diff --git a/openwiki/.last-update.json b/openwiki/.last-update.json
index 83e5f52..dc4ca9d 100644
--- a/openwiki/.last-update.json
+++ b/openwiki/.last-update.json
@@ -1,6 +1,6 @@
 {
-  "updatedAt": "2026-07-30T18:43:03.490Z",
+  "updatedAt": "2026-07-31T01:02:08.631Z",
   "command": "update",
-  "gitHead": "d4aeddcf536044803adebee76372d98634dd2c65",
+  "gitHead": "ef81c827916ad88685588de0b35190e30cae0917",
   "model": "zai.glm-5"
 }
diff --git a/openwiki/operations/release-gates.md b/openwiki/operations/release-gates.md
index 5f125ec..d44f3c4 100644
--- a/openwiki/operations/release-gates.md
+++ b/openwiki/operations/release-gates.md
@@ -29,8 +29,10 @@ Apple Development-signed and installed with a stable identity.
 
 The macOS release workflow automates notarized installer builds when triggered by a
 version tag or manual dispatch. It requires Developer ID Application and Installer
-credentials in the CI environment and publishes a GitHub release only after successful
-notarization and Gatekeeper acceptance.
+credentials in the CI environment, notarizes and staples the app bundle before
+packaging, and publishes a GitHub release only after successful installer notarization
+and Gatekeeper acceptance. The build enforces the expected PSD signing team via
+ATRIUM_CAPTURE_EXPECTED_TEAM_ID to prevent misissued certificates.
 
 Both public OAuth clients, idempotent authored-asset publication, and
 authenticated synthetic production-Atrium acceptance are live verified.