release: v0.3.0

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Info.plist

@@ -2,28 +2,24 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<!-- Identity invariants: CFBundleIdentifier stays ai.flowmaster.shotdeck and
+	<key>CFBundleExecutable</key>
-	     CFBundleExecutable stays Shotdeck. Changing either one invalidates the
+	<string>Shotdeck</string>
-	     user's existing Screen Recording grant. CFBundleName is the user-facing
+	<key>CFBundleIconFile</key>
-	     product name only. -->
+	<string>AppIcon</string>
 	<key>CFBundleIdentifier</key>
 	<string>ai.flowmaster.shotdeck</string>
 	<key>CFBundleName</key>
 	<string>Redline</string>
-	<key>CFBundleExecutable</key>
-	<string>Shotdeck</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>0.2.0</string>
+	<string>0.3.0</string>
 	<key>CFBundleVersion</key>
-	<string>1</string>
+	<string>3</string>
-	<key>CFBundleIconFile</key>
-	<string>AppIcon</string>
-	<key>LSUIElement</key>
-	<true/>
 	<key>LSMinimumSystemVersion</key>
 	<string>14.0</string>
+	<key>LSUIElement</key>
+	<true/>
 	<key>NSHumanReadableCopyright</key>
 	<string>Copyright © 2026 Flowmaster FZC LLC. All rights reserved.</string>
 </dict>

Sources/Shotdeck/AppModel.swift

@@ -36,11 +36,15 @@ public final class AppModel {
     public private(set) var outboxURL: URL
     /// Live watch folder; WP-4c updates this alongside `ReturnWatcher.updateWatchFolder`.
     public private(set) var watchFolderURL: URL
+    /// Absolute URL of the PDF composed this run, if any. Used by "Reveal last PDF".
+    public private(set) var lastComposedPDFURL: URL?
     /// Currently bound capture combo (the last one Carbon accepted, or the preferred load).
     private(set) var captureHotkey: HotkeyPreference
     var hotkeyDisplayString: String { captureHotkey.displayString }
     /// Staged update offered in the menu. Set only after checksum + payload validation.
     public private(set) var updateAvailable: (version: String, notes: String)?
+    /// True for the duration of any appcast check (manual or scheduled).
+    public private(set) var isCheckingForUpdates: Bool = false
 
     let paths: AppSupportPaths
     let spool: SpoolStore
@@ -94,7 +98,18 @@ public final class AppModel {
                 self.setStatus(message)
             }
         }
+        self.updateChecker.onCheckingChanged = { [weak self] checking in
+            self?.isCheckingForUpdates = checking
         }
+    }
+
+    /// CFBundleShortVersionString of the running app.
+    public var appVersion: String { UpdateChecker.currentVersion() }
+    /// Version recorded in the app-managed rollback copy, when one exists.
+    public var previousVersion: String? { updateChecker.previousVersion() }
+    /// Most recent status text — shared with the general status line by design
+    /// (Redline has one status channel, not a separate update-only one).
+    public var updateStatusMessage: String? { statusLine }
 
     // MARK: Seam mutators — the only way a WP-4b/4c extension changes state.
 
@@ -116,6 +131,42 @@ public final class AppModel {
         watchFolderURL = watch
         setFolderDisplayNames(outbox: outbox.lastPathComponent, watch: watch.lastPathComponent)
     }
+    func rememberLastComposedPDF(_ url: URL) { lastComposedPDFURL = url }
+
+    /// True when a last-composed PDF path is known this run, or the newest
+    /// `Redline-*.pdf` in the outbox exists on disk.
+    var canRevealLastPDF: Bool { revealablePDFURL() != nil }
+
+    public func revealLastPDF() {
+        guard let url = revealablePDFURL() else { return }
+        NSWorkspace.shared.activateFileViewerSelecting([url])
+    }
+
+    func revealablePDFURL() -> URL? {
+        if let last = lastComposedPDFURL, FileManager.default.fileExists(atPath: last.path) {
+            return last
+        }
+        return newestOutboxRedlinePDF()
+    }
+
+    func newestOutboxRedlinePDF() -> URL? {
+        let fm = FileManager.default
+        let items = (try? fm.contentsOfDirectory(
+            at: outboxURL,
+            includingPropertiesForKeys: [.contentModificationDateKey],
+            options: [.skipsHiddenFiles]
+        )) ?? []
+        let matches = items.filter {
+            $0.lastPathComponent.hasPrefix("Redline-") && $0.pathExtension.lowercased() == "pdf"
+        }
+        return matches.max { a, b in
+            let da = (try? a.resourceValues(forKeys: [.contentModificationDateKey])
+                .contentModificationDate) ?? .distantPast
+            let db = (try? b.resourceValues(forKeys: [.contentModificationDateKey])
+                .contentModificationDate) ?? .distantPast
+            return da < db
+        }
+    }
 
     public var iconState: MenuIconState {
         if !screenRecordingGranted { return .recordingMissing }
@@ -181,6 +232,19 @@ public final class AppModel {
         updateChecker.installStaged()
     }
 
+    /// User-initiated appcast check ("Check for updates" menu row).
+    public func checkForUpdates() {
+        Task { @MainActor in
+            await updateChecker.checkNow(manual: true)
+        }
+    }
+
+    /// Reverts `/Applications/Redline.app` to the app-managed rollback copy and relaunches.
+    /// Does nothing unless a `Redline.app.previous` exists and the user clicked the row.
+    public func revertToPreviousVersion() {
+        updateChecker.revertToPrevious()
+    }
+
     /// Unregisters `capture` and binds `HotkeyPreference.load()`. If Carbon rejects the new
     /// combo, restores the previous preference (UserDefaults + Carbon) so the old one keeps working.
     func reRegisterHotkey() {

Sources/Shotdeck/MenuBarView.swift

@@ -15,6 +15,8 @@ struct MenuBarView: View {
                 Divider()
                 returnsBlock
             }
+            Divider()
+            updateFooter
         }
         .padding(10)
         .frame(width: 320, alignment: .leading)
@@ -83,6 +85,21 @@ struct MenuBarView: View {
                 }
             }
 
+            Button {
+                model.checkForUpdates()
+            } label: {
+                actionLabel(model.isCheckingForUpdates ? "Checking…" : "Check for updates")
+            }
+            .disabled(model.isCheckingForUpdates)
+
+            if let previous = model.previousVersion {
+                Button {
+                    model.revertToPreviousVersion()
+                } label: {
+                    actionLabel("Revert to \(previous)")
+                }
+            }
+
             Button {
                 let anchor = NSApp.keyWindow?.contentView
                 if let sender = model as? SendCapable {
@@ -95,6 +112,13 @@ struct MenuBarView: View {
             }
             .disabled(model.session.isEmpty || model.isSending)
 
+            Button {
+                model.revealLastPDF()
+            } label: {
+                actionLabel("Reveal last PDF")
+            }
+            .disabled(!model.canRevealLastPDF)
+
             Button {
                 Task { await model.captureNow() }
             } label: {
@@ -186,4 +210,18 @@ struct MenuBarView: View {
     private var newestReturns: [ReturnedDocument] {
         model.allReturns.sorted { $0.detectedAt > $1.detectedAt }
     }
+
+    private var updateFooter: some View {
+        VStack(alignment: .leading, spacing: 2) {
+            Text("Redline \(model.appVersion)")
+                .font(.caption)
+                .foregroundStyle(.secondary)
+            if let message = model.updateStatusMessage {
+                Text(message)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+        }
+    }
 }

Sources/Shotdeck/PickerSelfTest.swift

@@ -1,6 +1,8 @@
 import AppKit
+import CoreGraphics
 import Darwin
 import Foundation
+import ImageIO
 import ShotdeckCore
 
 /// In-process self-test for the region picker, driven by `SHOTDECK_PICKER_SELFTEST`.
@@ -113,10 +115,10 @@ enum PickerSelfTest {
         fflush(stdout)
 
         runRegionPersistPhase()
-        if !startUpdateSelfTestIfRequested() {
+        // Hop off this MainActor job so the SEND-TRUTH Task can run; do not
-            exit(0)
+        // exit(0) here — runSendTruthPhase prints its own PASS/FAIL, then
-        }
+        // chains to UPDATE-SELFTEST (or exits if that phase is not requested).
-        // UPDATE-SELFTEST hops to a later main-actor turn and exits itself.
+        runSendTruthPhase()
     }
 
     /// Phase 2: writes a known region under `CaptureRegion.defaultsKey`, reloads it through
@@ -160,7 +162,145 @@ enum PickerSelfTest {
         fflush(stdout)
     }
 
-    /// Phase 3: builds a fake 99.0.0 bundle, serves a local appcast, stages via
+    /// Phase 3: drive SendController's share-outcome seams with no AirDrop sheet.
+    /// Fail path must leave the session open in the temp spool; success path archives
+    /// and mints a fresh empty session. Scheduled as a new MainActor job because this
+    /// function is called from inside `execute()` — a nested run-loop wait would never
+    /// let the Task start. On success, chains to UPDATE-SELFTEST instead of exiting.
+    private static func runSendTruthPhase() {
+        Task { @MainActor in
+            do {
+                try await executeSendTruth()
+                print("SEND-TRUTH PASS")
+                fflush(stdout)
+                if !startUpdateSelfTestIfRequested() {
+                    exit(0)
+                }
+            } catch {
+                print("SEND-TRUTH FAIL \(error)")
+                fflush(stdout)
+                exit(1)
+            }
+        }
+    }
+
+    private static func executeSendTruth() async throws {
+        let fm = FileManager.default
+        let root = fm.temporaryDirectory
+            .appendingPathComponent("shotdeck-send-truth-\(UUID().uuidString)", isDirectory: true)
+        defer { try? fm.removeItem(at: root) }
+
+        let paths = try AppSupportPaths(
+            root: root,
+            outbox: root.appendingPathComponent("outbox", isDirectory: true),
+            watchFolder: root.appendingPathComponent("watch", isDirectory: true)
+        )
+        let ledger = try ReturnLedger(paths: paths)
+        let model = AppModel(
+            paths: paths,
+            spool: try SpoolStore(paths: paths),
+            composer: PDFComposer(),
+            capturer: ScreenCapturer(),
+            hotkeys: HotkeyCenter(),
+            picker: RegionPickerController(),
+            ledger: ledger,
+            watcher: ReturnWatcher(paths: paths, ledger: ledger)
+        )
+        model.setFolderURLs(outbox: paths.outbox, watch: paths.watchFolder)
+
+        let png = try makeTinyPNGData()
+        _ = try await model.spool.append(
+            pngData: png,
+            pixelWidth: 64,
+            pixelHeight: 48,
+            scale: 1,
+            capturedAt: Date()
+        )
+        model.replaceSession(try await model.spool.currentSession())
+        let openID = model.session.id
+        guard !model.session.isEmpty else {
+            sendTruthFail("seeded session was empty")
+        }
+
+        let pending = try await model.composePDFForSend()
+        guard fm.fileExists(atPath: pending.fileURL.path) else {
+            sendTruthFail("PDF was not written")
+        }
+
+        model.handleDidFailToShareItems(fileName: pending.fileName)
+        let still = try await model.spool.currentSession()
+        guard still.id == openID, !still.isEmpty, still.state == .open else {
+            sendTruthFail("fail path archived or replaced the session")
+        }
+        let spoolDir = paths.sessionDirectory(openID)
+        guard fm.fileExists(atPath: spoolDir.path) else {
+            sendTruthFail("fail path: session missing from temp spool")
+        }
+        guard let status = model.statusLine, status.contains("nothing was sent") else {
+            sendTruthFail("fail path status missing 'nothing was sent': \(model.statusLine ?? "nil")")
+        }
+
+        await model.handleDidShareItems(fileName: pending.fileName, pageCount: pending.pageCount)
+        let fresh = try await model.spool.currentSession()
+        guard fresh.isEmpty, fresh.id != openID, fresh.state == .open else {
+            sendTruthFail("success path did not mint a fresh empty session")
+        }
+        let archived = try await model.spool.archivedSessions()
+        guard archived.contains(where: { $0.id == openID && $0.state == .archived }) else {
+            sendTruthFail("success path did not archive the session")
+        }
+        let archiveDir = paths.archiveDirectory(openID)
+        guard fm.fileExists(atPath: archiveDir.path) else {
+            sendTruthFail("success path: archive dir missing")
+        }
+        guard !fm.fileExists(atPath: spoolDir.path) else {
+            sendTruthFail("success path: session still in spool")
+        }
+    }
+
+    private static func makeTinyPNGData() throws -> Data {
+        let width = 64
+        let height = 48
+        let colorSpace = CGColorSpaceCreateDeviceRGB()
+        guard let context = CGContext(
+            data: nil,
+            width: width,
+            height: height,
+            bitsPerComponent: 8,
+            bytesPerRow: width * 4,
+            space: colorSpace,
+            bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
+        ) else {
+            sendTruthFail("could not create PNG context")
+        }
+        context.setFillColor(red: 0.2, green: 0.4, blue: 0.8, alpha: 1)
+        context.fill(CGRect(x: 0, y: 0, width: width, height: height))
+        guard let image = context.makeImage() else {
+            sendTruthFail("could not make CGImage")
+        }
+        let buffer = NSMutableData()
+        guard let destination = CGImageDestinationCreateWithData(
+            buffer,
+            "public.png" as CFString,
+            1,
+            nil
+        ) else {
+            sendTruthFail("could not create PNG destination")
+        }
+        CGImageDestinationAddImage(destination, image, nil)
+        guard CGImageDestinationFinalize(destination) else {
+            sendTruthFail("could not finalize PNG")
+        }
+        return buffer as Data
+    }
+
+    private static func sendTruthFail(_ reason: String) -> Never {
+        print("SEND-TRUTH FAIL \(reason)")
+        fflush(stdout)
+        exit(1)
+    }
+
+    /// Phase 4: builds a fake 99.0.0 bundle, serves a local appcast, stages via
     /// `checkNow`, then `installStaged` into the env dir — never `/Applications`.
     /// Returns true when the async phase was scheduled (it calls `exit` itself).
     @discardableResult
@@ -185,6 +325,9 @@ enum PickerSelfTest {
         return true
     }
 
+    /// (a) rejects an invalidly-signed payload, (b) stages the same payload once
+    /// properly signed, (c) installs it atomically into a throwaway target with
+    /// exactly one rollback copy, (d) reverts back. Never touches `/Applications`.
     private static func runUpdateSelfTest(outputDirectory: URL) async throws {
         let fm = FileManager.default
         try fm.createDirectory(at: outputDirectory, withIntermediateDirectories: true)
@@ -192,6 +335,9 @@ enum PickerSelfTest {
         guard let sourceApp = ownAppBundleURL() else {
             throw UpdateSelfTestError.detail("own bundle is not a .app (\(Bundle.main.bundleURL.path))")
         }
+        guard let originalVersion = readShortVersion(atAppURL: sourceApp) else {
+            throw UpdateSelfTestError.detail("own Info.plist has no CFBundleShortVersionString")
+        }
 
         let payload = outputDirectory.appendingPathComponent("payload", isDirectory: true)
         if fm.fileExists(atPath: payload.path) {
@@ -209,17 +355,20 @@ enum PickerSelfTest {
         plist["CFBundleShortVersionString"] = "99.0.0"
         let rewritten = try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0)
         try rewritten.write(to: plistURL)
+        // Editing Info.plist after copying it invalidates the inherited signature —
+        // Info.plist is a sealed special slot in the CodeDirectory — so this fake
+        // bundle is genuinely unsigned-in-effect without us stripping anything.
 
         let zipURL = outputDirectory.appendingPathComponent("Redline-99.0.0.zip")
+        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
+
+        func writeZipAndAppcast() throws {
             if fm.fileExists(atPath: zipURL.path) {
                 try fm.removeItem(at: zipURL)
             }
             try runDitto(arguments: ["-c", "-k", payload.path, zipURL.path])
-
             let zipData = try Data(contentsOf: zipURL)
             let hex = UpdateChecker.sha256Hex(zipData)
-
-        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
             let appcast: [String: String] = [
                 "version": "99.0.0",
                 "zipURL": zipURL.absoluteString,
@@ -228,13 +377,15 @@ enum PickerSelfTest {
             ]
             let appcastData = try JSONSerialization.data(withJSONObject: appcast, options: [.sortedKeys])
             try appcastData.write(to: appcastURL)
+        }
+        try writeZipAndAppcast()
 
         let defaults = UserDefaults.standard
-        let previous = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
+        let previousAppcastPref = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
         defaults.set(appcastURL.absoluteString, forKey: UpdateChecker.appcastURLDefaultsKey)
         defer {
-            if let previous {
+            if let previousAppcastPref {
-                defaults.set(previous, forKey: UpdateChecker.appcastURLDefaultsKey)
+                defaults.set(previousAppcastPref, forKey: UpdateChecker.appcastURLDefaultsKey)
             } else {
                 defaults.removeObject(forKey: UpdateChecker.appcastURLDefaultsKey)
             }
@@ -243,39 +394,128 @@ enum PickerSelfTest {
         let (model, isolatedRoot) = try makeIsolatedUpdateModel()
         defer { try? fm.removeItem(at: isolatedRoot) }
 
+        // (a) NEGATIVE — invalidly-signed payload must never be offered or staged.
         await model.updateChecker.checkNow()
+        guard model.updateAvailable == nil else {
+            throw UpdateSelfTestError.detail(
+                "reject-unsigned: updateAvailable=\(model.updateAvailable?.version ?? "nil") (expected nil)"
+            )
+        }
+        guard model.updateChecker.statusMessage == "Update is not signed by MMD — not installed." else {
+            throw UpdateSelfTestError.detail(
+                "reject-unsigned: statusMessage=\(model.updateChecker.statusMessage ?? "nil")"
+            )
+        }
+        print("UPDATE-SELFTEST reject-unsigned PASS")
+        fflush(stdout)
 
+        // (b) POSITIVE — re-sign the same bundle, re-zip, re-serve; must now stage.
+        let signIdentity = ProcessInfo.processInfo.environment["SHOTDECK_SELFTEST_SIGN_IDENTITY"]
+            ?? "Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
+        try runCodesign(identity: signIdentity, path: fakeApp.path)
+        try writeZipAndAppcast()
+
+        await model.updateChecker.checkNow()
         guard model.updateAvailable?.version == "99.0.0" else {
             throw UpdateSelfTestError.detail(
-                "updateAvailable=\(model.updateAvailable?.version ?? "nil")"
+                "staged-signed: updateAvailable=\(model.updateAvailable?.version ?? "nil")"
             )
         }
         guard let staged = model.updateChecker.stagedAppURL else {
-            throw UpdateSelfTestError.detail("staged payload missing")
+            throw UpdateSelfTestError.detail("staged-signed: staged payload missing")
         }
         guard staged.lastPathComponent == "Redline.app" else {
-            throw UpdateSelfTestError.detail("staged name \(staged.lastPathComponent)")
+            throw UpdateSelfTestError.detail("staged-signed: staged name \(staged.lastPathComponent)")
         }
         let stagedExe = staged.appendingPathComponent("Contents/MacOS/Shotdeck")
         guard fm.fileExists(atPath: stagedExe.path) else {
-            throw UpdateSelfTestError.detail("staged Contents/MacOS/Shotdeck missing")
+            throw UpdateSelfTestError.detail("staged-signed: staged Contents/MacOS/Shotdeck missing")
         }
+        print("UPDATE-SELFTEST staged-signed PASS")
+        fflush(stdout)
 
-        let targetRoot = outputDirectory.appendingPathComponent("target", isDirectory: true)
+        // (c) ATOMIC INSTALL — a throwaway target pre-populated with the real
-        if fm.fileExists(atPath: targetRoot.path) {
+        // running version; never `/Applications`.
-            try fm.removeItem(at: targetRoot)
+        let tempAppsRoot = outputDirectory.appendingPathComponent("Applications", isDirectory: true)
+        if fm.fileExists(atPath: tempAppsRoot.path) {
+            try fm.removeItem(at: tempAppsRoot)
         }
-        let target = targetRoot.appendingPathComponent("Redline.app")
+        try fm.createDirectory(at: tempAppsRoot, withIntermediateDirectories: true)
-        model.updateChecker.installStaged(to: target)
+        let tempTarget = tempAppsRoot.appendingPathComponent("Redline.app")
+        try fm.copyItem(at: sourceApp, to: tempTarget)
 
-        let installedPlist = target.appendingPathComponent("Contents/Info.plist")
+        model.updateChecker.installStaged(to: tempTarget)
-        guard let installed = NSDictionary(contentsOf: installedPlist) as? [String: Any],
+
-              let installedVersion = installed["CFBundleShortVersionString"] as? String
+        guard let installedVersion = readShortVersion(atAppURL: tempTarget) else {
-        else {
+            throw UpdateSelfTestError.detail("atomic-install: installed Info.plist unreadable")
-            throw UpdateSelfTestError.detail("installed Info.plist unreadable")
         }
         guard installedVersion == "99.0.0" else {
-            throw UpdateSelfTestError.detail("installed version \(installedVersion)")
+            throw UpdateSelfTestError.detail("atomic-install: installed version \(installedVersion)")
+        }
+        let previousCopy = tempAppsRoot.appendingPathComponent("Redline.app.previous")
+        guard let previousVersionAfterInstall = readShortVersion(atAppURL: previousCopy) else {
+            throw UpdateSelfTestError.detail("atomic-install: Redline.app.previous missing or unreadable")
+        }
+        guard previousVersionAfterInstall == originalVersion else {
+            throw UpdateSelfTestError.detail(
+                "atomic-install: previous version=\(previousVersionAfterInstall) expected=\(originalVersion)"
+            )
+        }
+        try assertNoLeftoverEntries(in: tempAppsRoot, expecting: ["Redline.app", "Redline.app.previous"])
+        print("UPDATE-SELFTEST atomic-install PASS")
+        fflush(stdout)
+
+        // (d) REVERT — the rollback copy swaps back in; the just-replaced version
+        // becomes the new rollback copy, so a revert is itself reversible.
+        model.updateChecker.revertToPrevious(target: tempTarget)
+
+        guard let revertedVersion = readShortVersion(atAppURL: tempTarget) else {
+            throw UpdateSelfTestError.detail("revert: reverted Info.plist unreadable")
+        }
+        guard revertedVersion == originalVersion else {
+            throw UpdateSelfTestError.detail("revert: target version=\(revertedVersion) expected=\(originalVersion)")
+        }
+        guard let previousVersionAfterRevert = readShortVersion(atAppURL: previousCopy) else {
+            throw UpdateSelfTestError.detail("revert: Redline.app.previous missing or unreadable")
+        }
+        guard previousVersionAfterRevert == "99.0.0" else {
+            throw UpdateSelfTestError.detail(
+                "revert: previous version=\(previousVersionAfterRevert) expected=99.0.0"
+            )
+        }
+        try assertNoLeftoverEntries(in: tempAppsRoot, expecting: ["Redline.app", "Redline.app.previous"])
+        print("UPDATE-SELFTEST revert PASS")
+        fflush(stdout)
+    }
+
+    private static func readShortVersion(atAppURL url: URL) -> String? {
+        let plistURL = url.appendingPathComponent("Contents/Info.plist")
+        guard let dict = NSDictionary(contentsOf: plistURL) as? [String: Any] else { return nil }
+        return dict["CFBundleShortVersionString"] as? String
+    }
+
+    private static func runCodesign(identity: String, path: String) throws {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/codesign")
+        process.arguments = ["--force", "--deep", "--sign", identity, path]
+        let err = Pipe()
+        process.standardError = err
+        process.standardOutput = Pipe()
+        try process.run()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let message = String(data: err.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+            throw UpdateSelfTestError.detail("codesign failed: \(message)")
+        }
+    }
+
+    private static func assertNoLeftoverEntries(in directory: URL, expecting expected: Set<String>) throws {
+        let entries = (try? FileManager.default.contentsOfDirectory(atPath: directory.path)) ?? []
+        let unexpected = entries.filter { !expected.contains($0) }
+        guard unexpected.isEmpty else {
+            throw UpdateSelfTestError.detail(
+                "unexpected entries in \(directory.path): \(unexpected.joined(separator: ", "))"
+            )
         }
     }
 

Sources/Shotdeck/SendController.swift

@@ -3,12 +3,59 @@ import Darwin
 import Foundation
 import ShotdeckCore
 
+/// Result of composing a send PDF. Kept so the self-test can drive the share
+/// outcome without presenting a real AirDrop sheet.
+struct ComposedSend: Sendable {
+    let fileName: String
+    let fileURL: URL
+    let pageCount: Int
+}
+
 extension AppModel: SendCapable {
     public func send(anchor: NSView?) async {
         guard !session.isEmpty, !isSending else { return }
         setSending(true)
-        defer { setSending(false) }
 
+        let pending: ComposedSend
+        do {
+            pending = try await composePDFForSend()
+        } catch {
+            // Never unlink the published PDF, and never unlink the temp file either:
+            // a rename failure would leave the complete document at the temp name.
+            setStatus((error as? ShotdeckError)?.errorDescription ?? "The PDF could not be built.")
+            setSending(false)
+            return
+        }
+
+        guard let anchor else {
+            handleDidFailToShareItems(fileName: pending.fileName)
+            setSending(false)
+            return
+        }
+
+        do {
+            try Sharing.airDrop(fileURL: pending.fileURL, from: anchor) { [weak self] success in
+                guard let self else { return }
+                if success {
+                    await self.handleDidShareItems(
+                        fileName: pending.fileName,
+                        pageCount: pending.pageCount
+                    )
+                } else {
+                    self.handleDidFailToShareItems(fileName: pending.fileName)
+                }
+                self.setSending(false)
+            }
+        } catch {
+            // canPerform false, no service, or no visible window: same as cancel.
+            handleDidFailToShareItems(fileName: pending.fileName)
+            setSending(false)
+        }
+    }
+
+    /// Writes the PDF to the outbox and records its path. Does not archive the session
+    /// and does not present AirDrop — that happens only after the share completes.
+    func composePDFForSend() async throws -> ComposedSend {
         let workingSession = session
         let composer = self.composer
         // Live outbox (FolderSettings), not `paths.outbox` — Settings changes take effect.
@@ -20,7 +67,6 @@ extension AppModel: SendCapable {
         let tempURL = outboxDir.appendingPathComponent(".shotdeck-\(UUID().uuidString).pdf")
         let title = "Redline – \(DubaiTime.stamp(workingSession.createdAt))"
 
-        do {
         // D-13: build off the main actor. Only Sendable values cross into the
         // detached task — never `anchor` (NSView is not Sendable).
         try await Task.detached(priority: .userInitiated) {
@@ -40,32 +86,35 @@ extension AppModel: SendCapable {
             try AtomicFile.fsyncDirectory(at: outboxDir)
         }.value
 
-            // File exists on disk now — archive only after that (D-13). A later AirDrop
-            // failure never deletes this file.
         guard FileManager.default.fileExists(atPath: finalURL.path) else {
             throw ShotdeckError.pdfCompositionFailed(reason: "the PDF was not written to disk")
         }
-            _ = try await spool.archiveCurrent(pdfFileName: fileName)
+        rememberLastComposedPDF(finalURL)
-            replaceSession(try await spool.currentSession())
+        return ComposedSend(
-
+            fileName: fileName,
-            let pageWord = workingSession.captures.count == 1 ? "page" : "pages"
+            fileURL: finalURL,
-            setStatus("Sent — \(workingSession.captures.count) \(pageWord).")
+            pageCount: workingSession.captures.count
-
-            guard let anchor else {
-                setStatus("PDF saved to \(outboxDisplayName). Open the panel to AirDrop it.")
-                return
-            }
-            do {
-                try Sharing.airDrop(fileURL: finalURL, from: anchor)
-            } catch {
-                setStatus(
-                    "AirDrop is not available right now — the PDF is on your \(outboxDisplayName)."
         )
     }
+
+    /// `NSSharingServiceDelegate.sharingService(_:didShareItems:)` seam.
+    func handleDidShareItems(fileName: String, pageCount: Int) async {
+        guard !session.isEmpty else { return }
+        do {
+            _ = try await spool.archiveCurrent(pdfFileName: fileName)
+            replaceSession(try await spool.currentSession())
+            let pageWord = pageCount == 1 ? "page" : "pages"
+            setStatus("Sent — \(pageCount) \(pageWord).")
         } catch {
-            // Never unlink the published PDF, and never unlink `tempURL` either:
+            setStatus((error as? ShotdeckError)?.errorDescription ?? "Could not archive the session.")
-            // a rename failure would leave the complete document at the temp name.
-            setStatus((error as? ShotdeckError)?.errorDescription ?? "The PDF could not be built.")
         }
     }
+
+    /// `NSSharingServiceDelegate.sharingService(_:didFailToShareItems:error:)` seam,
+    /// also used when `canPerform` is false or the user cancels. Does not archive.
+    func handleDidFailToShareItems(fileName: String) {
+        setStatus(
+            "AirDrop didn't complete — nothing was sent. Your captures are still here; the PDF is on your \(outboxDisplayName) as \(fileName)."
+        )
+    }
 }

Sources/Shotdeck/Sharing.swift

@@ -7,7 +7,14 @@ enum Sharing {
     /// Throws `ShotdeckError.airDropUnavailable` when the service cannot be created,
     /// `canPerform` is false, or `view` is not in a visible window (a detached view
     /// never produces an on-screen sheet).
-    static func airDrop(fileURL: URL, from view: NSView) throws {
+    ///
+    /// `onFinished` is invoked on the main actor when the sheet completes: `true` for
+    /// `didShareItems`, `false` for `didFailToShareItems` (including user cancel).
+    static func airDrop(
+        fileURL: URL,
+        from view: NSView,
+        onFinished: @escaping @MainActor @Sendable (Bool) async -> Void
+    ) throws {
         guard let service = NSSharingService(named: .sendViaAirDrop),
               service.canPerform(withItems: [fileURL]) else {
             throw ShotdeckError.airDropUnavailable
@@ -21,7 +28,12 @@ enum Sharing {
         window.makeKeyAndOrderFront(nil)
 
         service.subject = fileURL.lastPathComponent
-        let session = AirDropSession(service: service, window: window, view: view)
+        let session = AirDropSession(
+            service: service,
+            window: window,
+            view: view,
+            onFinished: onFinished
+        )
         AirDropSession.keepAlive(session)
         service.delegate = session
         service.perform(withItems: [fileURL])
@@ -29,7 +41,9 @@ enum Sharing {
 }
 
 /// Retains the sharing service for the life of the picker and supplies the real
-/// on-screen window as the sheet parent. `NSSharingService.delegate` is weak.
+/// on-screen window as the sheet parent. `NSSharingService.delegate` is weak, so
+/// `live` is the strong reference that keeps this object alive until the sheet
+/// reports success or failure (including cancel).
 @MainActor
 private final class AirDropSession: NSObject, NSSharingServiceDelegate {
     static var live: [AirDropSession] = []
@@ -37,11 +51,19 @@ private final class AirDropSession: NSObject, NSSharingServiceDelegate {
     let service: NSSharingService
     let window: NSWindow
     let view: NSView
+    let onFinished: @MainActor @Sendable (Bool) async -> Void
+    private var reported = false
 
-    init(service: NSSharingService, window: NSWindow, view: NSView) {
+    init(
+        service: NSSharingService,
+        window: NSWindow,
+        view: NSView,
+        onFinished: @escaping @MainActor @Sendable (Bool) async -> Void
+    ) {
         self.service = service
         self.window = window
         self.view = view
+        self.onFinished = onFinished
     }
 
     static func keepAlive(_ session: AirDropSession) {
@@ -52,6 +74,15 @@ private final class AirDropSession: NSObject, NSSharingServiceDelegate {
         Self.live.removeAll { $0 === self }
     }
 
+    private func report(_ success: Bool) {
+        guard !reported else { return }
+        reported = true
+        Task { @MainActor in
+            await self.onFinished(success)
+            self.drop()
+        }
+    }
+
     func sharingService(
         _ sharingService: NSSharingService,
         sourceWindowForShareItems items: [Any],
@@ -70,7 +101,7 @@ private final class AirDropSession: NSObject, NSSharingServiceDelegate {
     }
 
     func sharingService(_ sharingService: NSSharingService, didShareItems items: [Any]) {
-        drop()
+        report(true)
     }
 
     func sharingService(
@@ -78,6 +109,6 @@ private final class AirDropSession: NSObject, NSSharingServiceDelegate {
         didFailToShareItems items: [Any],
         error: any Error
     ) {
-        drop()
+        report(false)
     }
 }

Sources/Shotdeck/UpdateChecker.swift

@@ -1,6 +1,7 @@
 import AppKit
 import CryptoKit
 import Foundation
+import Security
 
 /// Built-in updater. Checks an appcast, stages a verified payload, and installs
 /// only when the user clicks the menu row — never automatically.
@@ -10,22 +11,31 @@ final class UpdateChecker {
     static let defaultAppcastURL = URL(string: "https://get.baobab-ts.com/cowork/redline/appcast.json")!
     static let defaultInstallTarget = URL(fileURLWithPath: "/Applications/Redline.app")
 
+    /// Required bundle identifier for any staged or installed payload.
+    static let expectedBundleIdentifier = "ai.flowmaster.shotdeck"
+    /// Developer team identifiers MMD ships Redline under. Overridable only for the self-test.
+    static let allowedTeamIdentifiers: Set<String> = ["PWMCBMX5M8", "L3N9S54CN3"]
+
     private(set) var availableUpdate: (version: String, notes: String)?
     private(set) var stagedAppURL: URL?
     private(set) var statusMessage: String?
+    private(set) var lastCheckedAt: Date?
+    private(set) var isCheckingNow: Bool = false
 
     var onChecked: (() -> Void)?
+    /// Fired whenever `isCheckingNow` flips, so a UI can show "Checking…" for the
+    /// whole duration of a check rather than only after it lands.
+    var onCheckingChanged: ((Bool) -> Void)?
 
     private let urlSession: URLSession
     private var repeatingTimer: Timer?
     private var firstCheckTask: Task<Void, Never>?
-    private var isChecking = false
     private var stagingDirectory: URL?
 
     init() {
         let config = URLSessionConfiguration.ephemeral
-        config.timeoutIntervalForRequest = 15
+        config.timeoutIntervalForRequest = 30
-        config.timeoutIntervalForResource = 15
+        config.timeoutIntervalForResource = 600
         config.httpCookieAcceptPolicy = .never
         config.httpShouldSetCookies = false
         config.httpCookieStorage = nil
@@ -51,10 +61,18 @@ final class UpdateChecker {
         repeatingTimer = timer
     }
 
-    func checkNow() async {
+    /// Checks the appcast and stages a newer, signature-verified payload.
-        guard !isChecking else { return }
+    /// `manual` only affects the status message shown when already up to date —
-        isChecking = true
+    /// a user-initiated check says so; the silent background check stays quiet.
-        defer { isChecking = false }
+    func checkNow(manual: Bool = false) async {
+        guard !isCheckingNow else { return }
+        isCheckingNow = true
+        onCheckingChanged?(true)
+        defer {
+            isCheckingNow = false
+            onCheckingChanged?(false)
+        }
+        lastCheckedAt = Date()
 
         let appcast: Appcast
         do {
@@ -67,7 +85,7 @@ final class UpdateChecker {
 
         guard Self.isNewer(appcast.version, than: Self.currentVersion()) else {
             clearOffer()
-            statusMessage = nil
+            statusMessage = manual ? "Redline \(Self.currentVersion()) is up to date." : nil
             onChecked?()
             return
         }
@@ -80,6 +98,10 @@ final class UpdateChecker {
             discardStaging()
             availableUpdate = nil
             statusMessage = "Update file failed the checksum — not installed."
+        } catch UpdateCheckError.signatureInvalid {
+            discardStaging()
+            availableUpdate = nil
+            statusMessage = "Update is not signed by MMD — not installed."
         } catch {
             discardStaging()
             availableUpdate = nil
@@ -88,9 +110,9 @@ final class UpdateChecker {
         onChecked?()
     }
 
-    /// Copies the staged app onto `target` with ditto (in place; never deletes the old app).
+    /// Installs the staged app onto `target` atomically, keeping exactly one rollback
-    /// Relaunches unless `SHOTDECK_UPDATE_SELFTEST` is set, so the in-process self-test
+    /// copy (`Redline.app.previous`), then hands off to a relaunch and quits.
-    /// can assert the installed Info.plist without killing the process.
+    /// Never deletes the old app before the new one is verified in place.
     func installStaged(to target: URL = UpdateChecker.defaultInstallTarget) {
         guard let staged = stagedAppURL else {
             statusMessage = "No update is staged."
@@ -98,29 +120,118 @@ final class UpdateChecker {
             return
         }
 
+        let targetDir = target.deletingLastPathComponent()
+        let previousURL = targetDir.appendingPathComponent("Redline.app.previous")
+
         do {
-            try FileManager.default.createDirectory(
+            try FileManager.default.createDirectory(at: targetDir, withIntermediateDirectories: true)
-                at: target.deletingLastPathComponent(),
+
-                withIntermediateDirectories: true
+            let replacementDir = try FileManager.default.url(
+                for: .itemReplacementDirectory,
+                in: .userDomainMask,
+                appropriateFor: target,
+                create: true
             )
-            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, target.path])
+            defer { try? FileManager.default.removeItem(at: replacementDir) }
+
+            let newCopy = replacementDir.appendingPathComponent(target.lastPathComponent)
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, newCopy.path])
+
+            // Exactly one rollback copy is kept — drop any older one before this install.
+            if FileManager.default.fileExists(atPath: previousURL.path) {
+                try FileManager.default.removeItem(at: previousURL)
+            }
+
+            if FileManager.default.fileExists(atPath: target.path) {
+                _ = try FileManager.default.replaceItemAt(
+                    target,
+                    withItemAt: newCopy,
+                    backupItemName: previousURL.lastPathComponent,
+                    options: [.withoutDeletingBackupItem]
+                )
+            } else {
+                try FileManager.default.moveItem(at: newCopy, to: target)
+            }
         } catch {
             statusMessage = "The update could not be installed."
             onChecked?()
             return
         }
 
-        let isSelfTest = ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
+        // Defense in depth: re-verify what actually landed on disk, not just the staged copy.
-        if isSelfTest { return }
-
         do {
-            try Self.runProcess(executable: "/usr/bin/open", arguments: ["-n", target.path])
+            try Self.verifySignature(of: target)
         } catch {
-            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            statusMessage = "The update was installed but failed verification."
             onChecked?()
             return
         }
-        NSApp.terminate(nil)
+
+        discardStaging()
+        availableUpdate = nil
+        relaunch(target: target)
+    }
+
+    /// Swaps `Redline.app.previous` back into place, verifying its signature first.
+    /// The just-replaced (newer) app becomes the new `.previous` — a revert is
+    /// itself reversible.
+    func revertToPrevious(target: URL = UpdateChecker.defaultInstallTarget) {
+        let targetDir = target.deletingLastPathComponent()
+        let previousURL = targetDir.appendingPathComponent("Redline.app.previous")
+
+        guard FileManager.default.fileExists(atPath: previousURL.path) else {
+            statusMessage = "No previous version to revert to."
+            onChecked?()
+            return
+        }
+
+        do {
+            try Self.verifySignature(of: previousURL)
+        } catch {
+            statusMessage = "The previous version failed verification and was not restored."
+            onChecked?()
+            return
+        }
+
+        do {
+            // `previousURL` cannot be handed to replaceItemAt directly: its own path
+            // IS the requested backup name, so the backup step would clobber it
+            // before the swap ever reads it. Stage a throwaway copy first, exactly
+            // like installStaged does for the forward direction.
+            let replacementDir = try FileManager.default.url(
+                for: .itemReplacementDirectory,
+                in: .userDomainMask,
+                appropriateFor: target,
+                create: true
+            )
+            defer { try? FileManager.default.removeItem(at: replacementDir) }
+
+            let newCopy = replacementDir.appendingPathComponent(target.lastPathComponent)
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [previousURL.path, newCopy.path])
+            try FileManager.default.removeItem(at: previousURL)
+
+            _ = try FileManager.default.replaceItemAt(
+                target,
+                withItemAt: newCopy,
+                backupItemName: previousURL.lastPathComponent,
+                options: [.withoutDeletingBackupItem]
+            )
+        } catch {
+            statusMessage = "Could not revert to the previous version."
+            onChecked?()
+            return
+        }
+
+        relaunch(target: target)
+    }
+
+    /// The version recorded in `Redline.app.previous`'s Info.plist, or nil when no
+    /// rollback copy exists.
+    func previousVersion(target: URL = UpdateChecker.defaultInstallTarget) -> String? {
+        let previousURL = target.deletingLastPathComponent().appendingPathComponent("Redline.app.previous")
+        let plistURL = previousURL.appendingPathComponent("Contents/Info.plist")
+        guard let plist = NSDictionary(contentsOf: plistURL) as? [String: Any] else { return nil }
+        return plist["CFBundleShortVersionString"] as? String
     }
 
     static func resolvedAppcastURL() -> URL {
@@ -156,6 +267,67 @@ final class UpdateChecker {
         SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()
     }
 
+    /// Validates the code signature of the app at `appURL`: strictly, across all
+    /// architectures and nested code, then checks its bundle identifier and team
+    /// identifier against `expectedBundleIdentifier` / the allowed-teams set.
+    /// `REDLINE_ALLOWED_TEAMS` (comma separated) overrides the allowed set — for
+    /// the self-test only, so it can accept a locally re-signed fake bundle.
+    static func verifySignature(of appURL: URL) throws {
+        var staticCode: SecStaticCode?
+        let createStatus = SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode)
+        guard createStatus == errSecSuccess, let code = staticCode else {
+            throw UpdateCheckError.signatureInvalid(
+                "could not read a code signature (status \(createStatus))"
+            )
+        }
+
+        let validityFlags = SecCSFlags(
+            rawValue: kSecCSStrictValidate | kSecCSCheckAllArchitectures | kSecCSCheckNestedCode
+        )
+        var validityError: Unmanaged<CFError>?
+        let validityStatus = SecStaticCodeCheckValidityWithErrors(code, validityFlags, nil, &validityError)
+        guard validityStatus == errSecSuccess else {
+            let detail = (validityError?.takeRetainedValue()).map { String(describing: $0) } ?? "status \(validityStatus)"
+            throw UpdateCheckError.signatureInvalid("signature is not valid: \(detail)")
+        }
+
+        var signingInfo: CFDictionary?
+        let infoStatus = SecCodeCopySigningInformation(
+            code,
+            SecCSFlags(rawValue: kSecCSSigningInformation),
+            &signingInfo
+        )
+        guard infoStatus == errSecSuccess, let info = signingInfo as? [String: Any] else {
+            throw UpdateCheckError.signatureInvalid("could not read signing information (status \(infoStatus))")
+        }
+
+        let identifier = info[kSecCodeInfoIdentifier as String] as? String
+        guard identifier == expectedBundleIdentifier else {
+            throw UpdateCheckError.signatureInvalid(
+                "unexpected bundle identifier: \(identifier ?? "nil")"
+            )
+        }
+
+        let teamIdentifier = info[kSecCodeInfoTeamIdentifier as String] as? String
+        guard let teamIdentifier, resolvedAllowedTeamIdentifiers().contains(teamIdentifier) else {
+            throw UpdateCheckError.signatureInvalid(
+                "unexpected team identifier: \(teamIdentifier ?? "nil")"
+            )
+        }
+    }
+
+    private static func resolvedAllowedTeamIdentifiers() -> Set<String> {
+        if let env = ProcessInfo.processInfo.environment["REDLINE_ALLOWED_TEAMS"], !env.isEmpty {
+            let parts = env.split(separator: ",")
+                .map { $0.trimmingCharacters(in: .whitespaces) }
+                .filter { !$0.isEmpty }
+            if !parts.isEmpty {
+                return Set(parts)
+            }
+        }
+        return allowedTeamIdentifiers
+    }
+
     // MARK: - Private
 
     private struct Appcast: Decodable {
@@ -170,6 +342,7 @@ final class UpdateChecker {
         case invalidPayload
         case httpStatus(Int)
         case processFailed(String)
+        case signatureInvalid(String)
     }
 
     private func fetchAppcast() async throws -> Appcast {
@@ -219,6 +392,7 @@ final class UpdateChecker {
         guard FileManager.default.fileExists(atPath: executable.path) else {
             throw UpdateCheckError.invalidPayload
         }
+        try Self.verifySignature(of: appURL)
         stagedAppURL = appURL
     }
 
@@ -235,6 +409,35 @@ final class UpdateChecker {
         stagedAppURL = nil
     }
 
+    /// Spawns a detached watcher that waits for this process to exit, then reopens
+    /// `target`, and quits. Never called during the self-test, so the in-process
+    /// assertions after `installStaged`/`revertToPrevious` can still run.
+    private func relaunch(target: URL) {
+        guard ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] == nil else { return }
+
+        let ownPID = ProcessInfo.processInfo.processIdentifier
+        let script = "while kill -0 \(ownPID) 2>/dev/null; do sleep 0.2; done; " +
+            "/usr/bin/open -n \(Self.shellQuoted(target.path))"
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/bin/sh")
+        process.arguments = ["-c", script]
+        process.standardInput = FileHandle.nullDevice
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+        do {
+            try process.run()
+        } catch {
+            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            onChecked?()
+            return
+        }
+        NSApp.terminate(nil)
+    }
+
+    private static func shellQuoted(_ path: String) -> String {
+        "'" + path.replacingOccurrences(of: "'", with: "'\\''") + "'"
+    }
+
     private static func findRedlineApp(in directory: URL) -> URL? {
         let fm = FileManager.default
         let direct = directory.appendingPathComponent("Redline.app")

Sources/Shotdeck/main.swift

@@ -21,8 +21,9 @@ struct ShotdeckApp: App {
                 .environment(appDelegate.model)
         } label: {
             let state = appDelegate.model.iconState
+            let hasUpdate = appDelegate.model.updateAvailable != nil
             HStack(spacing: 4) {
-                Image(systemName: state.symbolName)
+                menuBarIcon(for: state, hasUpdate: hasUpdate)
                 if let count = state.countText {
                     Text(count).font(.system(size: 11, weight: .semibold))
                 }
@@ -33,6 +34,29 @@ struct ShotdeckApp: App {
     }
 }
 
+/// The menu-bar symbol for `state`, badged while an update is staged. Uses the
+/// SF Symbol's own `.badge` variant when one exists; falls back to a small
+/// overlaid dot on the plain symbol otherwise. The badge disappears on its own
+/// once `updateAvailable` clears, since this reads live model state.
+@ViewBuilder
+private func menuBarIcon(for state: MenuIconState, hasUpdate: Bool) -> some View {
+    if hasUpdate {
+        let badgeName = "\(state.symbolName).badge"
+        if NSImage(systemSymbolName: badgeName, accessibilityDescription: nil) != nil {
+            Image(systemName: badgeName)
+        } else {
+            ZStack(alignment: .topTrailing) {
+                Image(systemName: state.symbolName)
+                Circle()
+                    .frame(width: 6, height: 6)
+                    .offset(x: 3, y: -3)
+            }
+        }
+    } else {
+        Image(systemName: state.symbolName)
+    }
+}
+
 @MainActor
 final class AppDelegate: NSObject, NSApplicationDelegate {
     let model: AppModel

Sources/ShotdeckCore/PDF/PDFComposer.swift

@@ -70,8 +70,8 @@ public struct PDFComposer: Sendable {
         }
     }
 
-    public static func fileName(for session: CaptureSession) -> String {
+    public static func fileName(for _: CaptureSession) -> String {
-        "Redline-\(DubaiTime.fileStamp(session.createdAt)).pdf"
+        "Redline-\(DubaiTime.fileStamp(Date())).pdf"
     }
 
     private static func writePDF(

Tests/ShotdeckCoreTests/PDFComposerTests.swift

@@ -203,6 +203,17 @@ private func pixelWindow(
     return (pixelX0, pixelY0, pixelX1, pixelY1)
 }
 
+@Test("fileName uses compose time, not session.createdAt, and matches Redline-yyyyMMdd-HHmmss.pdf")
+func fileNameUsesComposeTimeNotSessionCreatedAt() {
+    let old = Date(timeIntervalSince1970: 1_600_000_000) // 2020-09-13
+    let session = makeSession(captures: [], createdAt: old)
+    let name = PDFComposer.fileName(for: session)
+    #expect(name.wholeMatch(of: /^Redline-\d{8}-\d{6}\.pdf$/) != nil)
+    #expect(!name.contains(DubaiTime.fileStamp(old)))
+    let today = String(DubaiTime.fileStamp(Date()).prefix(8))
+    #expect(name.contains(today))
+}
+
 @Test("Three-page basic compose")
 func threePageBasicCompose() throws {
     let directory = try makeScratchDirectory()

scripts/publish-update.sh

@@ -0,0 +1,469 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# One-command Redline release: bump Info.plist, commit, signed build, zip,
+# DMG, appcast, upload to mmd01, verify the public URLs.
+# Hidden flag: --test  — upload under .../redline/test/ and skip the git commit.
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT}"
+
+PLIST="${ROOT}/Info.plist"
+PLISTBUDDY="/usr/libexec/PlistBuddy"
+REMOTE_HOST="mmd01"
+REMOTE_BASE="/opt/mmd-installer-content/cowork/redline"
+PUBLIC_BASE="https://get.baobab-ts.com/cowork/redline"
+BUNDLE_ID="ai.flowmaster.shotdeck"
+# Used both as the fallback signing identity and as what build-app.sh itself
+# still hardcodes for its own (pre-final) signing pass.
+FALLBACK_SIGN_IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
+
+usage() {
+    echo "Usage: $0 <version> [\"notes\"]" >&2
+    exit 1
+}
+
+TEST_MODE=0
+VERSION=""
+NOTES=""
+NOTES_SET=0
+for arg in "$@"; do
+    case "${arg}" in
+        --test)
+            TEST_MODE=1
+            ;;
+        --help|-h)
+            usage
+            ;;
+        --*)
+            echo "Unknown argument: ${arg}" >&2
+            usage
+            ;;
+        *)
+            if [[ -z "${VERSION}" ]]; then
+                VERSION="${arg}"
+            elif [[ "${NOTES_SET}" -eq 0 ]]; then
+                NOTES="${arg}"
+                NOTES_SET=1
+            else
+                echo "Unexpected extra argument: ${arg}" >&2
+                usage
+            fi
+            ;;
+    esac
+done
+
+if [[ -z "${VERSION}" ]]; then
+    usage
+fi
+
+if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([+-][A-Za-z0-9.-]+)*$ ]]; then
+    echo "Version '${VERSION}' is not a semver (e.g. 1.2.3 or 0.0.0-test)." >&2
+    exit 1
+fi
+
+if [[ "${VERSION}" == *'/'* || "${VERSION}" == *'..'* ]]; then
+    echo "Version contains illegal path characters: ${VERSION}" >&2
+    exit 1
+fi
+
+if [[ "${TEST_MODE}" -eq 1 ]]; then
+    REMOTE_DIR="${REMOTE_BASE}/test"
+    PUBLIC_DIR="${PUBLIC_BASE}/test"
+else
+    REMOTE_DIR="${REMOTE_BASE}"
+    PUBLIC_DIR="${PUBLIC_BASE}"
+fi
+
+APP_BUNDLE="${ROOT}/.build/Redline.app"
+ZIP_NAME="Redline-${VERSION}.zip"
+DMG_NAME="Redline-${VERSION}.dmg"
+ZIP_PATH="${ROOT}/.build/${ZIP_NAME}"
+DMG_PATH="${ROOT}/.build/Redline.dmg"
+APPCAST_PATH="${ROOT}/.build/appcast.json"
+ZIP_URL="${PUBLIC_DIR}/${ZIP_NAME}"
+APPCAST_URL="${PUBLIC_DIR}/appcast.json"
+
+if [[ "${TEST_MODE}" -eq 1 ]]; then
+    echo "==> Publish Redline ${VERSION} (test)"
+else
+    echo "==> Publish Redline ${VERSION}"
+fi
+echo "    remote: ${REMOTE_HOST}:${REMOTE_DIR}/"
+echo "    public: ${PUBLIC_DIR}/"
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    echo "Not inside a git work tree." >&2
+    exit 1
+fi
+
+# Tracked files must match HEAD. Untracked files are ignored so this script
+# can be dry-run (--test) before it is itself committed.
+if [[ -n "$(git status --porcelain -uno)" ]]; then
+    echo "git tree is not clean; commit or stash before publishing." >&2
+    git status --porcelain -uno >&2
+    exit 1
+fi
+
+if [[ ! -x "${PLISTBUDDY}" ]]; then
+    echo "PlistBuddy not found at ${PLISTBUDDY}" >&2
+    exit 1
+fi
+if [[ ! -f "${PLIST}" ]]; then
+    echo "Info.plist not found at ${PLIST}" >&2
+    exit 1
+fi
+
+restore_plist() {
+    git checkout -- "${PLIST}" >/dev/null 2>&1 || true
+}
+
+if [[ "${TEST_MODE}" -eq 1 ]]; then
+    trap restore_plist EXIT
+fi
+
+CURRENT_BUILD="$("${PLISTBUDDY}" -c 'Print :CFBundleVersion' "${PLIST}")"
+if [[ ! "${CURRENT_BUILD}" =~ ^[0-9]+$ ]]; then
+    echo "CFBundleVersion is not an integer: ${CURRENT_BUILD}" >&2
+    exit 1
+fi
+NEW_BUILD=$((CURRENT_BUILD + 1))
+
+echo "==> Bumping Info.plist"
+echo "    CFBundleShortVersionString -> ${VERSION}"
+echo "    CFBundleVersion ${CURRENT_BUILD} -> ${NEW_BUILD}"
+"${PLISTBUDDY}" -c "Set :CFBundleShortVersionString ${VERSION}" "${PLIST}"
+"${PLISTBUDDY}" -c "Set :CFBundleVersion ${NEW_BUILD}" "${PLIST}"
+
+if [[ "${TEST_MODE}" -eq 0 ]]; then
+    echo "==> Committing version bump on $(git rev-parse --abbrev-ref HEAD)"
+    git add "${PLIST}"
+    git commit -m "release: v${VERSION}"
+else
+    echo "==> --test: skipping git commit of version bump"
+fi
+
+# --- Resolve the signing identity for the shipped artifacts -----------------
+# REDLINE_KEYCHAIN (optional): a specific keychain to search/sign against,
+# for hosts where the Developer ID identity does not live in the login
+# keychain that codesign searches by default.
+FIND_IDENTITY_ARGS=(-v -p codesigning)
+CODESIGN_KEYCHAIN_ARGS=()
+if [[ -n "${REDLINE_KEYCHAIN:-}" ]]; then
+    FIND_IDENTITY_ARGS+=("${REDLINE_KEYCHAIN}")
+    CODESIGN_KEYCHAIN_ARGS=(--keychain "${REDLINE_KEYCHAIN}")
+fi
+
+if [[ -n "${REDLINE_SIGN_IDENTITY:-}" ]]; then
+    SIGN_IDENTITY="${REDLINE_SIGN_IDENTITY}"
+    echo "==> Signing identity: ${SIGN_IDENTITY} (REDLINE_SIGN_IDENTITY)"
+else
+    DEVELOPER_ID_LINE="$(security find-identity "${FIND_IDENTITY_ARGS[@]}" 2>/dev/null \
+        | grep -o '"Developer ID Application:[^"]*"' | head -n1 || true)"
+    DEVELOPER_ID="${DEVELOPER_ID_LINE//\"/}"
+    if [[ -n "${DEVELOPER_ID}" ]]; then
+        SIGN_IDENTITY="${DEVELOPER_ID}"
+        echo "==> Signing identity: ${SIGN_IDENTITY} (auto-detected Developer ID Application)"
+    else
+        SIGN_IDENTITY="${FALLBACK_SIGN_IDENTITY}"
+        echo
+        echo "************************************************************************"
+        echo "WARNING: signing with Apple Development identity — not Developer ID;"
+        echo "Gatekeeper will block first install on other Macs."
+        echo "************************************************************************"
+        echo
+    fi
+fi
+
+# Restricted HOMEs (agent sandboxes) hide the login keychain from codesign.
+# Re-run signed steps with the account's real home when the identity is missing.
+signing_home() {
+    if security find-identity -v -p codesigning 2>/dev/null | grep -Fq "${SIGN_IDENTITY}"; then
+        echo "${HOME}"
+        return
+    fi
+    local rh
+    rh="$(dscl . -read "/Users/$(id -un)" NFSHomeDirectory 2>/dev/null | awk '{print $2}')"
+    if [[ -n "${rh}" && -d "${rh}" ]]; then
+        echo "${rh}"
+    else
+        echo "${HOME}"
+    fi
+}
+
+run_signed() {
+    local sign_home
+    sign_home="$(signing_home)"
+    if [[ "${sign_home}" != "${HOME}" ]]; then
+        echo "==> Using HOME=${sign_home} so codesign can see the login keychain"
+    fi
+    HOME="${sign_home}" "$@"
+}
+
+echo "==> Building signed Redline.app"
+run_signed ./scripts/build-app.sh
+
+if [[ ! -d "${APP_BUNDLE}" ]]; then
+    echo "Signed app missing at ${APP_BUNDLE}" >&2
+    exit 1
+fi
+
+# build-app.sh always signs with its own hardcoded Apple Development identity
+# first (it has to — that identifier+identity pair is what keeps the Screen
+# Recording grant alive). Re-sign here with the identity actually resolved
+# above, which is what ships. A no-op when the two happen to be the same.
+echo "==> Signing ${APP_BUNDLE} with resolved identity"
+run_signed codesign --force --options runtime --timestamp \
+    ${CODESIGN_KEYCHAIN_ARGS[@]+"${CODESIGN_KEYCHAIN_ARGS[@]}"} \
+    --sign "${SIGN_IDENTITY}" \
+    --identifier "${BUNDLE_ID}" \
+    "${APP_BUNDLE}"
+
+build_zip() {
+    mkdir -p "${ROOT}/.build"
+    (
+        cd "${ROOT}/.build"
+        rm -f "${ZIP_NAME}"
+        ditto -c -k --keepParent Redline.app "${ZIP_NAME}"
+    )
+    if [[ ! -s "${ZIP_PATH}" ]]; then
+        echo "Zip was not created at ${ZIP_PATH}" >&2
+        exit 1
+    fi
+}
+
+# Rebuilds the manual-installer DMG from whatever is currently at
+# ${APP_BUNDLE} — never re-invokes build-app.sh, so a prior custom signature
+# or notarization staple on ${APP_BUNDLE} survives into the DMG untouched.
+build_dmg() {
+    local staging="${ROOT}/.build/dmg-staging"
+    local mount_point="${ROOT}/.build/dmg-mnt"
+
+    rm -rf "${staging}"
+    mkdir -p "${staging}"
+    ditto "${APP_BUNDLE}" "${staging}/Redline.app"
+    ln -s /Applications "${staging}/Applications"
+
+    mkdir -p "$(dirname "${DMG_PATH}")"
+    rm -f "${DMG_PATH}"
+    hdiutil create -volname "Redline" -srcfolder "${staging}" -ov -format UDZO "${DMG_PATH}"
+
+    if [[ -d "${mount_point}" ]] && /sbin/mount | grep -F -q "${mount_point}"; then
+        hdiutil detach "${mount_point}" || hdiutil detach "${mount_point}" -force
+    fi
+    rm -rf "${mount_point}"
+    mkdir -p "${mount_point}"
+
+    hdiutil attach "${DMG_PATH}" -nobrowse -readonly -mountpoint "${mount_point}"
+
+    local ok=1
+    if [[ ! -d "${mount_point}/Redline.app" ]]; then
+        echo "Verification failed: Redline.app missing from mounted DMG" >&2
+        ok=0
+    fi
+    if [[ "${ok}" -eq 1 && "$(readlink "${mount_point}/Applications" 2>/dev/null || true)" != "/Applications" ]]; then
+        echo "Verification failed: Applications does not point at /Applications" >&2
+        ok=0
+    fi
+    if [[ "${ok}" -eq 1 ]] && ! codesign --verify --deep --verbose=2 "${mount_point}/Redline.app"; then
+        ok=0
+    fi
+
+    hdiutil detach "${mount_point}" || hdiutil detach "${mount_point}" -force || true
+
+    if [[ "${ok}" -ne 1 ]]; then
+        exit 1
+    fi
+    if [[ ! -s "${DMG_PATH}" ]]; then
+        echo "DMG was not created at ${DMG_PATH}" >&2
+        exit 1
+    fi
+}
+
+echo "==> Zipping Redline.app -> ${ZIP_PATH}"
+build_zip
+
+SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
+ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
+PUBDATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+
+echo "==> Zip SHA256: ${SHA256}"
+echo "    Zip bytes:  ${ZIP_BYTES}"
+
+# --- Notarization (optional) -------------------------------------------------
+# Either REDLINE_NOTARY_PROFILE (a `notarytool store-credentials` keychain
+# profile) or all three of REDLINE_NOTARY_KEY_ID / REDLINE_NOTARY_ISSUER /
+# REDLINE_NOTARY_KEY_PATH (App Store Connect API key). Absent both: skip.
+NOTARIZED=0
+NOTARY_CONFIGURED=0
+if [[ -n "${REDLINE_NOTARY_PROFILE:-}" ]]; then
+    NOTARY_CONFIGURED=1
+elif [[ -n "${REDLINE_NOTARY_KEY_ID:-}" && -n "${REDLINE_NOTARY_ISSUER:-}" && -n "${REDLINE_NOTARY_KEY_PATH:-}" ]]; then
+    NOTARY_CONFIGURED=1
+fi
+
+if [[ "${NOTARY_CONFIGURED}" -eq 1 ]]; then
+    echo "==> Submitting ${ZIP_PATH} to notarytool"
+    NOTARY_ARGS=(xcrun notarytool submit "${ZIP_PATH}" --wait --timeout 30m)
+    if [[ -n "${REDLINE_NOTARY_PROFILE:-}" ]]; then
+        NOTARY_ARGS+=(--keychain-profile "${REDLINE_NOTARY_PROFILE}")
+    else
+        NOTARY_ARGS+=(
+            --key "${REDLINE_NOTARY_KEY_PATH}"
+            --key-id "${REDLINE_NOTARY_KEY_ID}"
+            --issuer "${REDLINE_NOTARY_ISSUER}"
+        )
+    fi
+
+    set +e
+    NOTARY_OUTPUT="$("${NOTARY_ARGS[@]}" 2>&1)"
+    NOTARY_STATUS=$?
+    set -e
+    echo "${NOTARY_OUTPUT}"
+    if [[ "${NOTARY_STATUS}" -ne 0 ]]; then
+        echo "notarytool submit failed (exit ${NOTARY_STATUS})." >&2
+        exit 1
+    fi
+    if ! grep -qi 'status: *Accepted' <<<"${NOTARY_OUTPUT}"; then
+        echo "notarytool did not report Accepted." >&2
+        exit 1
+    fi
+    NOTARIZED=1
+
+    echo "==> Stapling ${APP_BUNDLE}"
+    xcrun stapler staple "${APP_BUNDLE}"
+
+    echo "==> Rebuilding zip from the stapled app"
+    build_zip
+    SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
+    ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
+    echo "    Zip SHA256: ${SHA256}"
+    echo "    Zip bytes:  ${ZIP_BYTES}"
+
+    echo "==> Rebuilding DMG from the stapled app"
+    build_dmg
+
+    echo "==> Stapling ${DMG_PATH}"
+    xcrun stapler staple "${DMG_PATH}"
+else
+    echo "==> REDLINE_NOTARY_KEY_ID/ISSUER/KEY_PATH (or REDLINE_NOTARY_PROFILE) not set"
+    echo "NOT NOTARIZED"
+    echo "==> Building manual installer DMG"
+    build_dmg
+fi
+
+echo "==> Gatekeeper check: spctl -a -vv -t exec ${APP_BUNDLE}"
+set +e
+SPCTL_OUTPUT="$(spctl -a -vv -t exec "${APP_BUNDLE}" 2>&1)"
+SPCTL_STATUS=$?
+set -e
+echo "${SPCTL_OUTPUT}"
+if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then
+    if [[ "${NOTARIZED}" -eq 1 ]]; then
+        echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2
+        exit 1
+    fi
+    echo "WARNING: Gatekeeper does not accept this build (not notarized). First install on other Macs needs right-click > Open." >&2
+fi
+
+TEAM_IDENTIFIER="$(codesign -dv "${APP_BUNDLE}" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2}')"
+if [[ -z "${TEAM_IDENTIFIER}" ]]; then
+    echo "No TeamIdentifier on ${APP_BUNDLE} — the build is not signed with a team identity; refusing to publish." >&2
+    exit 1
+fi
+
+echo "==> Writing ${APPCAST_PATH}"
+python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" "${NOTARIZED}" "${TEAM_IDENTIFIER}" <<'PY'
+import json
+import sys
+
+version, zip_url, sha256, notes, pub_date, out_path, notarized, team_identifier = sys.argv[1:]
+payload = {
+    "version": version,
+    "zipURL": zip_url,
+    "sha256": sha256,
+    "notes": notes,
+    "pubDate": pub_date,
+    "notarized": notarized == "1",
+    "teamIdentifier": team_identifier,
+}
+with open(out_path, "w", encoding="utf-8") as fh:
+    json.dump(payload, fh, indent=2)
+    fh.write("\n")
+PY
+
+echo "==> Uploading to ${REMOTE_HOST}:${REMOTE_DIR}/"
+ssh -o BatchMode=yes "${REMOTE_HOST}" "mkdir -p '${REMOTE_DIR}'"
+rsync -e "ssh -o BatchMode=yes" -av "${ZIP_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/${ZIP_NAME}"
+rsync -e "ssh -o BatchMode=yes" -av "${DMG_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/Redline.dmg"
+rsync -e "ssh -o BatchMode=yes" -av "${DMG_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/${DMG_NAME}"
+rsync -e "ssh -o BatchMode=yes" -av "${APPCAST_PATH}" "${REMOTE_HOST}:${REMOTE_DIR}/appcast.json"
+ssh -o BatchMode=yes "${REMOTE_HOST}" \
+    "chmod 644 \
+        '${REMOTE_DIR}/${ZIP_NAME}' \
+        '${REMOTE_DIR}/Redline.dmg' \
+        '${REMOTE_DIR}/${DMG_NAME}' \
+        '${REMOTE_DIR}/appcast.json'"
+
+echo "==> Verifying public appcast ${APPCAST_URL}"
+APPCAST_BODY=""
+ok=0
+attempt=1
+while [[ "${attempt}" -le 15 ]]; do
+    if APPCAST_BODY="$(curl -fsS "${APPCAST_URL}")"; then
+        echo "${APPCAST_BODY}"
+        if grep -F -q "${VERSION}" <<<"${APPCAST_BODY}"; then
+            echo "OK: appcast contains ${VERSION}"
+            ok=1
+            break
+        fi
+        echo "appcast fetched but does not contain '${VERSION}' (attempt ${attempt})" >&2
+    else
+        echo "appcast fetch failed (attempt ${attempt})" >&2
+    fi
+    attempt=$((attempt + 1))
+    sleep 2
+done
+if [[ "${ok}" -ne 1 ]]; then
+    echo "Public appcast verification failed for ${APPCAST_URL}" >&2
+    exit 1
+fi
+
+echo "==> Verifying public zip HEAD ${ZIP_URL}"
+ok=0
+attempt=1
+HEAD_OUT=""
+while [[ "${attempt}" -le 15 ]]; do
+    HEAD_OUT="$(curl -sS -D - -o /dev/null -I "${ZIP_URL}" || true)"
+    echo "${HEAD_OUT}"
+    HTTP_CODE="$(awk 'BEGIN{c=""} toupper($1) ~ /^HTTP\//{c=$2} END{print c}' <<<"${HEAD_OUT}" | tr -d '\r')"
+    CONTENT_LENGTH="$(awk 'tolower($1)=="content-length:" {gsub("\r","",$2); print $2}' <<<"${HEAD_OUT}" | tail -n 1)"
+    if [[ "${HTTP_CODE}" == "200" && "${CONTENT_LENGTH}" == "${ZIP_BYTES}" ]]; then
+        echo "OK: zip HTTP ${HTTP_CODE}, Content-Length ${CONTENT_LENGTH} matches local ${ZIP_BYTES}"
+        ok=1
+        break
+    fi
+    echo "zip HEAD mismatch (attempt ${attempt}): HTTP '${HTTP_CODE}', Content-Length '${CONTENT_LENGTH}', local '${ZIP_BYTES}'" >&2
+    attempt=$((attempt + 1))
+    sleep 2
+done
+if [[ "${ok}" -ne 1 ]]; then
+    echo "Public zip verification failed for ${ZIP_URL}" >&2
+    exit 1
+fi
+
+echo
+echo "Published v${VERSION}"
+echo "  identity:  ${SIGN_IDENTITY}"
+if [[ "${NOTARIZED}" -eq 1 ]]; then
+    echo "  notarized: yes"
+else
+    echo "  notarized: no"
+fi
+echo "  spctl:     ${SPCTL_OUTPUT}"
+echo "  team:      ${TEAM_IDENTIFIER}"
+echo "  appcast:   ${APPCAST_URL}"
+echo "  zip:       ${ZIP_URL}"
+echo "  sha256:    ${SHA256}"
+echo "  dmg:       ${PUBLIC_DIR}/${DMG_NAME}"
+echo "  dmg:       ${PUBLIC_DIR}/Redline.dmg"