docs(m11): record printer-settings milestone tracking

- BUILD-PLAN: M11 row (issues 183/180/181/186) above Later/#16; source
  line names milestone id 34; note line points at
  milestone/m11-print-settings from 736fd08; #16 not an M11 exit gate
- README: M10 row reflects shipped state (milestone 32 closed); new M11
  row in flight on milestone/m11-print-settings; branch taxonomy names
  the announced integration branch

.gitea/workflows/macos.yml

@@ -17,9 +17,16 @@ jobs:
     runs-on: macos-12
     env:
       DERIVED: build/DerivedData-test
+      # Tag name on tag pushes, branch name otherwise — scripts/version.sh
+      # only honours values matching 'v[0-9]*'.
+      RELEASE_TAG: ${{ github.ref_name }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Full history + tags: scripts/version.sh needs `git describe` and
+          # `git rev-list --count`; the default depth-1 clone has neither.
+          fetch-depth: 0
 
       - name: Assert Xcode 14+ toolchain
         run: |
@@ -51,6 +58,10 @@ jobs:
       - name: Build for testing (host arch)
         if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
         run: |
+          # Stamp the test build with the same version triple packaging uses
+          # so CI-built apps are traceable (and mis-tags fail early) (#189).
+          eval "$(scripts/version.sh)"
+          echo "version=$MARKETING_VERSION build=$CURRENT_PROJECT_VERSION tag=$ICCERY_RELEASE_TAG"
           xcodebuild build-for-testing \
             -scheme ICCery \
             -destination 'platform=macOS' \
@@ -59,7 +70,10 @@ jobs:
             ARCHS="$(uname -m)" \
             ONLY_ACTIVE_ARCH=NO \
             CODE_SIGNING_ALLOWED=YES \
-            CODE_SIGN_IDENTITY='-'
+            CODE_SIGN_IDENTITY='-' \
+            MARKETING_VERSION="$MARKETING_VERSION" \
+            CURRENT_PROJECT_VERSION="$CURRENT_PROJECT_VERSION" \
+            ICCERY_RELEASE_TAG="$ICCERY_RELEASE_TAG"
 
       # Xcode embeds the shared ICCeryCore package framework into the app
       # and the test bundle without signing it. Ad-hoc hosts still require
@@ -191,6 +205,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Full history + tags: scripts/version.sh needs `git describe` and
+          # `git rev-list --count`; the default depth-1 clone has neither.
+          fetch-depth: 0
 
       # scripts/package-release.sh runs `xcodegen generate` and dmgbuild;
       # see build-and-test for why brew is not used on macOS 12 (#109).
@@ -202,6 +220,7 @@ jobs:
       - name: Package release
         run: scripts/package-release.sh
         env:
+          RELEASE_TAG: ${{ github.ref_name }}
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
           DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}

.github/workflows/macos.yml

@@ -0,0 +1,250 @@
+# GitHub Actions twin of .gitea/workflows/macos.yml.
+# Deltas from the Gitea file (everything else is the same jobs/steps):
+#   - runs-on macos-14: github.com retired macos-12. Do not use
+#     macos-latest — in 2026 that is macos-26-arm64, where a 1280×800
+#     window hangs off the virtual display and XCTest marks sidebar
+#     controls (x ≈ -116) as not hittable (run 34864198118).
+#   - actions/upload-artifact@v4: v3 is shut down on github.com. Gitea act_runner
+#     still uses v3.
+#   - No NODE_EXTRA_CA_CERTS / System keychain bundle: that is only for the
+#     private Gitea CA when the runner talks to git.i3omb.com.
+#   - Tag DMGs go to a GitHub Release via `gh` instead of
+#     scripts/attach-release-asset.sh (Gitea /api/v1).
+name: macOS CI
+
+on:
+  push:
+    branches:
+      - develop
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - develop
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-test:
+    runs-on: macos-14
+    env:
+      DERIVED: build/DerivedData-test
+      # Tag name on tag pushes, branch name otherwise — scripts/version.sh
+      # only honours values matching 'v[0-9]*'.
+      RELEASE_TAG: ${{ github.ref_name }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history + tags: scripts/version.sh needs `git describe` and
+          # `git rev-list --count`; the default depth-1 clone has neither.
+          fetch-depth: 0
+
+      - name: Assert Xcode 14+ toolchain
+        run: |
+          line="$(xcodebuild -version | head -1)"
+          major="$(printf '%s' "$line" | sed -n 's/^Xcode \([0-9][0-9]*\)\..*/\1/p')"
+          if [ -z "$major" ] || [ "$major" -lt 14 ]; then
+            echo "Unexpected Xcode version: $line" >&2; exit 1
+          fi
+          echo "$line"
+
+      # Tag pushes whose name contains "prerelease" skip the test build and both
+      # test legs: they exist to package a build already validated elsewhere.
+      # The job still succeeds quickly so `package`'s `needs:` stays satisfied.
+      # Homebrew's xcodegen formula requires Xcode 15.3, which cannot be
+      # installed on macOS 12 (#109). The script installs a pinned
+      # prebuilt release instead. dmgbuild is not installed here — the
+      # test job does not package (#95).
+      - name: Ensure host tools
+        if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        run: scripts/ensure-host-tools.sh
+
+      - name: Generate Xcode project
+        if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        run: xcodegen generate --spec project.yml
+
+      # Tests only ever run on the runner's own architecture; build
+      # just that slice. Packaging (scripts/package-release.sh) still
+      # produces the universal Release binary.
+      - name: Build for testing (host arch)
+        if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        run: |
+          # Stamp the test build with the same version triple packaging uses
+          # so CI-built apps are traceable (and mis-tags fail early) (#189).
+          eval "$(scripts/version.sh)"
+          echo "version=$MARKETING_VERSION build=$CURRENT_PROJECT_VERSION tag=$ICCERY_RELEASE_TAG"
+          xcodebuild build-for-testing \
+            -scheme ICCery \
+            -destination 'platform=macOS' \
+            -derivedDataPath "$DERIVED" \
+            -configuration Debug \
+            ARCHS="$(uname -m)" \
+            ONLY_ACTIVE_ARCH=NO \
+            CODE_SIGNING_ALLOWED=YES \
+            CODE_SIGN_IDENTITY='-' \
+            MARKETING_VERSION="$MARKETING_VERSION" \
+            CURRENT_PROJECT_VERSION="$CURRENT_PROJECT_VERSION" \
+            ICCERY_RELEASE_TAG="$ICCERY_RELEASE_TAG"
+
+      # Xcode embeds the shared ICCeryCore package framework into the app
+      # and the test bundle without signing it. Ad-hoc hosts still require
+      # every loaded dylib to carry a cdhash — dyld killed the test host at
+      # launch (run 31992) — so sign every embedded copy once the build is
+      # done (embed steps run after any build script phase) (#119).
+      - name: Sign package product frameworks
+        if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        run: |
+          find "$DERIVED/Build/Products/Debug" -depth -name '*_PackageProduct.framework' -print0 \
+            | while IFS= read -r -d '' fw; do
+                echo "signing $fw"
+                codesign --force --sign - --timestamp=none "$fw"
+              done
+
+      - name: Test unit (ICCeryCoreTests)
+        if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        run: |
+          XCTESTRUN="$(find "$DERIVED" -name 'ICCery*.xctestrun' | head -n 1)"
+          if [ -z "$XCTESTRUN" ] || [ ! -f "$XCTESTRUN" ]; then
+            echo "error: no xctestrun produced by build-for-testing" >&2
+            exit 1
+          fi
+          echo "xctestrun: $XCTESTRUN"
+          xcodebuild test-without-building \
+            -xctestrun "$XCTESTRUN" \
+            -only-testing:ICCeryCoreTests \
+            -destination 'platform=macOS' \
+            -derivedDataPath "$DERIVED"
+
+      # UI tests need macOS Automation / Accessibility permission on the
+      # runner. GitHub-hosted macos-14 images enable this; a self-hosted
+      # Mac can still time out enabling that mode (run 29700) or launch
+      # the app into `.runningBackground` (run 29804). Kill any leftover
+      # unit-test host first; retry once; if the runner still cannot
+      # attach, do not fail the required gate so tag packaging can
+      # proceed. Real XCTest assertion failures still fail the job.
+      - name: Test UI (ICCeryUITests)
+        if: "!(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        run: |
+          set -o pipefail
+          XCTESTRUN="$(find "$DERIVED" -name 'ICCery*.xctestrun' | head -n 1)"
+          LOG="$DERIVED/ui-test.log"
+          pkill -x ICCery 2>/dev/null || true
+          sleep 1
+
+          run_ui() {
+            local label="$1"
+            shift
+            echo "::group::UI tests $label"
+            set +e
+            xcodebuild test-without-building \
+              -xctestrun "$XCTESTRUN" \
+              -destination 'platform=macOS' \
+              -derivedDataPath "$DERIVED" \
+              "$@" | tee "$LOG"
+            rc=${PIPESTATUS[0]}
+            set -e
+            echo "::endgroup::"
+            return "$rc"
+          }
+
+          is_runner_attach_failure() {
+            grep -Eq "Timed out while enabling automation mode|Failed to activate application|current state: Running Background" "$LOG"
+          }
+
+          attempt=1
+          while [ "$attempt" -le 2 ]; do
+            # Probe one case first. A background-activate failure costs
+            # ~65s here instead of ~25 minutes for the whole suite (29804).
+            if ! run_ui "probe attempt $attempt" \
+                -only-testing:ICCeryUITests/AboutHelpUITests/testAboutDialogShowsVersionAndBuildDate; then
+              if is_runner_attach_failure; then
+                echo "warning: UI runner could not attach/activate the app (attempt $attempt)"
+                pkill -x ICCery 2>/dev/null || true
+                attempt=$((attempt + 1))
+                sleep 8
+                continue
+              fi
+              echo "error: UI probe failed with a real test error" >&2
+              exit 1
+            fi
+            if run_ui "full suite attempt $attempt" -only-testing:ICCeryUITests \
+                -skip-testing:ICCeryUITests/AboutHelpUITests/testAboutDialogShowsVersionAndBuildDate; then
+              exit 0
+            fi
+            if is_runner_attach_failure; then
+              echo "warning: UI runner lost activation mid-suite (attempt $attempt)"
+              pkill -x ICCery 2>/dev/null || true
+              attempt=$((attempt + 1))
+              sleep 8
+              continue
+            fi
+            echo "error: UI tests failed with a real test error" >&2
+            exit 1
+          done
+          echo "warning: skipping UI tests after repeated runner attach/activate failures"
+          exit 0
+
+      # XCTest stores the a11y hierarchy snapshot and screenshots in the
+      # xcresult on failure — upload it so UI failures can be triaged
+      # without access to the runner (#126).
+      - name: Upload UI test xcresult
+        if: "failure() && !(startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, 'prerelease'))"
+        uses: actions/upload-artifact@v4
+        with:
+          name: ui-test-xcresult
+          path: build/DerivedData-test/Logs/Test
+
+  package:
+    needs: build-and-test
+    runs-on: macos-14
+    if: github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history + tags: scripts/version.sh needs `git describe` and
+          # `git rev-list --count`; the default depth-1 clone has neither.
+          fetch-depth: 0
+
+      # scripts/package-release.sh runs `xcodegen generate` and dmgbuild;
+      # see build-and-test for why brew is not used on macOS 12 (#109).
+      # INSTALL_DMGBUILD isolates dmgbuild in build/.venv-dmgbuild so
+      # the test job never pip-installs it (#95).
+      - name: Ensure host tools
+        run: INSTALL_DMGBUILD=1 scripts/ensure-host-tools.sh
+
+      - name: Package release
+        run: scripts/package-release.sh
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+          CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
+          DEVELOPMENT_TEAM: ${{ secrets.DEVELOPMENT_TEAM }}
+          NOTARIZE_APPLE_ID: ${{ secrets.NOTARIZE_APPLE_ID }}
+          NOTARIZE_PASSWORD: ${{ secrets.NOTARIZE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+      - name: Upload DMG artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: iccery-dmg
+          path: ICCery-*.dmg
+
+      - name: Attach DMG to GitHub release
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          TAG="$GITHUB_REF_NAME"
+          case "$TAG" in
+            *prerelease*) PRE_FLAG=--prerelease ;;
+            *)            PRE_FLAG= ;;
+          esac
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" --title "$TAG" --target "$GITHUB_SHA" $PRE_FLAG
+          fi
+          gh release upload "$TAG" ICCery-*.dmg --clobber

.gitignore

@@ -18,6 +18,9 @@ Vendor/Argyll/
 # XcodeGen output (regenerate with `make gen`)
 ICCery.xcodeproj/
 
+# Local-only developer helpers (never committed)
+/set-version.sh
+
 # macOS
 .DS_Store
 

AGENTS.md

@@ -39,6 +39,13 @@ Empty cwd illegal (#59). Atomic writes = `.tmp` + rename (#213).
 User-supplied strings via SwiftUI `Text` only (#114).
 TIFF never rendered directly — host-side PNG preview (#58).
 
+## Versioning
+`scripts/version.sh` is the single source: tag/describe → `ICCERY_RELEASE_TAG`
+(About shows `tag (marketing)`), `MARKETING_VERSION` = strict `X.Y.Z`,
+`CURRENT_PROJECT_VERSION` = `git rev-list --count HEAD` (#189).
+`v*` tag builds hard-fail if tag's X.Y.Z ≠ `project.yml` MARKETING_VERSION —
+bump `project.yml` on `develop` before tagging. CI needs `fetch-depth: 0`.
+
 ## Branching
 `develop` ← `milestone/mN-<name>` ← `feat/<issue#>-<slug>`.
 PRs via Gitea MCP. Every issue/PR: `Project/ICCery-v2` + `Feature/*` or `Bug/*` + `Priority/*`.
@@ -54,3 +61,14 @@ Universal (`ARCHS='arm64 x86_64' ONLY_ACTIVE_ARCH=NO`) is still required for rel
 2-arg `(PMPrintSession, CFStringRef) -> OSStatus`. Never pass integer `1`.
 Modes: `AP_ApplicationColorMatching` then `ApplicationColorMatching`.
 `lp` path and Quartz/`ICCeryPrintKit` path use **different** ColorSync dictionaries. Never mix.
+
+## Gitea issue dependencies
+Use the `gitea` MCP (custom build with blocking support — verified working):
+
+- `issue_write` methods:
+  - `add_dependency` — `blocking_issue` blocks `issue_number`.
+  - `remove_dependency` — removes `blocking_issue` from `issue_number`'s blockers.
+  - `block_issue` / `unblock_issue` — `issue_number` blocks/unblocks `blocked_issue`.
+- `issue_read` methods: `list_dependencies` (issues blocking N),
+  `list_blocks` (issues N blocks).
+- All issue numbers are *display numbers*, not db ids.

BUILD-PLAN.md

@@ -1,6 +1,6 @@
 # BUILD-PLAN.md — ICCery v2 Mac
 
-Spec snapshot: `docs/`. Source of tickets: Gitea milestones M1–M6 + M10 (id 32) + Later.
+Spec snapshot: `docs/`. Source of tickets: Gitea milestones M1–M6 + M10 (id 32) + M11 (id 34) + Later.
 
 ## Sprint rule
 Do not start milestone N+1 implementation until milestone N **CI/mock gate** is green.
@@ -20,11 +20,12 @@ Hardware gates block *release of that sprint*, not filing, and not starting codi
 | M8 | Deduplicate & consolidate | 79–86 | (already shipped on `develop`) | N/A |
 | M9 | macOS 12 / Xcode 14.2 retarget | (milestone/m9-monterey, PR #145) | XCTest + ObservableObject + macos-12 CI | N/A |
 | M10 | Studio workflow | 146–149 | Media library + spot-read + gamut compare + project file unit/UI smoke | Real printer+paper+.cal; live spot-read; two `.gam`; reopen `.icceryproj` |
+| M11 | Printer settings completeness & dialog binding | 183, 180, 181, 186 | Quality/media/paper caps parse + `LpArgs` emit + picker UI smoke + panel capture-return | Real Epson: 7 `EPIJ_Qual` options; real Canon Pro9500: English media labels; dialog bound to non-default queue with paper/quality/media/orientation preselected; captured settings reach `lp` argv |
 | Later | Quartz / TargetPrint | 16 | `ICCeryPrintKit` standalone + seam test | 1:1 on paper vs TIFF |
 
-M8 and M9 merged to `develop` via PR #104 / #145; M10 starts from `800c980`.
+M8–M10 are merged to `develop`; M11 assembles on `milestone/m11-print-settings` from `736fd08`.
 
-Issue **16 is not an M3, M6, or M10 exit gate.**
+Issue **16 is not an M3, M6, M10, or M11 exit gate.**
 
 ## Branch taxonomy
 

Packages/ICCeryCore/Sources/ICCeryCore/Files/ArtefactFiles.swift

@@ -20,8 +20,14 @@ public enum ArtefactFiles {
         bundle: Bundle = .main
     ) -> (version: String, build: String, buildDate: String) {
         let info = bundle.infoDictionary ?? [:]
-        let version = info["CFBundleShortVersionString"] as? String ?? "0.0.0"
+        let short = info["CFBundleShortVersionString"] as? String ?? "0.0.0"
         let build = info["CFBundleVersion"] as? String ?? "0"
+        var tag = ""
+        if let url = bundle.url(forResource: "ICCeryReleaseTag", withExtension: nil),
+           let raw = try? String(contentsOf: url, encoding: .utf8) {
+            tag = raw
+        }
+        let version = displayVersion(shortVersion: short, releaseTag: tag)
 
         let url = bundle.executableURL ?? bundle.bundleURL
         let buildDate: String
@@ -37,4 +43,15 @@ public enum ArtefactFiles {
 
         return (version, build, buildDate)
     }
+
+    /// About "Version:" string from the release tag + marketing version
+    /// (#189): `v2.0.0-pre2 (2.0.0)`; dedupes to `v2.0.0` on an exact
+    /// release tag; falls back to the short version when untagged.
+    static func displayVersion(shortVersion: String, releaseTag: String) -> String {
+        let tag = releaseTag.trimmingCharacters(in: .whitespacesAndNewlines)
+        if tag.isEmpty || tag == shortVersion || tag == "v\(shortVersion)" {
+            return tag.isEmpty ? shortVersion : tag
+        }
+        return "\(tag) (\(shortVersion))"
+    }
 }

README.md

@@ -25,7 +25,8 @@ as AGPLv3 child processes. The GUI never `dlopen`s or links Argyll.
 | M7 | Pre-UAT hardening — shipped |
 | M8 | Deduplication contracts & UAT-ready hardening (#79–#86) — shipped |
 | M9 | macOS 12 / Xcode 14.2 retarget (PR #145) — shipped |
-| M10 | Studio workflow: gamut compare (#147), Spot Read (#148), project files (#149) shipped on `develop`; media library (#146) is in the tree, issue still open |
+| M10 | Studio workflow: media library (#146), gamut compare (#147), Spot Read (#148), project files (#149) — shipped on `develop` |
+| M11 | Printer settings completeness & dialog binding (#183, #180, #181, #186) — in flight on `milestone/m11-print-settings` |
 | Licence | Proprietary source in [`LICENCE.md`](LICENCE.md); bundled Argyll sidecars remain AGPLv3 |
 
 ## What it does
@@ -125,7 +126,35 @@ The script builds with a fixed derived data path (`build/DerivedData`), locates
 `Release/ICCery.app` from it, signs the bundle, recursively verifies every
 bundled Mach-O sidecar (`scripts/verify-sidecar-signatures.sh`), builds a
 HiDPI TIFF from `Resources/dmg-background.png` (+ `@2x`) via `tiffutil`, and
-writes `ICCery-${VERSION}-${BUILD_NUM}.dmg` with `dmgbuild==1.6.7`.
+writes the DMG with `dmgbuild==1.6.7`.
+
+### Versioning
+
+`scripts/version.sh` resolves the version triple and is the single source for
+packaging and CI:
+
+- **`ICCERY_RELEASE_TAG`** — `RELEASE_TAG` env when it matches `v[0-9]*` (CI
+  tag builds), else `git describe --tags --always --dirty --match 'v[0-9]*'`.
+  Stamped into the bundle's `ICCeryReleaseTag` resource (a generated
+  Info.plist cannot carry custom keys); the About dialog shows
+  `tag (marketing)` — e.g. `v2.0.0-pre2-grok (2.0.0)` — falling back to the
+  plain version when untagged.
+- **`MARKETING_VERSION`** (`CFBundleShortVersionString`) — first three numeric
+  components of the tag core. Must equal `project.yml`'s
+  `MARKETING_VERSION` on tag builds — packaging hard-fails on mismatch, so
+  bump `project.yml` on `develop` *before* tagging.
+- **`CURRENT_PROJECT_VERSION`** (`CFBundleVersion`) — `BUILD_NUMBER` env
+  override, else `git rev-list --count HEAD`. A single monotonically
+  increasing integer per Apple's macOS convention (Mac build numbers never
+  reset per version, unlike iOS).
+
+Tagged/described DMGs carry the tag: `ICCery-2.0.0-pre2-grok-<build>.dmg`;
+plain releases keep `ICCery-<ver>-<build>.dmg`.
+
+Release procedure: bump `MARKETING_VERSION` in `project.yml` on `develop` →
+merge `develop` → `main` → tag the release commit `vX.Y.Z[-suffix]` → push
+the tag. CI builds, signs, notarizes (when secrets exist) and attaches the
+DMG to the release.
 
 Sidecars stay ad-hoc signed inside the bundle — the app is never
 `codesign --deep`ed.
@@ -145,6 +174,8 @@ Environment variables read by the pipeline:
 | `CODESIGN_IDENTITY` | Developer ID identity for the outer `.app`; unset or `-` = ad-hoc |
 | `DEVELOPMENT_TEAM` | team ID passed to `xcodebuild` when signing |
 | `NOTARIZE_APPLE_ID` / `NOTARIZE_PASSWORD` / `APPLE_TEAM_ID` | `notarytool` + staple when all three are set |
+| `RELEASE_TAG` | release tag string (CI sets `github.ref_name`); stamped into the bundle + DMG name |
+| `BUILD_NUMBER` | `CFBundleVersion` override; default `git rev-list --count HEAD` |
 
 ## Layout
 
@@ -206,9 +237,13 @@ xcodebuild test -scheme ICCery -destination 'platform=macOS' \
   -only-testing:ICCeryUITests/Milestone5UITests
 ```
 
-CI (`.gitea/workflows/macos.yml`) runs `build-and-test` then `package` on
+CI (`.gitea/workflows/macos.yml` on Gitea, `.github/workflows/macos.yml` on
+GitHub) runs `build-and-test` then `package` on
 `develop` and on `v*` tags. Tags whose name contains `prerelease` skip the
 test job and still package. `pull_request` is wired for **`develop` only**.
+The GitHub file is the same pipeline on `macos-14` (github.com retired
+`macos-12`), `actions/upload-artifact@v4`, and `gh release upload` for tag
+DMGs.
 
 UI tests need an unlocked console (`IOConsoleLocked=false`). Mock Argyll /
 CUPS fixtures live under the test bundles; they must not be treated as proof
@@ -264,9 +299,9 @@ fix/<issue>-<slug>
 ```
 
 Open feature/fix PRs against **`develop`**. A `milestone/m…` integration
-branch is used only while that milestone is assembling; `milestone/m10-studio`
+branch is used only while that milestone is assembling — currently
-has been merged and deleted. Do not open umbrella “bugfix” branches that mix
+`milestone/m11-print-settings` (`milestone/m10-studio` was merged and
-tickets.
+deleted). Do not open umbrella “bugfix” branches that mix tickets.
 
 `main` is push-protected and requires status check
 `macOS CI / build-and-test (push)`. Protected **file** patterns on `main`

Sources/ICCery/AboutView.swift

@@ -6,6 +6,8 @@ import ICCeryCore
 struct AboutView: View {
     let onClose: () -> Void
 
+    @State private var showingLicenses = false
+
     private let info = ArtefactFiles.appInfo()
 
     var body: some View {
@@ -54,6 +56,12 @@ struct AboutView: View {
                 .foregroundStyle(.secondary)
                 .multilineTextAlignment(.center)
 
+            Button("View Licenses") {
+                showingLicenses = true
+            }
+            .controlSize(.large)
+            .accessibilityIdentifier("viewLicensesBtn")
+
             Button("Close") {
                 onClose()
             }
@@ -66,5 +74,8 @@ struct AboutView: View {
         .background(Theme.panel)
         .accessibilityElement(children: .contain)
         .accessibilityIdentifier("aboutDialog")
+        .sheet(isPresented: $showingLicenses) {
+            LicenseWindowView()
+        }
     }
 }

Sources/ICCery/ICCeryApp.swift

@@ -56,10 +56,41 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
     }
 
     /// docs/21 §Shell: 1280×800 content, min 1100×700, centred.
+    /// GitHub-hosted Macs (and any display smaller than 1280×800) must
+    /// not get a window that hangs off-screen — XCTest then reports
+    /// sidebar controls at negative x as not hittable (run 34864198118).
     private func configureMainWindow(_ window: NSWindow) {
-        window.setContentSize(NSSize(width: 1280, height: 800))
+        let desired = NSSize(width: 1280, height: 800)
-        window.contentMinSize = NSSize(width: 1100, height: 700)
+        let minimum = NSSize(width: 1100, height: 700)
+        let visible = (window.screen ?? NSScreen.main)?.visibleFrame
+            ?? NSRect(origin: .zero, size: desired)
+
+        window.contentMinSize = NSSize(
+            width: min(minimum.width, visible.width),
+            height: min(minimum.height, visible.height)
+        )
+        window.setContentSize(NSSize(
+            width: min(desired.width, visible.width),
+            height: min(desired.height, max(minimum.height, visible.height - 40))
+        ))
         window.center()
+
+        var frame = window.frame
+        if frame.width > visible.width {
+            frame.size.width = visible.width
+        }
+        if frame.height > visible.height {
+            frame.size.height = visible.height
+        }
+        frame.origin.x = min(
+            max(frame.origin.x, visible.minX),
+            visible.maxX - frame.width
+        )
+        frame.origin.y = min(
+            max(frame.origin.y, visible.minY),
+            visible.maxY - frame.height
+        )
+        window.setFrame(frame, display: true)
     }
 
     /// Dock-click reopen: let the WindowGroup re-show or recreate the

Sources/ICCery/LicenseWindowView.swift

@@ -0,0 +1,148 @@
+import AppKit
+import SwiftUI
+
+/// Detailed license and attribution window (issue #31, docs/21 §Modals).
+struct LicenseWindowView: View {
+    @Environment(\.dismiss) private var dismiss
+
+    private let icceryLicense: String
+    private let argyllLicense: String
+
+    init() {
+        // ICCery license from LICENCE.md (embedded at compile time)
+        self.icceryLicense = """
+# LICENCE
+
+**Copyright (c) 2026 Gordon Bolton**  
+**All Rights Reserved.**
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), strictly to view the source code and execute the Software for the sole purpose of personal testing, evaluation, and providing feedback.
+
+Under this licence, you may **not**:
+
+* Modify, alter, or create derivative works of the Software.
+* Distribute, publish, or sublicense the Software or any derivatives.
+* Use the Software for any commercial or production purpose.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
+## Bundled ArgyllCMS sidecar binaries
+
+This application bundles and invokes command-line binaries from the Gronod fork of ArgyllCMS. Those binaries are licensed separately under the **GNU Affero General Public License v3 (AGPLv3)**. They are executed strictly as independent subprocesses — they are never linked, loaded, or incorporated into this application — and a copy of `License.txt` is shipped beside the binaries in `Resources/Argyll/`. The terms above apply only to the ICCery application source code, not to the ArgyllCMS binaries.
+"""
+
+        // ArgyllCMS license from bundled License.txt
+        if let url = Bundle.main.url(forResource: "License", withExtension: "txt", subdirectory: "Argyll"),
+           let content = try? String(contentsOf: url, encoding: .utf8) {
+            self.argyllLicense = content
+        } else {
+            self.argyllLicense = """
+ArgyllCMS license not found — run `scripts/fetch-argyll.sh` to bundle binaries and license.
+
+The ArgyllCMS binaries are licensed under the GNU Affero General Public License v3 (AGPLv3).
+A copy of the license should be present at Resources/Argyll/License.txt.
+
+See: https://git.i3omb.com/gronod/argyllcms/releases
+"""
+        }
+    }
+
+    var body: some View {
+        VStack(spacing: 0) {
+            // Title bar
+            HStack {
+                Text("Licenses & Attribution")
+                    .font(.headline)
+                    .foregroundStyle(Theme.text)
+                Spacer()
+                Button("Close") {
+                    dismiss()
+                }
+                .keyboardShortcut(.cancelAction)
+                .accessibilityIdentifier("closeLicenseBtn")
+            }
+            .padding(.horizontal, 20)
+            .padding(.vertical, 12)
+            .background(Theme.panel.opacity(0.9))
+
+            Divider()
+
+            ScrollView {
+                VStack(alignment: .leading, spacing: 24) {
+                    // Section 1: ICCery License
+                    licenseSection(
+                        title: "ICCery License",
+                        content: icceryLicense,
+                        identifier: "icceryLicenseSection"
+                    )
+
+                    Divider()
+
+                    // Section 2: ArgyllCMS License
+                    licenseSection(
+                        title: "ArgyllCMS License (AGPLv3)",
+                        content: argyllLicense,
+                        identifier: "argyllLicenseSection"
+                    )
+
+                    Divider()
+
+                    // Section 3: Attribution & Links
+                    VStack(alignment: .leading, spacing: 12) {
+                        Text("Attribution & Links")
+                            .font(.headline)
+                            .foregroundStyle(Theme.text)
+                            .accessibilityIdentifier("attributionHeader")
+
+                        VStack(alignment: .leading, spacing: 8) {
+                            Link("ArgyllCMS by Graeme Gill → https://www.argyllcms.com/",
+                                 destination: URL(string: "https://www.argyllcms.com/")!)
+                                .font(.callout)
+                                .foregroundStyle(Theme.accent)
+                                .accessibilityIdentifier("argyllUpstreamLink")
+
+                            Link("Gronod ArgyllCMS fork (v3.5.0-ICCery.1.x) → https://git.i3omb.com/gronod/argyllcms",
+                                 destination: URL(string: "https://git.i3omb.com/gronod/argyllcms")!)
+                                .font(.callout)
+                                .foregroundStyle(Theme.accent)
+                                .accessibilityIdentifier("argyllForkLink")
+                        }
+
+                        Text("ICCery bundles and invokes ArgyllCMS binaries as isolated subprocesses per AGPLv3 isolation requirements. The ArgyllCMS binaries are never linked, loaded, or incorporated into the ICCery application binary.")
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                            .fixedSize(horizontal: false, vertical: true)
+                            .accessibilityIdentifier("agplIsolationNote")
+                    }
+                    .padding(.horizontal, 4)
+                    .accessibilityElement(children: .contain)
+                    .accessibilityIdentifier("attributionSection")
+                }
+                .padding(24)
+            }
+            .frame(minWidth: 600, minHeight: 500)
+            .background(Theme.panel)
+        }
+        .accessibilityElement(children: .contain)
+        .accessibilityIdentifier("licenseWindow")
+    }
+
+    private func licenseSection(title: String, content: String, identifier: String) -> some View {
+        VStack(alignment: .leading, spacing: 8) {
+            Text(title)
+                .font(.headline)
+                .foregroundStyle(Theme.text)
+                .accessibilityIdentifier(identifier + "Header")
+
+            Text(content)
+                .font(.system(.body, design: .monospaced))
+                .foregroundStyle(Theme.text)
+                .textSelection(.enabled)
+                .frame(maxWidth: .infinity, alignment: .leading)
+                .accessibilityIdentifier(identifier + "Content")
+        }
+        .padding(.horizontal, 4)
+    }
+}

Tests/ICCeryCoreTests/ArtefactFilesTests.swift

@@ -102,6 +102,62 @@ final class TiffPreviewTests: XCTestCase {
     }
 }
 
+final class AppInfoTests: XCTestCase {
+    // MARK: displayVersion (#189)
+
+    func testNoTagFallsBackToShortVersion() {
+        XCTAssertEqual(
+            ArtefactFiles.displayVersion(shortVersion: "2.0.0", releaseTag: ""),
+            "2.0.0"
+        )
+    }
+
+    func testWhitespaceTagFallsBackToShortVersion() {
+        XCTAssertEqual(
+            ArtefactFiles.displayVersion(shortVersion: "2.0.0", releaseTag: "  "),
+            "2.0.0"
+        )
+    }
+
+    func testExactReleaseTagDedupes() {
+        XCTAssertEqual(
+            ArtefactFiles.displayVersion(shortVersion: "2.0.0", releaseTag: "v2.0.0"),
+            "v2.0.0"
+        )
+    }
+
+    func testBareVersionTagDedupes() {
+        XCTAssertEqual(
+            ArtefactFiles.displayVersion(shortVersion: "2.0.0", releaseTag: "2.0.0"),
+            "2.0.0"
+        )
+    }
+
+    func testPrereleaseTagShowsMarketingInParens() {
+        XCTAssertEqual(
+            ArtefactFiles.displayVersion(
+                shortVersion: "2.0.0", releaseTag: "v2.0.0-pre2-grok"),
+            "v2.0.0-pre2-grok (2.0.0)"
+        )
+    }
+
+    func testDescribeStringShowsMarketingInParens() {
+        XCTAssertEqual(
+            ArtefactFiles.displayVersion(
+                shortVersion: "2.0.0", releaseTag: "v2.0.0-5-gdeadbee"),
+            "v2.0.0-5-gdeadbee (2.0.0)"
+        )
+    }
+
+    func testAppInfoUsesComposedVersion() {
+        // .main in the test host is the ICCery app under test; whatever it
+        // resolves to, build must be a non-empty digits-or-default string.
+        let info = ArtefactFiles.appInfo()
+        XCTAssertFalse(info.version.isEmpty)
+        XCTAssertFalse(info.build.isEmpty)
+    }
+}
+
 final class ArtefactFilesTests: XCTestCase {
     func testBase64RoundTrip() throws {
         let url = tempURL("a.txt")

Tests/ICCeryUITests/AboutHelpUITests.swift

@@ -20,6 +20,13 @@ final class AboutHelpUITests: XCTestCase {
     private func element(_ id: String) -> XCUIElement {
         let inApp = app.descendants(matching: .any)[id].firstMatch
         if inApp.exists { return inApp }
+        // Search all sheets (including nested sheets) for the element.
+        // The license window is a nested sheet (sheet presented from AboutView).
+        for sheet in app.sheets.allElementsBoundByIndex {
+            let inSheet = sheet.descendants(matching: .any)[id].firstMatch
+            if inSheet.exists { return inSheet }
+        }
+        // Fallback to original behavior
         return app.sheets.firstMatch.descendants(matching: .any)[id].firstMatch
     }
 
@@ -85,4 +92,139 @@ final class AboutHelpUITests: XCTestCase {
                        "Toggling global help must not reflow the sidebar.")
         XCTAssertTrue(app.descendants(matching: .any)["openSettingsBtn"].exists)
     }
+
+    func testAboutDialogShowsViewLicensesButton() throws {
+        launchApp()
+
+        let openAbout = app.buttons["openAboutBtn"]
+        XCTAssertTrue(openAbout.waitForExistence(timeout: 10))
+        openAbout.click()
+
+        _ = waitFor("aboutVersion", timeout: 10)
+
+        let viewLicensesBtn = waitFor("viewLicensesBtn", timeout: 10)
+        XCTAssertTrue(viewLicensesBtn.exists)
+        viewLicensesBtn.click()
+
+        // License window should open as a sheet
+        _ = waitFor("licenseWindow", timeout: 10)
+        XCTAssertTrue(element("licenseWindow").exists)
+
+        // Close license window
+        let closeLicenseBtn = waitFor("closeLicenseBtn", timeout: 5)
+        closeLicenseBtn.click()
+
+        // License window should be dismissed
+        XCTAssertFalse(element("licenseWindow").exists)
+
+        // Close about dialog
+        let closeAboutBtn = waitFor("closeAboutBtn", timeout: 5)
+        closeAboutBtn.click()
+        XCTAssertFalse(element("aboutDialog").exists)
+    }
+
+    func testLicenseWindowShowsICCeryLicense() throws {
+        launchApp()
+
+        let openAbout = app.buttons["openAboutBtn"]
+        XCTAssertTrue(openAbout.waitForExistence(timeout: 10))
+        openAbout.click()
+
+        let viewLicensesBtn = waitFor("viewLicensesBtn", timeout: 10)
+        viewLicensesBtn.click()
+
+        _ = waitFor("licenseWindow", timeout: 10)
+
+        // Verify ICCery license section exists
+        let icceryLicenseSection = waitFor("icceryLicenseSectionHeader", timeout: 5)
+        XCTAssertTrue(icceryLicenseSection.exists)
+
+        // Verify ICCery license content contains key phrases
+        let icceryLicenseContent = element("icceryLicenseSectionContent")
+        XCTAssertTrue(icceryLicenseContent.waitForExistence(timeout: 5))
+        let licenseText = icceryLicenseContent.value as? String ?? ""
+        XCTAssertTrue(licenseText.contains("Copyright (c) 2026 Gordon Bolton"))
+        XCTAssertTrue(licenseText.contains("All Rights Reserved"))
+        XCTAssertTrue(licenseText.contains("AGPLv3"))
+
+        // Close license window
+        let closeLicenseBtn = waitFor("closeLicenseBtn", timeout: 5)
+        closeLicenseBtn.click()
+
+        let closeAboutBtn = waitFor("closeAboutBtn", timeout: 5)
+        closeAboutBtn.click()
+    }
+
+    func testLicenseWindowShowsArgyllLicense() throws {
+        launchApp()
+
+        let openAbout = app.buttons["openAboutBtn"]
+        XCTAssertTrue(openAbout.waitForExistence(timeout: 10))
+        openAbout.click()
+
+        let viewLicensesBtn = waitFor("viewLicensesBtn", timeout: 10)
+        viewLicensesBtn.click()
+
+        _ = waitFor("licenseWindow", timeout: 10)
+
+        // Verify ArgyllCMS license section exists
+        let argyllLicenseSection = waitFor("argyllLicenseSectionHeader", timeout: 5)
+        XCTAssertTrue(argyllLicenseSection.exists)
+
+        // Verify Argyll license content exists (may be fallback if License.txt not bundled)
+        let argyllLicenseContent = element("argyllLicenseSectionContent")
+        XCTAssertTrue(argyllLicenseContent.waitForExistence(timeout: 5))
+        let licenseText = argyllLicenseContent.value as? String ?? ""
+        // Should contain either the actual AGPLv3 license or the fallback notice
+        XCTAssertTrue(licenseText.contains("AGPLv3") || licenseText.contains("GNU Affero General Public License") || licenseText.contains("fetch-argyll"))
+
+        // Close license window
+        let closeLicenseBtn = waitFor("closeLicenseBtn", timeout: 5)
+        closeLicenseBtn.click()
+
+        let closeAboutBtn = waitFor("closeAboutBtn", timeout: 5)
+        closeAboutBtn.click()
+    }
+
+    func testLicenseWindowShowsAttributionLinks() throws {
+        launchApp()
+
+        let openAbout = app.buttons["openAboutBtn"]
+        XCTAssertTrue(openAbout.waitForExistence(timeout: 10))
+        openAbout.click()
+
+        let viewLicensesBtn = waitFor("viewLicensesBtn", timeout: 10)
+        viewLicensesBtn.click()
+
+        _ = waitFor("licenseWindow", timeout: 10)
+
+        // Verify attribution section exists
+        let attributionHeader = waitFor("attributionHeader", timeout: 5)
+        XCTAssertTrue(attributionHeader.exists)
+
+        // Verify upstream link
+        let upstreamLink = element("argyllUpstreamLink")
+        XCTAssertTrue(upstreamLink.waitForExistence(timeout: 5))
+        let upstreamLabel = upstreamLink.label
+        XCTAssertTrue(upstreamLabel.contains("Graeme Gill") || upstreamLabel.contains("argyllcms.com"))
+
+        // Verify fork link
+        let forkLink = element("argyllForkLink")
+        XCTAssertTrue(forkLink.waitForExistence(timeout: 5))
+        let forkLabel = forkLink.label
+        XCTAssertTrue(forkLabel.contains("Gronod") || forkLabel.contains("git.i3omb.com"))
+
+        // Verify AGPL isolation note
+        let isolationNote = element("agplIsolationNote")
+        XCTAssertTrue(isolationNote.waitForExistence(timeout: 5))
+        let noteText = isolationNote.value as? String ?? ""
+        XCTAssertTrue(noteText.contains("isolated subprocesses") || noteText.contains("AGPLv3 isolation"))
+
+        // Close license window
+        let closeLicenseBtn = waitFor("closeLicenseBtn", timeout: 5)
+        closeLicenseBtn.click()
+
+        let closeAboutBtn = waitFor("closeAboutBtn", timeout: 5)
+        closeAboutBtn.click()
+    }
 }

Tests/ICCeryUITests/Milestone2UITests.swift

@@ -36,6 +36,7 @@ final class Milestone2UITests: XCTestCase {
             "ICCERY_UI_TESTING": "1",
             "ICCERY_TEST_ROOT": testRoot.path,
             "ICCERY_ARGYLL_BINARY_DIR": binDir.path,
+            "ICCERY_CUPS_BIN_DIR": binDir.path,
             "ICCERY_TEST_SAVE_TARGET":
                 workDir.appendingPathComponent("mytarget.ti1").path,
             "ICCERY_TEST_WORKDIR": workDir.path,
@@ -218,11 +219,12 @@ final class Milestone2UITests: XCTestCase {
         XCTAssertTrue(FileManager.default.fileExists(
             atPath: workDir.appendingPathComponent("mytarget.ti2").path))
 
-        // Print panel is live from M3; a default printer is selected
+        // Print panel is live from M3. GitHub macos-14 has no system
-        // so both the all-pages and per-page print buttons are enabled.
+        // queues, so mock CUPS (`ICCERY_CUPS_BIN_DIR`) must enumerate
+        // before Print All / per-page enable (run 34867767434).
         XCTAssertTrue(element("rawPrintPanel").exists)
-        XCTAssertTrue(app.buttons["btnPrintAll"].isEnabled)
+        _ = waitUntilEnabled("btnPrintAll", timeout: 15)
-        XCTAssertTrue(app.buttons["btnPrintPage-0"].isEnabled)
+        _ = waitUntilEnabled("btnPrintPage-0", timeout: 15)
         XCTAssertTrue(app.buttons["btnAdvanceToStage3"].isEnabled)
     }
 

Tests/ICCeryUITests/Milestone4UITests.swift

@@ -98,23 +98,9 @@ final class Milestone4UITests: XCTestCase {
         app.buttons["btnDetectInstruments"].click()
         _ = waitFor("chartreadInstrumentSelect", timeout: 20)
 
-        // Keep Auto (port 1) and start the session.
+        // Wait until Start is enabled before clicking. Existence-only
-        XCTAssertTrue(app.buttons["btnStartRead"].waitForExistence(timeout: 5))
+        // clicks are no-ops on the disabled control (runs 35251, 35293).
-        app.buttons["btnStartRead"].click()
+        driveOnePass(startButton: "btnStartRead")
-
-        // Calibrate.
-        let calibrate = element("btnCalibrate")
-        if !calibrate.waitForExistence(timeout: 25) {
-            let error = element("chartreadLastError").label
-            let value = element("chartreadLastError").value as? String ?? "<nil>"
-            XCTFail("No calibrate button. lastError.label='\(error)' value='\(value)'")
-        }
-        app.buttons["btnCalibrate"].click()
-
-        // Trigger each strip until all are read → Done & Save appears.
-        driveStripsUntilDone()
-        XCTAssertTrue(element("btnDoneRead").exists)
-        app.buttons["btnDoneRead"].firstMatch.click()
 
         // Averaging panel appears with one pass snapshot.
         _ = waitFor("chartreadAveragingPanel", timeout: 20)
@@ -168,15 +154,34 @@ final class Milestone4UITests: XCTestCase {
 
     /// Runs the mock handheld chartread session to completion
     /// (start → calibrate → strip A → strip B → Done & Save).
+    ///
+    /// `isEnabled` can be true in AX while the SwiftUI action is still
+    /// a no-op (runs 35251, 35443). Re-click until the session is
+    /// actually running (`btnCancel` is shown whenever
+    /// `isChartreadRunning`), then wait for Calibrate.
     private func driveOnePass(startButton: String) {
         let start = app.buttons[startButton]
-        XCTAssertTrue(start.waitForExistence(timeout: 10))
+        XCTAssertTrue(start.waitForExistence(timeout: 10), startButton)
-        let deadline = Date().addingTimeInterval(10)
+        let enabledBy = Date().addingTimeInterval(10)
-        while Date() < deadline, !start.isEnabled {
+        while Date() < enabledBy, !start.isEnabled {
             RunLoop.current.run(until: Date().addingTimeInterval(0.1))
         }
-        XCTAssertTrue(start.isEnabled)
+        XCTAssertTrue(start.isEnabled, "\(startButton) never enabled")
-        start.click()
+
+        let sessionBy = Date().addingTimeInterval(25)
+        while Date() < sessionBy, !chartreadSessionRunning {
+            if start.exists, start.isEnabled {
+                start.click()
+            }
+            RunLoop.current.run(until: Date().addingTimeInterval(0.4))
+        }
+        XCTAssertTrue(
+            chartreadSessionRunning,
+            "\(startButton) click never started chartread; "
+                + "notice=\(element("noticeText").value as? String ?? "") "
+                + "start.exists=\(start.exists)"
+        )
+
         _ = waitFor("btnCalibrate", timeout: 25)
         app.buttons["btnCalibrate"].click()
         driveStripsUntilDone()
@@ -184,6 +189,14 @@ final class Milestone4UITests: XCTestCase {
         app.buttons["btnDoneRead"].firstMatch.click()
     }
 
+    /// `btnCancel` is in the tree for the whole chartread session;
+    /// Calibrate/Trigger only appear after the first classified prompt.
+    private var chartreadSessionRunning: Bool {
+        element("btnCancel").exists
+            || element("btnCalibrate").exists
+            || element("btnTrigger").exists
+    }
+
     /// Clicks Trigger for each remaining strip until `btnDoneRead`
     /// appears — the button is re-polled each pass so a click that
     /// races a state transition isn't lost.

docs/21-ui-reference.md

@@ -69,7 +69,7 @@ Keyboard: **R** resets gamut camera when Stage 5 is visible. Bind to a focusable
 | Dialog | Root id | Controls |
 |--------|---------|----------|
 | Settings | `settingsDialog` | `settingsDeltaEGood`, `settingsDeltaEWarning`, `settingsCalStaleDays`; other controls listed in [22](22-settings-presets.md) |
-| About | `aboutDialog` | `aboutVersion`, `aboutBuildDate` from `get_app_info`, `closeAboutBtn` |
+| About | `aboutDialog` | `aboutVersion` (release tag + marketing, e.g. `v2.0.0-pre2 (2.0.0)`), `aboutBuildDate` from `get_app_info`, `closeAboutBtn` |
 | Save preset | `savePresetDialog` | `savePresetName`, `savePresetDesc`, `btnConfirmSavePreset`, `btnCloseSavePresetDialog` |
 | Manage presets | `managePresetsDialog` | `managePresetsList`, `btnExportActivePreset`, `btnImportPreset`, `btnCloseManagePresetsDialog` |
 | Save media recipe | `saveMediaRecipeDialog` | `saveMediaName`, `saveMediaNotes`, `saveMediaPaper`, `saveMediaInk`, `saveMediaPrinter`, `saveMediaPreset`, `saveMediaColourSpace`, `saveMediaCal`, `saveMediaApplyCal`, `btnConfirmSaveMedia`, `btnCloseSaveMediaDialog` |

docs/PREUAT.md

@@ -43,6 +43,8 @@ Do not install Argyll to `$PATH`. ICCery never searches `$PATH` for binaries.
 | `NOTARIZE_APPLE_ID` | Apple ID for `notarytool` |
 | `NOTARIZE_PASSWORD` | App-specific password for `notarytool` |
 | `APPLE_TEAM_ID` | Team ID for `notarytool` |
+| `RELEASE_TAG` | Optional. Simulates a tag build (`vX.Y.Z[-suffix]`); stamped into the bundle and DMG name |
+| `BUILD_NUMBER` | Optional `CFBundleVersion` override; default `git rev-list --count HEAD` |
 
 Invocation for a signed, notarized DMG:
 
@@ -56,7 +58,8 @@ export APPLE_TEAM_ID="TEAMID"
 scripts/package-release.sh
 ```
 
-The script will emit `ICCery-<version>-<build>.dmg`. After mounting, verify Gatekeeper acceptance:
+The script will emit `ICCery-<version>-<build>.dmg` (or `ICCery-<tag>-<build>.dmg`
+when `RELEASE_TAG`/a `v*` git tag applies). After mounting, verify Gatekeeper acceptance:
 
 ```
 spctl -a -t open --context context:primary-signature -v ICCery-*.dmg

docs/ui-interactive-map-sheets.puml

@@ -1,89 +0,0 @@
-@startuml ICCery-UI-sheets
-title Sheets  Settings, presets, media, Spot Read, Gamut, project
-!theme plain
-skinparam backgroundColor white
-skinparam defaultFontColor black
-skinparam defaultFontSize 13
-skinparam mapBackgroundColor white
-skinparam mapBorderColor #222222
-skinparam mapFontColor black
-skinparam arrowColor #222222
-skinparam shadowing false
-hide circle
-top to bottom direction
-
-map "SettingsView.swift" as set {
-  Argyll dir => TextField+Browse : empty = bundled
-  Default instrument => Picker : seeds Stage 3 and Spot Read
-  Enable i1Pro 2 LEDs => Toggle
-  settingsDeltaEGood => TextField
-  settingsDeltaEWarning => TextField : must be greater than Good
-  settingsCalStaleDays => TextField
-  Install location => Picker User or System
-  Ask before overwriting => Toggle
-  Open ColorSync after install => Toggle
-  Log level => Picker
-  Open log folder => Button
-  Cancel / Save => Save stays if validation fails
-}
-
-map "Presets  PresetDialogs.swift" as pre {
-  savePresetName => TextField
-  savePresetDesc => TextField
-  btnCloseSavePresetDialog => Button
-  btnConfirmSavePreset => Button : disabled if name empty
-  presetRow-id => Row : built-in cannot delete
-  btnImportPreset => Button
-  btnExportActivePreset => Button : custom selected
-  btnCloseManagePresetsDialog => Button
-}
-
-map "Media  MediaLibraryDialogs.swift" as media {
-  saveMediaName/Paper/Ink => TextField
-  saveMediaApplyCal => Toggle : disabled if CAL_ or missing file
-  btnConfirmSaveMedia => Button : name+paper+ink required
-  mediaLibraryList => List
-  btnMediaLibraryApply-id => Button per row
-  manageMediaNotice => Caption : failed Apply in-sheet
-  btnMediaLibraryApply => Button : disabled if no selection
-  btnCloseManageMediaDialog => Button
-}
-
-map "spotReadView  SpotReadView.swift" as spot {
-  btnSpotDetectInstruments => Button
-  spotInstrumentSelect => Picker : disabled while running
-  spotSetDefault => Toggle
-  btnSpotStart => Button : needs sidecar, cwd, not chartread
-  btnSpotCalibrate => Button : calibrating
-  btnSpotTrigger => Button : Read, awaitingStrip
-  btnSpotStop => Button : while running
-  btnSpotCopyLab => Button : disabled if no sample
-  btnSpotExportCsv => Button : disabled if no history
-  btnCloseSpotRead => Button Esc : dismiss = Stop
-}
-
-map "gamutView  GamutView.swift" as gam {
-  gamutLayer-srgb => Toggle : can hide, cannot remove
-  gamutLayer-profile => Toggle : disabled if no .gam
-  gamutLayer-compare => Toggle : disabled if no compare
-  btnGamutAddCompare => Menu
-  btnGamutRemoveCompare => Button
-  btnGamutSampleTiff => Button
-  btnResetGamutCamera => Button R
-  gamutLabEntryL/A/B => TextField
-  btnGamutInspectLab => Button
-  btnCloseGamut => Button Esc
-}
-
-map "Project alerts" as proj {
-  projectNewAlert => Alert : New Cancel / Confirm
-  Dirty save => Alert : Save / Don't Save / Cancel
-  projectRelocateSheet => Sheet : cwd missing on Open
-}
-
-set -[hidden]down- pre
-pre -[hidden]down- media
-media -[hidden]down- spot
-spot -[hidden]down- gam
-gam -[hidden]down- proj
-@enduml

docs/ui-interactive-map-shell.puml

@@ -1,81 +0,0 @@
-@startuml ICCery-UI-shell
-title Shell, sidebar, stepper, File menu
-!theme plain
-skinparam backgroundColor white
-skinparam defaultFontColor black
-skinparam defaultFontSize 13
-skinparam mapBackgroundColor white
-skinparam mapBorderColor #222222
-skinparam mapFontColor black
-skinparam arrowColor #222222
-skinparam shadowing false
-hide circle
-top to bottom direction
-
-map "Window" as win {
-  WindowGroup => ICCeryApp.swift : 1280x800 min 1100x700
-  RootView => RootView.swift : hosts every sheet
-  noticeText => NoticeBanner : shown if wizard.notice set; auto-hide 6s
-}
-
-map "Sidebar header" as hdr {
-  openSettingsBtn => Button : always / Settings sheet
-  openAboutBtn => Button : always / About
-  btnToggleAllHelp => Button : toggles yellow help dots
-}
-
-map "Presets" as pre {
-  presetSelect => Picker.menu : none + preset id; none is not factory reset
-  btnSavePresetModal => Button : always
-  btnOpenPresetsDialog => Button : always
-}
-
-map "Media library" as med {
-  mediaSelect => Picker.menu : never reuses presetSelect
-  mediaRecipeStale => Caption : shown if staleReasons nonempty
-  btnMediaLibraryCapture => Button : disabled if no Stage 2 printer
-  btnMediaLibraryManage => Button : always
-}
-
-map "Studio (not stepper)" as stu {
-  btnCalibratePrinter => Button : always; Stage 0
-  btnViewGamut => Button : sidebar always on; same id as Stage 5
-  btnSpotRead => Button : disabled if no cwd or chartread running
-}
-
-map "Stepper 1-5  disk is truth" as stp {
-  Stage1 Generate => always
-  Stage2 Lay out => .ti1
-  Stage3 Measure => .ti1 AND .ti2
-  Stage4 Build => .ti3 (not .ti2 alone)
-  Stage5 Verify => .ti3 AND .icc/.icm
-  Calibrate => not a stepper row; always available
-}
-
-map "Project chip" as chip {
-  projectChipName => Text : bound name or No project
-  projectChipPath => Text : shown if bound
-  projectChipStale => Caption : diskBehindNotes
-  btnProjectReveal => Button : shown if bound
-  btnProjectSave => Button : canSave = bound + basename + cwd
-  btnProjectOpen => Button : shown if not bound
-}
-
-map "File menu" as menu {
-  menuProjectNew => Button Cmd-N
-  menuProjectOpen => Button Cmd-O
-  menuProjectRecents => Menu : disabled if recents empty
-  menuProjectSave => Button Cmd-S : !canSave
-  menuProjectSaveAs => Button Shift-Cmd-S : basename + cwd
-  menuProjectReport => Button : !canReport
-  menuProjectClose => Button : !isBound
-}
-
-win -[hidden]down- hdr
-hdr -[hidden]down- pre
-pre -[hidden]down- med
-med -[hidden]down- stu
-stu -[hidden]down- stp
-stp -[hidden]down- chip
-chip -[hidden]down- menu
-@enduml

docs/ui-interactive-map-stage1-2.puml

@@ -1,83 +0,0 @@
-@startuml ICCery-UI-stage1-2
-title Stages 1-2  Generate Target / Lay Out and Print
-!theme plain
-skinparam backgroundColor white
-skinparam defaultFontColor black
-skinparam defaultFontSize 13
-skinparam mapBackgroundColor white
-skinparam mapBorderColor #222222
-skinparam mapFontColor black
-skinparam arrowColor #222222
-skinparam shadowing false
-hide circle
-top to bottom direction
-
-map "stage-1  Stage1View.swift" as s1 {
-  colourSpace => Picker.segmented : RGB or CMYK
-  patchCountPreset => Picker
-  patchCountCustom => TextField : shown if preset is custom
-  whitePatches => Stepper 0-50
-  blackPatches => Stepper 0-50
-  targetBasename => TextField
-  btnBrowse => Button
-  btnSelectWorkDir => Button
-  btnOpenExisting => Button : .ti1 or .ti2
-  btn-import-dataset => Button : unlocks stage 4
-  selectedPathDisplay => Text
-  targenAdvancedDetails => DisclosureGroup : UI tests pre-expand
-  btnGenerate => Button : needs basename AND directory
-  targenLog => ProcessLogView
-}
-
-map "Stage 1 Advanced (inside disclosure)" as adv {
-  targenGreySteps => Toggle+field : field iff on
-  targenSingleChannelSteps => Toggle+field
-  targenNeutralSteps => Toggle+field
-  targenNeutralConcentration => Toggle+Slider 0-1
-  targenAdaptation => Toggle+Slider 0-1
-  targenPrecondProfile => TextField
-  btnBrowsePrecondProfile => Button
-  targenHighQuality => Toggle
-  targenAlgorithm => Picker
-  targenInkLimitGroup => Toggle+field : CMYK only
-  targenDarkEmphasis => Toggle+Slider 0-3
-  targenDevicePower => Toggle+Slider 0-3
-}
-
-map "stage-2  Stage2View.swift" as s2 {
-  cmWarningBanner => Banner : always on stage 2
-  instrumentSelect => Picker : chart code, not USB port
-  pageSizeSelect => Picker
-  customPageW / customPageH => TextField : pageSize custom
-  tiffDpi => Stepper 72-600
-  printtargLayoutOrder => Picker
-  printtargCustomSeed => TextField : custom seed order
-  btnToggleLabelEdit => Button
-  targetMetadataPrinter => TextField
-  targetMetadataInkSet => TextField
-  targetMetadataDriverPaper => TextField
-  targetMetadataActualPaper => TextField
-  targetLabelPreview => TextField or Text
-  btnCreateLayout => Button : disabled if no basename
-  tiffGallery => Grid : after printtarg
-  btnPrintPage-N => Button : disabled if no printer
-}
-
-map "rawPrintPanel" as prn {
-  printerSelect => Picker CUPS
-  printerStatusBadge => Caption
-  btnRefreshPrinters => Button
-  btnPrinterProperties => Button : disabled if no printer
-  printerTraySelect => Picker : if trays exist
-  printerMediaTypeSelect => Picker : if media types exist
-  btnOrientPortrait => Button
-  btnOrientLandscape => Button
-  btnPrintAll => Button : needs layout AND printer
-  btnAdvanceToStage3 => Button : needs .ti2 unlock
-  printNotificationText => Caption : if printNotice set
-}
-
-s1 -[hidden]down- adv
-adv -[hidden]down- s2
-s2 -[hidden]down- prn
-@enduml

docs/ui-interactive-map-stage3-5-cal.puml

@@ -1,84 +0,0 @@
-@startuml ICCery-UI-stage3-5-cal
-title Stages 3-5 and Calibrate Printer
-!theme plain
-skinparam backgroundColor white
-skinparam defaultFontColor black
-skinparam defaultFontSize 13
-skinparam mapBackgroundColor white
-skinparam mapBorderColor #222222
-skinparam mapFontColor black
-skinparam arrowColor #222222
-skinparam shadowing false
-hide circle
-top to bottom direction
-
-map "stage-3  Stage3View.swift" as s3 {
-  btnDetectInstruments => Button : disabled while detecting
-  chartreadInstrumentSelect => Picker.menu
-  xyTableHint => Caption : if XY instrument
-  xyTablePanel => Place/Align/Scan/Remove
-  chartreadPrompt => Text
-  chartreadLastError => Caption : if notice set
-  btnStartRead => Button : shown if not running; needs basename+cwd
-  btnCalibrate => Button : running and calibrating
-  btnTrigger => Button : running and awaitingStrip
-  btnDoneReadEarly => Button : awaitingStrip
-  btnAccept => Button : place / align / continue / warning
-  btnRetry => Button : error state
-  btnDoneRead => Button : allStripsRead
-  btnCancel => Button : while running
-  swatchGrid => swatch-rowId-loc
-  btnMeasureAnotherSheet => Button : after a finished pass
-  btnFinishAndAverage => Button : finished AND at least one pass
-}
-
-map "stage-4  Stage4View.swift" as s4 {
-  colprofAlgorithm => Picker
-  colprofQuality => Picker
-  colprofFwa => Picker
-  colprofFwaCustomPath => TextField : custom spectrum
-  btnBrowseFwaSp => Button
-  colprofIlluminant => TextField
-  colprofObserver => TextField
-  colprofInputViewCond => TextField
-  colprofOutputViewCond => TextField
-  colprofDescription => TextField
-  colprofCopyright => TextField
-  colprofApplyCalibration => Toggle
-  colprofCalibrationFile => TextField : if applyCalibration
-  btnBrowseCalibrationFile => Button : if applyCalibration
-  btnCreateProfile => Button : basename + cwd, not running
-}
-
-map "stage-5  Stage5View.swift" as s5 {
-  btnVerifyProfile => Button : needs created profile
-  btnViewGamut => Button : disabled if no .gam (same id as sidebar)
-  btnInstallProfile => Button : needs created profile
-  driftPrinterFilter => Picker
-  btnExportHistory => Button
-  btnClearHistory => Button
-  verificationHistoryTable => Table
-  driftChart => not interactive
-  profileOverwriteBtn => Alert : install collision
-  profileRenameBtn => Alert
-  profileCancelCollisionBtn => Alert
-}
-
-map "stage-cal  CalibrationView.swift" as cal {
-  Colour space => Picker.segmented : no a11y id
-  calSteps => TextField
-  White patches => TextField : no a11y id
-  calInkExplore => TextField : CMYK only
-  calNeutralEmphasis => Toggle
-  btnCalGenerate => Button : needs basename + cwd
-  btnCalLayout => Button : same
-  btnCalMeasure => Button : needs .ti3
-  btnCalCompute => Button : .ti3 and not computing
-  calApplyToggle => Toggle : after curves exist
-  btnCalReturn => Button Esc : restores original basename
-}
-
-s3 -[hidden]down- s4
-s4 -[hidden]down- s5
-s5 -[hidden]down- cal
-@enduml

docs/ui-interactive-map.md

@@ -1,12 +0,0 @@
-# Interactive UI map
-
-PlantUML **maps** (not class diagrams). Class diagrams laid out 6500px wide, so Gitea on a phone showed a sliver of a black arrow and the UML “C” icon.
-
-Each file is one stacked column (~560–780px) that Kroki actually fits in the page.
-
-| Diagram | File | Kroki size |
-| --- | --- | --- |
-| Shell, sidebar, stepper, File menu | [ui-interactive-map-shell.puml](ui-interactive-map-shell.puml) | 563 × 1367 |
-| Stages 1–2 | [ui-interactive-map-stage1-2.puml](ui-interactive-map-stage1-2.puml) | 625 × 1366 |
-| Stages 3–5 + Calibrate | [ui-interactive-map-stage3-5-cal.puml](ui-interactive-map-stage3-5-cal.puml) | 568 × 1386 |
-| Sheets | [ui-interactive-map-sheets.puml](ui-interactive-map-sheets.puml) | 782 × 1502 |

project.yml

@@ -42,6 +42,15 @@ targets:
             echo "note: Vendor/Argyll absent — run scripts/fetch-argyll.sh"
           fi
         basedOnDependencyAnalysis: false
+      - name: Stamp release tag
+        # GENERATE_INFOPLIST_FILE writes Info.plist after script phases and
+        # only honours Apple's INFOPLIST_KEY_* allowlist — so the tag ships as
+        # a bundled resource read by ArtefactFiles.appInfo (#189).
+        script: |
+          DEST="$TARGET_BUILD_DIR/$UNLOCALIZED_RESOURCES_FOLDER_PATH"
+          mkdir -p "$DEST"
+          printf '%s' "${ICCERY_RELEASE_TAG:-}" > "$DEST/ICCeryReleaseTag"
+        basedOnDependencyAnalysis: false
     settings:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: com.gronod.iccery2
@@ -54,6 +63,13 @@ targets:
         INFOPLIST_KEY_NSHumanReadableCopyright: "Copyright © 2026 Gronod. AGPLv3."
         MARKETING_VERSION: "2.0.0"
         CURRENT_PROJECT_VERSION: "1"
+        # Stamped by scripts/version.sh at packaging/CI time (release tag or
+        # `git describe` string); About shows it next to the marketing version.
+        # Written to the bundled ICCeryReleaseTag resource by the
+        # "Stamp release tag" phase — GENERATE_INFOPLIST_FILE drops custom
+        # INFOPLIST_KEY_* names and generates the plist after script phases.
+        # Tag builds hard-fail when the tag's X.Y.Z != MARKETING_VERSION above.
+        ICCERY_RELEASE_TAG: ""
         ENABLE_HARDENED_RUNTIME: YES
         CODE_SIGN_ENTITLEMENTS: Resources/ICCery.entitlements
         CODE_SIGN_IDENTITY: "-"

scripts/fetch-argyll.sh

@@ -106,9 +106,19 @@ fi
 
 mkdir -p "$DEST"
 cp -R "$BIN_DIR"/. "$DEST"/
+# Copy License.txt from archive root (same level as bin/) to Vendor/Argyll/ root
+VENDOR_ROOT="$ROOT/Vendor/Argyll"
+for license_src in "$EXTRACT"/Argyll_V*/License.txt "$EXTRACT"/License.txt; do
+    if [ -f "$license_src" ]; then
+        cp "$license_src" "$VENDOR_ROOT/License.txt"
+        break
+    fi
+done
 find "$DEST" -type f -exec chmod 0755 {} +
 # Downloads carry com.apple.quarantine; the app cannot spawn quarantined tools.
 xattr -dr com.apple.quarantine "$DEST" 2>/dev/null || true
+# Also remove quarantine from Vendor/Argyll root if License.txt was copied
+xattr -dr com.apple.quarantine "$VENDOR_ROOT" 2>/dev/null || true
 
 # Ad-hoc sign every Mach-O (#165: unsigned arm64 → "Killed: 9"), then
 # verify — an unsigned sidecar fails the script. The tree may nest

scripts/package-release.sh

@@ -45,6 +45,13 @@ DEST="platform=macOS"
 IDENTITY="${CODESIGN_IDENTITY:--}"
 DEVELOPMENT_TEAM="${DEVELOPMENT_TEAM:-}"
 
+# Resolve the version triple from the release tag / git state. On tag builds
+# (RELEASE_TAG=v*) this hard-fails if the tag's X.Y.Z != project.yml
+# MARKETING_VERSION, so a mis-tag cannot ship mismatched metadata (#189).
+echo "==> Resolving version"
+eval "$(scripts/version.sh)"
+echo "version=$MARKETING_VERSION build=$CURRENT_PROJECT_VERSION tag=$ICCERY_RELEASE_TAG"
+
 echo "==> Building universal Release app"
 BUILD_EXTRA=""
 if [ -n "$DEVELOPMENT_TEAM" ]; then
@@ -60,6 +67,9 @@ xcodebuild \
     ONLY_ACTIVE_ARCH=NO \
     CODE_SIGNING_ALLOWED=YES \
     CODE_SIGN_IDENTITY="$IDENTITY" \
+    MARKETING_VERSION="$MARKETING_VERSION" \
+    CURRENT_PROJECT_VERSION="$CURRENT_PROJECT_VERSION" \
+    ICCERY_RELEASE_TAG="$ICCERY_RELEASE_TAG" \
     $BUILD_EXTRA \
     build
 
@@ -142,7 +152,14 @@ fi
 echo "==> Building DMG"
 VERSION="$(plutil -extract CFBundleShortVersionString raw "$APP/Contents/Info.plist" 2>/dev/null || printf '2.0.0')"
 BUILD_NUM="$(plutil -extract CFBundleVersion raw "$APP/Contents/Info.plist" 2>/dev/null || printf '1')"
-DMG="ICCery-${VERSION}-${BUILD_NUM}.dmg"
+# Tagged/described builds carry the tag in the DMG name so prerelease
+# artefacts are self-describing (ICCery-2.0.0-pre2-grok-236.dmg); a plain
+# release tag keeps the classic ICCery-<ver>-<build>.dmg form.
+TAG_NAME="${ICCERY_RELEASE_TAG#v}"
+case "$TAG_NAME" in
+    ''|"$VERSION"|dev) DMG="ICCery-${VERSION}-${BUILD_NUM}.dmg" ;;
+    *)                 DMG="ICCery-${TAG_NAME}-${BUILD_NUM}.dmg" ;;
+esac
 VOLUME_NAME="ICCery ${VERSION}"
 
 DMG_APP="$APP" \

scripts/version.sh

@@ -0,0 +1,88 @@
+#!/bin/sh
+# scripts/version.sh
+#
+# Resolve the ICCery version triple and print KEY=value lines for eval:
+#
+#   ICCERY_RELEASE_TAG      release tag / describe string stamped into the
+#                           bundle's ICCeryReleaseTag Info.plist key and shown
+#                           in the About dialog.
+#   MARKETING_VERSION       CFBundleShortVersionString — strict X.Y.Z only
+#                           (Apple forbids suffixes; tag payload never lands here).
+#   CURRENT_PROJECT_VERSION CFBundleVersion — monotonically increasing integer.
+#                           macOS/App-Store convention: never reset per version.
+#
+# Resolution:
+#   RELEASE_TAG env matching 'v[0-9]*' wins (CI tag builds; branch pushes pass
+#   the branch name and are ignored). Otherwise `git describe` on the worktree.
+#   Marketing version = first three numeric components of the tag core; a tag
+#   with no numeric core falls back to project.yml's MARKETING_VERSION.
+#   Build number = BUILD_NUMBER env override, else `git rev-list --count HEAD`.
+#
+# Hard fails (release-tag builds only): tag core not 1-3 numeric components,
+# or parsed X.Y.Z != project.yml MARKETING_VERSION — bump project.yml or fix
+# the tag before packaging.
+#
+# Usage: eval "$(scripts/version.sh)"
+
+set -eu
+
+ROOT="$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)"
+cd "$ROOT"
+
+YML_MARKETING="$(sed -n 's/^ *MARKETING_VERSION: *"\(.*\)"/\1/p' project.yml | head -n 1)"
+
+TAG="${RELEASE_TAG:-}"
+case "$TAG" in
+    v[0-9]*) ;;           # real release tag
+    *) TAG="" ;;          # branch name (develop, feat/...) or empty
+esac
+IS_RELEASE_TAG=0
+[ -n "$TAG" ] && IS_RELEASE_TAG=1
+
+if [ -z "$TAG" ]; then
+    TAG="$(git describe --tags --always --dirty --match 'v[0-9]*' 2>/dev/null || true)"
+fi
+[ -n "$TAG" ] || TAG="dev"
+
+# Marketing version: strip leading v, cut at first '-', keep first 3 dot
+# components. "v2.0.0-pre2" -> "2.0.0"; "v2.0.0.0-x" -> "2.0.0";
+# "v2.0.0-5-gsha" -> "2.0.0"; bare sha/"dev" -> no numeric core -> fallback.
+CORE="${TAG#v}"
+CORE="${CORE%%-*}"
+MV=""
+case "$CORE" in
+    *[!0-9.]*|'') ;;               # non-numeric core — not a version tag
+    *)
+        MV="$(printf '%s' "$CORE" | cut -d. -f1-3)"
+        # Every kept component must be non-empty digits.
+        case "$MV" in
+            *[!0-9.]*|''|*..*|.*|*.) MV="" ;;
+        esac
+        ;;
+esac
+
+if [ "$IS_RELEASE_TAG" -eq 1 ]; then
+    if [ -z "$MV" ]; then
+        echo "error: release tag '$TAG' has no X.Y.Z numeric core" >&2
+        exit 1
+    fi
+    if [ -n "$YML_MARKETING" ] && [ "$MV" != "$YML_MARKETING" ]; then
+        echo "error: tag '$TAG' resolves to $MV but project.yml MARKETING_VERSION=$YML_MARKETING; bump project.yml or fix the tag" >&2
+        exit 1
+    fi
+fi
+[ -n "$MV" ] || MV="$YML_MARKETING"
+[ -n "$MV" ] || MV="0.0.0"
+
+BUILD="${BUILD_NUMBER:-}"
+if [ -z "$BUILD" ]; then
+    BUILD="$(git rev-list --count HEAD 2>/dev/null || true)"
+fi
+case "$BUILD" in
+    ''|*[!0-9]*) BUILD="1" ;;
+esac
+[ "$BUILD" -gt 0 ] 2>/dev/null || BUILD="1"
+
+printf 'ICCERY_RELEASE_TAG=%s\n' "$TAG"
+printf 'MARKETING_VERSION=%s\n' "$MV"
+printf 'CURRENT_PROJECT_VERSION=%s\n' "$BUILD"