diff --git a/CLAUDE.md b/CLAUDE.md
index fd1cb4d..5dd2168 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -22,8 +22,8 @@ sethLabels is a thin deployment fork of [glabels-qt](https://github.com/j-evins/
 
 ## Conventions
 
-- This is a **deployment fork**, not a real fork. The discipline is **strict zero source patches** — no upstream-tracked file is ever edited. All sethLabels content lives in NEW top-level dirs (`scripts/`, `packaging/`, `sethlabels-docs/`, `.claude/`). Allowlist exception: `.gitignore` (one-time scaffold-time touch).
-- Enforced by `scripts/check-no-upstream-edits.sh` (to be implemented per spec §5.5).
+- This is a **deployment fork**, not a real fork. The discipline is **strict zero source patches** — no upstream-tracked file is ever edited. All sethLabels content lives in NEW top-level dirs (`scripts/`, `packaging/`, `sethlabels-docs/`, `tests-impl/`, `.claude/`). Allowlist exception: `.gitignore` (one-time scaffold-time touch).
+- Enforced by `scripts/check-no-upstream-edits.sh` — runs as the first step of every build script, also catches working-tree drift, aborts if `upstream/master` ref is missing.
 - Preserve upstream license (GPL-3.0) and copyright headers — strict-zero handles this automatically by never touching upstream files.
 - Versioning: `<upstream-tag>-seth<N>` (e.g., `3.99-master618-seth1`). See spec §D4 + §5.4.
 - See `~/bin/CLAUDE.md` for global homelab conventions (gitea CLI, conventional commits, credentials handling).
diff --git a/DECISIONS.md b/DECISIONS.md
index 583d1fb..b368466 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -18,6 +18,7 @@ Format: `YYYY-MM-DD: <decision> — <why>`
 - **2026-04-29: macOS = no CI required.** Homebrew tap with build-from-source means no macOS runner, no Apple Developer ID, no notarization pipeline. Tap repo (`git.sethpc.xyz/Seth/homebrew-tap`) is one ~30-line Ruby file. — Major simplification; Mac users build locally on first install (~5–10 min), all subsequent installs are version pin bumps to the tap formula.
 - **2026-04-29: Debian-family is the install target, not steel141.** Build host happens to be steel141 (or any clean Debian/Ubuntu box); install target is generic Debian-family. — No homelab paths, hostnames, or assumptions in scripts. Reproducibility on a fresh VM is the bar.
 - **2026-04-29: Spec, scripts, and packaging metadata live in NEW top-level dirs.** `sethlabels-docs/`, `scripts/`, `packaging/`. NOT in upstream's `docs/` directory. — Clear fork boundary; preserves strict-zero spirit (don't pollute upstream namespaces with our content).
+- **2026-04-29: macOS Launchpad/Spotlight integration via stub `.app` wrapper generated in brew formula.** Formula's `def install` synthesizes `glabels-qt.app/Contents/{Info.plist, MacOS/launcher, Resources/glabels-qt.icns}` after `cmake --install`. Launcher is a 2-line shell that `exec`s the real CLI binary. Icon converted from upstream's SVG via `sips`. User runs a one-time `cp -R "$(brew --prefix glabels-qt)/glabels-qt.app" /Applications/` (caveats block reminds them). — Upstream's `add_executable(glabels-qt WIN32 ...)` has no `MACOSX_BUNDLE` keyword, so cmake produces a CLI-only Mach-O on macOS. Strict-zero forbids patching upstream to fix this. The brew-formula-side stub is the cleanest sethLabels-side workaround; no Apple Developer ID, no signing pipeline, no .dmg. Tap commits `ef4d6c7` (initial wrapper) + `3542762` (SVG glob fix).
 
 ## Deferred / Rejected
 <!-- Decisions NOT to do something are just as valuable -- prevents re-proposing rejected ideas -->