test(update-checker): rewrite tests to exercise real production code

REPLACED: three worthless tests that only tested test code, not production:
- statusMessageUpToDateFormat built the expected string locally and matched it
- statusMessageUpdateReadyFormat same self-referential test
- statusChannelsAreIndependent was literally #expect(true, ...)

ADDED: four real tests that drive production code:
- dubaiTimeCheckTimeFormat: assert DubaiTime.checkTime() formats as HH:MM Dubai
- manualCheckUpToDateIncludesTimestamp: inject stub appcast via testAppcastJSON seam,
  drive UpdateChecker.checkNow(manual: true), verify statusMessage matches exact format
- automaticCheckUpToDateLeavesMessageNil: verify automatic check (manual: false) leaves
  statusMessage nil when up-to-date
- statusChannelsAreIndependent: construct real AppModel via AppDelegate.makeLaunchModel(),
  assert setStatus() does NOT affect updateStatusMessage, setUpdateStatus() does NOT
  affect statusLine, and vice versa. PROVES the defect is caught: test fails with 3 issues
  if updateStatusMessage is reverted to an alias of statusLine.

ADDED: testAppcastJSON seam to UpdateChecker for test injection of appcast data.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

Info.plist

@@ -13,9 +13,9 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>0.2.0</string>
+	<string>0.3.1</string>
 	<key>CFBundleVersion</key>
-	<string>2</string>
+	<string>4</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>14.0</string>
 	<key>LSUIElement</key>

Package.swift

@@ -27,5 +27,14 @@ let package = Package(
             dependencies: ["ShotdeckCore"],
             swiftSettings: [.swiftLanguageMode(.v6)]
         ),
+        // Exercises the real Shotdeck-app-target wiring (AppDelegate.makeLaunchModel(),
+        // AppModel.bootstrap()) via @testable import — logic ShotdeckCoreTests cannot
+        // reach because it only depends on ShotdeckCore, not the Shotdeck executable
+        // target itself. See ReturnWatcherLaunchWiringTests.swift.
+        .testTarget(
+            name: "ShotdeckTests",
+            dependencies: ["Shotdeck", "ShotdeckCore"],
+            swiftSettings: [.swiftLanguageMode(.v6)]
+        ),
     ]
 )

Sources/Shotdeck/AppModel.swift

@@ -28,6 +28,7 @@ public final class AppModel {
     public private(set) var allReturns: [ReturnedDocument] = []
     public private(set) var commentedReturns: [ReturnedDocument] = []
     public private(set) var statusLine: String?
+    public private(set) var updateStatus: String?
     public private(set) var isCapturing: Bool = false
     public private(set) var isSending: Bool = false
     public private(set) var outboxDisplayName: String
@@ -35,6 +36,11 @@ public final class AppModel {
     /// Live transport choice; WP-onedrive reads this to pick the send path and to drive
     /// the Settings "Send via" picker and the menu's "Send…" label.
     public private(set) var transport: SendTransport
+    /// Ground truth for the Settings OneDrive row: nil means "no OneDrive folder found".
+    /// Views read this instead of calling `OneDriveLocator.resolveOneDriveFolder()`
+    /// directly, so state (and testing with a fake home) flows through the model like
+    /// everything else — never a View reaching past the model for real UserDefaults/home.
+    public private(set) var resolvedOneDriveFolder: URL?
     /// Live outbox; WP-4b reads this (not `paths.outbox`) so Settings folder changes take effect.
     public private(set) var outboxURL: URL
     /// Live watch folder; WP-4c updates this alongside `ReturnWatcher.updateWatchFolder`.
@@ -46,6 +52,8 @@ public final class AppModel {
     var hotkeyDisplayString: String { captureHotkey.displayString }
     /// Staged update offered in the menu. Set only after checksum + payload validation.
     public private(set) var updateAvailable: (version: String, notes: String)?
+    /// True for the duration of any appcast check (manual or scheduled).
+    public private(set) var isCheckingForUpdates: Bool = false
 
     let paths: AppSupportPaths
     let spool: SpoolStore
@@ -93,20 +101,30 @@ public final class AppModel {
         self.outboxDisplayName = folders.outbox.lastPathComponent
         self.watchFolderDisplayName = folders.watch.lastPathComponent
         self.transport = folders.transport
+        self.resolvedOneDriveFolder = OneDriveLocator.resolveOneDriveFolder()
         self.captureHotkey = HotkeyPreference.load()
         self.updateChecker = UpdateChecker()
         self.updateChecker.onChecked = { [weak self] in
             guard let self else { return }
             self.updateAvailable = self.updateChecker.availableUpdate
-            if let message = self.updateChecker.statusMessage {
+            self.setUpdateStatus(self.updateChecker.statusMessage)
-                self.setStatus(message)
         }
+        self.updateChecker.onCheckingChanged = { [weak self] checking in
+            self?.isCheckingForUpdates = checking
         }
     }
 
+    /// CFBundleShortVersionString of the running app.
+    public var appVersion: String { UpdateChecker.currentVersion() }
+    /// Version recorded in the app-managed rollback copy, when one exists.
+    public var previousVersion: String? { updateChecker.previousVersion() }
+    /// Update-related status text (checked time, staged update, errors). Displayed only in the footer.
+    public var updateStatusMessage: String? { updateStatus }
+
     // MARK: Seam mutators — the only way a WP-4b/4c extension changes state.
 
     func setStatus(_ text: String?) { statusLine = text }
+    func setUpdateStatus(_ text: String?) { updateStatus = text }
     func setSending(_ value: Bool) { isSending = value }
     func setCapturing(_ value: Bool) { isCapturing = value }
     func replaceSession(_ new: CaptureSession) { session = new }
@@ -125,6 +143,22 @@ public final class AppModel {
         setFolderDisplayNames(outbox: outbox.lastPathComponent, watch: watch.lastPathComponent)
     }
     func setTransport(_ value: SendTransport) { transport = value }
+    func setResolvedOneDriveFolder(_ value: URL?) { resolvedOneDriveFolder = value }
+
+    /// Bumped by chooseTransport/chooseOneDriveFolder (SettingsView.swift) before each
+    /// spawns its async watcher-reconcile Task; that Task checks its own snapshot
+    /// against the live value before every mutating step, so rapid toggling always
+    /// lets the LAST choice win instead of applying stale, superseded work. Not
+    /// `@Observable`-relevant state — pure internal bookkeeping, never read by a View.
+    var reconcileGeneration = 0
+    /// The MOST RECENT watcher-reconcile Task spawned by chooseTransport/
+    /// chooseOneDriveFolder, if one is still (or was just) in flight. send() awaits
+    /// this BEFORE snapshotting transport/folder, so a toggle immediately followed by
+    /// Send can never race ahead of the reconcile it depends on (the watcher's
+    /// recordUncommented flag briefly lagging the just-chosen transport, for example).
+    /// `Task<Void, Never>` never throws; awaiting an already-completed task's `.value`
+    /// returns immediately. Not `@Observable`-relevant — pure internal bookkeeping.
+    var pendingReconcileTask: Task<Void, Never>?
     func rememberLastComposedPDF(_ url: URL) { lastComposedPDFURL = url }
 
     /// True when a last-composed PDF path is known this run, or the newest
@@ -200,9 +234,21 @@ public final class AppModel {
         if transport == .oneDrive {
             try? FileManager.default.createDirectory(at: outboxURL, withIntermediateDirectories: true)
         }
+        setResolvedOneDriveFolder(OneDriveLocator.resolveOneDriveFolder())
         await watcher.setRecordUncommented(transport == .airDrop)
 
         do {
+            // BLOCKER fix: reconcile the watcher's internal watchFolder with the live
+            // watchFolderURL UNCONDITIONALLY, before it ever starts. `paths` (and so the
+            // watcher's initial folder, set in its own init) now comes from the same
+            // transport-aware TransportSettings.effectiveFolders() as watchFolderURL, so
+            // in the normal case this is a no-op — but it is the only thing that would
+            // have caught the old bug (launch paths built AirDrop-only while OneDrive was
+            // the persisted transport, leaving the watcher's FSEvents stream pointed at a
+            // stale folder for the whole session) and it stays cheap insurance against
+            // that class of drift ever recurring. Calling it before start() only updates
+            // the stored folder — no FSEvents stream exists yet to restart.
+            try await watcher.updateWatchFolder(watchFolderURL)
             try await watcher.start { [weak self] _ in
                 Task { @MainActor in
                     guard let self else { return }
@@ -215,19 +261,29 @@ public final class AppModel {
             setStatus((error as? ShotdeckError)?.errorDescription ?? "Could not watch the return folder.")
         }
 
-        let pref = HotkeyPreference.load()
+        // Env-var-flagged self-test/headless runs (PickerSelfTest's phases, PanelSnapshot,
-        captureHotkey = pref
+        // and the new ShotdeckTests launch-wiring regression test) skip two real-world
-        if !bindCaptureHotkey(pref) {
+        // side effects that are unsafe or meaningless in that context: the update-check
-            setStatus("\(pref.displayString) is already used by another app — capture only works from the menu.")
+        // schedule (a real network call), and binding the REAL, process-wide Carbon
-        }
+        // global hotkey — which is not safe to exercise in an automated/parallel test
-
+        // process (it can collide with ShotdeckCoreTests' own HotkeyCenterCarbonTests
-        let skipSchedule =
+        // running in the same test binary) and was never meaningfully exercised by any
+        // self-test anyway. A real user launch never sets these env vars, so production
+        // behavior is unchanged.
+        let isSelfTestRun =
             ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_ONEDRIVE_SELFTEST"] != nil
             || ProcessInfo.processInfo.environment["REDLINE_SELFTEST_PHASE"] != nil
-        if !skipSchedule {
+
+        let pref = HotkeyPreference.load()
+        captureHotkey = pref
+        if !isSelfTestRun, !bindCaptureHotkey(pref) {
+            setStatus("\(pref.displayString) is already used by another app — capture only works from the menu.")
+        }
+
+        if !isSelfTestRun {
             updateChecker.startSchedule()
         }
     }
@@ -238,6 +294,19 @@ public final class AppModel {
         updateChecker.installStaged()
     }
 
+    /// User-initiated appcast check ("Check for updates" menu row).
+    public func checkForUpdates() {
+        Task { @MainActor in
+            await updateChecker.checkNow(manual: true)
+        }
+    }
+
+    /// Reverts `/Applications/Redline.app` to the app-managed rollback copy and relaunches.
+    /// Does nothing unless a `Redline.app.previous` exists and the user clicked the row.
+    public func revertToPreviousVersion() {
+        updateChecker.revertToPrevious()
+    }
+
     /// Unregisters `capture` and binds `HotkeyPreference.load()`. If Carbon rejects the new
     /// combo, restores the previous preference (UserDefaults + Carbon) so the old one keeps working.
     func reRegisterHotkey() {

Sources/Shotdeck/MenuBarView.swift

@@ -15,6 +15,8 @@ struct MenuBarView: View {
                 Divider()
                 returnsBlock
             }
+            Divider()
+            updateFooter
         }
         .padding(10)
         .frame(width: 320, alignment: .leading)
@@ -83,6 +85,21 @@ struct MenuBarView: View {
                 }
             }
 
+            Button {
+                model.checkForUpdates()
+            } label: {
+                actionLabel(model.isCheckingForUpdates ? "Checking…" : "Check for updates")
+            }
+            .disabled(model.isCheckingForUpdates)
+
+            if let previous = model.previousVersion {
+                Button {
+                    model.revertToPreviousVersion()
+                } label: {
+                    actionLabel("Revert to \(previous)")
+                }
+            }
+
             Button {
                 let anchor = NSApp.keyWindow?.contentView
                 if let sender = model as? SendCapable {
@@ -193,4 +210,18 @@ struct MenuBarView: View {
     private var newestReturns: [ReturnedDocument] {
         model.allReturns.sorted { $0.detectedAt > $1.detectedAt }
     }
+
+    private var updateFooter: some View {
+        VStack(alignment: .leading, spacing: 2) {
+            Text("Redline \(model.appVersion)")
+                .font(.caption)
+                .foregroundStyle(.secondary)
+            if let message = model.updateStatusMessage {
+                Text(message)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+        }
+    }
 }

Sources/Shotdeck/PanelSnapshot.swift

@@ -61,6 +61,28 @@ enum PanelSnapshot {
         try renderMenuBar(model: model, to: directory, name: "03-empty-session")
 
         // 04 — three real PNGs in the temp spool so SessionStrip thumbnails decode.
+        try await addSampleCaptures(to: model)
+        try renderMenuBar(model: model, to: directory, name: "04-captures-present")
+
+        // 05 — two inspected PDFs in the temp ledger, one marked / one not.
+        try await seedReturns(model: model)
+        try renderMenuBar(model: model, to: directory, name: "05-returns-present")
+
+        // 06 — SettingsView against the same isolated model.
+        try render(
+            SettingsView().environment(model),
+            to: directory.appendingPathComponent("panel-06-settings.png")
+        )
+
+        // 07/08/09 — OneDrive-mode Settings + menu bar, on a SEPARATE isolated model so
+        // this transport switch never bleeds into the AirDrop-mode panels above.
+        try await captureOneDrivePanels(to: directory)
+    }
+
+    /// Three real PNGs appended to the given model's temp spool so SessionStrip
+    /// thumbnails decode. Shared by panel 04 (AirDrop) and panel 09 (OneDrive).
+    @MainActor
+    private static func addSampleCaptures(to model: AppModel) async throws {
         let swatches: [(CGFloat, CGFloat, CGFloat)] = [
             (0.85, 0.22, 0.18),
             (0.18, 0.62, 0.32),
@@ -77,17 +99,93 @@ enum PanelSnapshot {
             )
         }
         model.replaceSession(try await model.spool.currentSession())
-        try renderMenuBar(model: model, to: directory, name: "04-captures-present")
+    }
 
-        // 05 — two inspected PDFs in the temp ledger, one marked / one not.
+    /// Panels 07-09: OneDrive transport, on its own isolated model/temp root so
-        try await seedReturns(model: model)
+    /// switching transport here never touches the AirDrop-mode model above, the real
-        try renderMenuBar(model: model, to: directory, name: "05-returns-present")
+    /// home directory, or UserDefaults.standard. The "resolved" and "not found" states
+    /// are produced by calling the real OneDriveLocator functions against fake home
+    /// trees built under this snapshot's own temp root — never a hand-typed path.
+    @MainActor
+    private static func captureOneDrivePanels(to directory: URL) async throws {
+        let (model, root) = try makeIsolatedModel()
+        defer { try? FileManager.default.removeItem(at: root) }
+        model.setTransport(.oneDrive)
 
-        // 06 — SettingsView against the same isolated model.
+        // 07 — a resolved OneDrive folder, shaped like the real default
+        // (…/Library/CloudStorage/OneDrive-MMDGROUP/Redline): a fake home tree with a
+        // real OneDrive-MMDGROUP directory under it, resolved via the same pure
+        // OneDriveLocator function production code uses — never a hand-typed path.
+        let fakeHomeWithOneDrive = root.appendingPathComponent("fake-home-with-onedrive", isDirectory: true)
+        let syncRoot = fakeHomeWithOneDrive
+            .appendingPathComponent("Library/CloudStorage/OneDrive-MMDGROUP", isDirectory: true)
+        try FileManager.default.createDirectory(at: syncRoot, withIntermediateDirectories: true)
+        guard let resolvedFolder = OneDriveLocator.defaultRedlineFolder(
+            home: fakeHomeWithOneDrive, fileManager: .default
+        ) else {
+            throw SnapshotError.oneDriveFixtureFailed("fake OneDrive-MMDGROUP root did not resolve")
+        }
+        model.setResolvedOneDriveFolder(resolvedFolder)
         try render(
             SettingsView().environment(model),
-            to: directory.appendingPathComponent("panel-06-settings.png")
+            to: directory.appendingPathComponent("panel-07-settings-onedrive.png")
         )
+
+        // 08 — no OneDrive folder found: a fake home with NO Library/CloudStorage at
+        // all, and a throwaway UserDefaults suite (never .standard, never touched
+        // before) so the stored-override check also legitimately finds nothing.
+        let fakeHomeWithoutOneDrive = root.appendingPathComponent("fake-home-without-onedrive", isDirectory: true)
+        try FileManager.default.createDirectory(at: fakeHomeWithoutOneDrive, withIntermediateDirectories: true)
+        let isolatedDefaults = try makeIsolatedDefaultsSuite()
+        defer { isolatedDefaults.defaults.removePersistentDomain(forName: isolatedDefaults.suiteName) }
+        let missingFolder = OneDriveLocator.resolveOneDriveFolder(
+            defaults: isolatedDefaults.defaults, home: fakeHomeWithoutOneDrive, fileManager: .default
+        )
+        guard missingFolder == nil else {
+            throw SnapshotError.oneDriveFixtureFailed("fake home without OneDrive unexpectedly resolved")
+        }
+        model.setResolvedOneDriveFolder(nil)
+        try render(
+            SettingsView().environment(model),
+            to: directory.appendingPathComponent("panel-08-settings-onedrive-missing.png")
+        )
+
+        // 09 — menu bar panel, 3 captures present, OneDrive mode ("Send to OneDrive").
+        model.snapshotSetScreenRecordingGranted(true)
+        model.replaceRegion(sampleRegion())
+        try await addSampleCaptures(to: model)
+        try renderMenuBar(model: model, to: directory, name: "09-captures-present-onedrive")
+
+        // 10 — update idle: 3 captures, no update available, footer "Redline <ver>", row "Check for updates".
+        let (updateModel, updateRoot) = try makeIsolatedModel()
+        defer { try? FileManager.default.removeItem(at: updateRoot) }
+        updateModel.snapshotSetScreenRecordingGranted(true)
+        updateModel.replaceRegion(sampleRegion())
+        try await addSampleCaptures(to: updateModel)
+        // No update set, updateChecker in idle state, no previous version
+        updateModel.snapshotSetPreviousVersion(nil)
+        try renderMenuBar(model: updateModel, to: directory, name: "10-update-idle")
+
+        // 11 — update checking: same as 10 but isCheckingForUpdates = true.
+        updateModel.snapshotSetIsCheckingForUpdates(true)
+        try renderMenuBar(model: updateModel, to: directory, name: "11-update-checking")
+        updateModel.snapshotSetIsCheckingForUpdates(false)
+
+        // 12 — update up-to-date: footer status line reads "Redline <ver> is up to date, checked 10:42 Dubai".
+        let upToDateMessage = "Redline \(updateModel.appVersion) is up to date, checked 10:42 Dubai"
+        updateModel.snapshotSetUpdateStatusMessage(upToDateMessage)
+        try renderMenuBar(model: updateModel, to: directory, name: "12-update-uptodate")
+
+        // 13 — update staged: row "Update to 9.9.9" present, footer status "Update to 9.9.9 is ready".
+        updateModel.snapshotSetUpdateAvailable(version: "9.9.9", notes: "Test release")
+        updateModel.snapshotSetUpdateStatusMessage("Update to 9.9.9 is ready")
+        try renderMenuBar(model: updateModel, to: directory, name: "13-update-staged")
+
+        // 14 — update revert: row "Revert to 0.2.0" present.
+        updateModel.snapshotSetUpdateAvailable(version: nil, notes: nil)  // Clear the staged update
+        updateModel.snapshotSetUpdateStatusMessage(nil)
+        updateModel.snapshotSetPreviousVersion("0.2.0")
+        try renderMenuBar(model: updateModel, to: directory, name: "14-update-revert")
     }
 
     @MainActor
@@ -177,6 +275,23 @@ enum PanelSnapshot {
         return (model, root)
     }
 
+    /// A throwaway UserDefaults suite — never `.standard` — for the panel-08 fixture,
+    /// the same isolation pattern ShotdeckCoreTests uses for TransportSettings/
+    /// OneDriveLocator tests.
+    private struct IsolatedDefaultsSuite {
+        let suiteName: String
+        let defaults: UserDefaults
+    }
+
+    private static func makeIsolatedDefaultsSuite() throws -> IsolatedDefaultsSuite {
+        let suiteName = "shotdeck-panel-snapshot-\(UUID().uuidString)"
+        guard let defaults = UserDefaults(suiteName: suiteName) else {
+            throw SnapshotError.oneDriveFixtureFailed("could not create isolated UserDefaults suite")
+        }
+        defaults.removePersistentDomain(forName: suiteName)
+        return IsolatedDefaultsSuite(suiteName: suiteName, defaults: defaults)
+    }
+
     @MainActor
     private static func seedReturns(model: AppModel) async throws {
         let watch = model.paths.watchFolder
@@ -276,6 +391,40 @@ extension AppModel {
         )
         self[keyPath: writable] = granted
     }
+
+    /// Snapshot-only: set isCheckingForUpdates without triggering a real check.
+    func snapshotSetIsCheckingForUpdates(_ checking: Bool) {
+        let writable: ReferenceWritableKeyPath<AppModel, Bool> = unsafeBitCast(
+            \AppModel.isCheckingForUpdates, to: ReferenceWritableKeyPath<AppModel, Bool>.self
+        )
+        self[keyPath: writable] = checking
+    }
+
+    /// Snapshot-only: set updateStatusMessage for panel display.
+    func snapshotSetUpdateStatusMessage(_ message: String?) {
+        setUpdateStatus(message)
+    }
+
+    /// Snapshot-only: set updateAvailable without triggering a real download.
+    func snapshotSetUpdateAvailable(version: String?, notes: String?) {
+        if let version = version, let notes = notes {
+            let writable: ReferenceWritableKeyPath<AppModel, (version: String, notes: String)?> = unsafeBitCast(
+                \AppModel.updateAvailable, to: ReferenceWritableKeyPath<AppModel, (version: String, notes: String)?>.self
+            )
+            self[keyPath: writable] = (version: version, notes: notes)
+        } else {
+            let writable: ReferenceWritableKeyPath<AppModel, (version: String, notes: String)?> = unsafeBitCast(
+                \AppModel.updateAvailable, to: ReferenceWritableKeyPath<AppModel, (version: String, notes: String)?>.self
+            )
+            self[keyPath: writable] = nil
+        }
+    }
+
+    /// Snapshot-only: set a fake previousVersion for the revert panel.
+    func snapshotSetPreviousVersion(_ version: String?) {
+        updateChecker.snapshotPreviousVersionOverride = version
+        updateChecker.snapshotUsesPreviousVersionOverride = true
+    }
 }
 
 private enum SnapshotError: Error, CustomStringConvertible {
@@ -283,6 +432,7 @@ private enum SnapshotError: Error, CustomStringConvertible {
     case encodeFailed(String)
     case pngGenerationFailed
     case pdfWriteFailed(String)
+    case oneDriveFixtureFailed(String)
 
     var description: String {
         switch self {
@@ -290,6 +440,7 @@ private enum SnapshotError: Error, CustomStringConvertible {
         case .encodeFailed(let name): return "PNG encode failed for \(name)"
         case .pngGenerationFailed: return "CoreGraphics PNG generation failed"
         case .pdfWriteFailed(let name): return "could not write \(name)"
+        case .oneDriveFixtureFailed(let detail): return "OneDrive snapshot fixture failed: \(detail)"
         }
     }
 }

Sources/Shotdeck/PickerSelfTest.swift

@@ -223,7 +223,7 @@ enum PickerSelfTest {
             sendTruthFail("seeded session was empty")
         }
 
-        let pending = try await model.composePDFForSend()
+        let pending = try await model.composePDFForSend(outbox: model.outboxURL, transport: .airDrop)
         guard fm.fileExists(atPath: pending.fileURL.path) else {
             sendTruthFail("PDF was not written")
         }
@@ -328,6 +328,9 @@ enum PickerSelfTest {
         return true
     }
 
+    /// (a) rejects an invalidly-signed payload, (b) stages the same payload once
+    /// properly signed, (c) installs it atomically into a throwaway target with
+    /// exactly one rollback copy, (d) reverts back. Never touches `/Applications`.
     private static func runUpdateSelfTest(outputDirectory: URL) async throws {
         let fm = FileManager.default
         try fm.createDirectory(at: outputDirectory, withIntermediateDirectories: true)
@@ -335,6 +338,9 @@ enum PickerSelfTest {
         guard let sourceApp = ownAppBundleURL() else {
             throw UpdateSelfTestError.detail("own bundle is not a .app (\(Bundle.main.bundleURL.path))")
         }
+        guard let originalVersion = readShortVersion(atAppURL: sourceApp) else {
+            throw UpdateSelfTestError.detail("own Info.plist has no CFBundleShortVersionString")
+        }
 
         let payload = outputDirectory.appendingPathComponent("payload", isDirectory: true)
         if fm.fileExists(atPath: payload.path) {
@@ -352,17 +358,20 @@ enum PickerSelfTest {
         plist["CFBundleShortVersionString"] = "99.0.0"
         let rewritten = try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0)
         try rewritten.write(to: plistURL)
+        // Editing Info.plist after copying it invalidates the inherited signature —
+        // Info.plist is a sealed special slot in the CodeDirectory — so this fake
+        // bundle is genuinely unsigned-in-effect without us stripping anything.
 
         let zipURL = outputDirectory.appendingPathComponent("Redline-99.0.0.zip")
+        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
+
+        func writeZipAndAppcast() throws {
             if fm.fileExists(atPath: zipURL.path) {
                 try fm.removeItem(at: zipURL)
             }
             try runDitto(arguments: ["-c", "-k", payload.path, zipURL.path])
-
             let zipData = try Data(contentsOf: zipURL)
             let hex = UpdateChecker.sha256Hex(zipData)
-
-        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
             let appcast: [String: String] = [
                 "version": "99.0.0",
                 "zipURL": zipURL.absoluteString,
@@ -371,13 +380,15 @@ enum PickerSelfTest {
             ]
             let appcastData = try JSONSerialization.data(withJSONObject: appcast, options: [.sortedKeys])
             try appcastData.write(to: appcastURL)
+        }
+        try writeZipAndAppcast()
 
         let defaults = UserDefaults.standard
-        let previous = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
+        let previousAppcastPref = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
         defaults.set(appcastURL.absoluteString, forKey: UpdateChecker.appcastURLDefaultsKey)
         defer {
-            if let previous {
+            if let previousAppcastPref {
-                defaults.set(previous, forKey: UpdateChecker.appcastURLDefaultsKey)
+                defaults.set(previousAppcastPref, forKey: UpdateChecker.appcastURLDefaultsKey)
             } else {
                 defaults.removeObject(forKey: UpdateChecker.appcastURLDefaultsKey)
             }
@@ -386,39 +397,128 @@ enum PickerSelfTest {
         let (model, isolatedRoot) = try makeIsolatedUpdateModel()
         defer { try? fm.removeItem(at: isolatedRoot) }
 
+        // (a) NEGATIVE — invalidly-signed payload must never be offered or staged.
         await model.updateChecker.checkNow()
+        guard model.updateAvailable == nil else {
+            throw UpdateSelfTestError.detail(
+                "reject-unsigned: updateAvailable=\(model.updateAvailable?.version ?? "nil") (expected nil)"
+            )
+        }
+        guard model.updateChecker.statusMessage == "Update is not signed by MMD — not installed." else {
+            throw UpdateSelfTestError.detail(
+                "reject-unsigned: statusMessage=\(model.updateChecker.statusMessage ?? "nil")"
+            )
+        }
+        print("UPDATE-SELFTEST reject-unsigned PASS")
+        fflush(stdout)
 
+        // (b) POSITIVE — re-sign the same bundle, re-zip, re-serve; must now stage.
+        let signIdentity = ProcessInfo.processInfo.environment["SHOTDECK_SELFTEST_SIGN_IDENTITY"]
+            ?? "Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
+        try runCodesign(identity: signIdentity, path: fakeApp.path)
+        try writeZipAndAppcast()
+
+        await model.updateChecker.checkNow()
         guard model.updateAvailable?.version == "99.0.0" else {
             throw UpdateSelfTestError.detail(
-                "updateAvailable=\(model.updateAvailable?.version ?? "nil")"
+                "staged-signed: updateAvailable=\(model.updateAvailable?.version ?? "nil")"
             )
         }
         guard let staged = model.updateChecker.stagedAppURL else {
-            throw UpdateSelfTestError.detail("staged payload missing")
+            throw UpdateSelfTestError.detail("staged-signed: staged payload missing")
         }
         guard staged.lastPathComponent == "Redline.app" else {
-            throw UpdateSelfTestError.detail("staged name \(staged.lastPathComponent)")
+            throw UpdateSelfTestError.detail("staged-signed: staged name \(staged.lastPathComponent)")
         }
         let stagedExe = staged.appendingPathComponent("Contents/MacOS/Shotdeck")
         guard fm.fileExists(atPath: stagedExe.path) else {
-            throw UpdateSelfTestError.detail("staged Contents/MacOS/Shotdeck missing")
+            throw UpdateSelfTestError.detail("staged-signed: staged Contents/MacOS/Shotdeck missing")
         }
+        print("UPDATE-SELFTEST staged-signed PASS")
+        fflush(stdout)
 
-        let targetRoot = outputDirectory.appendingPathComponent("target", isDirectory: true)
+        // (c) ATOMIC INSTALL — a throwaway target pre-populated with the real
-        if fm.fileExists(atPath: targetRoot.path) {
+        // running version; never `/Applications`.
-            try fm.removeItem(at: targetRoot)
+        let tempAppsRoot = outputDirectory.appendingPathComponent("Applications", isDirectory: true)
+        if fm.fileExists(atPath: tempAppsRoot.path) {
+            try fm.removeItem(at: tempAppsRoot)
         }
-        let target = targetRoot.appendingPathComponent("Redline.app")
+        try fm.createDirectory(at: tempAppsRoot, withIntermediateDirectories: true)
-        model.updateChecker.installStaged(to: target)
+        let tempTarget = tempAppsRoot.appendingPathComponent("Redline.app")
+        try fm.copyItem(at: sourceApp, to: tempTarget)
 
-        let installedPlist = target.appendingPathComponent("Contents/Info.plist")
+        model.updateChecker.installStaged(to: tempTarget)
-        guard let installed = NSDictionary(contentsOf: installedPlist) as? [String: Any],
+
-              let installedVersion = installed["CFBundleShortVersionString"] as? String
+        guard let installedVersion = readShortVersion(atAppURL: tempTarget) else {
-        else {
+            throw UpdateSelfTestError.detail("atomic-install: installed Info.plist unreadable")
-            throw UpdateSelfTestError.detail("installed Info.plist unreadable")
         }
         guard installedVersion == "99.0.0" else {
-            throw UpdateSelfTestError.detail("installed version \(installedVersion)")
+            throw UpdateSelfTestError.detail("atomic-install: installed version \(installedVersion)")
+        }
+        let previousCopy = tempAppsRoot.appendingPathComponent("Redline.app.previous")
+        guard let previousVersionAfterInstall = readShortVersion(atAppURL: previousCopy) else {
+            throw UpdateSelfTestError.detail("atomic-install: Redline.app.previous missing or unreadable")
+        }
+        guard previousVersionAfterInstall == originalVersion else {
+            throw UpdateSelfTestError.detail(
+                "atomic-install: previous version=\(previousVersionAfterInstall) expected=\(originalVersion)"
+            )
+        }
+        try assertNoLeftoverEntries(in: tempAppsRoot, expecting: ["Redline.app", "Redline.app.previous"])
+        print("UPDATE-SELFTEST atomic-install PASS")
+        fflush(stdout)
+
+        // (d) REVERT — the rollback copy swaps back in; the just-replaced version
+        // becomes the new rollback copy, so a revert is itself reversible.
+        model.updateChecker.revertToPrevious(target: tempTarget)
+
+        guard let revertedVersion = readShortVersion(atAppURL: tempTarget) else {
+            throw UpdateSelfTestError.detail("revert: reverted Info.plist unreadable")
+        }
+        guard revertedVersion == originalVersion else {
+            throw UpdateSelfTestError.detail("revert: target version=\(revertedVersion) expected=\(originalVersion)")
+        }
+        guard let previousVersionAfterRevert = readShortVersion(atAppURL: previousCopy) else {
+            throw UpdateSelfTestError.detail("revert: Redline.app.previous missing or unreadable")
+        }
+        guard previousVersionAfterRevert == "99.0.0" else {
+            throw UpdateSelfTestError.detail(
+                "revert: previous version=\(previousVersionAfterRevert) expected=99.0.0"
+            )
+        }
+        try assertNoLeftoverEntries(in: tempAppsRoot, expecting: ["Redline.app", "Redline.app.previous"])
+        print("UPDATE-SELFTEST revert PASS")
+        fflush(stdout)
+    }
+
+    private static func readShortVersion(atAppURL url: URL) -> String? {
+        let plistURL = url.appendingPathComponent("Contents/Info.plist")
+        guard let dict = NSDictionary(contentsOf: plistURL) as? [String: Any] else { return nil }
+        return dict["CFBundleShortVersionString"] as? String
+    }
+
+    private static func runCodesign(identity: String, path: String) throws {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/codesign")
+        process.arguments = ["--force", "--deep", "--sign", identity, path]
+        let err = Pipe()
+        process.standardError = err
+        process.standardOutput = Pipe()
+        try process.run()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let message = String(data: err.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+            throw UpdateSelfTestError.detail("codesign failed: \(message)")
+        }
+    }
+
+    private static func assertNoLeftoverEntries(in directory: URL, expecting expected: Set<String>) throws {
+        let entries = (try? FileManager.default.contentsOfDirectory(atPath: directory.path)) ?? []
+        let unexpected = entries.filter { !expected.contains($0) }
+        guard unexpected.isEmpty else {
+            throw UpdateSelfTestError.detail(
+                "unexpected entries in \(directory.path): \(unexpected.joined(separator: ", "))"
+            )
         }
     }
 
@@ -476,18 +576,13 @@ enum PickerSelfTest {
         exit(1)
     }
 
-    /// Real sync root this Mac has; the phase proves the transport against the actual
+    /// Phase 5: proves the OneDrive transport end to end against a REAL sync root —
-    /// OneDrive file provider, never a fake home tree (that is what
+    /// resolved at runtime via `OneDriveLocator.syncRoots()`, never a hardcoded path, so
-    /// OneDriveLocatorTests in ShotdeckCoreTests are for).
+    /// this runs correctly on any Mac/account that has OneDrive signed in (MMD-named
-    private static let realOneDriveSyncRoot = URL(
+    /// root preferred, same as production). Triggered by `SHOTDECK_ONEDRIVE_SELFTEST`
-        fileURLWithPath: "/Users/benjaminhippler/Library/CloudStorage/OneDrive-MMDGROUP",
+    /// when chained after PICKER/SEND-TRUTH/UPDATE-SELFTEST — the exact pattern
-        isDirectory: true
+    /// `startUpdateSelfTestIfRequested` uses for its own env var. Returns true when the
-    )
+    /// async phase was scheduled (it calls `exit` itself).
-
-    /// Phase 5: proves the OneDrive transport end to end against the real sync root.
-    /// Triggered by `SHOTDECK_ONEDRIVE_SELFTEST` when chained after PICKER/SEND-TRUTH/
-    /// UPDATE-SELFTEST — the exact pattern `startUpdateSelfTestIfRequested` uses for its
-    /// own env var. Returns true when the async phase was scheduled (it calls `exit` itself).
     @discardableResult
     private static func startOneDriveSelfTestIfRequested() -> Bool {
         guard ProcessInfo.processInfo.environment["SHOTDECK_ONEDRIVE_SELFTEST"] != nil else {
@@ -514,9 +609,16 @@ enum PickerSelfTest {
     }
 
     private static func runOneDriveSelfTestAndExit() {
+        // Never a false PASS: no real OneDrive sync root on this machine/account is a
+        // SKIP (still non-zero exit), not silently treated as passing.
+        guard let syncRoot = OneDriveLocator.syncRoots().first else {
+            print("ONEDRIVE-SELFTEST SKIP no OneDrive sync root")
+            fflush(stdout)
+            exit(1)
+        }
         Task { @MainActor in
             do {
-                let folder = try await executeOneDriveSelfTest()
+                let folder = try await executeOneDriveSelfTest(syncRoot: syncRoot)
                 print("ONEDRIVE-SELFTEST PASS path=\(folder.path)")
                 fflush(stdout)
                 exit(0)
@@ -528,19 +630,37 @@ enum PickerSelfTest {
         }
     }
 
-    /// Builds a session, sends it through the OneDrive branch of `send(anchor: nil)`
+    /// Sub-step 1: builds a session, sends it through the OneDrive branch of
-    /// against a NEW folder under the real OneDrive sync root, confirms the watcher does
+    /// `send(anchor: nil)` against a NEW folder under `syncRoot`, confirms the watcher
-    /// NOT report the freshly-written unmarked PDF as a return, then adds a real PDFKit
+    /// does NOT report the freshly-written unmarked PDF as a return, then adds a real
-    /// ink annotation in place (what the iPad does) and confirms the watcher now reports
+    /// PDFKit ink annotation in place (what the iPad does) and confirms the watcher now
-    /// it as commented. Never deletes anything under OneDrive — the created folder and
+    /// reports it as commented.
-    /// PDF are left in place for Ben to inspect / for the real iPad round trip.
+    ///
-    private static func executeOneDriveSelfTest() async throws -> URL {
+    /// Sub-step 1b: rapid transport toggling (chooseTransport(.airDrop) immediately
+    /// followed by chooseTransport(.oneDrive), no await between them) must still end
+    /// with the watcher pointed at the OneDrive folder — proves the generation-guarded
+    /// reconcile in chooseTransport/chooseOneDriveFolder (SettingsView.swift) really
+    /// does let the last choice win instead of an earlier, superseded call applying its
+    /// stale folder after a later one already won.
+    ///
+    /// Sub-step 1c: the OTHER race — a toggle immediately followed by Send, with no
+    /// sleep at all before send() runs. Proves send() awaits `pendingReconcileTask`
+    /// before snapshotting transport/folder: a freshly-sent, still-unmarked PDF must
+    /// never be reported as an already-returned document (which is exactly what would
+    /// happen if send() raced ahead while recordUncommented was still `true`, stale
+    /// from the .airDrop leg of the toggle).
+    ///
+    /// Sub-step 2: relaunch simulation — the exact BLOCKER scenario this phase exists to
+    /// catch. OneDrive is still persisted in defaults from sub-step 1; builds a FRESH
+    /// model the same way the real app launches (`AppDelegate.makeLaunchModel()` itself,
+    /// not a reimplementation), bootstraps it, then marks a PDF in the folder in place —
+    /// the relaunched watcher must report it. A temp app-support root keeps this off the
+    /// real ~/Library/Application Support/Shotdeck.
+    ///
+    /// Never deletes anything under OneDrive — the created folder and PDFs are left in
+    /// place for Ben to inspect / for the real iPad round trip.
+    private static func executeOneDriveSelfTest(syncRoot: URL) async throws -> URL {
         let fm = FileManager.default
-        guard fm.fileExists(atPath: realOneDriveSyncRoot.path) else {
-            throw OneDriveSelfTestError.detail(
-                "real OneDrive sync root not found at \(realOneDriveSyncRoot.path)"
-            )
-        }
 
         // UserDefaults.standard is the ONLY defaults instance send()/TransportSettings
         // actually read at runtime (there is no defaults-threading through AppModel), so
@@ -563,8 +683,7 @@ enum PickerSelfTest {
         }
 
         let stamp = DubaiTime.fileStamp(Date())
-        let selftestFolder = realOneDriveSyncRoot
+        let selftestFolder = syncRoot.appendingPathComponent("Redline-selftest-\(stamp)", isDirectory: true)
-            .appendingPathComponent("Redline-selftest-\(stamp)", isDirectory: true)
         try fm.createDirectory(at: selftestFolder, withIntermediateDirectories: true)
 
         TransportSettings.setTransport(.oneDrive, defaults: defaults)
@@ -629,8 +748,123 @@ enum PickerSelfTest {
         }
 
         // What the iPad does: mark it up in place with a real ink annotation, then save.
-        guard let document = PDFDocument(url: pdfURL), let page = document.page(at: 0) else {
+        try addInkMark(to: pdfURL)
-            throw OneDriveSelfTestError.detail("could not reopen \(pdfURL.path) to annotate it")
+
+        let afterMarkup = try await watcher.scanNow()
+        guard let recorded = afterMarkup.first(where: { $0.fileURL == pdfURL }), recorded.isCommented else {
+            throw OneDriveSelfTestError.detail("annotated PDF was not reported as commented by scanNow")
+        }
+        let commentedAfter = try await ledger.commented()
+        guard commentedAfter.contains(where: { $0.fileURL == pdfURL }) else {
+            throw OneDriveSelfTestError.detail("annotated PDF was not recorded in the ledger as commented")
+        }
+
+        // Sub-step 1b: rapid toggle race — see the doc comment above this function.
+        model.chooseTransport(.airDrop)
+        model.chooseTransport(.oneDrive)   // immediately superseding the call above
+        // The generation guard itself is what's under test, not this wait — it just
+        // gives the (already-guarded) reconcile Task a moment to settle either way.
+        try await Task.sleep(for: .milliseconds(500))
+        guard model.transport == .oneDrive else {
+            throw OneDriveSelfTestError.detail(
+                "rapid toggle: model.transport ended as \(model.transport), expected .oneDrive"
+            )
+        }
+        let racePDFURL = selftestFolder.appendingPathComponent("Redline-race-\(stamp).pdf")
+        try writeUnmarkedRedlinePDF(to: racePDFURL)
+        try addInkMark(to: racePDFURL)
+        let raceFound = try await model.watcher.scanNow()
+        guard raceFound.first(where: { $0.fileURL == racePDFURL })?.isCommented == true else {
+            throw OneDriveSelfTestError.detail(
+                "rapid toggle: watcher did not end up watching \(selftestFolder.path) — an earlier, superseded chooseTransport call won"
+            )
+        }
+
+        // Sub-step 1c: toggle-then-immediate-send race — see the doc comment above
+        // this function. No sleep here: this IS the exact race window finding #3
+        // exists to close, so send() itself must wait out the pending reconcile.
+        let racePNG = try makeTinyPNGData()
+        _ = try await model.spool.append(
+            pngData: racePNG, pixelWidth: 64, pixelHeight: 48, scale: 1, capturedAt: Date()
+        )
+        model.replaceSession(try await model.spool.currentSession())
+        guard !model.session.isEmpty else {
+            throw OneDriveSelfTestError.detail("toggle-then-send: re-seeded session was empty")
+        }
+
+        let knownBeforeToggleSend = Set(
+            ((try? fm.contentsOfDirectory(at: selftestFolder, includingPropertiesForKeys: nil)) ?? [])
+                .map(\.lastPathComponent)
+        )
+        model.chooseTransport(.airDrop)
+        model.chooseTransport(.oneDrive)   // immediately superseding, no sleep before send()
+        await model.send(anchor: nil)
+
+        guard let toggleSendStatus = model.statusLine, toggleSendStatus.hasPrefix("Saved to OneDrive") else {
+            throw OneDriveSelfTestError.detail(
+                "toggle-then-send: status was \(model.statusLine ?? "nil"), expected 'Saved to OneDrive'"
+            )
+        }
+        guard model.session.isEmpty else {
+            throw OneDriveSelfTestError.detail("toggle-then-send: session was not archived")
+        }
+        let filesAfterToggleSend = (try? fm.contentsOfDirectory(
+            at: selftestFolder, includingPropertiesForKeys: nil
+        )) ?? []
+        guard let toggleSendPDFURL = filesAfterToggleSend.first(where: {
+            $0.pathExtension.lowercased() == "pdf" && !knownBeforeToggleSend.contains($0.lastPathComponent)
+        }) else {
+            throw OneDriveSelfTestError.detail("toggle-then-send: no new PDF found in \(selftestFolder.path)")
+        }
+        // The freshly-sent PDF is UNMARKED. If send() had raced ahead of the pending
+        // reconcile, recordUncommented could still have been (stale) true, and this
+        // scan would wrongly report it as already returned.
+        let scanAfterToggleSend = try await model.watcher.scanNow()
+        guard !scanAfterToggleSend.contains(where: { $0.fileURL == toggleSendPDFURL }) else {
+            throw OneDriveSelfTestError.detail(
+                "toggle-then-send: freshly-sent unmarked PDF at \(toggleSendPDFURL.path) was reported as returned — send() raced ahead of the pending reconcile"
+            )
+        }
+
+        // Sub-step 2: relaunch simulation — see the doc comment above this function.
+        let relaunchAppSupportRoot = fm.temporaryDirectory
+            .appendingPathComponent("shotdeck-onedrive-relaunch-\(UUID().uuidString)", isDirectory: true)
+        defer { try? fm.removeItem(at: relaunchAppSupportRoot) }
+
+        let relaunchModel = AppDelegate.makeLaunchModel(appSupportRoot: relaunchAppSupportRoot)
+        guard relaunchModel.transport == .oneDrive else {
+            throw OneDriveSelfTestError.detail(
+                "relaunch: model transport was \(relaunchModel.transport), expected .oneDrive"
+            )
+        }
+        guard relaunchModel.watchFolderURL.path == selftestFolder.path else {
+            throw OneDriveSelfTestError.detail(
+                "relaunch: model watchFolderURL was \(relaunchModel.watchFolderURL.path), expected \(selftestFolder.path) — this is the exact BLOCKER this phase guards against"
+            )
+        }
+
+        await relaunchModel.bootstrap()
+
+        let relaunchPDFURL = selftestFolder.appendingPathComponent("Redline-relaunch-\(stamp).pdf")
+        try writeUnmarkedRedlinePDF(to: relaunchPDFURL)
+        try addInkMark(to: relaunchPDFURL)
+
+        let relaunchFound = try await relaunchModel.watcher.scanNow()
+        guard relaunchFound.first(where: { $0.fileURL == relaunchPDFURL })?.isCommented == true else {
+            throw OneDriveSelfTestError.detail(
+                "relaunch: watcher did not report the marked PDF at \(relaunchPDFURL.path) as returned — it was watching the wrong folder after relaunch"
+            )
+        }
+        await relaunchModel.watcher.stop()
+
+        return selftestFolder
+    }
+
+    /// Adds a real PDFKit ink annotation to the PDF at `url` in place and saves it —
+    /// exactly what the iPad does when marking up a page.
+    private static func addInkMark(to url: URL) throws {
+        guard let document = PDFDocument(url: url), let page = document.page(at: 0) else {
+            throw OneDriveSelfTestError.detail("could not reopen \(url.path) to annotate it")
         }
         let ink = PDFAnnotation(
             bounds: CGRect(x: 20, y: 20, width: 60, height: 60),
@@ -642,20 +876,27 @@ enum PickerSelfTest {
         stroke.line(to: NSPoint(x: 80, y: 80))
         ink.add(stroke)
         page.addAnnotation(ink)
-        guard document.write(to: pdfURL) else {
+        guard document.write(to: url) else {
-            throw OneDriveSelfTestError.detail("could not save the annotated PDF back to \(pdfURL.path)")
+            throw OneDriveSelfTestError.detail("could not save the annotated PDF back to \(url.path)")
+        }
     }
 
-        let afterMarkup = try await watcher.scanNow()
+    /// Writes a fresh, unmarked, single-page "Redline"-creator PDF straight to `url` —
-        guard let recorded = afterMarkup.first(where: { $0.fileURL == pdfURL }), recorded.isCommented else {
+    /// standing in for a PDF that has just landed in the watch folder, before any
-            throw OneDriveSelfTestError.detail("annotated PDF was not reported as commented by scanNow")
+    /// human mark. Used by the rapid-toggle and relaunch sub-steps, which don't need to
+    /// exercise send()/composePDFForSend() again (sub-step 1 already does).
+    private static func writeUnmarkedRedlinePDF(to url: URL) throws {
+        let document = PDFDocument()
+        let page = PDFPage()
+        page.setBounds(CGRect(x: 0, y: 0, width: 612, height: 792), for: .mediaBox)
+        document.insert(page, at: 0)
+        document.documentAttributes = [
+            PDFDocumentAttribute.creatorAttribute: "Redline",
+            PDFDocumentAttribute.subjectAttribute: UUID().uuidString,
+        ]
+        guard document.write(to: url) else {
+            throw OneDriveSelfTestError.detail("could not write \(url.path)")
         }
-        let commentedAfter = try await ledger.commented()
-        guard commentedAfter.contains(where: { $0.fileURL == pdfURL }) else {
-            throw OneDriveSelfTestError.detail("annotated PDF was not recorded in the ledger as commented")
-        }
-
-        return selftestFolder
     }
 
     private static func oneDriveFail(_ detail: String) -> Never {

Sources/Shotdeck/SendController.swift

@@ -16,34 +16,66 @@ extension AppModel: SendCapable {
         guard !session.isEmpty, !isSending else { return }
         setSending(true)
 
-        let transport = TransportSettings.transport()
+        // Wait for any IN-FLIGHT transport/folder reconcile (chooseTransport/
+        // chooseOneDriveFolder in SettingsView.swift) to fully settle BEFORE
+        // snapshotting transport/folder below. Without this, a toggle immediately
+        // followed by Send could let send() read a state that is still mid-transition
+        // — e.g. the watcher's recordUncommented flag briefly lagging the just-chosen
+        // transport, so a freshly-sent unmarked OneDrive PDF gets misreported as an
+        // already-returned document. `Task<Void, Never>.value` never throws, and
+        // awaiting nil is an immediate no-op (AirDrop mode, or no toggle in flight).
+        await pendingReconcileTask?.value
 
-        // OneDrive mode: verify the real destination exists RIGHT NOW, before composing
+        // Snapshot BOTH the transport AND the destination folder into local `let`s
-        // anything. `outboxURL` is kept in sync with the resolved OneDrive folder by
+        // ONCE, before any further `await` in this function. chooseTransport/
-        // bootstrap/chooseTransport/chooseOneDriveFolder, but this is re-resolved fresh
+        // chooseOneDriveFolder also refuse outright (status "Finish the current send
-        // here (never trusted stale) so a folder that vanished since then (OneDrive
+        // first.") while isSending is true, but this snapshot is the actual fix for the
-        // signed out, external volume unmounted, folder deleted) is caught instead of
+        // send-vs-switch race: even without that guard, everything below operates on
-        // silently writing into whatever `outboxURL` happens to hold.
+        // these frozen values — composePDFForSend(outbox:transport:) takes both as
+        // parameters and never re-reads `self.outboxURL`/`self.transport` after a
+        // suspension point, so a concurrent transport switch mid-send can no longer
+        // land the PDF under one transport's folder while the archive/status branch
+        // runs the other's.
+        let transport = TransportSettings.transport()
+        let destinationFolder: URL
+
+        // OneDrive mode: verify the real destination exists, is writable, AND actually
+        // accepts a real write RIGHT NOW, before composing anything. `isWritableDirectory`
+        // alone is not enough — a OneDrive Files-On-Demand directory whose provider
+        // domain is signed out can report as existing and POSIX-writable while an
+        // actual write fails, so `probeWritable` writes-fsyncs-removes a tiny real probe
+        // file to catch that. `outboxURL` is kept in sync with the resolved OneDrive
+        // folder by bootstrap/chooseTransport/chooseOneDriveFolder, but this is
+        // re-resolved fresh here (never trusted stale) so a folder that vanished or lost
+        // its permissions since then (OneDrive signed out, external volume unmounted,
+        // folder deleted, chmod'd unwritable) is caught instead of silently attempted
+        // and surfacing as a generic PDF-composition failure.
         if transport == .oneDrive {
             guard let folder = OneDriveLocator.resolveOneDriveFolder(),
-                  Self.directoryExists(at: folder)
+                  OneDriveLocator.isWritableDirectory(at: folder),
+                  OneDriveLocator.probeWritable(at: folder)
             else {
                 let path = OneDriveLocator.resolveOneDriveFolder()?.path
                     ?? TransportSettings.storedOneDriveFolderPath()
                     ?? "no OneDrive folder found"
+                setResolvedOneDriveFolder(nil)
                 setStatus(ShotdeckError.oneDriveFolderUnavailable(path: path).errorDescription)
                 setSending(false)
                 return
             }
+            destinationFolder = folder
+            setResolvedOneDriveFolder(folder)
             if outboxURL != folder || watchFolderURL != folder {
                 setFolderURLs(outbox: folder, watch: folder)
                 try? await watcher.updateWatchFolder(folder)
             }
+        } else {
+            destinationFolder = outboxURL
         }
 
         let pending: ComposedSend
         do {
-            pending = try await composePDFForSend()
+            pending = try await composePDFForSend(outbox: destinationFolder, transport: transport)
         } catch {
             // Never unlink the published PDF, and never unlink the temp file either:
             // a rename failure would leave the complete document at the temp name.
@@ -91,19 +123,20 @@ extension AppModel: SendCapable {
         }
     }
 
-    private static func directoryExists(at url: URL) -> Bool {
+    /// Writes the PDF to `outboxDir` and records its path. Does not archive the session
-        var isDirectory: ObjCBool = false
-        let exists = FileManager.default.fileExists(atPath: url.path, isDirectory: &isDirectory)
-        return exists && isDirectory.boolValue
-    }
-
-    /// Writes the PDF to the outbox and records its path. Does not archive the session
     /// and does not present AirDrop — that happens only after the share completes.
-    func composePDFForSend() async throws -> ComposedSend {
+    /// `outboxDir`/`transport` are passed in (values `send(anchor:)` snapshotted before
+    /// any await) rather than read from `self.outboxURL`/`self.transport` here, so a
+    /// concurrent transport switch mid-send can never redirect an in-flight compose to
+    /// a different folder. A write/rename failure specifically at the destination
+    /// folder (as opposed to composer.compose()'s own session/image-content failures)
+    /// is reported as `oneDriveFolderUnavailable` rather than the generic
+    /// `pdfCompositionFailed` when `transport == .oneDrive` — the File Provider edge
+    /// case where the folder looked writable moments ago in `send(anchor:)` but the
+    /// actual write still failed (e.g. OneDrive signed out mid-write).
+    func composePDFForSend(outbox outboxDir: URL, transport: SendTransport) async throws -> ComposedSend {
         let workingSession = session
         let composer = self.composer
-        // Live outbox (FolderSettings), not `paths.outbox` — Settings changes take effect.
-        let outboxDir = outboxURL
         let sourceDir = paths.sessionDirectory(workingSession.id)
         let fileName = PDFComposer.fileName(for: workingSession)
         let finalURL = outboxDir.appendingPathComponent(fileName)
@@ -123,14 +156,27 @@ extension AppModel: SendCapable {
             // POSIX rename onto `finalURL` replaces any same-name file in one
             // directory operation; there is never a window where the PDF is gone.
             if Darwin.rename(tempURL.path, finalURL.path) != 0 {
+                if transport == .oneDrive {
+                    throw ShotdeckError.oneDriveFolderUnavailable(path: outboxDir.path)
+                }
                 throw ShotdeckError.pdfCompositionFailed(
                     reason: "could not publish the PDF: \(String(cString: strerror(errno)))"
                 )
             }
+            do {
                 try AtomicFile.fsyncDirectory(at: outboxDir)
+            } catch {
+                if transport == .oneDrive {
+                    throw ShotdeckError.oneDriveFolderUnavailable(path: outboxDir.path)
+                }
+                throw error
+            }
         }.value
 
         guard FileManager.default.fileExists(atPath: finalURL.path) else {
+            if transport == .oneDrive {
+                throw ShotdeckError.oneDriveFolderUnavailable(path: outboxDir.path)
+            }
             throw ShotdeckError.pdfCompositionFailed(reason: "the PDF was not written to disk")
         }
         rememberLastComposedPDF(finalURL)

Sources/Shotdeck/SettingsView.swift

@@ -77,26 +77,25 @@ struct SettingsView: View {
             } else {
                 GridRow(alignment: .center) {
                     fieldLabel("OneDrive folder")
-                    if let folder = resolvedOneDriveFolder {
+                    if let folder = model.resolvedOneDriveFolder {
                         folderValue(path: folder.path) {
                             model.chooseOneDriveFolder()
                         }
                     } else {
-                        HStack(spacing: 8) {
+                        // One-line row, same shape as the normal path row: "Not found"
-                            Text("No OneDrive folder found — sign in to OneDrive or choose a folder.")
+                        // where the path would be, Choose… stays live. The explanation
-                                .font(.caption)
+                        // moves to the caption below instead of wrapping this row.
-                                .foregroundStyle(.secondary)
+                        folderValue(path: "Not found") {
-                                .fixedSize(horizontal: false, vertical: true)
+                            model.chooseOneDriveFolder()
-                                .frame(maxWidth: .infinity, alignment: .leading)
-                            Button("Choose…") { model.chooseOneDriveFolder() }
                         }
-                        .frame(minHeight: 22)
                     }
                 }
 
                 GridRow {
                     Text(
-                        "The PDF is saved here and this same folder is watched for the marked-up copy. On the iPad open it from Files > OneDrive."
+                        model.resolvedOneDriveFolder != nil
+                            ? "The PDF is saved here and this same folder is watched for the marked-up copy. On the iPad open it from Files > OneDrive."
+                            : "No OneDrive folder found. Sign in to OneDrive, or choose a folder."
                     )
                     .font(.caption)
                     .foregroundStyle(.secondary)
@@ -122,13 +121,6 @@ struct SettingsView: View {
         Binding(get: { model.transport }, set: { model.chooseTransport($0) })
     }
 
-    /// Ground truth from OneDriveLocator, not `model.outboxURL` — the model may be
-    /// showing an AirDrop-folder fallback when no real OneDrive folder resolves, and
-    /// the Settings row must say so plainly rather than repeat that fallback path.
-    private var resolvedOneDriveFolder: URL? {
-        OneDriveLocator.resolveOneDriveFolder()
-    }
-
     private func armHotkeyRecorder() {
         guard !isRecordingHotkey else { return }
         isRecordingHotkey = true
@@ -256,7 +248,21 @@ extension AppModel: SettingsWindowPresenting {
     /// doesn't exist yet, and re-points the running watcher (folder + recordUncommented)
     /// at the new state. Switching back to AirDrop restores its own stored overrides
     /// untouched, since AirDrop and OneDrive folder settings are stored under separate keys.
+    /// Refuses while a send is in flight (send() snapshots its own folder/transport, but
+    /// switching mid-send is still confusing UX — nothing to gain by allowing it).
+    /// The async reconcile below is generation-guarded: `reconcileGeneration` is bumped
+    /// synchronously before the Task starts, and the Task checks its own snapshot against
+    /// the live value before every mutating step, so rapid toggling (this function or
+    /// chooseOneDriveFolder, in any order) always lets the LAST choice win instead of an
+    /// earlier, superseded call applying its stale folder/flag after a later one already won.
+    /// The Task's handle is stored in `pendingReconcileTask` so send() can await its
+    /// completion before snapshotting transport/folder — closing the OTHER race, where a
+    /// toggle is immediately followed by Send before this reconcile has settled.
     func chooseTransport(_ value: SendTransport) {
+        guard !isSending else {
+            setStatus("Finish the current send first.")
+            return
+        }
         guard value != transport else { return }
         TransportSettings.setTransport(value)
         setTransport(value)
@@ -267,11 +273,18 @@ extension AppModel: SettingsWindowPresenting {
             )
         }
         setFolderURLs(outbox: folders.outbox, watch: folders.watch)
-        Task {
+        setResolvedOneDriveFolder(OneDriveLocator.resolveOneDriveFolder())
+
+        reconcileGeneration += 1
+        let generation = reconcileGeneration
+        pendingReconcileTask = Task {
+            guard generation == self.reconcileGeneration else { return }
             await watcher.setRecordUncommented(value == .airDrop)
+            guard generation == self.reconcileGeneration else { return }
             do {
                 try await watcher.updateWatchFolder(folders.watch)
             } catch {
+                guard generation == self.reconcileGeneration else { return }
                 setStatus(
                     (error as? ShotdeckError)?.errorDescription ?? "Could not switch the watch folder."
                 )
@@ -279,18 +292,31 @@ extension AppModel: SettingsWindowPresenting {
         }
     }
 
+    /// Refuses while a send is in flight, same reasoning as chooseTransport. See
+    /// chooseTransport's doc comment for the generation-guard mechanism shared here.
     func chooseOneDriveFolder() {
-        let start = OneDriveLocator.resolveOneDriveFolder() ?? FileManager.default.homeDirectoryForCurrentUser
+        guard !isSending else {
+            setStatus("Finish the current send first.")
+            return
+        }
+        let start = resolvedOneDriveFolder ?? FileManager.default.homeDirectoryForCurrentUser
         guard let url = chooseDirectory(startingAt: start) else { return }
         TransportSettings.setOneDriveFolder(url)
         try? FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+        setResolvedOneDriveFolder(OneDriveLocator.resolveOneDriveFolder())
         guard transport == .oneDrive else { return }
         setFolderURLs(outbox: url, watch: url)
-        Task {
+
+        reconcileGeneration += 1
+        let generation = reconcileGeneration
+        pendingReconcileTask = Task {
+            guard generation == self.reconcileGeneration else { return }
             do {
                 try await watcher.updateWatchFolder(url)
+                guard generation == self.reconcileGeneration else { return }
                 setStatus("OneDrive folder set to \(url.lastPathComponent).")
             } catch {
+                guard generation == self.reconcileGeneration else { return }
                 setStatus(
                     (error as? ShotdeckError)?.errorDescription ?? "Could not switch the watch folder."
                 )

Sources/Shotdeck/UpdateChecker.swift

@@ -1,6 +1,8 @@
 import AppKit
 import CryptoKit
 import Foundation
+import Security
+import ShotdeckCore
 
 /// Built-in updater. Checks an appcast, stages a verified payload, and installs
 /// only when the user clicks the menu row — never automatically.
@@ -10,22 +12,37 @@ final class UpdateChecker {
     static let defaultAppcastURL = URL(string: "https://get.baobab-ts.com/cowork/redline/appcast.json")!
     static let defaultInstallTarget = URL(fileURLWithPath: "/Applications/Redline.app")
 
+    /// Required bundle identifier for any staged or installed payload.
+    static let expectedBundleIdentifier = "ai.flowmaster.shotdeck"
+    /// Developer team identifiers MMD ships Redline under. Overridable only for the self-test.
+    static let allowedTeamIdentifiers: Set<String> = ["PWMCBMX5M8", "L3N9S54CN3"]
+
     private(set) var availableUpdate: (version: String, notes: String)?
     private(set) var stagedAppURL: URL?
     private(set) var statusMessage: String?
+    private(set) var lastCheckedAt: Date?
+    private(set) var isCheckingNow: Bool = false
 
     var onChecked: (() -> Void)?
+    /// Fired whenever `isCheckingNow` flips, so a UI can show "Checking…" for the
+    /// whole duration of a check rather than only after it lands.
+    var onCheckingChanged: ((Bool) -> Void)?
 
     private let urlSession: URLSession
     private var repeatingTimer: Timer?
     private var firstCheckTask: Task<Void, Never>?
-    private var isChecking = false
     private var stagingDirectory: URL?
+    /// Snapshot-only override for previousVersion; when snapshotUsesPreviousVersionOverride is true,
+    /// this value (including nil) is returned instead of checking the file system.
+    var snapshotPreviousVersionOverride: String?
+    var snapshotUsesPreviousVersionOverride: Bool = false
+    /// Test seam: override appcast JSON. When set, returns this instead of fetching from URL.
+    var testAppcastJSON: String?
 
     init() {
         let config = URLSessionConfiguration.ephemeral
-        config.timeoutIntervalForRequest = 15
+        config.timeoutIntervalForRequest = 30
-        config.timeoutIntervalForResource = 15
+        config.timeoutIntervalForResource = 600
         config.httpCookieAcceptPolicy = .never
         config.httpShouldSetCookies = false
         config.httpCookieStorage = nil
@@ -51,10 +68,18 @@ final class UpdateChecker {
         repeatingTimer = timer
     }
 
-    func checkNow() async {
+    /// Checks the appcast and stages a newer, signature-verified payload.
-        guard !isChecking else { return }
+    /// `manual` only affects the status message shown when already up to date —
-        isChecking = true
+    /// a user-initiated check says so; the silent background check stays quiet.
-        defer { isChecking = false }
+    func checkNow(manual: Bool = false) async {
+        guard !isCheckingNow else { return }
+        isCheckingNow = true
+        onCheckingChanged?(true)
+        defer {
+            isCheckingNow = false
+            onCheckingChanged?(false)
+        }
+        lastCheckedAt = Date()
 
         let appcast: Appcast
         do {
@@ -67,7 +92,12 @@ final class UpdateChecker {
 
         guard Self.isNewer(appcast.version, than: Self.currentVersion()) else {
             clearOffer()
+            if manual {
+                let timestamp = DubaiTime.checkTime(lastCheckedAt ?? Date())
+                statusMessage = "Redline \(Self.currentVersion()) is up to date, checked \(timestamp)"
+            } else {
                 statusMessage = nil
+            }
             onChecked?()
             return
         }
@@ -75,11 +105,15 @@ final class UpdateChecker {
         do {
             try await downloadAndStage(appcast)
             availableUpdate = (version: appcast.version, notes: appcast.notes ?? "")
-            statusMessage = nil
+            statusMessage = manual ? "Update to \(appcast.version) is ready" : nil
         } catch UpdateCheckError.checksumMismatch {
             discardStaging()
             availableUpdate = nil
             statusMessage = "Update file failed the checksum — not installed."
+        } catch UpdateCheckError.signatureInvalid {
+            discardStaging()
+            availableUpdate = nil
+            statusMessage = "Update is not signed by MMD — not installed."
         } catch {
             discardStaging()
             availableUpdate = nil
@@ -88,9 +122,9 @@ final class UpdateChecker {
         onChecked?()
     }
 
-    /// Copies the staged app onto `target` with ditto (in place; never deletes the old app).
+    /// Installs the staged app onto `target` atomically, keeping exactly one rollback
-    /// Relaunches unless `SHOTDECK_UPDATE_SELFTEST` is set, so the in-process self-test
+    /// copy (`Redline.app.previous`), then hands off to a relaunch and quits.
-    /// can assert the installed Info.plist without killing the process.
+    /// Never deletes the old app before the new one is verified in place.
     func installStaged(to target: URL = UpdateChecker.defaultInstallTarget) {
         guard let staged = stagedAppURL else {
             statusMessage = "No update is staged."
@@ -98,29 +132,121 @@ final class UpdateChecker {
             return
         }
 
+        let targetDir = target.deletingLastPathComponent()
+        let previousURL = targetDir.appendingPathComponent("Redline.app.previous")
+
         do {
-            try FileManager.default.createDirectory(
+            try FileManager.default.createDirectory(at: targetDir, withIntermediateDirectories: true)
-                at: target.deletingLastPathComponent(),
+
-                withIntermediateDirectories: true
+            let replacementDir = try FileManager.default.url(
+                for: .itemReplacementDirectory,
+                in: .userDomainMask,
+                appropriateFor: target,
+                create: true
             )
-            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, target.path])
+            defer { try? FileManager.default.removeItem(at: replacementDir) }
+
+            let newCopy = replacementDir.appendingPathComponent(target.lastPathComponent)
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, newCopy.path])
+
+            // Exactly one rollback copy is kept — drop any older one before this install.
+            if FileManager.default.fileExists(atPath: previousURL.path) {
+                try FileManager.default.removeItem(at: previousURL)
+            }
+
+            if FileManager.default.fileExists(atPath: target.path) {
+                _ = try FileManager.default.replaceItemAt(
+                    target,
+                    withItemAt: newCopy,
+                    backupItemName: previousURL.lastPathComponent,
+                    options: [.withoutDeletingBackupItem]
+                )
+            } else {
+                try FileManager.default.moveItem(at: newCopy, to: target)
+            }
         } catch {
             statusMessage = "The update could not be installed."
             onChecked?()
             return
         }
 
-        let isSelfTest = ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
+        // Defense in depth: re-verify what actually landed on disk, not just the staged copy.
-        if isSelfTest { return }
-
         do {
-            try Self.runProcess(executable: "/usr/bin/open", arguments: ["-n", target.path])
+            try Self.verifySignature(of: target)
         } catch {
-            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            statusMessage = "The update was installed but failed verification."
             onChecked?()
             return
         }
-        NSApp.terminate(nil)
+
+        discardStaging()
+        availableUpdate = nil
+        relaunch(target: target)
+    }
+
+    /// Swaps `Redline.app.previous` back into place, verifying its signature first.
+    /// The just-replaced (newer) app becomes the new `.previous` — a revert is
+    /// itself reversible.
+    func revertToPrevious(target: URL = UpdateChecker.defaultInstallTarget) {
+        let targetDir = target.deletingLastPathComponent()
+        let previousURL = targetDir.appendingPathComponent("Redline.app.previous")
+
+        guard FileManager.default.fileExists(atPath: previousURL.path) else {
+            statusMessage = "No previous version to revert to."
+            onChecked?()
+            return
+        }
+
+        do {
+            try Self.verifySignature(of: previousURL)
+        } catch {
+            statusMessage = "The previous version failed verification and was not restored."
+            onChecked?()
+            return
+        }
+
+        do {
+            // `previousURL` cannot be handed to replaceItemAt directly: its own path
+            // IS the requested backup name, so the backup step would clobber it
+            // before the swap ever reads it. Stage a throwaway copy first, exactly
+            // like installStaged does for the forward direction.
+            let replacementDir = try FileManager.default.url(
+                for: .itemReplacementDirectory,
+                in: .userDomainMask,
+                appropriateFor: target,
+                create: true
+            )
+            defer { try? FileManager.default.removeItem(at: replacementDir) }
+
+            let newCopy = replacementDir.appendingPathComponent(target.lastPathComponent)
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [previousURL.path, newCopy.path])
+            try FileManager.default.removeItem(at: previousURL)
+
+            _ = try FileManager.default.replaceItemAt(
+                target,
+                withItemAt: newCopy,
+                backupItemName: previousURL.lastPathComponent,
+                options: [.withoutDeletingBackupItem]
+            )
+        } catch {
+            statusMessage = "Could not revert to the previous version."
+            onChecked?()
+            return
+        }
+
+        relaunch(target: target)
+    }
+
+    /// The version recorded in `Redline.app.previous`'s Info.plist, or nil when no
+    /// rollback copy exists. Respects the snapshot-only override for panel rendering.
+    func previousVersion(target: URL = UpdateChecker.defaultInstallTarget) -> String? {
+        if snapshotUsesPreviousVersionOverride {
+            return snapshotPreviousVersionOverride
+        }
+        let previousURL = target.deletingLastPathComponent().appendingPathComponent("Redline.app.previous")
+        let plistURL = previousURL.appendingPathComponent("Contents/Info.plist")
+        guard let plist = NSDictionary(contentsOf: plistURL) as? [String: Any] else { return nil }
+        return plist["CFBundleShortVersionString"] as? String
     }
 
     static func resolvedAppcastURL() -> URL {
@@ -156,6 +282,67 @@ final class UpdateChecker {
         SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()
     }
 
+    /// Validates the code signature of the app at `appURL`: strictly, across all
+    /// architectures and nested code, then checks its bundle identifier and team
+    /// identifier against `expectedBundleIdentifier` / the allowed-teams set.
+    /// `REDLINE_ALLOWED_TEAMS` (comma separated) overrides the allowed set — for
+    /// the self-test only, so it can accept a locally re-signed fake bundle.
+    static func verifySignature(of appURL: URL) throws {
+        var staticCode: SecStaticCode?
+        let createStatus = SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode)
+        guard createStatus == errSecSuccess, let code = staticCode else {
+            throw UpdateCheckError.signatureInvalid(
+                "could not read a code signature (status \(createStatus))"
+            )
+        }
+
+        let validityFlags = SecCSFlags(
+            rawValue: kSecCSStrictValidate | kSecCSCheckAllArchitectures | kSecCSCheckNestedCode
+        )
+        var validityError: Unmanaged<CFError>?
+        let validityStatus = SecStaticCodeCheckValidityWithErrors(code, validityFlags, nil, &validityError)
+        guard validityStatus == errSecSuccess else {
+            let detail = (validityError?.takeRetainedValue()).map { String(describing: $0) } ?? "status \(validityStatus)"
+            throw UpdateCheckError.signatureInvalid("signature is not valid: \(detail)")
+        }
+
+        var signingInfo: CFDictionary?
+        let infoStatus = SecCodeCopySigningInformation(
+            code,
+            SecCSFlags(rawValue: kSecCSSigningInformation),
+            &signingInfo
+        )
+        guard infoStatus == errSecSuccess, let info = signingInfo as? [String: Any] else {
+            throw UpdateCheckError.signatureInvalid("could not read signing information (status \(infoStatus))")
+        }
+
+        let identifier = info[kSecCodeInfoIdentifier as String] as? String
+        guard identifier == expectedBundleIdentifier else {
+            throw UpdateCheckError.signatureInvalid(
+                "unexpected bundle identifier: \(identifier ?? "nil")"
+            )
+        }
+
+        let teamIdentifier = info[kSecCodeInfoTeamIdentifier as String] as? String
+        guard let teamIdentifier, resolvedAllowedTeamIdentifiers().contains(teamIdentifier) else {
+            throw UpdateCheckError.signatureInvalid(
+                "unexpected team identifier: \(teamIdentifier ?? "nil")"
+            )
+        }
+    }
+
+    private static func resolvedAllowedTeamIdentifiers() -> Set<String> {
+        if let env = ProcessInfo.processInfo.environment["REDLINE_ALLOWED_TEAMS"], !env.isEmpty {
+            let parts = env.split(separator: ",")
+                .map { $0.trimmingCharacters(in: .whitespaces) }
+                .filter { !$0.isEmpty }
+            if !parts.isEmpty {
+                return Set(parts)
+            }
+        }
+        return allowedTeamIdentifiers
+    }
+
     // MARK: - Private
 
     private struct Appcast: Decodable {
@@ -170,10 +357,16 @@ final class UpdateChecker {
         case invalidPayload
         case httpStatus(Int)
         case processFailed(String)
+        case signatureInvalid(String)
     }
 
     private func fetchAppcast() async throws -> Appcast {
-        let data = try await fetchData(from: Self.resolvedAppcastURL())
+        let data: Data
+        if let testJSON = testAppcastJSON {
+            data = testJSON.data(using: .utf8) ?? Data()
+        } else {
+            data = try await fetchData(from: Self.resolvedAppcastURL())
+        }
         return try JSONDecoder().decode(Appcast.self, from: data)
     }
 
@@ -219,6 +412,7 @@ final class UpdateChecker {
         guard FileManager.default.fileExists(atPath: executable.path) else {
             throw UpdateCheckError.invalidPayload
         }
+        try Self.verifySignature(of: appURL)
         stagedAppURL = appURL
     }
 
@@ -235,6 +429,35 @@ final class UpdateChecker {
         stagedAppURL = nil
     }
 
+    /// Spawns a detached watcher that waits for this process to exit, then reopens
+    /// `target`, and quits. Never called during the self-test, so the in-process
+    /// assertions after `installStaged`/`revertToPrevious` can still run.
+    private func relaunch(target: URL) {
+        guard ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] == nil else { return }
+
+        let ownPID = ProcessInfo.processInfo.processIdentifier
+        let script = "while kill -0 \(ownPID) 2>/dev/null; do sleep 0.2; done; " +
+            "/usr/bin/open -n \(Self.shellQuoted(target.path))"
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/bin/sh")
+        process.arguments = ["-c", script]
+        process.standardInput = FileHandle.nullDevice
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+        do {
+            try process.run()
+        } catch {
+            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            onChecked?()
+            return
+        }
+        NSApp.terminate(nil)
+    }
+
+    private static func shellQuoted(_ path: String) -> String {
+        "'" + path.replacingOccurrences(of: "'", with: "'\\''") + "'"
+    }
+
     private static func findRedlineApp(in directory: URL) -> URL? {
         let fm = FileManager.default
         let direct = directory.appendingPathComponent("Redline.app")

Sources/Shotdeck/main.swift

@@ -24,8 +24,9 @@ struct ShotdeckApp: App {
                 .environment(appDelegate.model)
         } label: {
             let state = appDelegate.model.iconState
+            let hasUpdate = appDelegate.model.updateAvailable != nil
             HStack(spacing: 4) {
-                Image(systemName: state.symbolName)
+                menuBarIcon(for: state, hasUpdate: hasUpdate)
                 if let count = state.countText {
                     Text(count).font(.system(size: 11, weight: .semibold))
                 }
@@ -36,6 +37,29 @@ struct ShotdeckApp: App {
     }
 }
 
+/// The menu-bar symbol for `state`, badged while an update is staged. Uses the
+/// SF Symbol's own `.badge` variant when one exists; falls back to a small
+/// overlaid dot on the plain symbol otherwise. The badge disappears on its own
+/// once `updateAvailable` clears, since this reads live model state.
+@ViewBuilder
+private func menuBarIcon(for state: MenuIconState, hasUpdate: Bool) -> some View {
+    if hasUpdate {
+        let badgeName = "\(state.symbolName).badge"
+        if NSImage(systemSymbolName: badgeName, accessibilityDescription: nil) != nil {
+            Image(systemName: badgeName)
+        } else {
+            ZStack(alignment: .topTrailing) {
+                Image(systemName: state.symbolName)
+                Circle()
+                    .frame(width: 6, height: 6)
+                    .offset(x: 3, y: -3)
+            }
+        }
+    } else {
+        Image(systemName: state.symbolName)
+    }
+}
+
 @MainActor
 final class AppDelegate: NSObject, NSApplicationDelegate {
     let model: AppModel
@@ -50,9 +74,18 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
         Task { await model.bootstrap() }
     }
 
-    private static func makeLaunchModel() -> AppModel {
+    /// Builds the model exactly the way the real app launches: paths come from
+    /// `TransportSettings.resolvedAppSupportPaths()` — transport-aware, so the watcher
+    /// this feeds is never seeded with a stale AirDrop folder while OneDrive is the
+    /// persisted transport (that was the BLOCKER this function used to have, when it
+    /// called the AirDrop-only `FolderSettings.resolvedAppSupportPaths()` instead).
+    /// `appSupportRoot` exists only so PickerSelfTest's relaunch-simulation sub-step can
+    /// point this at a temp directory instead of the real
+    /// ~/Library/Application Support/Shotdeck — production always calls this with no
+    /// argument (the real root). Internal, not private, for that same reason.
+    static func makeLaunchModel(appSupportRoot: URL? = nil) -> AppModel {
         do {
-            let paths = try FolderSettings.resolvedAppSupportPaths()
+            let paths = try TransportSettings.resolvedAppSupportPaths(root: appSupportRoot)
             return try makeModel(paths: paths)
         } catch {
             Log.ui.critical(

Sources/ShotdeckCore/Returns/ReturnWatcher.swift

@@ -17,6 +17,15 @@ public actor ReturnWatcher {
     /// A document that IS commented is always recorded, regardless of this flag.
     public var recordUncommented: Bool = true
 
+    /// The folder this watcher is CURRENTLY seeded to scan/watch — whatever `init`
+    /// last set it to, or `updateWatchFolder` since. Exposed so tests can observe the
+    /// watcher's seeded folder directly (e.g. right after construction, before
+    /// `start()`/`updateWatchFolder()` ever run) rather than only inferring it
+    /// indirectly through `scanNow()`'s behavior.
+    public var currentWatchFolder: URL {
+        watchFolder
+    }
+
     /// Watch folder is `paths.watchFolder`, which production constructs from
     /// `FolderSettings.resolve().watch`. This type never calls FolderSettings;
     /// `updateWatchFolder` is invoked by the UI layer only.

Sources/ShotdeckCore/Support/AppSupportPaths.swift

@@ -11,12 +11,6 @@ public struct AppSupportPaths: Sendable {
     /// Production paths.
     public static func standard() throws -> AppSupportPaths {
         let fileManager = FileManager.default
-        let appSupportParent = try fileManager.url(
-            for: .applicationSupportDirectory,
-            in: .userDomainMask,
-            appropriateFor: nil,
-            create: true
-        )
         let desktop = try fileManager.url(
             for: .desktopDirectory,
             in: .userDomainMask,
@@ -29,10 +23,25 @@ public struct AppSupportPaths: Sendable {
             appropriateFor: nil,
             create: true
         )
-        let root = appSupportParent.appendingPathComponent("Shotdeck", isDirectory: true)
+        let root = try standardRoot(fileManager: fileManager)
         return try AppSupportPaths(root: root, outbox: desktop, watchFolder: downloads)
     }
 
+    /// The standard `~/Library/Application Support/Shotdeck` root. Shared by
+    /// `standard()`, `FolderSettings.resolvedAppSupportPaths()`, and
+    /// `TransportSettings.resolvedAppSupportPaths()` so all three agree on where the
+    /// root lives — the folder-resolution logic (AirDrop-only vs transport-aware)
+    /// differs between those, the root computation never should.
+    public static func standardRoot(fileManager: FileManager = .default) throws -> URL {
+        let appSupportParent = try fileManager.url(
+            for: .applicationSupportDirectory,
+            in: .userDomainMask,
+            appropriateFor: nil,
+            create: true
+        )
+        return appSupportParent.appendingPathComponent("Shotdeck", isDirectory: true)
+    }
+
     /// Test paths rooted anywhere. Every directory is created if missing.
     public init(root: URL, outbox: URL, watchFolder: URL) throws {
         self.root = root

Sources/ShotdeckCore/Support/DubaiTime.swift

@@ -3,6 +3,7 @@ import Foundation
 public enum DubaiTime {
     private static let stampFormatter = LockedDateFormatter(dateFormat: "d MMM yyyy, HH:mm 'Dubai'")
     private static let fileStampFormatter = LockedDateFormatter(dateFormat: "yyyyMMdd-HHmmss")
+    private static let checkTimeFormatter = LockedDateFormatter(dateFormat: "HH:mm 'Dubai'")
 
     public static func stamp(_ date: Date) -> String {
         stampFormatter.string(from: date)
@@ -11,6 +12,10 @@ public enum DubaiTime {
     public static func fileStamp(_ date: Date) -> String {
         fileStampFormatter.string(from: date)
     }
+
+    public static func checkTime(_ date: Date) -> String {
+        checkTimeFormatter.string(from: date)
+    }
 }
 
 /// DateFormatter is not Sendable. This holder is the only shared mutable state

Sources/ShotdeckCore/Support/FolderSettings.swift

@@ -70,15 +70,7 @@ public enum FolderSettings {
         defaults: UserDefaults = .standard,
         fileManager: FileManager = .default
     ) throws -> AppSupportPaths {
-        let resolvedRoot: URL
+        let resolvedRoot = try root ?? AppSupportPaths.standardRoot(fileManager: fileManager)
-        if let root {
-            resolvedRoot = root
-        } else {
-            let appSupportParent = try fileManager.url(
-                for: .applicationSupportDirectory, in: .userDomainMask,
-                appropriateFor: nil, create: true)
-            resolvedRoot = appSupportParent.appendingPathComponent("Shotdeck", isDirectory: true)
-        }
         let folders = resolve(defaults: defaults, fileManager: fileManager)
         return try AppSupportPaths(root: resolvedRoot, outbox: folders.outbox, watchFolder: folders.watch)
     }

Sources/ShotdeckCore/Support/TransportSettings.swift

@@ -75,6 +75,25 @@ public enum TransportSettings {
             return (folders.outbox, folders.watch, transport)
         }
     }
+
+    /// Builds an `AppSupportPaths` using `root` (defaults to the standard
+    /// `~/Library/Application Support/Shotdeck` when nil) plus whatever
+    /// `effectiveFolders()` returns for outbox/watch. Unlike
+    /// `FolderSettings.resolvedAppSupportPaths()` (AirDrop-only), this is
+    /// transport-aware — it is the ONLY function launch code should use to build its
+    /// paths, so the watcher it feeds is never seeded with a stale AirDrop folder while
+    /// OneDrive is the persisted transport. `root` is exposed purely so tests (and the
+    /// ONEDRIVE-SELFTEST relaunch simulation) can point it at a temporary directory
+    /// instead of the user's real Application Support folder.
+    public static func resolvedAppSupportPaths(
+        root: URL? = nil,
+        defaults: UserDefaults = .standard,
+        fileManager: FileManager = .default
+    ) throws -> AppSupportPaths {
+        let resolvedRoot = try root ?? AppSupportPaths.standardRoot(fileManager: fileManager)
+        let folders = effectiveFolders(defaults: defaults, fileManager: fileManager)
+        return try AppSupportPaths(root: resolvedRoot, outbox: folders.outbox, watchFolder: folders.watch)
+    }
 }
 
 /// Pure path logic for locating a OneDrive sync root under
@@ -142,4 +161,61 @@ public enum OneDriveLocator {
         }
         return defaultRedlineFolder(home: home, fileManager: fileManager)
     }
+
+    /// True when `url` exists as a directory AND is writable by the current process.
+    /// The live check `send(anchor:)` performs before ever composing into a OneDrive
+    /// destination — a directory that exists but has had its permissions revoked (e.g.
+    /// `chmod 500`) must be treated as unavailable, not silently attempted and
+    /// surfaced as a generic PDF-composition failure.
+    public static func isWritableDirectory(
+        at url: URL,
+        fileManager: FileManager = .default
+    ) -> Bool {
+        var isDirectory: ObjCBool = false
+        let exists = fileManager.fileExists(atPath: url.path, isDirectory: &isDirectory)
+        guard exists, isDirectory.boolValue else { return false }
+        return fileManager.isWritableFile(atPath: url.path)
+    }
+
+    /// Writes a tiny probe file into `folder`, fsyncs it, then removes it — the only
+    /// reliable way to catch a OneDrive Files-On-Demand directory whose provider domain
+    /// is signed out: such a directory can report as existing and POSIX-writable
+    /// (`isWritableDirectory` returns true) while an actual write fails. True only when
+    /// the write, fsync, AND removal of the probe file all succeed; any failure at any
+    /// of those steps means false, so the caller treats the folder as unavailable
+    /// rather than proceeding to compose a real PDF into it.
+    public static func probeWritable(
+        at folder: URL,
+        fileManager: FileManager = .default
+    ) -> Bool {
+        let probeURL = folder.appendingPathComponent(".redline-probe-\(UUID().uuidString)")
+        // Belt-and-suspenders cleanup, unconditional: AtomicFile.write renames the temp
+        // file onto probeURL and THEN fsyncs the containing directory — if that last
+        // fsync throws, the probe file already exists on disk but the catch below
+        // returns false before ever reaching the explicit removeItem call. And if the
+        // explicit removeItem itself throws, this is the only retry it gets. Either
+        // way, never leave the probe file behind just because we're about to return.
+        defer {
+            if fileManager.fileExists(atPath: probeURL.path) {
+                try? fileManager.removeItem(at: probeURL)
+            }
+        }
+
+        do {
+            try AtomicFile.write(Data(), to: probeURL)
+        } catch {
+            return false
+        }
+
+        do {
+            try fileManager.removeItem(at: probeURL)
+        } catch {
+            return false
+        }
+
+        // Only true when the explicit removal above actually succeeded AND the file is
+        // confirmed gone — never trust a removeItem call that returned without throwing
+        // as proof of anything on a File Provider domain.
+        return !fileManager.fileExists(atPath: probeURL.path)
+    }
 }

Tests/ShotdeckCoreTests/ReturnWatcherTests.swift

@@ -231,8 +231,8 @@ func w27_fsEventsCallbackFiresOnRealArrival() async throws {
     }
 }
 
-@Test("recordUncommended defaults to true: an unmarked PDF is still recorded (AirDrop behaviour unchanged)")
+@Test("recordUncommented defaults to true: an unmarked PDF is still recorded (AirDrop behaviour unchanged)")
-func recordUncommendedDefaultTrueRecordsAnUnmarkedPDF() async throws {
+func recordUncommentedDefaultTrueRecordsAnUnmarkedPDF() async throws {
     let (paths, cleanup) = try makeCasePaths()
     defer { try? FileManager.default.removeItem(at: cleanup) }
 
@@ -250,8 +250,8 @@ func recordUncommendedDefaultTrueRecordsAnUnmarkedPDF() async throws {
     #expect(all.count == 1)
 }
 
-@Test("recordUncommended=false: an unmarked PDF is not recorded or returned; marking it up in place gets it recorded")
+@Test("recordUncommented=false: an unmarked PDF is not recorded or returned; marking it up in place gets it recorded")
-func recordUncommendedFalseSkipsUnmarkedThenRecordsAfterInPlaceMarkup() async throws {
+func recordUncommentedFalseSkipsUnmarkedThenRecordsAfterInPlaceMarkup() async throws {
     let (paths, cleanup) = try makeCasePaths()
     defer { try? FileManager.default.removeItem(at: cleanup) }
 
@@ -282,3 +282,110 @@ func recordUncommendedFalseSkipsUnmarkedThenRecordsAfterInPlaceMarkup() async th
     #expect(commented.count == 1)
     #expect(commented.first?.fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path)
 }
+
+// MARK: - Launch-paths BLOCKER regression (adversarial review, 20260905)
+//
+// The bug: AppDelegate.makeLaunchModel() built `paths` via the AirDrop-only
+// FolderSettings.resolvedAppSupportPaths(), so ReturnWatcher's internal watchFolder
+// (seeded from paths.watchFolder in its own init) was the AirDrop folder even when
+// OneDrive was the persisted transport, and bootstrap() never reconciled it before
+// starting. Net effect: PDFs went to OneDrive but FSEvents kept watching the stale
+// AirDrop folder for the whole session — marked-up returns were never detected.
+// The fix: launch paths now come from TransportSettings.resolvedAppSupportPaths()
+// (transport-aware), and AppModel.bootstrap() unconditionally reconciles the watcher's
+// folder via updateWatchFolder() before it starts. These two tests characterize the
+// bug (still reproducible via the old AirDrop-only construction) and prove the fix
+// (the real launch-construction path, end to end).
+
+@Test("Launch regression (fix): OneDrive persisted -> transport-aware launch paths -> bootstrap-style reconcile -> a marked PDF is detected")
+func launchStyleConstructionWithOneDriveTransportDetectsAMarkedReturn() async throws {
+    let suite = try makeTransportDefaultsSuite()
+    defer { tearDownTransportSuite(suite) }
+    let oneDriveFolder = try makeTransportTemporaryDirectory(prefix: "shotdeck-launch-onedrive")
+    defer { try? FileManager.default.removeItem(at: oneDriveFolder) }
+    let appSupportRoot = try makeTransportTemporaryDirectory(prefix: "shotdeck-launch-approot")
+    defer { try? FileManager.default.removeItem(at: appSupportRoot) }
+
+    TransportSettings.setTransport(.oneDrive, defaults: suite.defaults)
+    TransportSettings.setOneDriveFolder(oneDriveFolder, defaults: suite.defaults)
+
+    // Exactly what AppDelegate.makeLaunchModel() now does: build launch paths from the
+    // transport-aware resolver — the fix, NOT FolderSettings.resolvedAppSupportPaths(),
+    // which is AirDrop-only and is the root cause the next test characterizes.
+    let paths = try TransportSettings.resolvedAppSupportPaths(
+        root: appSupportRoot, defaults: suite.defaults, fileManager: .default
+    )
+    #expect(paths.outbox.path == oneDriveFolder.path)
+    #expect(paths.watchFolder.path == oneDriveFolder.path)
+
+    let ledger = try ReturnLedger(paths: paths)
+    let watcher = ReturnWatcher(paths: paths, ledger: ledger)
+
+    // What AppModel.bootstrap() now does, unconditionally, before watcher.start():
+    await watcher.setRecordUncommented(false)   // transport == .oneDrive
+    try await watcher.updateWatchFolder(paths.watchFolder)
+
+    let pdfURL = oneDriveFolder.appendingPathComponent("Redline-20260905-100000.pdf")
+    try makePDF(
+        at: pdfURL, pageCount: 1, creator: "Redline",
+        annotations: [(page: 0, annotation: makeAnnotation(
+            .ink, bounds: CGRect(x: 100, y: 100, width: 120, height: 50)
+        ))]
+    )
+
+    let found = try await watcher.scanNow()
+    #expect(found.contains(where: {
+        $0.fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path && $0.isCommented
+    }))
+
+    let commented = try await ledger.commented()
+    #expect(commented.contains(where: {
+        $0.fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path
+    }))
+}
+
+@Test("Launch regression (characterizes the bug): AirDrop-only launch paths with no reconcile miss an OneDrive-mode return")
+func airDropOnlyLaunchPathsWithoutReconcileMissesAMarkedOneDriveReturn() async throws {
+    let suite = try makeTransportDefaultsSuite()
+    defer { tearDownTransportSuite(suite) }
+    let oneDriveFolder = try makeTransportTemporaryDirectory(prefix: "shotdeck-buggy-onedrive")
+    defer { try? FileManager.default.removeItem(at: oneDriveFolder) }
+    // A configured AirDrop watch-folder override, isolated to a temp dir — NOT the real
+    // ~/Downloads, which may already hold real marked-up Redline PDFs from actual use
+    // and would make this test's "found.isEmpty" assertion depend on the state of
+    // Ben's real Downloads folder instead of the isolated fixture under test.
+    let staleAirDropFolder = try makeTransportTemporaryDirectory(prefix: "shotdeck-buggy-airdrop-stale")
+    defer { try? FileManager.default.removeItem(at: staleAirDropFolder) }
+    let appSupportRoot = try makeTransportTemporaryDirectory(prefix: "shotdeck-buggy-approot")
+    defer { try? FileManager.default.removeItem(at: appSupportRoot) }
+
+    TransportSettings.setTransport(.oneDrive, defaults: suite.defaults)
+    TransportSettings.setOneDriveFolder(oneDriveFolder, defaults: suite.defaults)
+    FolderSettings.setWatchFolder(staleAirDropFolder, defaults: suite.defaults)
+
+    // The BUG's exact construction: FolderSettings.resolvedAppSupportPaths() ignores
+    // the persisted transport entirely and always resolves the AirDrop folders.
+    let buggyPaths = try FolderSettings.resolvedAppSupportPaths(root: appSupportRoot, defaults: suite.defaults)
+    #expect(buggyPaths.watchFolder.path == staleAirDropFolder.path)
+    #expect(buggyPaths.watchFolder.path != oneDriveFolder.path)
+
+    let ledger = try ReturnLedger(paths: buggyPaths)
+    let watcher = ReturnWatcher(paths: buggyPaths, ledger: ledger)
+    // The old bootstrap(): recordUncommented was set, but there was NO
+    // updateWatchFolder() call before start() to reconcile the folder.
+    await watcher.setRecordUncommented(false)
+
+    let pdfURL = oneDriveFolder.appendingPathComponent("Redline-20260905-100100.pdf")
+    try makePDF(
+        at: pdfURL, pageCount: 1, creator: "Redline",
+        annotations: [(page: 0, annotation: makeAnnotation(
+            .ink, bounds: CGRect(x: 100, y: 100, width: 120, height: 50)
+        ))]
+    )
+
+    // The watcher is still pointed at the stale (configured-AirDrop) watch folder, so
+    // scanning it — NOT the OneDrive folder the PDF actually landed in — finds nothing.
+    // This is the exact BLOCKER the fix above closes.
+    let found = try await watcher.scanNow()
+    #expect(found.isEmpty)
+}

Tests/ShotdeckCoreTests/TransportSettingsTests.swift

@@ -90,6 +90,119 @@ func oneDriveFolderUnavailableErrorDescriptionContainsThePath() throws {
     #expect(description.contains(path))
 }
 
+@Test
+func isWritableDirectoryTrueForAnOrdinaryWritableDirectory() throws {
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-writable")
+    defer { try? FileManager.default.removeItem(at: dir) }
+    #expect(OneDriveLocator.isWritableDirectory(at: dir))
+}
+
+@Test
+func isWritableDirectoryFalseForAnExistingButUnwritableDirectory() throws {
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-unwritable")
+    defer {
+        // Restore perms BEFORE removal — an unwritable dir can't otherwise be cleaned up.
+        try? FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: dir.path)
+        try? FileManager.default.removeItem(at: dir)
+    }
+    #expect(OneDriveLocator.isWritableDirectory(at: dir))   // sanity check before chmod
+
+    try FileManager.default.setAttributes([.posixPermissions: 0o500], ofItemAtPath: dir.path)
+    #expect(!OneDriveLocator.isWritableDirectory(at: dir))
+}
+
+@Test
+func isWritableDirectoryFalseForAPlainFileAndForANonexistentPath() throws {
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-writable-check-parent")
+    defer { try? FileManager.default.removeItem(at: dir) }
+    let filePath = dir.appendingPathComponent("plain-file.txt")
+    FileManager.default.createFile(atPath: filePath.path, contents: Data("x".utf8))
+
+    #expect(!OneDriveLocator.isWritableDirectory(at: filePath))
+    #expect(!OneDriveLocator.isWritableDirectory(at: dir.appendingPathComponent("does-not-exist")))
+}
+
+@Test
+func probeWritableTrueForAnOrdinaryWritableDirectoryAndLeavesNoProbeFileBehind() throws {
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-probe-writable")
+    defer { try? FileManager.default.removeItem(at: dir) }
+
+    #expect(OneDriveLocator.probeWritable(at: dir))
+
+    let leftovers = try FileManager.default.contentsOfDirectory(atPath: dir.path)
+    #expect(leftovers.isEmpty)
+}
+
+@Test
+func probeWritableFalseForAChmod500Directory() throws {
+    // The File Provider edge case this probe exists for: isWritableDirectory can be
+    // true (as verified by the isWritableDirectory tests above) while an actual write
+    // still fails. A chmod 500 directory reproduces that "looks writable, isn't"
+    // shape closely enough to prove the probe itself does a real write, not just
+    // another permissions-bit check.
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-probe-unwritable")
+    defer {
+        try? FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: dir.path)
+        try? FileManager.default.removeItem(at: dir)
+    }
+    try FileManager.default.setAttributes([.posixPermissions: 0o500], ofItemAtPath: dir.path)
+
+    #expect(!OneDriveLocator.probeWritable(at: dir))
+}
+
+@Test
+func probeWritableFalseForAPlainFilePath() throws {
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-probe-file-parent")
+    defer { try? FileManager.default.removeItem(at: dir) }
+    let filePath = dir.appendingPathComponent("plain-file.txt")
+    FileManager.default.createFile(atPath: filePath.path, contents: Data("x".utf8))
+
+    #expect(!OneDriveLocator.probeWritable(at: filePath))
+}
+
+/// The write itself succeeds (a real probe file lands on disk via AtomicFile.write,
+/// which never touches this injected FileManager — it uses raw POSIX calls), but the
+/// FIRST call to `removeItem(at:)` throws, simulating a transient File Provider
+/// removal failure. probeWritable's own defer-based cleanup must retry and succeed
+/// (the second call through this same override falls through to `super`), so no
+/// probe file is left behind even though the function correctly still reports false
+/// (the removal it explicitly attempted did fail).
+private final class ThrowOnceOnRemoveFileManager: FileManager, @unchecked Sendable {
+    private let lock = NSLock()
+    private var hasThrown = false
+
+    override func removeItem(at URL: URL) throws {
+        lock.lock()
+        let shouldThrow = !hasThrown
+        hasThrown = true
+        lock.unlock()
+        if shouldThrow {
+            throw NSError(domain: "ShotdeckCoreTests.ThrowOnceOnRemove", code: 1)
+        }
+        try super.removeItem(at: URL)
+    }
+}
+
+@Test
+func probeWritableFalseAndLeavesNoProbeFileWhenRemoveItemThrowsOnce() throws {
+    // Directory fsync failure (the OTHER way probeWritable's cleanup can be needed) has
+    // no injectable seam: AtomicFile.write's directory fsync is a raw Darwin fsync(2)
+    // call on an already-open file descriptor, not parameterized by any FileManager or
+    // other dependency this test can substitute, and there is no portable way to make
+    // fsync(2) itself fail via chmod or other standard test techniques (fsync failures
+    // are OS/filesystem/hardware-level events). Covering the removeItem-throws path
+    // (below) is what this test does; the fsync-throws path is covered by code
+    // inspection only — the same `defer` block guards both.
+    let dir = try makeTransportTemporaryDirectory(prefix: "shotdeck-probe-remove-throws")
+    defer { try? FileManager.default.removeItem(at: dir) }
+    let injectedFileManager = ThrowOnceOnRemoveFileManager()
+
+    #expect(!OneDriveLocator.probeWritable(at: dir, fileManager: injectedFileManager))
+
+    let leftovers = try FileManager.default.contentsOfDirectory(atPath: dir.path)
+    #expect(leftovers.isEmpty)
+}
+
 struct TransportDefaultsSuite {
     let name: String
     let defaults: UserDefaults

Tests/ShotdeckTests/LaunchWiringTests.swift

@@ -0,0 +1,142 @@
+import AppKit
+import Foundation
+import PDFKit
+import Testing
+import ShotdeckCore
+@testable import Shotdeck
+
+/// Coverage gap closed (adversarial review, rounds 3 and 4): the Core-level regression
+/// tests in ShotdeckCoreTests hand-replicate what `AppDelegate.makeLaunchModel()` and
+/// `AppModel.bootstrap()` do, rather than calling them — so a future revert of
+/// `makeLaunchModel()` back to the AirDrop-only resolver, or a dropped
+/// `updateWatchFolder` call inside `bootstrap()`, would NOT fail `swift test`. This
+/// test goes through the real, unmodified call sites in the `Shotdeck` executable
+/// target via `@testable import`, which `ShotdeckCoreTests` cannot reach (it only
+/// depends on `ShotdeckCore`) — hence this separate `ShotdeckTests` target.
+///
+/// Round 4 correction: the first version of this test asserted only
+/// `model.watchFolderURL`, which `AppModel.init` computes independently via
+/// `TransportSettings.effectiveFolders()` — so it stayed correct (and the test kept
+/// passing) even when `makeLaunchModel()` was reverted to the AirDrop-only resolver,
+/// because `bootstrap()`'s own unconditional `updateWatchFolder` reconcile papered
+/// over the reverted resolver. That made the "verified this catches the blocker"
+/// claim in the previous round's commit message empirically false. This version
+/// asserts `model.paths`/the watcher's `currentWatchFolder` BEFORE `bootstrap()` runs,
+/// which actually depends on what `makeLaunchModel()` built — see this file's git
+/// history (or the round-4 commit message) for the verbatim before/after
+/// `swift test --filter` output proving it now discriminates correctly.
+@MainActor
+@Test("Real wiring: AppDelegate.makeLaunchModel() + AppModel.bootstrap() detect a marked OneDrive return")
+func realLaunchModelAndBootstrapDetectAMarkedOneDriveReturn() async throws {
+    let fm = FileManager.default
+
+    // UserDefaults.standard is the ONLY defaults instance makeLaunchModel()/bootstrap()
+    // actually read — there is no defaults-threading through AppModel/AppDelegate (the
+    // same reasoning documented in PickerSelfTest.swift's ONEDRIVE-SELFTEST phase).
+    // "Isolated" here means snapshot-and-restore around the real keys, not a separate
+    // UserDefaults(suiteName:) instance that these real, unmodified call sites would
+    // never actually consult.
+    let defaults = UserDefaults.standard
+    let previousTransport = defaults.string(forKey: TransportSettings.transportDefaultsKey)
+    let previousFolder = defaults.string(forKey: TransportSettings.oneDriveFolderDefaultsKey)
+    defer {
+        if let previousTransport {
+            defaults.set(previousTransport, forKey: TransportSettings.transportDefaultsKey)
+        } else {
+            defaults.removeObject(forKey: TransportSettings.transportDefaultsKey)
+        }
+        if let previousFolder {
+            defaults.set(previousFolder, forKey: TransportSettings.oneDriveFolderDefaultsKey)
+        } else {
+            defaults.removeObject(forKey: TransportSettings.oneDriveFolderDefaultsKey)
+        }
+    }
+
+    let oneDriveFolderRaw = fm.temporaryDirectory
+        .appendingPathComponent("shotdeck-real-wiring-onedrive-\(UUID().uuidString)", isDirectory: true)
+    try fm.createDirectory(at: oneDriveFolderRaw, withIntermediateDirectories: true)
+    defer { try? fm.removeItem(at: oneDriveFolderRaw) }
+    // FileManager's directory enumeration (inside the real ReturnWatcher/AppSupportPaths
+    // call sites this test exercises) can canonicalize /var -> /private/var for a path
+    // that actually exists; resolve here so every comparison below agrees.
+    let oneDriveFolder = oneDriveFolderRaw.resolvingSymlinksInPath()
+
+    let appSupportRoot = fm.temporaryDirectory
+        .appendingPathComponent("shotdeck-real-wiring-approot-\(UUID().uuidString)", isDirectory: true)
+    defer { try? fm.removeItem(at: appSupportRoot) }
+
+    TransportSettings.setTransport(.oneDrive, defaults: defaults)
+    TransportSettings.setOneDriveFolder(oneDriveFolder, defaults: defaults)
+
+    // Best-effort: keeps AppModel.bootstrap()'s real update-check schedule (a real
+    // HTTP GET after 10s, plus a RunLoop timer) from starting during this test.
+    // ProcessInfo.processInfo.environment on Darwin reads `environ` fresh each call,
+    // so a setenv() here is visible to bootstrap()'s own check immediately.
+    setenv("SHOTDECK_ONEDRIVE_SELFTEST", "1", 1)
+    defer { unsetenv("SHOTDECK_ONEDRIVE_SELFTEST") }
+
+    // The REAL, unmodified call sites — not a reimplementation. This is exactly what
+    // launching Redline with OneDrive as the persisted transport does.
+    let model = AppDelegate.makeLaunchModel(appSupportRoot: appSupportRoot)
+    // bootstrap() registers a REAL, process-wide Carbon global hotkey (capture combo,
+    // e.g. Option-Shift-2). Carbon registrations are not scoped to this test/model —
+    // they must be released before this test ends, or ShotdeckCoreTests'
+    // HotkeyCenterCarbonTests (a separate test target, same test process) can find the
+    // combo already taken / the global hotkey table in an unexpected state.
+    defer { model.hotkeys.unregisterAll() }
+
+    // PRE-bootstrap assertions — this is the actual proof of the launch RESOLVER
+    // (AppDelegate.makeLaunchModel() -> TransportSettings.resolvedAppSupportPaths()),
+    // independent of bootstrap()'s own reconcile. `model.watchFolderURL` alone does
+    // NOT prove this: AppModel.init computes it separately via
+    // TransportSettings.effectiveFolders(), so it would read as correct even if
+    // makeLaunchModel's `paths` were built by the AirDrop-only resolver — which is
+    // exactly how the first version of this test was empirically shown to be vacuous
+    // for the launch-resolver path (see this commit's message). `model.paths` is
+    // `internal` on AppModel, so @testable import already exposes it without any
+    // production API change; `currentWatchFolder` is the one new (internal-facing,
+    // `public` on the actor) seam added to ReturnWatcher for this purpose.
+    #expect(model.paths.watchFolder.path == oneDriveFolder.path)
+    #expect(model.paths.outbox.path == oneDriveFolder.path)
+    let seededWatchFolder = await model.watcher.currentWatchFolder
+    #expect(seededWatchFolder.path == oneDriveFolder.path)
+
+    #expect(model.transport == .oneDrive)
+    #expect(model.watchFolderURL.path == oneDriveFolder.path)
+
+    await model.bootstrap()
+
+    // Drop a marked-up Redline PDF into the folder in place — what OneDrive syncing
+    // down an already-marked copy after a relaunch looks like.
+    let pdfURL = oneDriveFolder.appendingPathComponent("Redline-realwiring-\(UUID().uuidString).pdf")
+    let document = PDFDocument()
+    let page = PDFPage()
+    page.setBounds(CGRect(x: 0, y: 0, width: 612, height: 792), for: .mediaBox)
+    document.insert(page, at: 0)
+    document.documentAttributes = [
+        PDFDocumentAttribute.creatorAttribute: "Redline",
+        PDFDocumentAttribute.subjectAttribute: UUID().uuidString,
+    ]
+    let ink = PDFAnnotation(
+        bounds: CGRect(x: 20, y: 20, width: 60, height: 60), forType: .ink, withProperties: nil
+    )
+    let stroke = NSBezierPath()
+    stroke.move(to: NSPoint(x: 20, y: 20))
+    stroke.line(to: NSPoint(x: 80, y: 80))
+    ink.add(stroke)
+    page.addAnnotation(ink)
+    let written = document.write(to: pdfURL)
+    #expect(written)
+    guard written else { return }
+
+    // .resolvingSymlinksInPath().path — not plain URL equality — matching how the rest
+    // of the suite compares a temp-dir-derived expected URL against a returned one.
+    let expectedPath = pdfURL.resolvingSymlinksInPath().path
+    let found = try await model.watcher.scanNow()
+    #expect(found.first(where: { $0.fileURL.resolvingSymlinksInPath().path == expectedPath })?.isCommented == true)
+
+    let commented = try await model.ledger.commented()
+    #expect(commented.contains(where: { $0.fileURL.resolvingSymlinksInPath().path == expectedPath }))
+
+    await model.watcher.stop()
+}

Tests/ShotdeckTests/UpdateCheckerTests.swift

@@ -0,0 +1,118 @@
+import Foundation
+import Testing
+@testable import Shotdeck
+@testable import ShotdeckCore
+
+@Test("DubaiTime.checkTime formats as HH:MM Dubai")
+func dubaiTimeCheckTimeFormat() {
+    let now = Date()
+    let result = DubaiTime.checkTime(now)
+
+    // Dubai timezone format: HH:MM Dubai
+    let pattern = "^[0-9]{2}:[0-9]{2} Dubai$"
+    let regex = try? NSRegularExpression(pattern: pattern, options: [])
+    let range = NSRange(result.startIndex..<result.endIndex, in: result)
+    let matches = regex?.matches(in: result, options: [], range: range) ?? []
+    #expect(!matches.isEmpty, "checkTime should format as HH:MM Dubai, got: \(result)")
+}
+
+@Test("Status message: up-to-date manual check includes Dubai timestamp")
+@MainActor
+func manualCheckUpToDateIncludesTimestamp() async {
+    let checker = UpdateChecker()
+
+    // Inject a stub appcast showing the current version (no update available)
+    let currentVersion = UpdateChecker.currentVersion()
+    let stubAppcast = """
+    {
+      "version": "\(currentVersion)",
+      "zipURL": "https://example.com/dummy.zip",
+      "sha256": "0000000000000000000000000000000000000000000000000000000000000000"
+    }
+    """
+    checker.testAppcastJSON = stubAppcast
+
+    // Capture the status message
+    var capturedStatus: String?
+    checker.onChecked = {
+        capturedStatus = checker.statusMessage
+    }
+
+    // Run the manual check
+    await checker.checkNow(manual: true)
+
+    // Verify the message matches the expected format and includes a timestamp
+    guard let status = capturedStatus else {
+        #expect(false, "statusMessage should not be nil for manual check finding no update")
+        return
+    }
+
+    // Message should be "Redline X.Y.Z is up to date, checked HH:MM Dubai"
+    let pattern = "^Redline [0-9]+\\.[0-9]+\\.[0-9]+ is up to date, checked [0-9]{2}:[0-9]{2} Dubai$"
+    let regex = try? NSRegularExpression(pattern: pattern, options: [])
+    let range = NSRange(status.startIndex..<status.endIndex, in: status)
+    let matches = regex?.matches(in: status, options: [], range: range) ?? []
+    #expect(!matches.isEmpty, "Manual check up-to-date message should match format, got: \(status)")
+}
+
+@Test("Status message: automatic check doesn't set message when up-to-date")
+@MainActor
+func automaticCheckUpToDateLeavesMessageNil() async {
+    let checker = UpdateChecker()
+
+    // Inject a stub appcast showing the current version (no update available)
+    let currentVersion = UpdateChecker.currentVersion()
+    let stubAppcast = """
+    {
+      "version": "\(currentVersion)",
+      "zipURL": "https://example.com/dummy.zip",
+      "sha256": "0000000000000000000000000000000000000000000000000000000000000000"
+    }
+    """
+    checker.testAppcastJSON = stubAppcast
+
+    // Capture the status message
+    var capturedStatus: String?
+    checker.onChecked = {
+        capturedStatus = checker.statusMessage
+    }
+
+    // Run an AUTOMATIC check (manual: false)
+    await checker.checkNow(manual: false)
+
+    // For automatic checks finding no update, statusMessage should be nil
+    #expect(capturedStatus == nil,
+            "Automatic check finding no update should leave statusMessage nil, got: \(capturedStatus ?? "(nil)")")
+}
+
+@Test("Update status and general status are independent channels")
+@MainActor
+func statusChannelsAreIndependent() async throws {
+    let fm = FileManager.default
+    let appSupportRoot = fm.temporaryDirectory
+        .appendingPathComponent("update-checker-channel-test-\(UUID().uuidString)", isDirectory: true)
+    defer { try? fm.removeItem(at: appSupportRoot) }
+
+    // Create a real AppModel using the standard launch pattern
+    let model = AppDelegate.makeLaunchModel(appSupportRoot: appSupportRoot)
+    defer { model.hotkeys.unregisterAll() }
+
+    // Test 1: Setting statusLine should NOT affect updateStatusMessage
+    model.setStatus("General status: captured 3")
+    #expect(model.statusLine == "General status: captured 3", "statusLine should be set")
+    #expect(model.updateStatusMessage == nil, "updateStatusMessage should remain nil")
+
+    // Test 2: Setting updateStatus should NOT affect statusLine
+    model.setUpdateStatus("Update to 9.9.9 is ready")
+    #expect(model.statusLine == "General status: captured 3", "statusLine should remain unchanged")
+    #expect(model.updateStatusMessage == "Update to 9.9.9 is ready", "updateStatusMessage should be set")
+
+    // Test 3: Clearing statusLine leaves updateStatus intact
+    model.setStatus(nil)
+    #expect(model.statusLine == nil, "statusLine should be cleared")
+    #expect(model.updateStatusMessage == "Update to 9.9.9 is ready", "updateStatusMessage should persist")
+
+    // Test 4: Clearing updateStatus leaves other state unaffected
+    model.setUpdateStatus(nil)
+    #expect(model.updateStatusMessage == nil, "updateStatusMessage should be cleared")
+}

scripts/publish-update.sh

@@ -13,7 +13,10 @@ PLISTBUDDY="/usr/libexec/PlistBuddy"
 REMOTE_HOST="mmd01"
 REMOTE_BASE="/opt/mmd-installer-content/cowork/redline"
 PUBLIC_BASE="https://get.baobab-ts.com/cowork/redline"
-SIGN_IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
+BUNDLE_ID="ai.flowmaster.shotdeck"
+# Used both as the fallback signing identity and as what build-app.sh itself
+# still hardcodes for its own (pre-final) signing pass.
+FALLBACK_SIGN_IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
 
 usage() {
     echo "Usage: $0 <version> [\"notes\"]" >&2
@@ -72,6 +75,7 @@ else
     PUBLIC_DIR="${PUBLIC_BASE}"
 fi
 
+APP_BUNDLE="${ROOT}/.build/Redline.app"
 ZIP_NAME="Redline-${VERSION}.zip"
 DMG_NAME="Redline-${VERSION}.dmg"
 ZIP_PATH="${ROOT}/.build/${ZIP_NAME}"
@@ -139,6 +143,38 @@ else
     echo "==> --test: skipping git commit of version bump"
 fi
 
+# --- Resolve the signing identity for the shipped artifacts -----------------
+# REDLINE_KEYCHAIN (optional): a specific keychain to search/sign against,
+# for hosts where the Developer ID identity does not live in the login
+# keychain that codesign searches by default.
+FIND_IDENTITY_ARGS=(-v -p codesigning)
+CODESIGN_KEYCHAIN_ARGS=()
+if [[ -n "${REDLINE_KEYCHAIN:-}" ]]; then
+    FIND_IDENTITY_ARGS+=("${REDLINE_KEYCHAIN}")
+    CODESIGN_KEYCHAIN_ARGS=(--keychain "${REDLINE_KEYCHAIN}")
+fi
+
+if [[ -n "${REDLINE_SIGN_IDENTITY:-}" ]]; then
+    SIGN_IDENTITY="${REDLINE_SIGN_IDENTITY}"
+    echo "==> Signing identity: ${SIGN_IDENTITY} (REDLINE_SIGN_IDENTITY)"
+else
+    DEVELOPER_ID_LINE="$(security find-identity "${FIND_IDENTITY_ARGS[@]}" 2>/dev/null \
+        | grep -o '"Developer ID Application:[^"]*"' | head -n1 || true)"
+    DEVELOPER_ID="${DEVELOPER_ID_LINE//\"/}"
+    if [[ -n "${DEVELOPER_ID}" ]]; then
+        SIGN_IDENTITY="${DEVELOPER_ID}"
+        echo "==> Signing identity: ${SIGN_IDENTITY} (auto-detected Developer ID Application)"
+    else
+        SIGN_IDENTITY="${FALLBACK_SIGN_IDENTITY}"
+        echo
+        echo "************************************************************************"
+        echo "WARNING: signing with Apple Development identity — not Developer ID;"
+        echo "Gatekeeper will block first install on other Macs."
+        echo "************************************************************************"
+        echo
+    fi
+fi
+
 # Restricted HOMEs (agent sandboxes) hide the login keychain from codesign.
 # Re-run signed steps with the account's real home when the identity is missing.
 signing_home() {
@@ -167,31 +203,85 @@ run_signed() {
 echo "==> Building signed Redline.app"
 run_signed ./scripts/build-app.sh
 
-if [[ ! -d "${ROOT}/.build/Redline.app" ]]; then
+if [[ ! -d "${APP_BUNDLE}" ]]; then
-    echo "Signed app missing at ${ROOT}/.build/Redline.app" >&2
+    echo "Signed app missing at ${APP_BUNDLE}" >&2
     exit 1
 fi
 
-echo "==> Zipping Redline.app -> ${ZIP_PATH}"
+# build-app.sh always signs with its own hardcoded Apple Development identity
-mkdir -p "${ROOT}/.build"
+# first (it has to — that identifier+identity pair is what keeps the Screen
-(
+# Recording grant alive). Re-sign here with the identity actually resolved
+# above, which is what ships. A no-op when the two happen to be the same.
+echo "==> Signing ${APP_BUNDLE} with resolved identity"
+run_signed codesign --force --options runtime --timestamp \
+    ${CODESIGN_KEYCHAIN_ARGS[@]+"${CODESIGN_KEYCHAIN_ARGS[@]}"} \
+    --sign "${SIGN_IDENTITY}" \
+    --identifier "${BUNDLE_ID}" \
+    "${APP_BUNDLE}"
+
+build_zip() {
+    mkdir -p "${ROOT}/.build"
+    (
         cd "${ROOT}/.build"
         rm -f "${ZIP_NAME}"
         ditto -c -k --keepParent Redline.app "${ZIP_NAME}"
-)
+    )
-
+    if [[ ! -s "${ZIP_PATH}" ]]; then
-if [[ ! -s "${ZIP_PATH}" ]]; then
         echo "Zip was not created at ${ZIP_PATH}" >&2
         exit 1
-fi
+    fi
+}
 
-echo "==> Building manual installer DMG"
+# Rebuilds the manual-installer DMG from whatever is currently at
-run_signed ./scripts/make-dmg.sh
+# ${APP_BUNDLE} — never re-invokes build-app.sh, so a prior custom signature
+# or notarization staple on ${APP_BUNDLE} survives into the DMG untouched.
+build_dmg() {
+    local staging="${ROOT}/.build/dmg-staging"
+    local mount_point="${ROOT}/.build/dmg-mnt"
 
-if [[ ! -s "${DMG_PATH}" ]]; then
+    rm -rf "${staging}"
+    mkdir -p "${staging}"
+    ditto "${APP_BUNDLE}" "${staging}/Redline.app"
+    ln -s /Applications "${staging}/Applications"
+
+    mkdir -p "$(dirname "${DMG_PATH}")"
+    rm -f "${DMG_PATH}"
+    hdiutil create -volname "Redline" -srcfolder "${staging}" -ov -format UDZO "${DMG_PATH}"
+
+    if [[ -d "${mount_point}" ]] && /sbin/mount | grep -F -q "${mount_point}"; then
+        hdiutil detach "${mount_point}" || hdiutil detach "${mount_point}" -force
+    fi
+    rm -rf "${mount_point}"
+    mkdir -p "${mount_point}"
+
+    hdiutil attach "${DMG_PATH}" -nobrowse -readonly -mountpoint "${mount_point}"
+
+    local ok=1
+    if [[ ! -d "${mount_point}/Redline.app" ]]; then
+        echo "Verification failed: Redline.app missing from mounted DMG" >&2
+        ok=0
+    fi
+    if [[ "${ok}" -eq 1 && "$(readlink "${mount_point}/Applications" 2>/dev/null || true)" != "/Applications" ]]; then
+        echo "Verification failed: Applications does not point at /Applications" >&2
+        ok=0
+    fi
+    if [[ "${ok}" -eq 1 ]] && ! codesign --verify --deep --verbose=2 "${mount_point}/Redline.app"; then
+        ok=0
+    fi
+
+    hdiutil detach "${mount_point}" || hdiutil detach "${mount_point}" -force || true
+
+    if [[ "${ok}" -ne 1 ]]; then
+        exit 1
+    fi
+    if [[ ! -s "${DMG_PATH}" ]]; then
         echo "DMG was not created at ${DMG_PATH}" >&2
         exit 1
-fi
+    fi
+}
+
+echo "==> Zipping Redline.app -> ${ZIP_PATH}"
+build_zip
 
 SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
 ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
@@ -200,18 +290,102 @@ PUBDATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
 echo "==> Zip SHA256: ${SHA256}"
 echo "    Zip bytes:  ${ZIP_BYTES}"
 
+# --- Notarization (optional) -------------------------------------------------
+# Either REDLINE_NOTARY_PROFILE (a `notarytool store-credentials` keychain
+# profile) or all three of REDLINE_NOTARY_KEY_ID / REDLINE_NOTARY_ISSUER /
+# REDLINE_NOTARY_KEY_PATH (App Store Connect API key). Absent both: skip.
+NOTARIZED=0
+NOTARY_CONFIGURED=0
+if [[ -n "${REDLINE_NOTARY_PROFILE:-}" ]]; then
+    NOTARY_CONFIGURED=1
+elif [[ -n "${REDLINE_NOTARY_KEY_ID:-}" && -n "${REDLINE_NOTARY_ISSUER:-}" && -n "${REDLINE_NOTARY_KEY_PATH:-}" ]]; then
+    NOTARY_CONFIGURED=1
+fi
+
+if [[ "${NOTARY_CONFIGURED}" -eq 1 ]]; then
+    echo "==> Submitting ${ZIP_PATH} to notarytool"
+    NOTARY_ARGS=(xcrun notarytool submit "${ZIP_PATH}" --wait --timeout 30m)
+    if [[ -n "${REDLINE_NOTARY_PROFILE:-}" ]]; then
+        NOTARY_ARGS+=(--keychain-profile "${REDLINE_NOTARY_PROFILE}")
+    else
+        NOTARY_ARGS+=(
+            --key "${REDLINE_NOTARY_KEY_PATH}"
+            --key-id "${REDLINE_NOTARY_KEY_ID}"
+            --issuer "${REDLINE_NOTARY_ISSUER}"
+        )
+    fi
+
+    set +e
+    NOTARY_OUTPUT="$("${NOTARY_ARGS[@]}" 2>&1)"
+    NOTARY_STATUS=$?
+    set -e
+    echo "${NOTARY_OUTPUT}"
+    if [[ "${NOTARY_STATUS}" -ne 0 ]]; then
+        echo "notarytool submit failed (exit ${NOTARY_STATUS})." >&2
+        exit 1
+    fi
+    if ! grep -qi 'status: *Accepted' <<<"${NOTARY_OUTPUT}"; then
+        echo "notarytool did not report Accepted." >&2
+        exit 1
+    fi
+    NOTARIZED=1
+
+    echo "==> Stapling ${APP_BUNDLE}"
+    xcrun stapler staple "${APP_BUNDLE}"
+
+    echo "==> Rebuilding zip from the stapled app"
+    build_zip
+    SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
+    ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
+    echo "    Zip SHA256: ${SHA256}"
+    echo "    Zip bytes:  ${ZIP_BYTES}"
+
+    echo "==> Rebuilding DMG from the stapled app"
+    build_dmg
+
+    echo "==> Stapling ${DMG_PATH}"
+    xcrun stapler staple "${DMG_PATH}"
+else
+    echo "==> REDLINE_NOTARY_KEY_ID/ISSUER/KEY_PATH (or REDLINE_NOTARY_PROFILE) not set"
+    echo "NOT NOTARIZED"
+    echo "==> Building manual installer DMG"
+    build_dmg
+fi
+
+echo "==> Gatekeeper check: spctl -a -vv -t exec ${APP_BUNDLE}"
+set +e
+SPCTL_OUTPUT="$(spctl -a -vv -t exec "${APP_BUNDLE}" 2>&1)"
+SPCTL_STATUS=$?
+set -e
+echo "${SPCTL_OUTPUT}"
+if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then
+    if [[ "${NOTARIZED}" -eq 1 ]]; then
+        echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2
+        exit 1
+    fi
+    echo "WARNING: Gatekeeper does not accept this build (not notarized). First install on other Macs needs right-click > Open." >&2
+fi
+
+TEAM_IDENTIFIER="$(codesign -dv "${APP_BUNDLE}" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2}')"
+if [[ -z "${TEAM_IDENTIFIER}" ]]; then
+    echo "No TeamIdentifier on ${APP_BUNDLE} — the build is not signed with a team identity; refusing to publish." >&2
+    exit 1
+fi
+
 echo "==> Writing ${APPCAST_PATH}"
-python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" <<'PY'
+python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" "${NOTARIZED}" "${TEAM_IDENTIFIER}" <<'PY'
 import json
 import sys
 
-version, zip_url, sha256, notes, pub_date, out_path = sys.argv[1:]
+version, zip_url, sha256, notes, pub_date, out_path, notarized, team_identifier = sys.argv[1:]
 payload = {
     "version": version,
     "zipURL": zip_url,
     "sha256": sha256,
     "notes": notes,
     "pubDate": pub_date,
+    "notarized": notarized == "1",
+    "teamIdentifier": team_identifier,
 }
 with open(out_path, "w", encoding="utf-8") as fh:
     json.dump(payload, fh, indent=2)
@@ -280,6 +454,14 @@ fi
 
 echo
 echo "Published v${VERSION}"
+echo "  identity:  ${SIGN_IDENTITY}"
+if [[ "${NOTARIZED}" -eq 1 ]]; then
+    echo "  notarized: yes"
+else
+    echo "  notarized: no"
+fi
+echo "  spctl:     ${SPCTL_OUTPUT}"
+echo "  team:      ${TEAM_IDENTIFIER}"
 echo "  appcast:   ${APPCAST_URL}"
 echo "  zip:       ${ZIP_URL}"
 echo "  sha256:    ${SHA256}"