diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index ee3bec1..2e55c92 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -13,7 +13,7 @@ body:
     attributes:
       label: Colony version
       description: Output of `colony --version` (or the release tag you downloaded).
-      placeholder: "v0.1.4"
+      placeholder: "0.9.2"
     validations:
       required: true
 
diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml
index c1e7666..7af4b66 100644
--- a/.github/workflows/aur-publish.yml
+++ b/.github/workflows/aur-publish.yml
@@ -19,6 +19,14 @@ on:
         description: 'Release tag to publish to AUR (e.g. v0.7.0)'
         required: true
         type: string
+    secrets:
+      # Declared explicitly so the caller passes THIS secret and nothing else.
+      # Under `secrets: inherit` this job also received COLONY_SIGNING_KEY_PEM,
+      # which it has no use for - and that is the one secret whose compromise
+      # is unrecoverable, since every install in the field trusts the key it
+      # signs with.
+      AUR_SSH_PRIVATE_KEY:
+        required: true
   workflow_dispatch:
     inputs:
       tag:
@@ -64,7 +72,18 @@ jobs:
           mkdir -p ~/.ssh
           printf '%s\n' "$SSH_KEY" > ~/.ssh/aur_bot
           chmod 600 ~/.ssh/aur_bot
-          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
+          # Pin the host key rather than trusting whatever answers today:
+          # a bare ssh-keyscan is trust-on-first-use on every single run.
+          # Fingerprint SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4,
+          # cross-checkable against the AUR entry on the Arch wiki.
+          AUR_HOSTKEY='aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN'
+          printf '%s\n' "$AUR_HOSTKEY" > ~/.ssh/known_hosts
+          # A mismatch means either a legitimate rotation (update the pin) or
+          # something worth stopping the release for.
+          if ! ssh-keyscan -t ed25519 aur.archlinux.org 2>/dev/null | grep -qxF "$AUR_HOSTKEY"; then
+            echo "::error::aur.archlinux.org host key does not match the pinned one"
+            exit 1
+          fi
 
       - name: Clone AUR colony-bin repo
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 61953a4..a6fb861 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,8 +33,64 @@ jobs:
       - name: Format
         run: cargo fmt --all -- --check
 
+      # --all-targets, or clippy never sees the 140 tests - the code most
+      # likely to accumulate lint debt, since nobody reads it in review.
       - name: Clippy
-        run: cargo clippy -- -D warnings
+        run: cargo clippy --all-targets -- -D warnings
 
       - name: Test
         run: cargo test --verbose
+
+  # The declared MSRV was 1.80 for years and could never have built: 70
+  # transitive dependencies require more. Nothing checked it, because CI only
+  # ever ran on stable. This leg is what stops it drifting again.
+  msrv:
+    name: MSRV
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Read the declared MSRV
+        id: msrv
+        run: |
+          version=$(grep '^rust-version' Cargo.toml | tr -d ' "' | cut -d= -f2)
+          [ -n "$version" ] || { echo "::error::could not read rust-version from Cargo.toml"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable branch
+        with:
+          toolchain: ${{ steps.msrv.outputs.version }}
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          key: msrv-${{ steps.msrv.outputs.version }}
+
+      - name: Build on the declared floor
+        run: cargo check --locked --all-targets
+
+  # Colony downloads and executes binaries, so a known-vulnerable dependency is
+  # not an abstract concern. This job GATES: red here means something new and
+  # actionable.
+  #
+  # It gates because the alternative does not work. Left to report without
+  # gating, it is red on every single PR forever - and a check that is always
+  # red is a check nobody reads. So the advisories that genuinely cannot be
+  # acted on from this repository are ignored BY ID, with the reason written
+  # down, and everything else fails the build.
+  #
+  # RUSTSEC-2026-0194 / RUSTSEC-2026-0195 (quick-xml): held at 0.38 by
+  # wayland-scanner, via winit and iced 0.14 - a semver-incompatible bump we
+  # cannot make from here. Both advisories concern parsing untrusted XML;
+  # wayland-scanner is a build-time proc-macro that parses the system's own
+  # Wayland protocol descriptions, so neither is reachable at runtime.
+  # Remove these two the day iced ships a winit new enough to carry
+  # quick-xml >= 0.41.
+  audit:
+    name: Advisories
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          ignore: RUSTSEC-2026-0194,RUSTSEC-2026-0195
diff --git a/.github/workflows/colony-rust-release.yml.template b/.github/workflows/colony-rust-release.yml.template
index 92726c2..6c3b910 100644
--- a/.github/workflows/colony-rust-release.yml.template
+++ b/.github/workflows/colony-rust-release.yml.template
@@ -1,94 +1,36 @@
-# Colony Rust App — Release Workflow Template
+# Colony Rust program — release workflow
 #
-# Copy this file to your repo as .github/workflows/release.yml
-# Replace {{APP_NAME}} with your binary/repo name (lowercase).
+# ┌─────────────────────────────────────────────────────────────────────────┐
+# │  THIS FILE IS NOT THE TEMPLATE. The canonical one lives in              │
+# │                                                                         │
+# │    Project-Colony-Resources / templates/release.yml                     │
+# │    https://github.com/Project-Colony/Project-Colony-Resources           │
+# │                                                                         │
+# │  Copy THAT file to your repo as .github/workflows/release.yml.          │
+# └─────────────────────────────────────────────────────────────────────────┘
 #
-# Assets follow the Colony naming convention:
-#   {{APP_NAME}}-linux, {{APP_NAME}}-windows.exe,
-#   {{APP_NAME}}-macos, {{APP_NAME}}-macos-x86
+# Why this is a pointer and not a copy: it used to be a copy, and the two
+# drifted. The Resources template referenced a secret named
+# COLONY_SIGNING_KEY while every real repo uses COLONY_SIGNING_KEY_PEM, and it
+# skipped signing on Windows entirely - so a program following it shipped an
+# unsigned .exe that Colony then refused to install, because the manifest said
+# "signed": true. Neither mistake was visible from either side. One canonical
+# file, kept next to the shared script it calls, is what stops that recurring.
 #
-# Colony auto-detects platforms from these asset names, so your
-# colony.json only needs: { "name": "...", "category": "..." }
-
-name: Release
-
-on:
-  push:
-    branches: [main]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  release-please:
-    runs-on: ubuntu-latest
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-      upload_url: ${{ steps.release.outputs.upload_url }}
-    steps:
-      - uses: googleapis/release-please-action@v4
-        id: release
-        with:
-          release-type: rust
-
-  build:
-    name: Build ${{ matrix.asset }}
-    needs: release-please
-    if: ${{ needs.release-please.outputs.release_created }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            os: ubuntu-latest
-            asset: "{{APP_NAME}}-linux"
-          - target: x86_64-pc-windows-msvc
-            os: windows-latest
-            asset: "{{APP_NAME}}-windows.exe"
-          - target: aarch64-apple-darwin
-            os: macos-latest
-            asset: "{{APP_NAME}}-macos"
-          - target: x86_64-apple-darwin
-            os: macos-latest
-            asset: "{{APP_NAME}}-macos-x86"
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: ${{ matrix.target }}
-
-      # Uncomment if your app needs GTK/X11 dependencies on Linux:
-      # - name: Install Linux dependencies
-      #   if: runner.os == 'Linux'
-      #   run: |
-      #     sudo apt-get update
-      #     sudo apt-get install -y libgtk-3-dev libxdo-dev libdbus-1-dev
-
-      - name: Build
-        run: cargo build --release --target ${{ matrix.target }}
-
-      - name: Rename binary (Unix)
-        if: runner.os != 'Windows'
-        run: cp target/${{ matrix.target }}/release/{{APP_NAME}} ${{ matrix.asset }}
-
-      - name: Rename binary (Windows)
-        if: runner.os == 'Windows'
-        run: copy target\${{ matrix.target }}\release\{{APP_NAME}}.exe ${{ matrix.asset }}
-
-      - name: Upload binary to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ needs.release-please.outputs.tag_name }}
-          files: ${{ matrix.asset }}
+# What you need, in short:
+#
+#   1. colony.json at your repo root (name + category is usually the whole
+#      file). Validate it with:  colony validate-manifest colony.json
+#   2. templates/release.yml   -> .github/workflows/release.yml
+#   3. templates/sign-release.sh -> scripts/sign-release.sh   (only if you set
+#      "signed": true; the workflow calls it from there)
+#   4. The COLONY_SIGNING_KEY_PEM organisation secret, which is restricted to
+#      Project-Colony repositories.
+#
+# The full contract - asset naming, the manifest, signing, the .meta sidecar,
+# key rotation, and how to adopt signatures in a program that already ships -
+# is in Project-Colony-Resources / design/releases.md.
+#
+# Colony's own release pipeline (.github/workflows/release-please.yml) is the
+# reference implementation and stays separate: it self-updates, so its
+# signature verification is mandatory rather than opt-in.
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 4434b53..05e6dc7 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -24,6 +24,24 @@ jobs:
         with:
           release-type: rust
 
+      # release-please's own step PUBLISHES the release - and moves
+      # /releases/latest - before a single binary exists. For the whole
+      # build+sign window every running Colony therefore showed an update badge
+      # whose every click failed: a missing asset first, then a fail-closed
+      # signature refusal once `build` had uploaded but `sign` had not. And if
+      # any build leg failed, that state was permanent until someone noticed.
+      #
+      # Held as a draft here rather than via a release-please config file: the
+      # config-file route means switching the action to manifest mode, which
+      # changes the outputs contract that the build, sign and aur jobs all
+      # depend on and that nine releases have proven. This is one gh call, and
+      # it narrows the window from minutes to the second between the two steps.
+      - name: Hold the release as a draft until it is signed
+        if: ${{ steps.release.outputs.release_created }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release edit "${{ steps.release.outputs.tag_name }}" --draft=true
+
   build:
     name: Build ${{ matrix.asset }}
     needs: release-please
@@ -74,6 +92,31 @@ jobs:
         if: runner.os == 'Windows'
         run: copy target\${{ matrix.target }}\release\colony.exe ${{ matrix.asset }}
 
+      # The pipeline's signature checks prove provenance and say nothing about
+      # whether the binary RUNS. An asset built for the wrong architecture, or
+      # one that aborts under the release profile's LTO, would be signed,
+      # verified, published and hashed into the AUR PKGBUILD with every check
+      # green. `--version` exits before opening a window, so this is a genuine
+      # end-to-end smoke test of the shipped artefact.
+      - name: Smoke-test the artefact
+        if: matrix.target != 'x86_64-apple-darwin'
+        shell: bash
+        run: |
+          chmod +x "${{ matrix.asset }}" || true
+          "./${{ matrix.asset }}" --version
+
+      # The Intel macOS asset is cross-compiled on an arm64 runner and cannot
+      # be executed there, so assert the architecture instead - which is the
+      # regression that would otherwise survive longest, on the leg with the
+      # fewest users.
+      - name: Check the cross-compiled artefact's architecture
+        if: matrix.target == 'x86_64-apple-darwin'
+        shell: bash
+        run: |
+          file "${{ matrix.asset }}"
+          file "${{ matrix.asset }}" | grep -q 'x86_64' \
+            || { echo "::error::${{ matrix.asset }} is not an x86_64 binary"; exit 1; }
+
       - name: Upload binary to GitHub Release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
@@ -159,6 +202,13 @@ jobs:
           done
           echo "published release verified"
 
+      # Only now does the release become visible. Until this step, /releases/
+      # latest still points at the previous version, so no client is offered an
+      # update it cannot apply, and the README's download link never points at
+      # an empty release.
+      - name: Publish the release
+        run: gh release edit "$TAG" --draft=false
+
   # Chained here (not on `release: published`) because release-please creates
   # the release with the default GITHUB_TOKEN, whose events do not trigger
   # other workflows - the standalone trigger never fired once in nine
@@ -171,4 +221,7 @@ jobs:
     uses: ./.github/workflows/aur-publish.yml
     with:
       tag: ${{ needs.release-please.outputs.tag_name }}
-    secrets: inherit
+    # NOT `inherit`: the AUR job needs one secret, and inheriting handed it
+    # the release signing key as well.
+    secrets:
+      AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7f810bf..cd1dbe0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,7 +25,7 @@ Minimal form:
 }
 ```
 
-Valid categories: `Development`, `Graphics`, `Network`, `Office`, `Multimedia`, `System`, `Utilities`, `Games`, `Other`.
+Valid categories: `Development`, `Graphics`, `Network`, `Office`, `Multimedia`, `System`, `Utilities`, `Security`, `Games`, `Other`.
 
 **App icon (recommended):** put a square PNG at `assets/icons/icon.png` and declare it in the manifest — `"icon": "assets/icons/icon.png"`. Colony shows it in the grid; without it your app gets a generated category tile. The same folder is the standard home for your `icon.ico` (Windows) and `icon.icns` (macOS). See the [App icon](docs/colony-spec.md#app-icon) section of the spec.
 
@@ -46,7 +46,7 @@ You can upload any subset — Colony only advertises the platforms whose asset i
 
 ### Step 3 — Wire up a release workflow (Rust apps)
 
-A ready-to-use GitHub Actions template is in this repo at [`.github/workflows/colony-rust-release.yml.template`](.github/workflows/colony-rust-release.yml.template). Copy it to your own repo as `.github/workflows/release.yml` and replace `{{APP_NAME}}` with your binary/repo name (lowercase).
+The ready-to-use GitHub Actions template lives in Project-Colony-Resources at [`templates/release.yml`](https://github.com/Project-Colony/Project-Colony-Resources/blob/main/templates/release.yml), next to the shared signing script it calls. Copy it to your own repo as `.github/workflows/release.yml` and replace `{{APP_NAME}}` with your binary/repo name (lowercase).
 
 It uses [`release-please`](https://github.com/googleapis/release-please) so every merged PR tagged with a conventional-commit prefix (`feat:`, `fix:`, etc.) opens a release PR; merging that PR tags the version, builds the matrix of 4 platforms, and uploads the assets under the convention above. Zero manual release work afterwards.
 
@@ -73,7 +73,7 @@ Your app card should appear in the category you declared. If not:
 
 - Make sure the release is **published** (not a draft).
 - Make sure asset names match the convention (lowercase, no version in the name, correct extension).
-- Look in `~/.cache/colony/repos_cache.json` — if your repo is there but without platforms, the `colony.json` or the asset names are wrong. See the [spec](docs/colony-spec.md) for the precise validation rules.
+- Look in `~/.config/Colony/Colony/cache/repos_cache.json` - if your repo is there but without platforms, the `colony.json` or the asset names are wrong. See the [spec](docs/colony-spec.md) for the precise validation rules.
 - Verify you aren't hitting the GitHub rate limit: Settings → GitHub → Connect.
 
 ---
@@ -96,7 +96,7 @@ cargo build --release    # optimized build
 **Linux runtime dependencies** (for building and running):
 
 ```
-libgtk-3-dev libxdo-dev libdbus-1-dev libasound2-dev libglib2.0-dev pkg-config
+libgtk-3-dev libxdo-dev libdbus-1-dev pkg-config
 ```
 
 ### Code organization
@@ -113,7 +113,7 @@ See [docs/architecture.md](docs/architecture.md) for the full layout. Short vers
 - `src/scan.rs` — system app detection (Linux `.desktop`, Windows Start Menu, macOS `.app`).
 - `src/sections.rs` — categories + filter logic.
 - `src/ui/` — widgets and panels (sidebar, app grid, detail view, settings).
-- `src/ui/theme.rs` — all 24 theme families + 50+ palettes.
+- `src/ui/theme.rs` — all 25 theme families + 57 palettes.
 
 ### Style
 
@@ -141,7 +141,7 @@ See [docs/architecture.md](docs/architecture.md) for the full layout. Short vers
 
 ### Reporting bugs / feature requests
 
-Use the templates in `.github/ISSUE_TEMPLATE/` when filing. Include Colony version (`colony --version`), OS, and relevant log excerpts from `~/.cache/colony/`.
+Use the templates in `.github/ISSUE_TEMPLATE/` when filing. Include Colony version (`colony --version`), OS, and relevant log excerpts from `~/.cache/colony/colony.log`.
 
 ---
 
diff --git a/Cargo.lock b/Cargo.lock
index 1f7d3af..e2b6868 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -387,6 +387,12 @@ dependencies = [
  "syn 2.0.114",
 ]
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
@@ -841,7 +847,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -971,7 +977,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1428,9 +1434,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2031,9 +2037,13 @@ version = "3.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
 dependencies = [
+ "byteorder",
  "dbus-secret-service",
  "log",
  "openssl",
+ "security-framework 2.11.1",
+ "security-framework 3.6.0",
+ "windows-sys 0.60.2",
  "zeroize",
 ]
 
@@ -2366,7 +2376,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3133,7 +3143,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3378,7 +3388,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3462,6 +3472,42 @@ dependencies = [
  "tiny-skia",
 ]
 
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d17b898a6d6948c3a8ee4372c17cb384f90d2e6e912ef00895b14fd7ab54ec38"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "self_cell"
 version = "1.2.2"
@@ -3901,7 +3947,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4810,7 +4856,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 8f02689..ef4b272 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,8 +3,12 @@ name = "colony"
 version = "0.9.2"
 edition = "2021"
 license = "GPL-3.0-or-later"
-# Enforced floor for the README's "Rust 1.80+" claim (std::sync::LazyLock).
-rust-version = "1.80"
+# The real floor, and it is enforced by CI (see .github/workflows/ci.yml).
+# 1.80 was declared for years and could never have worked: 70 transitive
+# dependencies require more, including iced, zip, image and wgpu at 1.88, so
+# cargo refuses to build at all on it. Nothing checked, because CI only ever
+# ran on stable.
+rust-version = "1.88"
 
 [dependencies]
 anyhow = "1.0.100"
@@ -19,7 +23,18 @@ futures = "0.3"
 open = "5"
 base64 = "0.23"
 dirs = "6"
-keyring = { version = "3", features = ["sync-secret-service", "vendored"] }
+# apple-native / windows-native are REQUIRED, not optional: keyring 3 has no
+# default feature, and without them its macOS and Windows backends resolve to
+# the in-memory `mock`, whose set_password returns Ok while storing nothing.
+# Colony reads that Ok as success and deletes its plaintext fallback on purpose,
+# so the token was written nowhere and every restart logged the user out. Both
+# are target-gated in keyring's manifest, so they add nothing to the Linux build.
+keyring = { version = "3", features = [
+    "apple-native",
+    "windows-native",
+    "sync-secret-service",
+    "vendored",
+] }
 semver = "1"
 sha2 = "0.10"
 # Pure-Rust ed25519 verification for signed launcher self-updates (no openssl).
diff --git a/README.md b/README.md
index 9bf7bbe..75719dc 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Colony is the central piece of [Project Colony](https://github.com/Project-Colon
 [![License: GPL-3.0-or-later](https://img.shields.io/badge/License-GPL--3.0--or--later-blue.svg)](LICENSE)
 [![AUR: colony-bin](https://img.shields.io/badge/AUR-colony--bin-blue)](https://aur.archlinux.org/packages/colony-bin)
 [![AUR: colony-git](https://img.shields.io/badge/AUR-colony--git-blue)](https://aur.archlinux.org/packages/colony-git)
-[![Platforms](https://img.shields.io/badge/platforms-linux%20%7C%20windows%20%7C%20macOS-lightgrey)](#installation)
+[![Platforms](https://img.shields.io/badge/platforms-linux%20%7C%20windows*%20%7C%20macOS*-lightgrey)](#platforms)
 
 <!-- Screenshots — drop PNG files into assets/screenshots/ and replace the comment below. -->
 <!--
@@ -41,7 +41,9 @@ Grab the single-file executable for your platform from the [latest release](http
 | macOS (Apple Silicon) | `colony-macos`           |
 | macOS (Intel)         | `colony-macos-x86`       |
 
-No installer — download, `chmod +x` on Unix, and run. A new release is published automatically by `release-please` after each merged change, so the latest binary is always at `/releases/latest`.
+No installer - download, `chmod +x` on Unix, and run. On macOS, Gatekeeper
+quarantines anything fetched from a browser, so clear the flag first:
+`xattr -d com.apple.quarantine colony-macos`. A new release is published automatically by `release-please` after each merged change, so the latest binary is always at `/releases/latest`.
 
 ### Build from source
 
@@ -52,7 +54,7 @@ cargo build --release
 ./target/release/colony
 ```
 
-Requires Rust 1.80+ and, on Linux, `libgtk-3-dev`, `libxdo-dev`, `libdbus-1-dev`, `libasound2-dev`, `libglib2.0-dev`, `pkg-config`.
+Requires Rust 1.88+ and, on Linux, `libgtk-3-dev`, `libxdo-dev`, `libdbus-1-dev`, `pkg-config`.
 
 ---
 
@@ -60,7 +62,7 @@ Requires Rust 1.80+ and, on Linux, `libgtk-3-dev`, `libxdo-dev`, `libdbus-1-dev`
 
 - **Discover** — Browse all Colony apps by category, search by name, read descriptions, changelogs, and licenses without leaving the launcher.
 - **Install & Update** — One click to download, one click to update. Colony tracks versions and shows when something new is available — for apps and for itself.
-- **Launch** — Colony also detects every application already installed on your system (Start Menu on Windows, `.desktop` files on Linux) and lets you launch them alongside Colony apps.
+- **Launch** - Colony also detects every application already installed on your system (`.desktop` files on Linux, the Start Menu on Windows, `/Applications` on macOS) and lets you launch them alongside Colony apps.
 - **Self-update** — Colony keeps itself up to date. When a new version is available, a badge appears in the sidebar; click to download, then restart.
 
 ➡️ New user? Start with the **[Tutorial](docs/tutorial.md)** for a step-by-step walkthrough.
@@ -75,7 +77,7 @@ Requires Rust 1.80+ and, on Linux, `libgtk-3-dev`, `libxdo-dev`, `libdbus-1-dev`
 
 ## Theming
 
-Colony ships with **24 theme families and 50+ palettes**, all compiled into the binary with zero runtime cost:
+Colony ships with **25 theme families and 57 palettes**, all compiled into the binary with zero runtime cost:
 
 | | | | |
 |---|---|---|---|
@@ -85,6 +87,7 @@ Colony ships with **24 theme families and 50+ palettes**, all compiled into the
 | Everforest | Material (Oceanic, Palenight, Deep Ocean) | Flexoki | Nightfox |
 | Sonokai | Oxocarbon | Night Owl | Iceberg |
 | Horizon | Mélange | Synthwave '84 | Modus (Operandi, Vivendi) |
+| Stellar Blade (Eve, Tachy, Lily, Enya, Kaya) | | | |
 
 Each palette includes full semantic tokens: backgrounds, text layers, accents, success/warning/error states, button states, and more.
 
@@ -105,16 +108,25 @@ Then publish a GitHub Release with assets named `yourapp-linux`, `yourapp-window
 
 **Full walkthrough**: see [CONTRIBUTING.md § Adding your app to Colony](CONTRIBUTING.md#adding-your-app-to-colony).
 
-A [release workflow template](.github/workflows/colony-rust-release.yml.template) is included for Rust apps using Release Please.
+The canonical [release workflow template](https://github.com/Project-Colony/Project-Colony-Resources/blob/main/templates/release.yml) lives in Project-Colony-Resources, alongside the shared signing script and the manifest schema.
 
 ## Platforms
 
-| Platform | Architecture | Status |
-|---|---|---|
-| Linux | x86_64 | Supported |
-| Windows | x86_64 | Supported |
-| macOS | ARM (Apple Silicon) | Supported |
-| macOS | x86_64 (Intel) | Supported |
+Colony is developed and tested on Linux. Windows and macOS builds are produced
+by the same CI, install and update apps, and are genuinely usable, but they get
+far less exercise, and some desktop integration is Linux-only.
+
+| Platform | Architecture | Status | Notes |
+|---|---|---|---|
+| Linux | x86_64 | Supported | Primary platform. `.desktop` entries for installed apps, `.desktop` scan of local apps. |
+| Windows | x86_64 | Best-effort | Installs, updates and launches. No Start Menu shortcut is created for installed apps. |
+| macOS | ARM (Apple Silicon) | Best-effort | Installs, updates and launches single-binary apps. `.app` bundles are not supported, and nothing is registered with Launch Services. |
+| macOS | x86_64 (Intel) | Best-effort | As above. |
+
+"Best-effort" means bug reports are welcome and will be fixed, but the platform
+is not part of the routine test loop. If you use Colony on Windows or macOS and
+something is wrong, please [open an issue](https://github.com/Project-Colony/Colony/issues): that is
+how these move up.
 
 ## Documentation
 
@@ -123,6 +135,7 @@ A [release workflow template](.github/workflows/colony-rust-release.yml.template
 | [Tutorial](docs/tutorial.md)       | End-user walkthrough: install → first app → launch    |
 | [FAQ](docs/faq.md)                 | Common questions + troubleshooting                    |
 | [Architecture](docs/architecture.md) | Internal structure, tech stack, data flow             |
+| [Release signing](docs/release-signing.md) | ed25519 signing, the `.meta` sidecar, key rotation |
 | [Colony spec](docs/colony-spec.md) | Full `colony.json` manifest reference                 |
 | [Contributing](CONTRIBUTING.md)    | How to add your app + how to contribute to Colony itself |
 
diff --git a/config/categories.json b/config/categories.json
index 0214f95..fa3d785 100644
--- a/config/categories.json
+++ b/config/categories.json
@@ -9,13 +9,29 @@
     "name": "Windows",
     "icon": "",
     "origin": "windows",
-    "category": "all"
+    "category": "all",
+    "platforms": [
+      "windows"
+    ]
   },
   {
     "name": "Linux",
     "icon": "",
     "origin": "external",
-    "category": "all"
+    "category": "all",
+    "platforms": [
+      "linux"
+    ]
+  },
+  {
+    "name": "macOS",
+    "icon": "",
+    "origin": "external",
+    "category": "all",
+    "platforms": [
+      "macos",
+      "macos-x86"
+    ]
   },
   {
     "name": "Development",
diff --git a/docs/architecture.md b/docs/architecture.md
index 7d5833f..ea65349 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -24,12 +24,20 @@ Colony is an application launcher written in Rust with Iced 0.14 (Elm architectu
 
 ```
 src/
-├── main.rs          — Bootstrap, App state, boot(), update(), view()
+├── main.rs          — Crate root: modules, CLI flags, logging, entry point
 ├── state.rs         — App struct (global state), GitHubState, UI fields
 ├── message.rs       — Message enum (all events)
-├── update.rs        — Handlers for each Message variant
-├── github.rs        — GitHub API, ETag cache, manifests, release
-│                      asset resolution, platform auto-detection
+├── app.rs           — impl App: boot(), view(), subscription(), theme()
+├── update/          — Message dispatch table (mod.rs) + handlers
+│   ├── store.rs     — install / update / uninstall / notes / favorites
+│   ├── github_auth.rs — device flow, catalog refresh
+│   ├── launcher.rs  — self-update state machine
+│   ├── preferences.rs, keyboard.rs, onboarding.rs
+├── github/          — split by layer, mod.rs re-exports everything
+│   ├── http.rs      — client, conditional-request cache, typed statuses
+│   ├── types.rs     — colony.json / API wire shapes
+│   ├── catalog.rs   — store listing
+│   └── releases.rs  — tags, assets, platform auto-detection
 ├── download.rs      — Asset/archive downloads, extraction, app-signature
 │                      verification, self-update
 ├── signing.rs       — ed25519 verification (launcher AND app releases)
@@ -40,10 +48,10 @@ src/
 ├── oauth.rs         — Device Flow OAuth (login, token, keychain)
 ├── scan.rs          — System application scanning (Linux/Windows/macOS)
 ├── sections.rs      — Categories, origin/category filters, JSON config
-├── i18n.rs          — FR/EN localization with variable substitution
+├── i18n/            — fr.rs, en.rs, and the Locale lookup (mod.rs)
 └── ui/
     ├── mod.rs       — UI module declarations
-    ├── theme.rs     — 24 theme families, 50+ palettes, semantic tokens
+    ├── theme.rs     — 25 theme families, 57 palettes, semantic tokens
     ├── sidebar.rs   — Sidebar (sections, GitHub, rescan, update badge)
     ├── app_grid.rs  — Application card grid with search
     ├── detail.rs    — Detail view (README, changelog, license, actions)
@@ -67,8 +75,9 @@ All async operations (API calls, downloads, scanning) return a `Task<Message>` t
 
 - **OAuth**: Device Flow (no client_secret exposed)
 - **Tokens**: Stored in OS keychain, file fallback (chmod 600)
-- **Downloads**: HTTPS only, optional SHA256 verification
-- **Timeouts**: 30s API requests, 10s connect, 300s downloads
+- **Downloads**: HTTPS only, optional SHA256 verification, resumable via Range with an ETag+length identity check before any partial file is continued
+- **URLs**: every remote-controlled path segment is percent-encoded, never interpolated - the WHATWG parser collapses `..` before the request is sent
+- **Timeouts**: 30s total for API requests, 10s connect, 60s read (inactivity) for downloads - a total deadline on a download makes a large asset impossible to fetch on a slow line
 - **Self-update**: Binary backup before replacement, automatic rollback on failure
 - **Signed updates**: Launcher updates verified against an embedded ed25519 public key (fail-closed) both at download and at apply time; see [release-signing.md](release-signing.md)
 
@@ -76,12 +85,15 @@ All async operations (API calls, downloads, scanning) return a `Task<Message>` t
 
 | Data | Location | Duration |
 |------|----------|----------|
-| Colony repos (cache) | `~/.cache/colony/repos_cache.json` | Offline fallback |
-| Scanned apps (cache) | `~/.cache/colony/scan_cache.json` | Session |
-| Repo docs (cache) | `~/.cache/colony/docs/<repo>/` | Offline fallback |
-| Preferences | `~/.config/colony/preferences.json` | Permanent |
-| Favorites | `~/.config/colony/favorites.json` | Permanent |
-| OAuth token | OS Keychain / `~/.config/colony/github_token.json` | Permanent |
+| Colony repos (cache) | `~/.config/Colony/Colony/cache/repos_cache.json` | Offline fallback |
+| Scanned apps (cache) | `~/.config/Colony/Colony/cache/scan_cache.json` | Session |
+| HTTP ETag cache | `~/.config/Colony/Colony/cache/http_etags.json` | Conditional requests across launches |
+| Repo docs (cache) | `~/.config/Colony/Colony/repo-docs/<repo>/` | Offline fallback |
+| Repo icons (cache) | `~/.config/Colony/Colony/repo-icons/<repo>/` | Offline fallback |
+| Preferences | `~/.config/Colony/Colony/preferences/preferences.json` | Permanent |
+| Favorites | `~/.config/Colony/Colony/preferences/favorites.json` | Permanent |
+| OAuth token | OS Keychain / `~/.config/Colony/Colony/auth/github_token.json` | Permanent |
+| Diagnostics log | `~/.cache/colony/colony.log` | Truncated per run |
 | Installed versions | `~/.local/share/Colony/apps/<repo>/.colony_version` | Permanent |
 | Resolved asset | `~/.local/share/Colony/apps/<repo>/.colony_asset` | Permanent |
 | Colony binaries | `~/.local/share/Colony/apps/<repo>/` | Permanent |
@@ -102,11 +114,11 @@ All async operations (API calls, downloads, scanning) return a `Task<Message>` t
 3. Replacement sequence: backup to `.old` → write the signature-verified
    bytes (never a re-read of the staged file) → chmod 755
 4. Automatic rollback if copy fails
-5. Spawns the new binary → exits the old one
+5. Spawns the new binary → exits the old one ONLY if the spawn succeeded
 
 ## Tests
 
-105 unit tests covering:
+131 unit tests covering:
 - `colony.json` manifest parsing (full, minimal, with pattern, with archives)
 - Platform auto-detection from release assets
 - `release_files` construction from assets
@@ -121,3 +133,7 @@ All async operations (API calls, downloads, scanning) return a `Task<Message>` t
   launcher-check outcomes, cancel semantics) via a hermetic test App
 - filePattern globs with exclusions, signature parsing (strict ed25519),
   typed HTTP-status classification
+- Resumable downloads end to end, against a local Range server that truncates
+  its first response
+- Remote-string URL containment (a hostile `tag` cannot leave the org)
+- Platform-gated sidebar sections, transient vs. permanently-broken manifests
diff --git a/docs/colony-spec.md b/docs/colony-spec.md
index fa4e5e3..223dca1 100644
--- a/docs/colony-spec.md
+++ b/docs/colony-spec.md
@@ -114,6 +114,7 @@ Signature and checksum siblings (`.sig`, `.sha256`, `.yml`, ...) are never match
 | `platforms` | `string[]` | no | Supported platforms. Values: `"windows"`, `"linux"`, `"macos"` (Apple Silicon), `"macos-x86"` (Intel). Auto-detected if omitted. |
 | `releaseFiles` | `object` | no | Map of platform → release entry. Each key is a platform. Auto-detected if omitted. |
 | `icon` | `string` | no | Path (relative to the repo root) to a square **PNG** app icon shown in the Colony grid. See [App icon](#app-icon). |
+| `signed` | `boolean` | no | When `true`, every release asset MUST ship a valid `<asset>.sig`; a missing signature aborts the install instead of falling back to the legacy unsigned path. Defaults to `false`. See [Signed releases](#signed-releases). |
 
 ### `releaseFiles` entry fields
 
@@ -240,8 +241,36 @@ org's private signing key, which never lives in any repository. Enforcement is
 implemented: `"signed": true` refuses an install with no signature, and the
 launcher **pins** the requirement client-side once an app has been installed with
 a verified signature, so flipping `signed` back to false in a compromised
-repository no longer downgrades that app to unsigned. What remains open is that
-an app signature is not bound to a version or an asset name, so an attacker with
-push access to a catalogue repo could still replay a *different* org-signed
-artefact; binding it needs the `.meta` sidecar rolled out to the ecosystem app
-release workflows first.
+repository no longer downgrades that app to unsigned. Since Colony 0.9.3 the binding gap is closed on the CLIENT side: an app asset
+that publishes a signed `<asset>.meta` sidecar (plus `<asset>.meta.sig`) has its
+bytes bound to an asset name, a digest and the resolved tag, and Colony refuses
+anything older than what is installed. That stops the replay of a *different*
+org-signed artefact under a new tag.
+
+Sidecars are **opportunistic and pinned**: an app that publishes none still
+installs, but once Colony has verified one for an app, a later release that
+stops publishing them is refused. So the ecosystem can adopt them repo by repo
+with no flag day, and no repo can quietly stop. The release template ships the
+`sign` job that emits them.
+
+## Validating your manifest
+
+Colony validates its own manifest format, so you do not have to guess:
+
+```sh
+colony validate-manifest colony.json
+```
+
+Pass the asset names your release publishes to also check that every platform
+actually **resolves** - which is the failure that matters, because a manifest
+can be structurally perfect and still leave your app listed with no Download
+button:
+
+```sh
+gh release view v1.2.3 --json assets --jq '.assets[].name' > names.txt
+colony validate-manifest colony.json $(tr '\n' ' ' < names.txt)
+```
+
+It exits non-zero on any problem, so it works as a CI gate. The shipped
+[release workflow template](https://github.com/Project-Colony/Project-Colony-Resources/blob/main/templates/release.yml)
+already runs it against each release before signing.
diff --git a/docs/docs.md b/docs/docs.md
index 2723db9..c685230 100644
--- a/docs/docs.md
+++ b/docs/docs.md
@@ -10,9 +10,10 @@ This folder contains the technical and end-user documentation for Colony.
 | [faq.md](faq.md)                       | End users       | Common questions + troubleshooting                        |
 | [architecture.md](architecture.md)     | Contributors    | Internal architecture, tech stack, file structure, data flow |
 | [colony-spec.md](colony-spec.md)       | App developers  | `colony.json` manifest spec + asset naming convention     |
+| [release-signing.md](release-signing.md) | Maintainers   | ed25519 release signing, the signed `.meta` sidecar, key rotation |
 
 ## See also
 
 - [Project-Colony GitHub organization](https://github.com/Project-Colony)
 - [Contributing guide](../CONTRIBUTING.md) — adding your app + contributing to Colony itself
-- [Release workflow template](../.github/workflows/colony-rust-release.yml.template) for Rust apps using `release-please`
+- [Release workflow template](https://github.com/Project-Colony/Project-Colony-Resources/blob/main/templates/release.yml) and the shared signing script, in Project-Colony-Resources
diff --git a/docs/faq.md b/docs/faq.md
index 6cd7a45..b02d878 100644
--- a/docs/faq.md
+++ b/docs/faq.md
@@ -56,7 +56,7 @@ Open the app in Colony → detail view → **Uninstall**. Or delete the app's di
 
 ### How do I uninstall Colony itself?
 
-AUR: `sudo pacman -R colony-bin` (or `colony-git`). Manual install: delete the binary plus `~/.config/colony/`, `~/.cache/colony/`, and `~/.local/share/Colony/`.
+AUR: `sudo pacman -R colony-bin` (or `colony-git`). Manual install: delete the binary plus `~/.config/Colony/Colony/`, `~/.cache/colony/`, and `~/.local/share/Colony/`.
 
 ---
 
@@ -72,7 +72,7 @@ You get a 5000 req/h limit and Colony can read private repos you have access to
 
 ### Where is the token stored?
 
-In your OS keychain (GNOME keyring, KWallet, macOS Keychain, Windows Credential Manager) via the [keyring](https://crates.io/crates/keyring) crate. If no keychain is available (headless Linux, CI) it falls back to `~/.config/colony/github_token.json` with `chmod 600`.
+In your OS keychain (GNOME keyring, KWallet, macOS Keychain, Windows Credential Manager) via the [keyring](https://crates.io/crates/keyring) crate. If no keychain is available (headless Linux, CI) it falls back to `~/.config/Colony/Colony/auth/github_token.json` with `chmod 600`.
 
 ### How do I disconnect?
 
@@ -87,13 +87,13 @@ Settings → GitHub → **Disconnect**. The token is deleted locally. The app le
 Most common causes:
 
 1. No `colony.json` at the root of the repo.
-2. `colony.json` has an invalid `category` (valid: `Development`, `Graphics`, `Network`, `Office`, `Multimedia`, `System`, `Utilities`, `Games`, `Other`).
+2. `colony.json` has an invalid `category` (valid: `Development`, `Graphics`, `Network`, `Office`, `Multimedia`, `System`, `Utilities`, `Security`, `Games`, `Other`).
 3. No GitHub release published (drafts don't count).
 4. Release assets don't match the `<repo>-<platform>` convention (see [colony-spec.md](colony-spec.md)).
 5. The repo is not under the `Project-Colony` org (Colony only scans that org).
 6. GitHub rate limit hit — connect your account.
 
-Cache file to inspect: `~/.cache/colony/repos_cache.json`.
+Cache file to inspect: `~/.config/Colony/Colony/cache/repos_cache.json`.
 
 ### Does Colony support private repos?
 
@@ -121,18 +121,20 @@ If your app is installed but not in any of these (portable binary without `.desk
 
 | What                       | Path                                                    |
 |----------------------------|---------------------------------------------------------|
-| Preferences                | `~/.config/colony/preferences.json`                     |
-| Favorites                  | `~/.config/colony/favorites.json`                       |
-| GitHub token (fallback)    | `~/.config/colony/github_token.json` (`chmod 600`)      |
+| Preferences                | `~/.config/Colony/Colony/preferences/preferences.json`      |
+| Favorites                  | `~/.config/Colony/Colony/preferences/favorites.json`        |
+| GitHub token (fallback)    | `~/.config/Colony/Colony/auth/github_token.json` (`chmod 600`) |
 | Installed app binaries     | `~/.local/share/Colony/apps/<repo>/`                    |
 | Installed version marker   | `~/.local/share/Colony/apps/<repo>/.colony_version`     |
 | Resolved asset filename    | `~/.local/share/Colony/apps/<repo>/.colony_asset`       |
-| Repo list cache            | `~/.cache/colony/repos_cache.json`                      |
-| Manifest docs cache        | `~/.cache/colony/docs/<repo>/`                          |
-| System app scan cache      | `~/.cache/colony/scan_cache.json`                       |
+| Repo list cache            | `~/.config/Colony/Colony/cache/repos_cache.json`            |
+| Manifest docs cache        | `~/.config/Colony/Colony/repo-docs/<repo>/`                 |
+| System app scan cache      | `~/.config/Colony/Colony/cache/scan_cache.json`             |
 | Self-update staging        | `~/.local/share/Colony/update-staging/`                 |
 
-Purging the `~/.cache/colony/` directory forces a full re-scan and re-fetch.
+Purging the `~/.config/Colony/Colony/cache/` directory forces a full re-scan and re-fetch, and Settings > Storage > "Clear caches" does the same from inside the app.
+
+Diagnostics are written to `~/.cache/colony/colony.log`, truncated at every start. Set `RUST_LOG=debug` for more detail.
 
 ### Can I edit `preferences.json` by hand?
 
@@ -140,14 +142,33 @@ Yes. Colony re-reads it on launch. The file is JSON with field names matching wh
 
 ### Can I override the scan directories?
 
-Yes. Edit `~/.config/colony/preferences.json` and add custom paths under the platform-appropriate scan settings. The Settings UI also exposes this for Linux.
+Yes. Edit `~/.config/Colony/Colony/preferences/preferences.json` and add custom paths under the platform-appropriate scan settings. The Settings UI also exposes this for Linux.
 
 ### I changed a theme and don't see it — why?
 
-Themes apply immediately, no restart. If a palette looks off, verify Settings → Theme has the expected family + palette selected. All 50+ palettes are compiled into the binary, so if it's missing you're on an old version — update.
+Themes apply immediately, no restart. If a palette looks off, verify Settings → Theme has the expected family + palette selected. All 57 palettes are compiled into the binary, so if it's missing you're on an old version — update.
 
 ---
 
+
+## Can I rename or reorder the sidebar sections?
+
+Yes. Colony looks for a `categories.json` override before falling back to the
+copy compiled into the binary, in this order:
+
+1. `~/.config/Colony/Colony/categories.json`
+2. next to the `colony` binary
+3. `./config/categories.json`
+
+Copy the shipped [`config/categories.json`](https://github.com/Project-Colony/Colony/blob/main/config/categories.json)
+to the first path and edit it. Each entry takes `name`, `icon` (a Nerd Font
+glyph), `origin` (`colony`, `windows`, `external`), `category`, and an optional
+`platforms` list that hides the section on other operating systems. A Favorites
+section is injected automatically if you leave it out.
+
+The same search order applies to `colony.toml`, which controls the directories
+scanned for locally installed apps.
+
 ## Troubleshooting
 
 ### Colony won't launch / crashes immediately
@@ -160,13 +181,13 @@ colony 2>&1 | tee colony.log
 
 Common causes:
 
-- Missing Linux runtime libs (GTK, dbus, xdo) — on AUR the deps are pulled automatically. For manual downloads, install them via your package manager.
+- A missing D-Bus session (the keyring backend needs one; a bare TTY or a minimal container has none) — on AUR the deps are pulled automatically. For manual downloads, install them via your package manager.
 - Corrupted cache — `rm -rf ~/.cache/colony` and relaunch.
 - Corrupted preferences — `mv ~/.config/colony/preferences.json ~/.config/colony/preferences.json.bak` and relaunch to regenerate defaults.
 
 ### Download stuck / very slow
 
-Colony uses a 300s timeout per download. If you're on slow network this may not be enough; interrupt with Esc and retry.
+Colony uses a 300s timeout per download. If you're on slow network this may not be enough; interrupt with the Cancel button on the download toast.
 
 ### Self-update fails
 
diff --git a/docs/release-signing.md b/docs/release-signing.md
index 8737963..25368ae 100644
--- a/docs/release-signing.md
+++ b/docs/release-signing.md
@@ -95,12 +95,41 @@ openssl pkey -in colony-release.pem -pubout -out colony-release.pub.pem
 openssl pkey -pubin -in colony-release.pub.pem -outform DER | tail -c 32 | xxd -i
 ```
 
-Paste the 32 bytes from step 2 into `RELEASE_PUBLIC_KEY` in
-[`src/signing.rs`](../src/signing.rs), ship a Colony release built with the new
-key, and sign all subsequent assets with the new private key. Note: clients on
-an old build trust only the old key, so keep signing with the old key until
-those clients have updated (or accept that they can no longer self-update and
-must reinstall).
+`src/signing.rs` embeds a **list** of accepted keys (`RELEASE_PUBLIC_KEYS`), and
+a signature is accepted if any listed key validates it. That is what makes a
+rotation possible at all: with a single key, the one `<asset>.sig` a release
+carries is either old-key (refused by every updated client) or new-key (refused
+by every client in the field), and verification is fail-closed, so the refusal
+is permanent either way.
+
+Rotate over three releases:
+
+| Release | `RELEASE_PUBLIC_KEYS` contains | Signed with | Who can update |
+|---|---|---|---|
+| N | `[new, old]` | **old** | everyone in the field; afterwards they trust both |
+| N+1 | `[new, old]` | **new** | everyone on N or later |
+| N+2 | `[new]` | **new** | everyone on N or later; `old` is now revoked |
+
+Two rules make this safe:
+
+- **N must be signed with the OLD key.** Its whole job is to widen the trusted
+  set on machines that only trust `old`. Signing it with `new` is the mistake
+  that strands the install base.
+- **Do not skip to N+2.** Anyone still on N-1 or earlier when `old` is dropped
+  can no longer self-update and must reinstall by hand. Leave N and N+1 in the
+  field long enough for that to be a rounding error, and check the release
+  download counts before shipping N+2.
+
+For an EMERGENCY rotation after a key leak, the same sequence applies but the
+overlap is a liability rather than a courtesy: the attacker holding `old` can
+sign anything the field will accept until N+2 ships. Publish N and N+1 back to
+back, keep the window to hours, and say so publicly - a compromised key is not a
+quiet fix.
+
+The test `any_trusted_key_verifies_and_an_untrusted_one_does_not` in
+`src/signing.rs` asserts both halves: any listed key validates, an unlisted one
+never does. It also asserts the list is length 1, so starting a rotation
+requires deliberately updating that assertion.
 
 ## Verifying a signature by hand
 
diff --git a/docs/tutorial.md b/docs/tutorial.md
index 92dc8f2..1c6e192 100644
--- a/docs/tutorial.md
+++ b/docs/tutorial.md
@@ -82,7 +82,8 @@ When you open Colony for the first time you'll see three zones:
 - **Sidebar** — Categories. The top group (`All` / `Windows` / `Linux`) is
   the *origin* filter: Colony apps, apps already installed on your system, or
   both. The middle group is Colony categories (`Development`, `Graphics`,
-  `Network`, `Office`, `Multimedia`, `System`, `Utilities`, `Games`, `Other`).
+  `Network`, `Office`, `Multimedia`, `System`, `Utilities`, `Security`, `Games`,
+  `Other`).
 - **App grid** — Cards for every app matching the current filters. Click a
   card to open its detail view.
 - **Search** — A search bar above the grid filters by app name.
@@ -121,7 +122,7 @@ Switch the sidebar origin to **Linux** (or **Windows**) to see only those.
 ## 5. Customize the theme
 
 Click the **gear icon** at the bottom of the sidebar → **Theme**. Colony ships
-24 theme families and 50+ palettes (Catppuccin, Gruvbox, Nord, Dracula, Rosé
+25 theme families and 57 palettes (Catppuccin, Gruvbox, Nord, Dracula, Rosé
 Pine, Tokyo Night, etc.). Theme changes apply instantly, no restart needed.
 
 ## 6. Connect your GitHub account (optional)
@@ -150,6 +151,6 @@ upgraded alongside the rest of your system.
   a published release with assets matching `<repo>-<platform>`. See
   [colony-spec.md](colony-spec.md) for the full manifest reference.
 - **Rate limit hit?** Connect a GitHub account (section 6).
-- **Download fails?** Check your network. Colony retries automatically; logs
-  go to `~/.cache/colony/` if you need to dig in.
+- **Download fails?** Check your network. Colony retries up to three times and resumes where it stopped; logs
+  go to `~/.cache/colony/colony.log` if you need to dig in.
 - **More questions?** See the [FAQ](faq.md).
diff --git a/scripts/sign-release.sh b/scripts/sign-release.sh
index b0279fa..43d496d 100755
--- a/scripts/sign-release.sh
+++ b/scripts/sign-release.sh
@@ -15,7 +15,14 @@
 #   <asset>.meta.sig  ed25519 signature over the .meta bytes
 #
 # The launcher verifies the sidecar and refuses anything that is not strictly
-# newer than itself, which is what stops a replay of an older org-signed build.
+# newer than itself; app installs verify the same sidecar and refuse anything
+# OLDER than what is already installed (equal is fine - an app pinned to a fixed
+# tag must stay reinstallable). Either way, that is what stops a replay of an
+# older org-signed build.
+#
+# Emitting sidecars for an app repo is safe to adopt at any time: Colony treats
+# them as opportunistic, and only makes them mandatory for a given app once it
+# has verified one (so a repo cannot silently stop publishing them).
 #
 # Usage:
 #   COLONY_SIGNING_KEY=/path/to/colony-release.pem \
diff --git a/src/app.rs b/src/app.rs
index ea796b8..37edf19 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -161,7 +161,7 @@ impl App {
                 .selected_accent
                 .clone()
                 .unwrap_or_else(|| "blue".into()),
-            auto_accent: false,
+            auto_accent: prefs.auto_accent.unwrap_or(false),
             // General
             restore_session: prefs.restore_session.unwrap_or(true),
             default_view: prefs.default_view.clone().unwrap_or_else(|| "all".into()),
@@ -190,6 +190,8 @@ impl App {
             is_checking_updates: false,
             // A catalog fetch (token'd or anonymous) always starts at boot.
             is_fetching_repos: true,
+            // The boot fetch is not a click.
+            repos_refresh_manual: false,
             // Settings section state persistence
             settings_expanded_sections: HashSet::new(),
             // Detail tabs
@@ -205,6 +207,7 @@ impl App {
             available_updates: std::collections::HashMap::new(),
             update_queue: Vec::new(),
             release_notes: std::collections::HashMap::new(),
+            release_facts: std::collections::HashMap::new(),
             fetching_notes: std::collections::HashSet::new(),
             install_status: std::collections::HashMap::new(),
             keyboard_cursor: None,
@@ -225,6 +228,17 @@ impl App {
         app.reload_app_icons();
         app.refresh_install_status();
 
+        // Nothing is in flight yet, so any staging file on disk is left over
+        // from a crash, an OOM, or a window closed mid-download. Cancel was the
+        // only thing that ever swept them.
+        let reclaimed = crate::persistence::prune_staging();
+        if reclaimed > 0 {
+            tracing::info!(
+                "reclaimed {} from interrupted transfers",
+                state::human_bytes(reclaimed)
+            );
+        }
+
         set_active_theme(&app.selected_theme, &app.selected_variant);
         set_high_contrast(app.high_contrast);
         if !app.auto_accent {
@@ -279,7 +293,33 @@ impl App {
 
         let main_layout = row![sidebar, content].spacing(0);
 
-        let page = container(main_layout).width(Fill).height(Fill);
+        // The status line used to render only inside the grid header, which is
+        // three of the four pages short: the detail page returns early, and
+        // settings and the GitHub panel replace the content pane outright. So
+        // "no release for your platform", a failed uninstall, a failed
+        // release-notes fetch and a rate-limited refresh all reported into a
+        // widget that was not on screen. As a footer it is always there, and
+        // it no longer competes with the search input for row width.
+        let page: Element<'_, Message> = if self.status_message.is_empty() {
+            container(main_layout).width(Fill).height(Fill).into()
+        } else {
+            let status_bar = container(
+                text(&self.status_message)
+                    .size(self.sz(12))
+                    .font(self.app_font())
+                    .color(Palette::TEXT_DIMMER()),
+            )
+            .padding([6, 16])
+            .width(Fill)
+            .style(|_theme| container::Style {
+                background: Some(Palette::BG_SIDEBAR().into()),
+                ..Default::default()
+            });
+            container(column![main_layout, status_bar])
+                .width(Fill)
+                .height(Fill)
+                .into()
+        };
 
         // Build overlay toasts (download progress + notifications) anchored to bottom-left
         let mut overlay_items: Vec<Element<'_, Message>> = Vec::new();
@@ -421,7 +461,7 @@ impl App {
 
         // Build the base page with overlays
         let base: Element<'_, Message> = if overlay_items.is_empty() {
-            page.into()
+            page
         } else {
             let overlay = container(Column::with_children(overlay_items).spacing(6))
                 .padding(iced::Padding {
diff --git a/src/download.rs b/src/download.rs
index 04f384d..4d71aab 100644
--- a/src/download.rs
+++ b/src/download.rs
@@ -12,20 +12,143 @@ use std::time::Duration;
 use crate::github::{APP_VERSION, CONNECT_TIMEOUT, GITHUB_ACCOUNT, LAUNCHER_OWNER, LAUNCHER_REPO};
 use crate::persistence::colony_data_dir;
 
-/// Build the HTTP client used for large asset downloads (longer read timeout
-/// than the API client).
+/// How long a download may stall before we give up. This is an *inactivity*
+/// budget, not a total one: a slow-but-alive link keeps its transfer, a dead
+/// socket still dies promptly.
+const DOWNLOAD_READ_TIMEOUT: Duration = Duration::from_secs(60);
+
+/// Build the HTTP client used for large asset downloads.
+///
+/// Deliberately no `.timeout()`: that is a *total* deadline covering connect,
+/// TLS, redirects and the whole body stream, so a 300 s cap made any asset
+/// larger than the line could carry in five minutes impossible to fetch at all
+/// (a 40 MB binary needed a sustained ~1.2 Mbit/s or it could never finish, on
+/// every attempt, with no partial progress kept). A read timeout bounds the
+/// only thing worth bounding - a connection that has stopped delivering bytes.
 fn download_client() -> Result<reqwest::Client> {
     Ok(reqwest::Client::builder()
         .user_agent(format!("Colony-Launcher/{APP_VERSION}"))
-        .timeout(Duration::from_secs(300))
+        .read_timeout(DOWNLOAD_READ_TIMEOUT)
         .connect_timeout(CONNECT_TIMEOUT)
         .build()?)
 }
 
-/// Stream an HTTP GET to `dest_path`, sending throttled progress (0.0..1.0)
-/// over `progress_tx`. Verifies the received length against Content-Length when
-/// present and rejects empty/truncated downloads. Removes `dest_path` on any
-/// failure. Shared by app-asset install and launcher self-update.
+/// Sanity ceiling on an advertised body. The whole asset is written to disk
+/// before any signature or digest check can run - that is unavoidable for a
+/// detached signature - so a misconfigured or hostile release could otherwise
+/// fill the user's home partition on its own say-so. Generous: the largest
+/// asset the org ships is two orders of magnitude below this.
+const MAX_ASSET_BYTES: u64 = 4 * 1024 * 1024 * 1024;
+
+/// Identity of the transfer a `.part` file belongs to, written beside it.
+///
+/// Resuming means stitching two responses into one file, so it is only sound
+/// while both halves describe the same artifact. A re-tagged release, or an
+/// asset rebuilt under the same name, must restart from zero rather than
+/// produce a file that never existed anywhere.
+#[derive(PartialEq, Eq)]
+struct PartIdentity {
+    etag: String,
+    total: u64,
+}
+
+impl PartIdentity {
+    fn path(dest: &std::path::Path) -> PathBuf {
+        let mut name = dest.as_os_str().to_os_string();
+        name.push(".id");
+        PathBuf::from(name)
+    }
+
+    fn read(dest: &std::path::Path) -> Option<Self> {
+        let raw = std::fs::read_to_string(Self::path(dest)).ok()?;
+        let (etag, total) = raw.split_once('\n')?;
+        Some(Self {
+            etag: etag.to_string(),
+            total: total.trim().parse().ok()?,
+        })
+    }
+
+    fn write(&self, dest: &std::path::Path) {
+        let _ = std::fs::write(Self::path(dest), format!("{}\n{}\n", self.etag, self.total));
+    }
+
+    fn forget(dest: &std::path::Path) {
+        let _ = std::fs::remove_file(Self::path(dest));
+    }
+}
+
+/// Whether a 206 response still describes the artifact a partial file belongs
+/// to. Both the validator and the total length must agree.
+fn response_matches_identity(resp: &reqwest::Response, id: &PartIdentity) -> bool {
+    let etag = resp
+        .headers()
+        .get(reqwest::header::ETAG)
+        .and_then(|v| v.to_str().ok());
+    if etag != Some(id.etag.as_str()) {
+        return false;
+    }
+    // "bytes <start>-<end>/<total>" - the total is the part we can compare.
+    resp.headers()
+        .get(reqwest::header::CONTENT_RANGE)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.rsplit('/').next())
+        .and_then(|total| total.trim().parse::<u64>().ok())
+        == Some(id.total)
+}
+
+/// Move `new` onto `dest`, even when `dest` is a binary that is currently
+/// running.
+///
+/// `std::fs::rename` over a live executable fails on Windows: the image is held
+/// with FILE_SHARE_READ|FILE_SHARE_DELETE, so MoveFileExW cannot delete the
+/// destination and returns ERROR_ACCESS_DENIED. Colony already knew the parade
+/// and applied it to its OWN self-update - rename the running file aside first,
+/// then move the new one in - but the app installer never learned it, so
+/// updating an app the user had left open failed AFTER downloading and
+/// verifying the whole asset, with a raw "Access is denied" and no hint that
+/// closing the app would fix it.
+///
+/// The aside-rename is harmless on Unix (where the plain rename would have
+/// worked anyway), so this takes the same path on every platform rather than
+/// keeping two behaviours that only one of them exercises.
+fn replace_file(new: &std::path::Path, dest: &std::path::Path) -> std::io::Result<()> {
+    if !dest.exists() {
+        return std::fs::rename(new, dest);
+    }
+    let aside = dest.with_extension("old");
+    let _ = std::fs::remove_file(&aside);
+    // A running image can always be RENAMED, on every platform - that is the
+    // whole trick. If even this fails, the destination is genuinely locked and
+    // the caller gets the real error instead of a mystery.
+    std::fs::rename(dest, &aside)?;
+    match std::fs::rename(new, dest) {
+        Ok(()) => {
+            // Best effort: on Windows the old image stays until the process
+            // holding it exits, and prune_staging() sweeps it at next boot.
+            let _ = std::fs::remove_file(&aside);
+            Ok(())
+        }
+        Err(e) => {
+            let _ = std::fs::rename(&aside, dest);
+            Err(e)
+        }
+    }
+}
+
+/// Discard a partial transfer and the identity that described it.
+fn discard_partial(dest_path: &std::path::Path) {
+    let _ = std::fs::remove_file(dest_path);
+    PartIdentity::forget(dest_path);
+}
+
+/// Stream an HTTP GET to `dest_path`, sending throttled progress over
+/// `progress_tx`, resuming a previous partial transfer when one is present and
+/// provably describes the same bytes.
+///
+/// Verifies the received length against Content-Length when present and rejects
+/// empty/truncated downloads. A partial file is KEPT on a transport failure so
+/// the next attempt can continue it, and removed on anything that makes it
+/// meaningless. Shared by app-asset install and launcher self-update.
 async fn download_to_file(
     client: &reqwest::Client,
     url: &str,
@@ -33,10 +156,35 @@ async fn download_to_file(
     dest_path: &std::path::Path,
     progress_tx: Option<futures::channel::mpsc::UnboundedSender<(u64, Option<u64>)>>,
 ) -> Result<()> {
+    // What is already on disk, and may we continue it? Both the server's ETag
+    // and the total length must match what the previous attempt recorded.
+    let resume_from = match (
+        std::fs::metadata(dest_path).map(|m| m.len()).ok(),
+        PartIdentity::read(dest_path),
+    ) {
+        (Some(have), Some(id)) if have > 0 && have < id.total => Some((have, id)),
+        // Anything else - no identity file, a complete or over-long file, an
+        // empty one - is not resumable. Start clean.
+        _ => {
+            discard_partial(dest_path);
+            None
+        }
+    };
+
     let mut request = client.get(url);
     if let Some(t) = token {
         request = request.header(reqwest::header::AUTHORIZATION, format!("Bearer {t}"));
     }
+    if let Some((have, ref id)) = resume_from {
+        // If-Range is sent, but is NOT trusted: GitHub redirects release assets
+        // to Azure blob storage, which ignores the header and answers 206 to a
+        // stale validator just the same (verified against a real release
+        // asset). So the 206 branch below re-checks the ETag and the total
+        // itself rather than taking the status code as proof.
+        request = request
+            .header(reqwest::header::RANGE, format!("bytes={have}-"))
+            .header(reqwest::header::IF_RANGE, id.etag.clone());
+    }
 
     let resp = request.send().await.map_err(|e| {
         if e.is_timeout() {
@@ -50,14 +198,66 @@ async fn download_to_file(
         anyhow::bail!("Download failed: HTTP {} for {url}", resp.status());
     }
 
-    let total = resp.content_length();
-    let mut downloaded: u64 = 0;
+    // A 206 is a claim, not a proof - the storage backend ignores If-Range.
+    // Accept it only when the response still describes the artifact the partial
+    // file belongs to: same ETag, and the same total in Content-Range. On any
+    // disagreement, throw the partial away and let the retry start clean rather
+    // than stitching two different bodies into a file that never existed.
+    let resuming = if resp.status().as_u16() == 206 {
+        match resume_from {
+            Some((_, ref id)) if response_matches_identity(&resp, id) => true,
+            Some(_) => {
+                discard_partial(dest_path);
+                anyhow::bail!("The release changed while downloading {url}; restarting");
+            }
+            None => false,
+        }
+    } else {
+        false
+    };
+    let already: u64 = if resuming {
+        resume_from.as_ref().map(|(have, _)| *have).unwrap_or(0)
+    } else {
+        0
+    };
+
+    // Total size of the WHOLE asset, not of this response.
+    let total = if resuming {
+        resume_from.as_ref().map(|(_, id)| id.total)
+    } else {
+        resp.content_length()
+    };
+
+    if let Some(total) = total {
+        anyhow::ensure!(
+            total <= MAX_ASSET_BYTES,
+            "Refusing {url}: the release advertises {total} bytes, over Colony's {MAX_ASSET_BYTES}-byte ceiling"
+        );
+    }
 
     use futures::StreamExt;
     use std::io::Write;
-    // Staging names are predictable, so never follow whatever sits there.
-    let mut file = create_new_file(dest_path)?;
+    let mut file = if resuming {
+        tracing::info!("resuming {url} at {already} bytes");
+        std::fs::OpenOptions::new().append(true).open(dest_path)?
+    } else {
+        // Fresh transfer. Record what we are about to fetch so a later attempt
+        // can tell whether continuing this file is sound, and never follow
+        // whatever sits at the (predictable) staging name.
+        discard_partial(dest_path);
+        if let (Some(etag), Some(total)) = (
+            resp.headers()
+                .get(reqwest::header::ETAG)
+                .and_then(|v| v.to_str().ok())
+                .map(str::to_string),
+            resp.content_length(),
+        ) {
+            PartIdentity { etag, total }.write(dest_path);
+        }
+        create_new_file(dest_path)?
+    };
     let mut stream = resp.bytes_stream();
+    let mut downloaded: u64 = already;
     let mut last_pct: u32 = 0;
 
     let stream_result: Result<()> = async {
@@ -65,6 +265,10 @@ async fn download_to_file(
             let chunk = chunk?;
             file.write_all(&chunk)?;
             downloaded += chunk.len() as u64;
+            anyhow::ensure!(
+                downloaded <= MAX_ASSET_BYTES,
+                "Refusing {url}: body exceeded Colony's {MAX_ASSET_BYTES}-byte ceiling"
+            );
 
             if let Some(ref tx) = progress_tx {
                 // Throttle: send on whole-percent changes when the total is
@@ -100,25 +304,106 @@ async fn download_to_file(
     .await;
 
     if let Err(e) = stream_result {
-        let _ = std::fs::remove_file(dest_path);
+        // KEEP the partial file. A drop at 95% used to throw away everything
+        // and charge the user the full asset again on the next click; with the
+        // identity sidecar beside it, the next attempt continues instead. Only
+        // a transfer we can no longer describe is discarded.
+        if PartIdentity::read(dest_path).is_none() {
+            discard_partial(dest_path);
+        }
         return Err(e);
     }
 
-    // Guard against a silently-truncated or empty transfer.
+    // Guard against a silently-truncated or empty transfer. Both are terminal
+    // for THIS file: a short body means the server disagrees with the length it
+    // advertised, so continuing from it would be guesswork.
     if let Some(total) = total {
         if downloaded != total {
-            let _ = std::fs::remove_file(dest_path);
+            discard_partial(dest_path);
             anyhow::bail!("Incomplete download: got {downloaded} of {total} bytes for {url}");
         }
     }
     if downloaded == 0 {
-        let _ = std::fs::remove_file(dest_path);
+        discard_partial(dest_path);
         anyhow::bail!("Empty download (0 bytes) for {url}");
     }
 
+    // Complete: the identity file has done its job.
+    PartIdentity::forget(dest_path);
     Ok(())
 }
 
+/// `download_to_file` with a bounded retry, so a dropped connection continues
+/// from where it stopped without the user having to notice and click again.
+///
+/// Only transport failures are retried, and only because the partial file now
+/// survives them: each attempt resumes from what the previous one wrote, so
+/// three tries cost three connections, not three assets. A verification failure
+/// never reaches here - it happens after this returns.
+async fn download_with_resume(
+    client: &reqwest::Client,
+    url: &str,
+    token: Option<&str>,
+    dest_path: &std::path::Path,
+    progress_tx: Option<futures::channel::mpsc::UnboundedSender<(u64, Option<u64>)>>,
+) -> Result<()> {
+    const ATTEMPTS: u32 = 3;
+    let mut last_err = None;
+    for attempt in 0..ATTEMPTS {
+        if attempt > 0 {
+            // Linear backoff; the point is to ride out a blip, not to hammer.
+            tokio::time::sleep(Duration::from_secs(2 * attempt as u64)).await;
+            tracing::info!("retrying {url} (attempt {} of {ATTEMPTS})", attempt + 1);
+        }
+        let had_partial = PartIdentity::read(dest_path).is_some();
+        match download_to_file(client, url, token, dest_path, progress_tx.clone()).await {
+            Ok(()) => return Ok(()),
+            Err(e) => {
+                last_err = Some(e);
+                // Retry when the next attempt would do something DIFFERENT:
+                // either a partial survived and will be continued, or one was
+                // just discarded (the release changed under us) and the next
+                // attempt starts clean. Otherwise - a 404, a refused URL - the
+                // next attempt would only repeat this one.
+                let resumable = PartIdentity::read(dest_path).is_some();
+                if !resumable && !had_partial {
+                    break;
+                }
+            }
+        }
+    }
+    Err(last_err.unwrap_or_else(|| anyhow::anyhow!("Download failed for {url}")))
+}
+
+/// Ceiling for the small sidecars Colony buffers whole (`.sig` is 64 bytes,
+/// `.meta` three short lines). Whoever controls a release can publish a
+/// multi-gigabyte file named `foo-linux.sig`; without a cap that is an OOM the
+/// moment a user clicks Install. Generous by four orders of magnitude.
+const MAX_SIDECAR_BYTES: u64 = 64 * 1024;
+
+/// Read a response body with an upper bound, so a body with no Content-Length -
+/// or one that lies about it - cannot be unbounded.
+async fn bounded_body(resp: reqwest::Response, url: &str, max: u64) -> Result<Vec<u8>> {
+    if let Some(len) = resp.content_length() {
+        anyhow::ensure!(
+            len <= max,
+            "Refusing {url}: declares {len} bytes, over the {max}-byte limit"
+        );
+    }
+    use futures::StreamExt;
+    let mut stream = resp.bytes_stream();
+    let mut out: Vec<u8> = Vec::new();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk?;
+        anyhow::ensure!(
+            out.len() as u64 + chunk.len() as u64 <= max,
+            "Refusing {url}: body exceeds the {max}-byte limit"
+        );
+        out.extend_from_slice(&chunk);
+    }
+    Ok(out)
+}
+
 /// Fetch a small OPTIONAL resource: `Ok(None)` on HTTP 404 (the resource
 /// genuinely is not published), `Err` on any other failure - so a transient
 /// network error can never be mistaken for "not published" (an attacker able
@@ -139,7 +424,7 @@ async fn fetch_optional_bytes(
     if !resp.status().is_success() {
         anyhow::bail!("HTTP {} for {url}", resp.status());
     }
-    Ok(Some(resp.bytes().await?.to_vec()))
+    Ok(Some(bounded_body(resp, url, MAX_SIDECAR_BYTES).await?))
 }
 
 /// Fetch a small resource (e.g. a detached signature) fully into memory.
@@ -152,15 +437,16 @@ async fn fetch_bytes(client: &reqwest::Client, url: &str, token: Option<&str>) -
     if !resp.status().is_success() {
         anyhow::bail!("HTTP {} for {url}", resp.status());
     }
-    Ok(resp.bytes().await?.to_vec())
+    bounded_body(resp, url, MAX_SIDECAR_BYTES).await
 }
 
-/// Verify SHA256 checksum of a file against an expected hex digest.
-fn verify_sha256(path: &std::path::Path, expected_hex: &str) -> Result<()> {
-    let mut file = std::fs::File::open(path)?;
-    let mut hasher = Sha256::new();
-    std::io::copy(&mut file, &mut hasher)?;
-    let computed = format!("{:x}", hasher.finalize());
+/// Verify a SHA256 digest over bytes already in memory.
+///
+/// Takes bytes rather than a path so the caller checks exactly what it is about
+/// to install: re-opening the staged file to hash it means the digest describes
+/// one read and the install uses another.
+fn verify_sha256_bytes(bytes: &[u8], expected_hex: &str) -> Result<()> {
+    let computed = format!("{:x}", Sha256::digest(bytes));
     if computed != expected_hex.to_lowercase() {
         anyhow::bail!(
             "SHA256 mismatch: expected {}, got {}",
@@ -178,21 +464,39 @@ fn verify_sha256(path: &std::path::Path, expected_hex: &str) -> Result<()> {
 /// whole asset - so the UI offers package-manager guidance instead of a
 /// download button that is guaranteed to die.
 pub fn launcher_is_system_managed() -> bool {
-    #[cfg(unix)]
-    {
-        std::env::current_exe()
-            .map(|exe| exe.starts_with("/usr") || exe.starts_with("/opt"))
-            .unwrap_or(false)
-    }
-    #[cfg(not(unix))]
-    {
-        false
+    let Ok(exe) = std::env::current_exe() else {
+        return false;
+    };
+    let Some(dir) = exe.parent() else {
+        return false;
+    };
+    // Behavioural, not a list of paths: probe whether we can actually create a
+    // file next to the executable. That answers /usr, /opt, Program Files,
+    // a read-only mount and a macOS /Applications install with one test and no
+    // per-platform table to keep in sync. The path check was #[cfg(unix)] only,
+    // so a Windows install under Program Files downloaded and verified the
+    // entire asset before dying on the rename - exactly the failure the guard
+    // was written to prevent, just never extended to the other platforms.
+    let probe = dir.join(format!(".colony-write-probe-{}", std::process::id()));
+    match std::fs::File::create(&probe) {
+        Ok(_) => {
+            let _ = std::fs::remove_file(&probe);
+            false
+        }
+        Err(_) => true,
     }
 }
 
 /// Ensure a filename is a single normal path component (no `..`, no path
 /// separators, not absolute) before it is joined into a destination directory.
 /// Shared by archive extraction and raw-asset download to block path traversal.
+/// Names Win32 resolves to devices no matter which directory contains them,
+/// and regardless of any extension (`CON.txt` is still the console).
+const RESERVED_DEVICE_NAMES: &[&str] = &[
+    "CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8",
+    "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+];
+
 pub(crate) fn ensure_safe_component(name: &str) -> Result<()> {
     let p = std::path::Path::new(name);
     anyhow::ensure!(
@@ -200,9 +504,74 @@ pub(crate) fn ensure_safe_component(name: &str) -> Result<()> {
             && matches!(p.components().next(), Some(std::path::Component::Normal(_))),
         "Invalid file name (path traversal attempt?): {name}"
     );
+
+    // The check above is the shape of a POSIX path, which is only half the
+    // question on the three platforms Colony supports. Rust's Windows parser
+    // recognises a drive prefix only when exactly one letter precedes the
+    // colon, so "payload:stream" is a single Normal component and joining it
+    // writes an NTFS alternate data stream on a file named "payload"; a
+    // reserved device name resolves to a device from any directory; and a
+    // trailing dot or space is stripped by the filesystem, so the name written
+    // differs from the name checked.
+    //
+    // Enforced on every platform, not behind cfg(windows): the catalog is
+    // shared, so a manifest that would be refused on Windows must be refused
+    // everywhere rather than installing differently per user.
+    anyhow::ensure!(
+        !name.contains(
+            |c: char| matches!(c, ':' | '\\' | '/' | '<' | '>' | '"' | '|' | '?' | '*')
+                || c.is_control()
+        ),
+        "Invalid file name (reserved character): {name}"
+    );
+    anyhow::ensure!(
+        !name.ends_with('.') && !name.ends_with(' '),
+        "Invalid file name (trailing dot or space is silently stripped): {name}"
+    );
+    let stem = name.split('.').next().unwrap_or(name);
+    anyhow::ensure!(
+        !RESERVED_DEVICE_NAMES
+            .iter()
+            .any(|d| stem.eq_ignore_ascii_case(d)),
+        "Invalid file name (reserved device name): {name}"
+    );
     Ok(())
 }
 
+/// Build a URL from a trusted base and remote-controlled path segments,
+/// percent-encoding each segment so it can never be structural.
+///
+/// `format!`-ing a remote string into a URL is not safe even when the string
+/// looks harmless in a JSON diff. `reqwest::Client::get` parses through the
+/// WHATWG URL parser, which collapses `..` segments (and `%2e%2e`) *before* the
+/// request is made: a `colony.json` whose `tag` reads
+/// `v1/../../../../../EvilOrg/EvilRepo/releases/download/v1` shortens the path
+/// into a different account entirely, and Colony would install and trust bytes
+/// that were never published under the org. That is the one containment claim
+/// the whole trust model rests on, and it was reachable from write access to a
+/// single line of a catalog repo - no release-publishing rights needed.
+///
+/// Segments are pushed through `path_segments_mut`, which percent-encodes them,
+/// so a `/` or a `..` inside a segment stays data. Legitimate git tags may
+/// contain `/` (`release/1.0`), so encoding is the honest fix here; rejecting
+/// the value outright would break them.
+pub(crate) fn build_url(base: &str, segments: &[&str]) -> Result<String> {
+    let mut url = reqwest::Url::parse(base)?;
+    {
+        let mut path = url
+            .path_segments_mut()
+            .map_err(|_| anyhow::anyhow!("URL base cannot have path segments: {base}"))?;
+        for segment in segments {
+            anyhow::ensure!(
+                !segment.is_empty(),
+                "empty URL path segment for base {base}"
+            );
+            path.push(segment);
+        }
+    }
+    Ok(url.into())
+}
+
 /// Normalized form of `raw` when it is an absolute `http`/`https` URL with a
 /// host, else `None`.
 ///
@@ -249,6 +618,17 @@ fn create_new_file(path: &std::path::Path) -> Result<std::fs::File> {
         .open(path)?)
 }
 
+/// `std::fs::write` for the trust path: same result, but through
+/// [`create_new_file`] so a symlink planted at the (entirely predictable)
+/// staging name is never followed.
+fn write_new_file(path: &std::path::Path, contents: &[u8]) -> Result<()> {
+    use std::io::Write;
+    let mut file = create_new_file(path)?;
+    file.write_all(contents)?;
+    file.flush()?;
+    Ok(())
+}
+
 /// Extract a single file from a .zip archive.
 fn extract_from_zip(
     archive_path: &std::path::Path,
@@ -280,7 +660,7 @@ fn extract_from_zip(
             let mut out = create_new_file(&tmp_dest)?;
             std::io::copy(&mut entry, &mut out)?;
             drop(out);
-            std::fs::rename(&tmp_dest, &final_dest)?;
+            replace_file(&tmp_dest, &final_dest)?;
             return Ok(final_dest);
         }
     }
@@ -317,7 +697,7 @@ fn extract_from_tar_gz(
             let final_dest = dest_dir.join(binary_name);
             let tmp_dest = dest_dir.join(format!("{binary_name}.new"));
             entry.unpack(&tmp_dest)?;
-            std::fs::rename(&tmp_dest, &final_dest)?;
+            replace_file(&tmp_dest, &final_dest)?;
             return Ok(final_dest);
         }
     }
@@ -354,7 +734,7 @@ fn extract_binary_from_archive(
     } else {
         // Raw binary (e.g. .exe, no archive extension) — rename to binary_name in dest_dir
         let dest = dest_dir.join(binary_name);
-        std::fs::rename(archive_path, &dest)?;
+        replace_file(archive_path, &dest)?;
         Ok(dest)
     }
 }
@@ -362,6 +742,13 @@ fn extract_binary_from_archive(
 /// Everything needed to install one resolved release asset.
 pub struct AssetInstall {
     pub repo_name: String,
+    /// The manifest's category, so the desktop menu files the app where it
+    /// belongs instead of dumping everything under Utility.
+    pub category: crate::scan::AppCategory,
+    /// What the desktop menu should call this app: the manifest's declared
+    /// name, which may differ from the repo slug. The slug stays the identity
+    /// key everywhere else (install dir, caches, entry filename).
+    pub display_name: String,
     /// The resolved (never "latest") release tag being installed.
     pub tag: String,
     /// The resolved asset name to download.
@@ -390,6 +777,8 @@ pub async fn download_release_asset(
 ) -> Result<PathBuf> {
     let AssetInstall {
         repo_name,
+        display_name,
+        category,
         tag,
         filename,
         binary_name,
@@ -409,12 +798,23 @@ pub async fn download_release_asset(
     // never truncates the currently-installed binary.
     let temp_path = dest_dir.join(format!("{filename}.part"));
 
-    let url = format!(
-        "https://github.com/{GITHUB_ACCOUNT}/{repo_name}/releases/download/{tag}/{filename}"
-    );
+    // Every segment after the host is remote-controlled (`repo_name` from the
+    // API listing, `tag` and `filename` from colony.json), so build the URL
+    // from encoded segments instead of interpolating them.
+    let url = build_url(
+        "https://github.com",
+        &[
+            GITHUB_ACCOUNT,
+            &repo_name,
+            "releases",
+            "download",
+            &tag,
+            &filename,
+        ],
+    )?;
 
     let client = download_client()?;
-    download_to_file(&client, &url, token.as_deref(), &temp_path, progress_tx).await?;
+    download_with_resume(&client, &url, token.as_deref(), &temp_path, progress_tx).await?;
 
     // `manifest.signed` lives in the very repo the signature protects, so a
     // compromised repo could flip it to false and drop the `.sig` to install
@@ -438,6 +838,73 @@ pub async fn download_release_asset(
                 anyhow::bail!("Could not check for a release signature of {filename}: {e}");
             }
         };
+    // Roll the signed metadata sidecar down to apps. A bare `.sig` proves only
+    // that the bytes came from the org key - not WHICH artefact or version they
+    // are - so a compromised maintainer could take an old, genuinely signed,
+    // known-vulnerable build, re-upload it under a new tag, and Colony would
+    // install it with every trust indicator green. The sidecar binds the bytes
+    // to an asset name, a digest and a version; the machinery already existed
+    // and was reachable only from the launcher's own self-update.
+    //
+    // Opportunistic and pinned, exactly like `.sig`: an app that publishes no
+    // sidecar today still installs, but once one has been verified, a later
+    // release cannot silently stop publishing it.
+    let metadata_pinned = crate::persistence::load_installed_metadata(&repo_name);
+    let metadata = match fetch_optional_bytes(
+        &client,
+        &format!("{url}{}", crate::signing::METADATA_SUFFIX),
+        token.as_deref(),
+    )
+    .await
+    {
+        Ok(Some(meta_bytes)) => {
+            // The sidecar is only worth anything signed. A missing signature
+            // for a PRESENT sidecar is not "legacy", it is a broken release.
+            let meta_sig = fetch_optional_bytes(
+                &client,
+                &format!(
+                    "{url}{}{}",
+                    crate::signing::METADATA_SUFFIX,
+                    crate::signing::SIGNATURE_SUFFIX
+                ),
+                token.as_deref(),
+            )
+            .await
+            .map_err(|e| {
+                anyhow::anyhow!("Could not fetch the metadata signature for {filename}: {e}")
+            })
+            .and_then(|sig| {
+                sig.ok_or_else(|| {
+                    anyhow::anyhow!(
+                        "{filename}{} was published without {filename}{}{} - refusing to install",
+                        crate::signing::METADATA_SUFFIX,
+                        crate::signing::METADATA_SUFFIX,
+                        crate::signing::SIGNATURE_SUFFIX
+                    )
+                })
+            });
+            match meta_sig {
+                Ok(meta_sig) => Some((meta_bytes, meta_sig)),
+                Err(e) => {
+                    discard_partial(&temp_path);
+                    return Err(e);
+                }
+            }
+        }
+        Ok(None) => None,
+        Err(e) => {
+            discard_partial(&temp_path);
+            anyhow::bail!("Could not check for release metadata of {filename}: {e}");
+        }
+    };
+    if metadata_pinned && metadata.is_none() {
+        discard_partial(&temp_path);
+        anyhow::bail!(
+            "{repo_name} was previously installed with verified release metadata, but this release publishes no {filename}{} - refusing to install (uninstall it first to opt back out)",
+            crate::signing::METADATA_SUFFIX
+        );
+    }
+
     if require_signature && signature.is_none() {
         let _ = std::fs::remove_file(&temp_path);
         // Say WHICH rule refused, because the two have different remedies: the
@@ -465,11 +932,25 @@ pub async fn download_release_asset(
         let binary_name = binary_name.clone();
         let filename = filename.clone();
 
+        let installed_version = crate::persistence::load_installed_version(&repo_name);
+        let resolved_tag = tag.clone();
         tokio::task::spawn_blocking(move || -> Result<PathBuf> {
             let was_signed = signature.is_some();
+            let had_metadata = metadata.is_some();
+            // Read the staged file ONCE and check everything against that one
+            // buffer. Each separate read of `<app dir>/<filename>.part` - a
+            // predictable path - is another chance to check one set of bytes
+            // and install a different set; the launcher path already avoids
+            // this by installing the buffer it verified.
+            let staged_bytes =
+                if signature.is_some() || metadata.is_some() || expected_sha256.is_some() {
+                    Some(std::fs::read(&temp_path)?)
+                } else {
+                    None
+                };
             if let Some(sig) = signature {
-                let bytes = std::fs::read(&temp_path)?;
-                if let Err(e) = crate::signing::verify_release_signature(&bytes, &sig) {
+                let bytes = staged_bytes.as_deref().unwrap_or_default();
+                if let Err(e) = crate::signing::verify_release_signature(bytes, &sig) {
                     let _ = std::fs::remove_file(&temp_path);
                     anyhow::bail!(
                         "Signature verification FAILED for {filename} - refusing to install: {e}"
@@ -477,13 +958,43 @@ pub async fn download_release_asset(
                 }
                 tracing::info!("ed25519 signature verified for {filename}");
             }
+            // The sidecar, verified against the same trusted keys and then
+            // bound to THIS asset, THIS digest and THIS tag - which is what a
+            // bare signature cannot say.
+            if let Some((meta_bytes, meta_sig)) = metadata {
+                let bytes = staged_bytes.as_deref().unwrap_or_default();
+                let checked = crate::signing::verify_release_signature(&meta_bytes, &meta_sig)
+                    .and_then(|()| crate::signing::ReleaseMetadata::parse(&meta_bytes))
+                    .and_then(|meta| {
+                        check_metadata_bindings(
+                            &meta,
+                            bytes,
+                            &filename,
+                            Some(resolved_tag.as_str()),
+                        )?;
+                        // ">=", not ">": an app pinned to a fixed tag
+                        // legitimately reinstalls the same version, so the
+                        // launcher's strictly-newer rule would lock it out.
+                        ensure_not_a_downgrade(&meta, installed_version.as_deref())?;
+                        Ok(())
+                    });
+                if let Err(e) = checked {
+                    let _ = std::fs::remove_file(&temp_path);
+                    anyhow::bail!(
+                        "Release metadata check FAILED for {filename} - refusing to install: {e}"
+                    );
+                }
+                tracing::info!("signed release metadata verified for {filename}");
+            }
             if let Some(ref expected) = expected_sha256 {
-                if let Err(e) = verify_sha256(&temp_path, expected) {
+                let bytes = staged_bytes.as_deref().unwrap_or_default();
+                if let Err(e) = verify_sha256_bytes(bytes, expected) {
                     let _ = std::fs::remove_file(&temp_path);
                     return Err(e);
                 }
                 tracing::info!("SHA256 verified for {filename}");
             }
+            drop(staged_bytes);
 
             let final_path = if let Some(ref bin) = binary_name {
                 // Archive install: extract the named binary (atomically renamed
@@ -496,10 +1007,32 @@ pub async fn download_release_asset(
             } else {
                 // Raw binary: atomically promote the verified temp file over any
                 // previous install.
-                std::fs::rename(&temp_path, &dest_path)?;
+                replace_file(&temp_path, &dest_path)?;
                 dest_path
             };
 
+            // An app whose asset name carries the version - which is the case
+            // `filePattern` exists to serve - installs the new release under a
+            // NEW filename, so the previous binary is simply orphaned. Nothing
+            // ever showed or reclaimed it: SphereCord's AppImage is 166 MB, so
+            // three updates left half a gigabyte of invisible junk that only an
+            // uninstall would clear. Drop the superseded file now that the new
+            // one is committed.
+            if let Some(stale) = crate::persistence::load_installed_asset(&repo_name) {
+                if stale != filename
+                    && Some(stale.as_str()) != binary_name.as_deref()
+                    && ensure_safe_component(&stale).is_ok()
+                {
+                    let stale_path = dest_dir.join(&stale);
+                    if stale_path != final_path && stale_path.is_file() {
+                        match std::fs::remove_file(&stale_path) {
+                            Ok(()) => tracing::info!("removed superseded binary {stale}"),
+                            Err(e) => tracing::warn!("could not remove superseded {stale}: {e}"),
+                        }
+                    }
+                }
+            }
+
             #[cfg(unix)]
             {
                 use std::os::unix::fs::PermissionsExt;
@@ -515,10 +1048,21 @@ pub async fn download_release_asset(
             // installed binary with no version file, silently excluded from
             // every future update check (or, in the filePattern case, an
             // orphaned binary the app no longer even sees as installed).
-            crate::persistence::save_installed_version(&repo_name, &tag)?;
+            //
+            // Order matters: the ASSET marker lands first and the VERSION
+            // marker last. The two writes are individually non-atomic, so a
+            // kill between them leaves a torn state - and only this order makes
+            // that state honest. With the version written first, a
+            // filePattern app whose asset name carries the version would claim
+            // the new version while `.colony_asset` still named the old file:
+            // installed_app_path resolves through the asset marker, so Colony
+            // would report the new version and Launch would run the old binary,
+            // with no update offered to correct it. This way round, a torn
+            // install simply re-offers the update.
             if record_asset {
                 crate::persistence::save_installed_asset(&repo_name, &filename)?;
             }
+            crate::persistence::save_installed_version(&repo_name, &tag)?;
             // Pin the signature requirement for future updates: a repo that
             // ships signatures today must not be able to stop tomorrow. Only
             // ever raises the bar - the marker is written, never cleared, while
@@ -526,10 +1070,20 @@ pub async fn download_release_asset(
             if was_signed {
                 crate::persistence::save_installed_signed(&repo_name)?;
             }
+            // Same one-way ratchet for the sidecar: a repo that binds its
+            // releases today must not be able to stop tomorrow.
+            if had_metadata {
+                crate::persistence::save_installed_metadata(&repo_name)?;
+            }
             // Desktop integration (Linux): index the installed app in the
             // desktop environment. Best-effort - a failure here must not fail
             // an otherwise complete install.
-            if let Err(e) = crate::persistence::write_desktop_entry(&repo_name, &final_path) {
+            if let Err(e) = crate::persistence::write_desktop_entry(
+                &repo_name,
+                &display_name,
+                category,
+                &final_path,
+            ) {
                 tracing::warn!("could not write desktop entry for {repo_name}: {e}");
             }
 
@@ -558,14 +1112,31 @@ pub async fn download_launcher_asset(
     let temp_dir = colony_data_dir()?.join("update-staging");
     std::fs::create_dir_all(&temp_dir)?;
     let dest_path = temp_dir.join(&filename);
-
-    let url = format!(
-        "https://github.com/{LAUNCHER_OWNER}/{LAUNCHER_REPO}/releases/download/{tag}/{filename}"
-    );
+    // Stream to `<asset>.part` and only rename onto the apply path once the
+    // whole file is here. Writing straight to the final name meant a download
+    // the user never applied - or a cancelled one - left a partial file at
+    // exactly the path apply_launcher_update consumes. Apply re-verifies, so it
+    // was refused fail-closed rather than being a hole, but the file sat there.
+    let part_path = temp_dir.join(format!("{filename}.part"));
+
+    let url = build_url(
+        "https://github.com",
+        &[
+            LAUNCHER_OWNER,
+            LAUNCHER_REPO,
+            "releases",
+            "download",
+            &tag,
+            &filename,
+        ],
+    )?;
 
     let client = download_client()?;
-    // download_to_file validates the length and rejects an empty/truncated body.
-    download_to_file(&client, &url, token.as_deref(), &dest_path, progress_tx).await?;
+    // Validates the length, rejects an empty/truncated body, and resumes a
+    // previous partial transfer when one provably describes the same asset.
+    download_with_resume(&client, &url, token.as_deref(), &part_path, progress_tx).await?;
+    let _ = std::fs::remove_file(&dest_path);
+    std::fs::rename(&part_path, &dest_path)?;
 
     // Fail-closed signature check: fetch the detached signature and verify the
     // downloaded binary against the embedded release key BEFORE it can be
@@ -625,13 +1196,13 @@ pub async fn download_launcher_asset(
     // file could be swapped between download and apply. The metadata sidecar is
     // staged for the same reason.
     let sig_path = staged_signature_path(&dest_path);
-    if let Err(e) = std::fs::write(&sig_path, &signature) {
+    if let Err(e) = write_new_file(&sig_path, &signature) {
         let _ = std::fs::remove_file(&dest_path);
         anyhow::bail!("Could not stage update signature: {e}");
     }
     let (meta_path, meta_sig_path) = staged_metadata_paths(&dest_path);
-    if let Err(e) = std::fs::write(&meta_path, &meta_bytes)
-        .and_then(|()| std::fs::write(&meta_sig_path, &meta_sig))
+    if let Err(e) = write_new_file(&meta_path, &meta_bytes)
+        .and_then(|()| write_new_file(&meta_sig_path, &meta_sig))
     {
         let _ = std::fs::remove_file(&dest_path);
         anyhow::bail!("Could not stage update metadata: {e}");
@@ -684,24 +1255,21 @@ fn verify_launcher_metadata(
     crate::signing::verify_release_signature(meta_bytes, meta_sig)
         .map_err(|e| anyhow::anyhow!("update metadata signature invalid: {e}"))?;
     let meta = crate::signing::ReleaseMetadata::parse(meta_bytes)?;
-    check_metadata_bindings(
-        &meta,
-        binary_bytes,
-        expected_asset,
-        expected_tag,
-        APP_VERSION,
-    )
+    check_metadata_bindings(&meta, binary_bytes, expected_asset, expected_tag)?;
+    ensure_strictly_newer(&meta, APP_VERSION)
 }
 
-/// The binding rules of [`verify_launcher_metadata`], split out so they can be
-/// tested without the release private key (`running` is injectable for the same
-/// reason). Assumes the metadata signature has already been verified.
+/// The binding rules shared by the launcher and app install paths, split out so
+/// they can be tested without the release private key. Assumes the metadata
+/// signature has already been verified.
+///
+/// Deliberately does NOT compare versions: that rule differs between the two
+/// callers (see [`ensure_strictly_newer`] and [`ensure_not_a_downgrade`]).
 fn check_metadata_bindings(
     meta: &crate::signing::ReleaseMetadata,
     binary_bytes: &[u8],
     expected_asset: &str,
     expected_tag: Option<&str>,
-    running: &str,
 ) -> Result<()> {
     anyhow::ensure!(
         meta.asset == expected_asset,
@@ -724,6 +1292,14 @@ fn check_metadata_bindings(
         );
     }
 
+    Ok(())
+}
+
+/// The launcher's extra rule: a self-update must be STRICTLY newer than the
+/// build applying it. Separate from [`check_metadata_bindings`] because apps do
+/// not share it - an app pinned to a fixed tag legitimately reinstalls the same
+/// version, so "strictly newer" would make reinstalling impossible.
+fn ensure_strictly_newer(meta: &crate::signing::ReleaseMetadata, running: &str) -> Result<()> {
     let new = crate::github::parse_version_tag(&meta.version).ok_or_else(|| {
         anyhow::anyhow!(
             "unrecognized version in update metadata: '{}'",
@@ -739,6 +1315,33 @@ fn check_metadata_bindings(
     Ok(())
 }
 
+/// The app equivalent: never go BACKWARDS from what is installed, but allow the
+/// same version (a reinstall, or an app pinned to a fixed tag).
+///
+/// Non-semver tags are common in the ecosystem and are not orderable, so they
+/// are accepted here rather than refused - the asset, digest and tag bindings
+/// already did the work that matters, and refusing them would lock those apps
+/// out of updates entirely.
+fn ensure_not_a_downgrade(
+    meta: &crate::signing::ReleaseMetadata,
+    installed: Option<&str>,
+) -> Result<()> {
+    let Some(installed) = installed else {
+        return Ok(());
+    };
+    let (Some(new), Some(current)) = (
+        crate::github::parse_version_tag(&meta.version),
+        crate::github::parse_version_tag(installed),
+    ) else {
+        return Ok(());
+    };
+    anyhow::ensure!(
+        new >= current,
+        "refusing a downgrade: signed release is {new} but {current} is installed"
+    );
+    Ok(())
+}
+
 /// Replace the running Colony binary with the downloaded update.
 /// Returns the exe path for relaunch on success. Restores backup on failure.
 pub fn apply_launcher_update(new_binary: &std::path::Path) -> Result<PathBuf> {
@@ -813,8 +1416,14 @@ pub fn apply_launcher_update(new_binary: &std::path::Path) -> Result<PathBuf> {
     }
     // Write the byte buffer that was just VERIFIED - copying the file again
     // would re-read from disk and install bytes the signature check never saw
-    // (a swap between read and copy would slip through).
-    std::fs::write(&staged_next, &staged_bytes)
+    // (a swap between read and copy would slip through). Through
+    // `write_new_file`, because `<exe>.new` is a predictable name in a
+    // user-writable directory: `fs::write` follows a symlink planted there, so
+    // the verified bytes would land at the attacker's path and the rename below
+    // would then move the SYMLINK over the running binary - turning Colony's
+    // own executable into a link to a file rewritable afterwards, cleanly past
+    // every signature check.
+    write_new_file(&staged_next, &staged_bytes)
         .map_err(|e| anyhow::anyhow!("Failed to stage new binary: {e}"))?;
     #[cfg(unix)]
     {
@@ -859,6 +1468,212 @@ pub fn apply_launcher_update(new_binary: &std::path::Path) -> Result<PathBuf> {
 mod tests {
     use super::*;
 
+    /// A one-shot HTTP server that TRUNCATES the first response and honours
+    /// Range on the next one - the shape of a real dropped connection.
+    ///
+    /// Hand-rolled on `std::net` rather than pulled in as a dependency: the
+    /// point is to prove the resume path end to end without adding a test-only
+    /// crate to a project that counts its dependencies.
+    fn spawn_truncating_server(
+        body: Vec<u8>,
+        cut: usize,
+        etag: &str,
+    ) -> (String, std::thread::JoinHandle<()>) {
+        use std::io::{BufRead, BufReader, Write};
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind");
+        let url = format!("http://{}/asset", listener.local_addr().unwrap());
+        let etag = etag.to_string();
+        let handle = std::thread::spawn(move || {
+            // Two connections: the truncated one, then the ranged one.
+            for _ in 0..2 {
+                let Ok((stream, _)) = listener.accept() else {
+                    return;
+                };
+                let mut reader = BufReader::new(&stream);
+                let mut range_start: Option<usize> = None;
+                loop {
+                    let mut line = String::new();
+                    if reader.read_line(&mut line).unwrap_or(0) == 0 {
+                        return;
+                    }
+                    if let Some(v) = line.to_ascii_lowercase().strip_prefix("range: bytes=") {
+                        range_start = v.split('-').next().and_then(|n| n.trim().parse().ok());
+                    }
+                    if line == "\r\n" || line == "\n" {
+                        break;
+                    }
+                }
+                let mut stream = &stream;
+                match range_start {
+                    Some(start) => {
+                        let chunk = &body[start..];
+                        let head = format!(
+                            "HTTP/1.1 206 Partial Content\r\nContent-Range: bytes {}-{}/{}\r\nContent-Length: {}\r\nETag: {}\r\nConnection: close\r\n\r\n",
+                            start,
+                            body.len() - 1,
+                            body.len(),
+                            chunk.len(),
+                            etag
+                        );
+                        let _ = stream.write_all(head.as_bytes());
+                        let _ = stream.write_all(chunk);
+                    }
+                    None => {
+                        let head = format!(
+                            "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nETag: {}\r\nConnection: close\r\n\r\n",
+                            body.len(),
+                            etag
+                        );
+                        let _ = stream.write_all(head.as_bytes());
+                        // Promise the whole body, deliver part of it, hang up.
+                        let _ = stream.write_all(&body[..cut]);
+                    }
+                }
+                let _ = stream.flush();
+            }
+        });
+        (url, handle)
+    }
+
+    /// The behaviour this whole batch exists for: a connection that died at 40%
+    /// used to throw away every byte and charge the user the full asset again.
+    #[test]
+    fn a_dropped_connection_is_resumed_instead_of_restarted() {
+        let body: Vec<u8> = (0..300_000usize)
+            .map(|i| ((i * 7 + 3) % 256) as u8)
+            .collect();
+        let (url, server) = spawn_truncating_server(body.clone(), 120_000, "\"v1\"");
+
+        let dir = std::env::temp_dir().join("colony_test_resume");
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let dest = dir.join("asset.part");
+
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap();
+        let result = rt.block_on(async {
+            let client = download_client().unwrap();
+            download_with_resume(&client, &url, None, &dest, None).await
+        });
+
+        assert!(
+            result.is_ok(),
+            "the retry must finish the transfer: {result:?}"
+        );
+        assert_eq!(
+            std::fs::read(&dest).unwrap(),
+            body,
+            "the stitched file must be byte-identical to the asset"
+        );
+        assert!(
+            !PartIdentity::path(&dest).exists(),
+            "a completed transfer leaves no identity file behind"
+        );
+
+        let _ = std::fs::remove_dir_all(&dir);
+        let _ = server.join();
+    }
+
+    /// Resuming stitches two responses into one file, so it is only sound
+    /// while both describe the same artifact. The identity sidecar is what
+    /// makes that decidable; without it, a re-tagged release could be silently
+    /// assembled from two different bodies.
+    #[test]
+    fn a_partial_transfer_is_only_resumable_against_its_own_identity() {
+        let dir = std::env::temp_dir().join("colony_test_part_identity");
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let part = dir.join("grape-linux.part");
+
+        // A partial transfer plus the identity that describes it.
+        std::fs::write(&part, vec![0u8; 512]).unwrap();
+        PartIdentity {
+            etag: "\"abc\"".into(),
+            total: 4096,
+        }
+        .write(&part);
+
+        let id = PartIdentity::read(&part).expect("identity round-trips");
+        assert_eq!(id.etag, "\"abc\"");
+        assert_eq!(id.total, 4096);
+        assert!(
+            std::fs::metadata(&part).unwrap().len() < id.total,
+            "a short file against a known total is what makes a resume possible"
+        );
+
+        // Discarding takes the sidecar with it, so the next attempt cannot
+        // resume from bytes nothing describes.
+        discard_partial(&part);
+        assert!(!part.exists());
+        assert!(PartIdentity::read(&part).is_none());
+
+        // A truncated or garbage sidecar is not an identity.
+        std::fs::write(PartIdentity::path(&part), "no-newline-here").unwrap();
+        assert!(PartIdentity::read(&part).is_none());
+        std::fs::write(PartIdentity::path(&part), "\"abc\"\nnot-a-number\n").unwrap();
+        assert!(PartIdentity::read(&part).is_none());
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A `tag` from colony.json used to be interpolated straight into the
+    /// release URL. reqwest parses with the WHATWG parser, which collapses
+    /// `..` BEFORE the request is issued, so one line of a catalog repo could
+    /// redirect the install to an account outside the org entirely - defeating
+    /// the only containment claim the trust model has.
+    #[test]
+    fn a_hostile_tag_cannot_walk_the_release_url_out_of_the_org() {
+        let hostile = "v1/../../../../../EvilOrg/EvilRepo/releases/download/v1";
+        let url = build_url(
+            "https://github.com",
+            &[
+                "Project-Colony",
+                "Grape",
+                "releases",
+                "download",
+                hostile,
+                "grape-linux",
+            ],
+        )
+        .expect("segments are encoded, not rejected");
+
+        assert!(
+            url.starts_with("https://github.com/Project-Colony/Grape/releases/download/"),
+            "the request must stay inside the org, got {url}"
+        );
+        assert!(
+            !url.contains("EvilOrg/EvilRepo/releases"),
+            "the traversal must not survive as structure, got {url}"
+        );
+
+        // Reparsing is what reqwest itself does; the collapse must not happen
+        // there either, which is the whole point of encoding the segment.
+        let reparsed = reqwest::Url::parse(&url).expect("valid URL");
+        assert_eq!(
+            reparsed.path_segments().map(|s| s.count()),
+            Some(6),
+            "no segment may be structural: {url}"
+        );
+
+        // A legitimate tag containing a slash (`release/1.0`) still works -
+        // rejecting `/` outright would have broken real repos.
+        let ok = build_url(
+            "https://github.com",
+            &[
+                "Project-Colony",
+                "Grape",
+                "releases",
+                "download",
+                "release/1.0",
+                "grape-linux",
+            ],
+        )
+        .expect("slashes in a tag are encoded, not an error");
+        assert!(ok.contains("release%2F1.0"), "got {ok}");
+    }
+
     /// The raw-binary branch of `extract_binary_from_archive` used to join the
     /// manifest's `binary` field straight into the install dir, so a hostile
     /// manifest could write anywhere (the caller then chmods 0755 and writes a
@@ -984,7 +1799,8 @@ mod tests {
         let bytes = b"new colony build";
         let meta = meta_for(bytes, "v1.2.0", "colony-linux");
         assert!(
-            check_metadata_bindings(&meta, bytes, "colony-linux", Some("v1.2.0"), "1.1.0").is_ok()
+            check_metadata_bindings(&meta, bytes, "colony-linux", Some("v1.2.0")).is_ok()
+                && ensure_strictly_newer(&meta, "1.1.0").is_ok()
         );
     }
 
@@ -995,7 +1811,11 @@ mod tests {
         let bytes = b"old colony build";
         for older in ["v1.0.0", "v0.9.0", "v1.1.0"] {
             let meta = meta_for(bytes, older, "colony-linux");
-            let err = check_metadata_bindings(&meta, bytes, "colony-linux", Some(older), "1.1.0")
+            // The BINDINGS pass - the bytes really are that signed artefact.
+            // What refuses the replay is the version rule that sits beside
+            // them, which is why it lives in its own function per caller.
+            assert!(check_metadata_bindings(&meta, bytes, "colony-linux", Some(older)).is_ok());
+            let err = ensure_strictly_newer(&meta, "1.1.0")
                 .unwrap_err()
                 .to_string();
             assert!(
@@ -1011,8 +1831,7 @@ mod tests {
         // Genuine, correctly signed metadata - but for a DIFFERENT asset.
         let meta = meta_for(served, "v1.2.0", "colony-macos");
         assert!(
-            check_metadata_bindings(&meta, served, "colony-linux", Some("v1.2.0"), "1.1.0")
-                .is_err(),
+            check_metadata_bindings(&meta, served, "colony-linux", Some("v1.2.0")).is_err(),
             "metadata naming another asset must not validate this download"
         );
     }
@@ -1021,23 +1840,48 @@ mod tests {
     fn signed_metadata_refuses_mismatched_digest_or_tag() {
         let meta = meta_for(b"expected bytes", "v1.2.0", "colony-linux");
         assert!(
-            check_metadata_bindings(&meta, b"tampered bytes", "colony-linux", None, "1.1.0")
-                .is_err(),
+            check_metadata_bindings(&meta, b"tampered bytes", "colony-linux", None).is_err(),
             "digest mismatch must fail"
         );
         assert!(
-            check_metadata_bindings(
-                &meta,
-                b"expected bytes",
-                "colony-linux",
-                Some("v1.3.0"),
-                "1.1.0"
-            )
-            .is_err(),
+            check_metadata_bindings(&meta, b"expected bytes", "colony-linux", Some("v1.3.0"))
+                .is_err(),
             "metadata for another tag than the one resolved must fail"
         );
     }
 
+    /// Apps do not share the launcher's strictly-newer rule - an app pinned to
+    /// a fixed tag reinstalls the same version - but they must still refuse a
+    /// genuinely-signed OLDER build replayed under a new tag.
+    #[test]
+    fn an_app_may_reinstall_the_same_version_but_never_an_older_one() {
+        let meta = meta_for(b"bytes", "v1.2.0", "grape-linux");
+
+        assert!(
+            ensure_not_a_downgrade(&meta, Some("v1.2.0")).is_ok(),
+            "reinstalling the pinned version must stay possible"
+        );
+        assert!(ensure_not_a_downgrade(&meta, Some("v1.1.0")).is_ok());
+        assert!(ensure_not_a_downgrade(&meta, None).is_ok(), "first install");
+        assert!(
+            ensure_not_a_downgrade(&meta, Some("v2.0.0")).is_err(),
+            "a signed but older release must not be installable over a newer one"
+        );
+
+        // The launcher rule is the stricter one, and stays that way.
+        assert!(ensure_strictly_newer(&meta, "1.1.0").is_ok());
+        assert!(
+            ensure_strictly_newer(&meta, "1.2.0").is_err(),
+            "the launcher must never reapply its own version"
+        );
+
+        // Non-semver tags are common in the ecosystem and are not orderable:
+        // accepted, because the asset/digest/tag bindings already did the work
+        // and refusing would lock those apps out of updates entirely.
+        let nightly = meta_for(b"bytes", "nightly", "grape-linux");
+        assert!(ensure_not_a_downgrade(&nightly, Some("nightly")).is_ok());
+    }
+
     #[test]
     fn extract_from_zip_works() {
         use std::io::Write;
@@ -1174,7 +2018,7 @@ mod tests {
 
         // SHA256 of "hello world"
         let expected = "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9";
-        assert!(verify_sha256(&file_path, expected).is_ok());
+        assert!(verify_sha256_bytes(&std::fs::read(&file_path).unwrap(), expected).is_ok());
 
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -1189,7 +2033,9 @@ mod tests {
         f.write_all(b"hello world").unwrap();
         f.flush().unwrap();
 
-        assert!(verify_sha256(&file_path, "0000000000000000").is_err());
+        assert!(
+            verify_sha256_bytes(&std::fs::read(&file_path).unwrap(), "0000000000000000").is_err()
+        );
 
         let _ = std::fs::remove_dir_all(&dir);
     }
diff --git a/src/github/catalog.rs b/src/github/catalog.rs
index a32b2c5..5a4e5e0 100644
--- a/src/github/catalog.rs
+++ b/src/github/catalog.rs
@@ -41,9 +41,19 @@ pub async fn fetch_colony_repos(token: Option<&str>) -> Result<Vec<ColonyRepo>>
                 let mut manifest = match fetch_colony_manifest(&client, &name).await {
                     Ok(Some(m)) => m,
                     Ok(None) => return None,
+                    Err(e) if is_invalid_manifest(&e) => {
+                        // The repo's OWN content is broken. Retrying will not
+                        // help, so this must not join transient_failures -
+                        // doing so resurrected the stale cached entry, and the
+                        // store kept serving the last-good manifest forever
+                        // while the maintainer wondered why their release never
+                        // appeared. Log the serde message: it names the field.
+                        tracing::error!("{e}");
+                        return None;
+                    }
                     Err(e) => {
-                        // fetch_colony_manifest already maps 404 to Ok(None),
-                        // so an Err here is transient, not "no manifest".
+                        // Transport, rate limit, or a malformed API envelope:
+                        // transient, so the cached entry is worth keeping.
                         tracing::warn!("Error checking colony.json for {}: {e}", name);
                         if let Ok(mut failed) = transient_failures.lock() {
                             failed.insert(name.clone());
@@ -55,7 +65,14 @@ pub async fn fetch_colony_repos(token: Option<&str>) -> Result<Vec<ColonyRepo>>
                 // Auto-detect platforms from release assets if manifest is minimal
                 if manifest.release_files.is_empty() {
                     if let Err(e) = auto_detect_release(&client, &name, &mut manifest).await {
-                        tracing::debug!("Auto-detect skipped for {name}: {e}");
+                        // Swallowed at debug level, this is why Eidos sits in
+                        // the catalog as a card with no platforms and no
+                        // Download button and nothing anywhere says which check
+                        // failed. It is the app author's actionable signal.
+                        tracing::warn!(
+                            "{name} declares no releaseFiles and no release asset matches the \
+                             <name>-<platform> convention, so it is not installable: {e}"
+                        );
                     }
                 }
 
@@ -72,10 +89,17 @@ pub async fn fetch_colony_repos(token: Option<&str>) -> Result<Vec<ColonyRepo>>
                 let (readme_result, license_result, changelog_result, icon_result) =
                     futures::future::join4(readme_fut, license_fut, changelog_fut, icon_fut).await;
 
+                // On failure the grid card still needs text, so the in-memory
+                // description falls back to the repo's one-liner - but the
+                // DISK cache must not be overwritten with it. Unguarded (unlike
+                // its three siblings below), one rate-limited refresh
+                // permanently degraded every affected detail page to a single
+                // sentence, and the way back was another successful fetch the
+                // user could not trigger while still rate-limited.
+                if let Ok(ref full) = readme_result {
+                    save_repo_doc(&name, "README.md", full);
+                }
                 let description = readme_result.unwrap_or(fallback_desc);
-
-                // Save docs + icon to disk cache
-                save_repo_doc(&name, "README.md", &description);
                 if let Ok(Some(ref content)) = license_result {
                     save_repo_doc(&name, "LICENSE.md", content);
                 }
@@ -135,7 +159,7 @@ async fn list_repos_paginated(client: &reqwest::Client) -> Result<Vec<GithubRepo
         let url = format!(
             "{GITHUB_API}/orgs/{GITHUB_ACCOUNT}/repos?per_page=100&sort=updated&page={page}"
         );
-        let (body, _) = cached_get(client, &url).await?;
+        let body = cached_get(client, &url).await?;
         let repos: Vec<GithubRepo> = serde_json::from_str(&body)?;
 
         if repos.is_empty() {
@@ -163,13 +187,33 @@ async fn list_repos_paginated(client: &reqwest::Client) -> Result<Vec<GithubRepo
 }
 
 /// Fetch and parse colony.json from a repo. Returns None if the file doesn't exist.
+/// Marker carried in the `anyhow` chain when a `colony.json` is present but
+/// permanently unusable (bad base64, malformed JSON, a field of the wrong
+/// type). Distinct from a transport failure: retrying will not help, and the
+/// stale cached entry must NOT be resurrected over it.
+#[derive(Debug)]
+pub struct InvalidManifest(pub String);
+
+impl std::fmt::Display for InvalidManifest {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+impl std::error::Error for InvalidManifest {}
+
+/// True when the failure is the repo's own content, not the network.
+fn is_invalid_manifest(error: &anyhow::Error) -> bool {
+    error.chain().any(|e| e.is::<InvalidManifest>())
+}
+
 async fn fetch_colony_manifest(
     client: &reqwest::Client,
     repo_name: &str,
 ) -> Result<Option<ColonyManifest>> {
     let url = format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/contents/colony.json");
     match cached_get(client, &url).await {
-        Ok((body, _)) => {
+        Ok(body) => {
             let content: GithubContent = serde_json::from_str(&body).map_err(|e| {
                 anyhow::anyhow!("Failed to parse GitHub content response for {repo_name}: {e}")
             })?;
@@ -182,10 +226,15 @@ async fn fetch_colony_manifest(
             let bytes = base64::engine::general_purpose::STANDARD
                 .decode(&cleaned)
                 .map_err(|e| {
-                    anyhow::anyhow!("Failed to decode base64 for {repo_name}/colony.json: {e}")
+                    anyhow::Error::new(InvalidManifest(format!(
+                        "Failed to decode base64 for {repo_name}/colony.json: {e}"
+                    )))
                 })?;
-            let manifest: ColonyManifest = serde_json::from_slice(&bytes)
-                .map_err(|e| anyhow::anyhow!("Invalid colony.json in {repo_name}: {e}"))?;
+            let manifest: ColonyManifest = serde_json::from_slice(&bytes).map_err(|e| {
+                anyhow::Error::new(InvalidManifest(format!(
+                    "Invalid colony.json in {repo_name}: {e}"
+                )))
+            })?;
             Ok(Some(manifest))
         }
         Err(e) => {
@@ -201,7 +250,7 @@ async fn fetch_colony_manifest(
 /// Fetch the README content from a repo, returning the first ~500 chars as plain text.
 async fn fetch_readme(client: &reqwest::Client, repo_name: &str) -> Result<String> {
     let url = format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/readme");
-    let (body, _) = cached_get(client, &url).await?;
+    let body = cached_get(client, &url).await?;
     let readme: GithubReadme = serde_json::from_str(&body)?;
     let raw = readme.content.unwrap_or_default();
     let cleaned: String = raw.chars().filter(|c| !c.is_whitespace()).collect();
@@ -221,7 +270,7 @@ async fn fetch_readme(client: &reqwest::Client, repo_name: &str) -> Result<Strin
 async fn fetch_license(client: &reqwest::Client, repo_name: &str) -> Result<Option<String>> {
     let url = format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/license");
     match cached_get(client, &url).await {
-        Ok((body, _)) => {
+        Ok(body) => {
             let content: GithubContent = serde_json::from_str(&body)?;
             let raw = content.content.unwrap_or_default();
             let cleaned: String = raw.chars().filter(|c| !c.is_whitespace()).collect();
@@ -260,6 +309,20 @@ async fn fetch_license_with_fallback(
     }
 }
 
+/// Build a `contents` API URL with every path segment percent-encoded.
+///
+/// `repo_name` comes from the API listing and `path` can be the manifest's
+/// `icon` field - both remote data, on a request that carries the user's token.
+/// Interpolating them lets a `..` shorten the path onto a different endpoint
+/// before the request is sent. An icon path is legitimately nested
+/// ("assets/icons/icon.png"), so it is split on '/' and each part encoded
+/// rather than rejected wholesale.
+fn contents_url(repo_name: &str, path: &str) -> Result<String> {
+    let mut segments = vec!["repos", GITHUB_ACCOUNT, repo_name, "contents"];
+    segments.extend(path.split('/').filter(|s| !s.is_empty()));
+    crate::download::build_url(GITHUB_API, &segments)
+}
+
 /// Fetch a file from a repo, trying multiple candidate paths.
 /// Returns the decoded UTF-8 content of the first file found, or None if all return 404.
 async fn fetch_repo_file_candidates(
@@ -268,9 +331,15 @@ async fn fetch_repo_file_candidates(
     candidates: &[&str],
 ) -> Result<Option<String>> {
     for path in candidates {
-        let url = format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/contents/{path}");
+        let url = match contents_url(repo_name, path) {
+            Ok(u) => u,
+            Err(e) => {
+                tracing::warn!("skipping unusable path {path:?} for {repo_name}: {e}");
+                continue;
+            }
+        };
         match cached_get(client, &url).await {
-            Ok((body, _)) => {
+            Ok(body) => {
                 let content: GithubContent = serde_json::from_str(&body)?;
                 let raw = content.content.unwrap_or_default();
                 let cleaned: String = raw.chars().filter(|c| !c.is_whitespace()).collect();
@@ -305,9 +374,15 @@ async fn fetch_icon(
         candidates.push("icon.png");
     }
     for path in candidates {
-        let url = format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/contents/{path}");
+        let url = match contents_url(repo_name, path) {
+            Ok(u) => u,
+            Err(e) => {
+                tracing::warn!("skipping unusable path {path:?} for {repo_name}: {e}");
+                continue;
+            }
+        };
         match cached_get(client, &url).await {
-            Ok((body, _)) => {
+            Ok(body) => {
                 let content: GithubContent = serde_json::from_str(&body)?;
                 let raw = content.content.unwrap_or_default();
                 let cleaned: String = raw.chars().filter(|c| !c.is_whitespace()).collect();
@@ -326,3 +401,38 @@ async fn fetch_icon(
     }
     Ok(None)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A repo whose own colony.json is malformed used to be filed as a
+    /// TRANSIENT failure, which resurrected its stale cached entry - so the
+    /// store served the last-good manifest forever and the maintainer got no
+    /// signal that their release would never appear.
+    #[test]
+    fn a_broken_manifest_is_permanent_not_transient() {
+        let broken = anyhow::Error::new(InvalidManifest("Invalid colony.json in Foo".into()));
+        assert!(is_invalid_manifest(&broken));
+
+        // With context stacked on top, the way the real call site sees it.
+        let wrapped = broken.context("while refreshing the catalog");
+        assert!(is_invalid_manifest(&wrapped));
+
+        // A network failure is NOT a broken manifest: it must keep the cache.
+        let transient = anyhow::anyhow!("Connection failed for https://api.github.com/...");
+        assert!(!is_invalid_manifest(&transient));
+    }
+
+    /// The real shape of a manifest that would break: `platforms` is a
+    /// Vec<String>, and a bare string there is a maintainer typo, not a blip.
+    #[test]
+    fn a_wrongly_typed_manifest_field_parses_as_invalid() {
+        let err = serde_json::from_slice::<ColonyManifest>(
+            br#"{"name":"Foo","category":"System","platforms":"linux"}"#,
+        )
+        .expect_err("a string where a list belongs must not parse");
+        let as_invalid = anyhow::Error::new(InvalidManifest(format!("Invalid colony.json: {err}")));
+        assert!(is_invalid_manifest(&as_invalid));
+    }
+}
diff --git a/src/github/http.rs b/src/github/http.rs
index b54d71d..250387b 100644
--- a/src/github/http.rs
+++ b/src/github/http.rs
@@ -30,13 +30,116 @@ pub(crate) const MAX_CONCURRENT_REPO_FETCHES: usize = 8;
 
 // --- HTTP ETag Cache ---
 
+/// How long a remembered 404 is trusted before Colony probes the URL again.
+///
+/// The catalog deliberately generates 404s: it tries several CHANGELOG names,
+/// several licence filenames, a second icon path, and colony.json for every
+/// repo in the org including the ones that will never have one. GitHub bills
+/// each of those against the quota and an ETag can never help, because a 404
+/// carries no ETag to send back. Remembering them is what keeps a cold boot
+/// inside the 60/h anonymous budget. The TTL is the cost of the trade: a repo
+/// that ADDS a CHANGELOG is picked up on the next window, or immediately via
+/// Settings > "Clear caches".
+const NOT_FOUND_TTL_SECS: u64 = 6 * 3600;
+
+/// Skip persisting any single body larger than this. READMEs are the big
+/// entries here and a pathological one should not bloat every launch.
+const MAX_CACHED_BODY_BYTES: usize = 512 * 1024;
+
+/// Total on-disk budget for the persisted cache.
+const MAX_CACHE_FILE_BYTES: usize = 4 * 1024 * 1024;
+
+#[derive(Clone, serde::Serialize, serde::Deserialize)]
 struct CacheEntry {
     etag: String,
     body: String,
 }
 
-static HTTP_CACHE: std::sync::LazyLock<Mutex<HashMap<String, CacheEntry>>> =
-    std::sync::LazyLock::new(|| Mutex::new(HashMap::new()));
+#[derive(Default, serde::Serialize, serde::Deserialize)]
+struct PersistedCache {
+    /// url -> last ETag and the body it described.
+    #[serde(default)]
+    entries: HashMap<String, CacheEntry>,
+    /// url -> unix seconds when GitHub last answered 404.
+    #[serde(default)]
+    not_found: HashMap<String, u64>,
+}
+
+fn now_secs() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+/// The conditional-request cache, restored from disk at first use.
+///
+/// This used to start empty on every launch, which made a cold boot and a warm
+/// boot cost exactly the same: ~55 full 200s for the org catalog, against an
+/// anonymous budget of 60/h. Opening Colony twice within the hour rate-limited
+/// the second launch. GitHub does not bill a 304, so replaying the ETags turns
+/// almost the whole refresh free - it only ever needed to survive the process.
+static HTTP_CACHE: std::sync::LazyLock<Mutex<PersistedCache>> = std::sync::LazyLock::new(|| {
+    Mutex::new(crate::persistence::load_http_cache_json().unwrap_or_default())
+});
+
+/// Write the conditional-request cache to disk. Called after a successful
+/// catalog refresh, where the map is at its most useful and most complete.
+pub fn save_http_cache() {
+    let Ok(cache) = HTTP_CACHE.lock() else {
+        return;
+    };
+    let cutoff = now_secs().saturating_sub(NOT_FOUND_TTL_SECS);
+    let snapshot = PersistedCache {
+        entries: bound_entries(&cache.entries, MAX_CACHE_FILE_BYTES),
+        not_found: cache
+            .not_found
+            .iter()
+            .filter(|(_, &seen)| seen > cutoff)
+            .map(|(k, v)| (k.clone(), *v))
+            .collect(),
+    };
+    drop(cache);
+    if let Err(e) = crate::persistence::save_http_cache_json(&snapshot) {
+        tracing::warn!("could not persist the HTTP cache: {e}");
+    }
+}
+
+/// Select the entries that fit the on-disk budget.
+///
+/// Smallest first, so a squeeze drops the handful of giant READMEs rather than
+/// the dozens of small manifest and release responses that make up most of the
+/// request count - saving quota is the point, not saving bytes.
+fn bound_entries(
+    entries: &HashMap<String, CacheEntry>,
+    mut budget: usize,
+) -> HashMap<String, CacheEntry> {
+    let mut sorted: Vec<(&String, &CacheEntry)> = entries.iter().collect();
+    sorted.sort_by_key(|(url, e)| (e.body.len(), url.as_str()));
+    let mut keep = HashMap::new();
+    for (url, entry) in sorted {
+        if entry.body.len() > MAX_CACHED_BODY_BYTES {
+            continue;
+        }
+        let cost = url.len() + entry.etag.len() + entry.body.len();
+        if cost > budget {
+            break;
+        }
+        budget -= cost;
+        keep.insert(url.clone(), entry.clone());
+    }
+    keep
+}
+
+/// Drop every remembered response. Wired to Settings > "Clear caches" so a user
+/// who suspects staleness has a button, including for remembered 404s.
+pub fn clear_http_cache() {
+    if let Ok(mut cache) = HTTP_CACHE.lock() {
+        cache.entries.clear();
+        cache.not_found.clear();
+    }
+    let _ = crate::persistence::save_http_cache_json(&PersistedCache::default());
+}
 
 /// Per-URL lock to prevent concurrent requests to the same endpoint.
 static URL_LOCKS: std::sync::LazyLock<Mutex<HashMap<String, std::sync::Arc<TokioMutex<()>>>>> =
@@ -52,19 +155,22 @@ fn url_lock(url: &str) -> std::sync::Arc<TokioMutex<()>> {
 }
 
 /// Rate-limit information from GitHub API response headers.
+///
+/// Private: `cached_get` used to hand this back to every caller and all six
+/// discarded it, so it read like a supported channel while being dead weight.
+/// The values are consumed here - the low-quota warning and the 403/429
+/// exhaustion check. Surfacing the remaining quota in the UI would be a
+/// deliberate feature, not a reason to keep an unread return value.
 #[derive(Debug, Clone)]
-pub struct RateLimitInfo {
+struct RateLimitInfo {
     pub remaining: u64,
     pub limit: u64,
     pub reset: u64,
 }
 
-/// Perform a GET request with ETag caching, per-URL locking, and rate-limit awareness.
-/// Returns (body_string, optional_rate_limit_info).
-pub(crate) async fn cached_get(
-    client: &reqwest::Client,
-    url: &str,
-) -> Result<(String, Option<RateLimitInfo>)> {
+/// Perform a GET request with ETag caching, per-URL locking, and rate-limit
+/// awareness. Returns the body.
+pub(crate) async fn cached_get(client: &reqwest::Client, url: &str) -> Result<String> {
     let lock = url_lock(url);
     let _guard = lock.lock().await;
 
@@ -72,7 +178,16 @@ pub(crate) async fn cached_get(
 
     // Add If-None-Match if we have a cached ETag
     if let Ok(cache) = HTTP_CACHE.lock() {
-        if let Some(entry) = cache.get(url) {
+        // A 404 we saw recently costs nothing to answer from here, and unlike a
+        // 200 it can never be revalidated with an ETag.
+        if let Some(&seen) = cache.not_found.get(url) {
+            if now_secs().saturating_sub(seen) < NOT_FOUND_TTL_SECS {
+                tracing::debug!("negative cache hit for {url}");
+                return Err(anyhow::Error::new(HttpStatus(404))
+                    .context(format!("GitHub API error 404 (remembered): {url}")));
+            }
+        }
+        if let Some(entry) = cache.entries.get(url) {
             request = request.header("If-None-Match", &entry.etag);
         }
     }
@@ -105,9 +220,9 @@ pub(crate) async fn cached_get(
         304 => {
             // Not Modified — return cached body
             if let Ok(cache) = HTTP_CACHE.lock() {
-                if let Some(entry) = cache.get(url) {
+                if let Some(entry) = cache.entries.get(url) {
                     tracing::debug!("Cache hit (304) for {}", url);
-                    return Ok((entry.body.clone(), rate_limit));
+                    return Ok(entry.body.clone());
                 }
             }
             anyhow::bail!("304 received but no cached body for {url}");
@@ -123,7 +238,9 @@ pub(crate) async fn cached_get(
             // Store in cache if we got an ETag
             if let Some(etag) = etag {
                 if let Ok(mut cache) = HTTP_CACHE.lock() {
-                    cache.insert(
+                    // The resource exists again; drop any remembered 404.
+                    cache.not_found.remove(url);
+                    cache.entries.insert(
                         url.to_string(),
                         CacheEntry {
                             etag,
@@ -132,7 +249,7 @@ pub(crate) async fn cached_get(
                     );
                 }
             }
-            Ok((body, rate_limit))
+            Ok(body)
         }
         status => {
             // Only treat an exhausted quota as a rate-limit error on the
@@ -159,6 +276,12 @@ pub(crate) async fn cached_get(
                     }
                 }
             }
+            if status == 404 {
+                if let Ok(mut cache) = HTTP_CACHE.lock() {
+                    cache.not_found.insert(url.to_string(), now_secs());
+                    cache.entries.remove(url);
+                }
+            }
             let body = resp.text().await.unwrap_or_default();
             Err(anyhow::Error::new(HttpStatus(status))
                 .context(format!("GitHub API error {status}: {body}")))
@@ -187,7 +310,7 @@ pub fn is_not_found(e: &anyhow::Error) -> bool {
     e.downcast_ref::<HttpStatus>().is_some_and(|s| s.0 == 404)
 }
 
-pub(crate) fn parse_rate_limit(headers: &reqwest::header::HeaderMap) -> Option<RateLimitInfo> {
+fn parse_rate_limit(headers: &reqwest::header::HeaderMap) -> Option<RateLimitInfo> {
     let remaining = headers
         .get("x-ratelimit-remaining")?
         .to_str()
@@ -238,3 +361,44 @@ pub(crate) fn build_client(token: Option<&str>) -> Result<reqwest::Client> {
         .connect_timeout(CONNECT_TIMEOUT)
         .build()?)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn entry(body_len: usize) -> CacheEntry {
+        CacheEntry {
+            etag: "e".into(),
+            body: "x".repeat(body_len),
+        }
+    }
+
+    #[test]
+    fn the_cache_budget_keeps_the_many_small_entries_over_the_one_huge_one() {
+        let mut entries = HashMap::new();
+        entries.insert("u/big".to_string(), entry(900));
+        entries.insert("u/a".to_string(), entry(10));
+        entries.insert("u/b".to_string(), entry(10));
+        entries.insert("u/c".to_string(), entry(10));
+
+        // Room for the three small ones and their keys, not for the big one.
+        let kept = bound_entries(&entries, 100);
+        assert_eq!(kept.len(), 3, "kept: {:?}", kept.keys().collect::<Vec<_>>());
+        assert!(!kept.contains_key("u/big"));
+
+        // A single body over the per-entry ceiling is never persisted, however
+        // much room is left.
+        let mut huge = HashMap::new();
+        huge.insert("u/huge".to_string(), entry(MAX_CACHED_BODY_BYTES + 1));
+        assert!(bound_entries(&huge, MAX_CACHE_FILE_BYTES).is_empty());
+    }
+
+    #[test]
+    fn a_remembered_404_expires() {
+        let now = now_secs();
+        let fresh = now.saturating_sub(NOT_FOUND_TTL_SECS / 2);
+        let stale = now.saturating_sub(NOT_FOUND_TTL_SECS + 1);
+        assert!(now.saturating_sub(fresh) < NOT_FOUND_TTL_SECS);
+        assert!(now.saturating_sub(stale) >= NOT_FOUND_TTL_SECS);
+    }
+}
diff --git a/src/github/mod.rs b/src/github/mod.rs
index 916e42f..7c87b16 100644
--- a/src/github/mod.rs
+++ b/src/github/mod.rs
@@ -18,6 +18,96 @@ pub use types::*;
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    /// A manifest can be structurally perfect and still leave the app listed
+    /// with no Download button, which is what actually happened to Eidos.
+    /// `validation_errors` is the shape check; the resolution check lives in
+    /// the CLI, where the release's real asset names are available.
+    #[test]
+    fn manifest_validation_catches_the_mistakes_that_make_an_app_uninstallable() {
+        fn manifest(json: &str) -> ColonyManifest {
+            serde_json::from_str(json).expect("fixture parses")
+        }
+
+        // The shape the org actually publishes: clean.
+        assert!(manifest(r#"{"name":"Grape","category":"Multimedia"}"#)
+            .validation_errors()
+            .is_empty());
+
+        // Declaring a platform with no entry for it is how an app gets listed
+        // but not installed.
+        let errs = manifest(
+            r#"{"name":"X","category":"Games","platforms":["linux","windows"],
+                "releaseFiles":{"linux":{"tag":"latest","file":"x-linux"}}}"#,
+        )
+        .validation_errors();
+        assert_eq!(errs.len(), 1, "{errs:?}");
+        assert!(errs[0].contains("windows"), "{errs:?}");
+
+        // Neither `file` nor `filePattern`: nothing can be downloaded.
+        let errs = manifest(
+            r#"{"name":"X","category":"Games","releaseFiles":{"linux":{"tag":"latest"}}}"#,
+        )
+        .validation_errors();
+        assert!(errs.iter().any(|e| e.contains("neither")), "{errs:?}");
+
+        // Both is ambiguous, and `file` silently wins.
+        let errs = manifest(
+            r#"{"name":"X","category":"Games","releaseFiles":{"linux":
+                {"tag":"latest","file":"a","filePattern":"b"}}}"#,
+        )
+        .validation_errors();
+        assert!(
+            errs.iter().any(|e| e.contains("mutually exclusive")),
+            "{errs:?}"
+        );
+
+        // A pinned digest against a moving tag breaks at the next release.
+        let errs = manifest(
+            r#"{"name":"X","category":"Games","releaseFiles":{"linux":
+                {"tag":"latest","file":"a","sha256":"aa"}}}"#,
+        )
+        .validation_errors();
+        assert!(errs.iter().any(|e| e.contains("64-character")), "{errs:?}");
+        assert!(errs.iter().any(|e| e.contains("latest")), "{errs:?}");
+
+        // An unknown platform key is a platform no client will ever select.
+        let errs = manifest(
+            r#"{"name":"X","category":"Games","releaseFiles":{"freebsd":
+                {"tag":"latest","file":"a"}}}"#,
+        )
+        .validation_errors();
+        assert!(errs.iter().any(|e| e.contains("freebsd")), "{errs:?}");
+
+        // Colony ships a PNG decoder and nothing else.
+        let errs = manifest(r#"{"name":"X","category":"Games","icon":"assets/logo.svg"}"#)
+            .validation_errors();
+        assert!(errs.iter().any(|e| e.contains("PNG")), "{errs:?}");
+        let errs = manifest(r#"{"name":"X","category":"Games","icon":"../../etc/passwd.png"}"#)
+            .validation_errors();
+        assert!(errs.iter().any(|e| e.contains("relative")), "{errs:?}");
+    }
+
+    /// The live case the validator exists for: Eidos publishes
+    /// `eidos-1.12.0-x86_64-linux.tar.gz`, which matches no convention, so
+    /// auto-detection yields nothing and the card has no Download button.
+    #[test]
+    fn eidos_shaped_assets_resolve_to_no_platform() {
+        let assets = vec![
+            "eidos-1.12.0-x86_64-linux.tar.gz".to_string(),
+            "eidos-1.12.0-x86_64-linux.tar.gz.sha256".to_string(),
+        ];
+        assert!(
+            detect_platforms_from_assets("Eidos", &assets).is_empty(),
+            "these asset names are exactly why Eidos is listed but uninstallable"
+        );
+        // The convention it would need instead.
+        assert_eq!(
+            detect_platforms_from_assets("Eidos", &["eidos-linux".to_string()]),
+            vec!["linux".to_string()]
+        );
+    }
+
     use base64::Engine as _;
 
     #[test]
diff --git a/src/github/releases.rs b/src/github/releases.rs
index 781c9f2..ddb54fc 100644
--- a/src/github/releases.rs
+++ b/src/github/releases.rs
@@ -32,7 +32,7 @@ pub async fn fetch_latest_release_tag_for(
     repo: &str,
 ) -> Result<String> {
     let url = format!("{GITHUB_API}/repos/{owner}/{repo}/releases/latest");
-    let (body, _) = cached_get(client, &url).await?;
+    let body = cached_get(client, &url).await?;
 
     #[derive(Deserialize)]
     struct Release {
@@ -53,6 +53,12 @@ pub async fn fetch_latest_release_tag(client: &reqwest::Client, repo_name: &str)
 pub struct ResolvedRelease {
     pub tag: String,
     pub asset_names: Vec<String>,
+    /// Byte size per asset name, as reported by the API. The store could not
+    /// answer "how big is this download?" before committing to it: the total
+    /// was only learned from Content-Length once the transfer had started.
+    pub asset_sizes: HashMap<String, u64>,
+    /// ISO-8601 publication timestamp of the release, when the API gave one.
+    pub published_at: Option<String>,
     /// The release notes (GitHub release body, markdown). Previously never
     /// fetched anywhere: the detail Changelog tab only showed the repo's
     /// CHANGELOG.md file frozen at catalog-fetch time.
@@ -67,28 +73,46 @@ pub async fn fetch_release_info(
     repo_name: &str,
     tag: &str,
 ) -> Result<ResolvedRelease> {
+    // `tag` is remote data (colony.json) and this request carries the user's
+    // bearer token, so build the path from encoded segments: interpolating it
+    // lets `..` shorten the path onto a different endpoint entirely. See
+    // `crate::download::build_url`.
     let url = if tag.eq_ignore_ascii_case("latest") {
         format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/releases/latest")
     } else {
-        format!("{GITHUB_API}/repos/{GITHUB_ACCOUNT}/{repo_name}/releases/tags/{tag}")
+        crate::download::build_url(
+            GITHUB_API,
+            &["repos", GITHUB_ACCOUNT, repo_name, "releases", "tags", tag],
+        )?
     };
-    let (body, _) = cached_get(client, &url).await?;
+    let body = cached_get(client, &url).await?;
 
     #[derive(Deserialize)]
     struct Asset {
         name: String,
+        #[serde(default)]
+        size: u64,
     }
     #[derive(Deserialize)]
     struct Release {
         tag_name: String,
         assets: Vec<Asset>,
         body: Option<String>,
+        #[serde(default)]
+        published_at: Option<String>,
     }
 
     let release: Release = serde_json::from_str(&body)?;
+    let asset_sizes: HashMap<String, u64> = release
+        .assets
+        .iter()
+        .map(|a| (a.name.clone(), a.size))
+        .collect();
     Ok(ResolvedRelease {
         tag: release.tag_name,
         asset_names: release.assets.into_iter().map(|a| a.name).collect(),
+        asset_sizes,
+        published_at: release.published_at,
         body: release.body,
     })
 }
@@ -103,8 +127,16 @@ pub async fn fetch_release_info(
 const NON_INSTALLABLE_SUFFIXES: &[&str] = &[
     ".sig",
     ".asc",
+    // The signed metadata sidecar (see crate::signing). Colony's own releases
+    // already ship `colony-linux.meta`, so the day an ecosystem app adopts the
+    // sidecar, a documented legacy substring pattern like "linux" would start
+    // matching two assets and fail with "Ambiguous pattern" - which is exactly
+    // what docs/colony-spec.md promises cannot happen.
+    ".meta",
     ".sha256",
     ".sha256sum",
+    // electron-builder publishes one per installer (SphereCord already does).
+    ".blockmap",
     ".txt",
     ".yml",
     ".yaml",
@@ -267,8 +299,13 @@ pub fn parse_version_tag(tag: &str) -> Option<semver::Version> {
 }
 
 /// Check if an update is available for a repo whose manifest pins `pinned_tag`
-/// for the current platform. Returns Some(target_tag) if the installed version
-/// differs from what the manifest would install, None otherwise.
+/// for the current platform.
+///
+/// `Ok(Some(tag))` = an update to `tag` is available. `Ok(None)` = the check
+/// RAN and there is nothing to install (either the app is not installed at all,
+/// or it is current). `Err` = the check could NOT run, and the caller must not
+/// turn that into "up to date" — the same fail-loud contract
+/// [`check_launcher_update`] already keeps for the launcher's own check.
 ///
 /// `pinned_tag` is compared directly unless it is "latest", in which case the
 /// repo's latest release is resolved. This avoids a perpetual "update
@@ -279,11 +316,14 @@ pub async fn check_update_available(
     client: &reqwest::Client,
     repo_name: &str,
     pinned_tag: &str,
-) -> Option<String> {
-    let installed = load_installed_version(repo_name)?;
+) -> Result<Option<String>> {
+    // Not installed is a real answer, not a failure: there is nothing to update.
+    let Some(installed) = load_installed_version(repo_name) else {
+        return Ok(None);
+    };
 
     let target = if pinned_tag.eq_ignore_ascii_case("latest") {
-        fetch_latest_release_tag(client, repo_name).await.ok()?
+        fetch_latest_release_tag(client, repo_name).await?
     } else {
         pinned_tag.to_string()
     };
@@ -291,22 +331,18 @@ pub async fn check_update_available(
     // Case-insensitive: "Nightly" vs "nightly" must not read as an update
     // (with non-semver tags the string fallback below would flag it forever).
     if target.eq_ignore_ascii_case(&installed) {
-        return None;
+        return Ok(None);
     }
 
     match (parse_version_tag(&installed), parse_version_tag(&target)) {
         (Some(installed_ver), Some(target_ver)) => {
-            if target_ver > installed_ver {
-                Some(target)
-            } else {
-                None
-            }
+            Ok((target_ver > installed_ver).then_some(target))
         }
         _ => {
             tracing::warn!(
                 "Non-semver tags for {repo_name} (installed '{installed}', target '{target}'); using string comparison"
             );
-            Some(target)
+            Ok(Some(target))
         }
     }
 }
diff --git a/src/github/types.rs b/src/github/types.rs
index c63852b..9373124 100644
--- a/src/github/types.rs
+++ b/src/github/types.rs
@@ -45,6 +45,111 @@ pub struct ColonyManifest {
     pub signed: bool,
 }
 
+/// The platform keys Colony understands. A manifest naming anything else is
+/// declaring a platform no client will ever match.
+pub const KNOWN_PLATFORMS: &[&str] = &["linux", "windows", "macos", "macos-x86"];
+
+impl ColonyManifest {
+    /// Check a manifest for the mistakes that make an app silently
+    /// un-installable, returning one message per problem.
+    ///
+    /// Serde catches a manifest that does not PARSE. It cannot catch one that
+    /// parses and then resolves to nothing, which is the failure that actually
+    /// happens: of the eight manifests the org publishes, one declares only a
+    /// name and a category and matches no release asset (so it renders as a
+    /// card with no Download button), and nobody noticed, because there is no
+    /// schema, no lint and no CI step anywhere on either side.
+    ///
+    /// Deliberately NOT called from the catalog fetch: a client refusing repos
+    /// that a newer Colony would accept is worse than showing them. This is for
+    /// `colony validate-manifest`, which app authors run in their own CI.
+    pub fn validation_errors(&self) -> Vec<String> {
+        let mut errors = Vec::new();
+
+        if self.name.trim().is_empty() {
+            errors.push("`name` is empty - it is the display name shown in Colony".into());
+        }
+        if self.category.trim().is_empty() {
+            errors.push("`category` is empty".into());
+        } else if matches!(
+            crate::scan::AppCategory::from_name(&self.category),
+            crate::scan::AppCategory::Other
+        ) && !self.category.eq_ignore_ascii_case("other")
+        {
+            errors.push(format!(
+                "`category` is {:?}, which Colony does not recognise - the app will be filed under Other. Known: development, graphics, network, office, multimedia, system, utilities, security, games, other",
+                self.category
+            ));
+        }
+
+        for platform in &self.platforms {
+            if !KNOWN_PLATFORMS.contains(&platform.as_str()) {
+                errors.push(format!(
+                    "`platforms` names {platform:?}, which is not one of {KNOWN_PLATFORMS:?}"
+                ));
+            }
+        }
+
+        for (platform, entry) in &self.release_files {
+            let at = format!("releaseFiles.{platform}");
+            if !KNOWN_PLATFORMS.contains(&platform.as_str()) {
+                errors.push(format!(
+                    "`{at}` is not one of {KNOWN_PLATFORMS:?}, so no client will ever select it"
+                ));
+            }
+            if entry.tag.trim().is_empty() {
+                errors.push(format!(
+                    "`{at}.tag` is empty - use \"latest\" or a real tag"
+                ));
+            }
+            match (&entry.file, &entry.file_pattern) {
+                (None, None) => errors.push(format!(
+                    "`{at}` declares neither `file` nor `filePattern`, so nothing can be downloaded"
+                )),
+                (Some(_), Some(_)) => errors.push(format!(
+                    "`{at}` declares BOTH `file` and `filePattern`; they are mutually exclusive and `file` wins"
+                )),
+                _ => {}
+            }
+            if let Some(sha) = &entry.sha256 {
+                if sha.len() != 64 || !sha.chars().all(|c| c.is_ascii_hexdigit()) {
+                    errors.push(format!("`{at}.sha256` is not a 64-character hex digest"));
+                }
+            }
+            // A pinned sha256 cannot describe a moving target.
+            if entry.sha256.is_some() && entry.tag.eq_ignore_ascii_case("latest") {
+                errors.push(format!(
+                    "`{at}` pins a sha256 but tracks \"latest\", so the digest breaks at the next release"
+                ));
+            }
+        }
+
+        // Declaring platforms without release entries is how an app ends up
+        // listed but un-installable.
+        for platform in &self.platforms {
+            if !self.release_files.is_empty() && !self.release_files.contains_key(platform) {
+                errors.push(format!(
+                    "`platforms` lists {platform:?} but `releaseFiles` has no entry for it"
+                ));
+            }
+        }
+
+        if let Some(icon) = &self.icon {
+            if icon.starts_with('/') || icon.contains("..") {
+                errors.push(format!(
+                    "`icon` must be a path relative to the repo root, got {icon:?}"
+                ));
+            } else if !icon.to_lowercase().ends_with(".png") {
+                errors.push(format!(
+                    "`icon` must be a PNG - Colony ships no other decoder - got {icon:?}"
+                ));
+            }
+        }
+
+        errors
+    }
+}
+
 /// Metadata for a Colony-compatible repository (has colony.json).
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct ColonyRepo {
@@ -55,6 +160,30 @@ pub struct ColonyRepo {
     pub manifest: ColonyManifest,
 }
 
+impl ColonyRepo {
+    /// What to SHOW the user: the manifest's declared name, falling back to the
+    /// repo slug.
+    ///
+    /// The spec defines `name` as "Display name in Colony", and two of the
+    /// eight published manifests deliberately set one that differs from the
+    /// slug ("Lilypad" for Lilypad-Vault, "SAM - Colony Edition"). Colony threw
+    /// it away everywhere except the launch button, so a card titled
+    /// "Lilypad-Vault" carried a button reading "Launch Lilypad", and the
+    /// desktop menu got the slug too.
+    ///
+    /// `name` stays the IDENTITY key - install paths, caches, favorites and the
+    /// active-detail-page pointer all key off it, and none of those may follow
+    /// a display name the repo can change at will.
+    pub fn display_name(&self) -> &str {
+        let declared = self.manifest.name.trim();
+        if declared.is_empty() {
+            &self.name
+        } else {
+            declared
+        }
+    }
+}
+
 #[derive(Debug, Deserialize)]
 pub(crate) struct GithubRepo {
     pub(crate) name: String,
diff --git a/src/i18n/en.rs b/src/i18n/en.rs
index b6efead..c507f6d 100644
--- a/src/i18n/en.rs
+++ b/src/i18n/en.rs
@@ -55,6 +55,7 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("search_placeholder".into(), "Search applications...".into());
     strings.insert("status_installed".into(), "Installed".into());
     strings.insert("status_get".into(), "Get".into());
+    strings.insert("status_unavailable".into(), "Not available".into());
     strings.insert("status_update".into(), "Update".into());
 
     // Detail view
@@ -63,7 +64,11 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("launch".into(), "Launch {name}".into());
     strings.insert("update".into(), "Update".into());
     strings.insert("download".into(), "Download".into());
-    strings.insert("no_release".into(), "No release available".into());
+    strings.insert("offered_version".into(), "Release {version}".into());
+    strings.insert(
+        "no_release_unrecognized".into(),
+        "No installable release found - this app has not published assets Colony recognizes".into(),
+    );
     strings.insert(
         "no_release_platform".into(),
         "Not available for your platform".into(),
@@ -101,12 +106,29 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "updates_available".into(),
         "{count} update(s) available: {names}".into(),
     );
+    strings.insert(
+        "launcher_relaunch_failed".into(),
+        "Colony updated, but the new version would not start ({error}). The previous version is kept at {backup} - rename it back to recover.".into(),
+    );
+    strings.insert(
+        "logout_incomplete".into(),
+        "Signed out, but the stored credential could not be removed ({error}). Revoke it at github.com/settings/applications.".into(),
+    );
+    strings.insert(
+        "update_skipped".into(),
+        "Skipped {name}: no longer in the catalog, or no build for this platform".into(),
+    );
+    strings.insert(
+        "update_check_failed".into(),
+        "Could not check {count} app(s) for updates — they may not be up to date".into(),
+    );
 
     // Sidebar section names (localized)
     strings.insert("section_all".into(), "All".into());
     strings.insert("section_favorites".into(), "Favorites".into());
     strings.insert("section_windows".into(), "Windows".into());
     strings.insert("section_linux".into(), "Linux".into());
+    strings.insert("section_macos".into(), "macOS".into());
     strings.insert("section_development".into(), "Development".into());
     strings.insert("section_graphics".into(), "Graphics".into());
     strings.insert("section_network".into(), "Network".into());
@@ -136,49 +158,12 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
 
     // Favorites
     strings.insert("add_favorite".into(), "Add to favorites".into());
-    strings.insert("remove_favorite".into(), "Remove from favorites".into());
 
     // First launch — carousel (3 steps)
     strings.insert("welcome_title".into(), "Welcome to Colony".into());
     strings.insert("welcome_desc".into(), "The centralized launcher for the Project-Colony ecosystem. Discover, install and launch apps in one click.".into());
     // Step 1 — interface tour
-    strings.insert(
-        "welcome_step1_title".into(),
-        "The interface, in 3 zones".into(),
-    );
-    strings.insert("welcome_step1_tip1_title".into(), "Sidebar".into());
-    strings.insert(
-        "welcome_step1_tip1_desc".into(),
-        "Filter by category or origin (Colony / system apps).".into(),
-    );
-    strings.insert("welcome_step1_tip2_title".into(), "Search".into());
-    strings.insert(
-        "welcome_step1_tip2_desc".into(),
-        "Type an app name in the top bar to filter instantly.".into(),
-    );
-    strings.insert("welcome_step1_tip3_title".into(), "Detail".into());
-    strings.insert(
-        "welcome_step1_tip3_desc".into(),
-        "Click any app to read its README, changelog and install it.".into(),
-    );
     // Step 2 — GitHub + ready
-    strings.insert(
-        "welcome_step2_title".into(),
-        "Connect GitHub (optional)".into(),
-    );
-    strings.insert("welcome_step2_desc".into(), "Without an account: 60 GitHub requests per hour. With an account: 5000/h + access to your private repos. Recommended if you plan to browse a lot.".into());
-    strings.insert(
-        "welcome_step2_hint1".into(),
-        "\u{f005}  Favorites (⭐) for quick access".into(),
-    );
-    strings.insert(
-        "welcome_step2_hint2".into(),
-        "\u{f53f}  24 theme families in the preferences".into(),
-    );
-    strings.insert(
-        "welcome_step2_hint3".into(),
-        "\u{f059}  Full tutorial + FAQ on GitHub".into(),
-    );
     // Navigation
     strings.insert("welcome_start".into(), "Let's go!".into());
     strings.insert("welcome_next".into(), "Next".into());
@@ -206,7 +191,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("tut_finish_desc".into(), "The gear icon next to the title opens Preferences: 24 theme families, keyboard shortcuts, accessibility. Enjoy Colony!".into());
 
     // Loading / async feedback
-    strings.insert("loading".into(), "Loading...".into());
     strings.insert("scanning".into(), "Scanning...".into());
     strings.insert("checking_updates".into(), "Checking for updates...".into());
     strings.insert("syncing_repos".into(), "Syncing repositories...".into());
@@ -219,15 +203,21 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
 
     // Keyboard shortcuts
     strings.insert("shortcuts_title".into(), "Keyboard shortcuts".into());
-    strings.insert("shortcut_esc".into(), "Esc — Close active panel".into());
+    strings.insert(
+        "shortcut_esc".into(),
+        "Esc — Close the current panel, dialog or detail page".into(),
+    );
     strings.insert(
         "shortcut_tab".into(),
         "Tab / Shift+Tab — Navigate categories".into(),
     );
-    strings.insert("shortcut_arrows".into(), "↑ ↓ — Navigate settings".into());
+    strings.insert(
+        "shortcut_arrows".into(),
+        "↑ ↓ — Navigate settings and the app grid".into(),
+    );
     strings.insert(
         "shortcut_enter".into(),
-        "Enter — Open first visible item".into(),
+        "Enter — Open the highlighted item (launches a local app directly)".into(),
     );
     strings.insert(
         "shortcut_pageupdown".into(),
@@ -282,14 +272,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     );
     strings.insert("settings_default_view_all".into(), "All".into());
     strings.insert("settings_default_view_favorites".into(), "Favorites".into());
-    strings.insert("settings_default_view_recent".into(), "Recent".into());
-    strings.insert("settings_close_behavior".into(), "Close behavior".into());
-    strings.insert(
-        "settings_close_behavior_desc".into(),
-        "Choose action on close.".into(),
-    );
-    strings.insert("settings_close_quit".into(), "Quit".into());
-    strings.insert("settings_close_tray".into(), "Minimize to tray".into());
     // Language
     strings.insert("settings_section_language".into(), "Language".into());
     strings.insert(
@@ -304,11 +286,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_current_language_desc".into(),
         "Synced with system.".into(),
     );
-    strings.insert("settings_time_format".into(), "Time format".into());
-    strings.insert(
-        "settings_time_format_desc".into(),
-        "Format used in the application.".into(),
-    );
     // Updates
     strings.insert("settings_section_updates".into(), "Updates".into());
     strings.insert(
@@ -323,39 +300,8 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_auto_check_updates_desc".into(),
         "Check for new versions on launch.".into(),
     );
-    strings.insert("settings_update_channel".into(), "Channel".into());
-    strings.insert(
-        "settings_update_channel_desc".into(),
-        "Choose version stability.".into(),
-    );
-    strings.insert(
-        "settings_auto_install_updates".into(),
-        "Install automatically".into(),
-    );
-    strings.insert(
-        "settings_auto_install_updates_desc".into(),
-        "Install updates in background.".into(),
-    );
     strings.insert("settings_check_updates".into(), "Check for updates".into());
     // Privacy
-    strings.insert("settings_section_privacy".into(), "Privacy".into());
-    strings.insert(
-        "settings_privacy_desc".into(),
-        "Choose data shared with Colony.".into(),
-    );
-    strings.insert("settings_error_reports".into(), "Send error reports".into());
-    strings.insert(
-        "settings_error_reports_desc".into(),
-        "Helps improve stability.".into(),
-    );
-    strings.insert(
-        "settings_usage_stats".into(),
-        "Anonymous usage statistics".into(),
-    );
-    strings.insert(
-        "settings_usage_stats_desc".into(),
-        "Helps understand Colony usage.".into(),
-    );
     // Appearance
     strings.insert(
         "settings_appearance_title".into(),
@@ -366,16 +312,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "Adjust theme, accents and visual effects.".into(),
     );
     strings.insert("settings_section_theme".into(), "Theme".into());
-    strings.insert(
-        "settings_theme_desc".into(),
-        "Choose the interface theme.".into(),
-    );
-    strings.insert("settings_theme_current".into(), "Current theme".into());
-    strings.insert(
-        "settings_theme_current_desc".into(),
-        "Overall application appearance.".into(),
-    );
-    strings.insert("settings_theme_dark".into(), "Dark".into());
     // Theme families
     strings.insert("settings_theme_catppuccin".into(), "Catppuccin".into());
     strings.insert("settings_theme_catppuccin_latte".into(), "Latte".into());
@@ -449,15 +385,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("settings_theme_stellar_blade_kaya".into(), "Kaya".into());
     // Colors & accents
     strings.insert("settings_section_colors".into(), "Colors & accents".into());
-    strings.insert(
-        "settings_colors_desc".into(),
-        "Customize the interface accent color.".into(),
-    );
-    strings.insert("settings_accent_color".into(), "Accent color".into());
-    strings.insert(
-        "settings_accent_color_desc".into(),
-        "Color used for interactive elements.".into(),
-    );
     strings.insert("settings_accent_red".into(), "Red".into());
     strings.insert("settings_accent_orange".into(), "Orange".into());
     strings.insert("settings_accent_yellow".into(), "Yellow".into());
@@ -474,18 +401,11 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_auto_accent_desc".into(),
         "Automatically adapts accent to backgrounds.".into(),
     );
-    strings.insert("settings_enabled_label".into(), "Enabled".into());
-    strings.insert("settings_disabled_label".into(), "Disabled".into());
     strings.insert("settings_section_typography".into(), "Typography".into());
     strings.insert(
         "settings_typography_desc".into(),
         "Configure font and text size.".into(),
     );
-    strings.insert("settings_font".into(), "Font".into());
-    strings.insert(
-        "settings_font_desc".into(),
-        "Font used in the interface.".into(),
-    );
     strings.insert("settings_font_size".into(), "Text size".into());
     strings.insert("settings_font_size_desc".into(), "Base text size.".into());
     strings.insert("settings_font_size_default".into(), "Default".into());
@@ -530,7 +450,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_high_contrast_desc".into(),
         "Increase contrast of elements.".into(),
     );
-    strings.insert("settings_disabled".into(), "Disabled".into());
     strings.insert("settings_text_size_a11y".into(), "Text size".into());
     strings.insert(
         "settings_text_size_a11y_desc".into(),
@@ -580,28 +499,19 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_scan_desc".into(),
         "Configure directories scanned at startup.".into(),
     );
-    strings.insert("settings_scan_dirs".into(), "Scan directories".into());
-    strings.insert(
-        "settings_scan_dirs_desc".into(),
-        "Directories scanned for applications.".into(),
-    );
-    strings.insert("settings_scan_dirs_value".into(), "Default".into());
     strings.insert("settings_startup".into(), "Scan on startup".into());
     strings.insert(
         "settings_startup_desc".into(),
         "Updates the library at startup.".into(),
     );
-    strings.insert("settings_enabled".into(), "Enabled".into());
     strings.insert("settings_section_install".into(), "Installation".into());
     strings.insert("settings_local_apps".into(), "Local applications".into());
     strings.insert("settings_colony_repos".into(), "Colony repos".into());
     strings.insert("settings_favorites".into(), "Favorites".into());
     // Placeholders
-    strings.insert("settings_coming_soon".into(), "Coming soon".into());
     // About
     strings.insert("settings_about_title".into(), "About Colony".into());
     strings.insert("settings_about".into(), "About".into());
-    strings.insert("settings_version".into(), "Colony v0.1.0".into());
     // Launcher self-update
     strings.insert(
         "launcher_update_available".into(),
@@ -623,10 +533,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "launcher_download_update".into(),
         "Download update {version}".into(),
     );
-    strings.insert(
-        "launcher_update_failed".into(),
-        "Update failed: {error}".into(),
-    );
     strings.insert("check_launcher_updates".into(), "Check for updates".into());
     strings.insert("launcher_up_to_date".into(), "Colony is up to date".into());
     strings.insert("update_all".into(), "Update all ({count})".into());
@@ -644,6 +550,5 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("tab_readme".into(), "ReadMe".into());
     strings.insert("tab_license".into(), "License".into());
     strings.insert("tab_changelog".into(), "Changelog".into());
-    strings.insert("tab_loading".into(), "Loading...".into());
     strings.insert("tab_not_available".into(), "Not available".into());
 }
diff --git a/src/i18n/fr.rs b/src/i18n/fr.rs
index 85263fe..ed97170 100644
--- a/src/i18n/fr.rs
+++ b/src/i18n/fr.rs
@@ -54,6 +54,7 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     );
     strings.insert("status_installed".into(), "Installé".into());
     strings.insert("status_get".into(), "À installer".into());
+    strings.insert("status_unavailable".into(), "Indisponible".into());
     strings.insert("status_update".into(), "Mise à jour".into());
 
     // Detail view
@@ -62,7 +63,12 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("launch".into(), "Lancer {name}".into());
     strings.insert("update".into(), "Mettre à jour".into());
     strings.insert("download".into(), "Télécharger".into());
-    strings.insert("no_release".into(), "Aucune release disponible".into());
+    strings.insert("offered_version".into(), "Version {version}".into());
+    strings.insert(
+        "no_release_unrecognized".into(),
+        "Aucune version installable - cette application ne publie pas d'assets reconnus par Colony"
+            .into(),
+    );
     strings.insert(
         "no_release_platform".into(),
         "Non disponible pour votre plateforme".into(),
@@ -115,12 +121,29 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "updates_available".into(),
         "{count} mise(s) à jour disponible(s) : {names}".into(),
     );
+    strings.insert(
+        "launcher_relaunch_failed".into(),
+        "Colony a été mis à jour mais la nouvelle version n'a pas démarré ({error}). L'ancienne version est conservée dans {backup} - renommez-la pour revenir en arrière.".into(),
+    );
+    strings.insert(
+        "logout_incomplete".into(),
+        "Déconnecté, mais le jeton stocké n'a pas pu être supprimé ({error}). Révoquez-le sur github.com/settings/applications.".into(),
+    );
+    strings.insert(
+        "update_skipped".into(),
+        "{name} ignorée : absente du catalogue, ou aucune version pour cette plateforme".into(),
+    );
+    strings.insert(
+        "update_check_failed".into(),
+        "Impossible de vérifier {count} application(s) — elles ne sont peut-être pas à jour".into(),
+    );
 
     // Sidebar section names (localized)
     strings.insert("section_all".into(), "Tout".into());
     strings.insert("section_favorites".into(), "Favoris".into());
     strings.insert("section_windows".into(), "Windows".into());
     strings.insert("section_linux".into(), "Linux".into());
+    strings.insert("section_macos".into(), "macOS".into());
     strings.insert("section_development".into(), "Développement".into());
     strings.insert("section_graphics".into(), "Graphisme".into());
     strings.insert("section_network".into(), "Réseau".into());
@@ -150,49 +173,12 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
 
     // Favorites
     strings.insert("add_favorite".into(), "Ajouter aux favoris".into());
-    strings.insert("remove_favorite".into(), "Retirer des favoris".into());
 
     // First launch — carousel (3 steps)
     strings.insert("welcome_title".into(), "Bienvenue dans Colony".into());
     strings.insert("welcome_desc".into(), "Le lanceur centralisé de l'écosystème Project-Colony. Découvrez, installez et lancez vos apps en un clic.".into());
     // Step 1 — interface tour
-    strings.insert(
-        "welcome_step1_title".into(),
-        "L'interface en 3 zones".into(),
-    );
-    strings.insert("welcome_step1_tip1_title".into(), "Sidebar".into());
-    strings.insert(
-        "welcome_step1_tip1_desc".into(),
-        "Filtrez par catégorie ou origine (Colony / système).".into(),
-    );
-    strings.insert("welcome_step1_tip2_title".into(), "Recherche".into());
-    strings.insert(
-        "welcome_step1_tip2_desc".into(),
-        "Tapez le nom d'une app dans la barre en haut pour filtrer instantanément.".into(),
-    );
-    strings.insert("welcome_step1_tip3_title".into(), "Détail".into());
-    strings.insert(
-        "welcome_step1_tip3_desc".into(),
-        "Cliquez une app pour lire le README, le changelog et l'installer.".into(),
-    );
     // Step 2 — GitHub + ready
-    strings.insert(
-        "welcome_step2_title".into(),
-        "Connectez GitHub (optionnel)".into(),
-    );
-    strings.insert("welcome_step2_desc".into(), "Sans compte : 60 requêtes GitHub par heure. Avec compte : 5000/h + accès aux repos privés. Recommandé si vous comptez explorer beaucoup.".into());
-    strings.insert(
-        "welcome_step2_hint1".into(),
-        "\u{f005}  Favoris (⭐) pour un accès rapide".into(),
-    );
-    strings.insert(
-        "welcome_step2_hint2".into(),
-        "\u{f53f}  24 familles de thèmes dans les préférences".into(),
-    );
-    strings.insert(
-        "welcome_step2_hint3".into(),
-        "\u{f059}  Consultez la FAQ et le tutoriel complet sur GitHub".into(),
-    );
     // Navigation
     strings.insert("welcome_start".into(), "C'est parti !".into());
     strings.insert("welcome_next".into(), "Suivant".into());
@@ -217,7 +203,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("tut_finish_desc".into(), "L'icône d'engrenage à côté du titre ouvre les préférences : 24 familles de thèmes, raccourcis clavier, accessibilité. Bon voyage dans Colony !".into());
 
     // Loading / async feedback
-    strings.insert("loading".into(), "Chargement...".into());
     strings.insert("scanning".into(), "Analyse en cours...".into());
     strings.insert(
         "checking_updates".into(),
@@ -241,7 +226,7 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("shortcuts_title".into(), "Raccourcis clavier".into());
     strings.insert(
         "shortcut_esc".into(),
-        "Échap — Fermer le panneau actif".into(),
+        "Échap — Fermer le panneau, la boîte de dialogue ou la fiche en cours".into(),
     );
     strings.insert(
         "shortcut_tab".into(),
@@ -249,11 +234,11 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     );
     strings.insert(
         "shortcut_arrows".into(),
-        "↑ ↓ — Naviguer dans les paramètres".into(),
+        "↑ ↓ — Naviguer dans les réglages et la grille".into(),
     );
     strings.insert(
         "shortcut_enter".into(),
-        "Entrée — Ouvrir le premier élément visible".into(),
+        "Entrée — Ouvrir l'élément sélectionné (lance directement une app locale)".into(),
     );
     strings.insert(
         "shortcut_pageupdown".into(),
@@ -314,17 +299,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     );
     strings.insert("settings_default_view_all".into(), "Toutes".into());
     strings.insert("settings_default_view_favorites".into(), "Favoris".into());
-    strings.insert("settings_default_view_recent".into(), "Récents".into());
-    strings.insert(
-        "settings_close_behavior".into(),
-        "Comportement à la fermeture".into(),
-    );
-    strings.insert(
-        "settings_close_behavior_desc".into(),
-        "Choisissez l'action à la fermeture.".into(),
-    );
-    strings.insert("settings_close_quit".into(), "Quitter".into());
-    strings.insert("settings_close_tray".into(), "Réduire dans la barre".into());
     // Language
     strings.insert("settings_section_language".into(), "Langue".into());
     strings.insert(
@@ -339,11 +313,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_current_language_desc".into(),
         "Synchronisée avec le système.".into(),
     );
-    strings.insert("settings_time_format".into(), "Format horaire".into());
-    strings.insert(
-        "settings_time_format_desc".into(),
-        "Format utilisé dans l'application.".into(),
-    );
     // Updates
     strings.insert("settings_section_updates".into(), "Mises à jour".into());
     strings.insert(
@@ -358,45 +327,11 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_auto_check_updates_desc".into(),
         "Vérifie les nouvelles versions au lancement.".into(),
     );
-    strings.insert("settings_update_channel".into(), "Canal".into());
-    strings.insert(
-        "settings_update_channel_desc".into(),
-        "Choisissez la stabilité des versions.".into(),
-    );
-    strings.insert(
-        "settings_auto_install_updates".into(),
-        "Installer automatiquement".into(),
-    );
-    strings.insert(
-        "settings_auto_install_updates_desc".into(),
-        "Installe les mises à jour en arrière-plan.".into(),
-    );
     strings.insert(
         "settings_check_updates".into(),
         "Vérifier les mises à jour".into(),
     );
     // Privacy
-    strings.insert("settings_section_privacy".into(), "Confidentialité".into());
-    strings.insert(
-        "settings_privacy_desc".into(),
-        "Choisissez les données partagées avec Colony.".into(),
-    );
-    strings.insert(
-        "settings_error_reports".into(),
-        "Envoyer des rapports d'erreurs".into(),
-    );
-    strings.insert(
-        "settings_error_reports_desc".into(),
-        "Permet d'améliorer la stabilité.".into(),
-    );
-    strings.insert(
-        "settings_usage_stats".into(),
-        "Statistiques anonymes d'utilisation".into(),
-    );
-    strings.insert(
-        "settings_usage_stats_desc".into(),
-        "Aide à comprendre l'usage de Colony.".into(),
-    );
     // Appearance
     strings.insert(
         "settings_appearance_title".into(),
@@ -407,16 +342,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "Ajustez le thème, les accents et les effets visuels.".into(),
     );
     strings.insert("settings_section_theme".into(), "Thème".into());
-    strings.insert(
-        "settings_theme_desc".into(),
-        "Choisissez le thème de l'interface.".into(),
-    );
-    strings.insert("settings_theme_current".into(), "Thème actuel".into());
-    strings.insert(
-        "settings_theme_current_desc".into(),
-        "Apparence globale de l'application.".into(),
-    );
-    strings.insert("settings_theme_dark".into(), "Sombre".into());
     // Theme families
     strings.insert("settings_theme_catppuccin".into(), "Catppuccin".into());
     strings.insert("settings_theme_catppuccin_latte".into(), "Latte".into());
@@ -493,15 +418,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_section_colors".into(),
         "Couleurs & accents".into(),
     );
-    strings.insert(
-        "settings_colors_desc".into(),
-        "Personnalisez la couleur d'accent de l'interface.".into(),
-    );
-    strings.insert("settings_accent_color".into(), "Couleur d'accent".into());
-    strings.insert(
-        "settings_accent_color_desc".into(),
-        "Couleur utilisée pour les éléments interactifs.".into(),
-    );
     strings.insert("settings_accent_red".into(), "Rouge".into());
     strings.insert("settings_accent_orange".into(), "Orange".into());
     strings.insert("settings_accent_yellow".into(), "Jaune".into());
@@ -518,18 +434,11 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_auto_accent_desc".into(),
         "Adapte automatiquement l'accent aux arrière-plans.".into(),
     );
-    strings.insert("settings_enabled_label".into(), "Activé".into());
-    strings.insert("settings_disabled_label".into(), "Désactivé".into());
     strings.insert("settings_section_typography".into(), "Typographie".into());
     strings.insert(
         "settings_typography_desc".into(),
         "Configurez la police et la taille du texte.".into(),
     );
-    strings.insert("settings_font".into(), "Police".into());
-    strings.insert(
-        "settings_font_desc".into(),
-        "Police utilisée dans l'interface.".into(),
-    );
     strings.insert("settings_font_size".into(), "Taille du texte".into());
     strings.insert(
         "settings_font_size_desc".into(),
@@ -580,7 +489,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_high_contrast_desc".into(),
         "Augmente le contraste des éléments.".into(),
     );
-    strings.insert("settings_disabled".into(), "Désactivé".into());
     strings.insert("settings_text_size_a11y".into(), "Taille du texte".into());
     strings.insert(
         "settings_text_size_a11y_desc".into(),
@@ -633,28 +541,19 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "settings_scan_desc".into(),
         "Configurez les dossiers analysés au démarrage.".into(),
     );
-    strings.insert("settings_scan_dirs".into(), "Dossiers de scan".into());
-    strings.insert(
-        "settings_scan_dirs_desc".into(),
-        "Répertoires analysés pour les applications.".into(),
-    );
-    strings.insert("settings_scan_dirs_value".into(), "Par défaut".into());
     strings.insert("settings_startup".into(), "Scanner au démarrage".into());
     strings.insert(
         "settings_startup_desc".into(),
         "Met à jour la bibliothèque au démarrage.".into(),
     );
-    strings.insert("settings_enabled".into(), "Activé".into());
     strings.insert("settings_section_install".into(), "Installation".into());
     strings.insert("settings_local_apps".into(), "Applications locales".into());
     strings.insert("settings_colony_repos".into(), "Dépôts Colony".into());
     strings.insert("settings_favorites".into(), "Favoris".into());
     // Placeholders
-    strings.insert("settings_coming_soon".into(), "Bientôt".into());
     // About
     strings.insert("settings_about_title".into(), "À propos de Colony".into());
     strings.insert("settings_about".into(), "À propos".into());
-    strings.insert("settings_version".into(), "Colony v0.1.0".into());
     // Launcher self-update
     strings.insert(
         "launcher_update_available".into(),
@@ -676,10 +575,6 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
         "launcher_download_update".into(),
         "Télécharger la mise à jour {version}".into(),
     );
-    strings.insert(
-        "launcher_update_failed".into(),
-        "Échec de la mise à jour : {error}".into(),
-    );
     strings.insert(
         "check_launcher_updates".into(),
         "Vérifier les mises à jour".into(),
@@ -703,6 +598,5 @@ pub(super) fn insert_all(strings: &mut HashMap<String, String>) {
     strings.insert("tab_readme".into(), "ReadMe".into());
     strings.insert("tab_license".into(), "License".into());
     strings.insert("tab_changelog".into(), "Changelog".into());
-    strings.insert("tab_loading".into(), "Chargement...".into());
     strings.insert("tab_not_available".into(), "Non disponible".into());
 }
diff --git a/src/i18n/mod.rs b/src/i18n/mod.rs
index 815f7c9..cdaa8d3 100644
--- a/src/i18n/mod.rs
+++ b/src/i18n/mod.rs
@@ -64,6 +64,7 @@ pub fn section_display_name(name: &str) -> String {
         "favorites" | "favoris" => "section_favorites",
         "windows" => "section_windows",
         "linux" => "section_linux",
+        "macos" => "section_macos",
         "development" => "section_development",
         "graphics" => "section_graphics",
         "network" => "section_network",
@@ -177,6 +178,79 @@ mod tests {
         );
     }
 
+    /// 52 keys (104 entries across the two locales) were dead: settings that
+    /// were never built, a welcome carousel that was replaced, placeholders
+    /// for features that never shipped. Translators had no way to tell them
+    /// from live strings.
+    ///
+    /// Reads the source rather than the runtime map, which is the only way to
+    /// see a key that nothing looks up.
+    #[test]
+    fn no_locale_key_is_unreferenced() {
+        const EN: &str = include_str!("en.rs");
+        // Every .rs in the crate EXCEPT the two locale tables themselves.
+        const SOURCES: &[&str] = &[
+            include_str!("mod.rs"),
+            include_str!("../app.rs"),
+            include_str!("../state.rs"),
+            include_str!("../update/mod.rs"),
+            include_str!("../update/store.rs"),
+            include_str!("../update/github_auth.rs"),
+            include_str!("../update/launcher.rs"),
+            include_str!("../update/preferences.rs"),
+            include_str!("../update/keyboard.rs"),
+            include_str!("../update/onboarding.rs"),
+            include_str!("../ui/app_grid.rs"),
+            include_str!("../ui/detail.rs"),
+            include_str!("../ui/sidebar.rs"),
+            include_str!("../ui/settings.rs"),
+            include_str!("../ui/github_panel.rs"),
+            include_str!("../ui/tutorial.rs"),
+            include_str!("../scan.rs"),
+            include_str!("../sections.rs"),
+            include_str!("../github/http.rs"),
+            include_str!("../github/catalog.rs"),
+            include_str!("../github/releases.rs"),
+            include_str!("../oauth.rs"),
+            include_str!("../download.rs"),
+            include_str!("../persistence.rs"),
+            include_str!("../config.rs"),
+            include_str!("../main.rs"),
+        ];
+
+        let mut dead = Vec::new();
+        for line in EN.lines() {
+            // A KEY is `"snake_case".into(),` - the value on a wrapped insert
+            // is also a quoted string on its own line, so match the shape, not
+            // just "starts with a quote".
+            let Some(rest) = line.trim().strip_prefix('"') else {
+                continue;
+            };
+            let Some(key) = rest.split('"').next() else {
+                continue;
+            };
+            if key.is_empty()
+                || !key
+                    .chars()
+                    .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_')
+                || !rest[key.len()..].starts_with("\".into()")
+            {
+                continue;
+            }
+            let needle = format!("\"{key}\"");
+            if !SOURCES.iter().any(|src| src.contains(&needle)) {
+                dead.push(key.to_string());
+            }
+        }
+        assert!(
+            dead.is_empty(),
+            "locale keys nothing looks up: {dead:?}\n\
+             Either delete them from en.rs and fr.rs, or - if they ARE used - add the \
+             module that uses them to SOURCES above (this list is hand-maintained, and a \
+             missing entry fails LOUDLY here rather than silently letting dead keys back in)."
+        );
+    }
+
     #[test]
     fn t_fmt_substitution() {
         // Initialize with English for test
diff --git a/src/main.rs b/src/main.rs
index ab03270..cf873a3 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -21,13 +21,199 @@ mod update;
 
 use state::{default_font, App};
 
+/// Where diagnostics land. A plain truncate-on-start file, not a rolling
+/// appender: one run's worth of log is what a bug report needs, and it keeps
+/// the dependency set unchanged.
+fn log_file_path() -> Option<std::path::PathBuf> {
+    let dir = dirs::cache_dir()?.join("colony");
+    std::fs::create_dir_all(&dir).ok()?;
+    Some(dir.join("colony.log"))
+}
+
+/// Answer `--version` / `--help` without opening a window. The bug template
+/// makes `colony --version` a required field, and on Windows
+/// `windows_subsystem = "windows"` means stderr goes nowhere, so the GUI was
+/// the only possible answer to either flag.
+///
+/// Returns true when the process should exit without starting the UI.
+fn handle_cli_flags() -> bool {
+    let Some(arg) = std::env::args().nth(1) else {
+        return false;
+    };
+    match arg.as_str() {
+        // Lets an app author check their own manifest in their own CI, which is
+        // the only place that can catch the mistake before users see a card
+        // with no Download button. Decentralised on purpose: each repo
+        // validates itself, there is no central registry to register with.
+        "validate-manifest" => {
+            let mut rest = std::env::args().skip(2);
+            let path = rest.next().unwrap_or_else(|| "colony.json".to_string());
+            // Everything after the path is a release asset name. Passing the
+            // assets being published is what turns a shape check into a real
+            // one - a structurally perfect manifest still resolves to nothing
+            // if the release names its files differently.
+            let assets: Vec<String> = rest.collect();
+            std::process::exit(validate_manifest(&path, &assets));
+        }
+        "--version" | "-V" => {
+            println!("colony {}", env!("CARGO_PKG_VERSION"));
+            true
+        }
+        "--help" | "-h" => {
+            println!(
+                "colony {}\nThe hub for the Colony ecosystem.\n\n\
+                 Usage: colony [OPTIONS] [COMMAND]\n\n\
+                 Options:\n  \
+                 -V, --version  Print the version and exit\n  \
+                 -h, --help     Print this help and exit\n\n\
+                 Commands:\n  \
+                 validate-manifest [PATH] [ASSET...]\n      \
+                 Check a colony.json (default: ./colony.json). Pass the release\n      \
+                 asset names to also verify each platform actually resolves.\n\n\
+                 With no arguments, Colony opens its window.\n\n\
+                 Diagnostics are written to {} and to stderr.\n\
+                 Set RUST_LOG=debug for more detail.",
+                env!("CARGO_PKG_VERSION"),
+                log_file_path()
+                    .map(|p| p.display().to_string())
+                    .unwrap_or_else(|| "(no cache directory)".into()),
+            );
+            true
+        }
+        _ => false,
+    }
+}
+
+/// Report on a `colony.json`. Returns the process exit code: 0 clean, 1 invalid,
+/// 2 unreadable.
+fn validate_manifest(path: &str, assets: &[String]) -> i32 {
+    let raw = match std::fs::read(path) {
+        Ok(bytes) => bytes,
+        Err(e) => {
+            eprintln!("cannot read {path}: {e}");
+            return 2;
+        }
+    };
+    let manifest: github::ColonyManifest = match serde_json::from_slice(&raw) {
+        Ok(m) => m,
+        Err(e) => {
+            eprintln!("{path} is not a valid colony.json: {e}");
+            return 1;
+        }
+    };
+    let mut errors = manifest.validation_errors();
+
+    if assets.is_empty() {
+        if manifest.release_files.is_empty() {
+            println!(
+                "  note: no releaseFiles - Colony auto-detects platforms from asset names \
+                 following the <name>-<platform> convention. Pass your release asset names \
+                 (colony validate-manifest {path} <asset>...) to check that this actually \
+                 resolves; without them this is a shape check only."
+            );
+        }
+    } else {
+        errors.extend(resolution_errors(&manifest, path, assets));
+    }
+
+    if errors.is_empty() {
+        println!("{path}: OK ({}, {})", manifest.name, manifest.category);
+        return 0;
+    }
+    eprintln!("{path}: {} problem(s)", errors.len());
+    for e in &errors {
+        eprintln!("  - {e}");
+    }
+    1
+}
+
+/// Check that the manifest resolves to something installable against the asset
+/// names a release actually publishes.
+///
+/// This is the check that catches the failure that really happens: a manifest
+/// declaring only a name and a category is structurally perfect, and still
+/// renders as a card with no Download button because none of its assets match
+/// the `<name>-<platform>` convention auto-detection looks for.
+fn resolution_errors(
+    manifest: &github::ColonyManifest,
+    path: &str,
+    assets: &[String],
+) -> Vec<String> {
+    let mut errors = Vec::new();
+
+    if manifest.release_files.is_empty() {
+        // Auto-detection is the only path. `<repo>` is not in the manifest, so
+        // derive it the way Colony does: from the manifest name, then from the
+        // file's own directory, since app authors run this in their repo root.
+        let repo_hint = std::path::Path::new(path)
+            .parent()
+            .and_then(|p| p.canonicalize().ok())
+            .and_then(|p| p.file_name().map(|n| n.to_string_lossy().into_owned()))
+            .unwrap_or_else(|| manifest.name.clone());
+        let detected = github::detect_platforms_from_assets(&repo_hint, assets);
+        if detected.is_empty() {
+            errors.push(format!(
+                "no releaseFiles, and none of the {} published asset(s) match the \
+                 <name>-<platform> convention for {repo_hint:?} (expected e.g. \
+                 {}-linux). The app will list in Colony with no Download button. \
+                 Declare releaseFiles explicitly, or rename the assets.",
+                assets.len(),
+                repo_hint.to_lowercase()
+            ));
+        } else {
+            println!("  auto-detected platforms: {}", detected.join(", "));
+        }
+        return errors;
+    }
+
+    for (platform, entry) in &manifest.release_files {
+        let at = format!("releaseFiles.{platform}");
+        if let Some(file) = &entry.file {
+            if !assets.iter().any(|a| a == file) {
+                errors.push(format!(
+                    "`{at}.file` is {file:?}, which this release does not publish"
+                ));
+            }
+        } else if let Some(pattern) = &entry.file_pattern {
+            match github::find_asset_by_pattern(assets, pattern) {
+                Ok(resolved) => println!("  {platform} -> {resolved}"),
+                Err(e) => errors.push(format!("`{at}.filePattern` does not resolve: {e}")),
+            }
+        }
+    }
+    errors
+}
+
 pub fn main() -> iced::Result {
-    tracing_subscriber::fmt()
-        .with_env_filter(
-            tracing_subscriber::EnvFilter::from_default_env()
-                .add_directive(tracing::Level::INFO.into()),
-        )
-        .init();
+    if handle_cli_flags() {
+        return Ok(());
+    }
+
+    // `EnvFilter::from_default_env().add_directive(INFO)` looked like "default
+    // to info", but a bare `RUST_LOG=debug` parses to a directive that compares
+    // Equal to the added one, so add_directive REPLACED it and the user's
+    // request was silently discarded. Build the default only when RUST_LOG is
+    // absent or unparseable, and otherwise honour it verbatim.
+    //
+    // The default is scoped rather than a bare "info": iced_winit and wgpu are
+    // chatty at info (a full pretty-printed WindowAttributes and adapter dump
+    // per launch), which drowned Colony's own lines in the very file a bug
+    // report is supposed to attach. Their warnings still come through.
+    let filter = tracing_subscriber::EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("warn,colony=info"));
+
+    // Log to a file as well as stderr: a .desktop launch has no terminal, and
+    // on Windows there is no console at all, so stderr-only meant that every
+    // warning in the codebase reached nobody in any shipped configuration.
+    use tracing_subscriber::fmt::writer::MakeWriterExt;
+    match log_file_path().and_then(|p| std::fs::File::create(p).ok()) {
+        Some(file) => tracing_subscriber::fmt()
+            .with_env_filter(filter)
+            .with_writer(std::sync::Mutex::new(file).and(std::io::stderr))
+            .with_ansi(false)
+            .init(),
+        None => tracing_subscriber::fmt().with_env_filter(filter).init(),
+    }
 
     // Honor the saved language preference over environment locale detection,
     // and reopen at the last persisted window size (clamped to sanity).
diff --git a/src/message.rs b/src/message.rs
index b57d07b..8c1f336 100644
--- a/src/message.rs
+++ b/src/message.rs
@@ -32,7 +32,6 @@ pub enum Message {
     GitHubError(String),
     GitHubRefreshRepos,
     DownloadRelease(String, String), // (repo_name, platform_key)
-    #[allow(dead_code)]
     /// (filename, downloaded bytes, total bytes when the server sent
     /// Content-Length) - raw bytes so the UI can show size AND speed, not
     /// just a bare percentage.
@@ -49,13 +48,16 @@ pub enum Message {
     AnimationTick,
     KeyboardEvent(keyboard::Event),
     CheckUpdates,
-    UpdatesChecked(Vec<(String, String)>), // Vec<(repo_name, latest_tag)>
+    /// One entry per checked repo. `Ok(Some(tag))` = update to `tag`,
+    /// `Ok(None)` = current, `Err(msg)` = the check could not run for that repo
+    /// and its existing badge must be left alone rather than cleared.
+    UpdatesChecked(Vec<(String, Result<Option<String>, String>)>),
     /// One-click sequential update of every app with a pending update.
     UpdateAll,
     /// Fetch the release notes ("what's new") for a repo's available update.
     FetchReleaseNotes(String),
-    /// (repo, Ok((tag, body_markdown))) - notes fetched (or failed).
-    ReleaseNotesFetched(String, Result<(String, String), String>),
+    /// (repo, Ok((facts, notes markdown)) | Err(message))
+    ReleaseNotesFetched(String, Result<(crate::state::ReleaseFacts, String), String>),
     /// Manual "clear store caches" from Settings > Storage.
     ClearStoreCaches,
     WindowResized(f32, f32),
diff --git a/src/oauth.rs b/src/oauth.rs
index abbd95a..182368d 100644
--- a/src/oauth.rs
+++ b/src/oauth.rs
@@ -12,17 +12,32 @@ const DEVICE_CODE_URL: &str = "https://github.com/login/device/code";
 const TOKEN_URL: &str = "https://github.com/login/oauth/access_token";
 
 /// Stored OAuth session.
-#[derive(Debug, Clone)]
+#[derive(Clone)]
 pub struct OAuthSession {
     pub access_token: String,
     pub username: Option<String>,
 }
 
+/// Hand-written so the token can never be printed. `Message` derives Debug and
+/// carries an `OAuthSession` in `GitHubLoginCompleted`, so the single most
+/// natural debugging line anyone will ever add to `App::update` -
+/// `tracing::debug!(?message)` - would otherwise put the plaintext token on
+/// stderr and into the log file for any user running with RUST_LOG=debug. The
+/// redaction is inherited by every type that contains a session.
+impl std::fmt::Debug for OAuthSession {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("OAuthSession")
+            .field("access_token", &"<redacted>")
+            .field("username", &self.username)
+            .finish()
+    }
+}
+
 /// Pending device code, returned by the first step of the flow.
 #[derive(Debug, Clone)]
 pub struct DeviceCode {
     pub user_code: String,
-    #[allow(dead_code)]
+    /// Shown in the panel so the flow survives a browser that would not open.
     pub verification_uri: String,
     pub(crate) device_code: String,
     pub(crate) expires_in: u64,
@@ -73,7 +88,11 @@ pub async fn request_device_code() -> Result<DeviceCode> {
     let url = format!("{}?user_code={}", device.verification_uri, device.user_code);
     match crate::download::web_url(&url) {
         Some(safe) => {
-            let _ = open::that(&safe);
+            if let Err(e) = open::that(&safe) {
+                // Not fatal: the panel shows the URL and the code, and the poll
+                // keeps running until the device code expires.
+                tracing::warn!("could not open the verification page: {e}");
+            }
         }
         None => tracing::warn!("refusing to open non-http(s) verification uri {url:?}"),
     }
@@ -282,16 +301,19 @@ fn write_private(path: &std::path::Path, contents: &[u8]) -> Result<()> {
         // Remove any pre-existing file first so `.mode(0o600)` on create always
         // applies (a truncated-open of a 0644 file would keep the loose bits).
         let _ = std::fs::remove_file(path);
+        // create_new, not create: with `create`, a symlink that wins the race
+        // between the unlink above and this open is FOLLOWED, and `.mode()`
+        // does not apply to an already-existing inode - so the token would be
+        // written through the link, at the link target's permissions. The
+        // unlink makes create_new succeed on the normal path, and because it
+        // guarantees a fresh inode, the mode it sets is the mode that sticks
+        // (the old set_permissions re-assertion chmod'd the link's target).
         let mut f = std::fs::OpenOptions::new()
             .write(true)
-            .create(true)
-            .truncate(true)
+            .create_new(true)
             .mode(0o600)
             .open(path)?;
         f.write_all(contents)?;
-        // Re-assert perms in case the file pre-existed with looser bits.
-        use std::os::unix::fs::PermissionsExt;
-        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600))?;
         Ok(())
     }
     #[cfg(not(unix))]
@@ -329,16 +351,44 @@ pub fn load_saved_token() -> Option<OAuthSession> {
 }
 
 /// Delete the stored token (logout).
+/// Forget the stored credential, reporting whether it actually went away.
+///
+/// `save_token` checks and logs every keyring outcome, and deliberately deletes
+/// the plaintext fallback once the keychain accepted the secret. The delete path
+/// used to get none of that care: the keyring result was dropped on the floor,
+/// so a failed deletion still reported "Disconnected" and the next launch
+/// silently restored the session from the credential the user just revoked.
 pub fn delete_saved_token() -> Result<()> {
-    // Remove from keychain
-    if let Ok(entry) = keyring::Entry::new(KEYRING_SERVICE, KEYRING_USER) {
-        let _ = entry.delete_credential();
+    let mut failure: Option<String> = None;
+
+    match keyring::Entry::new(KEYRING_SERVICE, KEYRING_USER) {
+        Ok(entry) => match entry.delete_credential() {
+            // Nothing stored is the desired end state, not an error.
+            Ok(()) | Err(keyring::Error::NoEntry) => {}
+            Err(e) => {
+                tracing::warn!("could not delete the keychain credential: {e}");
+                failure = Some(e.to_string());
+            }
+        },
+        Err(e) => {
+            tracing::warn!("could not open the keychain entry to delete it: {e}");
+            failure = Some(e.to_string());
+        }
     }
-    // Remove file too
+
     let path = token_path();
     if path.exists() {
-        std::fs::remove_file(&path)?;
+        if let Err(e) = std::fs::remove_file(&path) {
+            tracing::warn!("could not delete the token file: {e}");
+            failure = Some(e.to_string());
+        }
+    }
+
+    match failure {
+        None => {
+            tracing::info!("Token deleted");
+            Ok(())
+        }
+        Some(e) => anyhow::bail!("{e}"),
     }
-    tracing::info!("Token deleted");
-    Ok(())
 }
diff --git a/src/persistence.rs b/src/persistence.rs
index 10afdc4..dd137fc 100644
--- a/src/persistence.rs
+++ b/src/persistence.rs
@@ -18,6 +18,43 @@ pub fn colony_data_dir() -> Result<PathBuf> {
     Ok(base)
 }
 
+/// Write `bytes` to `path` atomically: a temp sibling, then a rename.
+///
+/// Every state writer here used a bare `std::fs::write`, so a crash, an OOM
+/// kill or power loss mid-write left exactly the truncated JSON that the
+/// loaders then treated as "no file" - which the next save overwrote with
+/// defaults, destroying any chance of recovery. The install path already knew
+/// better: it stages and renames precisely so an interrupted write cannot
+/// truncate the target.
+fn write_atomic(path: &std::path::Path, bytes: &[u8]) -> Result<()> {
+    let tmp = path.with_extension("tmp");
+    std::fs::write(&tmp, bytes)?;
+    std::fs::rename(&tmp, path)?;
+    Ok(())
+}
+
+/// Parse JSON from `path`, telling "absent" apart from "corrupt".
+///
+/// On a parse failure the file is moved aside to `<name>.corrupt` before
+/// defaults are returned, so the next save cannot clobber it and the user has
+/// something to attach to a bug report.
+fn load_json_or_quarantine<T: serde::de::DeserializeOwned>(path: &std::path::Path) -> Option<T> {
+    let content = std::fs::read_to_string(path).ok()?;
+    match serde_json::from_str(&content) {
+        Ok(value) => Some(value),
+        Err(e) => {
+            let quarantine = path.with_extension("corrupt");
+            tracing::warn!(
+                "{} is not valid JSON ({e}); moving it to {} and starting from defaults",
+                path.display(),
+                quarantine.display()
+            );
+            let _ = std::fs::rename(path, &quarantine);
+            None
+        }
+    }
+}
+
 /// Join a repo name onto `base` as a single directory component.
 ///
 /// `repo_name` is remote data (the `name` field of the GitHub API listing, also
@@ -183,6 +220,34 @@ pub fn load_installed_signed(repo_name: &str) -> bool {
     })
 }
 
+/// Marker recording that this app was installed with a verified signed METADATA
+/// sidecar, not just a bare signature.
+const META_FILE: &str = ".colony_meta";
+
+/// Record that the installed build carried a verified `.meta` sidecar.
+///
+/// Same "only ever raises the bar" contract as [`save_installed_signed`]: a
+/// bare `.sig` proves the bytes came from the org key, but not WHICH artefact
+/// or version they are, so a compromised maintainer can re-upload an old,
+/// genuinely signed, known-vulnerable build under a new tag. Once an app has
+/// been installed with a sidecar, later updates must keep providing one - so
+/// the replay cannot be performed by simply dropping the sidecar.
+///
+/// Never cleared while the app stays installed; uninstalling is the deliberate
+/// way out.
+pub fn save_installed_metadata(repo_name: &str) -> Result<()> {
+    let path = colony_app_dir(repo_name)?.join(META_FILE);
+    std::fs::write(&path, "1")?;
+    Ok(())
+}
+
+/// True when a previous install of this repo carried a verified sidecar.
+pub fn load_installed_metadata(repo_name: &str) -> bool {
+    colony_app_dir(repo_name)
+        .map(|d| d.join(META_FILE).exists())
+        .unwrap_or(false)
+}
+
 /// Save the resolved asset name for a repo (when using filePattern).
 pub fn save_installed_asset(repo_name: &str, filename: &str) -> Result<()> {
     let path = colony_app_dir(repo_name)?.join(ASSET_FILE);
@@ -207,8 +272,7 @@ fn repos_cache_path() -> Result<PathBuf> {
 /// Save Colony repos to local cache for offline use.
 pub fn save_repos_cache(repos: &[ColonyRepo]) -> Result<()> {
     let path = repos_cache_path()?;
-    let json = serde_json::to_string(repos)?;
-    std::fs::write(&path, json)?;
+    write_atomic(&path, serde_json::to_string(repos)?.as_bytes())?;
     tracing::debug!("Saved {} repos to cache", repos.len());
     Ok(())
 }
@@ -222,6 +286,31 @@ pub fn load_repos_cache() -> Option<Vec<ColonyRepo>> {
     Some(repos)
 }
 
+fn http_cache_path() -> Result<PathBuf> {
+    let cache_dir = colony_data_dir()?.join("cache");
+    std::fs::create_dir_all(&cache_dir)?;
+    Ok(cache_dir.join("http_etags.json"))
+}
+
+/// Load the persisted conditional-request cache (see `github::http`).
+///
+/// Generic so the cache's shape stays private to the HTTP layer - this module
+/// only knows where the file goes. A corrupt or older-shaped file simply
+/// deserialises to `None` and the cache starts empty, which costs quota but is
+/// never wrong.
+pub fn load_http_cache_json<T: serde::de::DeserializeOwned>() -> Option<T> {
+    let path = http_cache_path().ok()?;
+    let content = std::fs::read_to_string(&path).ok()?;
+    serde_json::from_str(&content).ok()
+}
+
+/// Persist the conditional-request cache. The caller is responsible for
+/// bounding what it hands over.
+pub fn save_http_cache_json<T: serde::Serialize>(value: &T) -> Result<()> {
+    let path = http_cache_path()?;
+    write_atomic(&path, serde_json::to_string(value)?.as_bytes())
+}
+
 fn favorites_path() -> Result<PathBuf> {
     let dir = colony_data_dir()?.join("preferences");
     std::fs::create_dir_all(&dir)?;
@@ -232,17 +321,14 @@ fn favorites_path() -> Result<PathBuf> {
 pub fn load_favorites() -> Vec<String> {
     favorites_path()
         .ok()
-        .and_then(|p| std::fs::read_to_string(p).ok())
-        .and_then(|c| serde_json::from_str(&c).ok())
+        .and_then(|p| load_json_or_quarantine(&p))
         .unwrap_or_default()
 }
 
 /// Save the list of favorite application names.
 pub fn save_favorites(favorites: &[String]) -> Result<()> {
     let path = favorites_path()?;
-    let json = serde_json::to_string(favorites)?;
-    std::fs::write(&path, json)?;
-    Ok(())
+    write_atomic(&path, serde_json::to_string(favorites)?.as_bytes())
 }
 
 /// User preferences saved between sessions.
@@ -255,14 +341,15 @@ pub struct UserPreferences {
     pub selected_theme: Option<String>,
     pub selected_variant: Option<String>,
     pub selected_accent: Option<String>,
+    /// Whether the accent follows the theme. The toggle existed and was
+    /// applied at boot, but was never written, so it silently reset every
+    /// restart.
+    pub auto_accent: Option<bool>,
     // General
     pub restore_session: Option<bool>,
     pub default_view: Option<String>,
-    pub close_behavior: Option<String>,
     pub language: Option<String>,
     pub auto_check_updates: Option<bool>,
-    pub update_channel: Option<String>,
-    pub auto_install_updates: Option<bool>,
     // Appearance
     pub font_size: Option<String>,
     pub animations: Option<bool>,
@@ -286,17 +373,14 @@ fn preferences_path() -> Result<PathBuf> {
 pub fn load_preferences() -> UserPreferences {
     preferences_path()
         .ok()
-        .and_then(|p| std::fs::read_to_string(p).ok())
-        .and_then(|c| serde_json::from_str(&c).ok())
+        .and_then(|p| load_json_or_quarantine(&p))
         .unwrap_or_default()
 }
 
 /// Save user preferences.
 pub fn save_preferences(prefs: &UserPreferences) -> Result<()> {
     let path = preferences_path()?;
-    let json = serde_json::to_string_pretty(prefs)?;
-    std::fs::write(&path, json)?;
-    Ok(())
+    write_atomic(&path, serde_json::to_string_pretty(prefs)?.as_bytes())
 }
 
 fn scan_cache_path() -> Result<PathBuf> {
@@ -328,7 +412,12 @@ pub struct CachedApp {
 /// (the app is already represented by its store card). Linux only; no-op
 /// elsewhere.
 #[cfg(target_os = "linux")]
-pub fn write_desktop_entry(repo_name: &str, exec_path: &std::path::Path) -> Result<()> {
+pub fn write_desktop_entry(
+    repo_name: &str,
+    display_name: &str,
+    category: crate::scan::AppCategory,
+    exec_path: &std::path::Path,
+) -> Result<()> {
     let dir = dirs::data_dir()
         .ok_or_else(|| anyhow::anyhow!("Cannot determine data directory"))?
         .join("applications");
@@ -340,7 +429,13 @@ pub fn write_desktop_entry(repo_name: &str, exec_path: &std::path::Path) -> Resu
     // the path closes the Exec quoting to append arguments. The icon path contains
     // repo_name too, so it goes through the same check rather than relying on
     // being emitted last.
-    let name = desktop_value(repo_name)?;
+    // The FILENAME keys off the slug (identity, and what remove_desktop_entry
+    // looks up); the Name= the user reads is the manifest's display name.
+    let name = desktop_value(if display_name.trim().is_empty() {
+        repo_name
+    } else {
+        display_name
+    })?;
     let exec = desktop_value(&exec_path.to_string_lossy())?;
     let icon_line = match repo_icon_dir(repo_name)
         .ok()
@@ -350,8 +445,9 @@ pub fn write_desktop_entry(repo_name: &str, exec_path: &std::path::Path) -> Resu
         Some(p) => format!("Icon={}\n", desktop_value(&p.to_string_lossy())?),
         None => String::new(),
     };
+    let categories = category.desktop_categories();
     let entry = format!(
-        "[Desktop Entry]\nType=Application\nName={name}\nExec=\"{exec}\"\nTerminal=false\nCategories=Utility;\nComment=Installed by Colony\nX-Colony-Managed=true\n{icon_line}"
+        "[Desktop Entry]\nType=Application\nName={name}\nExec=\"{exec}\"\nTerminal=false\nCategories={categories}\nComment=Installed by Colony\nX-Colony-Managed=true\n{icon_line}"
     );
     std::fs::write(dir.join(desktop_entry_filename(repo_name)?), entry)?;
     Ok(())
@@ -375,13 +471,25 @@ fn desktop_value(raw: &str) -> Result<String> {
         if matches!(c, '\\' | '"' | '`' | '$') {
             out.push('\\');
         }
+        // The Desktop Entry spec writes a literal percent as `%%`. Unescaped,
+        // the launcher expands the FIELD CODE instead: a manifest declaring
+        // `binary: "app%f"` yields Exec="/…/app%f", glib substitutes an empty
+        // file list, and the entry silently launches the wrong path.
+        if c == '%' {
+            out.push('%');
+        }
         out.push(c);
     }
     Ok(out)
 }
 
 #[cfg(not(target_os = "linux"))]
-pub fn write_desktop_entry(_repo_name: &str, _exec_path: &std::path::Path) -> Result<()> {
+pub fn write_desktop_entry(
+    _repo_name: &str,
+    _display_name: &str,
+    _category: crate::scan::AppCategory,
+    _exec_path: &std::path::Path,
+) -> Result<()> {
     Ok(())
 }
 
@@ -431,6 +539,111 @@ pub fn clear_store_caches() -> usize {
     removed
 }
 
+/// Remove an installed app's directory, coping with a binary that is currently
+/// running.
+///
+/// `remove_dir_all` cannot delete a live executable on Windows, so uninstalling
+/// an app the user had left open failed outright and left it half-removed. A
+/// running image can always be RENAMED though, so fall back to renaming each
+/// file aside: the directory then empties and [`prune_staging`] collects the
+/// leftovers at the next start, once the process holding them has exited.
+pub fn remove_app_dir(app_dir: &std::path::Path) -> std::io::Result<()> {
+    match std::fs::remove_dir_all(app_dir) {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(first) => {
+            let Ok(entries) = std::fs::read_dir(app_dir) else {
+                return Err(first);
+            };
+            for entry in entries.flatten() {
+                let path = entry.path();
+                if path.is_file() && std::fs::remove_file(&path).is_err() {
+                    let _ = std::fs::rename(&path, path.with_extension("old"));
+                }
+            }
+            // Second pass: everything deletable is gone, and anything renamed
+            // aside is now a `.old` the boot sweep will take.
+            std::fs::remove_dir_all(app_dir).or(Err(first))
+        }
+    }
+}
+
+/// Delete staging leftovers from interrupted transfers, and report the bytes
+/// reclaimed.
+///
+/// The only sweep that existed ran inside Cancel, so a crash, an OOM, a SIGKILL
+/// or simply closing the window mid-download left the whole partial asset in
+/// `apps/<repo>/` with no UI that showed or removed it. A `filePattern` app
+/// whose asset name carries the version leaves one per version, so it
+/// accumulates. Run once at boot: any staging file present then is by
+/// definition orphaned, because nothing is in flight yet.
+///
+/// The `update-staging` directory gets the same treatment, plus the `.old`
+/// backup a completed self-update leaves next to the executable - two full
+/// copies of the launcher could otherwise sit on disk indefinitely.
+pub fn prune_staging() -> u64 {
+    fn sweep(dir: &std::path::Path, reclaimed: &mut u64) {
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            let Some(name) = path.file_name().and_then(|n| n.to_str()) else {
+                continue;
+            };
+            if !(name.ends_with(".part")
+                || name.ends_with(".part.id")
+                || name.ends_with(".new")
+                || name.ends_with(".old"))
+            {
+                continue;
+            }
+            let size = entry.metadata().map(|m| m.len()).unwrap_or(0);
+            if std::fs::remove_file(&path).is_ok() {
+                tracing::info!("pruned staging leftover {}", path.display());
+                *reclaimed += size;
+            }
+        }
+    }
+
+    let mut reclaimed = 0;
+    if let Ok(apps) = colony_apps_dir() {
+        if let Ok(entries) = std::fs::read_dir(&apps) {
+            for entry in entries.flatten() {
+                if entry.path().is_dir() {
+                    sweep(&entry.path(), &mut reclaimed);
+                    // An uninstall that could not delete a running binary
+                    // renames it aside and leaves the shell of the directory;
+                    // once the sweep above has taken the `.old` file, finish
+                    // the job.
+                    if std::fs::read_dir(entry.path())
+                        .map(|mut d| d.next().is_none())
+                        .unwrap_or(false)
+                    {
+                        let _ = std::fs::remove_dir(entry.path());
+                    }
+                }
+            }
+        }
+    }
+    if let Ok(base) = colony_data_dir() {
+        sweep(&base.join("update-staging"), &mut reclaimed);
+    }
+    // Only our OWN backup, by exact path - never a directory sweep here. The
+    // executable may well live in /usr/bin, where an extension-based sweep
+    // would happily delete somebody else's `.old` file.
+    if let Ok(exe) = std::env::current_exe() {
+        for stale in [exe.with_extension("old"), exe.with_extension("new")] {
+            let size = std::fs::metadata(&stale).map(|m| m.len()).unwrap_or(0);
+            if stale.exists() && std::fs::remove_file(&stale).is_ok() {
+                tracing::info!("pruned launcher leftover {}", stale.display());
+                reclaimed += size;
+            }
+        }
+    }
+    reclaimed
+}
+
 /// Remove doc/icon caches for repos that are NO LONGER in the catalog, so a
 /// deleted or renamed repo does not leave its caches behind forever. Runs
 /// after each successful catalog fetch (never on a cache fallback, where a
@@ -478,8 +691,7 @@ pub fn save_scan_cache(apps: &[CachedApp]) -> Result<()> {
         timestamp,
     };
     let path = scan_cache_path()?;
-    let json = serde_json::to_string(&entry)?;
-    std::fs::write(&path, json)?;
+    write_atomic(&path, serde_json::to_string(&entry)?.as_bytes())?;
     Ok(())
 }
 
@@ -517,6 +729,8 @@ mod tests {
         assert!(desktop_value("app\nExec=sh").is_err());
         assert!(desktop_value("app\rExec=sh").is_err());
         assert!(desktop_value("app\0").is_err());
+        // A literal percent must be doubled, or the field code is expanded.
+        assert_eq!(desktop_value("app%f").unwrap(), "app%%f");
     }
 
     #[test]
diff --git a/src/scan.rs b/src/scan.rs
index a88a921..97f0e3b 100644
--- a/src/scan.rs
+++ b/src/scan.rs
@@ -63,6 +63,38 @@ impl AppCategory {
             Self::Other => "\u{f187}",       // archive-box
         }
     }
+
+    /// freedesktop main categories for the `Categories=` key of a `.desktop`
+    /// entry, terminated with the trailing `;` the spec requires.
+    ///
+    /// Every Colony-installed app used to be filed as `Utility;` regardless of
+    /// what its manifest declared, so a music player and two games landed in
+    /// the same GNOME/KDE menu section - defeating the categorisation the
+    /// manifest already carries, in the one place the user browses outside
+    /// Colony.
+    ///
+    /// `Security` has no freedesktop MAIN category, so it is paired with the
+    /// `Utility` main category as the spec requires of additional categories.
+    ///
+    /// Only `write_desktop_entry` consumes this, and that is Linux-only, so the
+    /// method is genuinely dead in a Windows or macOS build. Allowed narrowly
+    /// there rather than dropping the whole thing behind a `cfg`: the mapping
+    /// is platform-neutral data, and its test runs everywhere.
+    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+    pub fn desktop_categories(&self) -> &'static str {
+        match self {
+            Self::Development => "Development;",
+            Self::Graphics => "Graphics;",
+            Self::Network => "Network;",
+            Self::Office => "Office;",
+            Self::Multimedia => "AudioVideo;",
+            Self::System => "System;",
+            Self::Utility => "Utility;",
+            Self::Security => "Utility;Security;",
+            Self::Game => "Game;",
+            Self::Other => "Utility;",
+        }
+    }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
@@ -574,9 +606,9 @@ fn parse_desktop_file(path: &Path) -> Result<Application> {
     let mut name = None;
     let mut exec = None;
     let mut icon = None;
-    let mut categories = String::new();
-    let mut no_display = false;
-    let mut hidden = false;
+    let mut categories: Option<String> = None;
+    let mut no_display: Option<bool> = None;
+    let mut hidden: Option<bool> = None;
     let mut in_desktop_entry = false;
 
     for line in content.lines() {
@@ -596,12 +628,21 @@ fn parse_desktop_file(path: &Path) -> Result<Application> {
             let value = value.trim();
 
             match key {
+                // FIRST occurrence wins for every key, which is what glib
+                // does - and what Colony's own writer documents and relies on
+                // (it rejects control characters precisely so a second `Exec=`
+                // cannot be injected). Only `Name` had the guard; `Exec`,
+                // `Icon`, `Categories`, `NoDisplay` and `Hidden` took the LAST
+                // one, so a duplicated key made Colony read a different entry
+                // than the desktop environment does.
                 "Name" if name.is_none() => name = Some(value.to_string()),
-                "Exec" => exec = Some(clean_exec(value)),
-                "Icon" => icon = Some(value.to_string()),
-                "Categories" => categories = value.to_string(),
-                "NoDisplay" => no_display = value.eq_ignore_ascii_case("true"),
-                "Hidden" => hidden = value.eq_ignore_ascii_case("true"),
+                "Exec" if exec.is_none() => exec = Some(clean_exec(value)),
+                "Icon" if icon.is_none() => icon = Some(value.to_string()),
+                "Categories" if categories.is_none() => categories = Some(value.to_string()),
+                "NoDisplay" if no_display.is_none() => {
+                    no_display = Some(value.eq_ignore_ascii_case("true"))
+                }
+                "Hidden" if hidden.is_none() => hidden = Some(value.eq_ignore_ascii_case("true")),
                 // Entries Colony itself wrote for installed store apps: real
                 // desktop launchers should show them, but Colony's own scan
                 // must skip them - the app is already represented by its
@@ -614,9 +655,10 @@ fn parse_desktop_file(path: &Path) -> Result<Application> {
         }
     }
 
-    if no_display || hidden {
+    if no_display.unwrap_or(false) || hidden.unwrap_or(false) {
         anyhow::bail!("Application is hidden");
     }
+    let categories = categories.unwrap_or_default();
 
     let name = name.ok_or_else(|| anyhow::anyhow!("No name found"))?;
     let exec = exec.ok_or_else(|| anyhow::anyhow!("No exec found"))?;
@@ -802,6 +844,62 @@ fn categorize_macos_app(name: &str) -> AppCategory {
 
 #[cfg(test)]
 mod tests {
+    /// `parse_desktop_file` had no test at all, and read duplicated keys the
+    /// opposite way round from glib - so Colony could show a different Exec
+    /// than the desktop environment would run.
+    #[cfg(not(windows))]
+    #[test]
+    fn desktop_entries_are_read_first_wins_like_glib() {
+        use std::io::Write;
+        let dir = std::env::temp_dir().join("colony_test_desktop_parse");
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+
+        let write = |name: &str, body: &str| {
+            let path = dir.join(name);
+            let mut f = std::fs::File::create(&path).unwrap();
+            f.write_all(body.as_bytes()).unwrap();
+            path
+        };
+
+        // Duplicated keys: the FIRST of each must win.
+        let p = write(
+            "dup.desktop",
+            "[Desktop Entry]\nType=Application\nName=Real\nName=Shadow\n\
+             Exec=/usr/bin/real\nExec=/usr/bin/evil\nIcon=real\nIcon=evil\n",
+        );
+        let app = parse_desktop_file(&p).expect("parses");
+        assert_eq!(app.name, "Real");
+        assert_eq!(app.exec, "/usr/bin/real");
+        assert_eq!(app.icon.as_deref(), Some("real"));
+
+        // Keys outside [Desktop Entry] are not entry keys.
+        let p = write(
+            "group.desktop",
+            "[Desktop Entry]\nName=Main\nExec=/usr/bin/main\n\
+             [Desktop Action New]\nName=Other\nExec=/usr/bin/other\n",
+        );
+        let app = parse_desktop_file(&p).expect("parses");
+        assert_eq!(app.exec, "/usr/bin/main");
+
+        // Hidden entries are refused, and a later NoDisplay=false must not
+        // resurrect one.
+        let p = write(
+            "hidden.desktop",
+            "[Desktop Entry]\nName=H\nExec=/bin/h\nNoDisplay=true\nNoDisplay=false\n",
+        );
+        assert!(parse_desktop_file(&p).is_err());
+
+        // Colony's own entries are skipped: the app is already a store card.
+        let p = write(
+            "managed.desktop",
+            "[Desktop Entry]\nName=Grape\nExec=/bin/grape\nX-Colony-Managed=true\n",
+        );
+        assert!(parse_desktop_file(&p).is_err());
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     use super::*;
 
     // --- expand_env_vars tests ---
diff --git a/src/sections.rs b/src/sections.rs
index b1c7033..2d58769 100644
--- a/src/sections.rs
+++ b/src/sections.rs
@@ -74,15 +74,58 @@ impl SectionFilter {
     }
 }
 
+impl Section {
+    /// The platform key a section restricts the STORE half of the grid to, if
+    /// any.
+    ///
+    /// The platform sections consulted only the category filter, which is None
+    /// for them, so "Windows" listed every store repo - including linux-only
+    /// ones - right beside the locally scanned Windows apps. They are
+    /// advertised as platform views, so they should filter both halves, using
+    /// the manifest's own `platforms` data.
+    pub fn required_platform(&self) -> Option<&'static str> {
+        match self.filter.origin {
+            OriginFilter::WindowsOnly => Some("windows"),
+            OriginFilter::ExternalOnly => Some(crate::github::current_platform_key()),
+            _ => None,
+        }
+    }
+}
+
 #[derive(Debug, Deserialize)]
 struct SectionConfig {
     name: String,
     icon: String,
     origin: Option<String>,
     category: Option<String>,
+    /// Platform keys this section applies to ("linux", "windows", "macos",
+    /// "macos-x86"). Absent means every platform, which is how every existing
+    /// config keeps working unchanged.
+    ///
+    /// Without this, the shipped config gave a Windows user a permanently empty
+    /// "Linux" section, a Linux user a permanently empty "Windows" one, and a
+    /// macOS user their /Applications filed under a section labelled "Linux" -
+    /// the first thing anyone sees, saying loudly that the app was never run on
+    /// their platform.
+    #[serde(default)]
+    platforms: Option<Vec<String>>,
 }
 
 impl SectionConfig {
+    /// Whether this section belongs in the sidebar on the running platform.
+    fn applies_here(&self) -> bool {
+        let Some(ref platforms) = self.platforms else {
+            return true;
+        };
+        let here = crate::github::current_platform_key();
+        platforms.iter().any(|p| {
+            // "macos" matches the Intel key too: a section is about the OS,
+            // not the CPU.
+            p.eq_ignore_ascii_case(here)
+                || (p.eq_ignore_ascii_case("macos") && here.starts_with("macos"))
+        })
+    }
+
     fn into_section(self) -> Section {
         let is_favorites = self.name.to_lowercase().contains("favor");
         Section {
@@ -148,6 +191,7 @@ fn parse_sections(contents: &str) -> Option<Vec<Section>> {
         Ok(configs) => {
             let sections: Vec<Section> = configs
                 .into_iter()
+                .filter(SectionConfig::applies_here)
                 .map(SectionConfig::into_section)
                 .collect();
             if sections.is_empty() {
@@ -499,6 +543,7 @@ mod tests {
     #[test]
     fn section_config_into_section() {
         let config = SectionConfig {
+            platforms: None,
             name: "Test".to_string(),
             icon: "\u{f00a}".to_string(),
             origin: Some("colony".to_string()),
@@ -521,11 +566,55 @@ mod tests {
     fn embedded_categories_has_expected_names() {
         let sections = parse_sections(EMBEDDED_CATEGORIES).expect("embedded parses");
         let names: Vec<&str> = sections.iter().map(|s| s.name.as_str()).collect();
-        for expected in ["All", "Windows", "Linux", "Development", "Other"] {
+        // Platform-neutral sections are present everywhere; the per-OS ones are
+        // asserted by `platform_sections_are_gated_to_their_own_os` below.
+        for expected in ["All", "Development", "Other"] {
             assert!(names.contains(&expected), "missing section {expected}");
         }
     }
 
+    /// The shipped config gave a Windows user a permanently empty "Linux"
+    /// section, a Linux user a permanently empty "Windows" one, and a macOS
+    /// user their /Applications filed under a section labelled "Linux".
+    #[test]
+    fn platform_sections_are_gated_to_their_own_os() {
+        let sections = parse_sections(EMBEDDED_CATEGORIES).expect("embedded parses");
+        let names: Vec<&str> = sections.iter().map(|s| s.name.as_str()).collect();
+
+        let here = crate::github::current_platform_key();
+        let expected = match here {
+            "windows" => "Windows",
+            "linux" => "Linux",
+            _ => "macOS",
+        };
+        assert!(
+            names.contains(&expected),
+            "the running platform's section must be present, got {names:?}"
+        );
+        for other in ["Windows", "Linux", "macOS"] {
+            if other != expected {
+                assert!(
+                    !names.contains(&other),
+                    "{other} must not appear on {here}, got {names:?}"
+                );
+            }
+        }
+    }
+
+    /// Every section a user actually sees needs a glyph. The shipped config had
+    /// regressed all of them to the empty string while the (unreachable)
+    /// built-in fallback kept the real ones.
+    #[test]
+    fn every_shipped_section_has_an_icon() {
+        for section in parse_sections(EMBEDDED_CATEGORIES).expect("embedded parses") {
+            assert!(
+                !section.icon.trim().is_empty(),
+                "section {} ships without an icon",
+                section.name
+            );
+        }
+    }
+
     #[test]
     fn ensure_favorites_injects_when_missing() {
         // The embedded shipped config intentionally has no Favorites entry.
diff --git a/src/signing.rs b/src/signing.rs
index 51fe5d7..dc52af0 100644
--- a/src/signing.rs
+++ b/src/signing.rs
@@ -15,15 +15,31 @@ use anyhow::Result;
 use base64::Engine;
 use ed25519_dalek::{Signature, VerifyingKey};
 
-/// Colony release signing public key (ed25519, raw 32 bytes).
+/// Colony release signing public keys (ed25519, raw 32 bytes each).
 ///
-/// To rotate: generate a new key (see `docs/release-signing.md`), replace these
-/// bytes with the new raw public key, and sign all subsequent releases with the
-/// matching private key.
-const RELEASE_PUBLIC_KEY: [u8; 32] = [
+/// A LIST, not a single key, because rotation is otherwise not expressible.
+/// With one embedded key, `sign-release.sh` emits exactly one `<asset>.sig`,
+/// which is either old-key (refused by every updated client) or new-key
+/// (refused by every client in the field) - and verification is fail-closed, so
+/// the refusal is permanent. The documented rotation procedure could not be
+/// carried out in either direction: a planned rotation stranded every existing
+/// install, and an emergency one after a leak left the defender with nothing
+/// anyone could verify while the attacker held a key every client trusts.
+///
+/// Accepting any listed key makes rotation a real three-release sequence:
+///
+/// 1. Ship N embedding `[old, new]`, still SIGNED with `old` - every client in
+///    the field accepts it, and afterwards trusts both.
+/// 2. Sign N+1 with `new` - clients on N accept it; clients still on N-1 do not
+///    update, which is the cost of the overlap window.
+/// 3. Drop `old` from this list in N+2 to complete the revocation.
+///
+/// Order is irrelevant to verification; keep the newest first for readability.
+/// See `docs/release-signing.md`.
+const RELEASE_PUBLIC_KEYS: &[[u8; 32]] = &[[
     0x44, 0xd8, 0xe0, 0xdc, 0xd9, 0xfc, 0x1f, 0xaf, 0xda, 0x06, 0x0d, 0x6e, 0x9f, 0x01, 0xa3, 0x91,
     0x44, 0xdc, 0xad, 0xd4, 0xf1, 0x11, 0x13, 0x5e, 0x7d, 0x56, 0xaa, 0x53, 0xc7, 0x05, 0xbb, 0x4b,
-];
+]];
 
 /// Filename suffix of the detached signature published alongside each asset.
 pub const SIGNATURE_SUFFIX: &str = ".sig";
@@ -82,20 +98,32 @@ impl ReleaseMetadata {
 }
 
 /// Verify a detached ed25519 signature over `data` against the embedded Colony
-/// release key. Returns Ok only if the signature is valid.
+/// release keys. Returns Ok if ANY trusted key validates it.
+///
+/// Every key is tried even after one succeeds is NOT the case here - the loop
+/// short-circuits, which is fine: the key list is public and its length leaks
+/// nothing. What matters is that the signature itself is checked with
+/// `verify_strict`, which is constant-time in the secret-bearing parts.
 pub fn verify_release_signature(data: &[u8], signature_bytes: &[u8]) -> Result<()> {
-    verify_with_key(&RELEASE_PUBLIC_KEY, data, signature_bytes)
+    // Parse once: a malformed signature is a malformed signature whatever key
+    // we would have tried it against, and the error should say so.
+    let sig = parse_signature(signature_bytes)?;
+    for key in RELEASE_PUBLIC_KEYS {
+        if verify_parsed(key, data, &sig).is_ok() {
+            return Ok(());
+        }
+    }
+    anyhow::bail!("signature verification failed (untrusted or corrupt update)")
 }
 
-fn verify_with_key(pubkey: &[u8; 32], data: &[u8], signature_bytes: &[u8]) -> Result<()> {
-    let sig = parse_signature(signature_bytes)?;
+fn verify_parsed(pubkey: &[u8; 32], data: &[u8], sig: &Signature) -> Result<()> {
     let vk = VerifyingKey::from_bytes(pubkey)
         .map_err(|e| anyhow::anyhow!("invalid release public key: {e}"))?;
     // verify_strict: rejects malleable/non-canonical signatures and small-
     // order key components - the recommended verifier for update/security
     // contexts (plain verify() accepts signatures strict verification would
     // refuse).
-    vk.verify_strict(data, &sig)
+    vk.verify_strict(data, sig)
         .map_err(|_| anyhow::anyhow!("signature verification failed (untrusted or corrupt update)"))
 }
 
@@ -123,6 +151,14 @@ fn parse_signature(bytes: &[u8]) -> Result<Signature> {
 mod tests {
     use super::*;
 
+    /// Verify against ONE named key. Production always goes through
+    /// `verify_release_signature`, which parses once and loops over the trusted
+    /// list; tests need to name a key so they can pin down which one accepted.
+    fn verify_with_key(pubkey: &[u8; 32], data: &[u8], signature_bytes: &[u8]) -> Result<()> {
+        let sig = parse_signature(signature_bytes)?;
+        verify_parsed(pubkey, data, &sig)
+    }
+
     // Independent throwaway test key + vector (NOT the release key), generated
     // with `openssl genpkey -algorithm ed25519` + `openssl pkeyutl -sign -rawin`.
     const TEST_PUBKEY: [u8; 32] = [
@@ -159,8 +195,45 @@ mod tests {
 
     #[test]
     fn wrong_key_rejected() {
-        // The embedded release key must not validate the unrelated test vector.
-        assert!(verify_with_key(&RELEASE_PUBLIC_KEY, TEST_MSG, &TEST_SIG).is_err());
+        // No embedded release key may validate the unrelated test vector.
+        assert!(verify_release_signature(TEST_MSG, &TEST_SIG).is_err());
+        for key in RELEASE_PUBLIC_KEYS {
+            assert!(verify_with_key(key, TEST_MSG, &TEST_SIG).is_err());
+        }
+    }
+
+    /// Rotation depends on a signature from EITHER listed key being accepted -
+    /// that is the whole overlap window. Without it, the documented procedure
+    /// strands one half of the install base whichever key you sign with.
+    #[test]
+    fn any_trusted_key_verifies_and_an_untrusted_one_does_not() {
+        // Stand in for a rotation list: the real release key plus the throwaway
+        // test key, in the shape RELEASE_PUBLIC_KEYS takes during an overlap.
+        let rotating: &[[u8; 32]] = &[RELEASE_PUBLIC_KEYS[0], TEST_PUBKEY];
+
+        let verified = rotating
+            .iter()
+            .any(|k| verify_with_key(k, TEST_MSG, &TEST_SIG).is_ok());
+        assert!(
+            verified,
+            "a signature from the incoming key must be accepted during the overlap"
+        );
+
+        // A key that is NOT on the list still fails: rotation widens trust to a
+        // named set, it does not weaken verification.
+        let mut stranger = TEST_PUBKEY;
+        stranger[0] ^= 0xff;
+        assert!(
+            !std::iter::once(stranger).any(|k| verify_with_key(&k, TEST_MSG, &TEST_SIG).is_ok()),
+            "an unlisted key must never validate"
+        );
+
+        // And the shipped list is a single key today, so nothing is widened yet.
+        assert_eq!(
+            RELEASE_PUBLIC_KEYS.len(),
+            1,
+            "no rotation is in progress; bump this when one starts"
+        );
     }
 
     #[test]
diff --git a/src/state.rs b/src/state.rs
index 3ad2c85..9849a19 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -126,8 +126,17 @@ impl Notification {
 #[derive(Debug, Clone)]
 pub enum GitHubState {
     Disconnected,
-    Connecting { user_code: Option<String> },
-    Connected { session: OAuthSession },
+    Connecting {
+        user_code: Option<String>,
+        /// Where to enter the code. Without it the panel said "Enter this code
+        /// on GitHub" and never named github.com/login/device, so a browser
+        /// that failed to open left the user with a code and nowhere to put it
+        /// while the poll ran on until it expired.
+        verification_uri: Option<String>,
+    },
+    Connected {
+        session: OAuthSession,
+    },
     Error(String),
 }
 
@@ -140,6 +149,16 @@ pub enum DetailTab {
     Changelog,
 }
 
+/// The three facts every app store shows before you commit to a download.
+#[derive(Debug, Clone)]
+pub struct ReleaseFacts {
+    pub tag: String,
+    /// Size of the asset for the CURRENT platform, when the release names one.
+    pub size: Option<u64>,
+    /// ISO-8601 publication timestamp, as returned by the API.
+    pub published_at: Option<String>,
+}
+
 // --- App state ---
 
 pub struct App {
@@ -224,6 +243,11 @@ pub struct App {
     pub is_downloading: bool,
     pub is_checking_updates: bool,
     pub is_fetching_repos: bool,
+    /// Whether the catalog fetch in flight was started by the user clicking
+    /// Refresh rather than by boot. A boot fetch failing while a cached catalog
+    /// is on screen is routine and stays in the status line; a click the user
+    /// just made deserves a toast, otherwise the button looks broken.
+    pub repos_refresh_manual: bool,
     // Settings section state persistence
     pub settings_expanded_sections: HashSet<String>,
     // Detail tabs
@@ -250,6 +274,13 @@ pub struct App {
         std::collections::HashMap<String, (String, Vec<crate::ui::markdown_blocks::DetailBlock>)>,
     /// Repos whose release notes are currently being fetched.
     pub fetching_notes: std::collections::HashSet<String>,
+    /// What the store is actually offering, per repo: the resolved tag, the
+    /// download size for THIS platform, and the publication date. The API
+    /// returns all three and Colony used to discard the last two, so the
+    /// product page could not answer which version, how big, or how old -
+    /// the size was learned from Content-Length only once the transfer had
+    /// already started. Populated by the same fetch that gets the notes.
+    pub release_facts: std::collections::HashMap<String, ReleaseFacts>,
     /// Install status per store repo: (installed, installed version). The
     /// grid used to stat the filesystem per card per FRAME; this cache is
     /// refreshed only when it can actually change (catalog load, install
@@ -311,10 +342,21 @@ impl App {
     }
 
     /// Filter local applications by the currently selected section.
+    ///
+    /// A non-empty search query makes the search GLOBAL: the section's
+    /// origin/category filter is bypassed. The shipped "All" section declares
+    /// `origin: colony`, and `AppOrigin::Colony` is effectively unreachable for
+    /// scanned apps (entries Colony wrote are skipped by the X-Colony-Managed
+    /// bail; everything else is External or Windows), so typing "firefox" in
+    /// the default view reported zero results on a machine where Firefox sits
+    /// two clicks away. A search that lies about zero results is worse than no
+    /// search - the user concludes the feature is broken. Favorites stays
+    /// scoped: it is a chosen set, not a browsing filter.
     pub fn filtered_applications(&self) -> Vec<&Application> {
         let query = self.search_query.to_lowercase();
         let selected_section = self.sections.get(self.selected_section);
         let is_favorites = selected_section.map(|s| s.is_favorites).unwrap_or(false);
+        let searching = !query.is_empty();
         self.applications
             .iter()
             .filter(|app| {
@@ -323,7 +365,7 @@ impl App {
                         return false;
                     }
                 } else if let Some(section) = selected_section {
-                    if !section.filter.matches(app) {
+                    if !searching && !section.filter.matches(app) {
                         return false;
                     }
                 }
@@ -341,6 +383,7 @@ impl App {
         let selected_section = self.sections.get(self.selected_section);
         let is_favorites = selected_section.map(|s| s.is_favorites).unwrap_or(false);
 
+        let searching = !query.is_empty();
         self.colony_repos()
             .iter()
             .filter(|repo| {
@@ -349,10 +392,19 @@ impl App {
                         return false;
                     }
                 } else if let Some(section) = selected_section {
-                    if let Some(section_category) = section.category() {
-                        let repo_category = scan::AppCategory::from_name(&repo.manifest.category);
-                        if &repo_category != section_category {
-                            return false;
+                    if !searching {
+                        if let Some(section_category) = section.category() {
+                            let repo_category =
+                                scan::AppCategory::from_name(&repo.manifest.category);
+                            if &repo_category != section_category {
+                                return false;
+                            }
+                        }
+                        // Platform sections filter the store half too.
+                        if let Some(platform) = section.required_platform() {
+                            if !repo.manifest.release_files.contains_key(platform) {
+                                return false;
+                            }
                         }
                     }
                 }
@@ -540,6 +592,7 @@ impl App {
             is_downloading: false,
             is_checking_updates: false,
             is_fetching_repos: false,
+            repos_refresh_manual: false,
             settings_expanded_sections: std::collections::HashSet::new(),
             detail_tab: DetailTab::ReadMe,
             detail_blocks: Vec::new(),
@@ -548,6 +601,7 @@ impl App {
             available_updates: std::collections::HashMap::new(),
             update_queue: Vec::new(),
             release_notes: std::collections::HashMap::new(),
+            release_facts: std::collections::HashMap::new(),
             fetching_notes: std::collections::HashSet::new(),
             install_status: std::collections::HashMap::new(),
             keyboard_cursor: None,
diff --git a/src/ui/app_grid.rs b/src/ui/app_grid.rs
index e22b9a6..78661e5 100644
--- a/src/ui/app_grid.rs
+++ b/src/ui/app_grid.rs
@@ -186,10 +186,27 @@ impl App {
             .cloned()
             .unwrap_or((false, None));
         if !installed {
-            return text(crate::i18n::t("status_get"))
+            // The grid's most prominent per-row signal used to say "Get" for
+            // every uninstalled app, including ones with no build for this
+            // platform - so the user clicked in expecting to install and hit
+            // the detail page's dead end. The card already knows better: it
+            // renders a chip per declared platform right next to it.
+            let available = repo
+                .manifest
+                .release_files
+                .contains_key(crate::github::current_platform_key());
+            let (label, color) = if available {
+                (crate::i18n::t("status_get"), Palette::ACCENT())
+            } else {
+                (
+                    crate::i18n::t("status_unavailable"),
+                    Palette::TEXT_DIMMEST(),
+                )
+            };
+            return text(label)
                 .size(self.sz(12))
                 .font(self.app_font())
-                .color(Palette::ACCENT())
+                .color(color)
                 .into();
         }
         let version = cached_version;
@@ -318,8 +335,15 @@ impl App {
             .id(crate::ui::tutorial::ID_SEARCH)
             .width(Fill);
 
-        // Show search result count when query is active
-        let status_text = if !self.search_query.is_empty() {
+        // Only the search result count lives here. `status_message` used to
+        // share this row, which had two problems: it was the ONLY render site
+        // for the status line (so uninstall, platform and release-notes errors
+        // were invisible on the detail, settings and GitHub pages), and a long
+        // raw transport error laid the Fill search input out at width zero.
+        // It now renders as a footer in `App::view`, on every page.
+        let status_text = if self.search_query.is_empty() {
+            String::new()
+        } else {
             let filtered_count =
                 self.filtered_applications().len() + self.filtered_colony_repos().len();
             crate::i18n::t_fmt(
@@ -329,8 +353,6 @@ impl App {
                     ("query", &self.search_query),
                 ],
             )
-        } else {
-            self.status_message.clone()
         };
 
         // Show spinner indicator for async operations
@@ -366,13 +388,15 @@ impl App {
             )
             .padding([8, 14])
             .style(|_theme, status| {
-                let bg = match status {
-                    button::Status::Hovered => Palette::BG_CARD_HOVER(),
-                    _ => Palette::BG_SELECTED(),
-                };
+                let (bg, text_color) = theme::button_colors(
+                    status,
+                    Palette::BG_SELECTED(),
+                    Palette::BG_CARD_HOVER(),
+                    Palette::ACCENT(),
+                );
                 button::Style {
                     background: Some(bg.into()),
-                    text_color: Palette::ACCENT(),
+                    text_color,
                     border: iced::Border::default().rounded(6),
                     ..Default::default()
                 }
@@ -438,25 +462,51 @@ impl App {
             } else {
                 crate::i18n::t("no_apps_found")
             };
-            return container(
-                column![
-                    text("\u{f002}")
-                        .size(self.sz(32))
-                        .font(self.app_font())
-                        .color(Palette::TEXT_DIMMEST()),
-                    container(text("")).height(12),
-                    text(empty_msg)
-                        .size(self.sz(16))
-                        .font(self.app_font())
-                        .color(Palette::TEXT_PLACEHOLDER()),
-                ]
-                .align_x(iced::Alignment::Center),
-            )
-            .width(Fill)
-            .height(Fill)
-            .center_x(Fill)
-            .center_y(Fill)
-            .into();
+            let mut empty = column![
+                text("\u{f002}")
+                    .size(self.sz(32))
+                    .font(self.app_font())
+                    .color(Palette::TEXT_DIMMEST()),
+                container(text("")).height(12),
+                text(empty_msg)
+                    .size(self.sz(16))
+                    .font(self.app_font())
+                    .color(Palette::TEXT_PLACEHOLDER()),
+            ]
+            .align_x(iced::Alignment::Center);
+
+            // An empty store with no search query means the catalog fetch never
+            // landed. Without a button here the only recovery was to sign in or
+            // restart Colony - on a page whose whole pitch is that browsing
+            // needs no account.
+            if self.search_query.is_empty() && self.colony_repo_list.is_empty() {
+                empty = empty.push(container(text("")).height(16)).push(
+                    button(
+                        text(crate::i18n::t("github_refresh"))
+                            .size(self.sz(13))
+                            .font(self.app_font()),
+                    )
+                    .on_press_maybe(
+                        (!self.is_fetching_repos).then_some(Message::GitHubRefreshRepos),
+                    )
+                    .padding([8, 16])
+                    .style(move |_theme, status| {
+                        crate::ui::theme::action_button_style(
+                            status,
+                            Palette::BTN_DEFAULT(),
+                            Palette::BTN_HOVER(),
+                            Palette::BTN_PRESSED(),
+                        )
+                    }),
+                );
+            }
+
+            return container(empty)
+                .width(Fill)
+                .height(Fill)
+                .center_x(Fill)
+                .center_y(Fill)
+                .into();
         }
 
         // Chunk cards into a grid whose column count adapts to the available
@@ -508,7 +558,7 @@ impl App {
         let tint = theme::app_tint(&repo.name);
         let tile = self.icon_tile(&repo.name, tint, category.glyph());
 
-        let name = text(&repo.name)
+        let name = text(repo.display_name())
             .size(self.sz(15))
             .font(self.app_font_with_weight(Weight::Medium))
             .color(Palette::TEXT_PRIMARY());
@@ -669,18 +719,13 @@ impl App {
         )
         .on_press(Message::LaunchApp(app.exec.clone()))
         .padding([8, 14])
-        .style(|_theme, status| {
-            let bg = match status {
-                button::Status::Hovered => Palette::BTN_SUCCESS_HOVER(),
-                button::Status::Pressed => Palette::BTN_SUCCESS_PRESSED(),
-                _ => Palette::BG_SELECTED(),
-            };
-            button::Style {
-                background: Some(bg.into()),
-                text_color: Palette::TEXT_PRIMARY(),
-                border: iced::Border::default().rounded(8),
-                ..Default::default()
-            }
+        .style(move |_theme, status| {
+            crate::ui::theme::action_button_style(
+                status,
+                Palette::BG_SELECTED(),
+                Palette::BTN_SUCCESS_HOVER(),
+                Palette::BTN_SUCCESS_PRESSED(),
+            )
         });
 
         let status = container(
diff --git a/src/ui/detail.rs b/src/ui/detail.rs
index 08866fc..370e254 100644
--- a/src/ui/detail.rs
+++ b/src/ui/detail.rs
@@ -56,7 +56,7 @@ impl App {
         .on_press(Message::ColonyRepoBack)
         .padding([8, 16]);
 
-        let title = text(&repo.name)
+        let title = text(repo.display_name())
             .size(self.sz(24))
             .font(self.app_font_with_weight(Weight::Bold))
             .color(Palette::TEXT_PRIMARY());
@@ -197,6 +197,54 @@ impl App {
                 .into(),
             );
         }
+        // What the store is OFFERING, next to what is installed: the three
+        // questions every app store answers on the product page and Colony
+        // could not. The tag comes from the manifest for free; size and date
+        // arrive with the release-notes fetch, so they appear once the user has
+        // asked for the notes rather than costing a request per card.
+        if let Some(entry) = repo
+            .manifest
+            .release_files
+            .get(github::current_platform_key())
+        {
+            let facts = self.release_facts.get(&repo.name);
+            let offered_tag = facts
+                .map(|f| f.tag.as_str())
+                .filter(|t| !t.is_empty())
+                .unwrap_or(entry.tag.as_str());
+            if !offered_tag.eq_ignore_ascii_case("latest") {
+                footer_items.push(
+                    text(crate::i18n::t_fmt(
+                        "offered_version",
+                        &[("version", offered_tag)],
+                    ))
+                    .size(self.sz(12))
+                    .font(self.app_font())
+                    .color(Palette::TEXT_DIM())
+                    .into(),
+                );
+            }
+            if let Some(size) = facts.and_then(|f| f.size) {
+                footer_items.push(
+                    text(crate::state::human_bytes(size))
+                        .size(self.sz(12))
+                        .font(self.app_font())
+                        .color(Palette::TEXT_DIM())
+                        .into(),
+                );
+            }
+            if let Some(date) = facts.and_then(|f| f.published_at.as_deref()) {
+                // ISO-8601 from the API; the date half is what a user reads.
+                let day = date.split('T').next().unwrap_or(date);
+                footer_items.push(
+                    text(day.to_string())
+                        .size(self.sz(12))
+                        .font(self.app_font())
+                        .color(Palette::TEXT_DIM())
+                        .into(),
+                );
+            }
+        }
         footer_items.push(container(text("")).width(Fill).into());
         for pt in platform_labels {
             footer_items.push(pt);
@@ -228,18 +276,13 @@ impl App {
                 Some(Message::LaunchColonyApp(app_path))
             })
             .padding([12, 24])
-            .style(|_theme, status| {
-                let bg = match status {
-                    button::Status::Hovered => Palette::BTN_SUCCESS_HOVER(),
-                    button::Status::Pressed => Palette::BTN_SUCCESS_PRESSED(),
-                    _ => Palette::BTN_SUCCESS(),
-                };
-                button::Style {
-                    background: Some(bg.into()),
-                    text_color: Palette::TEXT_PRIMARY(),
-                    border: iced::Border::default().rounded(8),
-                    ..Default::default()
-                }
+            .style(move |_theme, status| {
+                crate::ui::theme::action_button_style(
+                    status,
+                    Palette::BTN_SUCCESS(),
+                    Palette::BTN_SUCCESS_HOVER(),
+                    Palette::BTN_SUCCESS_PRESSED(),
+                )
             });
 
             let repo_name = repo.name.clone();
@@ -255,18 +298,13 @@ impl App {
                 Some(Message::DownloadRelease(repo_name, platform_key))
             })
             .padding([10, 20])
-            .style(|_theme, status| {
-                let bg = match status {
-                    button::Status::Hovered => Palette::BTN_HOVER(),
-                    button::Status::Pressed => Palette::BTN_PRESSED(),
-                    _ => Palette::BTN_DEFAULT(),
-                };
-                button::Style {
-                    background: Some(bg.into()),
-                    text_color: Palette::TEXT_PRIMARY(),
-                    border: iced::Border::default().rounded(8),
-                    ..Default::default()
-                }
+            .style(move |_theme, status| {
+                crate::ui::theme::action_button_style(
+                    status,
+                    Palette::BTN_DEFAULT(),
+                    Palette::BTN_HOVER(),
+                    Palette::BTN_PRESSED(),
+                )
             });
 
             // Uninstall now triggers confirmation dialog
@@ -277,25 +315,26 @@ impl App {
                     .font(self.app_font())
                     .center(),
             )
-            .on_press(Message::ConfirmUninstall(uninstall_repo_name))
+            // The only action here that was not gated on a running download.
+            // Uninstalling mid-install remove_dir_all's the directory the
+            // detached blocking install is still renaming into, and the install
+            // then fails with a bare ENOENT.
+            .on_press_maybe(
+                (!self.is_downloading).then_some(Message::ConfirmUninstall(uninstall_repo_name)),
+            )
             .padding(iced::Padding {
                 top: 10.0,
                 right: 14.0,
                 bottom: 10.0,
                 left: 12.0,
             })
-            .style(|_theme, status| {
-                let bg = match status {
-                    button::Status::Hovered => Palette::BTN_TRASH_HOVER(),
-                    button::Status::Pressed => Palette::BTN_TRASH_PRESSED(),
-                    _ => Palette::BTN_DEFAULT(),
-                };
-                button::Style {
-                    background: Some(bg.into()),
-                    text_color: Palette::TEXT_PRIMARY(),
-                    border: iced::Border::default().rounded(8),
-                    ..Default::default()
-                }
+            .style(move |_theme, status| {
+                crate::ui::theme::action_button_style(
+                    status,
+                    Palette::BTN_DEFAULT(),
+                    Palette::BTN_TRASH_HOVER(),
+                    Palette::BTN_TRASH_PRESSED(),
+                )
             });
 
             let spacer: Element<'_, Message> = container(text("")).width(Fill).into();
@@ -324,18 +363,13 @@ impl App {
                     Some(Message::DownloadRelease(repo_name, platform_key))
                 })
                 .padding([12, 24])
-                .style(|_theme, status| {
-                    let bg = match status {
-                        button::Status::Hovered => Palette::BTN_HOVER(),
-                        button::Status::Pressed => Palette::BTN_PRESSED(),
-                        _ => Palette::BTN_DEFAULT(),
-                    };
-                    button::Style {
-                        background: Some(bg.into()),
-                        text_color: Palette::TEXT_PRIMARY(),
-                        border: iced::Border::default().rounded(8),
-                        ..Default::default()
-                    }
+                .style(move |_theme, status| {
+                    crate::ui::theme::action_button_style(
+                        status,
+                        Palette::BTN_DEFAULT(),
+                        Palette::BTN_HOVER(),
+                        Palette::BTN_PRESSED(),
+                    )
                 });
                 Row::new()
                     .push(spacer)
@@ -343,7 +377,20 @@ impl App {
                     .spacing(12)
                     .align_y(iced::Alignment::Center)
             } else {
-                let no_release = text(crate::i18n::t("no_release_platform"))
+                // Two very different situations wore the same label. A manifest
+                // that declares platforms, none of them yours, genuinely has no
+                // build for you. A manifest that declares NONE at all means
+                // Colony could not match the repo's release assets to any
+                // convention - which is the app author's problem, not the
+                // user's, and reads as "Colony is broken" when it says only
+                // "not available for your platform". (Eidos is the live case:
+                // its assets are named eidos-1.12.0-x86_64-linux.tar.gz.)
+                let key = if repo.manifest.release_files.is_empty() {
+                    "no_release_unrecognized"
+                } else {
+                    "no_release_platform"
+                };
+                let no_release = text(crate::i18n::t(key))
                     .size(self.sz(12))
                     .font(self.app_font())
                     .color(Palette::TEXT_MUTED());
@@ -398,8 +445,23 @@ impl App {
         // "What's new" panel when an update is pending: the GitHub release
         // body, fetched on demand and rendered from pre-parsed blocks (zero
         // per-frame markdown parsing).
-        let whats_new: Element<'_, Message> =
-            if let Some(new_tag) = self.available_updates.get(&repo.name) {
+        //
+        // Gated on a PENDING UPDATE, this whole panel was unreachable for an app
+        // the user was evaluating, or for the version they already run - and
+        // `fetch_release_notes` already had a fallback to the manifest's pinned
+        // tag that nothing could ever call. The Changelog tab is not a
+        // substitute: it reads a cached CHANGELOG.md that many repos do not
+        // have. Now it renders for any repo that ships a release here, titled
+        // with the pending tag when there is one and the pinned tag otherwise.
+        let notes_tag: Option<String> =
+            self.available_updates.get(&repo.name).cloned().or_else(|| {
+                repo.manifest
+                    .release_files
+                    .get(current_platform)
+                    .map(|entry| entry.tag.clone())
+            });
+        let whats_new: Element<'_, Message> = if let Some(ref new_tag) = notes_tag {
+            {
                 match self.release_notes.get(&repo.name) {
                     Some((tag, blocks)) if tag == new_tag => {
                         let md_settings = markdown::Settings::with_text_size(
@@ -465,9 +527,10 @@ impl App {
                         container(btn).width(Fill).into()
                     }
                 }
-            } else {
-                container(text("")).into()
-            };
+            }
+        } else {
+            container(text("")).into()
+        };
 
         let detail = column![
             header,
diff --git a/src/ui/github_panel.rs b/src/ui/github_panel.rs
index 6e25d5a..8454a78 100644
--- a/src/ui/github_panel.rs
+++ b/src/ui/github_panel.rs
@@ -42,18 +42,13 @@ impl App {
                         },
                     )
                     .padding([12, 24])
-                    .style(|_theme, status| {
-                        let bg = match status {
-                            button::Status::Hovered => Palette::BTN_HOVER(),
-                            button::Status::Pressed => Palette::BTN_PRESSED(),
-                            _ => Palette::BTN_DEFAULT(),
-                        };
-                        button::Style {
-                            background: Some(bg.into()),
-                            text_color: Palette::TEXT_PRIMARY(),
-                            border: iced::Border::default().rounded(8),
-                            ..Default::default()
-                        }
+                    .style(move |_theme, status| {
+                        crate::ui::theme::action_button_style(
+                            status,
+                            Palette::BTN_DEFAULT(),
+                            Palette::BTN_HOVER(),
+                            Palette::BTN_PRESSED(),
+                        )
                     });
 
                 let info = text(crate::i18n::t("github_public_api"))
@@ -61,17 +56,43 @@ impl App {
                     .font(self.app_font())
                     .color(Palette::TEXT_MUTED());
 
+                // Browsing the catalog is anonymous, so a user whose boot fetch
+                // failed (flaky network, VPN, captive portal) is signed out by
+                // definition - and this arm used to offer sign-in as the only
+                // way forward. It is the same anonymous fetch the boot path
+                // already runs; no token, no sign-in required.
+                let retry_btn = button(
+                    text(crate::i18n::t("github_refresh"))
+                        .size(self.sz(13))
+                        .font(self.app_font()),
+                )
+                .on_press_maybe((!self.is_fetching_repos).then_some(Message::GitHubRefreshRepos))
+                .padding([8, 16])
+                .style(move |_theme, status| {
+                    crate::ui::theme::action_button_style(
+                        status,
+                        Palette::BTN_DEFAULT(),
+                        Palette::BTN_HOVER(),
+                        Palette::BTN_PRESSED(),
+                    )
+                });
+
                 column![
                     desc,
                     container(text("")).height(16),
                     login_btn,
                     container(text("")).height(12),
-                    info
+                    info,
+                    container(text("")).height(12),
+                    retry_btn
                 ]
                 .spacing(8)
                 .into()
             }
-            GitHubState::Connecting { user_code } => match user_code {
+            GitHubState::Connecting {
+                user_code,
+                verification_uri,
+            } => match user_code {
                 Some(code) => {
                     let spinner_label = text("\u{f110}  ")
                         .size(self.sz(14))
@@ -105,7 +126,28 @@ impl App {
                         .size(self.sz(12))
                         .font(self.app_font())
                         .color(Palette::TEXT_DIMMEST());
-                    column![spinner_label, label, code_btn, hint]
+
+                    // The browser open is best-effort; if it failed, this line
+                    // is the only thing telling the user where the code goes.
+                    let where_to: Element<'_, Message> = match verification_uri {
+                        Some(uri) => button(
+                            text(uri.as_str())
+                                .size(self.sz(12))
+                                .font(self.app_font())
+                                .color(Palette::ACCENT()),
+                        )
+                        .on_press(Message::OpenUrl(uri.clone()))
+                        .padding(0)
+                        .style(|_theme, _status| button::Style {
+                            background: None,
+                            text_color: Palette::ACCENT(),
+                            ..Default::default()
+                        })
+                        .into(),
+                        None => container(text("")).height(0).into(),
+                    };
+
+                    column![spinner_label, label, code_btn, where_to, hint]
                         .spacing(8)
                         .into()
                 }
@@ -194,13 +236,15 @@ impl App {
                     refresh_btn_base.on_press(Message::GitHubRefreshRepos)
                 }
                 .style(|_theme, status| {
-                    let bg = match status {
-                        button::Status::Hovered => Palette::BG_SELECTED(),
-                        _ => Palette::BG_CARD_HOVER(),
-                    };
+                    let (bg, text_color) = crate::ui::theme::button_colors(
+                        status,
+                        Palette::BG_CARD_HOVER(),
+                        Palette::BG_SELECTED(),
+                        Palette::TEXT_PRIMARY(),
+                    );
                     button::Style {
                         background: Some(bg.into()),
-                        text_color: Palette::TEXT_PRIMARY(),
+                        text_color,
                         border: iced::Border::default().rounded(6),
                         ..Default::default()
                     }
@@ -254,9 +298,24 @@ impl App {
                 .on_press(Message::GitHubLogin)
                 .padding([8, 16]);
 
-                column![err, container(text("")).height(12), retry_btn]
-                    .spacing(8)
-                    .into()
+                // Retrying the sign-in is not the only thing that can go wrong
+                // here; the catalog fetch can fail on its own, and refetching
+                // it needs no account at all.
+                let refresh_btn = button(
+                    text(crate::i18n::t("github_refresh"))
+                        .size(self.sz(13))
+                        .font(self.app_font()),
+                )
+                .on_press_maybe((!self.is_fetching_repos).then_some(Message::GitHubRefreshRepos))
+                .padding([8, 16]);
+
+                column![
+                    err,
+                    container(text("")).height(12),
+                    row![retry_btn, refresh_btn].spacing(8)
+                ]
+                .spacing(8)
+                .into()
             }
         };
 
diff --git a/src/ui/settings.rs b/src/ui/settings.rs
index 7f74883..45ceb82 100644
--- a/src/ui/settings.rs
+++ b/src/ui/settings.rs
@@ -696,13 +696,15 @@ impl App {
                 let btn = button(text(label).size(self.sz(13)).font(self.app_font()))
                     .padding([6, 14])
                     .style(|_theme, status| {
-                        let bg = match status {
-                            button::Status::Hovered => Palette::BG_CARD_HOVER(),
-                            _ => iced::Color::TRANSPARENT,
-                        };
+                        let (bg, text_color) = crate::ui::theme::button_colors(
+                            status,
+                            iced::Color::TRANSPARENT,
+                            Palette::BG_CARD_HOVER(),
+                            Palette::TEXT_DIM(),
+                        );
                         button::Style {
                             background: Some(bg.into()),
-                            text_color: Palette::TEXT_DIM(),
+                            text_color,
                             border: iced::Border::default().rounded(6),
                             ..Default::default()
                         }
diff --git a/src/ui/sidebar.rs b/src/ui/sidebar.rs
index 48fe99e..e39fa5d 100644
--- a/src/ui/sidebar.rs
+++ b/src/ui/sidebar.rs
@@ -132,8 +132,17 @@ impl App {
         let update_badge: Element<'_, Message> = if let Some(ref update_info) =
             self.launcher_update_available
         {
-            let (label, msg): (String, Message) =
-                if let Some(ref path) = self.launcher_update_staged {
+            // A package-managed install cannot apply the in-app update: the exe
+            // directory is not writable. Settings > About already replaces the
+            // button with guidance here; the sidebar used to keep offering a
+            // press that only ever produced a warning toast, with no dismiss,
+            // for the whole session.
+            if self.launcher_system_managed {
+                return_system_managed_badge(self, &update_info.0)
+            } else {
+                let (label, msg): (String, Message) = if let Some(ref path) =
+                    self.launcher_update_staged
+                {
                     (
                         crate::i18n::t("launcher_restart_to_update"),
                         Message::ApplyLauncherUpdate(path.clone()),
@@ -146,29 +155,32 @@ impl App {
                     )
                 };
 
-            let is_downloading = self.is_downloading;
-            button(
-                text(label)
-                    .size(self.sz(11))
-                    .font(self.app_font())
-                    .color(Palette::ACCENT()),
-            )
-            .on_press_maybe(if is_downloading { None } else { Some(msg) })
-            .padding([6, 12])
-            .width(Fill)
-            .style(|_theme, status| {
-                let bg = match status {
-                    button::Status::Hovered => Palette::BG_CARD_HOVER(),
-                    _ => Palette::BG_SELECTED(),
-                };
-                button::Style {
-                    background: Some(bg.into()),
-                    text_color: Palette::ACCENT(),
-                    border: iced::Border::default().rounded(6),
-                    ..Default::default()
-                }
-            })
-            .into()
+                let is_downloading = self.is_downloading;
+                button(
+                    text(label)
+                        .size(self.sz(11))
+                        .font(self.app_font())
+                        .color(Palette::ACCENT()),
+                )
+                .on_press_maybe(if is_downloading { None } else { Some(msg) })
+                .padding([6, 12])
+                .width(Fill)
+                .style(|_theme, status| {
+                    let (bg, text_color) = crate::ui::theme::button_colors(
+                        status,
+                        Palette::BG_SELECTED(),
+                        Palette::BG_CARD_HOVER(),
+                        Palette::ACCENT(),
+                    );
+                    button::Style {
+                        background: Some(bg.into()),
+                        text_color,
+                        border: iced::Border::default().rounded(6),
+                        ..Default::default()
+                    }
+                })
+                .into()
+            }
         } else {
             container(text("")).height(0).into()
         };
@@ -277,3 +289,20 @@ impl App {
         btn.into()
     }
 }
+
+/// The sidebar's update badge for an install Colony cannot update itself:
+/// informational text, not a button that is guaranteed to fail.
+fn return_system_managed_badge<'a>(app: &App, version: &str) -> Element<'a, Message> {
+    container(
+        text(crate::i18n::t_fmt(
+            "launcher_update_system_managed",
+            &[("version", version)],
+        ))
+        .size(app.sz(11))
+        .font(app.app_font())
+        .color(Palette::TEXT_DIMMER()),
+    )
+    .padding([6, 12])
+    .width(Fill)
+    .into()
+}
diff --git a/src/ui/theme.rs b/src/ui/theme.rs
index c2ddfeb..c512c81 100644
--- a/src/ui/theme.rs
+++ b/src/ui/theme.rs
@@ -25,6 +25,7 @@ pub struct ThemePalette {
 
     // --- Accent ---
     pub accent_blue: Color,
+    #[allow(dead_code)]
     pub accent_icon: Color,
     pub accent_progress: Color,
 
@@ -54,6 +55,7 @@ pub struct ThemePalette {
     pub btn_trash_pressed: Color,
 
     // --- Modal ---
+    #[allow(dead_code)]
     pub bg_modal_section: Color,
     pub border_subtle: Color,
     pub divider: Color,
@@ -256,7 +258,7 @@ pub fn active_palette() -> ThemePalette {
 
 pub struct Palette;
 
-#[allow(non_snake_case, dead_code)]
+#[allow(non_snake_case)]
 impl Palette {
     // Backgrounds
     pub fn BG_PRIMARY() -> Color {
@@ -312,6 +314,11 @@ impl Palette {
     pub fn ACCENT() -> Color {
         effective_accent()
     }
+    /// Part of the palette vocabulary every theme fills in, but not currently
+    /// read by any view. Kept rather than deleted from 50+ palette definitions
+    /// for a two-token saving; the narrow allow is what stops the blanket one
+    /// from hiding the next genuinely dead accessor.
+    #[allow(dead_code)]
     pub fn ACCENT_ICON() -> Color {
         active_palette().accent_icon
     }
@@ -379,6 +386,11 @@ impl Palette {
     }
 
     // Modal
+    /// Part of the palette vocabulary every theme fills in, but not currently
+    /// read by any view. Kept rather than deleted from 50+ palette definitions
+    /// for a two-token saving; the narrow allow is what stops the blanket one
+    /// from hiding the next genuinely dead accessor.
+    #[allow(dead_code)]
     pub fn BG_MODAL_SECTION() -> Color {
         active_palette().bg_modal_section
     }
@@ -2933,3 +2945,118 @@ impl ThemePalette {
         divider: hex(0x382F4C),
     };
 }
+
+/// Style an action button from its three base colours, with a real disabled
+/// state.
+///
+/// Every action button in the app was written as
+/// `match status { Hovered => .., Pressed => .., _ => normal }`, so
+/// `button::Status::Disabled` fell into the catch-all and a disabled button
+/// rendered byte-identically to an active one: during a download, Launch,
+/// Update, Download, Update All, Refresh and the update badge all looked
+/// clickable and did nothing. Routing them through one helper means the next
+/// button cannot regress the same way.
+pub fn action_button_style(
+    status: iced::widget::button::Status,
+    normal: iced::Color,
+    hover: iced::Color,
+    pressed: iced::Color,
+) -> iced::widget::button::Style {
+    use iced::widget::button::Status;
+    let (background, text_color) = match status {
+        Status::Hovered => (hover, Palette::TEXT_PRIMARY()),
+        Status::Pressed => (pressed, Palette::TEXT_PRIMARY()),
+        Status::Disabled => (
+            // Halfway to the page background reads as "not available now"
+            // without inventing a new palette entry per theme.
+            mix(normal, Palette::BG_PRIMARY(), 0.6),
+            Palette::TEXT_DIMMER(),
+        ),
+        Status::Active => (normal, Palette::TEXT_PRIMARY()),
+    };
+    iced::widget::button::Style {
+        background: Some(background.into()),
+        text_color,
+        border: iced::Border::default().rounded(8),
+        ..Default::default()
+    }
+}
+
+/// Background and text colour for a two-state (normal/hover) button, with the
+/// disabled case handled. Companion to [`action_button_style`] for the buttons
+/// that carry their own text colour rather than TEXT_PRIMARY.
+pub fn button_colors(
+    status: iced::widget::button::Status,
+    normal: iced::Color,
+    hover: iced::Color,
+    text: iced::Color,
+) -> (iced::Color, iced::Color) {
+    use iced::widget::button::Status;
+    match status {
+        Status::Hovered | Status::Pressed => (hover, text),
+        Status::Disabled => (
+            mix(normal, Palette::BG_PRIMARY(), 0.6),
+            mix(text, Palette::BG_PRIMARY(), 0.55),
+        ),
+        Status::Active => (normal, text),
+    }
+}
+
+/// Linear blend of two colours; `t` is how much of `b` to take.
+fn mix(a: iced::Color, b: iced::Color, t: f32) -> iced::Color {
+    let t = t.clamp(0.0, 1.0);
+    iced::Color {
+        r: a.r + (b.r - a.r) * t,
+        g: a.g + (b.g - a.g) * t,
+        b: a.b + (b.b - a.b) * t,
+        a: a.a + (b.a - a.a) * t,
+    }
+}
+
+#[cfg(test)]
+mod doc_parity_tests {
+    /// Five documents state the family and palette counts, and nothing kept
+    /// them true: they said 24 families when there were 25, and the Stellar
+    /// Blade family (five variants) was missing from the README's table
+    /// altogether. Adding a palette should fail here, not go unnoticed.
+    #[test]
+    fn the_documented_theme_counts_match_the_code() {
+        const SRC: &str = include_str!("theme.rs");
+        let body = SRC
+            .split_once("pub fn set_active_theme")
+            .expect("dispatch exists")
+            .1;
+        let body = body.split_once("\n}").expect("dispatch closes").0;
+
+        let mut families = std::collections::BTreeSet::new();
+        let mut palettes = 0usize;
+        for line in body.lines() {
+            let line = line.trim();
+            // `("family", "variant") => ThemePalette::X,`
+            let Some(rest) = line.strip_prefix("(\"") else {
+                continue;
+            };
+            if !line.contains("=> ThemePalette::") {
+                continue;
+            }
+            let Some(family) = rest.split('"').next() else {
+                continue;
+            };
+            families.insert(family.to_string());
+            palettes += 1;
+        }
+
+        assert_eq!(
+            families.len(),
+            25,
+            "the docs say 25 theme families; found {} ({families:?}). Update README.md \
+             (including its table of family names), docs/faq.md, docs/tutorial.md, \
+             docs/architecture.md and CONTRIBUTING.md.",
+            families.len()
+        );
+        assert_eq!(
+            palettes, 57,
+            "the docs say 57 palettes; found {palettes}. Update the same five documents."
+        );
+    }
+}
diff --git a/src/update/github_auth.rs b/src/update/github_auth.rs
index 0d38307..66d9830 100644
--- a/src/update/github_auth.rs
+++ b/src/update/github_auth.rs
@@ -15,7 +15,10 @@ impl App {
     }
 
     pub(super) fn github_login(&mut self) -> Task<Message> {
-        self.github_state = GitHubState::Connecting { user_code: None };
+        self.github_state = GitHubState::Connecting {
+            user_code: None,
+            verification_uri: None,
+        };
         Task::perform(
             async {
                 oauth::request_device_code()
@@ -34,6 +37,7 @@ impl App {
             Ok(device) => {
                 self.github_state = GitHubState::Connecting {
                     user_code: Some(device.user_code.clone()),
+                    verification_uri: Some(device.verification_uri.clone()),
                 };
                 Task::perform(
                     async move {
@@ -97,17 +101,40 @@ impl App {
     }
 
     pub(super) fn github_logout(&mut self) -> Task<Message> {
-        let _ = oauth::delete_saved_token();
+        let outcome = oauth::delete_saved_token();
+        // The in-memory session is gone either way, so the state change stands.
+        // But if the STORED credential survived, saying "Disconnected" and
+        // nothing else is a lie the user discovers at the next launch, when the
+        // session comes back. Say so, and say what to do about it.
         self.github_state = GitHubState::Disconnected;
         self.status_message = i18n::t("github_disconnected");
-        Task::none()
+        match outcome {
+            Ok(()) => Task::none(),
+            Err(e) => {
+                let msg = i18n::t_fmt("logout_incomplete", &[("error", &e.to_string())]);
+                self.status_message = msg.clone();
+                self.push_notification(msg, NotificationLevel::Error)
+            }
+        }
     }
 
     pub(super) fn github_repos_fetched(
         &mut self,
         repos: Vec<crate::github::ColonyRepo>,
     ) -> Task<Message> {
+        self.repos_refresh_manual = false;
         self.is_fetching_repos = false;
+        // The listing arrives sorted by GitHub push order, so the store
+        // reshuffled between sessions for reasons invisible to the user - a
+        // README typo fix jumped a repo to the top, and muscle memory for "the
+        // third card down" never formed. Local apps were already sorted.
+        let mut repos = repos;
+        repos.sort_by_key(|r| r.display_name().to_lowercase());
+        let repos = repos;
+        // The catalog refresh is where the conditional-request cache is at its
+        // most complete: persisting it here means the next launch replays those
+        // ETags as 304s, which GitHub does not bill.
+        crate::github::save_http_cache();
         let count = repos.len();
         if let Err(e) = crate::persistence::save_repos_cache(&repos) {
             tracing::warn!("Failed to save repos cache: {e}");
@@ -140,6 +167,7 @@ impl App {
 
     pub(super) fn github_error(&mut self, e: String) -> Task<Message> {
         self.is_fetching_repos = false;
+        let was_manual = std::mem::take(&mut self.repos_refresh_manual);
         tracing::error!(error = %e, "GitHub error");
         if self.colony_repo_list.is_empty() {
             if let Some(cached) = crate::persistence::load_repos_cache() {
@@ -150,16 +178,17 @@ impl App {
         // Offline fallback repos may have cached icons on disk.
         self.reload_app_icons();
         self.status_message = i18n::t_fmt("github_api_error", &[("error", &e)]);
-        if self.colony_repo_list.is_empty() {
+        if self.colony_repo_list.is_empty() || was_manual {
+            // The anti-noise rule holds for the BOOT path only: a toast on
+            // every offline start, with a cached catalog already on screen,
+            // would be pure noise. A refresh the user just clicked is the
+            // opposite case - without feedback the button reads as broken,
+            // since the repo count does not move either.
             self.push_notification(
                 i18n::t_fmt("github_api_error", &[("error", &e)]),
                 NotificationLevel::Error,
             )
         } else {
-            // The catalog is showing (cached or previously fetched): a
-            // toast on every offline boot would be pure noise - the
-            // status line already carries the error. Only an EMPTY
-            // catalog warrants interrupting the user.
             Task::none()
         }
     }
@@ -168,6 +197,7 @@ impl App {
         if self.is_fetching_repos {
             return Task::none();
         }
+        self.repos_refresh_manual = true;
         self.is_fetching_repos = true;
         // Anonymous refresh is supported: the token only raises the
         // rate limit (60 req/h unauthenticated vs 5000 signed-in).
diff --git a/src/update/launcher.rs b/src/update/launcher.rs
index 25e9da5..b4a5e45 100644
--- a/src/update/launcher.rs
+++ b/src/update/launcher.rs
@@ -184,8 +184,29 @@ impl App {
             |result: Result<std::path::PathBuf, String>| match result {
                 Ok(exe_path) => {
                     tracing::info!("Launching updated Colony: {}", exe_path.display());
-                    let _ = std::process::Command::new(&exe_path).spawn();
-                    std::process::exit(0);
+                    // Exit only if the replacement actually started. The swap is
+                    // already committed by this point, so discarding the spawn
+                    // result and exiting regardless meant that a binary which
+                    // will not exec - wrong arch, missing runtime library,
+                    // noexec mount, antivirus quarantine - made Colony vanish
+                    // from the screen for good, with no window, no toast and no
+                    // way for the user to know that a `.old` backup exists.
+                    match std::process::Command::new(&exe_path).spawn() {
+                        Ok(_) => std::process::exit(0),
+                        Err(e) => {
+                            tracing::error!("updated Colony failed to start: {e}");
+                            Message::LauncherDownloadCompleted(Err(i18n::t_fmt(
+                                "launcher_relaunch_failed",
+                                &[
+                                    ("error", &e.to_string()),
+                                    (
+                                        "backup",
+                                        &exe_path.with_extension("old").display().to_string(),
+                                    ),
+                                ],
+                            )))
+                        }
+                    }
                 }
                 Err(e) => Message::LauncherDownloadCompleted(Err(e)),
             },
diff --git a/src/update/mod.rs b/src/update/mod.rs
index d5bf0b0..e3ac5d8 100644
--- a/src/update/mod.rs
+++ b/src/update/mod.rs
@@ -36,17 +36,26 @@ impl App {
         let timeout = level.timeout();
         self.notifications
             .push(Notification::new(id, message, level));
-        // When reduce_motion or animations off, don't auto-dismiss (user must click)
-        if self.reduce_motion || !self.animations {
-            Task::none()
-        } else {
-            Task::perform(
-                async move {
-                    tokio::time::sleep(timeout).await;
-                },
-                |_| Message::TickNotifications,
-            )
+        // The overlay column is anchored to the bottom and grows upward, so an
+        // unbounded stack pushes the OLDEST toasts off the top of the window -
+        // where they can never be clicked, and a toast is only dismissed by
+        // clicking it. Cap it so the overlay can never exceed the window.
+        const MAX_TOASTS: usize = 5;
+        while self.notifications.len() > MAX_TOASTS {
+            self.notifications.remove(0);
         }
+        // Always arm the expiry timer. Gating it on animations meant that with
+        // reduce-motion (or animations off) nothing ever sent TickNotifications,
+        // so the `retain(!is_expired)` branch below was unreachable and toasts
+        // were permanent - the accessibility settings were the ones that
+        // silted the UI up. The animation gate belongs on the FADE, not on the
+        // expiry, and it is already applied there.
+        Task::perform(
+            async move {
+                tokio::time::sleep(timeout).await;
+            },
+            |_| Message::TickNotifications,
+        )
     }
 
     /// Decode any cached app icons that aren't yet in memory into image handles,
@@ -137,6 +146,19 @@ impl App {
         self.detail_md_source = Some(key);
     }
 
+    /// Persist the settings this `App` owns.
+    ///
+    /// Written as an EXHAUSTIVE struct literal with no `..` on purpose: every
+    /// field of `UserPreferences` now corresponds to a field of `App`, so the
+    /// compiler refuses to build if a new preference is added and not saved
+    /// here. That is the guard that was missing - `auto_accent` had a working
+    /// toggle, applied at boot, that was simply never written, and it compiled
+    /// clean. `..Default::default()` or `..load_preferences()` would hide
+    /// exactly that mistake again.
+    ///
+    /// The three keys that used to be hardwired to `None` here
+    /// (`close_behavior`, `update_channel`, `auto_install_updates`) were read
+    /// by nothing and are gone.
     pub fn save_preferences(&self) {
         let prefs = crate::persistence::UserPreferences {
             selected_section: Some(self.selected_section),
@@ -146,14 +168,12 @@ impl App {
             selected_theme: Some(self.selected_theme.clone()),
             selected_variant: Some(self.selected_variant.clone()),
             selected_accent: Some(self.selected_accent.clone()),
+            auto_accent: Some(self.auto_accent),
             // General
             restore_session: Some(self.restore_session),
             default_view: Some(self.default_view.clone()),
-            close_behavior: None,
             language: Some(self.language.clone()),
             auto_check_updates: Some(self.auto_check_updates),
-            update_channel: None,
-            auto_install_updates: None,
             // Appearance
             font_size: Some(self.font_size.clone()),
             animations: Some(self.animations),
@@ -678,6 +698,233 @@ mod tests {
         assert_eq!(app.notifications.len(), 1);
     }
 
+    /// Two of the eight published manifests deliberately set a display name
+    /// that differs from the repo slug, and Colony threw it away everywhere the
+    /// user looks - so a card titled "Lilypad-Vault" carried a button reading
+    /// "Launch Lilypad".
+    /// Typing "firefox" in the default view reported zero results on a machine
+    /// where Firefox was two clicks away: the shipped "All" section filters to
+    /// `origin: colony`, and scanned apps are never AppOrigin::Colony.
+    /// The toggle worked and was applied at boot; it was simply never written,
+    /// so it reset on every restart and nothing caught it because the save
+    /// rebuilt the struct field by field.
+    #[test]
+    fn every_app_preference_survives_a_save_and_load_round_trip() {
+        let mut app = App::new_for_test();
+        app.auto_accent = true;
+        app.high_contrast = true;
+        app.reduce_motion = true;
+        app.selected_accent = "amber".into();
+
+        // Go through the same struct save_preferences builds, without touching
+        // the real config dir (that path is covered by the linux-gated test).
+        let prefs = crate::persistence::UserPreferences {
+            selected_section: Some(app.selected_section),
+            window_width: Some(app.window_size.0),
+            window_height: Some(app.window_size.1),
+            first_launch_done: Some(!app.show_first_launch),
+            selected_theme: Some(app.selected_theme.clone()),
+            selected_variant: Some(app.selected_variant.clone()),
+            selected_accent: Some(app.selected_accent.clone()),
+            auto_accent: Some(app.auto_accent),
+            restore_session: Some(app.restore_session),
+            default_view: Some(app.default_view.clone()),
+            language: Some(app.language.clone()),
+            auto_check_updates: Some(app.auto_check_updates),
+            font_size: Some(app.font_size.clone()),
+            animations: Some(app.animations),
+            high_contrast: Some(app.high_contrast),
+            text_size_a11y: Some(app.text_size_a11y.clone()),
+            reduce_motion: Some(app.reduce_motion),
+            keyboard_nav: Some(app.keyboard_nav),
+            dyslexia_font: Some(app.dyslexia_font),
+            scan_on_startup: Some(app.scan_on_startup),
+        };
+        let json = serde_json::to_string(&prefs).expect("serializes");
+        let back: crate::persistence::UserPreferences =
+            serde_json::from_str(&json).expect("round-trips");
+
+        assert_eq!(back.auto_accent, Some(true), "the field that was lost");
+        assert_eq!(back.selected_accent.as_deref(), Some("amber"));
+        assert_eq!(back.high_contrast, Some(true));
+        assert_eq!(back.reduce_motion, Some(true));
+
+        // Every field carries a value: a None here would mean save_preferences
+        // is dropping something on the floor.
+        let value: serde_json::Value = serde_json::from_str(&json).expect("object");
+        for (key, v) in value.as_object().expect("object") {
+            assert!(!v.is_null(), "preference {key} is written as null");
+        }
+    }
+
+    #[test]
+    fn search_reaches_local_apps_the_section_filter_would_hide() {
+        let mut app = App::new_for_test();
+        app.sections = crate::sections::load_sections();
+        app.selected_section = 0; // "All", origin: colony
+        app.applications = vec![scan::Application {
+            name: "Firefox".into(),
+            exec: "firefox".into(),
+            icon: None,
+            category: scan::AppCategory::Network,
+            origin: scan::AppOrigin::External,
+        }];
+
+        // Browsing the section still hides it - that is what the filter is for.
+        assert!(app.filtered_applications().is_empty());
+
+        // Searching for it must not.
+        app.search_query = "firefox".into();
+        assert_eq!(
+            app.filtered_applications().len(),
+            1,
+            "a search that reports zero results for an installed app is worse than no search"
+        );
+
+        // And a search that matches nothing still matches nothing.
+        app.search_query = "definitely-not-installed".into();
+        assert!(app.filtered_applications().is_empty());
+    }
+
+    /// The .desktop integration exists so store apps land correctly in
+    /// GNOME/KDE/rofi; filing a music player and two games under Utility
+    /// defeats the categorisation the manifest already carries.
+    #[test]
+    fn desktop_categories_follow_the_manifest() {
+        use scan::AppCategory as C;
+        assert_eq!(C::Multimedia.desktop_categories(), "AudioVideo;");
+        assert_eq!(C::Game.desktop_categories(), "Game;");
+        assert_eq!(C::Network.desktop_categories(), "Network;");
+        // Security is not a freedesktop MAIN category, so it must be paired
+        // with one or the entry is invalid.
+        assert_eq!(C::Security.desktop_categories(), "Utility;Security;");
+        for c in [
+            C::Development,
+            C::Graphics,
+            C::Network,
+            C::Office,
+            C::Multimedia,
+            C::System,
+            C::Utility,
+            C::Security,
+            C::Game,
+            C::Other,
+        ] {
+            let v = c.desktop_categories();
+            assert!(v.ends_with(';'), "{v:?} must be ;-terminated per the spec");
+        }
+    }
+
+    #[test]
+    fn the_manifest_display_name_wins_but_never_becomes_the_identity() {
+        let mut declared = repo("Lilypad-Vault", "");
+        declared.manifest.name = "Lilypad".to_string();
+        assert_eq!(declared.display_name(), "Lilypad");
+        assert_eq!(
+            declared.name, "Lilypad-Vault",
+            "the slug stays the identity key for install paths and caches"
+        );
+
+        // A manifest with no usable name falls back to the slug rather than
+        // rendering an empty card title.
+        let mut blank = repo("Grape", "");
+        blank.manifest.name = "   ".to_string();
+        assert_eq!(blank.display_name(), "Grape");
+    }
+
+    #[test]
+    fn the_toast_stack_is_capped_even_with_animations_off() {
+        let mut app = App::new_for_test();
+        // The accessibility settings were the ones that silted the UI up: with
+        // no animation tick, nothing ever expired the toasts, and the overlay
+        // grows upward from the bottom so the oldest scrolled out of clicking
+        // range and could never be dismissed at all.
+        app.animations = false;
+        app.reduce_motion = true;
+        for i in 0..12 {
+            let _ = app.push_notification(format!("toast {i}"), NotificationLevel::Info);
+        }
+        assert!(
+            app.notifications.len() <= 5,
+            "the overlay must never outgrow the window, got {}",
+            app.notifications.len()
+        );
+        assert_eq!(
+            app.notifications.last().map(|n| n.message.as_str()),
+            Some("toast 11"),
+            "the newest toast is the one that must survive the cap"
+        );
+    }
+
+    #[test]
+    fn a_repo_that_left_the_catalog_skips_forward_instead_of_stranding_the_queue() {
+        let mut app = App::new_for_test();
+        // "Gone" was queued by Update All, then a catalog refresh dropped it.
+        app.colony_repo_list = vec![repo("Still", "")];
+        app.update_queue = vec!["Next".to_string()];
+
+        let _ = app.update(Message::DownloadRelease(
+            "Gone".to_string(),
+            github::current_platform_key().to_string(),
+        ));
+
+        assert!(
+            app.update_queue.is_empty(),
+            "the skipped repo must hand the queue on, not park it for the next unrelated install"
+        );
+        assert_eq!(
+            app.notifications.len(),
+            1,
+            "the user must be told which app was skipped"
+        );
+    }
+
+    #[test]
+    fn app_check_failure_never_clears_a_badge_or_claims_up_to_date() {
+        let mut app = App::new_for_test();
+        app.is_checking_updates = true;
+        app.available_updates
+            .insert("Grape".to_string(), "v2.0.0".to_string());
+        app.available_updates
+            .insert("Spotter".to_string(), "v3.0.0".to_string());
+
+        // Grape's check could not run; Spotter's ran and came back current.
+        let _ = app.update(Message::UpdatesChecked(vec![
+            ("Grape".to_string(), Err("rate limited".to_string())),
+            ("Spotter".to_string(), Ok(None)),
+        ]));
+
+        assert!(!app.is_checking_updates);
+        assert_eq!(
+            app.available_updates.get("Grape").map(String::as_str),
+            Some("v2.0.0"),
+            "a check that did not run must leave the existing badge alone"
+        );
+        assert!(
+            !app.available_updates.contains_key("Spotter"),
+            "a check that DID run and found nothing must clear its badge"
+        );
+        assert!(
+            !app.status_message.contains("applications found"),
+            "the all-clear line must not be written when a check failed, got: {}",
+            app.status_message
+        );
+        assert_eq!(
+            app.notifications.len(),
+            1,
+            "the user must be told the check was incomplete"
+        );
+
+        // Every check succeeding and finding nothing IS the all-clear.
+        app.notifications.clear();
+        let _ = app.update(Message::UpdatesChecked(vec![(
+            "Grape".to_string(),
+            Ok(None),
+        )]));
+        assert!(app.available_updates.is_empty());
+        assert!(app.notifications.is_empty());
+    }
+
     #[test]
     fn window_resize_bumps_generation_and_stale_saves_are_ignored() {
         let mut app = App::new_for_test();
diff --git a/src/update/store.rs b/src/update/store.rs
index 9ef0ddd..f66c99b 100644
--- a/src/update/store.rs
+++ b/src/update/store.rs
@@ -31,6 +31,10 @@ impl App {
                 // that rule lives next to the check it feeds.
                 let require_signature = repo.manifest.signed;
                 let repo_name = repo.name.clone();
+                // The app's menu name, distinct from `display_name` below,
+                // which is the FILE being downloaded (shown in the toast).
+                let app_display_name = repo.display_name().to_string();
+                let app_category = crate::scan::AppCategory::from_name(&repo.manifest.category);
                 // API calls (release resolution) use the token for
                 // rate limits; the asset download itself is a public
                 // endpoint and gets NO token - no reason to present
@@ -85,6 +89,8 @@ impl App {
                             None,
                             crate::download::AssetInstall {
                                 repo_name: repo_name.clone(),
+                                display_name: app_display_name,
+                                category: app_category,
                                 tag: resolved_tag.clone(),
                                 filename: resolved_file.clone(),
                                 binary_name: binary,
@@ -117,7 +123,18 @@ impl App {
                 self.status_message = i18n::t_fmt("no_release_for", &[("platform", &platform_key)]);
             }
         }
-        Task::none()
+
+        // We got here without starting a download: either the repo vanished
+        // from the catalog (a refresh can land mid-queue and replaces it
+        // wholesale) or it ships nothing for this platform. Say so, and keep
+        // the "Update all" chain moving - the queue is otherwise only advanced
+        // by a completion, so it would sit parked until some later, unrelated
+        // install silently drained it.
+        let skipped = i18n::t_fmt("update_skipped", &[("name", &repo_name)]);
+        Task::batch([
+            self.push_notification(skipped, NotificationLevel::Warning),
+            self.dispatch_next_queued_update(),
+        ])
     }
 
     pub(super) fn download_progress(
@@ -210,14 +227,16 @@ impl App {
         if let Some(handle) = self.download_abort.take() {
             handle.abort();
         }
-        // The aborted task cannot clean up its staging file: sweep
-        // the cancelled repo's *.part leftovers here.
+        // The aborted task cannot clean up its staging file: sweep the
+        // cancelled repo's leftovers here, including the `.part.id` sidecar
+        // that would otherwise invite a resume of a transfer the user stopped
+        // on purpose.
         if let Some(repo) = self.downloading_repo.take() {
             if let Ok(app_dir) = crate::persistence::colony_app_dir(&repo) {
                 if let Ok(entries) = std::fs::read_dir(&app_dir) {
                     for entry in entries.flatten() {
                         let name = entry.file_name().to_string_lossy().to_string();
-                        if name.ends_with(".part") {
+                        if name.ends_with(".part") || name.ends_with(".part.id") {
                             let _ = std::fs::remove_file(entry.path());
                         }
                     }
@@ -229,6 +248,11 @@ impl App {
         self.download_speed = 0.0;
         self.last_progress_sample = None;
         self.is_downloading = false;
+        // The install itself runs in a DETACHED blocking task that runs to
+        // completion, so a cancel landing after the rename and marker writes
+        // leaves the app genuinely installed while install_status - the only
+        // source the grid and detail views read - still says otherwise.
+        self.refresh_install_status();
         self.status_message = i18n::t("download_cancelled");
         self.push_notification(i18n::t("download_cancelled"), NotificationLevel::Warning)
     }
@@ -271,6 +295,33 @@ impl App {
 
     pub(super) fn uninstall_colony_app(&mut self, repo_name: String) -> Task<Message> {
         self.confirm_uninstall = None;
+
+        let app_dir = match crate::persistence::colony_app_dir(&repo_name) {
+            Ok(dir) => dir,
+            Err(e) => {
+                let msg = i18n::t_fmt("scan_error", &[("error", &e.to_string())]);
+                self.status_message = msg.clone();
+                return self.push_notification(msg, NotificationLevel::Error);
+            }
+        };
+
+        // Do the thing that can FAIL first. The teardown used to run in the
+        // opposite order - drop the update badge, drop the release notes, delete
+        // the desktop entry, and only then try the removal - so a directory that
+        // could not be deleted (a running binary on Windows, a busy or read-only
+        // path on Unix) left the app on disk with its integration already ripped
+        // out, and nothing said so.
+        if app_dir.exists() {
+            if let Err(e) = crate::persistence::remove_app_dir(&app_dir) {
+                let msg = i18n::t_fmt("uninstall_error", &[("error", &e.to_string())]);
+                self.status_message = msg.clone();
+                // The card must reflect what is actually on disk either way.
+                self.refresh_install_status();
+                return self.push_notification(msg, NotificationLevel::Error);
+            }
+        }
+
+        // Committed: now the state that cannot be undone.
         // An uninstalled app has no meaningful "update available".
         self.available_updates.remove(&repo_name);
         // Stale notes describe the version that was just removed.
@@ -279,35 +330,24 @@ impl App {
         // cleanup happens on catalog refresh instead.)
         self.release_notes.remove(&repo_name);
         crate::persistence::remove_desktop_entry(&repo_name);
-        match crate::persistence::colony_app_dir(&repo_name) {
-            Ok(app_dir) => {
-                if app_dir.exists() {
-                    if let Err(e) = std::fs::remove_dir_all(&app_dir) {
-                        self.status_message =
-                            i18n::t_fmt("uninstall_error", &[("error", &e.to_string())]);
-                    } else {
-                        self.status_message = i18n::t_fmt("uninstalled", &[("name", &repo_name)]);
-                        // AFTER the directory removal, so the cache
-                        // records the app as gone.
-                        self.refresh_install_status();
-                        return Task::perform(
-                            async {
-                                tokio::time::sleep(Duration::from_secs(4)).await;
-                            },
-                            |_| Message::ClearStatus,
-                        );
-                    }
-                }
-            }
-            Err(e) => {
-                self.status_message = i18n::t_fmt("scan_error", &[("error", &e.to_string())]);
-            }
-        }
-        Task::none()
+        // AFTER the directory removal, so the cache records the app as gone.
+        self.refresh_install_status();
+        // Removing something already absent is a success, not a silent skip:
+        // the confirm dialog used to just close with no message at all.
+        self.status_message = i18n::t_fmt("uninstalled", &[("name", &repo_name)]);
+        Task::perform(
+            async {
+                tokio::time::sleep(Duration::from_secs(4)).await;
+            },
+            |_| Message::ClearStatus,
+        )
     }
 
     pub(super) fn clear_store_caches(&mut self) -> Task<Message> {
         let removed = crate::persistence::clear_store_caches();
+        // Including the remembered 404s: a user who clears caches because a
+        // repo just added a CHANGELOG should not wait out the negative TTL.
+        crate::github::clear_http_cache();
         self.app_icons.clear();
         self.release_notes.clear();
         self.detail_md_source = None;
@@ -357,7 +397,16 @@ impl App {
             async move {
                 let client = match github::build_update_client(token.as_deref()) {
                     Ok(c) => c,
-                    Err(_) => return Vec::new(),
+                    Err(e) => {
+                        // The check did not run for ANY repo. Report that per
+                        // repo rather than returning an empty list, which the
+                        // handler would read as "everything is current".
+                        let e = e.to_string();
+                        return repos
+                            .into_iter()
+                            .map(|(name, _)| (name, Err(e.clone())))
+                            .collect();
+                    }
                 };
                 let futs: Vec<_> = repos
                     .iter()
@@ -366,17 +415,14 @@ impl App {
                         let n = name.clone();
                         let t = tag.clone();
                         async move {
-                            github::check_update_available(&c, &n, &t)
+                            let outcome = github::check_update_available(&c, &n, &t)
                                 .await
-                                .map(|v| (n, v))
+                                .map_err(|e| e.to_string());
+                            (n, outcome)
                         }
                     })
                     .collect();
-                futures::future::join_all(futs)
-                    .await
-                    .into_iter()
-                    .flatten()
-                    .collect()
+                futures::future::join_all(futs).await
             },
             Message::UpdatesChecked,
         )
@@ -423,6 +469,14 @@ impl App {
         let Some(tag) = tag else {
             return Task::none();
         };
+        // What this platform would actually download, when the manifest names
+        // it outright (the filePattern case is resolved at install time).
+        let asset_hint = self
+            .colony_repos()
+            .iter()
+            .find(|r| r.name == repo_name)
+            .and_then(|r| r.manifest.release_files.get(platform))
+            .and_then(|e| e.file.clone());
         self.fetching_notes.insert(repo_name.clone());
         let token = self.github_token();
         let repo_for_result = repo_name.clone();
@@ -433,9 +487,26 @@ impl App {
                 let info = github::fetch_release_info(&client, &repo_name, &tag)
                     .await
                     .map_err(|e| e.to_string())?;
-                Ok((info.tag, info.body.unwrap_or_default()))
+                // The size of the asset THIS platform would download - not the
+                // release total, which would be four binaries.
+                let size = asset_hint
+                    .as_deref()
+                    .and_then(|name| info.asset_sizes.get(name).copied())
+                    .or_else(|| {
+                        // filePattern, or no declared filename: fall back to the
+                        // single asset if the release has exactly one.
+                        (info.asset_sizes.len() == 1)
+                            .then(|| info.asset_sizes.values().copied().next())
+                            .flatten()
+                    });
+                let facts = crate::state::ReleaseFacts {
+                    tag: info.tag,
+                    size,
+                    published_at: info.published_at,
+                };
+                Ok((facts, info.body.unwrap_or_default()))
             },
-            move |result: Result<(String, String), String>| {
+            move |result: Result<(crate::state::ReleaseFacts, String), String>| {
                 Message::ReleaseNotesFetched(repo_for_result, result)
             },
         )
@@ -444,13 +515,15 @@ impl App {
     pub(super) fn release_notes_fetched(
         &mut self,
         repo_name: String,
-        result: Result<(String, String), String>,
+        result: Result<(crate::state::ReleaseFacts, String), String>,
     ) -> Task<Message> {
         self.fetching_notes.remove(&repo_name);
         match result {
-            Ok((tag, body)) => {
+            Ok((facts, body)) => {
                 let blocks = markdown_blocks::parse(&body);
-                self.release_notes.insert(repo_name, (tag, blocks));
+                self.release_notes
+                    .insert(repo_name.clone(), (facts.tag.clone(), blocks));
+                self.release_facts.insert(repo_name, facts);
             }
             Err(e) => {
                 // Non-blocking feature: a failed fetch surfaces in the
@@ -461,24 +534,52 @@ impl App {
         Task::none()
     }
 
-    pub(super) fn updates_checked(&mut self, updates: Vec<(String, String)>) -> Task<Message> {
+    pub(super) fn updates_checked(
+        &mut self,
+        outcomes: Vec<(String, Result<Option<String>, String>)>,
+    ) -> Task<Message> {
         self.is_checking_updates = false;
-        // Record which apps have a pending update so the grid cards can
-        // show an update badge (not just a transient toast).
-        self.available_updates = updates.iter().cloned().collect();
-        let notif_task = if updates.is_empty() {
+
+        // Merge, never replace: a repo whose check could not run keeps the
+        // badge it already had. Replacing the whole map meant that going
+        // offline (or simply hitting the anonymous rate limit on a second
+        // launch) cleared every badge and told the user they were current.
+        let mut failed = 0usize;
+        let mut fresh: Vec<String> = Vec::new();
+        for (name, outcome) in &outcomes {
+            match outcome {
+                Ok(Some(tag)) => {
+                    self.available_updates.insert(name.clone(), tag.clone());
+                    fresh.push(name.clone());
+                }
+                Ok(None) => {
+                    self.available_updates.remove(name);
+                }
+                Err(e) => {
+                    failed += 1;
+                    tracing::warn!("Update check failed for {name}: {e}");
+                }
+            }
+        }
+
+        let notif_task = if failed > 0 {
+            // Never write the all-clear line when part of the check did not
+            // run - say so, and say how many apps we could not speak for.
+            let msg = i18n::t_fmt("update_check_failed", &[("count", &failed.to_string())]);
+            self.status_message = msg.clone();
+            self.push_notification(msg, NotificationLevel::Warning)
+        } else if fresh.is_empty() {
             self.status_message = i18n::t_fmt(
                 "apps_found",
                 &[("count", &self.applications.len().to_string())],
             );
             Task::none()
         } else {
-            let names: Vec<&str> = updates.iter().map(|(n, _)| n.as_str()).collect();
             let msg = i18n::t_fmt(
                 "updates_available",
                 &[
-                    ("count", &updates.len().to_string()),
-                    ("names", &names.join(", ")),
+                    ("count", &fresh.len().to_string()),
+                    ("names", &fresh.join(", ")),
                 ],
             );
             self.push_notification(msg, NotificationLevel::Info)