Background service installs stage the newest release on their channel, then
hand off to the launcher once the update window opens. Desktop-hosted servers
relaunch the app into an update it already downloaded once no window is in
use. Both follow the Update automatically setting.

A rolled-back target is remembered by the launcher and not retried, and a
release that changes the orchestration protocol is left for a manual update
so connected clients are not locked out.