What happened?

PawWork can keep prompting to install an already-downloaded updater package even when that pending package is older than the currently running app version.

Observed during the v0.2.8 replacement release: the app had already moved back to 0.2.8, but the updater toast still said an update was available for 0.2.7. Inspecting the pending cache showed that PawWork was holding onto an older downloaded update:

• ~/Library/Caches/pawwork-updater/pending/pawwork-mac-arm64.zip
• ~/Library/Caches/pawwork-updater/pending/update-info.json

The cached zip was unpacked and its Info.plist reported 0.2.7, while the live GitHub release metadata and direct v0.2.8 zip download both reported 0.2.8.

The logs show the stale pending download was created during a temporary release replacement window:

2026-04-23 05:59:01 update metadata fetched { releaseVersion: '0.2.7', ... }
2026-04-23 05:59:08 New version 0.2.7 has been downloaded to .../pawwork-updater/pending/pawwork-mac-arm64.zip
2026-04-23 06:09:00 update already downloaded { releaseVersion: '0.2.7' }

This is especially risky because setupAutoUpdater() currently sets autoUpdater.allowDowngrade = true, so a temporarily older latest release can be accepted and cached as a ready update.

Steps to reproduce

1. Run PawWork 0.2.8.
2. Make GitHub latest temporarily point to an older stable release such as 0.2.7.
3. Let PawWork check for updates and download the older package.
4. Restore GitHub latest to 0.2.8.
5. Let PawWork check for updates again.
6. See that PawWork still reports the already-downloaded 0.2.7 update as ready.

What did you expect to happen?

PawWork should never prompt to install a pending update whose version is lower than or equal to the current app version.

At minimum, the updater controller should discard a stale pending update and run a fresh update check when readyVersion <= currentVersion.

We should also reconsider whether stable production builds should set allowDowngrade = true.

PawWork version

v0.2.8

OS version

macOS

Can you reproduce it again?

Only once so far

Screenshots, recordings, or extra context

The issue was found from local updater evidence:

• Live v0.2.8/latest-mac.yml was version: 0.2.8.
• Directly downloaded v0.2.8/pawwork-mac-arm64.zip unpacked to app version 0.2.8.
• Local pending updater cache unpacked to app version 0.2.7.
• ~/Library/Logs/PawWork/main.log repeatedly logged update already downloaded { releaseVersion: '0.2.7' }.