property put `/Z7` on top of
it again (verified in place: 3.21-configured tree, reconfigured after
the bump, D9025 back). The configure now refuses such a tree with the
one-time remedy, delete its `CMakeCache.txt`. A fresh tree passes in
Debug, Release and RelWithDebInfo; CI trees are fresh on every run (only
the vcpkg binary cache persists), so nothing changes there.
- `tests/CrtAssertToStderr.cpp`: the last `[[maybe_unused]]` in
first-party code is gone; the hook object exists for its constructor,
which no compiler here warns about.

Re-verified on the final tip: Debug build 0 warnings, `ctest` 2229/2229
(2227 + the two new cases), `check-tidy.ps1` OK (100 files, and the gate
was shown to fail on a planted finding), `check-format.ps1` OK (495),
`check-qml.ps1` OK (68).

---------

Co-authored-by: Emir Hasanbegovic <1190336+emir-hasanbegovic@users.noreply.github.com>

Author: emir-hasanbegovic

.gitattributes

@@ -15,6 +15,9 @@
 *.sh text eol=lf
 *.py text eol=lf
 
+# Fed to `git apply` by cmake/PatchEnet.cmake; one byte-exact form everywhere.
+*.patch text eol=lf
+
 # cmd.exe mis-parses `goto` / `call` labels in an LF-only batch file.
 # PowerShell tolerates LF, but every Windows editor and signer expects CRLF.
 *.bat  text eol=crlf

.githooks/pre-commit

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Reformats staged C/C++ sources in place with clang-format and re-stages
-# them, then runs clang-tidy advisory-only. Skips either tool if it is not
-# installed; CI enforces both in strict mode. Runs under Git for Windows'
-# bundled bash, no WSL needed.
+# them, then runs CI's clang-tidy gate over the staged sources in its file
+# set. Skips either tool if it is not installed; CI enforces both. Runs under
+# Git for Windows' bundled bash, no WSL needed.
 #
 # This file must stay LF-terminated: a CRLF checkout makes the kernel look
 # for an interpreter named "bash\r" and the hook silently never runs.
@@ -30,22 +30,27 @@ else
     echo "⚠  clang-format not installed — skipping (winget install LLVM.LLVM)"
 fi
 
-# ── clang-tidy (advisory) ────────────────────────────────────────────────
-# Advisory to match CI: .clang-tidy's WarningsAsErrors='' is authoritative,
-# so a stylistic finding must not block a commit.
+# ── clang-tidy ───────────────────────────────────────────────────────────
+# scripts/check-tidy.ps1 is the gate CI runs (its flags, its compile database
+# view, findings fail); here it takes only the staged files in CI's set
+# (src/**/*.cpp outside src/UI/), so a finding stops the commit before it
+# would stop the pull request.
 if command -v clang-tidy >/dev/null 2>&1; then
     # build/ is the debug preset's binaryDir (CMakePresets.json), the same
     # tree CI lints against.
     if [ -f build/compile_commands.json ]; then
         cpp_files=()
         while IFS= read -r f; do
             case "$f" in
-                *.cpp) cpp_files+=("$f") ;;
+                src/UI/*) ;;
+                src/*.cpp) cpp_files+=("$f") ;;
             esac
         done <<<"$staged"
         if [ "${#cpp_files[@]}" -gt 0 ]; then
-            echo "▶ clang-tidy -p build (${#cpp_files[@]} file(s))"
-            clang-tidy -p build --quiet "${cpp_files[@]}" || true
+            echo "▶ clang-tidy (${#cpp_files[@]} file(s))"
+            files_csv=$(IFS=,; echo "${cpp_files[*]}")
+            powershell.exe -NoProfile -ExecutionPolicy Bypass \
+                -File scripts/check-tidy.ps1 -BuildDir build -Files "$files_csv"
         fi
     else
         echo "⚠  build/compile_commands.json missing — run scripts/build.ps1 debug"

.github/pull_request_template.md

@@ -14,15 +14,15 @@
 ## CI gates
 
 `windows-ci.yml` runs these on every pull request, in this order. Tick what you
-ran locally. Everything except `clang-tidy` fails the build.
+ran locally. Every one of them fails the build.
 
 - [ ] **`clang-format --dry-run --Werror`** over `src/` and `tests/`. CI pins
       clang-format **22.1.4** from PyPI. Version 18 and version 22 disagree on
       braced-init lists, so a different local version will flap.
       `pipx install clang-format==22.1.4`
 - [ ] **Debug build** configured with `-DDISH_BUILD_TESTS=ON
       -DDISH_REQUIRE_TRANSLATIONS=ON`, warnings clean (`/WX` is on for
-      first-party code)
+      first-party code, tests included)
 - [ ] **`ctest --output-on-failure --parallel`** passes
 - [ ] **`qmllint`** clean over every tracked `src/qml/*.qml`. Must run after the
       build, because the `Dish.Chrome` qmldir and qmltypes are generated into the
@@ -37,9 +37,10 @@ ran locally. Everything except `clang-tidy` fails the build.
       `cmake --build <build-dir> --target update_translations`, then commit the
       changed `.ts` files. A new `%n` plural also needs its singular and plural
       written into `translations/dish_en.ts` by hand.
-- [ ] **`clang-tidy -p build`** over `src/*.cpp` excluding `src/UI/*`, against the
-      same Debug tree. Advisory: `.clang-tidy` sets `WarningsAsErrors: ''` and
-      the step does not fail. Read the findings anyway.
+- [ ] **`scripts/check-tidy.ps1`** (`clang-tidy` over `src/*.cpp` excluding
+      `src/UI/*`, against the same Debug tree). Findings fail the step: it
+      passes `--warnings-as-errors='*'`, the way `dish-linux` gates its sweep,
+      while the fleet-canonical `.clang-tidy` keeps `WarningsAsErrors: ''`.
 - [ ] **Release build** configures and builds
 
 `scripts\build.ps1 debug test` reproduces the build and test steps. The security

.github/workflows/_security.yml

@@ -206,10 +206,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # Needs Advanced Security, which a private repo does not have; the step
-      # is advisory until then. Drop continue-on-error once public.
+      # Blocking: the repository is public, so the dependency graph this
+      # action reads is available.
       - name: Review changed dependencies
-        continue-on-error: true
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           fail-on-severity: high

.github/workflows/codeql.yml

@@ -43,6 +43,11 @@ jobs:
       # provider is backed by the actions/cache step below; windows-ci.yml
       # uses the same key, so the two lanes share archives.
       VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}\vcpkg-bincache,readwrite
+      # Overlay (incremental) analysis needs build-mode none; this lane traces
+      # a real MSVC build, so the action would try, warn that it cannot, and
+      # fall back to a full database on every run. Declaring the mode it ends
+      # up in anyway keeps the init step's log clean.
+      CODEQL_OVERLAY_DATABASE_MODE: none
 
     steps:
       - name: Checkout
@@ -89,7 +94,7 @@ jobs:
             vcpkg-bin-${{ runner.os }}-
 
       - name: Set up vcpkg
-        uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
+        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6
         with:
           vcpkgGitCommitId: ${{ env.VCPKG_COMMITID }}
 
@@ -115,8 +120,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           # security-extended without security-and-quality: the quality suite
-          # tripled the query count for maintainability findings that, like
-          # everything here pre-GHAS, surface only in the logs.
+          # tripled the query count for maintainability findings.
           queries: security-extended
 
       # 4 = the windows-2022 runner's vCPU count; Ninja's cores+2 default
@@ -127,12 +131,10 @@ jobs:
         shell: pwsh
         run: cmake --build build-release --parallel 4 --target Dish
 
+      # Blocking, and the SARIF is uploaded: the repository is public, so code
+      # scanning is available and the findings land as alerts instead of only
+      # in this log.
       - name: Perform CodeQL analysis
-        # SARIF upload needs Advanced Security, which a private repo does not
-        # have. Findings still surface in the logs. Drop continue-on-error and
-        # `upload: failure-only` once the repo is public.
-        continue-on-error: true
         uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: "/language:${{ matrix.language }}"
-          upload: failure-only

.github/workflows/release.yml

@@ -38,7 +38,7 @@ on:
 #   actions/checkout                @ v7.0.1  → 3d3c42e5aac5ba805825da76410c181273ba90b1
 #   ilammy/msvc-dev-cmd             @ v1.13.0 → 0b201ec74fa43914dc39ae48a89fd1d8cb592756
 #   jurplel/install-qt-action       @ v4.3.1  → 48d3ad6db93f3627c8ee7a0454bc6f3744f7e730
-#   lukka/run-vcpkg                 @ v11.5   → 5e0cab206a5ea620130caf672fce3e4a6b5666a1
+#   lukka/run-vcpkg                 @ v11.6   → b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2
 #   actions/upload-artifact         @ v7.0.1  → 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
 #   actions/download-artifact       @ v8.0.1  → 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
 #   softprops/action-gh-release     @ v3.0.2  → 3d0d9888cb7fd7b750713d6e236d1fcb99157228
@@ -178,7 +178,7 @@ jobs:
           cache: true
 
       - name: Set up vcpkg + install dependencies
-        uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
+        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6
         with:
           vcpkgGitCommitId: ${{ env.VCPKG_COMMITID }}
 

.github/workflows/security.yml

@@ -29,6 +29,10 @@ jobs:
       osv_scan_paths: |
         .
       gitleaks_enabled: true
-      dependency_review_enabled: true
+      # Off until the repository's Dependency graph is switched on (Settings,
+      # Code security). dependency-review-action reads that graph and fails
+      # without it, so on this repository the job has never reviewed anything.
+      # Flip to true once the setting is on; the job then blocks.
+      dependency_review_enabled: false
       action_pin_lint_enabled: true
       allowlist_expiry_enabled: true

.github/workflows/windows-ci.yml

@@ -85,7 +85,7 @@ jobs:
             vcpkg-bin-${{ runner.os }}-
 
       - name: Set up vcpkg + install dependencies
-        uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
+        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11.6
         with:
           vcpkgGitCommitId: ${{ env.VCPKG_COMMITID }}
 

CMakeLists.txt

@@ -1,12 +1,18 @@
-cmake_minimum_required(VERSION 3.21)
+# 3.25 for two things the warning-free build rests on: CMP0141, which hands the
+# MSVC debug-information format to a target property instead of baking /Zi into
+# the Debug flags (so a /Z7 target no longer overrides it, D9025), and the SYSTEM
+# option of FetchContent_Declare, which keeps /W4 /WX off Catch2's headers.
+cmake_minimum_required(VERSION 3.25)
 project(Dish
     VERSION 2.1.0
     DESCRIPTION "Dish Windows client for the Satellite gamepad-over-LAN protocol"
     # C is enabled for the vendored ENet fork (Moonlight control stream), whose
     # backend is pure C; everything first-party is C++.
     LANGUAGES C CXX)
 
-set(CMAKE_CXX_STANDARD 17)
+# C++20, in step with dish-linux (where it retires the pedantic warning on
+# Qt's zero-argument streaming log macros).
+set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CXX_EXTENSIONS OFF)
 
@@ -37,9 +43,10 @@ if(DISH_ENABLE_LTO AND CMAKE_BUILD_TYPE STREQUAL "Release")
     endif()
 endif()
 
-# dish_warnings is applied everywhere including tests; dish_strict adds
-# /WX (-Werror) and is applied only to first-party code, so Catch2's headers
-# can't fail the build.
+# dish_warnings carries the warning set, dish_strict adds /WX (-Werror). Both
+# apply to every first-party target, tests included; third-party headers stay
+# out of their reach as SYSTEM (external) includes, Catch2's via the SYSTEM
+# option in tests/CMakeLists.txt.
 add_library(dish_warnings INTERFACE)
 add_library(dish_strict   INTERFACE)
 
@@ -52,11 +59,7 @@ if(MSVC)
     target_compile_definitions(dish_warnings INTERFACE
         UNICODE _UNICODE
         WIN32_LEAN_AND_MEAN
-        NOMINMAX
-        # Silences the "use the secure version" nags for POSIX-style calls
-        # inside Qt and libsodium.
-        _CRT_SECURE_NO_WARNINGS
-        _WINSOCK_DEPRECATED_NO_WARNINGS)
+        NOMINMAX)
     if(DISH_ENABLE_WARNINGS)
         target_compile_options(dish_strict INTERFACE /WX)
     endif()
@@ -116,7 +119,15 @@ FetchContent_Declare(
     enet
     GIT_REPOSITORY https://github.com/cgutman/enet.git
     GIT_TAG        44c85e16279553d9c052e572bcbfcd745fb74abf
-    SOURCE_SUBDIR  _dish_no_such_subdir)
+    SOURCE_SUBDIR  _dish_no_such_subdir
+    # Nine `command | flag` ORs of two different enum types, which current
+    # MSVC reports as C5287 (level 1, so at any warning level), get the
+    # explicit casts it asks for. Applied once, at fetch time; see
+    # cmake/PatchEnet.cmake and THIRD_PARTY.md.
+    PATCH_COMMAND  ${CMAKE_COMMAND}
+                   -DENET_SOURCE_DIR=<SOURCE_DIR>
+                   -DPATCH_FILE=${CMAKE_CURRENT_SOURCE_DIR}/cmake/enet-msvc-c5287.patch
+                   -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/PatchEnet.cmake)
 FetchContent_MakeAvailable(enet)
 
 if(NOT enet_SOURCE_DIR OR NOT EXISTS "${enet_SOURCE_DIR}/callbacks.c")
@@ -563,6 +574,15 @@ target_link_libraries(dish_core
         dish_warnings
         dish_strict)
 
+# AppViewModel and the two role models live here, but their QML identities are
+# declared from the Dish target (src/qml/chrome/ForeignTypes.h). qmltyperegistrar
+# can only expand a QML_FOREIGN declaration when it can read the foreign class's
+# meta-object, which reaches it as a --foreign-types argument: this call writes
+# dish_core's metatypes .json and puts it on Dish's SOURCES through the
+# INTERFACE_SOURCES genex that qt_add_qml_module's QT_CONSUMES_METATYPES enables.
+# Without it the App singleton lands in the qmltypes with no properties at all.
+qt_extract_metatypes(dish_core)
+
 # --- UI executable ---
 set(DISH_UI_SOURCES
     src/UI/CrashHandler.h
@@ -589,12 +609,33 @@ if(sentry_FOUND)
 endif()
 set_target_properties(Dish PROPERTIES OUTPUT_NAME dish)
 target_link_libraries(Dish PRIVATE dish_core Qt6::Gui Qt6::Svg dish_warnings dish_strict)
-# Debug information for the symbol upload in release.yml. /Z7 keeps it in the
-# objects, /DEBUG:FULL writes dish.pdb beside dish.exe, and neither the install
-# image nor the portable bundle picks a .pdb up, so nothing shipped carries it.
+# Debug information for the symbol upload in release.yml. Embedded (/Z7) keeps
+# it in the objects, /DEBUG:FULL writes dish.pdb beside dish.exe, and neither
+# the install image nor the portable bundle picks a .pdb up, so nothing shipped
+# carries it. The format goes through the CMP0141 target property rather than a
+# raw /Z7, so the Debug configuration's own /Zi is replaced instead of overridden
+# on the command line (cl reports that as D9025 on every translation unit).
 if(sentry_FOUND AND MSVC)
-    target_compile_options(dish_core PRIVATE /Z7)
-    target_compile_options(Dish PRIVATE /Z7)
+    # CMake fills CMAKE_<LANG>_FLAGS_<CONFIG> once, when a tree is first
+    # configured, and a tree configured before 3.25 became the floor keeps the
+    # /Zi the older default put there. The property would then add /Z7 on top of
+    # it, which is D9025 back on every unit of these two targets, so such a tree
+    # is refused with the one-time remedy instead of built with the warning.
+    foreach(_dish_config IN LISTS CMAKE_CONFIGURATION_TYPES CMAKE_BUILD_TYPE)
+        string(TOUPPER "${_dish_config}" _dish_config)
+        foreach(_dish_lang C CXX)
+            set(_dish_flags_var CMAKE_${_dish_lang}_FLAGS_${_dish_config})
+            if("${${_dish_flags_var}}" MATCHES "[-/]Z[iI]( |$)")
+                message(FATAL_ERROR
+                    "${_dish_flags_var} is \"${${_dish_flags_var}}\": its /Zi would be "
+                    "overridden by the /Z7 dish_core and Dish carry as a target property "
+                    "(D9025 on every translation unit). This build tree was configured before "
+                    "CMake 3.25 became the floor; delete ${CMAKE_BINARY_DIR}/CMakeCache.txt "
+                    "and configure again.")
+            endif()
+        endforeach()
+    endforeach()
+    set_target_properties(dish_core Dish PROPERTIES MSVC_DEBUG_INFORMATION_FORMAT Embedded)
     target_link_options(Dish PRIVATE /DEBUG:FULL /OPT:REF /OPT:ICF)
 endif()
 # CrashHandler.cpp: dbghelp writes the minidump and symbolizes the stack;
@@ -613,7 +654,9 @@ target_sources(Dish PRIVATE
     src/qml/chrome/ThemeBridge.h
     src/qml/chrome/ThemeBridge.cpp
     src/qml/chrome/TokensBridge.h
-    src/qml/chrome/TokensBridge.cpp)
+    src/qml/chrome/TokensBridge.cpp
+    # QML_FOREIGN declarations for dish_core's view-model types; see the header.
+    src/qml/chrome/ForeignTypes.h)
 
 # DISH_KIT_QML_FILES: the canonical design-kit file list, kept in its own
 # file so the kit reads as a unit rather than as lines lost in this one.
@@ -663,10 +706,18 @@ qt_add_qml_module(Dish
 # so their directory has to be on the include path for it to compile.
 target_include_directories(Dish PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/qml/chrome)
 
-# C4702 (unreachable code) fires inside Qt's own headers from the TUs
-# qmlcachegen generates, and dish_strict's /WX makes it fatal.
+# The AOT-compiled QML (qmlcachegen's *_qml.cpp, attached to Dish by
+# qt_add_qml_module above) instantiates Qt's own QJSEngine / QVariant templates,
+# whose `if constexpr` early returns leave code MSVC's optimizer reports as
+# unreachable (C4702) inside qjsengine.h, qvariant.h and qmetatype.h. That is a
+# back-end warning, which -external:W0 does not reach (documented under
+# /external, "Limitations"), so /wd47XX is the compiler's own remedy for it.
+# Scoped to the generated units only: every first-party unit in this target
+# keeps C4702 live.
 if(MSVC)
-    target_compile_options(Dish PRIVATE /wd4702)
+    get_target_property(_dish_qmlcache_sources Dish SOURCES)
+    list(FILTER _dish_qmlcache_sources INCLUDE REGEX "/\\.rcc/qmlcache/")
+    set_source_files_properties(${_dish_qmlcache_sources} PROPERTIES COMPILE_OPTIONS /wd4702)
 endif()
 
 target_link_libraries(Dish PRIVATE

CMakePresets.json

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "cmakeMinimumRequired": { "major": 3, "minor": 21, "patch": 0 },
+  "cmakeMinimumRequired": { "major": 3, "minor": 25, "patch": 0 },
   "configurePresets": [
     {
       "name": "debug",