diff --git a/.github/workflows/_desktop-release.yml b/.github/workflows/_desktop-release.yml
index 4557393a09b..654c35b4ff7 100644
--- a/.github/workflows/_desktop-release.yml
+++ b/.github/workflows/_desktop-release.yml
@@ -59,6 +59,9 @@ jobs:
       - name: Package for macOS
         # Retry for transient Apple timestamp-server failures during code signing.
         run: ./scripts/retry.sh 3 30 make dist-mac
+        env:
+          # Local/PR builds may be unsigned, but official releases must fail without signing.
+          MAC_FORCE_CODE_SIGNING: "true"
 
       - name: Create legacy mux artifact aliases
         run: ./scripts/create-legacy-mux-artifact-aliases.sh
diff --git a/Makefile b/Makefile
index 23033945f09..7929889ced4 100644
--- a/Makefile
+++ b/Makefile
@@ -470,6 +470,8 @@ test-e2e-perf: ## Run automated performance profiling scenarios
 	@XUM_E2E_RUN_PERF=1 XUM_PROFILE_REACT=1 XUM_E2E_LOAD_DIST=1 XUM_E2E_SKIP_BUILD=1 PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 bun x playwright test --project=electron tests/e2e/scenarios/perf*.spec.ts $(PLAYWRIGHT_ARGS)
 
 ## Distribution
+MAC_FORCE_CODE_SIGNING ?= false
+
 dist: build ## Build distributable packages
 	@bun x electron-builder --publish never
 
@@ -494,13 +496,14 @@ ensure-mac-sharp-runtime-deps: node_modules/.installed
 
 dist-mac: build ## Build macOS distributables (x64 + arm64)
 	@$(MAKE) --no-print-directory ensure-mac-sharp-runtime-deps
-	@if [ -n "$$CSC_LINK" ]; then \
+	@# Local builds may omit signing credentials; keep the check safe under bash -u.
+	@if [ -n "$${CSC_LINK:-}" ]; then \
 		echo "🔐 Code signing enabled - using unified build for correct yml..."; \
-		bun x electron-builder --mac --x64 --arm64 --publish never; \
+		bun x electron-builder --mac --x64 --arm64 --publish never --config.forceCodeSigning=$(MAC_FORCE_CODE_SIGNING); \
 	else \
 		echo "Building macOS architectures in parallel..."; \
-		bun x electron-builder --mac --x64 --publish never & pid1=$$! ; \
-		bun x electron-builder --mac --arm64 --publish never & pid2=$$! ; \
+		bun x electron-builder --mac --x64 --publish never --config.forceCodeSigning=$(MAC_FORCE_CODE_SIGNING) & pid1=$$! ; \
+		bun x electron-builder --mac --arm64 --publish never --config.forceCodeSigning=$(MAC_FORCE_CODE_SIGNING) & pid2=$$! ; \
 		wait $$pid1 && wait $$pid2; \
 	fi
 	@echo "✅ Both architectures built successfully"
diff --git a/scripts/check_codex_comments.sh b/scripts/check_codex_comments.sh
index 20af90f4986..c9b7f2d44d5 100755
--- a/scripts/check_codex_comments.sh
+++ b/scripts/check_codex_comments.sh
@@ -83,9 +83,11 @@ compute_codex_sets_from_arrays() {
   # JSON goes through stdin, never argv: a long review history exceeds Linux's
   # per-argument limit (MAX_ARG_STRLEN, ~128KB) and made --argjson fail with
   # "Argument list too long". printf is a shell builtin, so it has no such limit.
+  # The bot's live status summary is metadata; its findings are gated by review threads below.
   REGULAR_COMMENTS=$(printf '%s' "$comments_json" | jq -c --arg bot "$BOT_LOGIN_GRAPHQL" '[
     .[]
     | select(.author.login == $bot and .isMinimized == false and (.body | test("Didn.t find any major issues|usage limits have been reached|create a Codex account") | not))
+    | select(.body | startswith("<!-- codex-pull-request-review-summary -->") | not)
   ]')
 
   UNRESOLVED_THREADS=$(printf '%s' "$threads_json" | jq -c --arg bot "$BOT_LOGIN_GRAPHQL" '[