diff --git a/docs/auto-update-contract.md b/docs/auto-update-contract.md
index e548b7b..283838d 100644
--- a/docs/auto-update-contract.md
+++ b/docs/auto-update-contract.md
@@ -19,7 +19,7 @@ manifest fetch), the desktop swap-installer, and the Android APK install channel
 | `variant`     | select | `clean` \| `adult`. |
 | `version`     | text   | Human semver shown to the user, e.g. `1.0.1`. |
 | `buildNumber` | number | Monotonic int; the comparator the updater actually uses. |
-| `file`        | file   | The artifact: desktop = `.zip` of the release bundle, android = `.apk`. Protected (see rules). |
+| `file`        | file   | The artifact: windows = `.exe` installer, linux = `.zip` of the release bundle, android = `.apk`. Protected (see rules). |
 | `sha256`      | text   | Lowercase hex SHA-256 of the artifact; verified before install. |
 | `size`        | number | Bytes. |
 | `notes`       | text   | Optional release notes (shown in the update prompt). |
@@ -77,6 +77,17 @@ computes the SHA-256 + size and uploads via the superuser REST API. Re-publishin
 the same `(platform, variant, buildNumber)` is rejected by the unique index —
 bump `buildNumber` for each release.
 
+**Windows publishes the installer**, `amber-setup-<variant>-<version>.exe`, not
+the zip. One artifact serves both jobs: people download and run it, and the app's
+updater runs the same file with `/SILENT`, which is why `DesktopInstaller`
+dispatches on the extension. The zip `release_windows.ps1` still builds beside it
+is for the flavour check and for unpacking by hand — do not publish it.
+
+`check-flavor.py` cannot read a `.exe` (Inno compresses the payload) and refuses
+rather than passing it. The Windows flavour gate is `Assert-Flavor` in
+`release_windows.ps1`, which reads the staged folder before either artifact is
+made from it; run it there, not here.
+
 ## Gating summary
 
 `nsfwEnabled` (admin-set on the `users` record) is the single source of truth: