diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index 8742d10..d498cf1 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -83,13 +83,21 @@ jobs:
       - name: 构建安装包
         working-directory: apps/desktop
         env:
-          TARP_CODESIGN: ${{ inputs.sign && secrets.MAC_DEVELOPER_ID != '' && matrix.platform == 'mac' && '1' || '0' }}
+          TARP_CODESIGN: ${{ matrix.platform == 'mac' && '1' || '0' }}
           TARP_NOTARIZE: ${{ inputs.sign && secrets.MAC_DEVELOPER_ID != '' && secrets.APPLE_ID != '' && matrix.platform == 'mac' && '1' || '0' }}
-          ELECTROBUN_DEVELOPER_ID: ${{ matrix.platform == 'mac' && secrets.MAC_DEVELOPER_ID || '' }}
+          ELECTROBUN_DEVELOPER_ID: ${{ matrix.platform == 'mac' && (inputs.sign && secrets.MAC_DEVELOPER_ID || '-') || '' }}
           ELECTROBUN_APPLEID: ${{ matrix.platform == 'mac' && secrets.APPLE_ID || '' }}
           ELECTROBUN_APPLEIDPASS: ${{ matrix.platform == 'mac' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
           ELECTROBUN_TEAMID: ${{ matrix.platform == 'mac' && secrets.APPLE_TEAM_ID || '' }}
         run: bun run dist
+      - name: 校验 macOS DMG 与内部安装器签名
+        if: runner.os == 'macOS'
+        run: |
+          codesign --verify --strict --verbose=2 apps/desktop/release/macos-arm64-TARP.dmg
+          TARP_DMG_MOUNT=$(mktemp -d "$RUNNER_TEMP/tarp-dmg.XXXXXX")
+          hdiutil attach apps/desktop/release/macos-arm64-TARP.dmg -readonly -nobrowse -mountpoint "$TARP_DMG_MOUNT"
+          trap 'hdiutil detach "$TARP_DMG_MOUNT"; rmdir "$TARP_DMG_MOUNT"' EXIT
+          codesign --verify --deep --strict --verbose=2 "$TARP_DMG_MOUNT/TARP.app"
       - name: 验证打包后的 Bun、CLI、模组、Wasm 和 SQLite
         run: bun scripts/release/smoke.ts desktop
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
diff --git a/apps/desktop/src/renderer/src/components/SidebarToggle.tsx b/apps/desktop/src/renderer/src/components/SidebarToggle.tsx
index c79b23c..181e9c6 100644
--- a/apps/desktop/src/renderer/src/components/SidebarToggle.tsx
+++ b/apps/desktop/src/renderer/src/components/SidebarToggle.tsx
@@ -8,16 +8,20 @@ interface SidebarToggleProps {
   readonly className?: string;
 }
 
-/** 把窗口操作放在原生交通灯旁，避免再拼出一条独立的自定义标题栏。 */
+/** macOS 按钮放在交通灯旁；Windows 保留原生标题栏，按钮贴近内容区左侧。 */
 export function SidebarToggle({ collapsed, onToggle, className }: SidebarToggleProps) {
+  const isWindows = navigator.userAgent.includes("Windows");
+
   return (
     <>
-      <div
-        className="absolute inset-x-0 top-0 z-50 h-12 [-webkit-app-region:drag]"
-        aria-hidden="true"
-      />
+      {!isWindows ? (
+        <div
+          className="absolute inset-x-0 top-0 z-50 h-12 [-webkit-app-region:drag]"
+          aria-hidden="true"
+        />
+      ) : null}
       <Button
-        className={`text-muted-foreground hover:bg-sidebar-accent hover:text-sidebar-accent-foreground absolute top-4 left-20 z-[60] size-8 rounded-lg [-webkit-app-region:no-drag] ${className ?? ""}`}
+        className={`text-muted-foreground hover:bg-sidebar-accent hover:text-sidebar-accent-foreground absolute top-4 z-[60] size-8 rounded-lg [-webkit-app-region:no-drag] ${isWindows ? "left-4" : "left-20"} ${className ?? ""}`}
         variant="ghost"
         size="icon"
         onClick={onToggle}
diff --git "a/docs/\345\217\221\345\270\203\346\265\201\347\250\213.md" "b/docs/\345\217\221\345\270\203\346\265\201\347\250\213.md"
index 2148389..90a7705 100644
--- "a/docs/\345\217\221\345\270\203\346\265\201\347\250\213.md"
+++ "b/docs/\345\217\221\345\270\203\346\265\201\347\250\213.md"
@@ -58,7 +58,9 @@ git push origin cli-v0.1.0
 
 SQLite 使用内置 `bun:sqlite`，Kysely 通过共享适配器同步访问；不分发 `better-sqlite3`。QuickJS Wasm 及其运行依赖作为外部文件复制，其他依赖参与打包。SQLite 验收覆盖加载、写入、事务回滚和重开恢复，Wasm 验收实际创建 QuickJS 上下文并执行代码。
 
-macOS 签名使用仓库 Secrets `MAC_CSC_LINK`（HTTPS 证书地址或 Base64 P12）、`MAC_CSC_KEY_PASSWORD` 和 `MAC_DEVELOPER_ID`（完整 Developer ID Application 标识）。CI 在临时钥匙串导入证书；`MAC_DEVELOPER_ID` 配置后开启签名。公证使用 `APPLE_ID`、`APPLE_APP_SPECIFIC_PASSWORD`、`APPLE_TEAM_ID`，映射到 Electrobun 的对应环境变量。未配置时生成本地验收包。Hutch 当前不自动签署 Windows 安装器，正式发布前按目标环境补充签名。
+macOS Actions 构建始终开启签名。PR 或未配置证书的发布使用免费临时签名身份 `-`；框架在生成更新归档和 DMG 前分别签署真实应用、外层自解压安装器与 DMG，不在归档生成后重新修改应用，避免破坏更新元数据和差分补丁。CI 挂载最终 DMG 校验安装器签名，并从更新归档解出真实应用做签名校验，任一步失败均停止上传。临时签名只保证包的签名完整性，不提供 Apple 开发者身份认证或公证，下载后仍可能受到 Gatekeeper 拦截。
+
+正式签名使用仓库 Secrets `MAC_CSC_LINK`（HTTPS 证书地址或 Base64 P12）、`MAC_CSC_KEY_PASSWORD` 和 `MAC_DEVELOPER_ID`（完整 Developer ID Application 标识）。发布流程在临时钥匙串导入证书，配置 `MAC_DEVELOPER_ID` 后使用正式身份替代临时签名。公证使用 `APPLE_ID`、`APPLE_APP_SPECIFIC_PASSWORD`、`APPLE_TEAM_ID`，映射到 Electrobun 的对应环境变量；无凭据时不提交公证。本机签名仍由 `TARP_CODESIGN`、`TARP_NOTARIZE` 与对应凭据控制。Hutch 当前不自动签署 Windows 安装器，正式发布前按目标环境补充签名。
 
 本机从根目录运行 `bun run dist` 后执行 `bun scripts/release/smoke.ts desktop` 验收稳定包；开发包可使用 `TARP_SMOKE_CHANNEL=dev`。最后一个任务上传以下附件，不自动公开 Release：
 
diff --git a/scripts/release/smoke.ts b/scripts/release/smoke.ts
index 045eb9a..b3d554b 100644
--- a/scripts/release/smoke.ts
+++ b/scripts/release/smoke.ts
@@ -94,6 +94,10 @@ try {
       process.platform === "darwin"
         ? join(directory, `${appName}.app/Contents`)
         : join(directory, appName);
+    if (process.platform === "darwin" && channel !== "dev") {
+      await execute("codesign", ["--verify", "--deep", "--strict", "--verbose=2", dirname(bundle)]);
+      console.log("macOS 更新归档中的应用签名验收通过。");
+    }
     const bin = join(bundle, process.platform === "darwin" ? "MacOS" : "bin");
     desktopApp = join(bundle, "Resources/app");
     executable = join(bin, process.platform === "win32" ? "bun.exe" : "bun");