diff --git a/.github/workflows/adhoc-mac-build.yml b/.github/workflows/adhoc-mac-build.yml
index 0febb6f8948..23525ee6208 100644
--- a/.github/workflows/adhoc-mac-build.yml
+++ b/.github/workflows/adhoc-mac-build.yml
@@ -128,18 +128,6 @@ jobs:
           echo "Resolved $REQUESTED_REF -> $sha"
           echo "sha=$sha" >>"$GITHUB_OUTPUT"
 
-  # Why its own job: this package ships relays for Windows SSH hosts, and only a
-  # Windows runner compiles the addon that launches one outside sshd's job.
-  # Why the unvetted ref is safe here: this job holds no secrets, and the mac job
-  # vets the same ref before it downloads anything, so fork code never gets signed.
-  relay-windows-process-tree:
-    needs: resolve-ref
-    permissions:
-      contents: read
-    uses: ./.github/workflows/relay-windows-process-tree.yml
-    with:
-      ref: ${{ needs.resolve-ref.outputs.sha }}
-
   # Why: a branch cut before the orcad template landed has none to build or ship.
   orcad-template-support:
     needs: resolve-ref
@@ -156,8 +144,17 @@ jobs:
           ref: ${{ needs.resolve-ref.outputs.sha }}
           sparse-checkout: |
             /config/scripts/packaged-orcad-template.cjs
+            /config/tsconfig.relay.json
           sparse-checkout-cone-mode: false
           persist-credentials: false
+      # Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
+      - name: Refuse a ref that still ships the SSH relay
+        shell: bash
+        run: |
+          if [[ -e config/tsconfig.relay.json ]]; then
+            echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
+            exit 1
+          fi
       - name: Detect whether the ref ships the orcad template
         id: detect
         shell: bash
@@ -171,8 +168,8 @@ jobs:
 
   # Design D2, as release-cut does: every desktop build ships the orcad template (server JS plus
   # every target's addons), merged from the node-server lanes that qualify each slot at this ref.
-  # Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, like the
-  # relay job, and the mac job vets the ref before anything is signed.
+  # Without it an adhoc build cannot deploy managed orcad to an SSH host. No secrets, and the mac
+  # job vets the ref before anything is signed.
   orcad-template:
     needs: [resolve-ref, orcad-template-support]
     if: needs.orcad-template-support.outputs.ships == 'true'
@@ -184,11 +181,10 @@ jobs:
       build_template: true
 
   build-adhoc-mac:
-    needs: [resolve-ref, relay-windows-process-tree, orcad-template-support, orcad-template]
+    needs: [resolve-ref, orcad-template-support, orcad-template]
     # Why not the implicit success(): a ref without the orcad template skips that job on purpose.
     if: >-
       !cancelled() && github.repository == 'stablyai/orca' &&
-      needs.relay-windows-process-tree.result == 'success' &&
       needs.orcad-template-support.result == 'success' &&
       (needs.orcad-template.result == 'success' ||
         (needs.orcad-template.result == 'skipped' &&
@@ -371,14 +367,6 @@ jobs:
           fi
           cat "$RUNNER_TEMP/adhoc-identity.txt" >>"$GITHUB_OUTPUT"
 
-      # Only a Windows runner compiles these; the relay-windows-process-tree job
-      # built them for this run.
-      - name: Collect the Windows process-table addons for the relay
-        uses: actions/download-artifact@v8
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree
-
       - name: Build app
         run: pnpm build:release
         env:
@@ -387,9 +375,6 @@ jobs:
           # gate accepts only 'stable' or 'rc', so leaving this unset keeps them
           # silent, which is correct for unvetted branch artifacts.
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
-          # Fail the build rather than ship a relay that cannot launch outside
-          # sshd's job for a standard user on a Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
 
       # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
       - name: Download the orcad deployment template
diff --git a/.github/workflows/daily-mac-build.yml b/.github/workflows/daily-mac-build.yml
index 9f013a8c724..c50ca782c56 100644
--- a/.github/workflows/daily-mac-build.yml
+++ b/.github/workflows/daily-mac-build.yml
@@ -89,16 +89,6 @@ jobs:
           [[ "$head_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::Could not resolve main"; exit 1; }
           echo "head_sha=$head_sha" >>"$GITHUB_OUTPUT"
 
-  # Why its own job: this package ships relays for Windows SSH hosts, and only a
-  # Windows runner compiles the addon that launches one outside sshd's job.
-  relay-windows-process-tree:
-    needs: resolve-main
-    permissions:
-      contents: read
-    uses: ./.github/workflows/relay-windows-process-tree.yml
-    with:
-      ref: ${{ needs.resolve-main.outputs.head_sha }}
-
   # As release-cut does: every SSH host runs orcad, deployed from the template this build ships.
   orcad-template:
     needs: resolve-main
@@ -112,7 +102,6 @@ jobs:
   build-daily-mac:
     needs:
       - resolve-main
-      - relay-windows-process-tree
       - orcad-template
     if: github.repository == 'stablyai/orca'
     outputs:
@@ -290,15 +279,6 @@ jobs:
           fi
           cat "$RUNNER_TEMP/daily-identity.txt" >>"$GITHUB_OUTPUT"
 
-      # Only a Windows runner compiles these; the relay-windows-process-tree job
-      # built them for this run.
-      - name: Collect the Windows process-table addons for the relay
-        if: steps.freshness.outputs.should_build == 'true'
-        uses: actions/download-artifact@v8
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree
-
       - name: Build app
         if: steps.freshness.outputs.should_build == 'true'
         run: pnpm build:release
@@ -308,9 +288,6 @@ jobs:
           # gate accepts only 'stable' or 'rc', so leaving this unset keeps them
           # silent, which is correct for unvetted dev artifacts.
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
-          # Fail the build rather than ship a relay that cannot launch outside
-          # sshd's job for a standard user on a Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
 
       # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
       - name: Download the orcad deployment template
diff --git a/.github/workflows/dev-channel-win-build.yml b/.github/workflows/dev-channel-win-build.yml
index 4445c05ecd3..19465996486 100644
--- a/.github/workflows/dev-channel-win-build.yml
+++ b/.github/workflows/dev-channel-win-build.yml
@@ -180,6 +180,15 @@ jobs:
           # (zizmor: artipacked).
           persist-credentials: false
 
+      # Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
+      - name: Refuse a ref that still ships the SSH relay
+        shell: bash
+        run: |
+          if [[ -e config/tsconfig.relay.json ]]; then
+            echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
+            exit 1
+          fi
+
       # Why a guard and not just a build: the workflow file comes from the
       # dispatch ref, but the packaging config comes from the *built* commit. A
       # branch cut before Windows dev builds landed has a config that ignores
@@ -247,23 +256,10 @@ jobs:
         shell: bash
         run: node config/scripts/verify-dev-channel-packaging.mjs --channel="$CHANNEL" --platform=win32
 
-      # Why here and not in build:relay: only a Windows runner can compile it, and
-      # arm64 cross-compiles from this same x64 agent. Runs before the 20-minute
-      # build so a runner image missing the MSVC ARM64 cross toolset fails in
-      # seconds with MSB8020 naming the component, rather than deep into packaging.
-      - name: Build Windows process-table addon for the relay
-        shell: bash
-        run: |
-          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
-          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
-
       - name: Build app
         shell: bash
         run: pnpm build:release
         env:
-          # Fail the build rather than ship a relay that silently falls back to
-          # the PowerShell scan on every Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: 'x64,arm64'
           # Why unset ORCA_BUILD_IDENTITY: telemetry's transport gate accepts only
           # 'stable' or 'rc', so leaving it unset keeps dev builds silent — which
           # is correct for unvetted artifacts. Same as the mac dev channels.
diff --git a/.github/workflows/hourly-mac-build.yml b/.github/workflows/hourly-mac-build.yml
index aabfc6f1cfc..d254ff393d5 100644
--- a/.github/workflows/hourly-mac-build.yml
+++ b/.github/workflows/hourly-mac-build.yml
@@ -116,17 +116,6 @@ jobs:
             echo "main moved to $head_sha (last hourly built $last_sha); building."
           fi
 
-  # Why its own job: this package ships relays for Windows SSH hosts, and only a
-  # Windows runner compiles the addon that launches one outside sshd's job.
-  relay-windows-process-tree:
-    needs: preflight
-    if: needs.preflight.outputs.should_build == 'true'
-    permissions:
-      contents: read
-    uses: ./.github/workflows/relay-windows-process-tree.yml
-    with:
-      ref: ${{ needs.preflight.outputs.head_sha }}
-
   # As release-cut does: every SSH host runs orcad, deployed from the template this build ships.
   orcad-template:
     needs: preflight
@@ -141,7 +130,6 @@ jobs:
   build-hourly-mac:
     needs:
       - preflight
-      - relay-windows-process-tree
       - orcad-template
     if: needs.preflight.outputs.should_build == 'true'
     outputs:
@@ -279,14 +267,6 @@ jobs:
           fi
           cat "$RUNNER_TEMP/hourly-identity.txt" >>"$GITHUB_OUTPUT"
 
-      # Only a Windows runner compiles these; the relay-windows-process-tree job
-      # built them for this run.
-      - name: Collect the Windows process-table addons for the relay
-        uses: actions/download-artifact@v8
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree
-
       - name: Build app
         run: pnpm build:release
         env:
@@ -295,9 +275,6 @@ jobs:
           # gate accepts only 'stable' or 'rc', so leaving this unset keeps them
           # silent, which is correct for unvetted dev artifacts.
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
-          # Fail the build rather than ship a relay that cannot launch outside
-          # sshd's job for a standard user on a Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
 
       # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
       - name: Download the orcad deployment template
diff --git a/.github/workflows/node-server-tests.yml b/.github/workflows/node-server-tests.yml
index 66946a8e98f..994123c0e50 100644
--- a/.github/workflows/node-server-tests.yml
+++ b/.github/workflows/node-server-tests.yml
@@ -205,14 +205,26 @@ jobs:
         env:
           ORCA_BUN_ORCAD_SLOT: ${{ steps.bun-orcad.outputs.slot }}
           BUN_EXECUTABLE: ${{ steps.bun-orcad.outputs.executable }}
-      # Only a Windows runner compiles it; arm64 cross-compiles here, as release-cut does for the relay.
+      # Only a Windows runner compiles it; arm64 cross-compiles here.
       # Before the Node 18 check below: the build script imports TypeScript, which Node 18 cannot load.
+      # orcad's instance lock and stop proof read a PID's creation time through it; the x64 binary this
+      # runner loads must answer it, and answer nothing for a missing PID rather than a stale time.
       - name: Build the Windows process-table addons for the desktop template
         if: inputs.build_template && matrix.os == 'windows-2022'
         shell: bash
         run: |
           node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
           node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
+          node -e "
+          const { assertWindowsProcessTreeCreationTime } = require('./config/scripts/windows-process-tree-creation-time.cjs')
+          const addon = require('./.build/windows-process-tree/x64/windows-process-tree.node')
+          assertWindowsProcessTreeCreationTime({ module: addon })
+          const own = addon.getProcessCreationTime(process.pid)
+          const started = Date.now() - process.uptime() * 1000
+          if (typeof own !== 'number' || Math.abs(own - started) > 5000) throw new Error('creation time ' + own + ' vs ' + started)
+          if (addon.getProcessCreationTime(0x7ffffff0) !== undefined) throw new Error('a missing PID must read undefined')
+          console.log('creation time ok:', own)
+          "
       - name: Keep the Windows process-table addons for the desktop template
         if: inputs.build_template && matrix.os == 'windows-2022'
         uses: actions/upload-artifact@v7
diff --git a/.github/workflows/relay-windows-process-tree.yml b/.github/workflows/relay-windows-process-tree.yml
deleted file mode 100644
index a61f2fae8e9..00000000000
--- a/.github/workflows/relay-windows-process-tree.yml
+++ /dev/null
@@ -1,88 +0,0 @@
-name: Relay Windows process-tree addons
-
-# Why a reusable workflow: every desktop package ships relays for Windows SSH hosts,
-# but only a Windows runner can compile the addon that launches a relay outside
-# sshd's job. macOS and Linux packaging jobs download this artifact into
-# .build/windows-process-tree before `pnpm build:release` stages it.
-on:
-  workflow_call:
-    inputs:
-      ref:
-        description: Commit or tag to build; must match what the packaging job checks out.
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    # Why windows-2022: windows-latest moved to VS 2026 before node-gyp could detect
-    # it. GitHub-hosted, so release-cut's SignPath provenance rule still holds.
-    runs-on: windows-2022
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref }}
-          persist-credentials: false
-
-      # Plain setup rather than a composite action: `uses: ./` resolves from the
-      # checked-out ref, which may be a release tag that predates the action.
-      - name: Setup pnpm
-        uses: pnpm/setup@v2
-        with:
-          install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: package.json
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-
-      # Why host-only: the addon is compiled from the patched source pnpm
-      # materializes, and arm64 cross-compiles through node-gyp --arch.
-      - name: Install dependencies
-        uses: nick-fields/retry@v4
-        with:
-          timeout_minutes: 10
-          max_attempts: 3
-          retry_wait_seconds: 30
-          command: pnpm install --frozen-lockfile
-
-      # The build script refuses unpatched source and checks each output's PE
-      # machine, ReadProcessMemory import, and spawnOutsideJob export.
-      - name: Build Windows process-table addons for the relay
-        shell: bash
-        run: |
-          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=x64
-          node config/scripts/build-windows-process-tree-relay-addon.mjs --arch=arm64
-
-      # orcad's instance lock and stop proof read one PID's creation time through this addon on
-      # Windows SSH hosts; prove the x64 binary this runner can load answers it, and answers
-      # nothing for a PID that does not exist rather than a stale or zero time.
-      - name: Assert the addon reads process creation time
-        shell: bash
-        run: |
-          node -e "
-          const { assertWindowsProcessTreeCreationTime } = require('./config/scripts/windows-process-tree-creation-time.cjs')
-          const addon = require('./.build/windows-process-tree/x64/windows-process-tree.node')
-          assertWindowsProcessTreeCreationTime({ module: addon })
-          const own = addon.getProcessCreationTime(process.pid)
-          const started = Date.now() - process.uptime() * 1000
-          if (typeof own !== 'number' || Math.abs(own - started) > 5000) throw new Error('creation time ' + own + ' vs ' + started)
-          if (addon.getProcessCreationTime(0x7ffffff0) !== undefined) throw new Error('a missing PID must read undefined')
-          console.log('creation time ok:', own)
-          "
-
-      - name: Upload relay addons
-        uses: actions/upload-artifact@v7
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree/
-          if-no-files-found: error
-          retention-days: 7
-          # A rerun attempt re-uploads under the same name, which is otherwise refused.
-          overwrite: true
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 174b2e3c011..e81fdcf04a5 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -113,6 +113,15 @@ jobs:
           # `git push` overwrites the existing tag.
           fetch-tags: true
 
+      # Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
+      - name: Refuse a ref that still ships the SSH relay
+        shell: bash
+        run: |
+          if [[ -e config/tsconfig.relay.json ]]; then
+            echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
+            exit 1
+          fi
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
@@ -1200,18 +1209,6 @@ jobs:
       - name: Confirm blocking release gates passed
         run: echo "All blocking release gates passed; artifact builds may start."
 
-  # Why its own job: every desktop package ships Windows relays, but only a
-  # Windows runner compiles the addon that launches one outside sshd's job.
-  # Needs only cut, so it overlaps the release gates instead of extending them.
-  relay-windows-process-tree:
-    needs: cut
-    if: needs.cut.outputs.should_release == 'true'
-    permissions:
-      contents: read
-    uses: ./.github/workflows/relay-windows-process-tree.yml
-    with:
-      ref: refs/tags/${{ needs.cut.outputs.tag }}
-
   # Compilation can overlap the release gates; signing remains behind release-preflight.
   release-javascript:
     needs: cut
@@ -1231,7 +1228,6 @@ jobs:
       - orcad-template
       - release-preflight
       - release-javascript
-      - relay-windows-process-tree
     # Why not the implicit success(): a tag without the orcad template skips that job on purpose.
     if: >-
       !cancelled() &&
@@ -1240,7 +1236,6 @@ jobs:
       needs.create-release.result == 'success' &&
       needs.release-preflight.result == 'success' &&
       needs.release-javascript.result == 'success' &&
-      needs.relay-windows-process-tree.result == 'success' &&
       (needs.orcad-template.result == 'success' ||
         (needs.orcad-template.result == 'skipped' && needs.cut.outputs.ships_orcad_template == 'false'))
     env:
@@ -1450,16 +1445,6 @@ jobs:
           echo "identity=$identity" >>"$GITHUB_OUTPUT"
           echo "Classified $TAG as $identity"
 
-      # Why every leg: each package ships relays for Windows SSH hosts. v1.4.203 and
-      # earlier shipped Windows relays with no windows-process-tree.node, and mac and
-      # Linux packages shipped none until the addon moved to its own Windows job.
-      # Why no run_attempt guard: Build app is ungated, so a rerun needs it staged too.
-      - name: Collect the Windows process-table addons for the relay
-        uses: actions/download-artifact@v8
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree
-
       # Why an explicit step rather than trusting the runner image: the packaged
       # CLI launcher is a native Rust binary, and a Windows host without cargo
       # fails deep inside electron-builder's native hook instead of here. Real
@@ -1500,9 +1485,6 @@ jobs:
           ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ needs.release-javascript.outputs.source_sha }}
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
           ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
-          # Fail the release rather than ship a relay that cannot launch outside
-          # sshd's job for a standard user on a Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
 
       # After the app build so nothing that cleans out/ can drop it; electron-builder ships it.
       - name: Download the orcad deployment template
@@ -2343,8 +2325,6 @@ jobs:
       - orcad-template
       - release-preflight
       - release-javascript
-      # release-mac-build.yml downloads the relay addons from this run.
-      - relay-windows-process-tree
     # Why not the implicit success(): a tag without the orcad template skips that job on purpose.
     if: >-
       !cancelled() &&
@@ -2353,7 +2333,6 @@ jobs:
       needs.create-release.result == 'success' &&
       needs.release-preflight.result == 'success' &&
       needs.release-javascript.result == 'success' &&
-      needs.relay-windows-process-tree.result == 'success' &&
       (needs.orcad-template.result == 'success' ||
         (needs.orcad-template.result == 'skipped' && needs.cut.outputs.ships_orcad_template == 'false'))
     # Why: SignPath requires every job in this signing workflow to be
diff --git a/.github/workflows/release-mac-build.yml b/.github/workflows/release-mac-build.yml
index ee8a183f9e4..c71c522b5fb 100644
--- a/.github/workflows/release-mac-build.yml
+++ b/.github/workflows/release-mac-build.yml
@@ -36,7 +36,7 @@ jobs:
     # faster runner.
     runs-on: blacksmith-6vcpu-macos-15
     timeout-minutes: 60
-    # actions: read fetches the relay addons from the release-cut run.
+    # actions: read fetches the release-cut run's artifacts.
     permissions:
       actions: read
       contents: write
@@ -48,6 +48,15 @@ jobs:
         with:
           ref: refs/tags/${{ inputs.tag }}
 
+      # Why: a relay-era ref (before #27215) needs the Windows relay addon this build no longer compiles.
+      - name: Refuse a ref that still ships the SSH relay
+        shell: bash
+        run: |
+          if [[ -e config/tsconfig.relay.json ]]; then
+            echo "::error::This ref predates #27215 and still ships the SSH relay; build a commit at or after 2b4b60a87e."
+            exit 1
+          fi
+
       - name: Restore draft-publish scripts from the workflow ref
         env:
           WORKFLOW_SHA: ${{ github.workflow_sha }}
@@ -138,16 +147,6 @@ jobs:
           echo "identity=$identity" >>"$GITHUB_OUTPUT"
           echo "Classified $TAG as $identity"
 
-      # Only a Windows runner compiles these; release-cut's relay-windows-process-tree
-      # job built them from this tag before dispatching this workflow.
-      - name: Collect the Windows process-table addons for the relay
-        uses: actions/download-artifact@v8
-        with:
-          name: relay-windows-process-tree
-          path: .build/windows-process-tree
-          run-id: ${{ inputs.release_run_id }}
-          github-token: ${{ github.token }}
-
       - name: Download release JavaScript from the release run
         if: inputs.javascript_source_sha != ''
         uses: actions/download-artifact@v8
@@ -173,9 +172,6 @@ jobs:
           ORCA_RELEASE_JAVASCRIPT_SOURCE_SHA: ${{ inputs.javascript_source_sha }}
           ORCA_DIAGNOSTICS_TOKEN_URL: https://www.onorca.dev/diagnostics/token
           ORCA_POSTHOG_WRITE_KEY: ${{ secrets.ORCA_POSTHOG_WRITE_KEY }}
-          # Fail the release rather than ship a relay that cannot launch outside
-          # sshd's job for a standard user on a Windows SSH host.
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: x64,arm64
 
       # Design D2: the parent release-cut run merged it from every node-server lane at this tag.
       - name: Download the orcad deployment template from the release run
diff --git a/.github/workflows/ssh-windows-hosts.yml b/.github/workflows/ssh-windows-hosts.yml
index e70fd5a8d6e..9cadb3a8b85 100644
--- a/.github/workflows/ssh-windows-hosts.yml
+++ b/.github/workflows/ssh-windows-hosts.yml
@@ -157,8 +157,6 @@ jobs:
           arches: ${{ matrix.arch }}
       - name: Build the win32 template and the relay
         shell: bash
-        env:
-          ORCA_REQUIRE_RELAY_NATIVE_ADDONS: ${{ matrix.arch }}
         run: |
           pnpm build:orcad-prebuilds --require-slots "win32-${{ matrix.arch }}"
           node config/scripts/build-orcad-template.mjs --targets "win32-${{ matrix.arch }}"
diff --git a/config/scripts/adhoc-build-pinned-commit.test.mjs b/config/scripts/adhoc-build-pinned-commit.test.mjs
index 2768779aad0..09333f002eb 100644
--- a/config/scripts/adhoc-build-pinned-commit.test.mjs
+++ b/config/scripts/adhoc-build-pinned-commit.test.mjs
@@ -61,7 +61,6 @@ afterAll(() => rmSync(directory, { recursive: true, force: true }))
 describe('adhoc build pins one commit for the whole run', () => {
   it('checks out the pinned commit in every job that builds from the repo', () => {
     const { jobs } = workflow
-    expect(jobs['relay-windows-process-tree'].with.ref).toBe(PINNED)
     expect(jobs['orcad-template'].with.ref).toBe(PINNED)
     const support = jobs['orcad-template-support'].steps.find((step) =>
       step.uses?.startsWith('actions/checkout@')
@@ -69,12 +68,7 @@ describe('adhoc build pins one commit for the whole run', () => {
     expect(support.with.ref).toBe(PINNED)
     const vet = jobs['build-adhoc-mac'].steps.find((step) => step.id === 'vetted')
     expect(vet.env.REQUESTED_REF).toBe(PINNED)
-    for (const name of [
-      'relay-windows-process-tree',
-      'orcad-template-support',
-      'orcad-template',
-      'build-adhoc-mac'
-    ]) {
+    for (const name of ['orcad-template-support', 'orcad-template', 'build-adhoc-mac']) {
       expect([jobs[name].needs].flat(), name).toContain('resolve-ref')
     }
   })
diff --git a/config/scripts/dev-channel-orcad-template-workflow.test.mjs b/config/scripts/dev-channel-orcad-template-workflow.test.mjs
index 007a0a309d9..c66b07541eb 100644
--- a/config/scripts/dev-channel-orcad-template-workflow.test.mjs
+++ b/config/scripts/dev-channel-orcad-template-workflow.test.mjs
@@ -37,7 +37,6 @@ describe.each(channels)('$name build ships the orcad template', (channel) => {
     expect(template.permissions).toEqual({ contents: 'read' })
     expect(template.secrets).toBeUndefined()
     expect(mac.steps.find((step) => step.name === 'Checkout').with.ref).toBe(channel.pinnedSha)
-    expect(jobs['relay-windows-process-tree'].with.ref).toBe(channel.pinnedSha)
   })
 
   it('packages the macOS build only with the template present', () => {
diff --git a/config/scripts/hourly-preflight-workflow.test.mjs b/config/scripts/hourly-preflight-workflow.test.mjs
index f8e5fcdba8b..d23681c026c 100644
--- a/config/scripts/hourly-preflight-workflow.test.mjs
+++ b/config/scripts/hourly-preflight-workflow.test.mjs
@@ -62,7 +62,7 @@ describe('hourly build preflight', () => {
     expect(
       preflight.steps.find((step) => step.id === 'app_token').with['permission-contents']
     ).toBe('read')
-    expect(build.needs).toEqual(['preflight', 'relay-windows-process-tree', 'orcad-template'])
+    expect(build.needs).toEqual(['preflight', 'orcad-template'])
     expect(build.if).toBe("needs.preflight.outputs.should_build == 'true'")
     expect(build.steps.find((step) => step.name === 'Checkout').with.ref).toBe(
       build.outputs.head_sha
diff --git a/config/scripts/orcad-windows-prebuild-workflow.test.mjs b/config/scripts/orcad-windows-prebuild-workflow.test.mjs
index 6b5fb57c11e..e01e346bab0 100644
--- a/config/scripts/orcad-windows-prebuild-workflow.test.mjs
+++ b/config/scripts/orcad-windows-prebuild-workflow.test.mjs
@@ -203,7 +203,6 @@ describe('SSH Windows consumers of qualified server slots', () => {
     expect(addon).toBeLessThan(sshSteps.indexOf(sshPrepare))
     expect(sshSteps.indexOf(sshPrepare)).toBeLessThan(template)
     expect(template).toBeLessThan(hosts)
-    expect(sshSteps[template].env.ORCA_REQUIRE_RELAY_NATIVE_ADDONS).toBe('${{ matrix.arch }}')
     expect(sshSteps[template].run).toContain('--require-slots "win32-${{ matrix.arch }}"')
     expect(sshSteps[hosts].run).toContain("@('orcad-cmd','orcad-powershell')")
     for (const workflowPaths of [
diff --git a/config/scripts/relay-era-ref-refusal-workflow.test.mjs b/config/scripts/relay-era-ref-refusal-workflow.test.mjs
new file mode 100644
index 00000000000..4307f77fc3f
--- /dev/null
+++ b/config/scripts/relay-era-ref-refusal-workflow.test.mjs
@@ -0,0 +1,56 @@
+// Desktop builds no longer compile the Windows relay addon, so every workflow that packages an
+// arbitrary ref must refuse one that still ships the relay rather than ship it without the addon.
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import { parse } from 'yaml'
+import { runProcess } from '@orca/process-host'
+
+const STEP = 'Refuse a ref that still ships the SSH relay'
+const directory = mkdtempSync(join(tmpdir(), 'relay-era-ref-refusal-'))
+afterAll(() => rmSync(directory, { recursive: true, force: true }))
+
+function steps(workflow, job) {
+  return parse(readFileSync(`.github/workflows/${workflow}`, 'utf8')).jobs[job].steps
+}
+
+async function runAt(run, relayEra) {
+  const checkout = mkdtempSync(join(directory, 'ref-'))
+  mkdirSync(join(checkout, 'config'))
+  if (relayEra) {
+    writeFileSync(join(checkout, 'config', 'tsconfig.relay.json'), '{}')
+  }
+  writeFileSync(join(checkout, 'step.sh'), run)
+  return runProcess({ program: 'bash', args: ['step.sh'], cwd: checkout })
+}
+
+describe.each([
+  // The refusal must precede everything that tags, signs or publishes.
+  [
+    'adhoc-mac-build.yml',
+    'orcad-template-support',
+    'Detect whether the ref ships the orcad template'
+  ],
+  ['release-cut.yml', 'cut', 'Resolve ref SHA'],
+  // Dispatchable on its own with any tag, so release-cut's refusal does not cover it.
+  ['release-mac-build.yml', 'build-mac', 'Build app'],
+  ['dev-channel-win-build.yml', 'build-win', 'Build app']
+])('%s refuses a relay-era ref', (workflow, job, laterStep) => {
+  const jobSteps = steps(workflow, job)
+  const index = jobSteps.findIndex((step) => step.name === STEP)
+
+  it('checks the ref before it builds or tags anything', () => {
+    expect(index).toBeGreaterThan(0)
+    expect(jobSteps[index - 1].uses).toMatch(/^actions\/checkout@/)
+    const sparse = jobSteps[index - 1].with['sparse-checkout']
+    expect(sparse?.split('\n').includes('/config/tsconfig.relay.json') ?? true).toBe(true)
+    expect(index).toBeLessThan(jobSteps.findIndex((step) => step.name === laterStep))
+  })
+
+  it('fails only when the checkout still has the relay', async () => {
+    const run = jobSteps[index].run
+    expect((await runAt(run, true)).code).toBe(1)
+    expect((await runAt(run, false)).code).toBe(0)
+  })
+})
diff --git a/config/scripts/release-cut-token-permissions.test.mjs b/config/scripts/release-cut-token-permissions.test.mjs
index d58604b63a6..d60da99a1ef 100644
--- a/config/scripts/release-cut-token-permissions.test.mjs
+++ b/config/scripts/release-cut-token-permissions.test.mjs
@@ -68,9 +68,6 @@ const EXPECTED_MATRIX = {
     contents: 'read'
   },
   [`${RELEASE_WORKFLOW}#release-preflight`]: { contents: 'read' },
-  [`${RELEASE_WORKFLOW}#relay-windows-process-tree`]: { contents: 'read' },
-  [`${RELEASE_WORKFLOW}#relay-windows-process-tree -> .github/workflows/relay-windows-process-tree.yml#build`]:
-    { contents: 'read' },
   [`${RELEASE_WORKFLOW}#skill-sharing-linux-floor-release-gate`]: { contents: 'read' },
   [`${RELEASE_WORKFLOW}#skill-sharing-release-gate`]: { contents: 'read' },
   [`${RELEASE_WORKFLOW}#terminal-rendering-golden`]: { contents: 'read' },