release(main): 同步 dev 最新候选改动

docs/guides/client-release.md

@@ -30,12 +30,19 @@ The runtime contract currently provides:
 - file picker/save/open adapters
 - desktop system notification adapters
 - desktop updater adapters
+- native desktop application menu and shortcut synchronization
+- desktop window lifecycle and system appearance synchronization
 
 Business modules must use this public runtime entry point. They must not inspect
 Tauri globals or import Tauri packages directly. Native files, notifications,
 secure session storage, and automatic updates must remain behind
 `frontend/src/runtime/` and explicit capability flags.
 
+Desktop menu accelerators and window appearance are synchronized through narrow
+Tauri commands owned by `frontend/src/runtime/`. macOS close/reopen behavior is
+handled by the Tauri event loop so a genuinely closed main window can be rebuilt from the Dock;
+these concerns must not move into Vue business modules.
+
 ## Version Change
 
 Update every client manifest with one command:
@@ -58,6 +65,10 @@ Manual edits that leave these files inconsistent fail CI.
 
 ## Stabilization Gates
 
+Client builds require Node.js 22.13.0 or newer. The development frontend container,
+Web CI, macOS release candidates, Windows internal validation, and the production
+Web image use the same Node 22.13 baseline.
+
 Client release candidates must pass the shared Web checks and the Desktop
 release/security gate before promotion:
 
@@ -122,8 +133,8 @@ The release pipeline must:
 2. build macOS Universal desktop artifacts;
 3. sign and notarize the macOS app;
 4. produce updater artifacts and `.sig` files with the updater private key;
-5. generate `latest.json` and a checksum manifest;
-6. verify the feed with `npm run desktop:update-feed:check -- --feed <latest.json> --artifacts-dir <artifact-dir>`;
+5. generate `latest.json` and a checksum manifest with `npm run desktop:update-feed:create`;
+6. verify the feed with `npm run desktop:update-feed:check -- --feed <release-dir>/latest.json --artifacts-dir <release-dir>`;
 7. upload immutable artifacts first;
 8. atomically replace `latest.json` last.
 
@@ -131,6 +142,13 @@ For Universal macOS artifacts, `latest.json` must provide both
 `darwin-aarch64` and `darwin-x86_64` entries pointing at the same Universal
 update package.
 
+The signed release candidate workflow lives at
+`.github/workflows/desktop-release-candidate.yml`. It must be run from a
+matching `vX.Y.Z` tag and produces a verified release directory as a GitHub
+artifact. That artifact is still only a release candidate; the release owner
+must upload immutable files to the production download origin and replace
+`latest.json` atomically after validation.
+
 ## Windows Build Readiness
 
 Second-phase Windows work is limited to CI compatibility validation. A
@@ -147,6 +165,16 @@ Windows validation must cover:
 - notification and updater compilation;
 - future code-signing requirements.
 
+The manual internal Windows validation workflow lives at
+`.github/workflows/desktop-windows-internal.yml`. It is `workflow_dispatch`
+only, runs on `windows-latest`, injects `VITE_BUILD_CHANNEL` and
+`VITE_BUILD_COMMIT` from the selected branch context, executes the shared client
+and Desktop safety gates, builds an unsigned NSIS installer with updater
+artifacts disabled, and uploads the `.exe` plus `SHA256SUMS.txt` as a GitHub
+Actions artifact. This workflow is for internal compatibility verification
+only; it must not generate `latest.json`, update feeds, signed release
+directories, or formal Windows release artifacts.
+
 ## Required Checks
 
 ```bash
@@ -167,8 +195,10 @@ export TAURI_SIGNING_PRIVATE_KEY="$UPDATER_PRIVATE_KEY"
 export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="$UPDATER_PRIVATE_KEY_PASSWORD"
 export REQUIRE_DESKTOP_SIGNING=true
 npm run release:env:check
-npm run desktop:build -- --bundles app
-npm run desktop:update-feed:check -- --feed src-tauri/target/release/bundle/latest.json --artifacts-dir src-tauri/target/release/bundle
+npm run desktop:release-readiness:check
+npm run desktop:build:macos-release -- --ci
+npm run desktop:update-feed:create -- --artifact <CTMS.app.tar.gz> --base-url <versioned-https-artifact-prefix> --output-dir <release-dir>
+npm run desktop:update-feed:check -- --feed <release-dir>/latest.json --artifacts-dir <release-dir>
 ```
 
 The Desktop build must run on macOS for the current first-phase target. A signed