完善桌面端交互体验与发布检查

docs/guides/branch-maintenance-sop-zh.md

@@ -92,17 +92,23 @@ git merge origin/dev
 cd frontend
 npm run version:check
 npm run runtime:check
+npm run desktop:release:check
+npm run ui:contract
 npm run type-check
 npm run test:unit
 npm run build
+npm run desktop:build:app
 ```
 
 涉及 Tauri、macOS 打包或桌面适配层时，还必须在 macOS 执行：
 
 ```bash
-npm run desktop:build -- --bundles app
+npm run desktop:build:app
 ```
 
+正式桌面发布构建仍必须设置 updater 签名私钥后执行
+`npm run desktop:build -- --bundles app`。
+
 后端改动应补充执行受影响模块的后端测试、迁移检查和接口回归。
 
 ### 4. 创建提交
@@ -453,10 +459,13 @@ git log --oneline --decorate --graph --all -30
 - [ ] 网页端与桌面端版本一致
 - [ ] `npm run version:check` 通过
 - [ ] `npm run runtime:check` 通过
+- [ ] `npm run desktop:release:check` 通过
+- [ ] `npm run ui:contract` 通过
 - [ ] `npm run type-check` 通过
 - [ ] `npm run test:unit` 通过
 - [ ] `npm run build` 通过
-- [ ] macOS 桌面端构建通过
+- [ ] `npm run desktop:build:app` 通过
+- [ ] 正式桌面发布构建已使用 updater 签名私钥执行
 - [ ] 数据库迁移与回滚方案确认
 - [ ] 发布说明完成
 - [ ] `main -> release` 合并完成

docs/guides/client-release.md

@@ -56,6 +56,29 @@ This synchronizes:
 
 Manual edits that leave these files inconsistent fail CI.
 
+## Stabilization Gates
+
+Client release candidates must pass the shared Web checks and the Desktop
+release/security gate before promotion:
+
+```bash
+cd frontend
+npm run version:check
+npm run runtime:check
+npm run desktop:release:check
+npm run ui:contract
+npm run type-check
+npm run test:unit
+npm run build
+npm run desktop:build:app
+```
+
+`desktop:release:check` statically verifies the Tauri bundle, updater public
+key, CSP, capability scopes, command allowlist, query-token ban, and secure
+session token boundary. The full manual release, security, regression, and
+Desktop UX checklist lives in
+`docs/audits/desktop-release-stabilization-checklist.md`.
+
 ## Promotion
 
 1. Merge feature branches into `dev`.
@@ -127,9 +150,12 @@ cd frontend
 npm ci
 npm run version:check
 npm run runtime:check
+npm run desktop:release:check
+npm run ui:contract
 npm run type-check
 npm run test:unit
 npm run build
+npm run desktop:build:app
 export TAURI_SIGNING_PRIVATE_KEY="$UPDATER_PRIVATE_KEY"
 export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="$UPDATER_PRIVATE_KEY_PASSWORD"
 npm run desktop:build -- --bundles app