review: refuse to publish a bundle without a team identifier; document the allowed-teams override

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Sources/Shotdeck/AppModel.swift

@@ -43,6 +43,8 @@ public final class AppModel {
     var hotkeyDisplayString: String { captureHotkey.displayString }
     /// Staged update offered in the menu. Set only after checksum + payload validation.
     public private(set) var updateAvailable: (version: String, notes: String)?
+    /// True for the duration of any appcast check (manual or scheduled).
+    public private(set) var isCheckingForUpdates: Bool = false
 
     let paths: AppSupportPaths
     let spool: SpoolStore
@@ -52,7 +54,6 @@ public final class AppModel {
     let picker: RegionPickerController
     let ledger: ReturnLedger
     let watcher: ReturnWatcher
-    let historyStore: HistoryStore
     let updateChecker: UpdateChecker
 
     public init(
@@ -64,7 +65,7 @@ public final class AppModel {
         picker: RegionPickerController,
         ledger: ReturnLedger,
         watcher: ReturnWatcher
-    ) throws {
+    ) {
         self.paths = paths
         self.spool = spool
         self.composer = composer
@@ -73,7 +74,6 @@ public final class AppModel {
         self.picker = picker
         self.ledger = ledger
         self.watcher = watcher
-        self.historyStore = try HistoryStore(paths: paths)
         self.session = CaptureSession(
             id: UUID(),
             createdAt: Date(),
@@ -98,7 +98,18 @@ public final class AppModel {
                 self.setStatus(message)
             }
         }
+        self.updateChecker.onCheckingChanged = { [weak self] checking in
+            self?.isCheckingForUpdates = checking
         }
+    }
+
+    /// CFBundleShortVersionString of the running app.
+    public var appVersion: String { UpdateChecker.currentVersion() }
+    /// Version recorded in the app-managed rollback copy, when one exists.
+    public var previousVersion: String? { updateChecker.previousVersion() }
+    /// Most recent status text — shared with the general status line by design
+    /// (Redline has one status channel, not a separate update-only one).
+    public var updateStatusMessage: String? { statusLine }
 
     // MARK: Seam mutators — the only way a WP-4b/4c extension changes state.
 
@@ -210,7 +221,6 @@ public final class AppModel {
             ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
-            || ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"] != nil
         if !skipSchedule {
             updateChecker.startSchedule()
         }
@@ -222,6 +232,19 @@ public final class AppModel {
         updateChecker.installStaged()
     }
 
+    /// User-initiated appcast check ("Check for updates" menu row).
+    public func checkForUpdates() {
+        Task { @MainActor in
+            await updateChecker.checkNow(manual: true)
+        }
+    }
+
+    /// Reverts `/Applications/Redline.app` to the app-managed rollback copy and relaunches.
+    /// Does nothing unless a `Redline.app.previous` exists and the user clicked the row.
+    public func revertToPreviousVersion() {
+        updateChecker.revertToPrevious()
+    }
+
     /// Unregisters `capture` and binds `HotkeyPreference.load()`. If Carbon rejects the new
     /// combo, restores the previous preference (UserDefaults + Carbon) so the old one keeps working.
     func reRegisterHotkey() {

Sources/Shotdeck/MenuBarView.swift

@@ -15,6 +15,8 @@ struct MenuBarView: View {
                 Divider()
                 returnsBlock
             }
+            Divider()
+            updateFooter
         }
         .padding(10)
         .frame(width: 320, alignment: .leading)
@@ -83,6 +85,21 @@ struct MenuBarView: View {
                 }
             }
 
+            Button {
+                model.checkForUpdates()
+            } label: {
+                actionLabel(model.isCheckingForUpdates ? "Checking…" : "Check for updates")
+            }
+            .disabled(model.isCheckingForUpdates)
+
+            if let previous = model.previousVersion {
+                Button {
+                    model.revertToPreviousVersion()
+                } label: {
+                    actionLabel("Revert to \(previous)")
+                }
+            }
+
             Button {
                 let anchor = NSApp.keyWindow?.contentView
                 if let sender = model as? SendCapable {
@@ -193,4 +210,18 @@ struct MenuBarView: View {
     private var newestReturns: [ReturnedDocument] {
         model.allReturns.sorted { $0.detectedAt > $1.detectedAt }
     }
+
+    private var updateFooter: some View {
+        VStack(alignment: .leading, spacing: 2) {
+            Text("Redline \(model.appVersion)")
+                .font(.caption)
+                .foregroundStyle(.secondary)
+            if let message = model.updateStatusMessage {
+                Text(message)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+        }
+    }
 }

Sources/Shotdeck/PanelSnapshot.swift

@@ -163,7 +163,7 @@ enum PanelSnapshot {
             watchFolder: root.appendingPathComponent("watch", isDirectory: true)
         )
         let ledger = try ReturnLedger(paths: paths)
-        let model = try AppModel(
+        let model = AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),

Sources/Shotdeck/PickerSelfTest.swift

@@ -30,20 +30,6 @@ enum PickerSelfTest {
         }
     }
 
-    /// Standalone HISTORY phase when `SHOTDECK_HISTORY_SELFTEST` is set without
-    /// the picker chain. Waits for NSApp like the other phases, then exits.
-    static func runHistoryIfRequested() {
-        guard let raw = ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"],
-              !raw.isEmpty
-        else { return }
-        _ = raw
-        DispatchQueue.main.async {
-            MainActor.assumeIsolated {
-                runHistoryPhase()
-            }
-        }
-    }
-
     private static func execute(outputDirectory: URL) {
         do {
             try FileManager.default.createDirectory(
@@ -131,8 +117,7 @@ enum PickerSelfTest {
         runRegionPersistPhase()
         // Hop off this MainActor job so the SEND-TRUTH Task can run; do not
         // exit(0) here — runSendTruthPhase prints its own PASS/FAIL, then
-        // chains to HISTORY, then UPDATE-SELFTEST (or exits if that phase is
-        // not requested).
+        // chains to UPDATE-SELFTEST (or exits if that phase is not requested).
         runSendTruthPhase()
     }
 
@@ -181,166 +166,21 @@ enum PickerSelfTest {
     /// Fail path must leave the session open in the temp spool; success path archives
     /// and mints a fresh empty session. Scheduled as a new MainActor job because this
     /// function is called from inside `execute()` — a nested run-loop wait would never
-    /// let the Task start. On success, chains to HISTORY instead of exiting.
+    /// let the Task start. On success, chains to UPDATE-SELFTEST instead of exiting.
     private static func runSendTruthPhase() {
         Task { @MainActor in
             do {
                 try await executeSendTruth()
                 print("SEND-TRUTH PASS")
                 fflush(stdout)
+                if !startUpdateSelfTestIfRequested() {
+                    exit(0)
+                }
             } catch {
                 print("SEND-TRUTH FAIL \(error)")
                 fflush(stdout)
                 exit(1)
             }
-            runHistoryPhase()
-        }
-    }
-
-    /// Phase 4: drive HistoryStore record/prune in a temp root. Env-gated by
-    /// `SHOTDECK_HISTORY_SELFTEST` the same way UPDATE is gated, and also runs
-    /// whenever the picker self-test chain is already in flight so a full
-    /// self-test prints HISTORY PASS|FAIL. Chains to UPDATE-SELFTEST (or exits).
-    private static func runHistoryPhase() {
-        let historyRequested = ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"]
-        let pickerRequested = ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"]
-        let shouldRun = (historyRequested.map { !$0.isEmpty } ?? false)
-            || (pickerRequested.map { !$0.isEmpty } ?? false)
-        guard shouldRun else {
-            if !startUpdateSelfTestIfRequested() {
-                exit(0)
-            }
-            return
-        }
-
-        Task { @MainActor in
-            do {
-                try await executeHistorySelfTest()
-                print("HISTORY PASS")
-                fflush(stdout)
-                if !startUpdateSelfTestIfRequested() {
-                    exit(0)
-                }
-            } catch {
-                print("HISTORY FAIL \(error)")
-                fflush(stdout)
-                exit(1)
-            }
-        }
-    }
-
-    private static func executeHistorySelfTest() async throws {
-        let fm = FileManager.default
-        let root = fm.temporaryDirectory
-            .appendingPathComponent("shotdeck-history-selftest-\(UUID().uuidString)", isDirectory: true)
-        defer { try? fm.removeItem(at: root) }
-
-        let paths = try AppSupportPaths(
-            root: root.appendingPathComponent("root", isDirectory: true),
-            outbox: root.appendingPathComponent("outbox", isDirectory: true),
-            watchFolder: root.appendingPathComponent("watch", isDirectory: true)
-        )
-        let store = try HistoryStore(paths: paths)
-        let sources = root.appendingPathComponent("user-sources", isDirectory: true)
-        try fm.createDirectory(at: sources, withIntermediateDirectories: true)
-
-        var recorded: [HistoryEntry] = []
-        for i in 0..<12 {
-            let source = sources.appendingPathComponent("source-\(i).pdf")
-            try Data("%PDF-1.4\n%hist-\(i)\n%%EOF\n".utf8).write(to: source)
-            let entry = try await store.recordSentPDF(
-                sourceURL: source,
-                sessionID: UUID(),
-                pageCount: 1,
-                sentAt: Date(timeIntervalSince1970: 1_800_000_000 + TimeInterval(i))
-            )
-            recorded.append(entry)
-            let onDisk = try Data(contentsOf: source)
-            guard onDisk == Data("%PDF-1.4\n%hist-\(i)\n%%EOF\n".utf8) else {
-                throw HistorySelfTestError.detail("user source PDF was modified: \(source.path)")
-            }
-        }
-
-        let listed = await store.listPDFs()
-        guard listed.count == 10 else {
-            throw HistorySelfTestError.detail("listPDFs count \(listed.count) want 10")
-        }
-        let wantNewest = Array(recorded.suffix(10).reversed())
-        guard listed.map(\.id) == wantNewest.map(\.id) else {
-            throw HistorySelfTestError.detail("listPDFs did not return the 10 newest")
-        }
-        let pdfsDir = paths.root.appendingPathComponent("history/pdfs", isDirectory: true)
-        for entry in recorded.prefix(2) {
-            let gone = pdfsDir.appendingPathComponent(entry.fileName)
-            guard !fm.fileExists(atPath: gone.path) else {
-                throw HistorySelfTestError.detail("oldest PDF still on disk: \(gone.path)")
-            }
-        }
-
-        let same = sources.appendingPathComponent("same.pdf")
-        try Data("%PDF-1.4\n%same\n%%EOF\n".utf8).write(to: same)
-        let first = try await store.recordSentPDF(
-            sourceURL: same, sessionID: nil, pageCount: 1,
-            sentAt: Date(timeIntervalSince1970: 1_800_000_100)
-        )
-        let second = try await store.recordSentPDF(
-            sourceURL: same, sessionID: nil, pageCount: 1,
-            sentAt: Date(timeIntervalSince1970: 1_800_000_101)
-        )
-        guard first.id != second.id, first.fileURL.path != second.fileURL.path,
-              fm.fileExists(atPath: first.fileURL.path),
-              fm.fileExists(atPath: second.fileURL.path),
-              fm.fileExists(atPath: same.path)
-        else {
-            throw HistorySelfTestError.detail("re-record same source did not produce two distinct copies")
-        }
-
-        let spool = try SpoolStore(paths: paths)
-        let png = try makeTinyPNGData()
-        let base = Date(timeIntervalSince1970: 1_800_100_000)
-        var n = 0
-        var oldestSessionID: UUID?
-        for count in [5, 15, 15] {
-            if n == 0 {
-                oldestSessionID = try await spool.currentSession().id
-            }
-            for _ in 0..<count {
-                _ = try await spool.append(
-                    pngData: png, pixelWidth: 64, pixelHeight: 48, scale: 1,
-                    capturedAt: base.addingTimeInterval(TimeInterval(n))
-                )
-                n += 1
-            }
-            _ = try await spool.archiveCurrent(pdfFileName: "Redline-hist-\(n).pdf")
-        }
-        let openCapture = try await spool.append(
-            pngData: png, pixelWidth: 64, pixelHeight: 48, scale: 1,
-            capturedAt: Date(timeIntervalSince1970: 1_900_000_000)
-        )
-        let openSession = try await spool.currentSession()
-        let openPNG = paths.sessionDirectory(openSession.id).appendingPathComponent(openCapture.fileName)
-        let openBytes = try Data(contentsOf: openPNG)
-
-        try await store.pruneImages()
-
-        let images = try await store.listImages(limit: 50)
-        guard images.count == 30 else {
-            throw HistorySelfTestError.detail("listImages count \(images.count) want 30")
-        }
-        if let oldestSessionID {
-            let oldDir = paths.archiveDirectory(oldestSessionID)
-            guard !fm.fileExists(atPath: oldDir.path) else {
-                throw HistorySelfTestError.detail("emptied archive session still on disk")
-            }
-        }
-        guard fm.fileExists(atPath: openPNG.path), try Data(contentsOf: openPNG) == openBytes else {
-            throw HistorySelfTestError.detail("open session PNG was touched")
-        }
-        let remainingOpen = try await spool.currentSession()
-        guard remainingOpen.id == openSession.id,
-              remainingOpen.captures.map(\.id) == [openCapture.id]
-        else {
-            throw HistorySelfTestError.detail("open session manifest was touched")
         }
     }
 
@@ -356,7 +196,7 @@ enum PickerSelfTest {
             watchFolder: root.appendingPathComponent("watch", isDirectory: true)
         )
         let ledger = try ReturnLedger(paths: paths)
-        let model = try AppModel(
+        let model = AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),
@@ -460,7 +300,7 @@ enum PickerSelfTest {
         exit(1)
     }
 
-    /// Phase 5: builds a fake 99.0.0 bundle, serves a local appcast, stages via
+    /// Phase 4: builds a fake 99.0.0 bundle, serves a local appcast, stages via
     /// `checkNow`, then `installStaged` into the env dir — never `/Applications`.
     /// Returns true when the async phase was scheduled (it calls `exit` itself).
     @discardableResult
@@ -485,6 +325,9 @@ enum PickerSelfTest {
         return true
     }
 
+    /// (a) rejects an invalidly-signed payload, (b) stages the same payload once
+    /// properly signed, (c) installs it atomically into a throwaway target with
+    /// exactly one rollback copy, (d) reverts back. Never touches `/Applications`.
     private static func runUpdateSelfTest(outputDirectory: URL) async throws {
         let fm = FileManager.default
         try fm.createDirectory(at: outputDirectory, withIntermediateDirectories: true)
@@ -492,6 +335,9 @@ enum PickerSelfTest {
         guard let sourceApp = ownAppBundleURL() else {
             throw UpdateSelfTestError.detail("own bundle is not a .app (\(Bundle.main.bundleURL.path))")
         }
+        guard let originalVersion = readShortVersion(atAppURL: sourceApp) else {
+            throw UpdateSelfTestError.detail("own Info.plist has no CFBundleShortVersionString")
+        }
 
         let payload = outputDirectory.appendingPathComponent("payload", isDirectory: true)
         if fm.fileExists(atPath: payload.path) {
@@ -509,17 +355,20 @@ enum PickerSelfTest {
         plist["CFBundleShortVersionString"] = "99.0.0"
         let rewritten = try PropertyListSerialization.data(fromPropertyList: plist, format: .xml, options: 0)
         try rewritten.write(to: plistURL)
+        // Editing Info.plist after copying it invalidates the inherited signature —
+        // Info.plist is a sealed special slot in the CodeDirectory — so this fake
+        // bundle is genuinely unsigned-in-effect without us stripping anything.
 
         let zipURL = outputDirectory.appendingPathComponent("Redline-99.0.0.zip")
+        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
+
+        func writeZipAndAppcast() throws {
             if fm.fileExists(atPath: zipURL.path) {
                 try fm.removeItem(at: zipURL)
             }
             try runDitto(arguments: ["-c", "-k", payload.path, zipURL.path])
-
             let zipData = try Data(contentsOf: zipURL)
             let hex = UpdateChecker.sha256Hex(zipData)
-
-        let appcastURL = outputDirectory.appendingPathComponent("appcast.json")
             let appcast: [String: String] = [
                 "version": "99.0.0",
                 "zipURL": zipURL.absoluteString,
@@ -528,13 +377,15 @@ enum PickerSelfTest {
             ]
             let appcastData = try JSONSerialization.data(withJSONObject: appcast, options: [.sortedKeys])
             try appcastData.write(to: appcastURL)
+        }
+        try writeZipAndAppcast()
 
         let defaults = UserDefaults.standard
-        let previous = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
+        let previousAppcastPref = defaults.string(forKey: UpdateChecker.appcastURLDefaultsKey)
         defaults.set(appcastURL.absoluteString, forKey: UpdateChecker.appcastURLDefaultsKey)
         defer {
-            if let previous {
-                defaults.set(previous, forKey: UpdateChecker.appcastURLDefaultsKey)
+            if let previousAppcastPref {
+                defaults.set(previousAppcastPref, forKey: UpdateChecker.appcastURLDefaultsKey)
             } else {
                 defaults.removeObject(forKey: UpdateChecker.appcastURLDefaultsKey)
             }
@@ -543,39 +394,128 @@ enum PickerSelfTest {
         let (model, isolatedRoot) = try makeIsolatedUpdateModel()
         defer { try? fm.removeItem(at: isolatedRoot) }
 
+        // (a) NEGATIVE — invalidly-signed payload must never be offered or staged.
         await model.updateChecker.checkNow()
+        guard model.updateAvailable == nil else {
+            throw UpdateSelfTestError.detail(
+                "reject-unsigned: updateAvailable=\(model.updateAvailable?.version ?? "nil") (expected nil)"
+            )
+        }
+        guard model.updateChecker.statusMessage == "Update is not signed by MMD — not installed." else {
+            throw UpdateSelfTestError.detail(
+                "reject-unsigned: statusMessage=\(model.updateChecker.statusMessage ?? "nil")"
+            )
+        }
+        print("UPDATE-SELFTEST reject-unsigned PASS")
+        fflush(stdout)
 
+        // (b) POSITIVE — re-sign the same bundle, re-zip, re-serve; must now stage.
+        let signIdentity = ProcessInfo.processInfo.environment["SHOTDECK_SELFTEST_SIGN_IDENTITY"]
+            ?? "Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
+        try runCodesign(identity: signIdentity, path: fakeApp.path)
+        try writeZipAndAppcast()
+
+        await model.updateChecker.checkNow()
         guard model.updateAvailable?.version == "99.0.0" else {
             throw UpdateSelfTestError.detail(
-                "updateAvailable=\(model.updateAvailable?.version ?? "nil")"
+                "staged-signed: updateAvailable=\(model.updateAvailable?.version ?? "nil")"
             )
         }
         guard let staged = model.updateChecker.stagedAppURL else {
-            throw UpdateSelfTestError.detail("staged payload missing")
+            throw UpdateSelfTestError.detail("staged-signed: staged payload missing")
         }
         guard staged.lastPathComponent == "Redline.app" else {
-            throw UpdateSelfTestError.detail("staged name \(staged.lastPathComponent)")
+            throw UpdateSelfTestError.detail("staged-signed: staged name \(staged.lastPathComponent)")
         }
         let stagedExe = staged.appendingPathComponent("Contents/MacOS/Shotdeck")
         guard fm.fileExists(atPath: stagedExe.path) else {
-            throw UpdateSelfTestError.detail("staged Contents/MacOS/Shotdeck missing")
+            throw UpdateSelfTestError.detail("staged-signed: staged Contents/MacOS/Shotdeck missing")
         }
+        print("UPDATE-SELFTEST staged-signed PASS")
+        fflush(stdout)
 
-        let targetRoot = outputDirectory.appendingPathComponent("target", isDirectory: true)
-        if fm.fileExists(atPath: targetRoot.path) {
-            try fm.removeItem(at: targetRoot)
+        // (c) ATOMIC INSTALL — a throwaway target pre-populated with the real
+        // running version; never `/Applications`.
+        let tempAppsRoot = outputDirectory.appendingPathComponent("Applications", isDirectory: true)
+        if fm.fileExists(atPath: tempAppsRoot.path) {
+            try fm.removeItem(at: tempAppsRoot)
         }
-        let target = targetRoot.appendingPathComponent("Redline.app")
-        model.updateChecker.installStaged(to: target)
+        try fm.createDirectory(at: tempAppsRoot, withIntermediateDirectories: true)
+        let tempTarget = tempAppsRoot.appendingPathComponent("Redline.app")
+        try fm.copyItem(at: sourceApp, to: tempTarget)
 
-        let installedPlist = target.appendingPathComponent("Contents/Info.plist")
-        guard let installed = NSDictionary(contentsOf: installedPlist) as? [String: Any],
-              let installedVersion = installed["CFBundleShortVersionString"] as? String
-        else {
-            throw UpdateSelfTestError.detail("installed Info.plist unreadable")
+        model.updateChecker.installStaged(to: tempTarget)
+
+        guard let installedVersion = readShortVersion(atAppURL: tempTarget) else {
+            throw UpdateSelfTestError.detail("atomic-install: installed Info.plist unreadable")
         }
         guard installedVersion == "99.0.0" else {
-            throw UpdateSelfTestError.detail("installed version \(installedVersion)")
+            throw UpdateSelfTestError.detail("atomic-install: installed version \(installedVersion)")
+        }
+        let previousCopy = tempAppsRoot.appendingPathComponent("Redline.app.previous")
+        guard let previousVersionAfterInstall = readShortVersion(atAppURL: previousCopy) else {
+            throw UpdateSelfTestError.detail("atomic-install: Redline.app.previous missing or unreadable")
+        }
+        guard previousVersionAfterInstall == originalVersion else {
+            throw UpdateSelfTestError.detail(
+                "atomic-install: previous version=\(previousVersionAfterInstall) expected=\(originalVersion)"
+            )
+        }
+        try assertNoLeftoverEntries(in: tempAppsRoot, expecting: ["Redline.app", "Redline.app.previous"])
+        print("UPDATE-SELFTEST atomic-install PASS")
+        fflush(stdout)
+
+        // (d) REVERT — the rollback copy swaps back in; the just-replaced version
+        // becomes the new rollback copy, so a revert is itself reversible.
+        model.updateChecker.revertToPrevious(target: tempTarget)
+
+        guard let revertedVersion = readShortVersion(atAppURL: tempTarget) else {
+            throw UpdateSelfTestError.detail("revert: reverted Info.plist unreadable")
+        }
+        guard revertedVersion == originalVersion else {
+            throw UpdateSelfTestError.detail("revert: target version=\(revertedVersion) expected=\(originalVersion)")
+        }
+        guard let previousVersionAfterRevert = readShortVersion(atAppURL: previousCopy) else {
+            throw UpdateSelfTestError.detail("revert: Redline.app.previous missing or unreadable")
+        }
+        guard previousVersionAfterRevert == "99.0.0" else {
+            throw UpdateSelfTestError.detail(
+                "revert: previous version=\(previousVersionAfterRevert) expected=99.0.0"
+            )
+        }
+        try assertNoLeftoverEntries(in: tempAppsRoot, expecting: ["Redline.app", "Redline.app.previous"])
+        print("UPDATE-SELFTEST revert PASS")
+        fflush(stdout)
+    }
+
+    private static func readShortVersion(atAppURL url: URL) -> String? {
+        let plistURL = url.appendingPathComponent("Contents/Info.plist")
+        guard let dict = NSDictionary(contentsOf: plistURL) as? [String: Any] else { return nil }
+        return dict["CFBundleShortVersionString"] as? String
+    }
+
+    private static func runCodesign(identity: String, path: String) throws {
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/codesign")
+        process.arguments = ["--force", "--deep", "--sign", identity, path]
+        let err = Pipe()
+        process.standardError = err
+        process.standardOutput = Pipe()
+        try process.run()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let message = String(data: err.fileHandleForReading.readDataToEndOfFile(), encoding: .utf8) ?? ""
+            throw UpdateSelfTestError.detail("codesign failed: \(message)")
+        }
+    }
+
+    private static func assertNoLeftoverEntries(in directory: URL, expecting expected: Set<String>) throws {
+        let entries = (try? FileManager.default.contentsOfDirectory(atPath: directory.path)) ?? []
+        let unexpected = entries.filter { !expected.contains($0) }
+        guard unexpected.isEmpty else {
+            throw UpdateSelfTestError.detail(
+                "unexpected entries in \(directory.path): \(unexpected.joined(separator: ", "))"
+            )
         }
     }
 
@@ -599,7 +539,7 @@ enum PickerSelfTest {
             watchFolder: root.appendingPathComponent("watch", isDirectory: true)
         )
         let ledger = try ReturnLedger(paths: paths)
-        let model = try AppModel(
+        let model = AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),
@@ -698,12 +638,3 @@ private enum UpdateSelfTestError: Error, CustomStringConvertible {
         }
     }
 }
-
-private enum HistorySelfTestError: Error, CustomStringConvertible {
-    case detail(String)
-    var description: String {
-        switch self {
-        case .detail(let s): return s
-        }
-    }
-}

Sources/Shotdeck/SendController.swift

@@ -100,8 +100,6 @@ extension AppModel: SendCapable {
     /// `NSSharingServiceDelegate.sharingService(_:didShareItems:)` seam.
     func handleDidShareItems(fileName: String, pageCount: Int) async {
         guard !session.isEmpty else { return }
-        let sentSessionID = session.id
-        let sourceURL = lastComposedPDFURL ?? outboxURL.appendingPathComponent(fileName)
         do {
             _ = try await spool.archiveCurrent(pdfFileName: fileName)
             replaceSession(try await spool.currentSession())
@@ -109,20 +107,6 @@ extension AppModel: SendCapable {
             setStatus("Sent — \(pageCount) \(pageWord).")
         } catch {
             setStatus((error as? ShotdeckError)?.errorDescription ?? "Could not archive the session.")
-            return
-        }
-        do {
-            _ = try await historyStore.recordSentPDF(
-                sourceURL: sourceURL,
-                sessionID: sentSessionID,
-                pageCount: pageCount,
-                sentAt: Date()
-            )
-            try await historyStore.pruneImages()
-        } catch {
-            Log.spool.error(
-                "Could not record sent PDF into history at \(sourceURL.path, privacy: .public): \(error.localizedDescription, privacy: .public)"
-            )
         }
     }
 

Sources/Shotdeck/UpdateChecker.swift

@@ -1,6 +1,7 @@
 import AppKit
 import CryptoKit
 import Foundation
+import Security
 
 /// Built-in updater. Checks an appcast, stages a verified payload, and installs
 /// only when the user clicks the menu row — never automatically.
@@ -10,22 +11,31 @@ final class UpdateChecker {
     static let defaultAppcastURL = URL(string: "https://get.baobab-ts.com/cowork/redline/appcast.json")!
     static let defaultInstallTarget = URL(fileURLWithPath: "/Applications/Redline.app")
 
+    /// Required bundle identifier for any staged or installed payload.
+    static let expectedBundleIdentifier = "ai.flowmaster.shotdeck"
+    /// Developer team identifiers MMD ships Redline under. Overridable only for the self-test.
+    static let allowedTeamIdentifiers: Set<String> = ["PWMCBMX5M8", "L3N9S54CN3"]
+
     private(set) var availableUpdate: (version: String, notes: String)?
     private(set) var stagedAppURL: URL?
     private(set) var statusMessage: String?
+    private(set) var lastCheckedAt: Date?
+    private(set) var isCheckingNow: Bool = false
 
     var onChecked: (() -> Void)?
+    /// Fired whenever `isCheckingNow` flips, so a UI can show "Checking…" for the
+    /// whole duration of a check rather than only after it lands.
+    var onCheckingChanged: ((Bool) -> Void)?
 
     private let urlSession: URLSession
     private var repeatingTimer: Timer?
     private var firstCheckTask: Task<Void, Never>?
-    private var isChecking = false
     private var stagingDirectory: URL?
 
     init() {
         let config = URLSessionConfiguration.ephemeral
-        config.timeoutIntervalForRequest = 15
-        config.timeoutIntervalForResource = 15
+        config.timeoutIntervalForRequest = 30
+        config.timeoutIntervalForResource = 600
         config.httpCookieAcceptPolicy = .never
         config.httpShouldSetCookies = false
         config.httpCookieStorage = nil
@@ -51,10 +61,18 @@ final class UpdateChecker {
         repeatingTimer = timer
     }
 
-    func checkNow() async {
-        guard !isChecking else { return }
-        isChecking = true
-        defer { isChecking = false }
+    /// Checks the appcast and stages a newer, signature-verified payload.
+    /// `manual` only affects the status message shown when already up to date —
+    /// a user-initiated check says so; the silent background check stays quiet.
+    func checkNow(manual: Bool = false) async {
+        guard !isCheckingNow else { return }
+        isCheckingNow = true
+        onCheckingChanged?(true)
+        defer {
+            isCheckingNow = false
+            onCheckingChanged?(false)
+        }
+        lastCheckedAt = Date()
 
         let appcast: Appcast
         do {
@@ -67,7 +85,7 @@ final class UpdateChecker {
 
         guard Self.isNewer(appcast.version, than: Self.currentVersion()) else {
             clearOffer()
-            statusMessage = nil
+            statusMessage = manual ? "Redline \(Self.currentVersion()) is up to date." : nil
             onChecked?()
             return
         }
@@ -80,6 +98,10 @@ final class UpdateChecker {
             discardStaging()
             availableUpdate = nil
             statusMessage = "Update file failed the checksum — not installed."
+        } catch UpdateCheckError.signatureInvalid {
+            discardStaging()
+            availableUpdate = nil
+            statusMessage = "Update is not signed by MMD — not installed."
         } catch {
             discardStaging()
             availableUpdate = nil
@@ -88,9 +110,9 @@ final class UpdateChecker {
         onChecked?()
     }
 
-    /// Copies the staged app onto `target` with ditto (in place; never deletes the old app).
-    /// Relaunches unless `SHOTDECK_UPDATE_SELFTEST` is set, so the in-process self-test
-    /// can assert the installed Info.plist without killing the process.
+    /// Installs the staged app onto `target` atomically, keeping exactly one rollback
+    /// copy (`Redline.app.previous`), then hands off to a relaunch and quits.
+    /// Never deletes the old app before the new one is verified in place.
     func installStaged(to target: URL = UpdateChecker.defaultInstallTarget) {
         guard let staged = stagedAppURL else {
             statusMessage = "No update is staged."
@@ -98,29 +120,118 @@ final class UpdateChecker {
             return
         }
 
+        let targetDir = target.deletingLastPathComponent()
+        let previousURL = targetDir.appendingPathComponent("Redline.app.previous")
+
         do {
-            try FileManager.default.createDirectory(
-                at: target.deletingLastPathComponent(),
-                withIntermediateDirectories: true
+            try FileManager.default.createDirectory(at: targetDir, withIntermediateDirectories: true)
+
+            let replacementDir = try FileManager.default.url(
+                for: .itemReplacementDirectory,
+                in: .userDomainMask,
+                appropriateFor: target,
+                create: true
             )
-            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, target.path])
+            defer { try? FileManager.default.removeItem(at: replacementDir) }
+
+            let newCopy = replacementDir.appendingPathComponent(target.lastPathComponent)
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [staged.path, newCopy.path])
+
+            // Exactly one rollback copy is kept — drop any older one before this install.
+            if FileManager.default.fileExists(atPath: previousURL.path) {
+                try FileManager.default.removeItem(at: previousURL)
+            }
+
+            if FileManager.default.fileExists(atPath: target.path) {
+                _ = try FileManager.default.replaceItemAt(
+                    target,
+                    withItemAt: newCopy,
+                    backupItemName: previousURL.lastPathComponent,
+                    options: [.withoutDeletingBackupItem]
+                )
+            } else {
+                try FileManager.default.moveItem(at: newCopy, to: target)
+            }
         } catch {
             statusMessage = "The update could not be installed."
             onChecked?()
             return
         }
 
-        let isSelfTest = ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
-        if isSelfTest { return }
-
+        // Defense in depth: re-verify what actually landed on disk, not just the staged copy.
         do {
-            try Self.runProcess(executable: "/usr/bin/open", arguments: ["-n", target.path])
+            try Self.verifySignature(of: target)
         } catch {
-            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            statusMessage = "The update was installed but failed verification."
             onChecked?()
             return
         }
-        NSApp.terminate(nil)
+
+        discardStaging()
+        availableUpdate = nil
+        relaunch(target: target)
+    }
+
+    /// Swaps `Redline.app.previous` back into place, verifying its signature first.
+    /// The just-replaced (newer) app becomes the new `.previous` — a revert is
+    /// itself reversible.
+    func revertToPrevious(target: URL = UpdateChecker.defaultInstallTarget) {
+        let targetDir = target.deletingLastPathComponent()
+        let previousURL = targetDir.appendingPathComponent("Redline.app.previous")
+
+        guard FileManager.default.fileExists(atPath: previousURL.path) else {
+            statusMessage = "No previous version to revert to."
+            onChecked?()
+            return
+        }
+
+        do {
+            try Self.verifySignature(of: previousURL)
+        } catch {
+            statusMessage = "The previous version failed verification and was not restored."
+            onChecked?()
+            return
+        }
+
+        do {
+            // `previousURL` cannot be handed to replaceItemAt directly: its own path
+            // IS the requested backup name, so the backup step would clobber it
+            // before the swap ever reads it. Stage a throwaway copy first, exactly
+            // like installStaged does for the forward direction.
+            let replacementDir = try FileManager.default.url(
+                for: .itemReplacementDirectory,
+                in: .userDomainMask,
+                appropriateFor: target,
+                create: true
+            )
+            defer { try? FileManager.default.removeItem(at: replacementDir) }
+
+            let newCopy = replacementDir.appendingPathComponent(target.lastPathComponent)
+            try Self.runProcess(executable: "/usr/bin/ditto", arguments: [previousURL.path, newCopy.path])
+            try FileManager.default.removeItem(at: previousURL)
+
+            _ = try FileManager.default.replaceItemAt(
+                target,
+                withItemAt: newCopy,
+                backupItemName: previousURL.lastPathComponent,
+                options: [.withoutDeletingBackupItem]
+            )
+        } catch {
+            statusMessage = "Could not revert to the previous version."
+            onChecked?()
+            return
+        }
+
+        relaunch(target: target)
+    }
+
+    /// The version recorded in `Redline.app.previous`'s Info.plist, or nil when no
+    /// rollback copy exists.
+    func previousVersion(target: URL = UpdateChecker.defaultInstallTarget) -> String? {
+        let previousURL = target.deletingLastPathComponent().appendingPathComponent("Redline.app.previous")
+        let plistURL = previousURL.appendingPathComponent("Contents/Info.plist")
+        guard let plist = NSDictionary(contentsOf: plistURL) as? [String: Any] else { return nil }
+        return plist["CFBundleShortVersionString"] as? String
     }
 
     static func resolvedAppcastURL() -> URL {
@@ -156,6 +267,67 @@ final class UpdateChecker {
         SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()
     }
 
+    /// Validates the code signature of the app at `appURL`: strictly, across all
+    /// architectures and nested code, then checks its bundle identifier and team
+    /// identifier against `expectedBundleIdentifier` / the allowed-teams set.
+    /// `REDLINE_ALLOWED_TEAMS` (comma separated) overrides the allowed set — for
+    /// the self-test only, so it can accept a locally re-signed fake bundle.
+    static func verifySignature(of appURL: URL) throws {
+        var staticCode: SecStaticCode?
+        let createStatus = SecStaticCodeCreateWithPath(appURL as CFURL, [], &staticCode)
+        guard createStatus == errSecSuccess, let code = staticCode else {
+            throw UpdateCheckError.signatureInvalid(
+                "could not read a code signature (status \(createStatus))"
+            )
+        }
+
+        let validityFlags = SecCSFlags(
+            rawValue: kSecCSStrictValidate | kSecCSCheckAllArchitectures | kSecCSCheckNestedCode
+        )
+        var validityError: Unmanaged<CFError>?
+        let validityStatus = SecStaticCodeCheckValidityWithErrors(code, validityFlags, nil, &validityError)
+        guard validityStatus == errSecSuccess else {
+            let detail = (validityError?.takeRetainedValue()).map { String(describing: $0) } ?? "status \(validityStatus)"
+            throw UpdateCheckError.signatureInvalid("signature is not valid: \(detail)")
+        }
+
+        var signingInfo: CFDictionary?
+        let infoStatus = SecCodeCopySigningInformation(
+            code,
+            SecCSFlags(rawValue: kSecCSSigningInformation),
+            &signingInfo
+        )
+        guard infoStatus == errSecSuccess, let info = signingInfo as? [String: Any] else {
+            throw UpdateCheckError.signatureInvalid("could not read signing information (status \(infoStatus))")
+        }
+
+        let identifier = info[kSecCodeInfoIdentifier as String] as? String
+        guard identifier == expectedBundleIdentifier else {
+            throw UpdateCheckError.signatureInvalid(
+                "unexpected bundle identifier: \(identifier ?? "nil")"
+            )
+        }
+
+        let teamIdentifier = info[kSecCodeInfoTeamIdentifier as String] as? String
+        guard let teamIdentifier, resolvedAllowedTeamIdentifiers().contains(teamIdentifier) else {
+            throw UpdateCheckError.signatureInvalid(
+                "unexpected team identifier: \(teamIdentifier ?? "nil")"
+            )
+        }
+    }
+
+    private static func resolvedAllowedTeamIdentifiers() -> Set<String> {
+        if let env = ProcessInfo.processInfo.environment["REDLINE_ALLOWED_TEAMS"], !env.isEmpty {
+            let parts = env.split(separator: ",")
+                .map { $0.trimmingCharacters(in: .whitespaces) }
+                .filter { !$0.isEmpty }
+            if !parts.isEmpty {
+                return Set(parts)
+            }
+        }
+        return allowedTeamIdentifiers
+    }
+
     // MARK: - Private
 
     private struct Appcast: Decodable {
@@ -170,6 +342,7 @@ final class UpdateChecker {
         case invalidPayload
         case httpStatus(Int)
         case processFailed(String)
+        case signatureInvalid(String)
     }
 
     private func fetchAppcast() async throws -> Appcast {
@@ -219,6 +392,7 @@ final class UpdateChecker {
         guard FileManager.default.fileExists(atPath: executable.path) else {
             throw UpdateCheckError.invalidPayload
         }
+        try Self.verifySignature(of: appURL)
         stagedAppURL = appURL
     }
 
@@ -235,6 +409,35 @@ final class UpdateChecker {
         stagedAppURL = nil
     }
 
+    /// Spawns a detached watcher that waits for this process to exit, then reopens
+    /// `target`, and quits. Never called during the self-test, so the in-process
+    /// assertions after `installStaged`/`revertToPrevious` can still run.
+    private func relaunch(target: URL) {
+        guard ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] == nil else { return }
+
+        let ownPID = ProcessInfo.processInfo.processIdentifier
+        let script = "while kill -0 \(ownPID) 2>/dev/null; do sleep 0.2; done; " +
+            "/usr/bin/open -n \(Self.shellQuoted(target.path))"
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/bin/sh")
+        process.arguments = ["-c", script]
+        process.standardInput = FileHandle.nullDevice
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+        do {
+            try process.run()
+        } catch {
+            statusMessage = "The update was installed but Redline could not relaunch. Open it from Applications."
+            onChecked?()
+            return
+        }
+        NSApp.terminate(nil)
+    }
+
+    private static func shellQuoted(_ path: String) -> String {
+        "'" + path.replacingOccurrences(of: "'", with: "'\\''") + "'"
+    }
+
     private static func findRedlineApp(in directory: URL) -> URL? {
         let fm = FileManager.default
         let direct = directory.appendingPathComponent("Redline.app")

Sources/Shotdeck/main.swift

@@ -9,8 +9,6 @@ if ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil {
 }
 if ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil {
     MainActor.assumeIsolated { PickerSelfTest.runIfRequested() }
-} else if ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"] != nil {
-    MainActor.assumeIsolated { PickerSelfTest.runHistoryIfRequested() }
 }
 ShotdeckApp.main()
 
@@ -23,8 +21,9 @@ struct ShotdeckApp: App {
                 .environment(appDelegate.model)
         } label: {
             let state = appDelegate.model.iconState
+            let hasUpdate = appDelegate.model.updateAvailable != nil
             HStack(spacing: 4) {
-                Image(systemName: state.symbolName)
+                menuBarIcon(for: state, hasUpdate: hasUpdate)
                 if let count = state.countText {
                     Text(count).font(.system(size: 11, weight: .semibold))
                 }
@@ -35,6 +34,29 @@ struct ShotdeckApp: App {
     }
 }
 
+/// The menu-bar symbol for `state`, badged while an update is staged. Uses the
+/// SF Symbol's own `.badge` variant when one exists; falls back to a small
+/// overlaid dot on the plain symbol otherwise. The badge disappears on its own
+/// once `updateAvailable` clears, since this reads live model state.
+@ViewBuilder
+private func menuBarIcon(for state: MenuIconState, hasUpdate: Bool) -> some View {
+    if hasUpdate {
+        let badgeName = "\(state.symbolName).badge"
+        if NSImage(systemSymbolName: badgeName, accessibilityDescription: nil) != nil {
+            Image(systemName: badgeName)
+        } else {
+            ZStack(alignment: .topTrailing) {
+                Image(systemName: state.symbolName)
+                Circle()
+                    .frame(width: 6, height: 6)
+                    .offset(x: 3, y: -3)
+            }
+        }
+    } else {
+        Image(systemName: state.symbolName)
+    }
+}
+
 @MainActor
 final class AppDelegate: NSObject, NSApplicationDelegate {
     let model: AppModel
@@ -69,7 +91,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 
     private static func makeModel(paths: AppSupportPaths) throws -> AppModel {
         let ledger = try ReturnLedger(paths: paths)
-        return try AppModel(
+        return AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),

Sources/ShotdeckCore/History/HistoryStore.swift

@@ -1,446 +0,0 @@
-import Foundation
-
-/// Retention ruling (2026-09-02). Ben's instruction is the authority that
-/// supersedes the earlier D-11 never-delete rule FOR THIS STORE only:
-///
-///     "the last 10 files are saved, and the past 30 images, and cleared up
-///     afterwards. user should be able to select from those and send again."
-///
-/// App-managed copies live under `AppSupportPaths.root/history/`. Pruning
-/// unlinks files under `history/pdfs/` and archived capture PNGs beyond the
-/// newest 30. It never deletes a user file, never touches the outbox PDF, and
-/// never touches the open spool session (D-11 still applies there).
-
-/// One sent-PDF copy retained for re-send. The file at `fileURL` is the
-/// app-managed copy under `history/pdfs/`, not the user's original.
-public struct HistoryEntry: Codable, Sendable, Equatable, Identifiable {
-    public let id: UUID
-    public let fileName: String
-    public let fileURL: URL
-    public let originalFileName: String
-    public let sessionID: UUID?
-    public let pageCount: Int
-    public let sentAt: Date
-
-    public init(
-        id: UUID,
-        fileName: String,
-        fileURL: URL,
-        originalFileName: String,
-        sessionID: UUID?,
-        pageCount: Int,
-        sentAt: Date
-    ) {
-        self.id = id
-        self.fileName = fileName
-        self.fileURL = fileURL
-        self.originalFileName = originalFileName
-        self.sessionID = sessionID
-        self.pageCount = pageCount
-        self.sentAt = sentAt
-    }
-}
-
-/// A capture PNG on disk under an archived session, listed for re-send.
-/// `path` is the real file; HistoryStore never copies images.
-public struct ImageRef: Sendable, Equatable {
-    public let path: URL
-    public let capturedAt: Date
-    public let sessionID: UUID
-
-    public init(path: URL, capturedAt: Date, sessionID: UUID) {
-        self.path = path
-        self.capturedAt = capturedAt
-        self.sessionID = sessionID
-    }
-}
-
-public actor HistoryStore {
-    public static let pdfRetentionCount = 10
-    public static let imageRetentionCount = 30
-
-    private let paths: AppSupportPaths
-    private let historyRoot: URL
-    private let pdfsDirectory: URL
-    private let manifestURL: URL
-    private var entries: [HistoryEntry]
-
-    public init(paths: AppSupportPaths) throws {
-        self.paths = paths
-        self.historyRoot = paths.root.appendingPathComponent("history", isDirectory: true)
-        self.pdfsDirectory = historyRoot.appendingPathComponent("pdfs", isDirectory: true)
-        self.manifestURL = historyRoot.appendingPathComponent("history.json")
-        do {
-            try FileManager.default.createDirectory(at: historyRoot, withIntermediateDirectories: true)
-            try FileManager.default.createDirectory(at: pdfsDirectory, withIntermediateDirectories: true)
-        } catch {
-            throw ShotdeckError.spoolWriteFailed(
-                path: historyRoot.path,
-                underlying: error.localizedDescription
-            )
-        }
-        self.entries = try Self.loadEntries(from: manifestURL, pdfsDirectory: pdfsDirectory)
-    }
-
-    /// Copies `sourceURL` into `history/pdfs/` (never moves or writes the
-    /// user's file), appends an entry, then keeps the 10 newest PDF copies.
-    public func recordSentPDF(
-        sourceURL: URL,
-        sessionID: UUID?,
-        pageCount: Int,
-        sentAt: Date
-    ) throws -> HistoryEntry {
-        let fm = FileManager.default
-        guard fm.fileExists(atPath: sourceURL.path) else {
-            throw ShotdeckError.spoolWriteFailed(
-                path: sourceURL.path,
-                underlying: "source PDF does not exist"
-            )
-        }
-        let data: Data
-        do {
-            data = try Data(contentsOf: sourceURL)
-        } catch {
-            throw ShotdeckError.spoolWriteFailed(
-                path: sourceURL.path,
-                underlying: error.localizedDescription
-            )
-        }
-
-        let id = UUID()
-        let fileName = "\(DubaiTime.fileStamp(sentAt))-\(id.uuidString.lowercased()).pdf"
-        let destURL = pdfsDirectory.appendingPathComponent(fileName)
-        try AtomicFile.write(data, to: destURL)
-
-        let entry = HistoryEntry(
-            id: id,
-            fileName: fileName,
-            fileURL: destURL,
-            originalFileName: sourceURL.lastPathComponent,
-            sessionID: sessionID,
-            pageCount: pageCount,
-            sentAt: sentAt
-        )
-        entries.append(entry)
-        try prunePDFEntries()
-        return entry
-    }
-
-    /// Newest first, at most `pdfRetentionCount`.
-    public func listPDFs() -> [HistoryEntry] {
-        Array(sortedPDFs().prefix(Self.pdfRetentionCount))
-    }
-
-    /// The newest capture PNGs across `archive/` sessions (including
-    /// `removed/`). Does not copy files and does not look at the open spool.
-    public func listImages(limit: Int = 30) throws -> [ImageRef] {
-        let images = try collectArchivedImages()
-        return images.prefix(max(limit, 0)).map(\.ref)
-    }
-
-    /// Across archived sessions only: keep the 30 newest PNGs total (including
-    /// `removed/`); delete older PNGs, drop them from `session.json`, and
-    /// remove a session directory left with zero PNGs. Never touches spool/.
-    public func pruneImages() throws {
-        let fm = FileManager.default
-        let images = try collectArchivedImages()
-        let keepCount = Self.imageRetentionCount
-        let doomed = Array(images.dropFirst(keepCount))
-        guard !doomed.isEmpty else { return }
-
-        var remainingBySession: [UUID: CaptureSession] = [:]
-        var dirBySession: [UUID: URL] = [:]
-        for item in images {
-            remainingBySession[item.session.id] = item.session
-            dirBySession[item.session.id] = item.sessionDir
-        }
-
-        var droppedIDs: [UUID: Set<UUID>] = [:]
-        for item in doomed {
-            try deleteIfPrunableImage(item.ref.path)
-            if let captureID = item.captureID {
-                droppedIDs[item.session.id, default: []].insert(captureID)
-            }
-        }
-
-        for (sessionID, ids) in droppedIDs {
-            guard var session = remainingBySession[sessionID] else { continue }
-            for id in ids {
-                session = session.removing(captureID: id)
-            }
-            remainingBySession[sessionID] = session
-        }
-
-        let touchedIDs = Set(doomed.map(\.session.id))
-        for sessionID in touchedIDs {
-            guard let sessionDir = dirBySession[sessionID] else { continue }
-            guard isUnderArchive(sessionDir), !isUnderSpool(sessionDir) else { continue }
-
-            if pngsRemaining(in: sessionDir).isEmpty {
-                if fm.fileExists(atPath: sessionDir.path) {
-                    try fm.removeItem(at: sessionDir)
-                    Log.spool.warning("Pruned \(sessionDir.path, privacy: .public)")
-                }
-                try AtomicFile.fsyncDirectory(at: paths.archive)
-                continue
-            }
-
-            if let session = remainingBySession[sessionID], droppedIDs[sessionID] != nil {
-                try AtomicFile.writeJSON(
-                    session,
-                    to: sessionDir.appendingPathComponent("session.json")
-                )
-            }
-        }
-    }
-
-    // MARK: - PDF retention
-
-    private func prunePDFEntries() throws {
-        let sorted = sortedPDFs()
-        let kept = Array(sorted.prefix(Self.pdfRetentionCount))
-        let discarded = sorted.dropFirst(Self.pdfRetentionCount)
-        for entry in discarded {
-            let url = pdfsDirectory.appendingPathComponent(entry.fileName)
-            try deleteIfAppManagedPDF(url)
-        }
-        entries = kept
-        try persistEntries()
-    }
-
-    private func sortedPDFs() -> [HistoryEntry] {
-        entries.sorted { lhs, rhs in
-            if lhs.sentAt != rhs.sentAt { return lhs.sentAt > rhs.sentAt }
-            return lhs.id.uuidString > rhs.id.uuidString
-        }
-    }
-
-    private func persistEntries() throws {
-        try AtomicFile.writeJSON(entries, to: manifestURL)
-    }
-
-    private func deleteIfAppManagedPDF(_ url: URL) throws {
-        guard isUnderPDFs(url) else { return }
-        let fm = FileManager.default
-        guard fm.fileExists(atPath: url.path) else { return }
-        do {
-            try fm.removeItem(at: url)
-        } catch {
-            throw ShotdeckError.spoolWriteFailed(
-                path: url.path,
-                underlying: error.localizedDescription
-            )
-        }
-        Log.spool.warning("Pruned \(url.path, privacy: .public)")
-        try AtomicFile.fsyncDirectory(at: pdfsDirectory)
-    }
-
-    // MARK: - Archived images
-
-    private struct ArchivedImage {
-        let ref: ImageRef
-        let session: CaptureSession
-        let sessionDir: URL
-        let captureID: UUID?
-    }
-
-    private func collectArchivedImages() throws -> [ArchivedImage] {
-        let dirs = try archivedSessionDirectories()
-        var collected: [ArchivedImage] = []
-        for dir in dirs {
-            let sessionID = UUID(uuidString: dir.lastPathComponent) ?? UUID()
-            let session = (try? loadSession(at: dir, id: sessionID))
-                ?? CaptureSession(
-                    id: sessionID,
-                    createdAt: fileDate(dir) ?? Date(),
-                    state: .archived,
-                    captures: [],
-                    pdfFileName: nil
-                )
-            var referenced = Set<String>()
-            for capture in session.captures {
-                let url = dir.appendingPathComponent(capture.fileName)
-                guard FileManager.default.fileExists(atPath: url.path) else { continue }
-                referenced.insert(capture.fileName)
-                collected.append(
-                    ArchivedImage(
-                        ref: ImageRef(path: url, capturedAt: capture.capturedAt, sessionID: session.id),
-                        session: session,
-                        sessionDir: dir,
-                        captureID: capture.id
-                    )
-                )
-            }
-            let removedDir = dir.appendingPathComponent("removed", isDirectory: true)
-            for url in pngFiles(in: dir) where !referenced.contains(url.lastPathComponent) {
-                collected.append(
-                    ArchivedImage(
-                        ref: ImageRef(
-                            path: url,
-                            capturedAt: fileDate(url) ?? .distantPast,
-                            sessionID: session.id
-                        ),
-                        session: session,
-                        sessionDir: dir,
-                        captureID: nil
-                    )
-                )
-            }
-            for url in pngFiles(in: removedDir) {
-                collected.append(
-                    ArchivedImage(
-                        ref: ImageRef(
-                            path: url,
-                            capturedAt: fileDate(url) ?? .distantPast,
-                            sessionID: session.id
-                        ),
-                        session: session,
-                        sessionDir: dir,
-                        captureID: nil
-                    )
-                )
-            }
-        }
-        return collected.sorted { lhs, rhs in
-            if lhs.ref.capturedAt != rhs.ref.capturedAt {
-                return lhs.ref.capturedAt > rhs.ref.capturedAt
-            }
-            return lhs.ref.path.path > rhs.ref.path.path
-        }
-    }
-
-    private func archivedSessionDirectories() throws -> [URL] {
-        let fm = FileManager.default
-        let entries: [URL]
-        do {
-            entries = try fm.contentsOfDirectory(
-                at: paths.archive,
-                includingPropertiesForKeys: [.isDirectoryKey],
-                options: []
-            )
-        } catch {
-            throw ShotdeckError.spoolWriteFailed(
-                path: paths.archive.path,
-                underlying: error.localizedDescription
-            )
-        }
-        return entries.filter { url in
-            let isDirectory = (try? url.resourceValues(forKeys: [.isDirectoryKey]).isDirectory) ?? false
-            return isDirectory && UUID(uuidString: url.lastPathComponent) != nil
-        }
-    }
-
-    private func loadSession(at dir: URL, id: UUID) throws -> CaptureSession {
-        let url = dir.appendingPathComponent("session.json")
-        let data = try Data(contentsOf: url)
-        let decoder = JSONDecoder()
-        decoder.dateDecodingStrategy = .iso8601
-        let session = try decoder.decode(CaptureSession.self, from: data)
-        guard session.id == id else {
-            throw ShotdeckError.manifestCorrupt(path: url.path)
-        }
-        return session
-    }
-
-    private func pngFiles(in dir: URL) -> [URL] {
-        let fm = FileManager.default
-        guard fm.fileExists(atPath: dir.path) else { return [] }
-        let entries = (try? fm.contentsOfDirectory(
-            at: dir,
-            includingPropertiesForKeys: [.isDirectoryKey],
-            options: []
-        )) ?? []
-        return entries.filter { url in
-            let isDirectory = (try? url.resourceValues(forKeys: [.isDirectoryKey]).isDirectory) ?? false
-            return !isDirectory && url.pathExtension.lowercased() == "png"
-        }
-    }
-
-    private func pngsRemaining(in sessionDir: URL) -> [URL] {
-        pngFiles(in: sessionDir)
-            + pngFiles(in: sessionDir.appendingPathComponent("removed", isDirectory: true))
-    }
-
-    private func deleteIfPrunableImage(_ url: URL) throws {
-        guard isUnderArchive(url), !isUnderSpool(url) else { return }
-        let fm = FileManager.default
-        guard fm.fileExists(atPath: url.path) else { return }
-        do {
-            try fm.removeItem(at: url)
-        } catch {
-            throw ShotdeckError.spoolWriteFailed(
-                path: url.path,
-                underlying: error.localizedDescription
-            )
-        }
-        Log.spool.warning("Pruned \(url.path, privacy: .public)")
-        try AtomicFile.fsyncDirectory(at: url.deletingLastPathComponent())
-    }
-
-    private func fileDate(_ url: URL) -> Date? {
-        let values = try? url.resourceValues(forKeys: [.creationDateKey, .contentModificationDateKey])
-        return values?.creationDate ?? values?.contentModificationDate
-    }
-
-    // MARK: - Path guards
-
-    private func isUnderPDFs(_ url: URL) -> Bool {
-        isUnderDirectory(url, parent: pdfsDirectory)
-    }
-
-    private func isUnderArchive(_ url: URL) -> Bool {
-        isUnderDirectory(url, parent: paths.archive)
-    }
-
-    private func isUnderSpool(_ url: URL) -> Bool {
-        isUnderDirectory(url, parent: paths.spool)
-    }
-
-    private func isUnderDirectory(_ url: URL, parent: URL) -> Bool {
-        let parentPath = parent.standardizedFileURL.path
-        let path = url.standardizedFileURL.path
-        if path == parentPath { return true }
-        let prefix = parentPath.hasSuffix("/") ? parentPath : parentPath + "/"
-        return path.hasPrefix(prefix)
-    }
-
-    // MARK: - Manifest load
-
-    private static func loadEntries(from url: URL, pdfsDirectory: URL) throws -> [HistoryEntry] {
-        let fm = FileManager.default
-        guard fm.fileExists(atPath: url.path) else { return [] }
-        let data: Data
-        do {
-            data = try Data(contentsOf: url)
-        } catch {
-            throw ShotdeckError.spoolWriteFailed(
-                path: url.path,
-                underlying: error.localizedDescription
-            )
-        }
-        let decoder = JSONDecoder()
-        decoder.dateDecodingStrategy = .iso8601
-        do {
-            let decoded = try decoder.decode([HistoryEntry].self, from: data)
-            return decoded.map { entry in
-                HistoryEntry(
-                    id: entry.id,
-                    fileName: entry.fileName,
-                    fileURL: pdfsDirectory.appendingPathComponent(entry.fileName),
-                    originalFileName: entry.originalFileName,
-                    sessionID: entry.sessionID,
-                    pageCount: entry.pageCount,
-                    sentAt: entry.sentAt
-                )
-            }
-        } catch {
-            let corruptURL = url.deletingLastPathComponent()
-                .appendingPathComponent("history.json.corrupt-\(DubaiTime.fileStamp(Date()))")
-            try? fm.moveItem(at: url, to: corruptURL)
-            Log.spool.error(
-                "history.json could not be decoded; moved to \(corruptURL.path, privacy: .public): \(error.localizedDescription, privacy: .public)"
-            )
-            return []
-        }
-    }
-}

Tests/ShotdeckCoreTests/HistoryStoreTests.swift

@@ -1,319 +0,0 @@
-import CoreGraphics
-import Foundation
-import ImageIO
-import Testing
-import ShotdeckCore
-
-@Test
-func recordTwelvePDFsKeepsTenNewestAndDeletesOldestCopies() async throws {
-    let (root, paths) = try makeHistoryPaths()
-    defer { try? FileManager.default.removeItem(at: root) }
-
-    let store = try HistoryStore(paths: paths)
-    let sources = root.appendingPathComponent("user-sources", isDirectory: true)
-    try FileManager.default.createDirectory(at: sources, withIntermediateDirectories: true)
-
-    var recorded: [HistoryEntry] = []
-    for i in 0..<12 {
-        let source = sources.appendingPathComponent("source-\(i).pdf")
-        try writeDummyPDF(to: source, marker: "pdf-\(i)")
-        let sentAt = Date(timeIntervalSince1970: 1_800_000_000 + TimeInterval(i))
-        let entry = try await store.recordSentPDF(
-            sourceURL: source,
-            sessionID: UUID(),
-            pageCount: i + 1,
-            sentAt: sentAt
-        )
-        recorded.append(entry)
-    }
-
-    let listed = await store.listPDFs()
-    #expect(listed.count == 10)
-    #expect(listed.map(\.id) == recorded.suffix(10).reversed().map(\.id))
-    #expect(listed.map(\.sentAt) == recorded.suffix(10).reversed().map(\.sentAt))
-
-    let pdfsDir = paths.root.appendingPathComponent("history/pdfs", isDirectory: true)
-    for entry in recorded.prefix(2) {
-        #expect(!FileManager.default.fileExists(atPath: pdfsDir.appendingPathComponent(entry.fileName).path))
-    }
-    for entry in recorded.suffix(10) {
-        #expect(FileManager.default.fileExists(atPath: pdfsDir.appendingPathComponent(entry.fileName).path))
-    }
-}
-
-@Test
-func pruneImagesKeepsThirtyNewestAcrossThreeArchivedSessionsAndLeavesOpenSessionAlone() async throws {
-    let (root, paths) = try makeHistoryPaths()
-    defer { try? FileManager.default.removeItem(at: root) }
-
-    let spool = try SpoolStore(paths: paths)
-    let base = Date(timeIntervalSince1970: 1_800_100_000)
-    var captures: [(id: UUID, capturedAt: Date, sessionID: UUID)] = []
-
-    // 5 oldest + 15 + 15 = 35 archived PNGs. The oldest session is emptied by prune.
-    let perSession = [5, 15, 15]
-    var index = 0
-    for count in perSession {
-        let sessionID = try await spool.currentSession().id
-        for _ in 0..<count {
-            let capturedAt = base.addingTimeInterval(TimeInterval(index))
-            let capture = try await spool.append(
-                pngData: try makeHistoryPNGData(width: 6, height: 4, red: 0.2, green: 0.3, blue: 0.4),
-                pixelWidth: 6,
-                pixelHeight: 4,
-                scale: 1.0,
-                capturedAt: capturedAt
-            )
-            captures.append((capture.id, capturedAt, sessionID))
-            index += 1
-        }
-        _ = try await spool.archiveCurrent(pdfFileName: "Redline-hist-\(sessionID.uuidString).pdf")
-    }
-
-    let openBefore = try await spool.currentSession()
-    let openCapture = try await spool.append(
-        pngData: try makeHistoryPNGData(width: 8, height: 6, red: 0.9, green: 0.1, blue: 0.1),
-        pixelWidth: 8,
-        pixelHeight: 6,
-        scale: 1.0,
-        capturedAt: Date(timeIntervalSince1970: 1_900_000_000)
-    )
-    let openSession = try await spool.currentSession()
-    #expect(openSession.id == openBefore.id)
-    let openDir = paths.sessionDirectory(openSession.id)
-    let openPNG = openDir.appendingPathComponent(openCapture.fileName)
-    let openPNGBytes = try Data(contentsOf: openPNG)
-    let openManifest = try Data(contentsOf: openDir.appendingPathComponent("session.json"))
-
-    let store = try HistoryStore(paths: paths)
-    try await store.pruneImages()
-
-    let remaining = try await store.listImages(limit: 50)
-    #expect(remaining.count == 30)
-
-    let newestThirty = Array(captures.suffix(30))
-    let remainingDates = Set(remaining.map(\.capturedAt))
-    #expect(remainingDates == Set(newestThirty.map(\.capturedAt)))
-    #expect(remaining.map(\.sessionID).allSatisfy { $0 != openSession.id })
-
-    let oldestFive = Array(captures.prefix(5))
-    for old in oldestFive {
-        let archiveDir = paths.archiveDirectory(old.sessionID)
-        #expect(!FileManager.default.fileExists(atPath: archiveDir.path))
-    }
-
-    #expect(pngFiles(under: paths.archive).count == 30)
-    try assertManifestsMatchDisk(archiveRoot: paths.archive)
-
-    #expect(FileManager.default.fileExists(atPath: openPNG.path))
-    #expect(try Data(contentsOf: openPNG) == openPNGBytes)
-    #expect(try Data(contentsOf: openDir.appendingPathComponent("session.json")) == openManifest)
-    #expect(try await spool.currentSession().captures.map(\.id) == [openCapture.id])
-}
-
-@Test
-func recordSentPDFLeavesTheUserSourceUntouched() async throws {
-    let (root, paths) = try makeHistoryPaths()
-    defer { try? FileManager.default.removeItem(at: root) }
-
-    let source = root.appendingPathComponent("outside-appsupport.pdf")
-    let payload = Data("%PDF-1.4\n%user-original\n%%EOF\n".utf8)
-    try payload.write(to: source)
-
-    let store = try HistoryStore(paths: paths)
-    let entry = try await store.recordSentPDF(
-        sourceURL: source,
-        sessionID: UUID(),
-        pageCount: 2,
-        sentAt: Date(timeIntervalSince1970: 1_800_200_000)
-    )
-
-    #expect(FileManager.default.fileExists(atPath: source.path))
-    #expect(try Data(contentsOf: source) == payload)
-    #expect(entry.fileURL.path != source.path)
-    #expect(try Data(contentsOf: entry.fileURL) == payload)
-    #expect(entry.fileURL.path.hasPrefix(
-        paths.root.appendingPathComponent("history/pdfs", isDirectory: true).path
-    ))
-}
-
-@Test
-func recordingTheSameSourceTwiceMakesTwoDistinctCopies() async throws {
-    let (root, paths) = try makeHistoryPaths()
-    defer { try? FileManager.default.removeItem(at: root) }
-
-    let source = root.appendingPathComponent("resend.pdf")
-    try writeDummyPDF(to: source, marker: "same-source")
-
-    let store = try HistoryStore(paths: paths)
-    let first = try await store.recordSentPDF(
-        sourceURL: source,
-        sessionID: nil,
-        pageCount: 1,
-        sentAt: Date(timeIntervalSince1970: 1_800_300_000)
-    )
-    let second = try await store.recordSentPDF(
-        sourceURL: source,
-        sessionID: nil,
-        pageCount: 1,
-        sentAt: Date(timeIntervalSince1970: 1_800_300_001)
-    )
-
-    #expect(first.id != second.id)
-    #expect(first.fileName != second.fileName)
-    #expect(first.fileURL.path != second.fileURL.path)
-    #expect(FileManager.default.fileExists(atPath: first.fileURL.path))
-    #expect(FileManager.default.fileExists(atPath: second.fileURL.path))
-    let firstBytes = try Data(contentsOf: first.fileURL)
-    let secondBytes = try Data(contentsOf: second.fileURL)
-    #expect(firstBytes == secondBytes)
-    #expect(FileManager.default.fileExists(atPath: source.path))
-
-    let listed = await store.listPDFs()
-    #expect(listed.count == 2)
-    #expect(Set(listed.map(\.id)) == [first.id, second.id])
-}
-
-@Test
-func pruneImagesDeletesOlderPNGsInRemovedFolders() async throws {
-    let (root, paths) = try makeHistoryPaths()
-    defer { try? FileManager.default.removeItem(at: root) }
-
-    let spool = try SpoolStore(paths: paths)
-    let base = Date(timeIntervalSince1970: 1_800_400_000)
-    for i in 0..<30 {
-        _ = try await spool.append(
-            pngData: try makeHistoryPNGData(width: 4, height: 4, red: 0.1, green: 0.2, blue: 0.3),
-            pixelWidth: 4,
-            pixelHeight: 4,
-            scale: 1.0,
-            capturedAt: base.addingTimeInterval(TimeInterval(10 + i))
-        )
-    }
-    _ = try await spool.archiveCurrent(pdfFileName: "Redline-keep.pdf")
-
-    let oldSessionID = UUID()
-    let oldDir = paths.archiveDirectory(oldSessionID)
-    let removedDir = oldDir.appendingPathComponent("removed", isDirectory: true)
-    try FileManager.default.createDirectory(at: removedDir, withIntermediateDirectories: true)
-    let oldPNG = removedDir.appendingPathComponent("001-DEADBEEF.png")
-    try makeHistoryPNGData(width: 4, height: 4, red: 0.5, green: 0.5, blue: 0.5).write(to: oldPNG)
-    try FileManager.default.setAttributes(
-        [.creationDate: base],
-        ofItemAtPath: oldPNG.path
-    )
-    let oldSession = CaptureSession(
-        id: oldSessionID,
-        createdAt: base,
-        state: .archived,
-        captures: [],
-        pdfFileName: "Redline-old.pdf"
-    )
-    try AtomicFile.writeJSON(oldSession, to: oldDir.appendingPathComponent("session.json"))
-
-    let store = try HistoryStore(paths: paths)
-    try await store.pruneImages()
-
-    #expect(!FileManager.default.fileExists(atPath: oldPNG.path))
-    #expect(pngFiles(under: paths.archive).count == 30)
-}
-
-// MARK: - Fixtures
-
-private func makeHistoryPaths() throws -> (root: URL, paths: AppSupportPaths) {
-    let root = FileManager.default.temporaryDirectory
-        .appendingPathComponent("shotdeck-history-\(UUID().uuidString)", isDirectory: true)
-    let paths = try AppSupportPaths(
-        root: root.appendingPathComponent("root", isDirectory: true),
-        outbox: root.appendingPathComponent("outbox", isDirectory: true),
-        watchFolder: root.appendingPathComponent("watch", isDirectory: true)
-    )
-    return (root, paths)
-}
-
-private func writeDummyPDF(to url: URL, marker: String) throws {
-    try Data("%PDF-1.4\n%\(marker)\n%%EOF\n".utf8).write(to: url)
-}
-
-private func makeHistoryPNGData(
-    width: Int,
-    height: Int,
-    red: CGFloat,
-    green: CGFloat,
-    blue: CGFloat
-) throws -> Data {
-    let colorSpace = CGColorSpaceCreateDeviceRGB()
-    guard let context = CGContext(
-        data: nil,
-        width: width,
-        height: height,
-        bitsPerComponent: 8,
-        bytesPerRow: width * 4,
-        space: colorSpace,
-        bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
-    ) else {
-        throw HistoryFixtureError.pngGenerationFailed
-    }
-    context.setFillColor(red: red, green: green, blue: blue, alpha: 1)
-    context.fill(CGRect(x: 0, y: 0, width: width, height: height))
-    guard let image = context.makeImage() else {
-        throw HistoryFixtureError.pngGenerationFailed
-    }
-    let buffer = NSMutableData()
-    guard let destination = CGImageDestinationCreateWithData(buffer, "public.png" as CFString, 1, nil) else {
-        throw HistoryFixtureError.pngGenerationFailed
-    }
-    CGImageDestinationAddImage(destination, image, nil)
-    guard CGImageDestinationFinalize(destination) else {
-        throw HistoryFixtureError.pngGenerationFailed
-    }
-    return buffer as Data
-}
-
-private func pngFiles(under root: URL) -> [URL] {
-    let fm = FileManager.default
-    guard let enumerator = fm.enumerator(
-        at: root,
-        includingPropertiesForKeys: [.isRegularFileKey],
-        options: []
-    ) else { return [] }
-    var urls: [URL] = []
-    for case let url as URL in enumerator {
-        let isFile = (try? url.resourceValues(forKeys: [.isRegularFileKey]).isRegularFile) ?? false
-        if isFile, url.pathExtension.lowercased() == "png" {
-            urls.append(url)
-        }
-    }
-    return urls
-}
-
-private func assertManifestsMatchDisk(archiveRoot: URL) throws {
-    let fm = FileManager.default
-    let sessions = (try fm.contentsOfDirectory(
-        at: archiveRoot,
-        includingPropertiesForKeys: [.isDirectoryKey],
-        options: []
-    )).filter {
-        ((try? $0.resourceValues(forKeys: [.isDirectoryKey]).isDirectory) ?? false)
-            && UUID(uuidString: $0.lastPathComponent) != nil
-    }
-    let decoder = JSONDecoder()
-    decoder.dateDecodingStrategy = .iso8601
-    for dir in sessions {
-        let manifestURL = dir.appendingPathComponent("session.json")
-        #expect(fm.fileExists(atPath: manifestURL.path))
-        let session = try decoder.decode(CaptureSession.self, from: Data(contentsOf: manifestURL))
-        for capture in session.captures {
-            let url = dir.appendingPathComponent(capture.fileName)
-            #expect(fm.fileExists(atPath: url.path))
-        }
-        let topLevelPNGs = (try fm.contentsOfDirectory(at: dir, includingPropertiesForKeys: nil, options: []))
-            .filter { $0.pathExtension.lowercased() == "png" }
-        let manifestNames = Set(session.captures.map(\.fileName))
-        #expect(Set(topLevelPNGs.map(\.lastPathComponent)) == manifestNames)
-    }
-}
-
-private enum HistoryFixtureError: Error {
-    case pngGenerationFailed
-}

scripts/publish-update.sh

@@ -13,7 +13,10 @@ PLISTBUDDY="/usr/libexec/PlistBuddy"
 REMOTE_HOST="mmd01"
 REMOTE_BASE="/opt/mmd-installer-content/cowork/redline"
 PUBLIC_BASE="https://get.baobab-ts.com/cowork/redline"
-SIGN_IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
+BUNDLE_ID="ai.flowmaster.shotdeck"
+# Used both as the fallback signing identity and as what build-app.sh itself
+# still hardcodes for its own (pre-final) signing pass.
+FALLBACK_SIGN_IDENTITY="Apple Development: ben@flow-master.ai (QH2H9G2LK5)"
 
 usage() {
     echo "Usage: $0 <version> [\"notes\"]" >&2
@@ -72,6 +75,7 @@ else
     PUBLIC_DIR="${PUBLIC_BASE}"
 fi
 
+APP_BUNDLE="${ROOT}/.build/Redline.app"
 ZIP_NAME="Redline-${VERSION}.zip"
 DMG_NAME="Redline-${VERSION}.dmg"
 ZIP_PATH="${ROOT}/.build/${ZIP_NAME}"
@@ -139,6 +143,38 @@ else
     echo "==> --test: skipping git commit of version bump"
 fi
 
+# --- Resolve the signing identity for the shipped artifacts -----------------
+# REDLINE_KEYCHAIN (optional): a specific keychain to search/sign against,
+# for hosts where the Developer ID identity does not live in the login
+# keychain that codesign searches by default.
+FIND_IDENTITY_ARGS=(-v -p codesigning)
+CODESIGN_KEYCHAIN_ARGS=()
+if [[ -n "${REDLINE_KEYCHAIN:-}" ]]; then
+    FIND_IDENTITY_ARGS+=("${REDLINE_KEYCHAIN}")
+    CODESIGN_KEYCHAIN_ARGS=(--keychain "${REDLINE_KEYCHAIN}")
+fi
+
+if [[ -n "${REDLINE_SIGN_IDENTITY:-}" ]]; then
+    SIGN_IDENTITY="${REDLINE_SIGN_IDENTITY}"
+    echo "==> Signing identity: ${SIGN_IDENTITY} (REDLINE_SIGN_IDENTITY)"
+else
+    DEVELOPER_ID_LINE="$(security find-identity "${FIND_IDENTITY_ARGS[@]}" 2>/dev/null \
+        | grep -o '"Developer ID Application:[^"]*"' | head -n1 || true)"
+    DEVELOPER_ID="${DEVELOPER_ID_LINE//\"/}"
+    if [[ -n "${DEVELOPER_ID}" ]]; then
+        SIGN_IDENTITY="${DEVELOPER_ID}"
+        echo "==> Signing identity: ${SIGN_IDENTITY} (auto-detected Developer ID Application)"
+    else
+        SIGN_IDENTITY="${FALLBACK_SIGN_IDENTITY}"
+        echo
+        echo "************************************************************************"
+        echo "WARNING: signing with Apple Development identity — not Developer ID;"
+        echo "Gatekeeper will block first install on other Macs."
+        echo "************************************************************************"
+        echo
+    fi
+fi
+
 # Restricted HOMEs (agent sandboxes) hide the login keychain from codesign.
 # Re-run signed steps with the account's real home when the identity is missing.
 signing_home() {
@@ -167,31 +203,85 @@ run_signed() {
 echo "==> Building signed Redline.app"
 run_signed ./scripts/build-app.sh
 
-if [[ ! -d "${ROOT}/.build/Redline.app" ]]; then
-    echo "Signed app missing at ${ROOT}/.build/Redline.app" >&2
+if [[ ! -d "${APP_BUNDLE}" ]]; then
+    echo "Signed app missing at ${APP_BUNDLE}" >&2
     exit 1
 fi
 
-echo "==> Zipping Redline.app -> ${ZIP_PATH}"
-mkdir -p "${ROOT}/.build"
-(
+# build-app.sh always signs with its own hardcoded Apple Development identity
+# first (it has to — that identifier+identity pair is what keeps the Screen
+# Recording grant alive). Re-sign here with the identity actually resolved
+# above, which is what ships. A no-op when the two happen to be the same.
+echo "==> Signing ${APP_BUNDLE} with resolved identity"
+run_signed codesign --force --options runtime --timestamp \
+    "${CODESIGN_KEYCHAIN_ARGS[@]}" \
+    --sign "${SIGN_IDENTITY}" \
+    --identifier "${BUNDLE_ID}" \
+    "${APP_BUNDLE}"
+
+build_zip() {
+    mkdir -p "${ROOT}/.build"
+    (
         cd "${ROOT}/.build"
         rm -f "${ZIP_NAME}"
         ditto -c -k --keepParent Redline.app "${ZIP_NAME}"
-)
-
-if [[ ! -s "${ZIP_PATH}" ]]; then
+    )
+    if [[ ! -s "${ZIP_PATH}" ]]; then
         echo "Zip was not created at ${ZIP_PATH}" >&2
         exit 1
-fi
+    fi
+}
 
-echo "==> Building manual installer DMG"
-run_signed ./scripts/make-dmg.sh
+# Rebuilds the manual-installer DMG from whatever is currently at
+# ${APP_BUNDLE} — never re-invokes build-app.sh, so a prior custom signature
+# or notarization staple on ${APP_BUNDLE} survives into the DMG untouched.
+build_dmg() {
+    local staging="${ROOT}/.build/dmg-staging"
+    local mount_point="${ROOT}/.build/dmg-mnt"
 
-if [[ ! -s "${DMG_PATH}" ]]; then
+    rm -rf "${staging}"
+    mkdir -p "${staging}"
+    ditto "${APP_BUNDLE}" "${staging}/Redline.app"
+    ln -s /Applications "${staging}/Applications"
+
+    mkdir -p "$(dirname "${DMG_PATH}")"
+    rm -f "${DMG_PATH}"
+    hdiutil create -volname "Redline" -srcfolder "${staging}" -ov -format UDZO "${DMG_PATH}"
+
+    if [[ -d "${mount_point}" ]] && /sbin/mount | grep -F -q "${mount_point}"; then
+        hdiutil detach "${mount_point}" || hdiutil detach "${mount_point}" -force
+    fi
+    rm -rf "${mount_point}"
+    mkdir -p "${mount_point}"
+
+    hdiutil attach "${DMG_PATH}" -nobrowse -readonly -mountpoint "${mount_point}"
+
+    local ok=1
+    if [[ ! -d "${mount_point}/Redline.app" ]]; then
+        echo "Verification failed: Redline.app missing from mounted DMG" >&2
+        ok=0
+    fi
+    if [[ "${ok}" -eq 1 && "$(readlink "${mount_point}/Applications" 2>/dev/null || true)" != "/Applications" ]]; then
+        echo "Verification failed: Applications does not point at /Applications" >&2
+        ok=0
+    fi
+    if [[ "${ok}" -eq 1 ]] && ! codesign --verify --deep --verbose=2 "${mount_point}/Redline.app"; then
+        ok=0
+    fi
+
+    hdiutil detach "${mount_point}" || hdiutil detach "${mount_point}" -force || true
+
+    if [[ "${ok}" -ne 1 ]]; then
+        exit 1
+    fi
+    if [[ ! -s "${DMG_PATH}" ]]; then
         echo "DMG was not created at ${DMG_PATH}" >&2
         exit 1
-fi
+    fi
+}
+
+echo "==> Zipping Redline.app -> ${ZIP_PATH}"
+build_zip
 
 SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
 ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
@@ -200,18 +290,102 @@ PUBDATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
 echo "==> Zip SHA256: ${SHA256}"
 echo "    Zip bytes:  ${ZIP_BYTES}"
 
+# --- Notarization (optional) -------------------------------------------------
+# Either REDLINE_NOTARY_PROFILE (a `notarytool store-credentials` keychain
+# profile) or all three of REDLINE_NOTARY_KEY_ID / REDLINE_NOTARY_ISSUER /
+# REDLINE_NOTARY_KEY_PATH (App Store Connect API key). Absent both: skip.
+NOTARIZED=0
+NOTARY_CONFIGURED=0
+if [[ -n "${REDLINE_NOTARY_PROFILE:-}" ]]; then
+    NOTARY_CONFIGURED=1
+elif [[ -n "${REDLINE_NOTARY_KEY_ID:-}" && -n "${REDLINE_NOTARY_ISSUER:-}" && -n "${REDLINE_NOTARY_KEY_PATH:-}" ]]; then
+    NOTARY_CONFIGURED=1
+fi
+
+if [[ "${NOTARY_CONFIGURED}" -eq 1 ]]; then
+    echo "==> Submitting ${ZIP_PATH} to notarytool"
+    NOTARY_ARGS=(xcrun notarytool submit "${ZIP_PATH}" --wait --timeout 30m)
+    if [[ -n "${REDLINE_NOTARY_PROFILE:-}" ]]; then
+        NOTARY_ARGS+=(--keychain-profile "${REDLINE_NOTARY_PROFILE}")
+    else
+        NOTARY_ARGS+=(
+            --key "${REDLINE_NOTARY_KEY_PATH}"
+            --key-id "${REDLINE_NOTARY_KEY_ID}"
+            --issuer "${REDLINE_NOTARY_ISSUER}"
+        )
+    fi
+
+    set +e
+    NOTARY_OUTPUT="$("${NOTARY_ARGS[@]}" 2>&1)"
+    NOTARY_STATUS=$?
+    set -e
+    echo "${NOTARY_OUTPUT}"
+    if [[ "${NOTARY_STATUS}" -ne 0 ]]; then
+        echo "notarytool submit failed (exit ${NOTARY_STATUS})." >&2
+        exit 1
+    fi
+    if ! grep -qi 'status: *Accepted' <<<"${NOTARY_OUTPUT}"; then
+        echo "notarytool did not report Accepted." >&2
+        exit 1
+    fi
+    NOTARIZED=1
+
+    echo "==> Stapling ${APP_BUNDLE}"
+    xcrun stapler staple "${APP_BUNDLE}"
+
+    echo "==> Rebuilding zip from the stapled app"
+    build_zip
+    SHA256="$(shasum -a 256 "${ZIP_PATH}" | awk '{print $1}')"
+    ZIP_BYTES="$(stat -f%z "${ZIP_PATH}")"
+    echo "    Zip SHA256: ${SHA256}"
+    echo "    Zip bytes:  ${ZIP_BYTES}"
+
+    echo "==> Rebuilding DMG from the stapled app"
+    build_dmg
+
+    echo "==> Stapling ${DMG_PATH}"
+    xcrun stapler staple "${DMG_PATH}"
+else
+    echo "==> REDLINE_NOTARY_KEY_ID/ISSUER/KEY_PATH (or REDLINE_NOTARY_PROFILE) not set"
+    echo "NOT NOTARIZED"
+    echo "==> Building manual installer DMG"
+    build_dmg
+fi
+
+echo "==> Gatekeeper check: spctl -a -vv -t exec ${APP_BUNDLE}"
+set +e
+SPCTL_OUTPUT="$(spctl -a -vv -t exec "${APP_BUNDLE}" 2>&1)"
+SPCTL_STATUS=$?
+set -e
+echo "${SPCTL_OUTPUT}"
+if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then
+    if [[ "${NOTARIZED}" -eq 1 ]]; then
+        echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2
+        exit 1
+    fi
+    echo "WARNING: Gatekeeper does not accept this build (not notarized). First install on other Macs needs right-click > Open." >&2
+fi
+
+TEAM_IDENTIFIER="$(codesign -dv "${APP_BUNDLE}" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2}')"
+if [[ -z "${TEAM_IDENTIFIER}" ]]; then
+    echo "No TeamIdentifier on ${APP_BUNDLE} — the build is not signed with a team identity; refusing to publish." >&2
+    exit 1
+fi
+
 echo "==> Writing ${APPCAST_PATH}"
-python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" <<'PY'
+python3 - "${VERSION}" "${ZIP_URL}" "${SHA256}" "${NOTES}" "${PUBDATE}" "${APPCAST_PATH}" "${NOTARIZED}" "${TEAM_IDENTIFIER}" <<'PY'
 import json
 import sys
 
-version, zip_url, sha256, notes, pub_date, out_path = sys.argv[1:]
+version, zip_url, sha256, notes, pub_date, out_path, notarized, team_identifier = sys.argv[1:]
 payload = {
     "version": version,
     "zipURL": zip_url,
     "sha256": sha256,
     "notes": notes,
     "pubDate": pub_date,
+    "notarized": notarized == "1",
+    "teamIdentifier": team_identifier,
 }
 with open(out_path, "w", encoding="utf-8") as fh:
     json.dump(payload, fh, indent=2)
@@ -280,6 +454,14 @@ fi
 
 echo
 echo "Published v${VERSION}"
+echo "  identity:  ${SIGN_IDENTITY}"
+if [[ "${NOTARIZED}" -eq 1 ]]; then
+    echo "  notarized: yes"
+else
+    echo "  notarized: no"
+fi
+echo "  spctl:     ${SPCTL_OUTPUT}"
+echo "  team:      ${TEAM_IDENTIFIER}"
 echo "  appcast:   ${APPCAST_URL}"
 echo "  zip:       ${ZIP_URL}"
 echo "  sha256:    ${SHA256}"