Update

docs/UPDATING.md

@@ -0,0 +1,55 @@
+# Updating ForgeFlow on Windows
+
+ForgeFlow stores its local token, server credentials, repository mappings,
+preferences, deployment profiles, diagnostics and operation history outside the
+source directory.
+
+## Manual update to v0.4.0
+
+1. Close ForgeFlow.
+2. Extract the v0.4.0 update package.
+3. Copy the contents of its `ForgeFlow` folder over the existing source folder.
+4. Do not create `ForgeFlow\ForgeFlow`.
+5. Open PowerShell in the existing folder.
+6. Run:
+
+```powershell
+Set-ExecutionPolicy -Scope Process Bypass
+.\update-windows.ps1
+```
+
+The script installs the new `ssh2` dependency, runs the environment doctor,
+verifies the source and executes all tests before starting ForgeFlow.
+
+## Built-in updates after v0.4.0
+
+Open **Settings → ForgeFlow updates**.
+
+The default source is:
+
+```text
+Gitea instance: the instance already configured in ForgeFlow
+Repository:      Jens/ForgeFlow
+Branch:          main
+```
+
+The repository must contain a newer semantic version in `package.json`.
+
+Choose:
+
+1. **Check now**
+2. **Download update**
+3. **Apply & restart**
+
+The source updater downloads the exact branch commit, records a SHA-256 checksum,
+backs up the installed source, applies the archive, runs `npm install` and
+`npm run check`, and restarts ForgeFlow. When validation fails it restores the
+previous source and starts that version again.
+
+The update log is written beneath ForgeFlow's local user-data `updates` folder
+and does not contain the Gitea token.
+
+The updater deliberately checks the semantic version stored in the remote
+`package.json`. Merely pushing a new commit without increasing that version does
+not present an update. Publish the complete validated ForgeFlow source to the
+configured repository and bump the version for every release.