diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3556c0d80..573151a17 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-04-05
+
+See [docs/releases/v0.16.0.md](docs/releases/v0.16.0.md) for full notes and [docs/releases/v0.16.0/assets.md](docs/releases/v0.16.0/assets.md) for release asset inventory.
+
+### Added
+
+- Add right-panel turn diff viewer.
+- Add editable code preview state and autosave support.
+- Add hidden provider input for prompt enhancements.
+- Add viewport presets and orientation controls.
+- Add optional rebase before commit flow.
+- Add GitHub repo cloning entry points.
+- Add build metadata across server and web.
+
+### Changed
+
+- Refine diff viewer panel defaults and opening behavior.
+- Standardize modal button styling.
+- Restart provider sessions when worktree cwd changes.
+- Stabilize release train and split Intel compatibility build.
+- Preserve prompt enhancement when sending messages.
+- Stabilize browser test runner and related types.
+- Refresh tracked worktree bases before creation.
+- Expose reasoning content in the work log.
+- Refactor home empty state into focused components.
+
+### Fixed
+
+- Fix branch sync to use explicit upstream refs.
+- Fix post-merge lint warnings.
+- Sanitize shell env before launching agent sessions.
+
+### Removed
+
+- Remove diff preview panel.
+
 ## [0.15.0] - 2026-04-05
 
 See [docs/releases/v0.15.0.md](docs/releases/v0.15.0.md) for full notes and [docs/releases/v0.15.0/assets.md](docs/releases/v0.15.0/assets.md) for release asset inventory.
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index fb2744bce..191047d37 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/desktop",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "private": true,
   "main": "dist-electron/main.js",
   "scripts": {
diff --git a/apps/mobile/android/app/build.gradle b/apps/mobile/android/app/build.gradle
index d61725ef0..5f145a243 100644
--- a/apps/mobile/android/app/build.gradle
+++ b/apps/mobile/android/app/build.gradle
@@ -8,7 +8,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode 1
-        versionName "0.14.0"
+        versionName "0.16.0"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
diff --git a/apps/mobile/ios/App/App.xcodeproj/project.pbxproj b/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
index 28cd9a2ba..8850e083f 100644
--- a/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
+++ b/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
@@ -303,7 +303,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.14.0;
+				MARKETING_VERSION = 0.16.0;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = com.openknots.okcode.mobile;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -325,7 +325,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.14.0;
+				MARKETING_VERSION = 0.16.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.openknots.okcode.mobile;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";
diff --git a/apps/mobile/package.json b/apps/mobile/package.json
index 6bdd474c9..c0defd07e 100644
--- a/apps/mobile/package.json
+++ b/apps/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/mobile",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/apps/server/package.json b/apps/server/package.json
index 3b98d14ca..acfe5f27d 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "okcodes",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "MIT",
   "repository": {
     "type": "git",
diff --git a/apps/server/src/git/Layers/GitManager.test.ts b/apps/server/src/git/Layers/GitManager.test.ts
index 740c1f535..79acc11ed 100644
--- a/apps/server/src/git/Layers/GitManager.test.ts
+++ b/apps/server/src/git/Layers/GitManager.test.ts
@@ -781,45 +781,48 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
     }),
   );
 
-  it.effect("rebases onto the latest default branch before commit when enabled", () =>
-    Effect.gen(function* () {
-      const repoDir = yield* makeTempDir("okcode-git-manager-");
-      yield* initRepo(repoDir);
-      const remoteDir = yield* createBareRemote();
-      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
-      yield* runGit(repoDir, ["push", "-u", "origin", "main"]);
-      yield* runGit(repoDir, ["checkout", "-b", "feature/rebase-before-commit"]);
+  it.effect(
+    "rebases onto the latest default branch before commit when enabled",
+    () =>
+      Effect.gen(function* () {
+        const repoDir = yield* makeTempDir("okcode-git-manager-");
+        yield* initRepo(repoDir);
+        const remoteDir = yield* createBareRemote();
+        yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+        yield* runGit(repoDir, ["push", "-u", "origin", "main"]);
+        yield* runGit(repoDir, ["checkout", "-b", "feature/rebase-before-commit"]);
 
-      const updaterDir = yield* makeTempDir("okcode-git-manager-updater-");
-      yield* runGit(updaterDir, ["clone", "--branch", "main", remoteDir, "."]);
-      yield* runGit(updaterDir, ["config", "user.email", "test@example.com"]);
-      yield* runGit(updaterDir, ["config", "user.name", "Test User"]);
-      fs.writeFileSync(path.join(updaterDir, "base.txt"), "remote main update\n");
-      yield* runGit(updaterDir, ["add", "base.txt"]);
-      yield* runGit(updaterDir, ["commit", "-m", "Remote main update"]);
-      yield* runGit(updaterDir, ["push", "origin", "main"]);
+        const updaterDir = yield* makeTempDir("okcode-git-manager-updater-");
+        yield* runGit(updaterDir, ["clone", "--branch", "main", remoteDir, "."]);
+        yield* runGit(updaterDir, ["config", "user.email", "test@example.com"]);
+        yield* runGit(updaterDir, ["config", "user.name", "Test User"]);
+        fs.writeFileSync(path.join(updaterDir, "base.txt"), "remote main update\n");
+        yield* runGit(updaterDir, ["add", "base.txt"]);
+        yield* runGit(updaterDir, ["commit", "-m", "Remote main update"]);
+        yield* runGit(updaterDir, ["push", "origin", "main"]);
 
-      fs.writeFileSync(path.join(repoDir, "README.md"), "hello\nrebased feature work\n");
+        fs.writeFileSync(path.join(repoDir, "README.md"), "hello\nrebased feature work\n");
 
-      const { manager } = yield* makeManager();
-      const result = yield* runStackedAction(manager, {
-        cwd: repoDir,
-        action: "commit",
-        commitMessage: "feat: rebase before commit",
-        rebaseBeforeCommit: true,
-      });
+        const { manager } = yield* makeManager();
+        const result = yield* runStackedAction(manager, {
+          cwd: repoDir,
+          action: "commit",
+          commitMessage: "feat: rebase before commit",
+          rebaseBeforeCommit: true,
+        });
 
-      expect(result.commit.status).toBe("created");
+        expect(result.commit.status).toBe("created");
 
-      const remoteMainSha = yield* runGit(repoDir, ["rev-parse", "origin/main"]).pipe(
-        Effect.map((gitResult) => gitResult.stdout.trim()),
-      );
-      const mergeBase = yield* runGit(repoDir, ["merge-base", "HEAD", "origin/main"]).pipe(
-        Effect.map((gitResult) => gitResult.stdout.trim()),
-      );
+        const remoteMainSha = yield* runGit(repoDir, ["rev-parse", "origin/main"]).pipe(
+          Effect.map((gitResult) => gitResult.stdout.trim()),
+        );
+        const mergeBase = yield* runGit(repoDir, ["merge-base", "HEAD", "origin/main"]).pipe(
+          Effect.map((gitResult) => gitResult.stdout.trim()),
+        );
 
-      expect(mergeBase).toBe(remoteMainSha);
-    }),
+        expect(mergeBase).toBe(remoteMainSha);
+      }),
+    30_000,
   );
 
   it.effect("uses custom commit message when provided", () =>
diff --git a/apps/server/src/wsServer.test.ts b/apps/server/src/wsServer.test.ts
index d87563e21..206a83241 100644
--- a/apps/server/src/wsServer.test.ts
+++ b/apps/server/src/wsServer.test.ts
@@ -873,6 +873,10 @@ describe("WebSocket Server", () => {
       issues: [],
       providers: defaultProviderStatuses,
       availableEditors: expect.any(Array),
+      buildInfo: expect.objectContaining({
+        surface: "server",
+        version: "0.16.0",
+      }),
     });
     expectAvailableEditors((response.result as { availableEditors: unknown }).availableEditors);
   });
@@ -899,6 +903,10 @@ describe("WebSocket Server", () => {
       issues: [],
       providers: defaultProviderStatuses,
       availableEditors: expect.any(Array),
+      buildInfo: expect.objectContaining({
+        surface: "server",
+        version: "0.16.0",
+      }),
     });
     expectAvailableEditors((response.result as { availableEditors: unknown }).availableEditors);
 
@@ -936,6 +944,10 @@ describe("WebSocket Server", () => {
       ],
       providers: defaultProviderStatuses,
       availableEditors: expect.any(Array),
+      buildInfo: expect.objectContaining({
+        surface: "server",
+        version: "0.16.0",
+      }),
     });
     expectAvailableEditors((response.result as { availableEditors: unknown }).availableEditors);
     expect(fs.readFileSync(keybindingsPath, "utf8")).toBe("{ not-json");
@@ -1152,6 +1164,10 @@ describe("WebSocket Server", () => {
       issues: [],
       providers: defaultProviderStatuses,
       availableEditors: expect.any(Array),
+      buildInfo: expect.objectContaining({
+        surface: "server",
+        version: "0.16.0",
+      }),
     });
     expectAvailableEditors((response.result as { availableEditors: unknown }).availableEditors);
   });
@@ -1201,6 +1217,10 @@ describe("WebSocket Server", () => {
       issues: [],
       providers: defaultProviderStatuses,
       availableEditors: expect.any(Array),
+      buildInfo: expect.objectContaining({
+        surface: "server",
+        version: "0.16.0",
+      }),
     });
     expectAvailableEditors(
       (configResponse.result as { availableEditors: unknown }).availableEditors,
diff --git a/apps/web/package.json b/apps/web/package.json
index c979d7b0b..558136221 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/web",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/apps/web/src/components/ChatView.logic.test.ts b/apps/web/src/components/ChatView.logic.test.ts
index 70fa6fc99..ed620e27b 100644
--- a/apps/web/src/components/ChatView.logic.test.ts
+++ b/apps/web/src/components/ChatView.logic.test.ts
@@ -116,7 +116,7 @@ describe("buildHiddenProviderInput", () => {
     expect(providerInput).toContain(
       'Before responding, improve the user\'s request using the "Add specificity" enhancement mode',
     );
-    expect(providerInput).toContain("Fix this [terminal-1:4-6] button");
+    expect(providerInput).toContain("Fix this @terminal-1:4-6 button");
     expect(providerInput).toContain("<terminal_context>");
     expect(providerInput).toContain("bun lint");
   });
diff --git a/bun.lock b/bun.lock
index 7b6097512..32a646d22 100644
--- a/bun.lock
+++ b/bun.lock
@@ -19,7 +19,7 @@
     },
     "apps/desktop": {
       "name": "@okcode/desktop",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "dependencies": {
         "effect": "catalog:",
         "electron": "40.6.0",
@@ -103,7 +103,7 @@
     },
     "apps/mobile": {
       "name": "@okcode/mobile",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "dependencies": {
         "@capacitor/android": "^8.3.0",
         "@capacitor/app": "^8.1.0",
@@ -123,7 +123,7 @@
     },
     "apps/server": {
       "name": "okcodes",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "bin": {
         "okcode": "./dist/index.mjs",
       },
@@ -154,7 +154,7 @@
     },
     "apps/web": {
       "name": "@okcode/web",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "dependencies": {
         "@base-ui/react": "^1.2.0",
         "@codemirror/language": "^6.12.3",
@@ -214,7 +214,7 @@
     },
     "packages/contracts": {
       "name": "@okcode/contracts",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "dependencies": {
         "effect": "catalog:",
       },
diff --git a/docs/releases/README.md b/docs/releases/README.md
index dbda6471b..9fa84d3ed 100644
--- a/docs/releases/README.md
+++ b/docs/releases/README.md
@@ -7,4 +7,10 @@ Use this directory for versioned release notes and asset manifests only:
 - `docs/releases/vX.Y.Z.md`
 - `docs/releases/vX.Y.Z/assets.md`
 
+| Version              | Summary                                                                                    | Assets                        |
+| -------------------- | ------------------------------------------------------------------------------------------ | ----------------------------- |
+| [0.16.0](v0.16.0.md) | Right-panel diff review, editable code previews, and stronger release stability            | [manifest](v0.16.0/assets.md) |
+| [0.15.0](v0.15.0.md) | Brand refresh, scoped preview tabs, redesigned chat home, and rebase-aware branch sync     | [manifest](v0.15.0/assets.md) |
+| [0.14.0](v0.14.0.md) | Inline diffs, prompt enhancement, auto-refreshing file tree, and link-based mobile pairing | [manifest](v0.14.0/assets.md) |
+
 When release policy changes, update [`docs/release.md`](../release.md) instead of duplicating the workflow matrix here.
diff --git a/docs/releases/v0.0.13/assets.md b/docs/releases/v0.0.13/assets.md
new file mode 100644
index 000000000..3e1d13cef
--- /dev/null
+++ b/docs/releases/v0.0.13/assets.md
@@ -0,0 +1,46 @@
+# v0.0.13 — Release assets (manifest)
+
+Binaries are **not** stored in this git repository; they are attached to the [GitHub Release for `v0.0.13`](https://github.com/OpenKnots/okcode/releases/tag/v0.0.13) by the [Release Desktop workflow](../../.github/workflows/release.yml).
+
+The GitHub Release also includes **documentation attachments** (same content as in-repo, stable filenames for download):
+
+| File                        | Source in repo                        |
+| --------------------------- | ------------------------------------- |
+| `okcode-CHANGELOG.md`       | [CHANGELOG.md](../../../CHANGELOG.md) |
+| `okcode-RELEASE-NOTES.md`   | [v0.0.13.md](../v0.0.13.md)           |
+| `okcode-ASSETS-MANIFEST.md` | This file                             |
+
+After the workflow completes, expect **installer and updater** artifacts similar to the following (exact names may include the product name `OK Code` and version `0.0.13`).
+
+## Desktop installers and payloads
+
+| Platform            | Kind           | Typical pattern |
+| ------------------- | -------------- | --------------- |
+| macOS Apple Silicon | DMG            | `*.dmg` (arm64) |
+| macOS Intel         | DMG            | `*.dmg` (x64)   |
+| macOS               | ZIP (updater)  | `*.zip`         |
+| Linux x64           | AppImage       | `*.AppImage`    |
+| Windows x64         | NSIS installer | `*.exe`         |
+
+## Electron updater metadata
+
+| File               | Purpose                                                   |
+| ------------------ | --------------------------------------------------------- |
+| `latest-mac.yml`   | macOS update manifest (merged from per-arch builds in CI) |
+| `latest-linux.yml` | Linux update manifest                                     |
+| `latest.yml`       | Windows update manifest                                   |
+| `*.blockmap`       | Differential download block maps                          |
+
+## iOS (TestFlight)
+
+The mobile companion features in this release ship through the native app build pipeline rather than as GitHub release assets.
+
+| Detail            | Value                                      |
+| ----------------- | ------------------------------------------ |
+| Bundle ID         | `com.openknots.okcode.mobile`              |
+| Marketing version | `0.0.13`                                   |
+| Build number      | Set from `GITHUB_RUN_NUMBER` at build time |
+
+## Checksums
+
+SHA-256 checksums are not committed here; verify downloads via GitHub's release UI or `gh release download` if you use the GitHub CLI.
diff --git a/docs/releases/v0.16.0.md b/docs/releases/v0.16.0.md
new file mode 100644
index 000000000..39769bdef
--- /dev/null
+++ b/docs/releases/v0.16.0.md
@@ -0,0 +1,33 @@
+# OK Code v0.16.0
+
+**Date:** 2026-04-05
+**Tag:** [`v0.16.0`](https://github.com/OpenKnots/okcode/releases/tag/v0.16.0)
+
+## Summary
+
+Right-panel diff review, editable code previews, stronger branch/worktree handling, and a more stable coordinated release train.
+
+## Highlights
+
+- **Add a right-panel turn diff viewer.** Diffs now open in a dedicated side panel with improved defaults and opening behavior for faster review.
+- **Add editable code preview state with autosave.** Previewed code can now be edited directly and preserved automatically while you work.
+- **Add viewport presets and orientation controls.** Preview tooling now supports faster device/layout switching without manual resizing.
+- **Add optional rebase-before-commit flow.** Git workflows can now rebase before commit when that better matches the branch strategy.
+- **Add GitHub repo cloning entry points.** Project creation can start directly from GitHub repository cloning flows.
+- **Expose build metadata across server and web.** The UI and server now share build metadata so release/runtime state is easier to inspect.
+- **Restart provider sessions when worktree cwd changes.** Provider sessions recover more predictably when the active worktree root changes.
+- **Sanitize shell env before launching agent sessions.** Provider launches are more robust and less likely to inherit unsafe or incompatible environment state.
+
+## Breaking changes
+
+- **Diff preview panel removed.** Diff review now lives in the right-panel viewer instead of the previous preview panel surface.
+
+## Upgrade and install
+
+- **CLI:** `npm install -g okcodes@0.16.0` (after the package is published to npm manually).
+- **Desktop:** Download from [GitHub Releases](https://github.com/OpenKnots/okcode/releases/tag/v0.16.0). This release includes signed macOS arm64/x64 DMGs, Linux x64 AppImage, and Windows x64 NSIS installer. Filenames are listed in [assets.md](v0.16.0/assets.md).
+- **iOS:** Available via TestFlight (uploaded automatically by the coordinated release workflow).
+
+## Known limitations
+
+OK Code remains early work in progress. Keep an eye on reconnect behavior, long-running stream recovery, and platform-specific desktop packaging edge cases during RC soak and stable promotion.
diff --git a/docs/releases/v0.16.0/assets.md b/docs/releases/v0.16.0/assets.md
new file mode 100644
index 000000000..793e16b7d
--- /dev/null
+++ b/docs/releases/v0.16.0/assets.md
@@ -0,0 +1,50 @@
+# v0.16.0 — Release assets (manifest)
+
+Binaries are **not** stored in this git repository; they are attached to the [GitHub Release for `v0.16.0`](https://github.com/OpenKnots/okcode/releases/tag/v0.16.0) by the [Release Desktop workflow](../../.github/workflows/release.yml).
+
+The GitHub Release also includes **documentation attachments** (same content as in-repo, stable filenames for download):
+
+| File                        | Source in repo                        |
+| --------------------------- | ------------------------------------- |
+| `okcode-CHANGELOG.md`       | [CHANGELOG.md](../../../CHANGELOG.md) |
+| `okcode-RELEASE-NOTES.md`   | [v0.16.0.md](../v0.16.0.md)           |
+| `okcode-ASSETS-MANIFEST.md` | This file                             |
+
+After the workflow completes, expect **installer and updater** artifacts similar to the following (exact names may include the product name `OK Code` and version `0.16.0`).
+
+## Desktop installers and payloads
+
+| Platform            | Kind           | Typical pattern |
+| ------------------- | -------------- | --------------- |
+| macOS Apple Silicon | DMG (signed)   | `*.dmg` (arm64) |
+| macOS Intel         | DMG (signed)   | `*.dmg` (x64)   |
+| macOS               | ZIP (updater)  | `*.zip`         |
+| Linux x64           | AppImage       | `*.AppImage`    |
+| Windows x64         | NSIS installer | `*.exe`         |
+
+### macOS code signing and notarization
+
+All macOS DMG and ZIP payloads are **code-signed** with an Apple Developer ID certificate and **notarized** via the Apple notarization service. Gatekeeper will verify the signature on first launch. The hardened runtime is enabled with entitlements defined in `apps/desktop/resources/entitlements.mac.plist`.
+
+## Electron updater metadata
+
+| File               | Purpose                                                   |
+| ------------------ | --------------------------------------------------------- |
+| `latest-mac.yml`   | macOS update manifest (merged from per-arch builds in CI) |
+| `latest-linux.yml` | Linux update manifest                                     |
+| `latest.yml`       | Windows update manifest                                   |
+| `*.blockmap`       | Differential download block maps                          |
+
+## iOS (TestFlight)
+
+The iOS build is uploaded directly to App Store Connect / TestFlight by the [Release iOS workflow](../../.github/workflows/release-ios.yml). No IPA artifact is attached to the GitHub Release.
+
+| Detail            | Value                                      |
+| ----------------- | ------------------------------------------ |
+| Bundle ID         | `com.openknots.okcode.mobile`              |
+| Marketing version | `0.16.0`                                   |
+| Build number      | Set from `GITHUB_RUN_NUMBER` at build time |
+
+## Checksums
+
+SHA-256 checksums are not committed here; verify downloads via GitHub's release UI or `gh release download` if you use the GitHub CLI.
diff --git a/packages/contracts/package.json b/packages/contracts/package.json
index 0a2b5b793..00a55c352 100644
--- a/packages/contracts/package.json
+++ b/packages/contracts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/contracts",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "private": true,
   "files": [
     "dist"
diff --git a/scripts/prepare-release.ts b/scripts/prepare-release.ts
index 8c2b1cc51..e52d88294 100644
--- a/scripts/prepare-release.ts
+++ b/scripts/prepare-release.ts
@@ -278,7 +278,7 @@ The GitHub Release also includes **documentation attachments** (same content as
 | File                        | Source in repo                        |
 | --------------------------- | ------------------------------------- |
 | \`okcode-CHANGELOG.md\`       | [CHANGELOG.md](../../../CHANGELOG.md) |
-| \`okcode-RELEASE-NOTES.md\`   | [v${version}.md](../v${version}.md)             |
+| \`okcode-RELEASE-NOTES.md\`   | [v${version}.md](../v${version}.md)           |
 | \`okcode-ASSETS-MANIFEST.md\` | This file                             |
 
 After the workflow completes, expect **installer and updater** artifacts similar to the following (exact names may include the product name \`OK Code\` and version \`${version}\`).
@@ -287,16 +287,21 @@ After the workflow completes, expect **installer and updater** artifacts similar
 
 | Platform            | Kind           | Typical pattern |
 | ------------------- | -------------- | --------------- |
-| macOS Apple Silicon | DMG            | \`*.dmg\` (arm64) |
+| macOS Apple Silicon | DMG (signed)   | \`*.dmg\` (arm64) |
+| macOS Intel         | DMG (signed)   | \`*.dmg\` (x64)   |
 | macOS               | ZIP (updater)  | \`*.zip\`         |
 | Linux x64           | AppImage       | \`*.AppImage\`    |
 | Windows x64         | NSIS installer | \`*.exe\`         |
 
+### macOS code signing and notarization
+
+All macOS DMG and ZIP payloads are **code-signed** with an Apple Developer ID certificate and **notarized** via the Apple notarization service. Gatekeeper will verify the signature on first launch. The hardened runtime is enabled with entitlements defined in \`apps/desktop/resources/entitlements.mac.plist\`.
+
 ## Electron updater metadata
 
 | File               | Purpose                                                   |
 | ------------------ | --------------------------------------------------------- |
-| \`latest-mac.yml\`   | macOS update manifest                                      |
+| \`latest-mac.yml\`   | macOS update manifest (merged from per-arch builds in CI) |
 | \`latest-linux.yml\` | Linux update manifest                                     |
 | \`latest.yml\`       | Windows update manifest                                   |
 | \`*.blockmap\`       | Differential download block maps                          |
@@ -305,10 +310,10 @@ After the workflow completes, expect **installer and updater** artifacts similar
 
 The iOS build is uploaded directly to App Store Connect / TestFlight by the [Release iOS workflow](../../.github/workflows/release-ios.yml). No IPA artifact is attached to the GitHub Release.
 
-| Detail            | Value                                    |
-| ----------------- | ---------------------------------------- |
-| Bundle ID         | \`com.openknots.okcode.mobile\`            |
-| Marketing version | \`${version}\`                              |
+| Detail            | Value                                      |
+| ----------------- | ------------------------------------------ |
+| Bundle ID         | \`com.openknots.okcode.mobile\`              |
+| Marketing version | \`${version}\`                                   |
 | Build number      | Set from \`GITHUB_RUN_NUMBER\` at build time |
 
 ## Checksums
@@ -399,6 +404,8 @@ function runQualityGates(rootDir: string): void {
     { name: "Lint", cmd: "bun", args: ["run", "lint"] },
     { name: "Typecheck", cmd: "bun", args: ["run", "typecheck"] },
     { name: "Test", cmd: "bun", args: ["run", "test"] },
+    { name: "Browser tests", cmd: "bun", args: ["run", "--cwd", "apps/web", "test:browser"] },
+    { name: "Desktop smoke", cmd: "bun", args: ["run", "test:desktop-smoke"] },
     { name: "Release smoke", cmd: "bun", args: ["run", "release:smoke"] },
   ];
 
diff --git a/scripts/update-release-package-versions.ts b/scripts/update-release-package-versions.ts
index a351373a2..15eb5ef7b 100644
--- a/scripts/update-release-package-versions.ts
+++ b/scripts/update-release-package-versions.ts
@@ -1,4 +1,4 @@
-import { appendFileSync, readFileSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -10,6 +10,11 @@ export const releasePackageFiles = [
   "packages/contracts/package.json",
 ] as const;
 
+const mobileVersionFiles = {
+  android: "apps/mobile/android/app/build.gradle",
+  ios: "apps/mobile/ios/App/App.xcodeproj/project.pbxproj",
+} as const;
+
 interface UpdateReleasePackageVersionsOptions {
   readonly rootDir?: string;
 }
@@ -38,6 +43,32 @@ export function updateReleasePackageVersions(
     changed = true;
   }
 
+  const androidPath = resolve(rootDir, mobileVersionFiles.android);
+  if (existsSync(androidPath)) {
+    const androidOriginal = readFileSync(androidPath, "utf8");
+    const androidUpdated = androidOriginal.replace(
+      /versionName\s+"[^"]+"/g,
+      `versionName "${version}"`,
+    );
+    if (androidUpdated !== androidOriginal) {
+      writeFileSync(androidPath, androidUpdated);
+      changed = true;
+    }
+  }
+
+  const iosPath = resolve(rootDir, mobileVersionFiles.ios);
+  if (existsSync(iosPath)) {
+    const iosOriginal = readFileSync(iosPath, "utf8");
+    const iosUpdated = iosOriginal.replace(
+      /MARKETING_VERSION\s*=\s*[^;]+;/g,
+      `MARKETING_VERSION = ${version};`,
+    );
+    if (iosUpdated !== iosOriginal) {
+      writeFileSync(iosPath, iosUpdated);
+      changed = true;
+    }
+  }
+
   return { changed };
 }