## Context
The desktop app is packaged with Electron and electron-builder. Updates will be served from a static 1Panel/Nginx site instead of a business backend.

## Decisions
- Use `electron-updater` with electron-builder `generic` publishing.
- Reserve `https://truegrowth.benchu.cloud/desktop/stable/` as the stable update channel root.
- Keep mac `dmg` for first install and mac `zip` for auto updates.
- Keep Windows `nsis` as the installed auto-update target and `portable` as a manual-download artifact only.
- Do not automatically restart the app after download; users confirm restart from the renderer UI.
- Desktop update UI supersedes the existing web Service Worker update prompt inside Electron so customers do not see two update concepts at once.

## Release Notes
- macOS customer auto updates require Developer ID signing and notarization before production distribution.
- Windows production releases should be Authenticode signed to reduce SmartScreen and security-product friction.
- Unsigned builds may be used for local or internal update-flow tests only.