docs: the Microsoft Store is the Windows install, GitHub builds are a preview

The Store package is signed at submission and updates itself. The tray
.msi under windows-v* and the desktop setup exe are a developer preview:
unsigned, SmartScreen warns on first run, and they do not update
themselves; the tray app reports a newer version and links to it. Said
in the README, the distribution notes, the tray development notes and
the release body.

.github/workflows/release-menubar-windows.yml

@@ -95,5 +95,11 @@ jobs:
 
             The bundle is unsigned, so Windows SmartScreen warns on first run: click
             "More info", then "Run anyway". Signing is planned.
+
+            This `.msi` is a developer preview. The recommended install is the Microsoft
+            Store (https://apps.microsoft.com/detail/9P0R4ZL5XMB8), which is signed and
+            updates itself. Preview builds do not update themselves: the tray app reports
+            that a newer version exists and links to the release, and you take it by
+            re-running `codeburn menubar --force` or downloading the new `.msi` here.
           files: release-artifacts/*
           fail_on_unmatched_files: true

README.md

@@ -55,7 +55,8 @@
       <strong>Menubar</strong><br/>
       <img src="https://raw.githubusercontent.com/getagentseal/codeburn/main/assets/menubar-app.jpg" alt="CodeBurn macOS menubar" /><br/>
       <code>codeburn menubar</code><br/>
-      <a href="https://github.com/getagentseal/codeburn/releases/tag/windows-v0.9.23"><img src="https://img.shields.io/badge/Windows-Tray_app_(.msi)-F97316?logo=windows&logoColor=white" alt="Download the CodeBurn Windows menubar" /></a>
+      <a href="https://apps.microsoft.com/detail/9P0R4ZL5XMB8"><img src="https://img.shields.io/badge/Windows-Microsoft_Store-F97316?logo=microsoft&logoColor=white" alt="Get CodeBurn from the Microsoft Store" /></a>
+      <a href="https://github.com/getagentseal/codeburn/releases/tag/windows-v0.9.23"><img src="https://img.shields.io/badge/Windows-Tray_app_.msi_(preview)-F97316?logo=windows&logoColor=white" alt="Download the CodeBurn Windows tray app developer preview (.msi)" /></a>
     </td>
   </tr>
   <tr>
@@ -348,6 +349,8 @@ Allowed values are `terminal` (macOS Terminal.app, the default) and `iterm2`. An
 
 ### Windows
 
+The recommended install is the [Microsoft Store](https://apps.microsoft.com/detail/9P0R4ZL5XMB8) (Store ID `9P0R4ZL5XMB8`), which ships the desktop app with the tray app inside it. Microsoft signs that package at submission, and the Store keeps it up to date, so the tray app leaves its own update checker switched off there.
+
 Windows gets the same ambient view from the system tray, from the same one command:
 
 ```powershell
@@ -358,7 +361,9 @@ It downloads the `.msi` for your CLI version, verifies its sha256, runs it throu
 
 Today's spend sits in the tray as a number beside the flame icon (turn it off in Settings, and the tooltip always carries it). Click for the same popover the macOS app shows: agent tabs, period switcher, Trend, Forecast, Pulse, Stats and Plan insights, activity and model breakdowns, optimize findings, and CSV/JSON export. Settings covers launch at login, the tray number, theme, and currency. It refreshes every 60 seconds while the popover is open and every 2 minutes while it is closed.
 
-The tray app reads everything through the CLI, so install that first (`npm install -g codeburn`) — it needs **codeburn 0.9.9 or newer**, and shows a setup screen with the install command until it finds one. Source and build instructions are in [`windows/`](windows/) ([windows/DEVELOPMENT.md](windows/DEVELOPMENT.md)). The `.msi` is unsigned for now, so SmartScreen prompts on first run.
+The tray app reads everything through the CLI, so install that first (`npm install -g codeburn`). It needs **codeburn 0.9.9 or newer**, and shows a setup screen with the install command until it finds one. Source and build instructions are in [`windows/`](windows/) ([windows/DEVELOPMENT.md](windows/DEVELOPMENT.md)).
+
+The `.msi` under the `windows-v*` releases and the desktop setup `.exe` are a developer preview. Both are unsigned, so SmartScreen prompts on first run: click "More info", then "Run anyway". The preview builds also do not update themselves. The tray app still tells you when a newer version exists and links to the release; taking it means re-running `codeburn menubar --force` or downloading the new build yourself.
 
 ### Linux (GNOME)
 

app/DISTRIBUTION.md

@@ -147,6 +147,12 @@ launches it from `app\resources\menubar\`. Launch at login is a
 package with `GetCurrentPackageFullName` and skips its own update checker
 entirely, since Store updates cover it.
 
+That is why the Store is the recommended Windows install: it is the only
+Windows route with a signed artifact (Microsoft signs the package at
+submission) and a real update path. The GitHub downloads stay a developer
+preview, unsigned and without self-update, until an Authenticode certificate
+exists.
+
 The startup task is Windows' to set, not this app's: reaching one would take the
 WinRT `Windows.ApplicationModel.StartupTask` API, which Electron has no binding
 for and which this app ships no native code to reach, and a Run value written
@@ -307,6 +313,15 @@ shows **"Windows protected your PC"**. Users click **"More info" → "Run
 anyway"** to launch it. This is expected for an unsigned build; the only fix is
 a purchased code-signing (Authenticode/EV) certificate.
 
+**Distribution policy.** The Microsoft Store build (Store ID `9P0R4ZL5XMB8`) is
+the recommended Windows install. This NSIS setup `.exe` and the tray `.msi`
+under the `windows-v*` releases are a developer preview: unsigned, SmartScreen
+warns on first run, and neither route updates itself. The tray app still
+reports that a newer version exists and points at the GitHub release; taking it
+means re-running `codeburn menubar --force` or downloading the build by hand.
+One-click updating comes back once an Authenticode certificate signs the
+artifacts.
+
 ### Microsoft Store (`package:store`)
 
 The Store build is a separate AppX target so the GitHub NSIS installer remains

windows/DEVELOPMENT.md

@@ -201,10 +201,13 @@ npm run tauri build
   Check for Updates in the tray menu and in About. The tray item opens About on the
   `about#check` anchor, which is where the up to date / update available / check failed
   result is shown, and where the button that installs it lives.
-- One click updates both: `npm install -g codeburn@latest --force` through the npm beside the
-  launcher, then `codeburn menubar --force`. Each stage gets 120 s and is killed past it.
-  `MIN_CLI_VERSION_FOR_UPDATE` is **0.9.21**, the first CLI whose `menubar` can install a
-  Windows app at all; an older one is refused with the manual command instead.
+- There is no install button. Outside a Store package the app only reports that a newer
+  version exists, opens the `windows-v*` release page, and shows `codeburn menubar --force`
+  as the manual command, because the MSI is unsigned and its checksum comes from the same
+  release (the module doc in `update.rs` has the reasoning). Inside a Store package the
+  checker stands down, since Store updates cover it. `MIN_CLI_VERSION_FOR_UPDATE` is
+  **0.9.21**, the first CLI whose `menubar` can install a Windows app at all; an older one
+  is told to update the CLI first.
 - Renaming the MSI asset breaks the version lookup here as well as in the installer:
   `MSI_PREFIX` / `MSI_SUFFIX` have to move with `WINDOWS_RELEASE`.