@@ -65,19 +65,16 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
-      commit: ${{ steps.source.outputs.commit }}
       name: ${{ steps.channel.outputs.name }}
       app_id: ${{ steps.channel.outputs.app_id }}
       origin: ${{ steps.channel.outputs.origin }}
       release_repository: ${{ steps.channel.outputs.release_repository }}
       token_kind: ${{ steps.channel.outputs.token_kind }}
-      smoke_shards: ${{ steps.smoke.outputs.shards }}
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           persist-credentials: false
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.sha }}
 
       # Prerelease versions carry their environment in the tag: -dev.N is a
       # dev build, -staging.N a staging build. Legacy -alpha/-beta tags remain
@@ -108,7 +105,6 @@ jobs:
           echo "Building $NAME ($APP_ID) for $RELEASE_REPOSITORY; default origin: ${ORIGIN:-production}"
 
       - name: Validate release source
-        id: source
         env:
           PUBLISH: ${{ inputs.publish }}
           SIGN: ${{ inputs.sign }}
@@ -123,6 +119,10 @@ jobs:
             echo "::error::Manual desktop releases must use a stable source-repository tag."
             exit 1
           fi
+          if [ "$GITHUB_EVENT_NAME" = workflow_dispatch ] && [ "$GITHUB_REF" != "refs/tags/$VERSION" ]; then
+            echo "::error::Run this workflow from the $VERSION tag, so it executes only that tag's code and its caches stay scoped to that tag."
+            exit 1
+          fi
           if [ "$PUBLISH" = true ] && [ "$SIGN" != true ]; then
             echo "::error::Desktop releases must be signed before publication."
             exit 1
@@ -137,17 +137,6 @@ jobs:
             fi
           fi
 
-          echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Select available smoke partitioning
-        id: smoke
-        run: |
-          if [ -f scripts/desktop-e2e.ts ]; then
-            echo 'shards=[1,2,3,4]' >> "$GITHUB_OUTPUT"
-          else
-            echo 'shards=[1]' >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Validate release authentication
         if: ${{ inputs.publish }}
         env:
@@ -168,17 +157,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        shard: ${{ fromJSON(needs.source.outputs.smoke_shards) }}
+        shard: [1, 2, 3, 4]
     steps:
       - &checkout-source
         name: Checkout verified source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           persist-credentials: false
-          ref: ${{ needs.source.outputs.commit }}
 
-      - &setup-bun
-        name: Setup Bun
+      - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.4
@@ -218,9 +205,7 @@ jobs:
             exit 1
           fi
 
-      - &native-cache
-        name: Restore native compilation
-        if: hashFiles('.github/actions/desktop-native-cache/action.yml') != ''
+      - name: Restore native compilation
         uses: ./.github/actions/desktop-native-cache
 
       - &bundle-desktop
@@ -245,12 +230,7 @@ jobs:
           BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
           TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
           CONTINUE_SIGN_IN_REPORT_PATH: test-results/continue-sign-in-report.json
-        run: |
-          if [ -f ../../scripts/desktop-e2e.ts ]; then
-            bun run ../../scripts/desktop-e2e.ts ${{ matrix.shard }}/${{ strategy.job-total }}
-          else
-            bun run test:e2e --reporter=line,json
-          fi
+        run: bun run ../../scripts/desktop-e2e.ts ${{ matrix.shard }}/${{ strategy.job-total }}
 
       - name: Upload smoke coverage and timings
         if: always()
@@ -271,6 +251,8 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
+  # Restores no caches: every byte that gets signed comes from this checkout or
+  # a fresh download, never from a cache another run could have written.
   build:
     name: build
     needs: source
@@ -281,24 +263,18 @@ jobs:
     steps:
       - *checkout-source
 
-      - *setup-bun
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.4
+          no-cache: true
 
       - *setup-node
 
-      - name: Cache Electron binaries
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
-        with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-          key: electron-cache-${{ runner.os }}-${{ hashFiles('apps/desktop/package.json') }}
-
       - *install-dependencies
 
       - *inject-version
 
-      - *native-cache
-
       - name: Verify desktop source
         run: |
           bun run --cwd apps/desktop lint:check
 
@@ -108,7 +108,8 @@ The build also derives the app icon from `SIM_DESKTOP_DEFAULT_ORIGIN`. Every cha
 
 CI (`.github/workflows/desktop-release.yml`, wired into `ci.yml`):
 - Stable builds run only after `release` on a `vX.Y.Z:` commit to main — **never before**: `scripts/create-single-release.ts` skips creation if the tag exists, so a desktop job publishing first would eat the changelog. Stable assets remain on `simstudioai/sim`; dev/staging assets publish to the public `simstudioai/sim-desktop-releases` repository so source-repository followers are not notified for internal shell builds. The job builds `--publish never`; reruns verify the size and SHA-256 digest of existing release assets instead of overwriting them.
-- **Secrets gate**: `desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "desktop-release" → Run workflow with a `vX.Y.Z` version (`publish: false` uploads artifacts to the run instead of the release).
+- **Secrets gate**: `desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "desktop-release" → Run workflow, select the `vX.Y.Z` tag under "Use workflow from", and enter the same version (`publish: false` uploads artifacts to the run instead of the release). Any other ref is refused, so a run only executes the tag's own code and workflow, and its caches stay scoped to that tag.
+- **Cache trust**: the signed `build` job restores no caches, so nothing it signs can come from a cache another run wrote. Only the unsigned smoke jobs use caches.
 - The product semver is **injected** from the release tag into `apps/desktop/package.json` at build time (repo package versions are placeholders). A mismatch guard fails the build.
 - Fuses are flipped at package time (`electronFuses` in `electron-builder.yml`): runAsNode off, NODE_OPTIONS off, inspect args off, ASAR-only + integrity validation, and cookie encryption on. The packaged smoke test asserts every fuse byte so Electron upgrades fail until new fuses receive an explicit policy.
 - **Cookie-encryption go/no-go**: on every Electron bump, verify a packaged build keeps its session across relaunch (there are historical cookie-persistence bugs with the `EnableCookieEncryption` fuse). If it reproduces, set `enableCookieEncryption: false` and record it here.
 
@@ -13,5 +13,5 @@ The rendering-parity guarantee (identical to Chrome of the pinned version) is on
    - Workflow canvas (WebGL/ReactFlow), Monaco editing, a table export download.
    - Offline page appears with networking off; Retry recovers.
 6. **E2E:** `bun run test:e2e` green locally on the new pin; `desktop-e2e.yml` green in CI (the `latest` canary leg should already have hinted at surprises).
-7. **Signing/notarization smoke:** run `desktop-release.yml` via `workflow_dispatch` with `publish: false` against a test tag; `spctl`/`stapler` steps must pass.
+7. **Signing/notarization smoke:** run `desktop-release.yml` via `workflow_dispatch` with `publish: false`, selecting a test tag under "Use workflow from" and entering the same version; `spctl`/`stapler` steps must pass.
 8. **Ship** behind a staged rollout (10% `stagingPercentage`) and watch `update_error` / `renderer_gone` rates in the event logs before raising.
@@ -1,14 +1,17 @@
-import { createSerializer, parseAsString } from 'nuqs/server'
-import { SIM_LINK_SORTS } from '@/lib/sim-links/validation'
+import { truncateAtCodePoint } from '@sim/utils/string'
+import { createParser, createSerializer, parseAsString } from 'nuqs/server'
+import { SIM_LINK_SEARCH_MAX_LENGTH, SIM_LINK_SORTS } from '@/lib/sim-links/validation'
 import { createSortParams } from '@/lib/url-state'
 
+const boundedSearch = (value: string) => truncateAtCodePoint(value, SIM_LINK_SEARCH_MAX_LENGTH, '')
+
 /**
  * `create` opens the new-link editor, prefilled with its value as the name. `search` filters by
  * name, destination, or description.
  */
 export const simLinksParsers = {
   create: parseAsString,
-  search: parseAsString.withDefault(''),
+  search: createParser({ parse: boundedSearch, serialize: boundedSearch }).withDefault(''),
 } as const
 
 export const serializeSimLinkView = createSerializer(simLinksParsers)
 
@@ -8,7 +8,7 @@ import { useQueryStates } from 'nuqs'
 import type { SimLink } from '@/lib/api/contracts/sim-links'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { simLinkPath, simLinkUrl } from '@/lib/navigation/paths'
-import { toSimLinkName } from '@/lib/sim-links/validation'
+import { SIM_LINK_SEARCH_MAX_LENGTH, toSimLinkName } from '@/lib/sim-links/validation'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
 import {
   INSTALL_EXTENSION_ACTION,
@@ -132,6 +132,7 @@ export function SimLinks({ organizationId }: SimLinksProps) {
 
   const searchConfig: SearchConfig = {
     value: search,
+    maxLength: SIM_LINK_SEARCH_MAX_LENGTH,
     onChange: setSearch,
     onClearAll: () => setSearch(''),
     placeholder: SIM_LINKS_SEARCH_PLACEHOLDER,
 
@@ -9,11 +9,7 @@ import {
   type SimLinkResolution,
   suggestSimLinks,
 } from '@/lib/sim-links/application/use-cases'
-import {
-  parseTypedSimLink,
-  SIM_LINK_SEARCH_MAX_LENGTH,
-  simLinkNameSchema,
-} from '@/lib/sim-links/validation'
+import { parseTypedSimLink, simLinkNameSchema } from '@/lib/sim-links/validation'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import { LogoShell } from '@/app/(landing)/components/logo-shell'
 import { serializeSimLinkView } from '@/app/o/[organizationId]/links/search-params'
@@ -108,7 +104,7 @@ export default async function SimLinkPage({ params, searchParams }: SimLinkPageP
   const validName = simLinkNameSchema.safeParse(name).success
   // A name can't hold a space, so `sim card prices` is someone looking for a link, not naming one.
   if (result.kind === 'not_found' && /\s/.test(name)) {
-    redirect(serializeSimLinkView(library, { search: name.slice(0, SIM_LINK_SEARCH_MAX_LENGTH) }))
+    redirect(serializeSimLinkView(library, { search: name }))
   }
   const creatable = result.kind === 'not_found' && validName
   const similar = creatable