From 6cf90f6dfdc0405a9e4050da8d5453f0a1b84d44 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Tue, 3 Nov 2026 22:25:40 -0600
Subject: [PATCH 1/2] Replace dw.phar install instructions with the 2.5.0
 migration

From CLI 2.5.0 releases ship no PHAR. Replace the PHAR download block with
the approved migration: move to the standalone binary through the
installers, or download and verify the release yourself on Linux, macOS or
Windows, and note that a 2.x PHAR's dw upgrade message can't change.
dw upgrade now refuses only Composer vendor and Homebrew installs, the
binary needs no PHP extensions for signal forwarding, and only a 2.x PHAR
reports installation kind phar. All eight languages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/polyglot/cli-reference.md                | 14 +++---
 docs/polyglot/cli.mdx                         | 47 ++++++++++++-----
 .../current/polyglot/cli-reference.md         | 14 +++---
 .../current/polyglot/cli.mdx                  | 50 ++++++++++++++-----
 i18n/de/source-hashes.json                    |  4 +-
 .../current/polyglot/cli-reference.md         |  8 +--
 .../current/polyglot/cli.mdx                  | 37 ++++++++++----
 i18n/es/source-hashes.json                    |  4 +-
 .../current/polyglot/cli-reference.md         | 13 +++--
 .../current/polyglot/cli.mdx                  | 48 +++++++++++++-----
 i18n/fr/source-hashes.json                    |  4 +-
 .../current/polyglot/cli-reference.md         |  8 +--
 .../current/polyglot/cli.mdx                  | 37 ++++++++++----
 i18n/ja/source-hashes.json                    |  4 +-
 .../current/polyglot/cli-reference.md         | 14 +++---
 .../current/polyglot/cli.mdx                  | 47 ++++++++++++-----
 i18n/pt-BR/source-hashes.json                 |  4 +-
 .../current/polyglot/cli-reference.md         | 14 +++---
 .../current/polyglot/cli.mdx                  | 47 ++++++++++++-----
 i18n/uk/source-hashes.json                    |  4 +-
 .../current/polyglot/cli-reference.md         |  8 +--
 .../current/polyglot/cli.mdx                  | 37 ++++++++++----
 i18n/zh-Hans/source-hashes.json               |  4 +-
 23 files changed, 312 insertions(+), 159 deletions(-)

diff --git a/docs/polyglot/cli-reference.md b/docs/polyglot/cli-reference.md
index b82653d56f0..e5ac97fd716 100644
--- a/docs/polyglot/cli-reference.md
+++ b/docs/polyglot/cli-reference.md
@@ -62,7 +62,7 @@ canonical `input` array.
 | `dw debug workflow <workflow-id>` | Capture stuck-run diagnostics for one workflow: state, pending tasks, queue facts, failures, and compatibility metadata. | `--run-id`, global options, `--json` |
 | `dw server:start-dev` | Serve an existing, configured Laravel project's HTTP application. Requires external PHP. | `--port`, `--host` (default `127.0.0.1`), `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | Poll a workflow until terminal or until a configured polling limit. | `--run-id`, `--interval`, `--max-polls`, global options |
-| `dw upgrade` | Replace the running standalone `dw` binary with a newer (or pinned) release. Refuses to rewrite Composer vendor, Homebrew cellar, and PHAR installs. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | Replace the running standalone `dw` binary with a newer (or pinned) release. Refuses to rewrite Composer vendor and Homebrew cellar installs. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 Use `server:info` when validating contract shape, `doctor` when explaining why
 a CLI cannot talk to a server, and `debug workflow` when support needs one
@@ -84,9 +84,8 @@ interfaces. MySQL and PostgreSQL modes require project Compose services named
 return nonzero. Compose services remain running when the HTTP process ends.
 
 POSIX native binaries forward SIGINT and SIGTERM to the active child and wait
-up to five seconds for its process group to stop. Source and PHAR installs
-require PHP's `pcntl` and `posix` extensions for this forwarding. Windows uses
-its console interruption behavior.
+up to five seconds for its process group to stop. Windows uses its console
+interruption behavior.
 
 For a standalone Durable Workflow Server using published images, follow the
 [service quickstart](/docs/quickstart).
@@ -197,13 +196,14 @@ prose:
 | `upgraded` | Binary replaced with `target_version`. |
 | `noop` | `current_version` already matches `target_version`; `--force` bypasses this. |
 | `dry-run` | `--dry-run` resolved `target_version`, `asset_url`, and `checksum_url` without downloading. |
-| `refused` | Install kind is not a standalone release binary (Composer vendor, Homebrew cellar, or PHAR), or the platform has no published asset. |
+| `refused` | Install kind is not a standalone release binary (Composer vendor or Homebrew cellar), or the platform has no published asset. |
 | `permission-denied` | The install directory is not writable; the payload includes a `hint` with the recommended next step. |
 | `error` | Release catalog fetch, checksum mismatch, or filesystem error. |
 
 For refusals, the JSON payload's `installation.kind` identifies the managing
-tool (`composer-vendor`, `homebrew`, `phar`, or `binary`) and `reason` names
-the right owner to use instead. For public, source-free automation, reinstall
+tool (`composer-vendor`, `homebrew`, `binary`, or `unknown`) and `reason` names
+the right owner to use instead. Only a 2.x PHAR, running its own 2.x code,
+reports `phar`. For public, source-free automation, reinstall
 a pinned release through `https://durable-workflow.com/install.sh`; for
 tap-managed Homebrew installs, use `brew upgrade durable-workflow/tap/dw`.
 
diff --git a/docs/polyglot/cli.mdx b/docs/polyglot/cli.mdx
index 703560d103c..a3af00d99fa 100644
--- a/docs/polyglot/cli.mdx
+++ b/docs/polyglot/cli.mdx
@@ -93,21 +93,42 @@ that directory to the user `PATH`.
 </details>
 
 <details>
-<summary><b>PHAR</b> (portable, requires PHP 8.2+)</summary>
+<summary><b>Moving from <code>dw.phar</code></b></summary>
+
+From CLI 2.5.0, releases ship no PHAR. If you run `php dw.phar`, switch to the
+standalone binary, which needs no PHP, with the shell or PowerShell installer
+above. Then delete `dw.phar`. The installers check the binary against the
+release's `SHA256SUMS` before installing it.
+
+If you don't pipe scripts into a shell, download the release and verify it
+first. Pick your platform's asset:
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-The PHAR works wherever PHP 8.2 or newer is already available and is the
-recommended artifact for shared CI runners that already ship PHP.
+On Windows, download, verify and copy without running a script:
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+Add `%LOCALAPPDATA%\Programs\dw` to your `PATH` if it isn't there already.
+
+In a 2.x PHAR install, `dw upgrade` still answers "Download the matching PHAR
+manually". That message comes from the old release and can't be changed, so
+use the commands above instead. Standalone-binary installs upgrade as usual
+with `dw upgrade`.
 
 </details>
 
@@ -123,8 +144,8 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` refuses to rewrite Composer vendor, Homebrew cellar, and PHAR
-installs because those paths are owned by another tool. Reinstall a pinned
+`dw upgrade` refuses to rewrite Composer vendor and Homebrew cellar installs
+because those paths are owned by another tool. Reinstall a pinned
 public release with the installer, update the owning package manager, or use
 `brew upgrade durable-workflow/tap/dw` for tap-managed Homebrew installs. See the
 [CLI reference](./cli-reference.md#self-upgrade) for the full stable option
diff --git a/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index 5d749e8be77..53a4fe655b1 100644
--- a/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -62,7 +62,7 @@ weiterhin das kanonische Array `input` erhält.
 | `dw debug workflow <workflow-id>` | Diagnose eines festhängenden Workflow-Laufs erfassen: Zustand, ausstehende Tasks, Warteschlangenangaben, Fehler und Kompatibilitätsmetadaten. | `--run-id`, globale Optionen, `--json` |
 | `dw server:start-dev` | HTTP-Anwendung eines bestehenden konfigurierten Laravel-Projekts bereitstellen. Benötigt externes PHP. | `--port`, `--host` (Standard `127.0.0.1`), `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | Workflow bis zum terminalen Zustand oder bis zur konfigurierten Abfragegrenze beobachten. | `--run-id`, `--interval`, `--max-polls`, globale Optionen |
-| `dw upgrade` | Laufende eigenständige `dw`-Binärdatei durch ein neueres oder festgelegtes Release ersetzen. Verweigert das Überschreiben von Composer-vendor-, Homebrew-cellar- und PHAR-Installationen. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | Laufende eigenständige `dw`-Binärdatei durch ein neueres oder festgelegtes Release ersetzen. Verweigert das Überschreiben von Composer-vendor- und Homebrew-cellar-Installationen. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 Verwenden Sie `server:info` zur Vertragsprüfung, `doctor` zur Erklärung von
 CLI-Verbindungsproblemen und `debug workflow`, wenn Support eine maschinenlesbare
@@ -86,9 +86,8 @@ Compose-Dienste des Projekts namens `mysql` beziehungsweise `pgsql` sowie
 ungleich null. Compose-Dienste laufen nach Ende des HTTP-Prozesses weiter.
 
 Native POSIX-Binärdateien leiten SIGINT und SIGTERM an das aktive Kind weiter
-und warten bis zu fünf Sekunden auf das Ende seiner Prozessgruppe.
-Quellcode- und PHAR-Installationen benötigen dafür PHPs Erweiterungen `pcntl`
-und `posix`. Windows verwendet sein Konsolen-Unterbrechungsverhalten.
+und warten bis zu fünf Sekunden auf das Ende seiner Prozessgruppe. Windows
+verwendet sein Konsolen-Unterbrechungsverhalten.
 
 Für einen eigenständigen Durable Workflow Server mit veröffentlichten Images
 folgen Sie dem [Service-Schnellstart](/docs/quickstart).
@@ -193,13 +192,14 @@ Prosaauswertung:
 | `upgraded` | Binärdatei durch `target_version` ersetzt. |
 | `noop` | `current_version` entspricht bereits `target_version`; `--force` umgeht dies. |
 | `dry-run` | `--dry-run` hat `target_version`, `asset_url` und `checksum_url` ohne Download aufgelöst. |
-| `refused` | Installation ist keine eigenständige Release-Binärdatei (Composer vendor, Homebrew cellar oder PHAR), oder für die Plattform ist kein Artefakt veröffentlicht. |
+| `refused` | Installation ist keine eigenständige Release-Binärdatei (Composer vendor oder Homebrew cellar), oder für die Plattform ist kein Artefakt veröffentlicht. |
 | `permission-denied` | Installationsverzeichnis nicht beschreibbar; die Nutzlast enthält einen `hint` mit empfohlenem nächsten Schritt. |
 | `error` | Fehler beim Abruf des Release-Katalogs, abweichende Prüfsumme oder Dateisystemfehler. |
 
 Bei Ablehnungen benennt `installation.kind` das verwaltende Werkzeug
-(`composer-vendor`, `homebrew`, `phar` oder `binary`) und `reason` den richtigen
-zuständigen Weg. Für öffentliche Automatisierung ohne Quellcode installieren
+(`composer-vendor`, `homebrew`, `binary` oder `unknown`) und `reason` den richtigen
+zuständigen Weg. Nur ein 2.x-PHAR, das seinen eigenen 2.x-Code ausführt, meldet
+`phar`. Für öffentliche Automatisierung ohne Quellcode installieren
 Sie ein festgelegtes Release über `https://durable-workflow.com/install.sh`
 erneut. Für Tap-verwaltete Homebrew-Installationen verwenden Sie
 `brew upgrade durable-workflow/tap/dw`.
diff --git a/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index dc097cc3f23..eeea83f1d31 100644
--- a/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -96,21 +96,45 @@ Benutzer-`PATH`.
 </details>
 
 <details>
-<summary><b>PHAR</b> (portabel, erfordert PHP 8.2+)</summary>
+<summary><b>Umstieg von <code>dw.phar</code></b></summary>
+
+Ab CLI 2.5.0 enthalten Releases kein PHAR mehr. Wenn Sie `php dw.phar`
+ausführen, wechseln Sie mit der obigen Shell- oder PowerShell-Installation zur
+eigenständigen Binärdatei, die kein PHP benötigt. Löschen Sie anschließend
+`dw.phar`. Die Installationsskripte prüfen die Binärdatei vor der Installation
+gegen die `SHA256SUMS` des Release.
+
+Wenn Sie keine Skripte an eine Shell weiterleiten, laden Sie das Release
+herunter und prüfen Sie es zuerst. Wählen Sie das Artefakt Ihrer Plattform:
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-Das PHAR funktioniert überall, wo PHP 8.2 oder neuer bereits verfügbar ist.
-Es ist das empfohlene Artefakt für gemeinsame CI-Runner mit vorhandenem PHP.
+Unter Windows laden Sie herunter, prüfen und kopieren, ohne ein Skript
+auszuführen:
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+Ergänzen Sie `%LOCALAPPDATA%\Programs\dw` in Ihrem `PATH`, falls es dort noch
+nicht steht.
+
+In einer 2.x-PHAR-Installation antwortet `dw upgrade` weiterhin mit "Download the
+matching PHAR manually". Diese Meldung stammt aus dem alten Release und lässt
+sich nicht ändern; verwenden Sie stattdessen die obigen Befehle. Installationen
+der eigenständigen Binärdatei aktualisieren sich wie gewohnt mit `dw upgrade`.
 
 </details>
 
@@ -127,8 +151,8 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` verweigert das Überschreiben von Composer-vendor-, Homebrew-cellar-
-und PHAR-Installationen, da diese Pfade von anderen Werkzeugen verwaltet werden.
+`dw upgrade` verweigert das Überschreiben von Composer-vendor- und
+Homebrew-cellar-Installationen, da diese Pfade von anderen Werkzeugen verwaltet werden.
 Installieren Sie ein festgelegtes öffentliches Release erneut mit dem
 Installationsprogramm, aktualisieren Sie den zuständigen Paketmanager oder
 verwenden Sie für Tap-verwaltete Homebrew-Installationen
diff --git a/i18n/de/source-hashes.json b/i18n/de/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/de/source-hashes.json
+++ b/i18n/de/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index 87f94d59784..50d070d505d 100644
--- a/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -54,7 +54,7 @@ La entrada JSON de inicios de workflow, señales, consultas, actualizaciones, pr
 | `dw debug workflow <workflow-id>` | Capturar diagnósticos de una ejecución atascada: estado, tareas pendientes, cola, fallos y compatibilidad. | `--run-id`, opciones globales, `--json` |
 | `dw server:start-dev` | Servir la aplicación HTTP de un proyecto Laravel existente y configurado. Requiere PHP externo. | `--port`, `--host` (predeterminado `127.0.0.1`), `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | Sondear hasta estado terminal o un límite configurado de sondeos. | `--run-id`, `--interval`, `--max-polls`, opciones globales |
-| `dw upgrade` | Reemplazar el binario independiente actual de `dw` por otra publicación posterior o fijada. Rechaza modificar Composer vendor, Homebrew cellar y PHAR. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | Reemplazar el binario independiente actual de `dw` por otra publicación posterior o fijada. Rechaza modificar Composer vendor y Homebrew cellar. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 Utiliza `server:info` para validar estructuras de contrato, `doctor` para explicar por qué la CLI no se conecta y `debug workflow` si soporte necesita una captura de ejecución legible por máquinas.
 
@@ -64,7 +64,7 @@ Ejecuta `dw server:start-dev` desde el directorio de un proyecto Laravel instala
 
 El comando utiliza loopback por defecto. Usa explícitamente `--host=0.0.0.0` para todas las interfaces. Los modos MySQL y PostgreSQL requieren servicios Compose del proyecto llamados `mysql` o `pgsql`, respectivamente, y `redis`. Los fallos de dependencias o procesos HTTP devuelven un código distinto de cero. Los servicios Compose permanecen activos al terminar HTTP.
 
-Los binarios nativos POSIX reenvían SIGINT y SIGTERM al hijo activo y esperan hasta cinco segundos a que termine su grupo de procesos. Las instalaciones desde código y PHAR requieren las extensiones PHP `pcntl` y `posix` para reenviar señales. Windows utiliza su interrupción de consola.
+Los binarios nativos POSIX reenvían SIGINT y SIGTERM al hijo activo y esperan hasta cinco segundos a que termine su grupo de procesos. Windows utiliza su interrupción de consola.
 
 Para Durable Workflow Server independiente con imágenes publicadas, sigue el [inicio rápido del servicio](/docs/quickstart).
 
@@ -118,11 +118,11 @@ El comando rechaza modificar instalaciones gestionadas por otra herramienta. La
 | `upgraded` | Binario reemplazado por `target_version`. |
 | `noop` | `current_version` ya coincide con `target_version`; `--force` evita esta omisión. |
 | `dry-run` | `--dry-run` resolvió `target_version`, `asset_url` y `checksum_url` sin descargar. |
-| `refused` | La instalación no es un binario independiente (Composer vendor, Homebrew cellar o PHAR), o no hay artefacto publicado para la plataforma. |
+| `refused` | La instalación no es un binario independiente (Composer vendor o Homebrew cellar), o no hay artefacto publicado para la plataforma. |
 | `permission-denied` | No se puede escribir en el directorio de instalación; la carga incluye `hint` con el paso recomendado. |
 | `error` | Fallo al obtener el catálogo, checksum no coincidente o error del sistema de archivos. |
 
-En rechazos, `installation.kind` identifica la herramienta gestora (`composer-vendor`, `homebrew`, `phar` o `binary`) y `reason` indica el responsable correcto. Para automatización pública sin código fuente, reinstala una publicación fijada mediante `https://durable-workflow.com/install.sh`; para Homebrew por tap, utiliza `brew upgrade durable-workflow/tap/dw`.
+En rechazos, `installation.kind` identifica la herramienta gestora (`composer-vendor`, `homebrew`, `binary` o `unknown`) y `reason` indica el responsable correcto. Solo un PHAR 2.x, al ejecutar su propio código 2.x, informa `phar`. Para automatización pública sin código fuente, reinstala una publicación fijada mediante `https://durable-workflow.com/install.sh`; para Homebrew por tap, utiliza `brew upgrade durable-workflow/tap/dw`.
 
 ## Perfiles de entorno {#environment-profiles}
 
diff --git a/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index d9ddf85f0c0..42ab19a4e81 100644
--- a/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -76,20 +76,35 @@ El instalador escribe `dw.exe` en `%USERPROFILE%\.durable-workflow\bin` y añade
 </details>
 
 <details>
-<summary><b>PHAR</b> (portátil, requiere PHP 8.2+)</summary>
+<summary><b>Migrar desde <code>dw.phar</code></b></summary>
+
+A partir de CLI 2.5.0, las publicaciones no incluyen PHAR. Si ejecutas `php dw.phar`, cambia al binario independiente, que no necesita PHP, con el instalador de shell o de PowerShell anterior. Después elimina `dw.phar`. Los instaladores verifican el binario con el `SHA256SUMS` de la publicación antes de instalarlo.
+
+Si no canalizas scripts hacia una shell, descarga la publicación y verifícala primero. Elige el artefacto de tu plataforma:
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-El PHAR funciona donde ya esté disponible PHP 8.2 o posterior y es el artefacto recomendado para ejecutores de CI compartidos que ya incluyan PHP.
+En Windows, descarga, verifica y copia sin ejecutar ningún script:
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+Añade `%LOCALAPPDATA%\Programs\dw` a tu `PATH` si aún no está.
+
+En una instalación PHAR 2.x, `dw upgrade` sigue respondiendo "Download the matching PHAR manually". Ese mensaje procede de la publicación antigua y no puede cambiarse, así que utiliza los comandos anteriores. Las instalaciones de binario independiente se actualizan con `dw upgrade` como siempre.
 
 </details>
 
@@ -103,7 +118,7 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` rechaza modificar instalaciones de Composer vendor, Homebrew cellar y PHAR porque pertenecen a otra herramienta. Reinstala una publicación pública fijada mediante el instalador, actualiza el gestor de paquetes propietario o utiliza `brew upgrade durable-workflow/tap/dw` para Homebrew gestionado por tap. Consulta la [referencia de CLI](./cli-reference.md#self-upgrade) para el contrato estable de opciones y campos de estado.
+`dw upgrade` rechaza modificar instalaciones de Composer vendor y Homebrew cellar porque pertenecen a otra herramienta. Reinstala una publicación pública fijada mediante el instalador, actualiza el gestor de paquetes propietario o utiliza `brew upgrade durable-workflow/tap/dw` para Homebrew gestionado por tap. Consulta la [referencia de CLI](./cli-reference.md#self-upgrade) para el contrato estable de opciones y campos de estado.
 
 ## Configurar {#configure}
 
diff --git a/i18n/es/source-hashes.json b/i18n/es/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/es/source-hashes.json
+++ b/i18n/es/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index b092d7b6187..f4f16b13318 100644
--- a/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -63,7 +63,7 @@ argument positionnel pour que le serveur reçoive toujours le tableau `input` ca
 | `dw debug workflow <workflow-id>` | Capturer les diagnostics d'une exécution bloquée : état, tâches en attente, informations de file, échecs et métadonnées de compatibilité. | `--run-id`, options globales, `--json` |
 | `dw server:start-dev` | Servir l'application HTTP d'un projet Laravel existant et configuré. Nécessite un PHP externe. | `--port`, `--host` (`127.0.0.1` par défaut), `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | Interroger un workflow jusqu'à un état terminal ou à la limite d'interrogations configurée. | `--run-id`, `--interval`, `--max-polls`, options globales |
-| `dw upgrade` | Remplacer le binaire autonome `dw` en cours par une version plus récente ou épinglée. Refuse de réécrire les installations Composer vendor, Homebrew cellar et PHAR. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | Remplacer le binaire autonome `dw` en cours par une version plus récente ou épinglée. Refuse de réécrire les installations Composer vendor et Homebrew cellar. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 Utilisez `server:info` pour valider la forme du contrat, `doctor` pour
 expliquer pourquoi une CLI ne peut pas joindre un serveur et `debug workflow`
@@ -88,9 +88,8 @@ HTTP renvoie un code non nul. Les services Compose restent actifs à la fin du
 processus HTTP.
 
 Les binaires natifs POSIX transmettent SIGINT et SIGTERM à l'enfant actif et
-attendent jusqu'à cinq secondes l'arrêt de son groupe de processus. Les
-installations source et PHAR nécessitent les extensions PHP `pcntl` et `posix`
-pour cette transmission. Windows utilise son comportement d'interruption de console.
+attendent jusqu'à cinq secondes l'arrêt de son groupe de processus. Windows
+utilise son comportement d'interruption de console.
 
 Pour un Durable Workflow Server autonome utilisant les images publiées,
 suivez le [démarrage rapide du mode service](/docs/quickstart).
@@ -200,13 +199,13 @@ de prose :
 | `upgraded` | Binaire remplacé par `target_version`. |
 | `noop` | `current_version` correspond déjà à `target_version` ; `--force` contourne ce cas. |
 | `dry-run` | `--dry-run` a résolu `target_version`, `asset_url` et `checksum_url` sans téléchargement. |
-| `refused` | L'installation n'est pas un binaire de version autonome (Composer vendor, Homebrew cellar ou PHAR), ou la plateforme n'a pas d'artefact publié. |
+| `refused` | L'installation n'est pas un binaire de version autonome (Composer vendor ou Homebrew cellar), ou la plateforme n'a pas d'artefact publié. |
 | `permission-denied` | Le répertoire d'installation n'est pas accessible en écriture ; la charge utile inclut un `hint` proposant la prochaine étape. |
 | `error` | Échec de récupération du catalogue des versions, somme de contrôle différente ou erreur du système de fichiers. |
 
 En cas de refus, `installation.kind` identifie l'outil responsable
-(`composer-vendor`, `homebrew`, `phar` ou `binary`) et `reason` nomme celui à
-utiliser. Pour une automatisation publique sans sources, réinstallez une
+(`composer-vendor`, `homebrew`, `binary` ou `unknown`) et `reason` nomme celui à
+utiliser. Seul un PHAR 2.x, exécutant son propre code 2.x, signale `phar`. Pour une automatisation publique sans sources, réinstallez une
 version épinglée via `https://durable-workflow.com/install.sh` ; pour Homebrew
 géré par le tap, utilisez `brew upgrade durable-workflow/tap/dw`.
 
diff --git a/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index bf9a89f4e91..e3e058ea248 100644
--- a/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -95,21 +95,43 @@ ajoute ce répertoire au `PATH` de l'utilisateur.
 </details>
 
 <details>
-<summary><b>PHAR</b> (portable, nécessite PHP 8.2+)</summary>
+<summary><b>Migrer depuis <code>dw.phar</code></b></summary>
+
+À partir de la CLI 2.5.0, les versions ne fournissent plus de PHAR. Si vous
+exécutez `php dw.phar`, passez au binaire autonome, qui ne nécessite pas PHP,
+avec l'installateur shell ou PowerShell ci-dessus. Supprimez ensuite `dw.phar`.
+Les installateurs vérifient le binaire avec le `SHA256SUMS` de la version avant
+de l'installer.
+
+Si vous ne redirigez pas de scripts vers un shell, téléchargez la version et
+vérifiez-la d'abord. Choisissez l'artefact de votre plateforme :
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-Le PHAR fonctionne partout où PHP 8.2 ou ultérieur est déjà disponible.
-C'est l'artefact recommandé pour les runners CI partagés qui fournissent déjà PHP.
+Sous Windows, téléchargez, vérifiez et copiez sans exécuter de script :
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+Ajoutez `%LOCALAPPDATA%\Programs\dw` à votre `PATH` s'il n'y figure pas déjà.
+
+Dans une installation PHAR 2.x, `dw upgrade` répond toujours « Download the
+matching PHAR manually ». Ce message provient de l'ancienne version et ne peut
+pas être modifié ; utilisez donc les commandes ci-dessus. Les installations du
+binaire autonome se mettent à jour normalement avec `dw upgrade`.
 
 </details>
 
@@ -126,8 +148,8 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` refuse de réécrire les installations Composer vendor, Homebrew
-cellar et PHAR, car ces chemins appartiennent à un autre outil. Réinstallez
+`dw upgrade` refuse de réécrire les installations Composer vendor et Homebrew
+cellar, car ces chemins appartiennent à un autre outil. Réinstallez
 une version publique épinglée avec l'installateur, mettez à jour via le
 gestionnaire de paquets responsable ou utilisez
 `brew upgrade durable-workflow/tap/dw` pour les installations Homebrew gérées
diff --git a/i18n/fr/source-hashes.json b/i18n/fr/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/fr/source-hashes.json
+++ b/i18n/fr/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index 957a947c496..4b9754ecd4a 100644
--- a/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -54,7 +54,7 @@ Server を利用するすべてのコマンドは、スタンドアロン Server
 | `dw debug workflow <workflow-id>` | 停滞した1ワークフローの状態、保留タスク、キュー情報、失敗、互換性メタデータを取得。 | `--run-id`、グローバルオプション、`--json` |
 | `dw server:start-dev` | 設定済みの既存 Laravel プロジェクトの HTTP アプリケーションを提供。外部 PHP が必要。 | `--port`、`--host`（既定 `127.0.0.1`）、`--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | 終了状態または設定したポーリング上限までワークフローをポーリング。 | `--run-id`, `--interval`, `--max-polls`、グローバルオプション |
-| `dw upgrade` | 稼働中の単独 `dw` バイナリを新しい（または指定した）リリースへ置換。Composer vendor、Homebrew cellar、PHAR の書き換えは拒否。 | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | 稼働中の単独 `dw` バイナリを新しい（または指定した）リリースへ置換。Composer vendor と Homebrew cellar の書き換えは拒否。 | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 契約構造の検証には `server:info`、CLI が Server と通信できない理由の説明には `doctor`、サポートに機械可読な実行記録が必要な場合には `debug workflow` を使います。
 
@@ -64,7 +64,7 @@ Server を利用するすべてのコマンドは、スタンドアロン Server
 
 既定のバインドはループバックです。全インターフェースには明示的に `--host=0.0.0.0` を使います。MySQL と PostgreSQL モードには、それぞれ `mysql` または `pgsql`、および `redis` というプロジェクトの Compose サービスが必要です。依存プロセスや HTTP プロセスの失敗は非ゼロを返します。HTTP プロセス終了後も Compose サービスは稼働を続けます。
 
-POSIX ネイティブバイナリは SIGINT と SIGTERM を有効な子へ転送し、そのプロセスグループの停止を最大5秒待ちます。ソースと PHAR のインストールでは、転送に PHP の `pcntl` と `posix` 拡張が必要です。Windows はコンソール割り込み動作を使います。
+POSIX ネイティブバイナリは SIGINT と SIGTERM を有効な子へ転送し、そのプロセスグループの停止を最大5秒待ちます。Windows はコンソール割り込み動作を使います。
 
 公開イメージを使うスタンドアロン Durable Workflow Server は、[サービスクイックスタート](/docs/quickstart)に従ってください。
 
@@ -118,11 +118,11 @@ dw server:info --output=json \
 | `upgraded` | バイナリを `target_version` に置換した。 |
 | `noop` | `current_version` が `target_version` と一致する。`--force` で回避。 |
 | `dry-run` | ダウンロードせず `target_version`、`asset_url`、`checksum_url` を解決した。 |
-| `refused` | 単独リリースバイナリ以外（Composer vendor、Homebrew cellar、PHAR）、またはプラットフォーム用アセットが未公開。 |
+| `refused` | 単独リリースバイナリ以外（Composer vendor、Homebrew cellar）、またはプラットフォーム用アセットが未公開。 |
 | `permission-denied` | インストールディレクトリが書き込み不可。推奨対応を `hint` に含む。 |
 | `error` | リリースカタログ取得、チェックサム不一致、ファイルシステムのエラー。 |
 
-拒否時、JSON の `installation.kind` は管理ツール（`composer-vendor`、`homebrew`、`phar`、`binary`）を識別し、`reason` は代わりに使う正しい管理元を示します。公開されたソース不要の自動化では `https://durable-workflow.com/install.sh` で固定リリースを再インストールし、tap 管理の Homebrew では `brew upgrade durable-workflow/tap/dw` を使います。
+拒否時、JSON の `installation.kind` は管理ツール（`composer-vendor`、`homebrew`、`binary`、`unknown`）を識別し、`reason` は代わりに使う正しい管理元を示します。`phar` を報告するのは、自身の 2.x コードを実行している 2.x PHAR だけです。公開されたソース不要の自動化では `https://durable-workflow.com/install.sh` で固定リリースを再インストールし、tap 管理の Homebrew では `brew upgrade durable-workflow/tap/dw` を使います。
 
 ## 環境プロファイル {#environment-profiles}
 
diff --git a/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index 55ff40a7631..3843f9b816c 100644
--- a/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -76,20 +76,35 @@ dw --version
 </details>
 
 <details>
-<summary><b>PHAR</b>（移植可能、PHP 8.2 以降が必要）</summary>
+<summary><b><code>dw.phar</code> からの移行</b></summary>
+
+CLI 2.5.0 以降、リリースには PHAR が含まれません。`php dw.phar` を実行している場合は、上記のシェルまたは PowerShell インストーラーで、PHP が不要な単独バイナリへ切り替えてください。その後 `dw.phar` を削除します。インストーラーは、インストール前にリリースの `SHA256SUMS` でバイナリを検証します。
+
+スクリプトをシェルへパイプしない場合は、先にリリースをダウンロードして検証します。使用するプラットフォームのアセットを選んでください。
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-PHAR は PHP 8.2 以降があれば動作し、PHP が既にある共有 CI ランナーに推奨する成果物です。
+Windows では、スクリプトを実行せずにダウンロード、検証、コピーします。
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+`%LOCALAPPDATA%\Programs\dw` がまだ `PATH` にない場合は追加してください。
+
+2.x の PHAR インストールでは、`dw upgrade` は引き続き "Download the matching PHAR manually" と応答します。このメッセージは旧リリースに由来し変更できないため、代わりに上記のコマンドを使ってください。単独バイナリのインストールは、通常どおり `dw upgrade` で更新できます。
 
 </details>
 
@@ -103,7 +118,7 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` は、他のツールが所有する Composer vendor、Homebrew cellar、PHAR のインストール先を書き換えません。インストーラーで固定した公開リリースを再インストールするか、管理元のパッケージマネージャーで更新します。tap 管理の Homebrew インストールには `brew upgrade durable-workflow/tap/dw` を使います。安定したオプションとステータスフィールドの完全な契約は、[CLI リファレンス](./cli-reference.md#self-upgrade)を参照してください。
+`dw upgrade` は、他のツールが所有する Composer vendor と Homebrew cellar のインストール先を書き換えません。インストーラーで固定した公開リリースを再インストールするか、管理元のパッケージマネージャーで更新します。tap 管理の Homebrew インストールには `brew upgrade durable-workflow/tap/dw` を使います。安定したオプションとステータスフィールドの完全な契約は、[CLI リファレンス](./cli-reference.md#self-upgrade)を参照してください。
 
 ## 設定 {#configure}
 
diff --git a/i18n/ja/source-hashes.json b/i18n/ja/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/ja/source-hashes.json
+++ b/i18n/ja/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index 51e8fffe742..c42799d9171 100644
--- a/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -62,7 +62,7 @@ que o servidor ainda receba o array canônico `input`.
 | `dw debug workflow <workflow-id>` | Captura diagnóstico de execução presa: estado, tarefas pendentes, fatos da fila, falhas e metadados de compatibilidade. | `--run-id`, opções globais, `--json` |
 | `dw server:start-dev` | Serve a aplicação HTTP de um projeto Laravel existente configurado. Exige PHP externo. | `--port`, `--host` (padrão `127.0.0.1`), `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | Consulta um workflow até estado terminal ou limite de polling configurado. | `--run-id`, `--interval`, `--max-polls`, opções globais |
-| `dw upgrade` | Substitui o binário independente `dw` em execução por um release mais novo (ou fixado). Recusa reescrever vendor do Composer, cellar do Homebrew e instalações PHAR. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | Substitui o binário independente `dw` em execução por um release mais novo (ou fixado). Recusa reescrever instalações no vendor do Composer e no cellar do Homebrew. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 Use `server:info` para validar o formato do contrato, `doctor` para explicar
 por que uma CLI não se comunica com um servidor e `debug workflow` quando o
@@ -85,9 +85,8 @@ dependências ou processos HTTP retornam código não zero. Serviços Compose
 continuam executando quando o processo HTTP termina.
 
 Binários nativos POSIX encaminham SIGINT e SIGTERM ao filho ativo e aguardam
-até cinco segundos para seu grupo de processos parar. Instalações de código-fonte
-e PHAR exigem extensões PHP `pcntl` e `posix` para esse encaminhamento.
-Windows usa seu comportamento de interrupção do console.
+até cinco segundos para seu grupo de processos parar. Windows usa seu
+comportamento de interrupção do console.
 
 Para um Durable Workflow Server independente com imagens publicadas, siga o
 [início rápido de serviço](/docs/quickstart).
@@ -188,13 +187,14 @@ A saída JSON usa um campo estável `status` para a automação decidir sem inte
 | `upgraded` | Binário substituído por `target_version`. |
 | `noop` | `current_version` já corresponde a `target_version`; `--force` ignora isso. |
 | `dry-run` | `--dry-run` resolveu `target_version`, `asset_url` e `checksum_url` sem baixar. |
-| `refused` | Tipo de instalação não é binário de release independente (vendor Composer, cellar Homebrew ou PHAR), ou não há artefato publicado para a plataforma. |
+| `refused` | Tipo de instalação não é binário de release independente (vendor Composer ou cellar Homebrew), ou não há artefato publicado para a plataforma. |
 | `permission-denied` | O diretório de instalação não é gravável; o payload inclui um `hint` com o próximo passo recomendado. |
 | `error` | Erro de busca do catálogo de releases, divergência de checksum ou erro de filesystem. |
 
 Nas recusas, `installation.kind` identifica a ferramenta responsável
-(`composer-vendor`, `homebrew`, `phar` ou `binary`), e `reason` nomeia o
-responsável correto a usar. Para automação pública sem código-fonte,
+(`composer-vendor`, `homebrew`, `binary` ou `unknown`), e `reason` nomeia o
+responsável correto a usar. Apenas um PHAR 2.x, executando seu próprio código
+2.x, informa `phar`. Para automação pública sem código-fonte,
 reinstale um release fixado por `https://durable-workflow.com/install.sh`;
 para Homebrew gerenciado pelo tap, use `brew upgrade durable-workflow/tap/dw`.
 
diff --git a/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index c76fee32089..3023a6ac745 100644
--- a/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -94,21 +94,42 @@ esse diretório ao `PATH` do usuário.
 </details>
 
 <details>
-<summary><b>PHAR</b> (portátil, exige PHP 8.2+)</summary>
+<summary><b>Migrar de <code>dw.phar</code></b></summary>
+
+A partir da CLI 2.5.0, os releases não incluem mais PHAR. Se você executa
+`php dw.phar`, troque para o binário independente, que não precisa de PHP, com o
+instalador shell ou PowerShell acima. Depois exclua `dw.phar`. Os instaladores
+verificam o binário com o `SHA256SUMS` do release antes de instalá-lo.
+
+Se você não encaminha scripts para um shell, baixe o release e verifique-o
+primeiro. Escolha o artefato da sua plataforma:
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-O PHAR funciona onde PHP 8.2 ou posterior já está disponível e é o artefato
-recomendado para executores compartilhados de CI que já incluem PHP.
+No Windows, baixe, verifique e copie sem executar um script:
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+Adicione `%LOCALAPPDATA%\Programs\dw` ao seu `PATH` se ainda não estiver lá.
+
+Em uma instalação PHAR 2.x, `dw upgrade` ainda responde "Download the matching PHAR
+manually". Essa mensagem vem do release antigo e não pode ser alterada, então
+use os comandos acima. Instalações de binário independente são atualizadas
+normalmente com `dw upgrade`.
 
 </details>
 
@@ -124,8 +145,8 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` recusa reescrever instalações no vendor do Composer, cellar do
-Homebrew e PHAR, pois esses caminhos são controlados por outra ferramenta.
+`dw upgrade` recusa reescrever instalações no vendor do Composer e no cellar do
+Homebrew, pois esses caminhos são controlados por outra ferramenta.
 Reinstale um release público fixado com o instalador, atualize pelo gerenciador
 de pacotes responsável ou use `brew upgrade durable-workflow/tap/dw` para
 instalações Homebrew gerenciadas pelo tap. Veja a
diff --git a/i18n/pt-BR/source-hashes.json b/i18n/pt-BR/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/pt-BR/source-hashes.json
+++ b/i18n/pt-BR/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index 87b474d8c0e..54c4e1a00bd 100644
--- a/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -61,7 +61,7 @@ activity є позиційним масивом аргументів v2. Вві
 | `dw debug workflow <workflow-id>` | Зібрати діагностику застряглого виконання: стан, очікувані завдання, відомості про чергу, помилки й метадані сумісності. | `--run-id`, глобальні параметри, `--json` |
 | `dw server:start-dev` | Обслуговувати HTTP-запити наявного налаштованого Laravel-проєкту. Потрібен окремий PHP. | `--port`, `--host` (типово `127.0.0.1`), `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | Опитувати workflow до термінального стану чи заданої межі опитувань. | `--run-id`, `--interval`, `--max-polls`, глобальні параметри |
-| `dw upgrade` | Замінити поточний самостійний бінарний файл `dw` новішим чи зафіксованим релізом. Відмовляється змінювати Composer vendor, Homebrew cellar і PHAR. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | Замінити поточний самостійний бінарний файл `dw` новішим чи зафіксованим релізом. Відмовляється змінювати Composer vendor і Homebrew cellar. | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 Використовуйте `server:info` для перевірки форми контракту, `doctor` для пояснення
 проблем зв'язку CLI із сервером, а `debug workflow` для отримання
@@ -84,9 +84,8 @@ Compose проєкту з назвами `mysql` або `pgsql` відповід
 Compose продовжують працювати після завершення HTTP-процесу.
 
 Бінарні версії для POSIX передають SIGINT і SIGTERM активному дочірньому
-процесу та чекають до п'яти секунд на зупинку його групи процесів. Для цього
-встановлення з вихідного коду та PHAR потребують розширень PHP `pcntl` і
-`posix`. У Windows діє механізм переривання консолі.
+процесу та чекають до п'яти секунд на зупинку його групи процесів. У Windows
+діє механізм переривання консолі.
 
 Для окремого Durable Workflow Server з опублікованих образів скористайтеся
 [швидким стартом сервісного режиму](/docs/quickstart).
@@ -187,13 +186,14 @@ JSON містить стабільне поле `status` для автомати
 | `upgraded` | Бінарний файл замінено на `target_version`. |
 | `noop` | `current_version` уже відповідає `target_version`. `--force` обходить цю перевірку. |
 | `dry-run` | `--dry-run` визначив `target_version`, `asset_url` і `checksum_url` без завантаження. |
-| `refused` | Інсталяція не є самостійним бінарним файлом релізу (Composer vendor, Homebrew cellar чи PHAR) або для платформи немає опублікованого файлу. |
+| `refused` | Інсталяція не є самостійним бінарним файлом релізу (Composer vendor чи Homebrew cellar) або для платформи немає опублікованого файлу. |
 | `permission-denied` | Каталог інсталяції недоступний для запису. Payload містить `hint` із рекомендованою дією. |
 | `error` | Помилка отримання каталогу релізів, невідповідність контрольної суми чи помилка файлової системи. |
 
 У разі відмови `installation.kind` визначає інструмент керування
-(`composer-vendor`, `homebrew`, `phar` чи `binary`), а `reason` називає
-належний спосіб оновлення. Для публічної автоматизації без вихідного коду
+(`composer-vendor`, `homebrew`, `binary` чи `unknown`), а `reason` називає
+належний спосіб оновлення. Лише PHAR 2.x, який виконує власний код 2.x,
+повідомляє `phar`. Для публічної автоматизації без вихідного коду
 перевстановіть зафіксований реліз через `https://durable-workflow.com/install.sh`.
 Для інсталяцій Homebrew використовуйте `brew upgrade durable-workflow/tap/dw`.
 
diff --git a/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index c2117d49bf8..81515c5c284 100644
--- a/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -94,21 +94,42 @@ Installer записує `dw.exe` до `%USERPROFILE%\.durable-workflow\bin`
 </details>
 
 <details>
-<summary><b>PHAR</b> (переносний, потребує PHP 8.2+)</summary>
+<summary><b>Перехід із <code>dw.phar</code></b></summary>
+
+Починаючи з CLI 2.5.0, випуски не містять PHAR. Якщо ви запускаєте `php dw.phar`,
+перейдіть на standalone binary, якому не потрібен PHP, за допомогою shell чи
+PowerShell installer вище. Потім видаліть `dw.phar`. Installers перевіряють binary
+за `SHA256SUMS` випуску перед встановленням.
+
+Якщо ви не передаєте scripts безпосередньо в shell, спершу завантажте випуск і
+перевірте його. Виберіть артефакт для своєї платформи:
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-PHAR працює всюди, де вже доступний PHP 8.2 або новіший.
-Це рекомендований артефакт спільних CI runners, які вже містять PHP.
+У Windows завантажте, перевірте й скопіюйте файл без запуску script:
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+Додайте `%LOCALAPPDATA%\Programs\dw` до свого `PATH`, якщо його там ще немає.
+
+В інсталяції PHAR 2.x `dw upgrade` і далі відповідає "Download the matching PHAR
+manually". Це повідомлення походить зі старого випуску й не може бути змінене,
+тому використовуйте наведені вище команди. Standalone-встановлення binary
+оновлюються як зазвичай через `dw upgrade`.
 
 </details>
 
@@ -124,8 +145,8 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` відмовляється переписувати Composer vendor, Homebrew cellar
-та PHAR installs, бо ці шляхи належать іншому інструменту.
+`dw upgrade` відмовляється переписувати Composer vendor і Homebrew cellar
+installs, бо ці шляхи належать іншому інструменту.
 Перевстановіть закріплений публічний випуск installer, оновіть
 відповідний package manager або використайте
 `brew upgrade durable-workflow/tap/dw` для Homebrew tap.
diff --git a/i18n/uk/source-hashes.json b/i18n/uk/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/uk/source-hashes.json
+++ b/i18n/uk/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md b/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
index 9a4477ecb0c..c75351eaca5 100644
--- a/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
+++ b/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli-reference.md
@@ -54,7 +54,7 @@ keywords:
 | `dw debug workflow <workflow-id>` | 采集一个工作流卡住运行的诊断：状态、待处理任务、队列信息、失败及兼容性元数据。 | `--run-id`, 全局选项, `--json` |
 | `dw server:start-dev` | 为已配置的现有 Laravel 项目提供 HTTP 应用服务。要求外部 PHP。 | `--port`, `--host` （默认 `127.0.0.1`）, `--db=sqlite\|mysql\|pgsql` |
 | `dw watch workflow <workflow-id>` | 轮询工作流，直到终态或达到配置的轮询限制。 | `--run-id`, `--interval`, `--max-polls`, 全局选项 |
-| `dw upgrade` | 用更新或固定发布替换当前独立 `dw` 二进制文件。拒绝重写 Composer vendor、Homebrew cellar 和 PHAR 安装。 | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
+| `dw upgrade` | 用更新或固定发布替换当前独立 `dw` 二进制文件。拒绝重写 Composer vendor 和 Homebrew cellar 安装。 | `--tag`, `--dry-run`, `--force`, `--output=table\|json` |
 
 验证契约结构时使用 `server:info`，分析 CLI 无法连接 Server 的原因时使用 `doctor`，支持团队需要单次运行的机器可读采集时使用 `debug workflow`。
 
@@ -64,7 +64,7 @@ keywords:
 
 命令默认绑定回环地址。显式使用 `--host=0.0.0.0` 才绑定所有接口。MySQL 和 PostgreSQL 模式分别要求项目 Compose 服务名为 `mysql` 或 `pgsql`，并且有 `redis`。依赖或 HTTP 进程失败返回非零值。HTTP 进程结束后，Compose 服务继续运行。
 
-POSIX 原生二进制文件将 SIGINT 和 SIGTERM 转发给活动子进程，并最多等待五秒让其进程组停止。源码和 PHAR 安装要求 PHP 的 `pcntl` 和 `posix` 扩展才能转发。Windows 使用自身的控制台中断行为。
+POSIX 原生二进制文件将 SIGINT 和 SIGTERM 转发给活动子进程，并最多等待五秒让其进程组停止。Windows 使用自身的控制台中断行为。
 
 使用已发布镜像运行独立 Durable Workflow Server 时，请按[服务快速入门](/docs/quickstart)操作。
 
@@ -118,11 +118,11 @@ dw server:info --output=json \
 | `upgraded` | 二进制文件已替换为 `target_version`。 |
 | `noop` | `current_version` 已匹配 `target_version`；`--force` 可绕过。 |
 | `dry-run` | `--dry-run` 已解析 `target_version`、`asset_url` 和 `checksum_url`，没有下载。 |
-| `refused` | 安装类型不是独立发布二进制文件（Composer vendor、Homebrew cellar 或 PHAR），或平台没有已发布制品。 |
+| `refused` | 安装类型不是独立发布二进制文件（Composer vendor 或 Homebrew cellar），或平台没有已发布制品。 |
 | `permission-denied` | 安装目录不可写；负载包含建议下一步的 `hint`。 |
 | `error` | 获取发布目录失败、校验和不匹配，或文件系统错误。 |
 
-拒绝时，JSON 负载的 `installation.kind` 标识管理工具（`composer-vendor`、`homebrew`、`phar` 或 `binary`），`reason` 指出应改用哪个管理方。公开且无需源码的自动化可通过 `https://durable-workflow.com/install.sh` 重新安装固定发布；Homebrew tap 管理的安装使用 `brew upgrade durable-workflow/tap/dw`。
+拒绝时，JSON 负载的 `installation.kind` 标识管理工具（`composer-vendor`、`homebrew`、`binary` 或 `unknown`），`reason` 指出应改用哪个管理方。只有运行自身 2.x 代码的 2.x PHAR 才会报告 `phar`。公开且无需源码的自动化可通过 `https://durable-workflow.com/install.sh` 重新安装固定发布；Homebrew tap 管理的安装使用 `brew upgrade durable-workflow/tap/dw`。
 
 ## 环境配置档 {#environment-profiles}
 
diff --git a/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index d0bdb0f3efe..b615d38a02e 100644
--- a/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -76,20 +76,35 @@ dw --version
 </details>
 
 <details>
-<summary><b>PHAR</b>（可移植，要求 PHP 8.2+）</summary>
+<summary><b>从 <code>dw.phar</code> 迁移</b></summary>
+
+自 CLI 2.5.0 起，发布不再包含 PHAR。如果你运行 `php dw.phar`，请使用上方 shell 或 PowerShell 安装器切换到无需 PHP 的独立二进制文件，然后删除 `dw.phar`。安装器会在安装前根据发布的 `SHA256SUMS` 校验二进制文件。
+
+如果你不将脚本通过管道传给 shell，请先下载发布并进行验证。选择与你平台对应的制品：
 
 ```bash
-VERSION=<release-tag>
-curl -fsSL -o dw.phar \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/dw.phar"
-curl -fsSL -o SHA256SUMS \
-  "https://github.com/durable-workflow/cli/releases/download/${VERSION}/SHA256SUMS"
-sha256sum --check --ignore-missing SHA256SUMS
-chmod +x dw.phar
-./dw.phar --version
+mkdir release
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+sh release/verify-release.sh --attest release/
+install -m 0755 release/dw-linux-x86_64 ~/.local/bin/dw
 ```
 
-只要已有 PHP 8.2 或更新版本就能运行 PHAR；它是已配备 PHP 的共享 CI 运行器的推荐制品。
+在 Windows 上，无需运行脚本即可下载、验证并复制：
+
+```powershell
+New-Item -ItemType Directory -Force release | Out-Null
+gh release download %%artifact.cliVersion%% --repo durable-workflow/cli --dir release
+$expected = ((Select-String -Path release\SHA256SUMS -Pattern ' dw-windows-x86_64\.exe$').Line -split '\s+')[0]
+$actual = (Get-FileHash release\dw-windows-x86_64.exe -Algorithm SHA256).Hash.ToLower()
+if ($actual -ne $expected) { throw 'dw-windows-x86_64.exe does not match SHA256SUMS' }
+gh attestation verify release\dw-windows-x86_64.exe --repo durable-workflow/cli --signer-workflow durable-workflow/cli/.github/workflows/release-rust.yml
+New-Item -ItemType Directory -Force "$env:LOCALAPPDATA\Programs\dw" | Out-Null
+Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
+```
+
+如果 `%LOCALAPPDATA%\Programs\dw` 尚未在 `PATH` 中，请将其加入。
+
+在 2.x PHAR 安装中，`dw upgrade` 仍会回复 "Download the matching PHAR manually"。该消息来自旧发布且无法更改，请改用上方命令。独立二进制文件安装照常使用 `dw upgrade` 升级。
 
 </details>
 
@@ -103,7 +118,7 @@ dw upgrade --tag=<release-tag>     # pin to a specific release tag
 dw upgrade --dry-run       # resolve the target release without downloading
 ```
 
-`dw upgrade` 拒绝重写 Composer vendor、Homebrew cellar 和 PHAR 安装，因为这些路径由其他工具管理。使用安装器重新安装固定的公开发布，更新对应包管理器，或对 Homebrew tap 管理的安装使用 `brew upgrade durable-workflow/tap/dw`。完整稳定选项及状态字段契约见 [CLI 参考](./cli-reference.md#self-upgrade)。
+`dw upgrade` 拒绝重写 Composer vendor 和 Homebrew cellar 安装，因为这些路径由其他工具管理。使用安装器重新安装固定的公开发布，更新对应包管理器，或对 Homebrew tap 管理的安装使用 `brew upgrade durable-workflow/tap/dw`。完整稳定选项及状态字段契约见 [CLI 参考](./cli-reference.md#self-upgrade)。
 
 ## 配置 {#configure}
 
diff --git a/i18n/zh-Hans/source-hashes.json b/i18n/zh-Hans/source-hashes.json
index 4ae37cf6b9f..ae9816de2d1 100644
--- a/i18n/zh-Hans/source-hashes.json
+++ b/i18n/zh-Hans/source-hashes.json
@@ -70,8 +70,8 @@
   "polyglot/avro-value-protocol.md": "602e66c6288c1dd69d2b400c64e4739ad3a0493b5be269cee40f7848b11f260a",
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
-  "polyglot/cli-reference.md": "dc637af2ab17abc3f7e0233aeaacccc61dd1bbe7c94330e550a531ed1d8e48f8",
-  "polyglot/cli.mdx": "5c4b80e371705aaf37cb39eb9bc6375ca2496522dbeb161046707324190cef13",
+  "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
+  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",

From d0f4ec92d92b62e3e26791507845fe3cad257096 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Tue, 3 Nov 2026 22:28:26 -0600
Subject: [PATCH 2/2] Offer the macOS Intel CLI binary that 2.5.0 adds

CLI 2.5.0 publishes dw-macos-x86_64. Add a macOS (Intel) choice to the
install picker, list every release asset in the manual verification path,
and note that Intel Macs move from 2.x with the shell installer because
published 2.x dw upgrade has no macOS x86_64 asset. All eight languages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/polyglot/cli.mdx                                      | 6 +++++-
 .../current/polyglot/cli.mdx                               | 5 +++++
 i18n/de/source-hashes.json                                 | 2 +-
 .../current/polyglot/cli.mdx                               | 4 +++-
 i18n/es/source-hashes.json                                 | 2 +-
 .../current/polyglot/cli.mdx                               | 5 +++++
 i18n/fr/source-hashes.json                                 | 2 +-
 .../current/polyglot/cli.mdx                               | 4 +++-
 i18n/ja/source-hashes.json                                 | 2 +-
 .../current/polyglot/cli.mdx                               | 4 ++++
 i18n/pt-BR/source-hashes.json                              | 2 +-
 .../current/polyglot/cli.mdx                               | 4 ++++
 i18n/uk/source-hashes.json                                 | 2 +-
 .../current/polyglot/cli.mdx                               | 4 +++-
 i18n/zh-Hans/source-hashes.json                            | 2 +-
 src/components/CliInstall/index.js                         | 7 +++++++
 16 files changed, 46 insertions(+), 11 deletions(-)

diff --git a/docs/polyglot/cli.mdx b/docs/polyglot/cli.mdx
index a3af00d99fa..b3979f3e241 100644
--- a/docs/polyglot/cli.mdx
+++ b/docs/polyglot/cli.mdx
@@ -101,7 +101,8 @@ above. Then delete `dw.phar`. The installers check the binary against the
 release's `SHA256SUMS` before installing it.
 
 If you don't pipe scripts into a shell, download the release and verify it
-first. Pick your platform's asset:
+first. Pick your platform's asset: `dw-linux-x86_64`, `dw-linux-aarch64`,
+`dw-macos-aarch64`, `dw-macos-x86_64` or `dw-windows-x86_64.exe`.
 
 ```bash
 mkdir release
@@ -130,6 +131,9 @@ manually". That message comes from the old release and can't be changed, so
 use the commands above instead. Standalone-binary installs upgrade as usual
 with `dw upgrade`.
 
+On an Intel Mac, move from 2.x with the shell installer. Published 2.x
+`dw upgrade` has no macOS x86_64 asset to move to.
+
 </details>
 
 ### Update An Installed Binary
diff --git a/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index eeea83f1d31..7e750c4bb0b 100644
--- a/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/de/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -106,6 +106,7 @@ gegen die `SHA256SUMS` des Release.
 
 Wenn Sie keine Skripte an eine Shell weiterleiten, laden Sie das Release
 herunter und prüfen Sie es zuerst. Wählen Sie das Artefakt Ihrer Plattform:
+`dw-linux-x86_64`, `dw-linux-aarch64`, `dw-macos-aarch64`, `dw-macos-x86_64` oder `dw-windows-x86_64.exe`.
 
 ```bash
 mkdir release
@@ -136,6 +137,10 @@ matching PHAR manually". Diese Meldung stammt aus dem alten Release und lässt
 sich nicht ändern; verwenden Sie stattdessen die obigen Befehle. Installationen
 der eigenständigen Binärdatei aktualisieren sich wie gewohnt mit `dw upgrade`.
 
+Auf einem Intel-Mac wechseln Sie von 2.x mit der Shell-Installation. Das
+veröffentlichte `dw upgrade` aus 2.x hat kein macOS-x86_64-Artefakt, zu dem es
+wechseln könnte.
+
 </details>
 
 ### Eine installierte Binärdatei aktualisieren {#update-an-installed-binary}
diff --git a/i18n/de/source-hashes.json b/i18n/de/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/de/source-hashes.json
+++ b/i18n/de/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index 42ab19a4e81..8427bcd3fd8 100644
--- a/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/es/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -80,7 +80,7 @@ El instalador escribe `dw.exe` en `%USERPROFILE%\.durable-workflow\bin` y añade
 
 A partir de CLI 2.5.0, las publicaciones no incluyen PHAR. Si ejecutas `php dw.phar`, cambia al binario independiente, que no necesita PHP, con el instalador de shell o de PowerShell anterior. Después elimina `dw.phar`. Los instaladores verifican el binario con el `SHA256SUMS` de la publicación antes de instalarlo.
 
-Si no canalizas scripts hacia una shell, descarga la publicación y verifícala primero. Elige el artefacto de tu plataforma:
+Si no canalizas scripts hacia una shell, descarga la publicación y verifícala primero. Elige el artefacto de tu plataforma: `dw-linux-x86_64`, `dw-linux-aarch64`, `dw-macos-aarch64`, `dw-macos-x86_64` o `dw-windows-x86_64.exe`.
 
 ```bash
 mkdir release
@@ -106,6 +106,8 @@ Añade `%LOCALAPPDATA%\Programs\dw` a tu `PATH` si aún no está.
 
 En una instalación PHAR 2.x, `dw upgrade` sigue respondiendo "Download the matching PHAR manually". Ese mensaje procede de la publicación antigua y no puede cambiarse, así que utiliza los comandos anteriores. Las instalaciones de binario independiente se actualizan con `dw upgrade` como siempre.
 
+En un Mac con Intel, migra desde 2.x con el instalador de shell. El `dw upgrade` publicado de 2.x no tiene ningún artefacto de macOS x86_64 al que cambiar.
+
 </details>
 
 ### Actualizar un binario instalado {#update-an-installed-binary}
diff --git a/i18n/es/source-hashes.json b/i18n/es/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/es/source-hashes.json
+++ b/i18n/es/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index e3e058ea248..72931e3a73c 100644
--- a/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/fr/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -105,6 +105,7 @@ de l'installer.
 
 Si vous ne redirigez pas de scripts vers un shell, téléchargez la version et
 vérifiez-la d'abord. Choisissez l'artefact de votre plateforme :
+`dw-linux-x86_64`, `dw-linux-aarch64`, `dw-macos-aarch64`, `dw-macos-x86_64` ou `dw-windows-x86_64.exe`.
 
 ```bash
 mkdir release
@@ -133,6 +134,10 @@ matching PHAR manually ». Ce message provient de l'ancienne version et ne peut
 pas être modifié ; utilisez donc les commandes ci-dessus. Les installations du
 binaire autonome se mettent à jour normalement avec `dw upgrade`.
 
+Sur un Mac Intel, migrez depuis la 2.x avec l'installateur shell. La commande
+`dw upgrade` publiée en 2.x ne dispose d'aucun artefact macOS x86_64 vers lequel
+migrer.
+
 </details>
 
 ### Mettre à jour un binaire installé {#update-an-installed-binary}
diff --git a/i18n/fr/source-hashes.json b/i18n/fr/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/fr/source-hashes.json
+++ b/i18n/fr/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index 3843f9b816c..f26a090b5f6 100644
--- a/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/ja/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -80,7 +80,7 @@ dw --version
 
 CLI 2.5.0 以降、リリースには PHAR が含まれません。`php dw.phar` を実行している場合は、上記のシェルまたは PowerShell インストーラーで、PHP が不要な単独バイナリへ切り替えてください。その後 `dw.phar` を削除します。インストーラーは、インストール前にリリースの `SHA256SUMS` でバイナリを検証します。
 
-スクリプトをシェルへパイプしない場合は、先にリリースをダウンロードして検証します。使用するプラットフォームのアセットを選んでください。
+スクリプトをシェルへパイプしない場合は、先にリリースをダウンロードして検証します。使用するプラットフォームのアセット（`dw-linux-x86_64`、`dw-linux-aarch64`、`dw-macos-aarch64`、`dw-macos-x86_64`、`dw-windows-x86_64.exe` のいずれか）を選んでください。
 
 ```bash
 mkdir release
@@ -106,6 +106,8 @@ Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
 
 2.x の PHAR インストールでは、`dw upgrade` は引き続き "Download the matching PHAR manually" と応答します。このメッセージは旧リリースに由来し変更できないため、代わりに上記のコマンドを使ってください。単独バイナリのインストールは、通常どおり `dw upgrade` で更新できます。
 
+Intel Mac では、シェルインストーラーで 2.x から移行してください。公開済みの 2.x の `dw upgrade` には、移行先となる macOS x86_64 のアセットがありません。
+
 </details>
 
 ### インストール済みバイナリの更新 {#update-an-installed-binary}
diff --git a/i18n/ja/source-hashes.json b/i18n/ja/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/ja/source-hashes.json
+++ b/i18n/ja/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index 3023a6ac745..558a66f4a2e 100644
--- a/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/pt-BR/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -103,6 +103,7 @@ verificam o binário com o `SHA256SUMS` do release antes de instalá-lo.
 
 Se você não encaminha scripts para um shell, baixe o release e verifique-o
 primeiro. Escolha o artefato da sua plataforma:
+`dw-linux-x86_64`, `dw-linux-aarch64`, `dw-macos-aarch64`, `dw-macos-x86_64` ou `dw-windows-x86_64.exe`.
 
 ```bash
 mkdir release
@@ -131,6 +132,9 @@ manually". Essa mensagem vem do release antigo e não pode ser alterada, então
 use os comandos acima. Instalações de binário independente são atualizadas
 normalmente com `dw upgrade`.
 
+Em um Mac Intel, migre do 2.x com o instalador shell. O `dw upgrade` publicado
+no 2.x não tem um artefato macOS x86_64 para o qual migrar.
+
 </details>
 
 ### Atualizar um binário instalado {#update-an-installed-binary}
diff --git a/i18n/pt-BR/source-hashes.json b/i18n/pt-BR/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/pt-BR/source-hashes.json
+++ b/i18n/pt-BR/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index 81515c5c284..7f9a92b0d61 100644
--- a/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/uk/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -103,6 +103,7 @@ PowerShell installer вище. Потім видаліть `dw.phar`. Installers
 
 Якщо ви не передаєте scripts безпосередньо в shell, спершу завантажте випуск і
 перевірте його. Виберіть артефакт для своєї платформи:
+`dw-linux-x86_64`, `dw-linux-aarch64`, `dw-macos-aarch64`, `dw-macos-x86_64` або `dw-windows-x86_64.exe`.
 
 ```bash
 mkdir release
@@ -131,6 +132,9 @@ manually". Це повідомлення походить зі старого в
 тому використовуйте наведені вище команди. Standalone-встановлення binary
 оновлюються як зазвичай через `dw upgrade`.
 
+На Mac з Intel переходьте з 2.x за допомогою shell installer. Опублікований
+`dw upgrade` у 2.x не має артефакту macOS x86_64, на який можна перейти.
+
 </details>
 
 ### Оновлення встановленого виконуваного файлу {#update-an-installed-binary}
diff --git a/i18n/uk/source-hashes.json b/i18n/uk/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/uk/source-hashes.json
+++ b/i18n/uk/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx b/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
index b615d38a02e..f9dac166b31 100644
--- a/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
+++ b/i18n/zh-Hans/docusaurus-plugin-content-docs/current/polyglot/cli.mdx
@@ -80,7 +80,7 @@ dw --version
 
 自 CLI 2.5.0 起，发布不再包含 PHAR。如果你运行 `php dw.phar`，请使用上方 shell 或 PowerShell 安装器切换到无需 PHP 的独立二进制文件，然后删除 `dw.phar`。安装器会在安装前根据发布的 `SHA256SUMS` 校验二进制文件。
 
-如果你不将脚本通过管道传给 shell，请先下载发布并进行验证。选择与你平台对应的制品：
+如果你不将脚本通过管道传给 shell，请先下载发布并进行验证。选择与你平台对应的制品：`dw-linux-x86_64`、`dw-linux-aarch64`、`dw-macos-aarch64`、`dw-macos-x86_64` 或 `dw-windows-x86_64.exe`。
 
 ```bash
 mkdir release
@@ -106,6 +106,8 @@ Copy-Item release\dw-windows-x86_64.exe "$env:LOCALAPPDATA\Programs\dw\dw.exe"
 
 在 2.x PHAR 安装中，`dw upgrade` 仍会回复 "Download the matching PHAR manually"。该消息来自旧发布且无法更改，请改用上方命令。独立二进制文件安装照常使用 `dw upgrade` 升级。
 
+在 Intel Mac 上，请使用 shell 安装器从 2.x 迁移。已发布的 2.x `dw upgrade` 没有可迁移到的 macOS x86_64 制品。
+
 </details>
 
 ### 更新已安装的二进制文件 {#update-an-installed-binary}
diff --git a/i18n/zh-Hans/source-hashes.json b/i18n/zh-Hans/source-hashes.json
index ae9816de2d1..ba901179219 100644
--- a/i18n/zh-Hans/source-hashes.json
+++ b/i18n/zh-Hans/source-hashes.json
@@ -71,7 +71,7 @@
   "polyglot/cancellation.md": "a08aca914d8211d32184fd76f14e4f8bf47d40656e55364923013e3cece3b70d",
   "polyglot/cli-python-parity.md": "acf1acbf15ca9cdf069154699c5fbf8c1d1fd3241a32d201ac10b8ec76c038be",
   "polyglot/cli-reference.md": "269039ffae9df115f2a2a5586b51c9ca8b273d193bfce427819e50fd2f64793a",
-  "polyglot/cli.mdx": "69b05de15ebabb80a0d65d2b25e43da60355e605859d43dda28568bb27e0f557",
+  "polyglot/cli.mdx": "c0ab3a8f3f2568335b76cc57a890f5d60a93d6d3e78690aa2b4e74f35e08b42a",
   "polyglot/cloud-control-plane.md": "bb375e598dd1afa3207171047fb81b0cb82c382ce535ab415cb09dc10f6d748e",
   "polyglot/deployment-modes.md": "7b508db4be86c92de76cfd8dfd946d93941c8a6f0a601a161d4d3fd1711bf97f",
   "polyglot/embedded-to-server.md": "21a7e4c9439a73db3a97fd9b0610749faabf7c449806fe0ad55a0924f50d3b80",
diff --git a/src/components/CliInstall/index.js b/src/components/CliInstall/index.js
index b51d974b9ad..e0a995c0e0f 100644
--- a/src/components/CliInstall/index.js
+++ b/src/components/CliInstall/index.js
@@ -27,6 +27,13 @@ const PLATFORMS = [
     command: 'curl -fsSL https://durable-workflow.com/install.sh | sh',
     asset: 'dw-macos-aarch64',
   },
+  {
+    id: 'macos-x86_64',
+    label: 'macOS (Intel)',
+    shell: 'bash',
+    command: 'curl -fsSL https://durable-workflow.com/install.sh | sh',
+    asset: 'dw-macos-x86_64',
+  },
   {
     id: 'windows-x86_64',
     label: 'Windows (x86_64)',