Catalog section · LNCH
28 planned items in Simca Launcher (Steam-like): Offline Mode, User-Initiated Updates, Package Spec, Sign-in.
The update manifest (product id, channel, version, release date, notes, artifacts with name, url, sha256 and size, blocked versions) travels inside the signed-document envelope with an Ed25519 signature checked against embedded keys, expiry and a minimum document version; an unsigned manifest is never acted on
Depends on: LNCH-0001
Product id must match, platform must match, the artifact must be a named file (never a folder URL), the version must not be blocked and must not be older than the installed one, all checked after the signature and before a download starts
Depends on: LNCH-0001
The signed manifest lists versions that must never be offered or installed (known-bad releases); a blocked installed version is flagged for update or rollback
Depends on: LNCH-0001
A missing or empty sha256 or size in the manifest fails the update; there is no skip-the-check path
Depends on: LNCH-0001
The artifact is downloaded to a .partial file in the local staging folder, its sha256 and size are verified, and only then renamed to its final staged name
Depends on: LNCH-0001
Leftover .partial files and abandoned staging entries from failed downloads are removed on the next start or update attempt
Depends on: LNCH-0001
Staging lives under the local application-data folder, not in documents or a cloud-synced folder, to avoid sync and antivirus locks
Depends on: LNCH-0001
Check free space for the artifact and its staged copy before downloading and stop early with a plain message
Depends on: LNCH-0001
The new version is copied to its own versioned file or folder and the old one is left in place; the running executable is never overwritten
Depends on: LNCH-0001
A small helper waits for the old process to exit, starts the new version, and runs outside the old process tree; the launcher releases its single-instance lock before quitting
Depends on: LNCH-0001
The launcher finds the real path of its own file even when a portable build unpacks to a temp folder; updates never use the temp copy as the install slot
Depends on: LNCH-0001
The previous generation is kept (hash recorded) and the user can switch back to it with one action; there is no downgrade through the manifest, only an explicit rollback to a retained, verified generation
Depends on: LNCH-0001
A new generation that does not confirm a healthy start is rolled back to the previous generation on the next launcher open; the user is told why
Depends on: LNCH-0001
Rollback and pinning refuse any generation that the current signed manifest lists as blocked
Depends on: LNCH-0001
Keep the current and previous generation (a small fixed number of older ones) and delete the rest after a successful update
Depends on: LNCH-0001
Compare versions with full semantic-version rules including prerelease and build parts; a prerelease is never treated as equal to its release
Depends on: LNCH-0001
Installing an update from a file received by USB or messenger checks the same signature, expiry, blocked list, hash and size as an online update, with no network
Depends on: LNCH-0001
Only the configured manifest sources are read; no catalog fallback, no source-host (for example repository release) fallback and no access tokens from the environment
Depends on: LNCH-0001
Any failure to check or fetch leaves the installed version running and shows a plain reason; nothing is retried in the background
Depends on: LNCH-0001
The last check time, result and seen manifest version are stored locally for display and rollback protection; they never trigger a check
Depends on: LNCH-0001
Opening the launcher may offer an update but never installs one; apply needs a user action every time
Depends on: LNCH-0001
No credential, key or launcher key is hard-coded in the launcher, the app or the updater
Depends on: LNCH-0001
Publish the artifact first, then the signed manifest, then fetch both back and verify before announcing; purge cached not-found answers for new keys
Depends on: LNCH-0001
Static layout per product and channel (stable and dev) with an immutable artifact and a no-store manifest; the host is any static server or mirror
Depends on: LNCH-0001
Registering Simca in the stock earlier launcher needs a registry row in its product list and a launcher release, with the artifact on the update host; the stock launcher does not verify the manifest hash before install, has no signing, and signs the user in to its seats service
Depends on: LNCH-0001
A Simca launcher forked from the earlier launcher without the tether, launcher keys, presence or seats calls; compare with registering Simca as a free offline SKU in the stock launcher (decision D27)
Depends on: LNCH-0001
If Simca is listed in the stock launcher as a free SKU, the user's launcher still signs in and talks to seats, which Simca cannot control; the no-account promise would then hold for Simca's own code only
Depends on: LNCH-0001
Whatever launcher is used, the app verifies the signature of its own update packages before use, because the stock launcher does not
Depends on: LNCH-0001