fix: no console window and a writable config dir on Windows

src/main.rs

@@ -3,6 +3,10 @@
 //! master, 0600), `carrier.db` (fumi-core's sealed store) and `read.txt`
 //! (read marks, carrier's own sidecar).
 
+// No console window when the Windows release build is double-clicked.
+// Debug builds keep it for eprintln output.
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
 mod app;
 #[cfg(debug_assertions)]
 mod demo;
@@ -26,9 +30,7 @@ fn main() {
 fn config_dir() -> PathBuf {
     let base = match std::env::var("XDG_CONFIG_HOME") {
         Ok(xdg) if !xdg.is_empty() => PathBuf::from(xdg).join("carrier"),
-        _ => PathBuf::from(std::env::var("HOME").unwrap_or_default())
-            .join(".config")
-            .join("carrier"),
+        _ => default_config_root(),
     };
     // Dev builds get their own profile, seeded with sample data in
     // `demo.rs`, so layout work never touches the real account.
@@ -36,3 +38,20 @@ fn config_dir() -> PathBuf {
     let base = base.with_file_name("carrier-demo");
     base
 }
+
+// HOME is rarely set on Windows, and when it is missing the Unix
+// fallback would resolve .config\carrier against the working
+// directory - for an installed copy that's Program Files, which isn't
+// writable, so the app would die on startup. Roaming AppData is the
+// per-user config location there.
+#[cfg(windows)]
+fn default_config_root() -> PathBuf {
+    PathBuf::from(std::env::var("APPDATA").unwrap_or_default()).join("carrier")
+}
+
+#[cfg(not(windows))]
+fn default_config_root() -> PathBuf {
+    PathBuf::from(std::env::var("HOME").unwrap_or_default())
+        .join(".config")
+        .join("carrier")
+}