fix: integrate updater downgrade guard

.project-docs/30-worklog/tasks/20260826-recover-pi-updater-integration-8f3a6c21.md

@@ -0,0 +1,95 @@
+# Task: Recover Pi integration and merge updater fix
+
+## Identity
+
+- Task ID: 20260826-recover-pi-updater-integration-8f3a6c21
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 48a9189939f3f9a581a76e9d6f5ba2f49879a67c
+- Owner: codex
+- Status: Verification complete; documentation gate pending
+
+## Scope
+
+- Recover the abandoned Pi integration documentation already present in the
+  `main` worktree and validate it against the completed Pi source-task records.
+- Integrate the updater downgrade-prevention change from source commit
+  `2e61800fed793b63b3b7804a03a4c7d8617e23d7` into `main`.
+- Verify the focused updater behavior, type safety, lint, and production Vite
+  build before handing back the integrated branch.
+- Preserve unrelated untracked task records byte-for-byte and outside this
+  task's commits.
+
+## Intent And Constraints
+
+- User explicitly authorized force-releasing and taking over the abandoned Pi
+  integration task.
+- Treat completed source task records as read-only evidence; promote only the
+  canonical Pi documentation that is supported by those records.
+- Keep unverified Pi release gaps explicit: real Provider execution, macOS
+  x64/arm64 packaged artifacts, and native non-WSL Linux remain unverified.
+- Apply only the two updater source/test changes from the verified feature
+  commit so the feature task record remains source-owned.
+- Do not modify, delete, or commit
+  `20260819-package-learning-off-115-9c4d.md` or the superseded Pi integration
+  task record without separate authority.
+
+## Plan
+
+1. Validate the pending Pi canonical documentation against source-task facts
+   and current product boundaries.
+2. Apply the verified updater downgrade guard and its focused regression tests.
+3. Run focused tests, typecheck, scoped lint, and `build:vite`; inspect the
+   final diff and commit the integrated result on `main`.
+4. Run the Task Documentation Gate, release ownership, and report any remaining
+   foreign-record blocker without weakening or bypassing the gate.
+
+## Outcome
+
+- Recovered and semantically reviewed the pending Pi canonical documentation
+  against the completed hard-cutover, provider, release-proof, legacy-removal,
+  and background-run source tasks.
+- Integrated the exact updater source/test change from
+  `2e61800fed793b63b3b7804a03a4c7d8617e23d7` into `main` without copying or
+  editing its source-owned task record.
+- Automatic update channel selection and later channel changes now explicitly
+  restore `autoUpdater.allowDowngrade = false`, preventing installed `2.0.0`
+  from treating online `1.1.9` as an available update.
+- Preserved both unrelated/unregistered task records byte-for-byte and outside
+  the staged integration set.
+
+## Verification
+
+- Exact source parity:
+  `git diff --exit-code 2e61800 -- electron/main/updater.ts tests/unit/app-updater.test.ts`
+  passed before task-record finalization.
+- `pnpm exec vitest run tests/unit/app-updater.test.ts`: passed, 1 file / 15 tests.
+- `pnpm run typecheck`: passed.
+- `pnpm exec eslint electron/main/updater.ts tests/unit/app-updater.test.ts`: passed.
+- `pnpm test`: passed, 181 regular files / 1543 tests passed / 2 skipped,
+  followed by the pressure file with 1/1 passed.
+- `pnpm run build:vite`: passed for Renderer, Electron Main, Preload, and the
+  release utility worker; existing dynamic-import and large-chunk warnings
+  remain warnings only.
+- `git diff --check`: passed.
+- `check_doc_drift.py --task-id 20260826-recover-pi-updater-integration-8f3a6c21`:
+  blocked only by the two preserved foreign task records listed below.
+
+## Follow-ups
+
+- Human authorization is required to move the unregistered foreign records
+  `20260819-package-learning-off-115-9c4d.md` and
+  `20260826-integrate-pi-provider-fix-6e4c2a91.md` out of the `main` worktree
+  into a recovery directory. Until then the Task Documentation Gate cannot
+  pass and integration ownership cannot be cleanly released.
+- Real Provider execution, packaged macOS x64/arm64 artifacts, and native
+  non-WSL Linux artifacts remain explicitly unverified Pi release gates.
+
+## Promotion Candidates
+
+- Applied the already-supported Pi hard-cutover facts to the canonical success
+  criteria, decision index/ADR, architecture, current state, business rules,
+  evidence index, and commitments.
+- No additional updater promotion candidate: the updater behavior is captured
+  by focused tests and does not change an architectural boundary.