The desktop app gains a real self-updater, the update feed that silently froze is fixed for good, and the macOS first-launch fix is now impossible to miss.

• Self-updating desktop app. When a new version ships, Empryo tells you — a dialog on launch (once per version, Skip respected), /update on demand, a light 4-hourly background check, and an OS notification if the window is in the background. On Windows and Linux (AppImage) one click downloads, verifies, installs silently, and restarts. On macOS (unsigned builds can't self-install) it downloads and opens the verified DMG — and because the download never touches a browser, there's no quarantine flag and no "damaged app" dance on updates.
• Trust before bits. Every update is checked against the release's RSA-4096-signed checksum manifest with a key pinned inside the app — the same chain the install scripts use. A tampered or spoofed feed can't get a single unverified byte executed.
• Support Empryo. The About dialog now says the quiet part: the app ships unsigned because certificates are a recurring cost. If Empryo helps you, GitHub Sponsors and PayPal links live there — appreciated, never expected.

• A missing API key can no longer brick the app. If your configured model's key isn't set (or no model is configured at all), the workspace now boots normally — genome, files, and the Keys panel all work, the Errors panel explains what's missing, and chat shows the same actionable message per send until you add a key or switch models. Previously this failed the whole bridge at the workspace picker.
• Linux gets its icon back. Installs shipped the icon only into an unregistered 1024px slot, so Mint/Cinnamon menus showed nothing — a full 16→1024 size set now lands in the right places, and the window/taskbar icon ships as a real resource instead of a path that only existed in dev.
• The update check told everyone they were current. The release feed gated on a changelog file nothing was updating, so it froze at 3.0.1 and every newer install compared against it and answered "up to date". The feed now includes every release no matter which pipeline wrote it — and empryo.com/changelog shows the full history again.
• Slash commands the composer forgot. Commands declared in the shared manifest (like /update and /usage) ran from the ⌘K palette but were invisible to the chat composer. The composer now reads the same manifest and runs them through the same bindings.
• macOS install hint you can actually see. The xattr -cr first-launch fix is now a bold amber callout with one-click copy, sitting directly under the download buttons — on the download page, the wizard, and the docs.
• Docs accordions were rendering empty. A markdown-renderer bug dropped content nested inside tabs and accordions — the "Other install methods" section on the installation page was blank on the live site. Fixed.
• Memory tab's scope controls are labeled, readable fields now; select dropdowns app-wide slimmed down with a consistent chevron; wizard download labels no longer vanish in light theme.