diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b9ec1d3..2d897ec 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,14 @@ on:
           - patch
           - minor
           - major
+      mark_critical:
+        description: "Mandatory security update (clients can't dismiss the prompt)"
+        type: boolean
+        default: false
+      advisory_url:
+        description: "Optional advisory/release link shown on the security banner"
+        type: string
+        default: ""
 
 # Never run two releases at once — they race on the version bump + tag.
 concurrency:
@@ -212,18 +220,18 @@ jobs:
             src-tauri/target/**/release/bundle/**/*.sig
 
   build-flatpak:
-    # Wrap the .deb from the `build` job into a distro-agnostic .flatpak bundle
-    # (installs on Alpine, Arch, Fedora, Ubuntu, …). x86_64 ONLY: the builder
-    # image `bilelmoussaoui/flatpak-github-actions:gnome-47` ships no arm64
-    # manifest, so `docker pull` on an arm64 runner fails outright — native
-    # aarch64 flatpak isn't buildable with this toolchain. arm64 Linux users are
-    # covered by the .deb/.rpm/.AppImage arm64 artifacts; only the arm64 .flatpak
-    # is omitted. Revisit if the image gains arm64 (or via QEMU cross-build).
-    # The `gnome-47` tag MUST match `runtime-version` in flatpak/ai.canonic.app.yml.
+    # Wrap each arch's .deb (from the `build` job) into a distro-agnostic
+    # .flatpak bundle (installs on Alpine, Arch, Fedora, Ubuntu, …). Built
+    # NATIVELY per-arch on matching runners: x86_64 on ubuntu-latest, aarch64 on
+    # ubuntu-24.04-arm. We do NOT use the `bilelmoussaoui/...:gnome-47` container
+    # because it ships no arm64 image (docker pull fails on arm64 runners) —
+    # instead flatpak-builder is apt-installed and the GNOME runtime pulled from
+    # Flathub, which works identically on both arches. The runtime version below
+    # MUST match `runtime-version` in flatpak/ai.canonic.app.yml.
     needs:
       - compute-version
       - build
-    timeout-minutes: 30
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -232,14 +240,33 @@ jobs:
             artifact: release-linux-x64
             deb_glob: "*_amd64.deb"
             arch: x86_64
+          - runner: ubuntu-24.04-arm
+            artifact: release-linux-arm64
+            deb_glob: "*_arm64.deb"
+            arch: aarch64
     runs-on: ${{ matrix.runner }}
-    container:
-      image: bilelmoussaoui/flatpak-github-actions:gnome-47
-      options: --privileged
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
 
+      - name: Install Flatpak toolchain
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder
+          # GitHub's ubuntu-24.04 images restrict unprivileged user namespaces
+          # via AppArmor, which breaks flatpak-builder's bwrap sandbox. Relax it
+          # (no-op if the knob doesn't exist on the runner image).
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+
+      - name: Install GNOME runtime + SDK (native arch)
+        # The manifest builds against org.gnome.{Platform,Sdk}//47. Flathub
+        # serves both x86_64 and aarch64, so this resolves to the runner's arch.
+        run: |
+          flatpak remote-add --if-not-exists --user \
+            flathub https://flathub.org/repo/flathub.flatpakrepo
+          flatpak install --user -y --noninteractive flathub \
+            org.gnome.Platform//47 org.gnome.Sdk//47
+
       - name: Download Linux build (.deb)
         uses: actions/download-artifact@v8
         with:
@@ -265,12 +292,13 @@ jobs:
             flatpak/ai.canonic.app.metainfo.xml
 
       - name: Build Flatpak bundle
-        uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # v6.7
-        with:
-          bundle: canonic_${{ needs.compute-version.outputs.version }}_${{ matrix.arch }}.flatpak
-          manifest-path: flatpak/ai.canonic.app.yml
-          # Per-arch cache so the two matrix legs don't clobber each other.
-          cache-key: flatpak-builder-${{ matrix.arch }}-${{ github.sha }}
+        env:
+          BUNDLE: canonic_${{ needs.compute-version.outputs.version }}_${{ matrix.arch }}.flatpak
+        run: |
+          flatpak-builder --user --force-clean --disable-rofiles-fuse \
+            --install-deps-from=flathub \
+            --repo=flatpak-repo flatpak-build flatpak/ai.canonic.app.yml
+          flatpak build-bundle flatpak-repo "$BUNDLE" ai.canonic.app master
 
       - name: Upload Flatpak artifact
         uses: actions/upload-artifact@v7
@@ -358,16 +386,24 @@ jobs:
         # with its signed bundle URL + detached signature (read from the .sig
         # files). VERSION/REPO are passed via env (never interpolated into the
         # script) so untrusted input can't reach the shell or node.
+        # MARK_CRITICAL/ADVISORY_URL flag a mandatory security update: from the
+        # workflow_dispatch input, or a `security-critical` label on the merged
+        # PR. They become unsigned manifest fields the client enforces (the
+        # binary is still signature-verified, so this can only force-with-update).
         env:
           GH_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.compute-version.outputs.version }}
           REPO: Canonical-AI/canonic
+          MARK_CRITICAL: ${{ github.event.inputs.mark_critical == 'true' || contains(github.event.pull_request.labels.*.name, 'security-critical') }}
+          ADVISORY_URL: ${{ github.event.inputs.advisory_url }}
         run: |
           node <<'EOF'
           const fs = require('fs');
           const path = require('path');
           const version = process.env.VERSION;
           const repo = process.env.REPO;
+          const critical = process.env.MARK_CRITICAL === 'true';
+          const advisory = process.env.ADVISORY_URL || '';
 
           // Recursively collect every downloaded artifact file.
           const files = [];
@@ -408,12 +444,22 @@ jobs:
             throw new Error('no updater artifacts found — check createUpdaterArtifacts + signing secrets');
           }
 
-          fs.writeFileSync('latest.json', JSON.stringify({
+          const manifest = {
             version,
             notes: `See https://github.com/${repo}/releases/tag/v${version}`,
             pub_date: new Date().toISOString(),
             platforms,
-          }, null, 2));
+          };
+          // Custom fields the client reads via Update.raw_json to force a
+          // mandatory, non-dismissible security update.
+          if (critical) {
+            manifest.critical = true;
+            manifest.severity = 'critical';
+            manifest.advisory =
+              advisory || `https://github.com/${repo}/releases/tag/v${version}`;
+          }
+
+          fs.writeFileSync('latest.json', JSON.stringify(manifest, null, 2));
           console.log(fs.readFileSync('latest.json', 'utf8'));
           EOF
           gh release upload "v$VERSION" latest.json --repo "$REPO" --clobber
diff --git a/README.md b/README.md
index 85e9c92..66d671b 100644
--- a/README.md
+++ b/README.md
@@ -66,12 +66,13 @@ Full usage guide, keyboard shortcuts, and feature walkthroughs:
 curl -fsSL https://raw.githubusercontent.com/Canonical-AI/canonic/main/install.sh | sh
 ```
 
-Detects your OS and architecture, downloads the right build, and installs it.
+Detects your OS, architecture, and Linux distro, downloads the right build, and installs it.
 
-- **macOS** (Apple Silicon) → `/Applications/Canonic.app`
-- **Linux** (x64 / arm64) → `~/.local/bin/canonic` (AppImage)
+- **macOS** (Apple Silicon) → `/Applications/canonic.app`
+- **Linux** (glibc, x64 / arm64) → `~/.local/bin/canonic` (AppImage)
+- **Arch / Alpine** (x64 / arm64) → Flatpak `ai.canonic.app` (AppImage can't run on musl-libc Alpine; Arch ships no FUSE by default)
 
-To pin a specific version: `curl -fsSL ... | sh -s -- --version v0.1.2-alpha`
+To pin a specific version: `curl -fsSL ... | sh -s -- --version v0.2.2-alpha`
 
 <br />
 
@@ -84,35 +85,41 @@ brew install --cask canonic
 
 ### Linux
 
-**AppImage**
+**AppImage** (most glibc distros — Ubuntu, Fedora, …):
 
 ```bash
-chmod +x canonic-*.AppImage
-./canonic-*.AppImage
+chmod +x canonic_*.AppImage
+./canonic_*.AppImage
 ```
 
-**Flatpak** (recommended on Alpine-based / postmarketOS):
+**Flatpak** (Alpine / postmarketOS / Arch — and any musl-libc distro; x86_64 & arm64):
 
 ```bash
-flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
-flatpak install --user canonic-*.flatpak
+flatpak remote-add --if-not-exists --user flathub https://flathub.org/repo/flathub.flatpakrepo
+flatpak install --user canonic_*.flatpak
 flatpak run ai.canonic.app
 ```
 
-**Pacman** (Arch / postmarketOS):
+**Debian / Ubuntu** (`.deb`):
 
 ```bash
-sudo pacman -U canonic-*.pacman
+sudo apt install ./canonic_*.deb
+```
+
+**Fedora / RHEL** (`.rpm`):
+
+```bash
+sudo dnf install ./canonic_*.rpm
 ```
 
 ### Direct download (all platforms)
 
 Grab the latest build for your platform from the [Releases](https://github.com/Canonical-AI/canonic/releases) page:
 
-* **macOS** — `.dmg` (Apple Silicon / Intel)
+* **macOS** — `.dmg` (universal — Apple Silicon & Intel)
 * **Windows** — `.exe`
-* **Linux x64** — `.AppImage`, `.flatpak`, `.deb`, `.pacman`, `.tar.gz`
-* **Linux arm64** — `.AppImage`, `.flatpak`, `.deb`, `.pacman`, `.tar.gz` (ARM Arch, postmarketOS, PinePhone, Raspberry Pi)
+* **Linux x64** — `.AppImage`, `.flatpak`, `.deb`, `.rpm`
+* **Linux arm64** — `.AppImage`, `.deb`, `.flatpak` (Raspberry Pi, PinePhone, postmarketOS, ARM servers)
 
 <br />
 
diff --git a/docs/specs/REQUIREMENTS.md b/docs/specs/REQUIREMENTS.md
index af1aa2f..30d9e6b 100644
--- a/docs/specs/REQUIREMENTS.md
+++ b/docs/specs/REQUIREMENTS.md
@@ -640,6 +640,21 @@ Source of truth for product requirements. When a requirement changes, update thi
   when: the comments panel opens
   then: the version filter is set to "All versions" and every unresolved comment is shown
 
+* scenario: anchor text still present highlights normally
+  given: a comment whose quoted anchor text still appears in the open document
+  when: the comments panel is shown
+  then: the comment highlights in the document and shows no "text changed" warning
+
+* scenario: anchor text changed shows a warning
+  given: a comment whose quoted anchor text no longer appears in the open document (it was edited)
+  when: the comments panel is shown
+  then: the comment is marked stale and shows a "Text has changed" badge instead of a missing highlight
+
+* scenario: resolved or short anchors are never flagged stale
+  given: a resolved comment, or a comment whose quoted text is shorter than 2 characters
+  when: anchors are evaluated against the document
+  then: the comment is never marked stale
+
 ***
 
 ## Browser Commenting (BCM)
@@ -812,6 +827,11 @@ Source of truth for product requirements. When a requirement changes, update thi
   when: an action is selected
   then: the trigger `/` character is removed from the document before the block is inserted
 
+* scenario: insert today's date
+  given: the slash menu is open at the root
+  when: the user selects "Today's date" (or types `today` and presses Enter)
+  then: the current date is inserted at the caret in ISO 8601 format (YYYY-MM-DD) using the local calendar day, and the trigger `/` is removed
+
 ### Agent slash commands
 
 * scenario: root menu lists Review and Build
@@ -2016,6 +2036,38 @@ GNOME runtime carries glibc and webkit2gtk inside the sandbox.
   when: the pipeline reaches finalize
   then: no version bump, tag, or release is published (finalize depends on the Flatpak job)
 
+## One-Line Installer (PKG-INS)
+
+`install.sh` is the curl-pipe-sh installer. It detects OS, CPU architecture, and
+Linux distro, then downloads the matching release asset (names match Tauri's
+bundle output, e.g. `canonic_<version>_universal.dmg`,
+`canonic_<version>_amd64.AppImage`, `canonic_<version>_x86_64.flatpak`).
+
+* scenario: install on macOS
+  given: a user runs the installer on macOS (Apple Silicon)
+  when: the script detects `Darwin`
+  then: it downloads `canonic_<version>_universal.dmg`, mounts it, copies the `.app` into `/Applications`, and clears the Gatekeeper quarantine flag
+
+* scenario: install on a glibc Linux distro
+  given: a user on a glibc distro (e.g. Ubuntu, Fedora) that is neither Arch nor Alpine
+  when: the script detects the distro
+  then: it downloads the AppImage (`amd64` on x86_64, `aarch64` on arm64) to `~/.local/bin/canonic` and marks it executable
+
+* scenario: install on Arch or Alpine
+  given: a user on Arch or Alpine, x86_64 or arm64 (detected via `/etc/os-release` ID/ID_LIKE, or `/etc/arch-release` / `/etc/alpine-release`)
+  when: the script selects an install method
+  then: it installs the Flatpak matching the CPU (`canonic_<version>_x86_64.flatpak` or `canonic_<version>_aarch64.flatpak`) — adds the Flathub remote, then `flatpak install --user` — because Alpine is musl-libc and Arch ships no FUSE for AppImages
+
+* scenario: Flatpak missing on Arch or Alpine
+  given: an Arch or Alpine user without `flatpak` installed
+  when: the installer reaches the Flatpak step
+  then: it exits with a message telling them to install flatpak (`doas apk add flatpak` / `sudo pacman -S flatpak`) and re-run
+
+* scenario: pin a specific version
+  given: a user passes `--version <tag>`
+  when: the script resolves the version
+  then: it skips the GitHub "latest release" lookup and installs the named tag
+
 ## Auto-Update (UPD)
 
 Canonic updates itself in place using the Tauri updater. On launch it checks the
@@ -2238,11 +2290,33 @@ pinned in `tauri.conf.json`, so an unsigned or tampered package is rejected.
   when: the app starts
   then: no greeting is shown and the stored target is cleared
 
+### Mandatory security updates
+
+* scenario: a critical update can't be dismissed
+  given: the release manifest marks the update `critical`
+  when: the update is detected
+  then: the over-editor banner and the left-panel widget both show a red "Security update required" notice with no close button (overriding the usual dismiss)
+
+* scenario: advisory link is shown for security updates
+  given: a critical update whose manifest includes an advisory URL
+  when: the security banner is shown
+  then: it includes an "Advisory" link that opens the advisory in the browser
+
+* scenario: forcing is best-effort and non-destructive
+  given: the critical flag lives in the unsigned part of the manifest
+  when: the client enforces it
+  then: it only nags/forces-with-update — the downloaded binary is still signature-verified before install, so a tampered flag can never run a malicious build
+
+* scenario: releases can be flagged critical from CI
+  given: a release is published
+  when: the `mark_critical` workflow input is true or the merged PR has the `security-critical` label
+  then: `latest.json` is written with `critical: true`, `severity: critical`, and an advisory URL
+
 ### Demo Mode
 
 * scenario: update flow is demoable end to end
   given: the app is in demo mode
-  when: the user downloads and restarts the fake update
-  then: progress animates, then an "Updated to v0.3.0" greeting with a release-notes link is shown — no real binary or network is touched
+  when: the user downloads and restarts the fake (critical) update
+  then: a non-dismissible "Security update required" banner is shown, progress animates, then an "Updated to v0.3.0" greeting with a release-notes link — no real binary or network is touched
 
 *Last updated: 2026-06-10*
diff --git a/install.sh b/install.sh
index f2d1e64..5aed620 100755
--- a/install.sh
+++ b/install.sh
@@ -3,7 +3,7 @@
 # curl -fsSL https://raw.githubusercontent.com/Canonical-AI/canonic/main/install.sh | sh
 #
 # Optional: pin a version
-# curl -fsSL ... | sh -s -- --version v0.1.2-alpha
+# curl -fsSL ... | sh -s -- --version v0.2.2-alpha
 
 set -u
 
@@ -53,7 +53,39 @@ case "$ARCH" in
 esac
 
 if [ "$PLATFORM" = "macos" ] && [ "$ARCH_NORM" != "arm64" ]; then
-  err "Canonic only builds for Apple Silicon (arm64) on macOS. Intel Macs are not supported."
+  # The macOS .dmg is a universal binary, but the installer is only verified on
+  # Apple Silicon. Intel Macs can use the .dmg from the Releases page directly.
+  warn "Intel Macs are not officially supported; the universal .dmg may still work."
+fi
+
+# --- Linux distro detection --------------------------------------------
+# Arch and Alpine get the Flatpak instead of the AppImage (both arches):
+#   • Alpine is musl-libc — the glibc AppImage will not run at all.
+#   • Arch ships no FUSE by default, so AppImages need extra setup; the Flatpak
+#     bundles its own GNOME runtime and just works.
+# Flatpak bundles are built for both x86_64 and aarch64, so no per-arch fallback.
+INSTALL_METHOD="appimage"   # default for Linux
+DISTRO_PRETTY="Linux"
+
+if [ "$PLATFORM" = "linux" ]; then
+  DISTRO_ID=""
+  DISTRO_LIKE=""
+  if [ -r /etc/os-release ]; then
+    # Parse rather than `source` so we don't clobber $VERSION (os-release
+    # defines its own VERSION=).
+    DISTRO_ID=$(grep -E '^ID='      /etc/os-release | head -n1 | cut -d= -f2 | tr -d '"')
+    DISTRO_LIKE=$(grep -E '^ID_LIKE=' /etc/os-release | head -n1 | cut -d= -f2 | tr -d '"')
+    DISTRO_PRETTY=$(grep -E '^PRETTY_NAME=' /etc/os-release | head -n1 | cut -d= -f2 | tr -d '"')
+  fi
+  [ -f /etc/alpine-release ] && DISTRO_ID="alpine"
+  [ -f /etc/arch-release ]   && [ -z "$DISTRO_ID" ] && DISTRO_ID="arch"
+  [ -z "$DISTRO_PRETTY" ] && DISTRO_PRETTY="Linux"
+
+  case " ${DISTRO_ID} ${DISTRO_LIKE} " in
+    *" alpine "* | *" arch "*)
+      INSTALL_METHOD="flatpak"
+      ;;
+  esac
 fi
 
 # --- resolve version ---------------------------------------------------
@@ -65,69 +97,108 @@ if [ -z "$VERSION" ]; then
     || err "Could not fetch latest release from GitHub API"
 fi
 
+# Release assets embed the bare version (no leading "v"); the tag keeps it.
+VERSION_NOV="${VERSION#v}"
+
 info "Installing Canonic ${VERSION} for ${PLATFORM}/${ARCH_NORM}"
 
-# --- pick the right asset -----------------------------------------------
-case "${PLATFORM}-${ARCH_NORM}" in
-  macos-arm64)
-    ASSET="canonic-arm64.zip"
-    ASSET_TYPE="zip"
-    ;;
-  linux-x86_64)
-    ASSET="canonic-x86_64.AppImage"
-    ASSET_TYPE="appimage"
+# --- pick the right asset ----------------------------------------------
+# Names match Tauri's bundle output (productName=canonic), exactly as attached
+# to each GitHub release.
+case "$PLATFORM" in
+  macos)
+    ASSET="canonic_${VERSION_NOV}_universal.dmg"
     ;;
-  linux-arm64)
-    ASSET="canonic-arm64.AppImage"
-    ASSET_TYPE="appimage"
+  linux)
+    if [ "$INSTALL_METHOD" = "flatpak" ]; then
+      # Flatpak bundles use x86_64 / aarch64 in their filename.
+      [ "$ARCH_NORM" = "x86_64" ] && FLATPAK_ARCH="x86_64" || FLATPAK_ARCH="aarch64"
+      ASSET="canonic_${VERSION_NOV}_${FLATPAK_ARCH}.flatpak"
+    elif [ "$ARCH_NORM" = "x86_64" ]; then
+      ASSET="canonic_${VERSION_NOV}_amd64.AppImage"
+    else
+      ASSET="canonic_${VERSION_NOV}_aarch64.AppImage"
+    fi
     ;;
 esac
 
 DOWNLOAD_URL="https://github.com/${REPO}/releases/download/${VERSION}/${ASSET}"
 
-# --- download -----------------------------------------------------------
+# --- download ----------------------------------------------------------
 TMPDIR=$(mktemp -d)
-trap 'rm -rf "$TMPDIR"' EXIT
+MOUNT=""
+cleanup() {
+  [ -n "$MOUNT" ] && hdiutil detach "$MOUNT" >/dev/null 2>&1
+  rm -rf "$TMPDIR"
+}
+trap cleanup EXIT
 
 info "Downloading ${ASSET}…"
 curl -fsSL --progress-bar -o "${TMPDIR}/${ASSET}" "$DOWNLOAD_URL" \
-  || err "Download failed"
+  || err "Download failed (${DOWNLOAD_URL})"
+
+# --- install -----------------------------------------------------------
+LAUNCH_HINT="canonic"
 
-# --- install ------------------------------------------------------------
 case "$PLATFORM" in
   macos)
-    info "Extracting…"
-    unzip -qo "${TMPDIR}/${ASSET}" -d "$TMPDIR" || err "Unzip failed"
+    info "Mounting ${ASSET}…"
+    MOUNT=$(mktemp -d)
+    hdiutil attach -nobrowse -quiet -mountpoint "$MOUNT" "${TMPDIR}/${ASSET}" \
+      || err "Could not mount DMG"
+
+    APP_SRC=$(find "$MOUNT" -maxdepth 1 -name '*.app' | head -n1)
+    [ -n "$APP_SRC" ] || err "No .app found inside the DMG"
+    APP_NAME=$(basename "$APP_SRC")
 
-    APP_NAME="Canonic.app"
     if [ -d "/Applications/${APP_NAME}" ]; then
-      warn "Existing Canonic.app found in /Applications — replacing"
+      warn "Existing /Applications/${APP_NAME} found — replacing"
       rm -rf "/Applications/${APP_NAME}"
     fi
 
-    info "Installing to /Applications/Canonic.app…"
-    mv "${TMPDIR}/${APP_NAME}" /Applications/ \
-      || err "Could not move to /Applications (try running with sudo)"
+    info "Installing to /Applications/${APP_NAME}…"
+    cp -R "$APP_SRC" /Applications/ \
+      || err "Could not copy to /Applications (try running with sudo)"
 
     # Remove quarantine flag so Gatekeeper doesn't block it
-    if ! xattr -d com.apple.quarantine "/Applications/${APP_NAME}" 2>/dev/null; then
+    if ! xattr -dr com.apple.quarantine "/Applications/${APP_NAME}" 2>/dev/null; then
       warn "Could not clear quarantine flag. You may need to right-click → Open the app."
     fi
+    LAUNCH_HINT="open -a ${APP_NAME%.app}"
     ;;
 
   linux)
-    INSTALL_DIR="${HOME}/.local/bin"
-    mkdir -p "$INSTALL_DIR"
-
-    info "Installing to ${INSTALL_DIR}/canonic…"
-    cp "${TMPDIR}/${ASSET}" "${INSTALL_DIR}/canonic" \
-      || err "Could not copy to ${INSTALL_DIR}"
-    chmod +x "${INSTALL_DIR}/canonic"
-
-    if ! echo "$PATH" | tr ':' '\n' | grep -Fqx "$INSTALL_DIR"; then
-      warn "${INSTALL_DIR} is not in your PATH."
-      echo "  Add this to your shell config (~/.bashrc, ~/.zshrc, etc.):"
-      echo "    export PATH=\"\$HOME/.local/bin:\$PATH\""
+    if [ "$INSTALL_METHOD" = "flatpak" ]; then
+      command -v flatpak >/dev/null 2>&1 || err "Flatpak is required on ${DISTRO_PRETTY} but isn't installed.
+  Install it, then re-run this script:
+    Alpine: doas apk add flatpak
+    Arch:   sudo pacman -S flatpak"
+
+      # The bundle depends on the GNOME runtime; Flathub provides it.
+      info "Ensuring Flathub remote…"
+      flatpak remote-add --if-not-exists --user \
+        flathub https://flathub.org/repo/flathub.flatpakrepo \
+        || warn "Could not add Flathub remote; runtime download may fail."
+
+      info "Installing Canonic Flatpak…"
+      flatpak install --user -y "${TMPDIR}/${ASSET}" \
+        || err "flatpak install failed"
+      LAUNCH_HINT="flatpak run ai.canonic.app"
+    else
+      INSTALL_DIR="${HOME}/.local/bin"
+      mkdir -p "$INSTALL_DIR"
+
+      info "Installing to ${INSTALL_DIR}/canonic…"
+      cp "${TMPDIR}/${ASSET}" "${INSTALL_DIR}/canonic" \
+        || err "Could not copy to ${INSTALL_DIR}"
+      chmod +x "${INSTALL_DIR}/canonic"
+
+      if ! echo "$PATH" | tr ':' '\n' | grep -Fqx "$INSTALL_DIR"; then
+        warn "${INSTALL_DIR} is not in your PATH."
+        echo "  Add this to your shell config (~/.bashrc, ~/.zshrc, etc.):"
+        echo "    export PATH=\"\$HOME/.local/bin:\$PATH\""
+      fi
+      LAUNCH_HINT="canonic"
     fi
     ;;
 esac
@@ -135,6 +206,6 @@ esac
 echo ""
 printf "  ${GREEN}✓${NC} Canonic ${BOLD}${VERSION}${NC} installed successfully!\n"
 echo ""
-echo "  Launch it from your app launcher (macOS) or run:"
-echo "    ${BOLD}canonic${NC}"
+echo "  Launch it from your app launcher, or run:"
+echo "    ${BOLD}${LAUNCH_HINT}${NC}"
 echo ""
diff --git a/src-tauri/icons/128x128.png b/src-tauri/icons/128x128.png
index a3ca3da..1382566 100644
Binary files a/src-tauri/icons/128x128.png and b/src-tauri/icons/128x128.png differ
diff --git a/src-tauri/icons/128x128@2x.png b/src-tauri/icons/128x128@2x.png
index dcc926b..15a6cdb 100644
Binary files a/src-tauri/icons/128x128@2x.png and b/src-tauri/icons/128x128@2x.png differ
diff --git a/src-tauri/icons/32x32.png b/src-tauri/icons/32x32.png
index 0a280dc..256b7af 100644
Binary files a/src-tauri/icons/32x32.png and b/src-tauri/icons/32x32.png differ
diff --git a/src-tauri/icons/64x64.png b/src-tauri/icons/64x64.png
index 66047b6..29d9d89 100644
Binary files a/src-tauri/icons/64x64.png and b/src-tauri/icons/64x64.png differ
diff --git a/src-tauri/icons/icon.png b/src-tauri/icons/icon.png
index b8c1a4f..48926bf 100644
Binary files a/src-tauri/icons/icon.png and b/src-tauri/icons/icon.png differ
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index e34a5ac..a1fed75 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -2677,10 +2677,27 @@ pub async fn update_check(app: tauri::AppHandle) -> Result<Value, String> {
     let updater = app.updater().map_err(|e| e.to_string())?;
     match updater.check().await {
         Ok(Some(update)) => {
+            // Custom (unsigned) manifest fields drive security forcing. The
+            // binary itself is still signature-verified at install, so these
+            // flags can only nag/force-with-update — never run a bad binary.
+            // `critical: true` makes the update mandatory for every client old
+            // enough to see it (the plugin only returns one when out of date).
+            let raw = &update.raw_json;
+            let mandatory = raw
+                .get("critical")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
+            let advisory = raw
+                .get("advisory")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
             let info = json!({
                 "version": update.version.clone(),
                 "notes": update.body.clone(),
                 "date": update.date.map(|d| d.to_string()),
+                "mandatory": mandatory,
+                "advisory": advisory,
             });
             *pending_update().lock().unwrap() =
                 Some(PendingUpdate { update, bytes: None });
diff --git a/src/components/editor/MilkdownEditor.vue b/src/components/editor/MilkdownEditor.vue
index a828663..4c66b03 100644
--- a/src/components/editor/MilkdownEditor.vue
+++ b/src/components/editor/MilkdownEditor.vue
@@ -9,6 +9,7 @@
 import { watch, ref, provide, computed, onUnmounted, reactive } from "vue";
 import { Milkdown, useEditor } from "@milkdown/vue";
 import { useAppStore } from "../../store";
+import { findStaleCommentIds } from "../../utils/comment-anchors.js";
 import {
     Editor,
     rootCtx,
@@ -1300,11 +1301,14 @@ const { loading, get } = useEditor((root) =>
                 ...prev,
                 editable: () => !editorReadonly.value,
             }));
-            ctx.get(listenerCtx).markdownUpdated((_, markdown) => {
+            ctx.get(listenerCtx).markdownUpdated((lctx, markdown) => {
                 const fixed = stripEmptyLineBr(
                     markdown.replace(/\\\[\\\[/g, "[["),
                 );
                 emit("update", fixed);
+                // Re-evaluate which anchors still match after the edit.
+                const view = lctx.get(editorViewCtx);
+                if (view) reportStaleAnchors(view, props.comments || []);
             });
             ctx.update(prosePluginsCtx, (plugins) => [
                 ...plugins,
@@ -1364,9 +1368,19 @@ function dispatchHighlights(comments) {
         const view = ctx.get(editorViewCtx);
         if (!view) return;
         view.dispatch(view.state.tr.setMeta(HIGHLIGHT_KEY, comments || []));
+        reportStaleAnchors(view, comments || []);
     });
 }
 
+// The editor is the source of truth for whether a comment highlights: it
+// searches the same block-separated plain text buildDecorations uses. Report
+// comments whose anchor text is no longer found so the panel can flag them.
+function reportStaleAnchors(view, comments) {
+    const doc = view.state.doc;
+    const plain = doc.textBetween(0, doc.content.size, "\n", "\n");
+    store.setStaleCommentIds(findStaleCommentIds(plain, comments));
+}
+
 watch(loading, (isLoading) => {
     if (!isLoading) dispatchHighlights(props.comments);
 });
diff --git a/src/components/editor/slash-menu/SlashMenuTooltip.vue b/src/components/editor/slash-menu/SlashMenuTooltip.vue
index 44ba29d..de1ee5c 100644
--- a/src/components/editor/slash-menu/SlashMenuTooltip.vue
+++ b/src/components/editor/slash-menu/SlashMenuTooltip.vue
@@ -72,6 +72,7 @@ import {
     Hammer,
     Bot,
     Settings,
+    Calendar,
 } from "lucide-vue-next";
 import { useAppStore } from "../../../store";
 
@@ -90,6 +91,12 @@ let onCloseCallback = null;
 const MENU_DATA = {
     main: [
         { id: "insert", label: "Insert", icon: Type, submenu: "insert" },
+        {
+            id: "today",
+            label: "Today's date",
+            icon: Calendar,
+            action: "insert-today",
+        },
         {
             id: "review",
             label: "Review with agent",
diff --git a/src/components/editor/slash-menu/index.js b/src/components/editor/slash-menu/index.js
index 4713e22..303cb27 100644
--- a/src/components/editor/slash-menu/index.js
+++ b/src/components/editor/slash-menu/index.js
@@ -11,6 +11,15 @@ export function slashTriggerAllowed({ parentOffset, charBefore }) {
   return charBefore === " ";
 }
 
+// Today's date in ISO 8601 (YYYY-MM-DD), built from local calendar components
+// so it never drifts a day near midnight (toISOString would use UTC).
+export function formatToday(date = new Date()) {
+  const y = date.getFullYear();
+  const m = String(date.getMonth() + 1).padStart(2, "0");
+  const d = String(date.getDate()).padStart(2, "0");
+  return `${y}-${m}-${d}`;
+}
+
 export const createSlashMenuPlugin = (tooltipRef) => {
   let lastModITime = 0;
 
@@ -161,6 +170,9 @@ function handleAction(view, pos, action) {
           tr.replaceWith(mappedPos, mappedPos, schema.nodes.hr.create());
         }
         break;
+      case "insert-today":
+        tr.insertText(formatToday(), mappedPos, mappedPos);
+        break;
       case "blockquote":
       case "bullet-list":
       case "ordered-list":
diff --git a/src/components/layout/MainLayout.vue b/src/components/layout/MainLayout.vue
index d719026..b3992af 100644
--- a/src/components/layout/MainLayout.vue
+++ b/src/components/layout/MainLayout.vue
@@ -24,34 +24,6 @@
             </div>
             <div class="titlebar-center" data-tauri-drag-region></div>
             <div class="titlebar-right" @mousedown="onTitlebarRightMouseDown">
-                <!-- Update indicator -->
-                <template v-if="updateReady">
-                    <button
-                        class="icon-btn"
-                        @click="installUpdate"
-                        title="Restart and install update"
-                    >
-                        <ArrowUpCircle :size="15" />
-                    </button>
-                </template>
-                <template v-else-if="updateDownloading">
-                    <div
-                        class="icon-btn"
-                        :title="'Downloading update ' + downloadProgress + '%'"
-                    >
-                        <ArrowUpCircle :size="15" style="opacity: 0.5" />
-                    </div>
-                </template>
-                <template v-else-if="updateAvailable">
-                    <button
-                        class="icon-btn"
-                        @click="downloadUpdate"
-                        title="Download available update"
-                    >
-                        <ArrowUpCircle :size="15" />
-                    </button>
-                </template>
-
                 <!-- Font toggle -->
                 <button
                     class="icon-btn"
@@ -1122,13 +1094,19 @@ const {
     updateAvailable,
     updateDownloading,
     updateInfo,
-    downloadProgress,
 } = storeToRefs(store);
-const { downloadUpdate, installUpdate } = store;
+const { downloadUpdate } = store;
 
 const showUpdatePrompt = ref(false);
 watch(updateAvailable, (val) => {
-    if (val && !updateDownloading.value && !updateReady.value) {
+    // A mandatory update is carried by the non-dismissible UpdateNotice banner;
+    // skip the gentle (dismissible) legacy nudge so the messaging isn't mixed.
+    if (
+        val &&
+        !updateDownloading.value &&
+        !updateReady.value &&
+        !store.updateMandatory
+    ) {
         setTimeout(() => {
             showUpdatePrompt.value = true;
         }, 2000);
diff --git a/src/components/layout/UpdateNotice.vue b/src/components/layout/UpdateNotice.vue
index 2ad0d49..ac07bda 100644
--- a/src/components/layout/UpdateNotice.vue
+++ b/src/components/layout/UpdateNotice.vue
@@ -2,7 +2,11 @@
   <div
     v-if="visible"
     class="update-notice"
-    :class="[`update-notice--${placement}`, `update-notice--${variant}`]"
+    :class="[
+      `update-notice--${placement}`,
+      `update-notice--${phase}`,
+      { 'update-notice--critical': critical },
+    ]"
     role="status"
   >
     <component :is="icon" :size="placement === 'sidebar' ? 14 : 15" class="un-icon" aria-hidden="true" />
@@ -21,6 +25,12 @@
         href="#"
         @click.prevent="store.openReleaseNotes()"
       >Release notes ↗</a>
+      <a
+        v-else-if="critical && store.advisoryUrl"
+        class="un-link"
+        href="#"
+        @click.prevent="store.openAdvisory()"
+      >Advisory ↗</a>
     </div>
     <button v-if="showDownload" class="un-action" @click="store.downloadUpdate()">
       Download
@@ -37,7 +47,13 @@
 <script setup>
 import { computed } from "vue";
 import { useAppStore } from "../../store";
-import { ArrowUpCircle, Download, CheckCircle2, X } from "lucide-vue-next";
+import {
+  ArrowUpCircle,
+  Download,
+  CheckCircle2,
+  ShieldAlert,
+  X,
+} from "lucide-vue-next";
 
 // placement: 'editor' = floating banner over the editor (live state, not
 // dismissible while an update is in flight; shows the post-update greeting).
@@ -55,8 +71,14 @@ const isActive = computed(
   () => store.updateAvailable || store.updateDownloading || store.updateReady,
 );
 
+// Severity axis: a manifest-flagged critical update can't be dismissed on
+// either surface, and the editor banner shows it from the 'available' state
+// too (no waiting for the legacy nudge).
+const critical = computed(() => store.updateMandatory && isActive.value);
+
 const visible = computed(() => {
   if (isGreeting.value) return true;
+  if (critical.value) return true;
   if (props.placement === "editor") {
     // The 'available' nudge over the editor is the legacy update-prompt; this
     // banner adds the in-flight + ready states (progress, restart) on top.
@@ -66,45 +88,47 @@ const visible = computed(() => {
   return isActive.value && !store.updateNoticeDismissed;
 });
 
-const variant = computed(() => {
+// Lifecycle phase (what's happening), orthogonal to severity (how urgent).
+const phase = computed(() => {
   if (isGreeting.value) return "updated";
   if (store.updateReady) return "ready";
   if (store.updateDownloading) return "downloading";
   return "available";
 });
 
-const icon = computed(
-  () =>
-    ({
-      updated: CheckCircle2,
-      ready: ArrowUpCircle,
-      downloading: ArrowUpCircle,
-      available: Download,
-    })[variant.value],
-);
+const icon = computed(() => {
+  if (phase.value === "updated") return CheckCircle2;
+  if (critical.value) return ShieldAlert;
+  return phase.value === "available" ? Download : ArrowUpCircle;
+});
 
 const text = computed(() => {
+  if (phase.value === "updated") return `Updated to v${store.recentlyUpdatedVersion}`;
+  const noun = critical.value ? "Security update" : "Update";
   const v = store.updateInfo?.version;
-  switch (variant.value) {
-    case "updated":
-      return `Updated to v${store.recentlyUpdatedVersion}`;
+  switch (phase.value) {
     case "ready":
-      return "Update ready to install";
+      return critical.value
+        ? "Security update ready — restart to patch"
+        : "Update ready to install";
     case "downloading":
-      return `Downloading update… ${store.downloadProgress}%`;
+      return `${noun} · downloading… ${store.downloadProgress}%`;
     default:
+      if (critical.value)
+        return v ? `Security update required · v${v}` : "Security update required";
       return v ? `Update available · v${v}` : "Update available";
   }
 });
 
-// Download button only before the download starts.
-const showDownload = computed(() => variant.value === "available");
+// Download button before the download starts.
+const showDownload = computed(() => phase.value === "available");
 
 // Editor banner is dismissible only for the greeting; the sidebar widget is
-// always closable while an update is in flight.
-const dismissible = computed(
-  () => isGreeting.value || (props.placement === "sidebar" && isActive.value),
-);
+// closable while an update is in flight — but never when it's mandatory.
+const dismissible = computed(() => {
+  if (critical.value) return false;
+  return isGreeting.value || (props.placement === "sidebar" && isActive.value);
+});
 
 function dismiss() {
   if (isGreeting.value) store.dismissRecentlyUpdated();
@@ -201,6 +225,22 @@ function dismiss() {
   color: var(--success, #3fb950);
 }
 
+/* Critical / security-mandatory update */
+.update-notice--critical {
+  border-color: var(--danger, #f85149);
+  border-left: 3px solid var(--danger, #f85149);
+}
+.update-notice--critical .un-icon,
+.update-notice--critical .un-link {
+  color: var(--danger, #f85149);
+}
+.update-notice--critical .un-action {
+  background: var(--danger, #f85149);
+}
+.update-notice--critical .un-bar-fill {
+  background: var(--danger, #f85149);
+}
+
 /* Floating banner over the editor */
 .update-notice--editor {
   position: fixed;
diff --git a/src/components/panels/CommentsPanel.vue b/src/components/panels/CommentsPanel.vue
index dfabcb9..7ed7e0c 100644
--- a/src/components/panels/CommentsPanel.vue
+++ b/src/components/panels/CommentsPanel.vue
@@ -56,12 +56,19 @@
           </span>
         </div>
 
-        <div v-if="comment.anchor?.quotedText" class="quoted-text">
+        <div
+          v-if="comment.anchor?.quotedText"
+          class="quoted-text"
+          :class="{ stale: isStale(comment) }"
+        >
           "{{ truncate(comment.anchor.quotedText, 80) }}"
         </div>
         <div v-else-if="comment.anchor?.lineNumber" class="line-ref">
           Line {{ comment.anchor.lineNumber }}
         </div>
+        <div v-if="isStale(comment)" class="text-changed" title="The quoted text was edited, so this comment can no longer be highlighted in the document.">
+          ⚠ Text has changed
+        </div>
 
         <p class="comment-text">{{ comment.text }}</p>
 
@@ -168,6 +175,13 @@ function truncate(text, len) {
   return text.length > len ? text.slice(0, len) + '…' : text
 }
 
+// A comment is stale when its anchor text no longer appears in the open doc.
+// The editor reports these ids (it owns the highlight match); the panel shows a
+// "Text has changed" badge instead of a highlight that would silently go missing.
+function isStale(comment) {
+  return store.staleCommentIds.has(comment.id)
+}
+
 // ── Version filter ──
 // Comments are stamped with the commit oid they were made against (store.addComment).
 // Named versions (store.docVersions) map a label to an oid; "Current" is HEAD.
@@ -354,6 +368,22 @@ async function submitReply(commentId) {
   border-left: 2px solid var(--accent);
 }
 
+.quoted-text.stale {
+  color: var(--text-muted);
+  border-left-color: var(--text-muted);
+  text-decoration: line-through;
+  opacity: 0.7;
+}
+
+.text-changed {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  font-size: 0.7rem;
+  color: var(--warning, #d97706);
+  margin-bottom: 6px;
+}
+
 .line-ref {
   font-size: 0.75rem;
   color: var(--text-muted);
diff --git a/src/demo/config.json b/src/demo/config.json
index 017e31a..560f816 100644
--- a/src/demo/config.json
+++ b/src/demo/config.json
@@ -3,7 +3,10 @@
   "template": "pm-framework",
   "update": {
     "version": "0.3.0",
-    "notes": "Faster workspace search, new editor themes, and inline comment improvements."
+    "notes": "Security patch plus faster workspace search and new editor themes.",
+    "mandatory": true,
+    "severity": "critical",
+    "advisory": "https://github.com/Canonical-AI/canonic/releases/tag/v0.3.0"
   },
   "files": {
     "Vision/product-vision.md": "# Product Vision\n\n> What we're building and why it matters.\n\n## Vision Statement\n\nCanonic is a local-first document editor for product managers — built on Git — that makes version control, peer review, and AI-assisted thinking feel native to how good PMs already work.\n\n## Problem We're Solving\n\nProduct managers write documents — PRDs, strategies, roadmaps — in tools that treat them as ephemeral notes. Notion, Google Docs, and Confluence have no concept of history, branching, or structured review. Decisions get made in comments that disappear. `Final_v3_APPROVED.docx` is still the state of the art.\n\nThe real problem isn't the format. It's that there's no shared ritual for saying \"this document is ready to build from.\" Engineers have pull requests. PMs have Slack threads.\n\n## Why Now\n\nThree things converged:\n\n1. **Remote-first teams normalized async review.** The \"walk over and ask\" fallback is gone. Docs need to stand alone — and when they don't, the cost is a sprint built on the wrong requirements.\n2. **AI can now act as a thinking partner.** The bottleneck isn't writing speed — it's thinking quality. Claude can challenge your reasoning before you've committed to it.\n3. **Local-first is having a moment.** Developers are exhausted by SaaS tools that hold their data hostage. PMs are starting to feel the same way.\n\n## Who This Is For\n\nB2B product managers at 20–200 person companies who ship software. They write documents before building things. They collaborate with engineers and designers who have opinions. They care about their decisions aging well — they want to look back at *why* they decided something, not just *what*.\n\nNot for: enterprise PMOs, agencies, or anyone who needs a PM tool to also be a project tracker.\n",
@@ -113,6 +116,18 @@
   ],
   "comments": {
     "Vision/product-vision.md": [
+      {
+        "id": "demo-stale-1",
+        "author": "Ben Okafor",
+        "authorInitials": "BO",
+        "type": "selection",
+        "anchor": { "quotedText": "a local-first writing tool for PMs" },
+        "text": "Strong framing — though 'editor' might land better than 'writing tool' with the eng audience reviewing this.",
+        "resolved": false,
+        "commitOid": "demo-v1",
+        "createdAt": "2026-05-05T11:00:00.000Z",
+        "isDemo": true
+      },
       {
         "id": "demo-own-private-1",
         "author": "You",
diff --git a/src/store/index.js b/src/store/index.js
index 72ad8c5..11c373b 100644
--- a/src/store/index.js
+++ b/src/store/index.js
@@ -313,6 +313,11 @@ export const useAppStore = defineStore("app", () => {
   // ── INLINE COMMENTS ──
   // ==========================================
   const comments = ref([]);
+  // Ids of comments whose anchor text no longer appears in the open doc (the
+  // text was edited since the comment was made). Populated by the editor, which
+  // is the source of truth for whether a comment highlights. Drives the
+  // "Text has changed" badge in the comments panel.
+  const staleCommentIds = ref(new Set());
 
   // ==========================================
   // ── PEER-TO-PEER SHARING ──
@@ -734,6 +739,10 @@ export const useAppStore = defineStore("app", () => {
   // "Updated to vX" + a release-notes link. Cleared once dismissed.
   const recentlyUpdated = ref(false);
   const recentlyUpdatedVersion = ref("");
+  // Security forcing: a manifest-flagged critical update can't be dismissed.
+  // Derived from updateInfo so they clear automatically when it does.
+  const updateMandatory = computed(() => !!updateInfo.value?.mandatory);
+  const advisoryUrl = computed(() => updateInfo.value?.advisory || "");
 
   const releaseNotesUrl = computed(() => {
     const v = recentlyUpdated.value
@@ -744,12 +753,16 @@ export const useAppStore = defineStore("app", () => {
       : "";
   });
 
+  // Apply an `update:available` payload. Extracted so it's unit-testable
+  // without firing the IPC listener.
+  function applyUpdateInfo(info) {
+    updateInfo.value = info;
+    updateAvailable.value = true;
+    updateNoticeDismissed.value = false;
+  }
+
   if (api?.update) {
-    api.update.onAvailable?.((info) => {
-      updateInfo.value = info;
-      updateAvailable.value = true;
-      updateNoticeDismissed.value = false;
-    });
+    api.update.onAvailable?.(applyUpdateInfo);
     api.update.onProgress?.((progress) => {
       updateAvailable.value = false;
       updateDownloading.value = true;
@@ -804,13 +817,7 @@ export const useAppStore = defineStore("app", () => {
     }
     // Stash the target version; on the next launch checkRecentlyUpdated() reads
     // it back to confirm the swap landed and greet the user.
-    try {
-      if (typeof localStorage !== "undefined" && version) {
-        localStorage.setItem("canonic:updatingTo", version);
-      }
-    } catch {
-      /* localStorage unavailable (tests/web) — skip the greeting */
-    }
+    if (version) storage.setItem("canonic:updatingTo", version);
     api?.update.install();
   }
 
@@ -826,15 +833,18 @@ export const useAppStore = defineStore("app", () => {
     if (releaseNotesUrl.value) api?.share?.openLink?.(releaseNotesUrl.value);
   }
 
+  function openAdvisory() {
+    if (advisoryUrl.value) api?.share?.openLink?.(advisoryUrl.value);
+  }
+
   // Called once at startup: if the previous session installed an update and the
   // running version now matches the stashed target, show the "Updated to vX"
   // greeting. Always clears the marker so it fires exactly once.
   async function checkRecentlyUpdated() {
+    const target = storage.getItem("canonic:updatingTo");
+    if (!target) return;
+    storage.removeItem("canonic:updatingTo");
     try {
-      if (typeof localStorage === "undefined") return;
-      const target = localStorage.getItem("canonic:updatingTo");
-      if (!target) return;
-      localStorage.removeItem("canonic:updatingTo");
       let current = "";
       if (api?.app?.getVersion) current = await api.app.getVersion();
       if (current && current === target) {
@@ -1820,8 +1830,15 @@ export const useAppStore = defineStore("app", () => {
   // ==========================================
   // ── INLINE COMMENTS ──
   // ==========================================
+  // The editor recomputes stale anchors after loading/editing; clear stale flags
+  // from the previous doc so they don't linger before the editor reports.
+  function setStaleCommentIds(ids) {
+    staleCommentIds.value = new Set(ids || []);
+  }
+
   async function loadComments() {
     if (!currentFile.value) return;
+    staleCommentIds.value = new Set();
     const docId = currentFile.value.replace(/[\\/]/g, "_");
     const saved = (await api.comments.get(docId)) || [];
     if (isDemoMode.value) {
@@ -1979,10 +1996,10 @@ export const useAppStore = defineStore("app", () => {
     demoFiles.value = cfg.files ? { ...cfg.files } : {};
     isDemoMode.value = true;
 
-    // Surface a fake available update so the auto-update flow is demoable.
+    // Surface a fake available update so the auto-update flow is demoable,
+    // including the mandatory/severity/advisory security fields.
     if (cfg.update) {
-      updateInfo.value = cfg.update;
-      updateAvailable.value = true;
+      applyUpdateInfo(cfg.update);
     }
 
     // AI Control demo data
@@ -3502,6 +3519,8 @@ export const useAppStore = defineStore("app", () => {
     isExternalRepo,
     commitLog,
     comments,
+    staleCommentIds,
+    setStaleCommentIds,
     isDirty,
     unsavedBuffer,
     fileIsUncommitted,
@@ -3640,12 +3659,16 @@ export const useAppStore = defineStore("app", () => {
     updateNoticeDismissed,
     recentlyUpdated,
     recentlyUpdatedVersion,
+    updateMandatory,
+    advisoryUrl,
     releaseNotesUrl,
+    applyUpdateInfo,
     downloadUpdate,
     installUpdate,
     dismissUpdateNotice,
     dismissRecentlyUpdated,
     openReleaseNotes,
+    openAdvisory,
     checkRecentlyUpdated,
     commentingActive: ref(false),
     refreshDiscoveredPeers,
diff --git a/src/utils/comment-anchors.js b/src/utils/comment-anchors.js
new file mode 100644
index 0000000..7ea42d5
--- /dev/null
+++ b/src/utils/comment-anchors.js
@@ -0,0 +1,28 @@
+// Comment anchor matching.
+//
+// A comment anchors to the document by storing the exact text it was made
+// against (anchor.quotedText). The editor highlights a comment by searching
+// for that quoted text in the doc's plain text. When the quoted text can no
+// longer be found — because the document was edited since the comment was made
+// — the anchor is "stale": there is nothing to highlight, so the UI shows a
+// "Text has changed" badge instead of silently dropping the highlight.
+//
+// `plainText` must be the same block-separated representation the editor
+// highlights against: doc.textBetween(0, size, "\n", "\n"). Pass `null` when
+// the doc text is not known yet (editor not mounted) so nothing is flagged.
+
+// Mirror the editor's highlight threshold: quotes under 2 chars and resolved
+// comments are never highlighted, so they are never "stale".
+export function isAnchorStale(plainText, comment) {
+  if (!comment || comment.resolved) return false;
+  const text = comment.anchor?.quotedText;
+  if (!text || text.length < 2) return false;
+  if (plainText == null) return false;
+  return !plainText.includes(text);
+}
+
+// Ids of comments whose anchor text no longer appears in the document.
+export function findStaleCommentIds(plainText, comments) {
+  if (!Array.isArray(comments)) return [];
+  return comments.filter((c) => isAnchorStale(plainText, c)).map((c) => c.id);
+}
diff --git a/tests/integration/auto-update.test.js b/tests/integration/auto-update.test.js
index c3393ca..bc39612 100644
--- a/tests/integration/auto-update.test.js
+++ b/tests/integration/auto-update.test.js
@@ -146,4 +146,39 @@ describe('auto-update store', () => {
     expect(store.recentlyUpdated).toBe(false)
     expect(mockApi.app.getVersion).not.toHaveBeenCalled()
   })
+
+  it('applyUpdateInfo marks a critical update mandatory with advisory', () => {
+    store.applyUpdateInfo({
+      version: '0.2.5-alpha',
+      mandatory: true,
+      advisory: 'https://example.com/advisory',
+    })
+    expect(store.updateAvailable).toBe(true)
+    expect(store.updateMandatory).toBe(true)
+    expect(store.advisoryUrl).toBe('https://example.com/advisory')
+  })
+
+  it('applyUpdateInfo leaves a normal update non-mandatory', () => {
+    store.applyUpdateInfo({ version: '0.2.5-alpha' })
+    expect(store.updateMandatory).toBe(false)
+    expect(store.advisoryUrl).toBe('')
+  })
+
+  it('updateMandatory/advisoryUrl clear when the update info is cleared', () => {
+    store.applyUpdateInfo({ version: '0.2.5-alpha', mandatory: true, advisory: 'x' })
+    expect(store.updateMandatory).toBe(true)
+    store.updateInfo = null
+    expect(store.updateMandatory).toBe(false)
+    expect(store.advisoryUrl).toBe('')
+  })
+
+  it('openAdvisory opens the advisory URL via the bridge', () => {
+    store.applyUpdateInfo({
+      version: '0.2.5-alpha',
+      mandatory: true,
+      advisory: 'https://example.com/advisory',
+    })
+    store.openAdvisory()
+    expect(mockApi.share.openLink).toHaveBeenCalledWith('https://example.com/advisory')
+  })
 })
diff --git a/tests/integration/comments.test.js b/tests/integration/comments.test.js
index cdd05f2..e4a0ac4 100644
--- a/tests/integration/comments.test.js
+++ b/tests/integration/comments.test.js
@@ -152,6 +152,26 @@ describe('comments store', () => {
     expect(store.comments[0].id).toBe('c3')
   })
 
+  it('setStaleCommentIds() stores ids the editor reports as stale', async () => {
+    store.setStaleCommentIds(['a', 'b'])
+    expect(store.staleCommentIds.has('a')).toBe(true)
+    expect(store.staleCommentIds.has('b')).toBe(true)
+    expect(store.staleCommentIds.has('c')).toBe(false)
+  })
+
+  it('setStaleCommentIds(null) clears the set', () => {
+    store.setStaleCommentIds(['a'])
+    store.setStaleCommentIds(null)
+    expect(store.staleCommentIds.size).toBe(0)
+  })
+
+  it('loadComments() clears stale flags from the previous doc', async () => {
+    store.setStaleCommentIds(['old'])
+    mockApi.comments.get.mockResolvedValueOnce([])
+    await store.loadComments()
+    expect(store.staleCommentIds.size).toBe(0)
+  })
+
   it('persisted data is serializable plain JSON (no Proxy)', async () => {
     await store.addComment({ id: 'cx', author: 'X', type: 'selection', anchor: { quotedText: 'hi' }, text: 'ok', resolved: false, createdAt: '' })
 
diff --git a/tests/unit/comment-anchors.test.js b/tests/unit/comment-anchors.test.js
new file mode 100644
index 0000000..313ccc4
--- /dev/null
+++ b/tests/unit/comment-anchors.test.js
@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest'
+import { isAnchorStale, findStaleCommentIds } from '../../src/utils/comment-anchors.js'
+
+const PLAIN = 'Canonic is a local-first document editor for product managers.\nIt is built on Git.'
+
+function c(over = {}) {
+  return { id: 'c1', anchor: { quotedText: 'local-first document editor' }, ...over }
+}
+
+describe('isAnchorStale', () => {
+  it('not stale when quoted text is present in the doc', () => {
+    expect(isAnchorStale(PLAIN, c())).toBe(false)
+  })
+
+  it('stale when quoted text no longer appears in the doc', () => {
+    expect(isAnchorStale(PLAIN, c({ anchor: { quotedText: 'a local-first writing tool for PMs' } }))).toBe(true)
+  })
+
+  it('matches across block boundaries via the "\\n" separator representation', () => {
+    // "managers.\nIt" only exists once blocks are joined by a newline
+    expect(isAnchorStale(PLAIN, c({ anchor: { quotedText: 'managers.\nIt is built' } }))).toBe(false)
+  })
+
+  it('resolved comments are never stale', () => {
+    expect(isAnchorStale(PLAIN, c({ resolved: true, anchor: { quotedText: 'gone text' } }))).toBe(false)
+  })
+
+  it('quotes shorter than 2 chars are never stale', () => {
+    expect(isAnchorStale(PLAIN, c({ anchor: { quotedText: 'x' } }))).toBe(false)
+  })
+
+  it('comments without quoted text are never stale', () => {
+    expect(isAnchorStale(PLAIN, c({ anchor: { lineNumber: 5 } }))).toBe(false)
+    expect(isAnchorStale(PLAIN, c({ anchor: undefined }))).toBe(false)
+  })
+
+  it('null doc text (editor not ready) flags nothing', () => {
+    expect(isAnchorStale(null, c({ anchor: { quotedText: 'anything' } }))).toBe(false)
+  })
+
+  it('empty doc makes any real quote stale', () => {
+    expect(isAnchorStale('', c())).toBe(true)
+  })
+})
+
+describe('findStaleCommentIds', () => {
+  it('returns only the ids whose anchor text is missing', () => {
+    const comments = [
+      c({ id: 'present' }),
+      c({ id: 'gone', anchor: { quotedText: 'a local-first writing tool for PMs' } }),
+      c({ id: 'resolved-gone', resolved: true, anchor: { quotedText: 'also gone' } }),
+    ]
+    expect(findStaleCommentIds(PLAIN, comments)).toEqual(['gone'])
+  })
+
+  it('handles non-array input', () => {
+    expect(findStaleCommentIds(PLAIN, null)).toEqual([])
+  })
+})
diff --git a/tests/unit/slash-today.test.js b/tests/unit/slash-today.test.js
new file mode 100644
index 0000000..56878fb
--- /dev/null
+++ b/tests/unit/slash-today.test.js
@@ -0,0 +1,26 @@
+import { describe, it, expect } from "vitest";
+import { formatToday } from "../../src/components/editor/slash-menu/index.js";
+
+// /today inserts the current date in ISO 8601 (YYYY-MM-DD), built from local
+// calendar components so it never drifts a day near midnight (unlike toISOString,
+// which is UTC-based).
+describe("formatToday", () => {
+  it("formats a date as YYYY-MM-DD", () => {
+    expect(formatToday(new Date(2026, 5, 10))).toBe("2026-06-10");
+  });
+
+  it("zero-pads single-digit month and day", () => {
+    expect(formatToday(new Date(2026, 0, 3))).toBe("2026-01-03");
+  });
+
+  it("uses local calendar components, not UTC", () => {
+    // Late-evening local time that is the next day in UTC for positive offsets.
+    // The local date must win regardless of the runner's timezone.
+    const d = new Date(2026, 11, 31, 23, 30);
+    expect(formatToday(d)).toBe("2026-12-31");
+  });
+
+  it("defaults to the current date when called with no argument", () => {
+    expect(formatToday()).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+  });
+});