release candidates: every push to main runs the full CI, the acceptance matrix and the Linux / Windows installer builds in parallel (ci.yml) and records the green result per commit as the draft rc-<sha> (green.json last); a version-only bump commit (proven file by file with the version writers) reuses its parent's CI and matrix and rebuilds only the installers; a v* tag only promotes the candidate (release.yml), fails fast on a red or missing commit; acceptance runs carry a CLI key; tools/release.ts does the whole release on the Mac (bump, CHANGELOG cut, fast gate, push, tag, Mac build + notarize in parallel with Forgejo, cached macOS acceptance, add, verify, publish with one upload of the Mac files, /Applications update, npm commands) and --rehearsal; DMG notarization runs while the app and updater bundle are checked; rehearsal channel on the VDS; docs

tools/vds/apache-storebound-desktop.conf

@@ -5,6 +5,7 @@
 # document root, because the site's publish rsync deletes everything that is not in the repository.
 Alias /desktop/latest.json /var/www/storebound-desktop/latest.json
 Alias /desktop/beta/latest.json /var/www/storebound-desktop/beta/latest.json
+Alias /desktop/rehearsal/latest.json /var/www/storebound-desktop/rehearsal/latest.json
 Alias /desktop/dl/ /var/www/storebound-desktop/dl/
 <Directory /var/www/storebound-desktop>
   Options -Indexes -FollowSymLinks
@@ -15,7 +16,7 @@ Alias /desktop/dl/ /var/www/storebound-desktop/dl/
     Header set Content-Disposition "attachment"
   </FilesMatch>
 </Directory>
-<LocationMatch "^/desktop/(beta/)?latest\.json$">
+<LocationMatch "^/desktop/((beta|rehearsal)/)?latest\.json$">
   Header set Cache-Control "no-cache"
   Header set Access-Control-Allow-Origin "*"
 </LocationMatch>