diff --git a/.forgejo/workflows/portable.yml b/.forgejo/workflows/portable.yml
index 205659b..4472b63 100644
--- a/.forgejo/workflows/portable.yml
+++ b/.forgejo/workflows/portable.yml
@@ -51,9 +51,6 @@ jobs:
       - name: 데스크톱 번들 빌드
         run: npm run build --workspace=@d3ro/desktop
 
-      - name: 데스크톱 렌더러 번들 검증
-        run: node scripts/ci/verify-desktop-renderer-bundles.mjs
-
       - name: 휴대용 ZIP + Scoop 매니페스트 생성
         run: node scripts/ci/build-portable.mjs
 
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index d42bffd..3159540 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -62,7 +62,6 @@ jobs:
             throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
           }
           npm run build --workspace=@d3ro/desktop
-          node scripts/ci/verify-desktop-renderer-bundles.mjs
           Push-Location apps/desktop
           npx electron-builder --win --x64 --config electron-builder.yml --publish never
           node scripts/ci/verify-native-abi.mjs
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0db2b41..0694180 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -169,10 +169,6 @@ jobs:
       - name: Build Target Workspace
         run: ${{ matrix.cmd }}
 
-      - name: Verify Desktop Renderer Bundles
-        if: matrix.target == 'desktop'
-        run: node scripts/ci/verify-desktop-renderer-bundles.mjs
-
   # ──────────────────────────────────────────────────────────────────
   # 4. Android x86_64 artifacts and native dependency gate
   # ──────────────────────────────────────────────────────────────────
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75e3d44..1e5c634 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -109,9 +109,6 @@ jobs:
           npm run typecheck
           npm run build --workspace=@d3ro/desktop
 
-      - name: Verify Desktop Renderer Bundles
-        run: node scripts/ci/verify-desktop-renderer-bundles.mjs
-
       - name: Build STT Sidecar (local transcription engine)
         run: |
           # Local transcription depends on the faster-whisper sidecar; a release
@@ -192,9 +189,6 @@ jobs:
           npm run typecheck
           npm run build --workspace=@d3ro/desktop
 
-      - name: Verify Desktop Renderer Bundles
-        run: node scripts/ci/verify-desktop-renderer-bundles.mjs
-
       - name: Build STT Sidecar (local transcription engine)
         run: |
           # Local transcription depends on the faster-whisper sidecar; a release
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f3aaa8c..f6f813e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,17 +13,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cloud-optional backup (encrypted, opt-in)
 - Plugin system for custom pipelines
 
-## [1.3.7] - 2026-09-19
-
-### Fixed
-- **Recording and live caption overlays never worked in installed builds.** Popup
-  pages loaded their scripts as classic `<script src>` tags, which the renderer
-  build does not bundle, so a packaged app rendered only the static markup: the
-  recording tip froze at 0:00 with no wave bars and captions showed nothing.
-  Popup scripts are now module scripts, a packaging check fails when a renderer
-  page references an asset that was never emitted, and popups hold IPC until
-  their renderer is ready and re-assert visibility on every show.
-
 ## [1.3.6] - 2026-09-18
 
 ### Fixed
diff --git a/apps/admin-swagger/openapi.json b/apps/admin-swagger/openapi.json
index 7d3d32e..943a0e2 100644
--- a/apps/admin-swagger/openapi.json
+++ b/apps/admin-swagger/openapi.json
@@ -3,7 +3,7 @@
   "info": {
     "title": "D3RO-VOICE Admin API",
     "description": "Admin CRM Edge Functions for user management, subscription CRUD, payment history, and audit logs.",
-    "version": "1.3.7"
+    "version": "1.3.6"
   },
   "servers": [
     {
diff --git a/apps/admin/package.json b/apps/admin/package.json
index 7270b2a..ec9a77f 100644
--- a/apps/admin/package.json
+++ b/apps/admin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/admin",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice Admin CRM — SaaS 관리 도구",
   "scripts": {
diff --git a/apps/api-server/D3ROVoice.Api.csproj b/apps/api-server/D3ROVoice.Api.csproj
index fb058c9..4543483 100644
--- a/apps/api-server/D3ROVoice.Api.csproj
+++ b/apps/api-server/D3ROVoice.Api.csproj
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
-    <Version>1.3.7</Version>
+    <Version>1.3.6</Version>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index dc1f42f..35b1769 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/desktop",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "productName": "d3ro-voice",
   "description": "로컬 AI 음성 어시스턴트 (Electron)",
   "main": "./out/main/index.js",
diff --git a/apps/desktop/src/main/windows/WindowManager.ts b/apps/desktop/src/main/windows/WindowManager.ts
index 2d0d6f8..6f39eea 100644
--- a/apps/desktop/src/main/windows/WindowManager.ts
+++ b/apps/desktop/src/main/windows/WindowManager.ts
@@ -62,99 +62,6 @@ function getPopupI18nStrings(): Record<string, string> {
   }
 }
 
-// ── Popup window lifecycle ────────────────────────────
-
-/** Popup windows whose renderer finished loading and can receive IPC */
-const popupReady = new WeakSet<BrowserWindow>()
-/** IPC messages held back until the popup renderer is ready */
-const pendingPopupMessages = new WeakMap<BrowserWindow, Array<{ channel: string; data: unknown }>>()
-
-/**
- * Promote popup renderer console output and load failures into the main log.
- * Popups have no renderer logging otherwise, so a missing asset or a script
- * exception stays invisible and the popup just renders static markup.
- */
-function hookPopupDiagnostics(win: BrowserWindow, name: string): void {
-  win.webContents.on('console-message', (_event, level, message, line, sourceId) => {
-    logger.info(`[${name}] [Renderer] [${level}] ${message} (${sourceId}:${line})`)
-  })
-  win.webContents.on('did-fail-load', (_event, errorCode, errorDescription, validatedURL) => {
-    logger.error(`[${name}] renderer load failed [${errorCode}] ${errorDescription} (${validatedURL})`)
-  })
-  win.webContents.on('render-process-gone', (_event, details) => {
-    logger.error(`[${name}] renderer process gone: ${details.reason} (exitCode=${details.exitCode})`)
-  })
-}
-
-/**
- * Deliver IPC to a popup even while its renderer is still loading.
- * webContents.send before load is silently dropped, which leaves popups stuck
- * on their initial markup (for example a frozen 0:00 timer).
- */
-function sendToPopupWindow(win: BrowserWindow, channel: string, data: unknown): void {
-  if (win.isDestroyed() || win.webContents.isDestroyed()) return
-
-  if (popupReady.has(win)) {
-    win.webContents.send(channel, data)
-    return
-  }
-
-  const queue = pendingPopupMessages.get(win) ?? []
-  queue.push({ channel, data })
-  if (queue.length > 32) {
-    queue.splice(0, queue.length - 32)
-  }
-  pendingPopupMessages.set(win, queue)
-}
-
-function flushPopupMessages(win: BrowserWindow): void {
-  popupReady.add(win)
-
-  const queue = pendingPopupMessages.get(win)
-  if (!queue || queue.length === 0) return
-
-  pendingPopupMessages.delete(win)
-  for (const message of queue) {
-    if (!win.isDestroyed() && !win.webContents.isDestroyed()) {
-      win.webContents.send(message.channel, message.data)
-    }
-  }
-}
-
-/** Shared popup lifecycle: diagnostics + load tracking + theme injection */
-function attachPopupLifecycle(win: BrowserWindow, name: string): void {
-  hookPopupDiagnostics(win, name)
-
-  win.webContents.on('did-start-loading', () => {
-    popupReady.delete(win)
-  })
-
-  win.webContents.on('did-finish-load', () => {
-    injectPopupTheme(win)
-    flushPopupMessages(win)
-  })
-}
-
-/**
- * Show a popup without stealing focus, reliably on every call.
- * After hide(), showInactive() can lose z-order and repaint, so popups stopped
- * appearing from the second show onward: re-assert topmost and force a repaint.
- */
-function presentPopup(win: BrowserWindow, level?: 'floating' | 'screen-saver'): void {
-  if (!win.isVisible()) {
-    win.showInactive()
-  }
-
-  // Z-order/repaint adjustments must never break a capture session.
-  try {
-    win.setAlwaysOnTop(true, level)
-    win.moveTop()
-    win.webContents.invalidate()
-  } catch (err) {
-    logger.warn(`Popup present adjustment failed: ${err instanceof Error ? err.message : String(err)}`)
-  }
-}
-
 // ── 윈도우 참조 ───────────────────────────────────────
 
 let mainWindow: BrowserWindow | null = null
@@ -292,7 +199,9 @@ function createRecordingTipWindow(): BrowserWindow {
     win.loadFile(join(__dirname, '../renderer/popups/recording-tip/index.html'))
   }
 
-  attachPopupLifecycle(win, 'recording-tip')
+  win.webContents.on('did-finish-load', () => {
+    injectPopupTheme(win)
+  })
 
   win.on('closed', () => {
     recordingTipWindow = null
@@ -344,9 +253,10 @@ export function showRecordingTip(
   win.setBounds({ x, y, width: TIP_WIDTH, height: TIP_HEIGHT })
 
   // 상태 전송 후 즉시 show (2-phase 제거 — 숨겨진 윈도우의 렌더러 비활성 문제 방지)
-  sendToPopupWindow(win, IPC_CHANNELS.WINDOW.TIP_STATE_CHANGED, { state, _i18n: getPopupI18nStrings(), ...params })
-  presentPopup(win, 'screen-saver')
-  logger.debug(`RecordingTip presented: state=${state} visible=${win.isVisible()} loading=${win.webContents.isLoading()}`)
+  win.webContents.send(IPC_CHANNELS.WINDOW.TIP_STATE_CHANGED, { state, _i18n: getPopupI18nStrings(), ...params })
+  if (!win.isVisible()) {
+    win.showInactive()
+  }
 }
 
 export function hideRecordingTip(): void {
@@ -360,20 +270,20 @@ export function updateRecordingTipState(
   params?: { text?: string; errorMessage?: string }
 ): void {
   if (recordingTipWindow && !recordingTipWindow.isDestroyed()) {
-    sendToPopupWindow(recordingTipWindow, IPC_CHANNELS.WINDOW.TIP_STATE_CHANGED, { state, _i18n: getPopupI18nStrings(), ...params })
+    recordingTipWindow.webContents.send(IPC_CHANNELS.WINDOW.TIP_STATE_CHANGED, { state, _i18n: getPopupI18nStrings(), ...params })
   }
 }
 
 export function sendAudioLevelToTip(level: number): void {
   if (recordingTipWindow && !recordingTipWindow.isDestroyed()) {
-    sendToPopupWindow(recordingTipWindow, IPC_CHANNELS.VOICE.AUDIO_LEVEL, { level })
+    recordingTipWindow.webContents.send(IPC_CHANNELS.VOICE.AUDIO_LEVEL, { level })
   }
 }
 
 /** 실시간 부분 전사 텍스트를 RecordingTip에 전달 */
 export function sendPartialTranscriptToTip(text: string): void {
   if (recordingTipWindow && !recordingTipWindow.isDestroyed()) {
-    sendToPopupWindow(recordingTipWindow, IPC_CHANNELS.VOICE_PARTIAL.PARTIAL_TRANSCRIPT, { text })
+    recordingTipWindow.webContents.send(IPC_CHANNELS.VOICE_PARTIAL.PARTIAL_TRANSCRIPT, { text })
   }
 }
 
@@ -404,7 +314,9 @@ function createResultPopupWindow(): BrowserWindow {
     win.loadFile(join(__dirname, '../renderer/popups/result-popup/index.html'))
   }
 
-  attachPopupLifecycle(win, 'result-popup')
+  win.webContents.on('did-finish-load', () => {
+    injectPopupTheme(win)
+  })
 
   win.on('closed', () => {
     resultPopupWindow = null
@@ -428,7 +340,7 @@ export function showResultPopup(text: string, autoHideMs = 5000): void {
   const win = getResultPopupWindow()
 
   // Phase 1: prepare
-  sendToPopupWindow(win, IPC_CHANNELS.POPUP_RESULT.PREPARE, { text, _i18n: getPopupI18nStrings() })
+  win.webContents.send(IPC_CHANNELS.POPUP_RESULT.PREPARE, { text, _i18n: getPopupI18nStrings() })
 
   ipcMain.once(IPC_CHANNELS.POPUP_RESULT.MEASURED, (_event, data: { width: number; height: number }) => {
     const cursorPos = screen.getCursorScreenPoint()
@@ -447,10 +359,12 @@ export function showResultPopup(text: string, autoHideMs = 5000): void {
 
     win.setBounds({ x, y, width: data.width, height: data.height })
 
-    presentPopup(win)
+    if (!win.isVisible()) {
+      win.showInactive()
+    }
 
     // Phase 2: show
-    sendToPopupWindow(win, IPC_CHANNELS.POPUP_RESULT.SHOW, { autoHideMs })
+    win.webContents.send(IPC_CHANNELS.POPUP_RESULT.SHOW, { autoHideMs })
   })
 }
 
@@ -487,7 +401,9 @@ function createHistoryPopupWindow(): BrowserWindow {
     win.loadFile(join(__dirname, '../renderer/popups/history-popup/index.html'))
   }
 
-  attachPopupLifecycle(win, 'history-popup')
+  win.webContents.on('did-finish-load', () => {
+    injectPopupTheme(win)
+  })
 
   win.on('closed', () => {
     historyPopupWindow = null
@@ -524,16 +440,18 @@ export function showHistoryPopup(entries: Array<Record<string, unknown>>): void
 
   win.setBounds({ x, y, width: popupWidth, height: popupHeight })
 
-  sendToPopupWindow(win, IPC_CHANNELS.POPUP_HISTORY.SHOW_ITEMS, { entries, _i18n: getPopupI18nStrings() })
+  win.webContents.send(IPC_CHANNELS.POPUP_HISTORY.SHOW_ITEMS, { entries, _i18n: getPopupI18nStrings() })
 
-  presentPopup(win)
+  if (!win.isVisible()) {
+    win.showInactive()
+  }
 
-  sendToPopupWindow(win, IPC_CHANNELS.POPUP_HISTORY.SHOW, {})
+  win.webContents.send(IPC_CHANNELS.POPUP_HISTORY.SHOW, {})
 }
 
 export function hideHistoryPopup(): void {
   if (historyPopupWindow && !historyPopupWindow.isDestroyed()) {
-    sendToPopupWindow(historyPopupWindow, IPC_CHANNELS.POPUP_HISTORY.HIDE, {})
+    historyPopupWindow.webContents.send(IPC_CHANNELS.POPUP_HISTORY.HIDE, {})
     setTimeout(() => {
       if (historyPopupWindow && !historyPopupWindow.isDestroyed()) {
         historyPopupWindow.hide()
@@ -544,7 +462,7 @@ export function hideHistoryPopup(): void {
 
 export function sendKeyToHistoryPopup(key: string): void {
   if (historyPopupWindow && !historyPopupWindow.isDestroyed() && historyPopupWindow.isVisible()) {
-    sendToPopupWindow(historyPopupWindow, IPC_CHANNELS.POPUP_HISTORY.KEY_EVENT, { key })
+    historyPopupWindow.webContents.send(IPC_CHANNELS.POPUP_HISTORY.KEY_EVENT, { key })
   }
 }
 
@@ -579,7 +497,9 @@ function createCommandPopupWindow(): BrowserWindow {
     win.loadFile(join(__dirname, '../renderer/popups/command-popup/index.html'))
   }
 
-  attachPopupLifecycle(win, 'command-popup')
+  win.webContents.on('did-finish-load', () => {
+    injectPopupTheme(win)
+  })
 
   win.on('closed', () => { commandPopupWindow = null })
   return win
@@ -607,15 +527,15 @@ export function showCommandPopup(commands: Array<Record<string, unknown>>, activ
   if (y < display.workArea.y) { y = cursorPos.y + 20 }
 
   win.setBounds({ x, y, width: popupWidth, height: popupHeight })
-  sendToPopupWindow(win, IPC_CHANNELS.POPUP_COMMAND.SHOW_ITEMS, { commands, activeId, _i18n: getPopupI18nStrings() })
+  win.webContents.send(IPC_CHANNELS.POPUP_COMMAND.SHOW_ITEMS, { commands, activeId, _i18n: getPopupI18nStrings() })
 
-  presentPopup(win)
-  sendToPopupWindow(win, IPC_CHANNELS.POPUP_COMMAND.SHOW, {})
+  if (!win.isVisible()) { win.showInactive() }
+  win.webContents.send(IPC_CHANNELS.POPUP_COMMAND.SHOW, {})
 }
 
 export function hideCommandPopup(): void {
   if (commandPopupWindow && !commandPopupWindow.isDestroyed()) {
-    sendToPopupWindow(commandPopupWindow, IPC_CHANNELS.POPUP_COMMAND.HIDE, {})
+    commandPopupWindow.webContents.send(IPC_CHANNELS.POPUP_COMMAND.HIDE, {})
     setTimeout(() => {
       if (commandPopupWindow && !commandPopupWindow.isDestroyed()) {
         commandPopupWindow.hide()
@@ -626,7 +546,7 @@ export function hideCommandPopup(): void {
 
 export function sendKeyToCommandPopup(key: string): void {
   if (commandPopupWindow && !commandPopupWindow.isDestroyed() && commandPopupWindow.isVisible()) {
-    sendToPopupWindow(commandPopupWindow, IPC_CHANNELS.POPUP_COMMAND.KEY_EVENT, { key })
+    commandPopupWindow.webContents.send(IPC_CHANNELS.POPUP_COMMAND.KEY_EVENT, { key })
   }
 }
 
@@ -671,7 +591,9 @@ function createCaptionOverlayWindow(): BrowserWindow {
     win.loadFile(join(__dirname, '../renderer/popups/caption-overlay/index.html'))
   }
 
-  attachPopupLifecycle(win, 'caption-overlay')
+  win.webContents.on('did-finish-load', () => {
+    injectPopupTheme(win)
+  })
 
   win.on('closed', () => {
     captionOverlayWindow = null
@@ -690,19 +612,21 @@ export function getCaptionOverlayWindow(): BrowserWindow {
 
 export function showCaptionOverlay(): void {
   const win = getCaptionOverlayWindow()
-  presentPopup(win)
+  if (!win.isVisible()) {
+    win.showInactive()
+  }
 }
 
 export function hideCaptionOverlay(): void {
   if (captionOverlayWindow && !captionOverlayWindow.isDestroyed()) {
-    sendToPopupWindow(captionOverlayWindow, IPC_CHANNELS.POPUP_CAPTION.HIDE, {})
+    captionOverlayWindow.webContents.send(IPC_CHANNELS.POPUP_CAPTION.HIDE, {})
     captionOverlayWindow.hide()
   }
 }
 
 export function sendToCaptionOverlay(channel: string, data: unknown): void {
   if (captionOverlayWindow && !captionOverlayWindow.isDestroyed()) {
-    sendToPopupWindow(captionOverlayWindow, channel, data)
+    captionOverlayWindow.webContents.send(channel, data)
   }
 }
 
diff --git a/apps/desktop/src/renderer/popups/caption-overlay/index.html b/apps/desktop/src/renderer/popups/caption-overlay/index.html
index 520866a..b9b33f8 100644
--- a/apps/desktop/src/renderer/popups/caption-overlay/index.html
+++ b/apps/desktop/src/renderer/popups/caption-overlay/index.html
@@ -12,7 +12,6 @@
       <div id="lines"></div>
     </div>
   </div>
-  <!-- type="module" 필수: Vite 번들에는 모듈 스크립트만 포함된다(누락 시 자막이 렌더되지 않는다). -->
-  <script type="module" src="./script.js"></script>
+  <script src="./script.js"></script>
 </body>
 </html>
diff --git a/apps/desktop/src/renderer/popups/command-popup/index.html b/apps/desktop/src/renderer/popups/command-popup/index.html
index 996a62f..664087f 100644
--- a/apps/desktop/src/renderer/popups/command-popup/index.html
+++ b/apps/desktop/src/renderer/popups/command-popup/index.html
@@ -19,7 +19,6 @@
       </div>
     </div>
   </div>
-  <!-- type="module" 필수: Vite 번들에는 모듈 스크립트만 포함된다. -->
-  <script type="module" src="./script.js"></script>
+  <script src="./script.js"></script>
 </body>
 </html>
diff --git a/apps/desktop/src/renderer/popups/history-popup/index.html b/apps/desktop/src/renderer/popups/history-popup/index.html
index 0a461e5..780a1fb 100644
--- a/apps/desktop/src/renderer/popups/history-popup/index.html
+++ b/apps/desktop/src/renderer/popups/history-popup/index.html
@@ -17,7 +17,6 @@
       </div>
     </div>
   </div>
-  <!-- type="module" 필수: Vite 번들에는 모듈 스크립트만 포함된다. -->
-  <script type="module" src="./script.js"></script>
+  <script src="./script.js"></script>
 </body>
 </html>
diff --git a/apps/desktop/src/renderer/popups/recording-tip/index.html b/apps/desktop/src/renderer/popups/recording-tip/index.html
index 623064c..58ea4ba 100644
--- a/apps/desktop/src/renderer/popups/recording-tip/index.html
+++ b/apps/desktop/src/renderer/popups/recording-tip/index.html
@@ -34,7 +34,6 @@
       </div>
     </div>
   </div>
-  <!-- type="module" 필수: Vite 번들에는 모듈 스크립트만 포함된다. -->
-  <script type="module" src="./script.js"></script>
+  <script src="./script.js"></script>
 </body>
 </html>
diff --git a/apps/desktop/src/renderer/popups/result-popup/index.html b/apps/desktop/src/renderer/popups/result-popup/index.html
index 6457d33..552fe47 100644
--- a/apps/desktop/src/renderer/popups/result-popup/index.html
+++ b/apps/desktop/src/renderer/popups/result-popup/index.html
@@ -23,7 +23,6 @@
       </div>
     </div>
   </div>
-  <!-- type="module" 필수: Vite 번들에는 모듈 스크립트만 포함된다. -->
-  <script type="module" src="./script.js"></script>
+  <script src="./script.js"></script>
 </body>
 </html>
diff --git a/apps/mobile-rn/android/app/build.gradle b/apps/mobile-rn/android/app/build.gradle
index b71db41..745b471 100644
--- a/apps/mobile-rn/android/app/build.gradle
+++ b/apps/mobile-rn/android/app/build.gradle
@@ -151,8 +151,8 @@ def versionSettingsValid = configuredVersionName != null &&
     configuredVersionName ==~ strictSemver &&
     configuredVersionCodeValue != null &&
     configuredVersionCodeValue <= 2100000000L
-def resolvedVersionName = versionSettingsValid ? configuredVersionName : "1.3.7"
-def resolvedVersionCode = versionSettingsValid ? configuredVersionCodeValue.toInteger() : 1031007
+def resolvedVersionName = versionSettingsValid ? configuredVersionName : "1.3.6"
+def resolvedVersionCode = versionSettingsValid ? configuredVersionCodeValue.toInteger() : 1031006
 
 def requiredReleaseSettings = [
     D3RO_RELEASE_STORE_FILE: releaseStoreFilePath,
diff --git a/apps/mobile-rn/ios/D3ROVoice.xcodeproj/project.pbxproj b/apps/mobile-rn/ios/D3ROVoice.xcodeproj/project.pbxproj
index 24b59d2..faf7162 100644
--- a/apps/mobile-rn/ios/D3ROVoice.xcodeproj/project.pbxproj
+++ b/apps/mobile-rn/ios/D3ROVoice.xcodeproj/project.pbxproj
@@ -257,7 +257,7 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
-				CURRENT_PROJECT_VERSION = 1031007;
+				CURRENT_PROJECT_VERSION = 1031006;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = D3ROVoice/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
@@ -265,7 +265,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.3.7;
+				MARKETING_VERSION = 1.3.6;
 				OTHER_LDFLAGS = (
 					"$(inherited)",
 					"-ObjC",
@@ -287,14 +287,14 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
-				CURRENT_PROJECT_VERSION = 1031007;
+				CURRENT_PROJECT_VERSION = 1031006;
 				INFOPLIST_FILE = D3ROVoice/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = 15.1;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 1.3.7;
+				MARKETING_VERSION = 1.3.6;
 				OTHER_LDFLAGS = (
 					"$(inherited)",
 					"-ObjC",
diff --git a/apps/mobile-rn/metadata/android/en-US/changelogs/1031007.txt b/apps/mobile-rn/metadata/android/en-US/changelogs/1031007.txt
deleted file mode 100644
index 2ea3629..0000000
--- a/apps/mobile-rn/metadata/android/en-US/changelogs/1031007.txt
+++ /dev/null
@@ -1 +0,0 @@
-Overlay fixes: the recording waveform/timer and live captions now display correctly.
diff --git a/apps/mobile-rn/metadata/android/ko-KR/changelogs/1031007.txt b/apps/mobile-rn/metadata/android/ko-KR/changelogs/1031007.txt
deleted file mode 100644
index 031c828..0000000
--- a/apps/mobile-rn/metadata/android/ko-KR/changelogs/1031007.txt
+++ /dev/null
@@ -1 +0,0 @@
-오버레이 수정: 녹음 파형/타이머와 실시간 자막이 정상 표시됩니다.
diff --git a/apps/mobile-rn/package-lock.json b/apps/mobile-rn/package-lock.json
index e3cbe30..351b628 100644
--- a/apps/mobile-rn/package-lock.json
+++ b/apps/mobile-rn/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@d3ro/mobile-rn",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@d3ro/mobile-rn",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "dependencies": {
         "@d3ro/api-client": "file:../../packages/api-client",
         "@d3ro/core": "file:../../packages/core",
@@ -62,7 +62,7 @@
     },
     "../..": {
       "name": "d3ro-voice-monorepo",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "workspaces": [
         "apps/desktop",
@@ -81,7 +81,7 @@
     },
     "../../packages/api-client": {
       "name": "@d3ro/api-client",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "@d3ro/core": "*",
@@ -98,7 +98,7 @@
     },
     "../../packages/core": {
       "name": "@d3ro/core",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "docx": "^9.6.1"
@@ -109,7 +109,7 @@
     },
     "../../packages/i18n": {
       "name": "@d3ro/i18n",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "devDependencies": {
         "@types/react": "^19.0.0"
@@ -120,7 +120,7 @@
     },
     "../../packages/ui-native": {
       "name": "@d3ro/ui-native",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "devDependencies": {
         "@types/react": "*"
diff --git a/apps/mobile-rn/package.json b/apps/mobile-rn/package.json
index 81ef219..d18dab4 100644
--- a/apps/mobile-rn/package.json
+++ b/apps/mobile-rn/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/mobile-rn",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "scripts": {
     "android": "react-native run-android",
diff --git a/apps/web/package.json b/apps/web/package.json
index 8fbf2a1..137143b 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/web",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice 웹 앱 — Next.js 기반 SaaS 인터페이스",
   "scripts": {
diff --git a/apps/web/src/components/layout/sidebar.tsx b/apps/web/src/components/layout/sidebar.tsx
index e4a0264..b678848 100644
--- a/apps/web/src/components/layout/sidebar.tsx
+++ b/apps/web/src/components/layout/sidebar.tsx
@@ -139,7 +139,7 @@ export function Sidebar(): React.ReactElement {
           </PhosphorText>
         </Box>
         <Box sx={{ fontSize: '10px', fontFamily: 'ui-monospace, monospace', color: d3roPalette.text.muted }}>
-          v1.3.7
+          v1.3.6
         </Box>
       </Box>
 
diff --git a/docs/map/00-index.md b/docs/map/00-index.md
index d3413ac..6599721 100644
--- a/docs/map/00-index.md
+++ b/docs/map/00-index.md
@@ -2,8 +2,7 @@
 
 > Status: ACTIVE
 > Last full audit: 2026-09-13
-> Last update: 2026-09-19 — GAP-INFRA-05 (desktop renderer popup bundle verification wired into CI); 1.3.7 published to the updater feed
-> Scope: entire monorepo `D:/workspace/D3ROVoice` at product version `1.3.7`
+> Scope: entire monorepo `D:/workspace/D3ROVoice` at product version `1.3.6`
 > Purpose: let any agent (or human) answer two questions in under a minute:
 > 1. **What infrastructure exists?** (build, CI, services, APIs, data, packages, deploy)
 > 2. **How far is each feature developed?** (per surface, with file anchors and status)
diff --git a/docs/map/02-infrastructure.md b/docs/map/02-infrastructure.md
index 32507a0..d8233ab 100644
--- a/docs/map/02-infrastructure.md
+++ b/docs/map/02-infrastructure.md
@@ -78,7 +78,6 @@ npm run release:metadata[:test]
 npm run release:forgejo[:check]  # canonical Forgejo publisher/feed
 npm run release:tag             # annotated/signed immutable release tag
 npm run security:secrets[:test] # hardcoded-secret scanner
-npm run check:desktop-renderer[:test] # built renderer pages reference only assets on disk
 npm run test:e2e:red            # content-report red e2e
 npm run release:mobile:boundary[:test]
 npm run release:mobile:config[:test]
@@ -137,7 +136,7 @@ See [`03-shared-packages.md`](./03-shared-packages.md). Summary:
 
 ### GitLab CI (`.gitlab-ci.yml`)
 
-Stages `validate → test → build → e2e → package → publish → deploy`. Primary pipeline for desktop Windows/macOS releases (Forgejo Generic Registry is the canonical updater feed; GitLab project 1172 is a legacy mirror) and production mobile releases (`mobile-production-release`, manual/protected). Admin NAS deploy job is intentionally **disabled**. `package-windows`/`package-macos` build the faster-whisper sidecar (`sidecar:setup` → `sidecar:build`) and run `scripts/ci/verify-sidecar-bundle.mjs` before electron-builder, so a release can never ship without the local STT engine. Every pipeline that runs `npm run build --workspace=@d3ro/desktop` (`.forgejo` release/portable, `.github` CI/release) then runs `scripts/ci/verify-desktop-renderer-bundles.mjs`, which fails packaging when a renderer page references an asset the build did not emit (GAP-INFRA-05).
+Stages `validate → test → build → e2e → package → publish → deploy`. Primary pipeline for desktop Windows/macOS releases (Forgejo Generic Registry is the canonical updater feed; GitLab project 1172 is a legacy mirror) and production mobile releases (`mobile-production-release`, manual/protected). Admin NAS deploy job is intentionally **disabled**. `package-windows`/`package-macos` build the faster-whisper sidecar (`sidecar:setup` → `sidecar:build`) and run `scripts/ci/verify-sidecar-bundle.mjs` before electron-builder, so a release can never ship without the local STT engine.
 
 ### Forgejo Actions (`.forgejo/workflows/`)
 `portable.yml` — 태그/수동 실행으로 **서명 없이** portable 채널(95MiB 7z 분할 볼륨 + Scoop 매니페스트 + 설치 스크립트)을 게시한다. `WIN_CSC_*` 불필요, updater feed는 건드리지 않는다.
@@ -192,7 +191,7 @@ Full detail: [`09-supabase-backend.md`](./09-supabase-backend.md).
 
 | File | Purpose |
 |---|---|
-| `release/product-version.json` | version `1.3.7`, `androidVersionCode`/`iosBuildNumber` `1031007`, releaseDate, desktop license keyId |
+| `release/product-version.json` | version `1.3.6`, `androidVersionCode`/`iosBuildNumber` `1031006`, releaseDate, desktop license keyId |
 | `release/android-release-identity.json` | package `com.d3ro.voice`, Play app ID, app-signing SHA-256, upload cert SHA-256, evidence keyId, AdMob unit IDs |
 | `release/desktop-license-public.pem` | Ed25519 public key for desktop offline licenses |
 | `release/mobile-release-evidence-public.pem` | Ed25519 public key for mobile release evidence |
diff --git a/docs/map/04-desktop-app.md b/docs/map/04-desktop-app.md
index 317ae42..dd6e5df 100644
--- a/docs/map/04-desktop-app.md
+++ b/docs/map/04-desktop-app.md
@@ -146,12 +146,6 @@ Preload exposes **`window.electronAPI`** with 33 namespaces: `platform, audio, c
 
 `windows/WindowManager.ts` creates 6 windows: main (borderless, custom TitleBar; macOS `hiddenInset`), recording-tip, result-popup, history-popup, command-popup, caption-overlay. Injects popup theme CSS + i18n strings; 2-phase resize. `windows/TrayManager.ts` — tray icon + menu + double-click show.
 
-**Popup invariants** (each shipped broken once — do not regress):
-
-- 팝업 HTML의 스크립트는 반드시 `<script type="module">`로 선언한다. Vite는 모듈 스크립트만 번들에 포함하므로 classic `<script src="./script.js">`는 dev에서만 로드되고 패키징 산출물에서는 파일 자체가 사라진다(오버레이가 정적 HTML로 멈춘 원인). `scripts/ci/verify-desktop-renderer-bundles.mjs`가 빌드 HTML이 참조하는 모든 로컬 asset의 존재를 검사한다.
-- 렌더러 로드 전의 `webContents.send`는 조용히 버려진다. 팝업 전송은 `sendToPopupWindow`를 쓰고, 이 함수가 `did-finish-load`까지 메시지를 보관했다가 전달한다. `attachPopupLifecycle`이 로드 상태 추적·테마 주입·팝업 렌더러 진단 로그를 한 곳에서 묶는다.
-- 팝업 표시는 `presentPopup`으로 통일한다(`showInactive` + topmost 재선언 + `moveTop` + `webContents.invalidate`). 한 번 `hide()`된 팝업이 두 번째 표시에서 z-order/repaint를 잃어 보이지 않던 문제를 막는다.
-
 Vanilla popups (`src/renderer/popups/`):
 | Popup | Purpose |
 |---|---|
diff --git a/docs/map/10-feature-catalog.md b/docs/map/10-feature-catalog.md
index 500a2f9..6a6ae29 100644
--- a/docs/map/10-feature-catalog.md
+++ b/docs/map/10-feature-catalog.md
@@ -17,7 +17,7 @@ Status quick-reference: `[x]` done+verified · `[~]` partial/unverified · `[ ]`
 | CAP-01 | Push-to-talk dictation (hold/release) | [x] | [-] | [x] | [-] | Desktop `VoiceModeService`; mobile RecordScreen via app CTA/notification action (no global hotkey) |
 | CAP-02 | Hands-free toggle dictation | [x] | [-] | [x] | [-] | Desktop double-press; mobile toggle |
 | CAP-03 | Live partial transcript while recording | [x] | [ ] | [ ] | [-] | Desktop `voice:partialTranscript` + recording-tip; producer added in `1.3.0` (`VoiceModeService._runPartial` → `LocalSTTService.transcribePartial`, 1.5 s cadence / 7.5 s window, never inserted). The row was `[x]` before any producer existed. |
-| CAP-04 | Recording waveform + level meter | [x] | [x] | [x] | [-] | Desktop 9-bar cos distribution; mobile audio level; the recording-tip popup bundle and its on-disk assets are verified by `scripts/ci/verify-desktop-renderer-bundles.mjs` |
+| CAP-04 | Recording waveform + level meter | [x] | [x] | [x] | [-] | Desktop 9-bar cos distribution; mobile audio level |
 | CAP-05 | Device/mic selection | [x] | [ ] | [~] | [-] | Desktop config; mobile uses system default |
 | CAP-06 | System/loopback audio capture | [x] | [-] | [ ] | [-] | Desktop only (caption source); mobile policy-limited |
 | CAP-07 | Local Whisper STT | [x] | [-] | [x] | [-] | Desktop ships the faster-whisper sidecar (`resources/sidecar`, built by `sidecar:build`, verified by `scripts/ci/verify-sidecar-bundle.mjs`), warms it up at app start, and connects over IPv4 loopback; mobile on-device Whisper (supported devices) |
@@ -26,7 +26,7 @@ Status quick-reference: `[x]` done+verified · `[~]` partial/unverified · `[ ]`
 | CAP-10 | STT model download/management UI | [x] | [-] | [~] | [-] | Desktop model manager + onboarding; mobile bundled model |
 | CAP-11 | File transcription (audio/video) | [x] | [ ] | [x] | [~] | Desktop ffmpeg chunking; mobile import picker; web deferred |
 | CAP-12 | Audio import from other apps (share intent) | [-] | [-] | [x] | [-] | Mobile Android `ACTION_SEND`/`ACTION_VIEW` (SSOT R-016 GREEN) |
-| CAP-13 | Live captions overlay | [x] | [-] | [-] | [-] | Desktop `CaptionService` + caption-overlay popup; popup assets verified in the packaged build (`scripts/ci/verify-desktop-renderer-bundles.mjs`); GAP-INFRA-05 |
+| CAP-13 | Live captions overlay | [x] | [-] | [-] | [-] | Desktop `CaptionService` + caption-overlay popup |
 | CAP-14 | Recording persistence / crash recovery | [x] | [ ] | [x] | [-] | Desktop WAV persist; mobile durable queue + process-kill WAV recovery |
 | CAP-15 | Android foreground recording service | [-] | [-] | [x] | [-] | Mobile API 34 FGS + persistent notification (SSOT R-005 GREEN) |
 
diff --git a/docs/map/11-gap-backlog.md b/docs/map/11-gap-backlog.md
index a539482..47d0dc7 100644
--- a/docs/map/11-gap-backlog.md
+++ b/docs/map/11-gap-backlog.md
@@ -21,9 +21,9 @@ Legend: `[ ]` open · `[~]` in progress · `[!]` blocked externally · `[x]` res
 | ID | Area | Gap | Evidence | Suggested next step |
 |---|---|---|---|---|
 | GAP-QA-01 | Quality | Extreme Red Team: headful end-to-end bug hunting across real desktop Electron, Web Next.js, and CI pipelines. | `red_team_log.md`, `tests/e2e/red_team_cycle*.spec.ts`, `apps/web/e2e/red_team_cycle4_web.spec.ts` | `[x]` 2026-09-15: 18 scenarios executed, 14 defects caught and 100% resolved (infinite chunking loop DEF-008, IPC signature mismatch DEF-004, markdown editor typing rollback DEF-006, Web RSC Link serialization DEF-012, secret scanner lookahead DEF-013, etc.). All 18 scenarios GREEN with zero regressions. |
-| GAP-REL-01 | Release | Official release publication to Forgejo and active public download center deployment. | `scripts/ci/publish-forgejo-release.mjs`, `apps/web/src/app/download/page.tsx`, `site/src/sections/Download.tsx`, `apps/web/e2e/red_team_cycle4_web.spec.ts` | `[~]` 2026-09-15: v1.1.0 release assets (`D3RO-Voice-Setup-1.1.0-x64.exe`, `.blockmap`, `latest.yml`, `update-policy.json`) published to canonical Forgejo registry and release hub. 2026-09-16: the published 1.1.0 installer carries no Authenticode signature, so it does not satisfy the release policy; product version moved to `1.2.0` and publication must come from CI with the signing gate GREEN. Download centers in `apps/web` (`/download`) and `site` (`#download`) link the canonical Forgejo feed. 2026-09-19: `1.3.7` (overlay fix) is published to the canonical updater feed (`latest.yml` = 1.3.7, 90.6MiB); the CI signing gate that blocks tag-driven publication is still unresolved, so this went out through the local updater path (GAP-REL-06). |
-| GAP-REL-02 | Release | Windows stable publication needs an external public-trust Authenticode PFX, its password, the exact signer subject, and a Forgejo token, none of which live in the repository. | `.forgejo/workflows/release.yml`, `.gitlab-ci.yml`, `scripts/ci/set-forgejo-secrets.mjs`, `scripts/ci/verify-windows-release-artifact.ps1` | `[!]` 2026-09-18 measured: the Forgejo repo had **zero** Actions secrets; `FORGEJO_TOKEN` is registered now (2026-09-18) but `WIN_CSC_*` still have no values, so `v1.2.0` (run 49) and `v1.3.0` (run 51) both failed at the signing guard and **no updater-feed release has been published since `1.1.0`**. Inject the four secrets (`WIN_CSC_LINK`, `WIN_CSC_KEY_PASSWORD`, `WIN_CSC_EXPECTED_SIGNER_SUBJECT`, `FORGEJO_TOKEN`) with `npm run release:secrets` (check: `npm run release:secrets:check`), then re-run `release.yml` for the `v1.3.0` tag via `workflow_dispatch` (tags are immutable). **2026-09-19 정정**: CI 서명 게이트는 여전히 막혀 있지만, updater feed에는 `1.3.2`~`1.3.7`이 로컬 `release:updater` 경로로 게시되어 있다(GAP-REL-06). |
-| GAP-REL-06 | Release | 서명 인증서가 없어 stable(`latest`) 채널에 **무서명** 설치본을 게시했다. electron-updater는 `app-update.yml`에 `publisherName`이 없으면 서명 검증을 건너뛰므로 설치는 동작하지만, SmartScreen 평판은 버전마다 0부터 시작한다. | `scripts/ci/publish-updater-release.mjs`, `release/update-policy.json`, `.forgejo/workflows/release.yml` | `[!]` 2026-09-18: `1.3.2`를 `--ack-unsigned`(명시적 승인 플래그)로 게시. **2026-09-19: `1.3.7`도 같은 경로로 게시**(`npm run release:updater -- --ack-unsigned`, 설치본 90.6MiB, `latest.yml`=1.3.7, 설치본 sha512가 피드 메타데이터와 일치). 인증서 확보 시 더 높은 버전으로 서명 게시하여 대체하고, 이 예외를 제거한다. |
+| GAP-REL-01 | Release | Official release publication to Forgejo and active public download center deployment. | `scripts/ci/publish-forgejo-release.mjs`, `apps/web/src/app/download/page.tsx`, `site/src/sections/Download.tsx`, `apps/web/e2e/red_team_cycle4_web.spec.ts` | `[~]` 2026-09-15: v1.1.0 release assets (`D3RO-Voice-Setup-1.1.0-x64.exe`, `.blockmap`, `latest.yml`, `update-policy.json`) published to canonical Forgejo registry and release hub. 2026-09-16: the published 1.1.0 installer carries no Authenticode signature, so it does not satisfy the release policy; product version moved to `1.2.0` and publication must come from CI with the signing gate GREEN. Download centers in `apps/web` (`/download`) and `site` (`#download`) link the canonical Forgejo feed. |
+| GAP-REL-02 | Release | Windows stable publication needs an external public-trust Authenticode PFX, its password, the exact signer subject, and a Forgejo token, none of which live in the repository. | `.forgejo/workflows/release.yml`, `.gitlab-ci.yml`, `scripts/ci/set-forgejo-secrets.mjs`, `scripts/ci/verify-windows-release-artifact.ps1` | `[!]` 2026-09-18 measured: the Forgejo repo had **zero** Actions secrets; `FORGEJO_TOKEN` is registered now (2026-09-18) but `WIN_CSC_*` still have no values, so `v1.2.0` (run 49) and `v1.3.0` (run 51) both failed at the signing guard and **no updater-feed release has been published since `1.1.0`**. Inject the four secrets (`WIN_CSC_LINK`, `WIN_CSC_KEY_PASSWORD`, `WIN_CSC_EXPECTED_SIGNER_SUBJECT`, `FORGEJO_TOKEN`) with `npm run release:secrets` (check: `npm run release:secrets:check`), then re-run `release.yml` for the `v1.3.0` tag via `workflow_dispatch` (tags are immutable). |
+| GAP-REL-06 | Release | 서명 인증서가 없어 stable(`latest`) 채널에 **무서명** 설치본을 게시했다. electron-updater는 `app-update.yml`에 `publisherName`이 없으면 서명 검증을 건너뛰므로 설치는 동작하지만, SmartScreen 평판은 버전마다 0부터 시작한다. | `scripts/ci/publish-updater-release.mjs`, `release/update-policy.json`, `.forgejo/workflows/release.yml` | `[!]` 2026-09-18: `1.3.2`를 `--ack-unsigned`(명시적 승인 플래그)로 게시. 인증서 확보 시 더 높은 버전으로 서명 게시하여 대체하고, 이 예외를 제거한다. |
 | GAP-REL-07 | Release | 패키징된 `better-sqlite3`가 호스트 Node ABI여서 `1.3.2` 설치본이 시작 즉시 죽었다(NODE_MODULE_VERSION 131 vs 130). 원인: 로컬 `npm install`이 네이티브 모듈을 Node용으로 재빌드했고 패키징이 재빌드를 건너었다. | `scripts/ci/verify-native-abi.mjs`, `scripts/ci/fix-native-abi.mjs`, `.gitlab-ci.yml`/`.forgejo`/`.github` 패키징 단계 | `[x]` 2026-09-18: 패키징 후 Electron ABI를 검증하고, 검증된 트리에서만 설치본을 생성(`--prepackaged`)한다. `1.3.3`은 설치본에서 추출한 바이너리로 재검증 GREEN. |
 | GAP-ADS-01 | Ads | 9 of 10 desktop ad adapters still extend `UnavailableAdAdapter` (`provider_not_integrated`). | `apps/desktop/src/main/services/ads/*` | `[~]` 2026-09-13: `DirectHouseSponsorAdapter` is now a real configurable REST adapter (bid/impression/click/reward via `endpointUrl`; fail-closed when unconfigured; 22 unit tests GREEN). Remaining 9 need official SDKs/authenticated endpoints. |
 | GAP-ADS-02 | Ads | Desktop mediation reward accounting is not wired to license quota (`claimReward` still returns no tokens). | `AdMediationEngine.ts`, `AppLayout.tsx` | Wire verified `reportRewardCompletion` to `LicenseService` quota after the direct sponsor endpoint exists. |
@@ -55,8 +55,6 @@ Legend: `[ ]` open · `[~]` in progress · `[!]` blocked externally · `[x]` res
 | GAP-STT-06 | Local STT | Decode settings were untuned: previous-text conditioning let repeated hallucinations compound, and no VAD parameters meant slow, uneven segments. | `apps/desktop/sidecar/main.py` | `[x]` 2026-09-18: `condition_on_previous_text=false`, bounded low-temperature fallback, `no_speech`/`compression_ratio`/`log_prob` thresholds, 300 ms silence trimming. Same transcript, ~5x faster on the reference machine (7.7 s audio: 1609 ms → 303 ms). |
 | GAP-STT-08 | Local STT | 1.3.5 설치본에서 엔진 설치가 "런타임 아카이브 해시 불일치 (sidecar)"로 항상 실패했다. 부품 검증은 **메모리 스트림**에서 센 값으로, 결합 검증은 **디스크 파일**에서 계산해 기준이 서로 달랐다. 디스크 쓰기가 잘려도 부품 검사를 통과하고 결합 단계에서만 터지므로 원인 파악도 불가능했다. 재시도가 없어 전송이 한 번 끊기면 곧바로 설치 실패였다. | `apps/desktop/src/main/services/RuntimeProvisioner.ts` | `[x]` 2026-09-18: 부품 크기·해시를 디스크 파일 기준으로 통일하고, 결합본은 크기를 먼저 검사한 뒤 해시를 본다(오류 메시지에 실제/기대값 포함). 부품 다운로드는 실패 시 해당 파일을 지우고 최대 3회 재시도한다. 서버 아티팩트는 무결함을 확인했고(부품 2개 해시 일치, 결합본 `e203aa53…` = 인덱스 기대값), 실제 feed로 설치를 재현해 18초 만에 성공. **1.3.6으로 게시 완료** — `latest.yml`이 1.3.6/90.6MiB를 서빙하고 설치본 sha512가 피드 메타데이터와 일치. 설치본 asar에 수정 코드가 포함되고 구버전 `archiveHash` 경로는 제거됨을 확인. |
 
-| GAP-INFRA-05 | Build | 패키징된 렌더러 팝업 스크립트가 번들에 없었다. 팝업 HTML이 classic `<script src="./script.js">`를 참조해 Vite가 처리하지 않았고, dev에서는 로드되지만 설치본에는 파일이 없었다. 그래서 녹음 오버레이가 0:00에서 멈추고 웨이브 바가 뜨지 않았으며 실시간 자막이 렌더되지 않았다. 로드 전 `webContents.send`가 조용히 버려지는 문제와 `hide()` 이후 재표시의 z-order/repaint 유실도 함께 있었다. | `apps/desktop/src/renderer/popups/*/index.html`, `apps/desktop/src/main/windows/WindowManager.ts`, `scripts/ci/verify-desktop-renderer-bundles.mjs` | `[x]` 2026-09-19: 팝업 5종을 `type="module"`로 전환해 Vite가 해시된 번들로 방출하도록 고쳤고, 빌드 HTML이 참조하는 모든 로컬 asset이 디스크에 있는지 검사하는 `verify-desktop-renderer-bundles.mjs`(+ self-test)를 `.forgejo`/`.github` 패키징 파이프라인에 연결했다. WindowManager는 렌더러 준비 전 IPC를 `did-finish-load`까지 보관하고, 팝업을 표시할 때마다 topmost 재선언 + 강제 repaint를 수행하며, 팝업 렌더러 콘솔/로드 실패를 main 로그로 승격한다. |
-
 ---
 
 ## 2. Mobile checklist roll-up (from `MOBILE_APP_COMPLETION_SSOT.md` §4)
diff --git a/package-lock.json b/package-lock.json
index f6fa5a5..7ac4ac7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "d3ro-voice-monorepo",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "d3ro-voice-monorepo",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "workspaces": [
         "apps/desktop",
@@ -25,7 +25,7 @@
     },
     "apps/admin": {
       "name": "@d3ro/admin",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "dependencies": {
         "@d3ro/api-client": "*",
         "@d3ro/core": "*",
@@ -109,7 +109,7 @@
     },
     "apps/desktop": {
       "name": "@d3ro/desktop",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "@d3ro/core": "*",
@@ -158,7 +158,7 @@
     },
     "apps/web": {
       "name": "@d3ro/web",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "dependencies": {
         "@d3ro/api-client": "*",
         "@d3ro/core": "*",
@@ -16861,7 +16861,7 @@
     },
     "packages/api-client": {
       "name": "@d3ro/api-client",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "@d3ro/core": "*",
@@ -16878,7 +16878,7 @@
     },
     "packages/core": {
       "name": "@d3ro/core",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "docx": "^9.6.1"
@@ -16889,7 +16889,7 @@
     },
     "packages/i18n": {
       "name": "@d3ro/i18n",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "devDependencies": {
         "@types/react": "^19.0.0"
@@ -16900,7 +16900,7 @@
     },
     "packages/ui": {
       "name": "@d3ro/ui",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "dependencies": {
         "@d3ro/core": "*"
@@ -16920,7 +16920,7 @@
     },
     "packages/ui-native": {
       "name": "@d3ro/ui-native",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "license": "MIT",
       "devDependencies": {
         "@types/react": "*"
diff --git a/package.json b/package.json
index 5036316..0a3e44d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "d3ro-voice-monorepo",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice — 멀티플랫폼 AI 음성 어시스턴트 (Monorepo)",
   "author": "D3RO",
@@ -35,8 +35,6 @@
     "security:secrets:test": "node scripts/ci/check-no-hardcoded-secrets.mjs --self-test",
     "check:design": "node scripts/ci/check-design-tokens.mjs",
     "check:design:test": "node scripts/ci/check-design-tokens.mjs --self-test",
-    "check:desktop-renderer": "node scripts/ci/verify-desktop-renderer-bundles.mjs",
-    "check:desktop-renderer:test": "node scripts/ci/verify-desktop-renderer-bundles.mjs --self-test",
     "test:e2e:red": "node server/supabase/tests/content-report-red.e2e.mjs",
     "release:mobile:boundary": "node scripts/ci/verify-mobile-release-boundary.mjs",
     "release:mobile:boundary:test": "node scripts/ci/verify-mobile-release-boundary.mjs --self-test",
diff --git a/packages/api-client/package.json b/packages/api-client/package.json
index e2f1b40..b3c6e7c 100644
--- a/packages/api-client/package.json
+++ b/packages/api-client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/api-client",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice API 클라이언트 — Supabase 래퍼 (web/desktop/mobile 공유)",
   "license": "MIT",
diff --git a/packages/core/package.json b/packages/core/package.json
index 19a57e8..55b2f35 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/core",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice 공유 비즈니스 로직 — 타입, 에러, IPC 채널, 상수, 유틸",
   "license": "MIT",
diff --git a/packages/i18n/package.json b/packages/i18n/package.json
index 01c689e..e7a4b7c 100644
--- a/packages/i18n/package.json
+++ b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/i18n",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice 공유 i18n — 12개 locale, 타입 안전 키, Context, 포맷 유틸",
   "license": "MIT",
diff --git a/packages/ui-native/package.json b/packages/ui-native/package.json
index 352fd20..8e1d456 100644
--- a/packages/ui-native/package.json
+++ b/packages/ui-native/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/ui-native",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice React Native DS — MetalCard/PhosphorText/Led/WaveBars etc.",
   "license": "MIT",
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 8cc337b..63c0f40 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@d3ro/ui",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "private": true,
   "description": "D3RO Voice 공유 UI — 디자인 시스템 컴포넌트 + 테마 토큰 + CSS 변수 맵",
   "license": "MIT",
diff --git a/release/product-version.json b/release/product-version.json
index 253a35c..4008e30 100644
--- a/release/product-version.json
+++ b/release/product-version.json
@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
-  "version": "1.3.7",
-  "androidVersionCode": 1031007,
-  "iosBuildNumber": 1031007,
-  "releaseDate": "2026-09-19",
+  "version": "1.3.6",
+  "androidVersionCode": 1031006,
+  "iosBuildNumber": 1031006,
+  "releaseDate": "2026-09-18",
   "desktopLicensePublicKeyId": "5c52b765135ee2531c681b53cd4dc0e96fff8737f496c0b04ba8334fc81a887f"
 }
diff --git a/scripts/ci/verify-desktop-renderer-bundles.mjs b/scripts/ci/verify-desktop-renderer-bundles.mjs
deleted file mode 100644
index 0eb994a..0000000
--- a/scripts/ci/verify-desktop-renderer-bundles.mjs
+++ /dev/null
@@ -1,160 +0,0 @@
-// scripts/ci/verify-desktop-renderer-bundles.mjs
-//
-// Fails packaging when a renderer page ships without the assets it references.
-//
-// Why this exists: Vite only bundles <script type="module"> tags. A page that
-// keeps a classic <script src="./script.js"> points at a file the build never
-// emits, so the packaged window renders its static markup forever. That is how
-// the recording overlay froze at 0:00 without wave bars and live captions never
-// showed up. Comparing built HTML against disk catches the whole class of bug.
-//
-// Usage:
-//   node scripts/ci/verify-desktop-renderer-bundles.mjs
-//   node scripts/ci/verify-desktop-renderer-bundles.mjs --self-test
-
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const repoRoot = path.resolve(scriptDir, '..', '..')
-const desktopDir = path.join(repoRoot, 'apps', 'desktop')
-const sourcePopupDir = path.join(desktopDir, 'src', 'renderer', 'popups')
-const builtRendererDir = path.join(desktopDir, 'out', 'renderer')
-
-/**
- * Pages the packaged renderer must contain, relative to the renderer root.
- * Popup directories are discovered from source so a new popup cannot be added
- * without also being built.
- */
-function expectedPages() {
-  const pages = ['index.html']
-  if (!existsSync(sourcePopupDir)) return pages
-
-  for (const entry of readdirSync(sourcePopupDir).sort()) {
-    const entryPath = path.join(sourcePopupDir, entry)
-    if (statSync(entryPath).isDirectory() && existsSync(path.join(entryPath, 'index.html'))) {
-      pages.push(path.posix.join('popups', entry, 'index.html'))
-    }
-  }
-  return pages
-}
-
-/** Local script/link references inside a built HTML page. */
-function localReferences(html) {
-  const refs = []
-  const pattern = /<(?:script|link)\b[^>]*?\b(?:src|href)="([^"]+)"/g
-  let match
-  while ((match = pattern.exec(html)) !== null) {
-    const ref = match[1]
-    if (/^[a-z]+:/i.test(ref) || ref.startsWith('//') || ref.startsWith('#')) continue
-    refs.push(ref.split('?')[0])
-  }
-  return refs
-}
-
-/**
- * @param {string} rendererDir built renderer root
- * @param {string[]} pages page paths relative to that root
- * @returns {string[]} problems, empty when the build is complete
- */
-function collectProblems(rendererDir, pages) {
-  const problems = []
-
-  for (const page of pages) {
-    const pagePath = path.join(rendererDir, page)
-    if (!existsSync(pagePath)) {
-      problems.push(`missing built page: ${pagePath}`)
-      continue
-    }
-
-    const html = readFileSync(pagePath, 'utf8')
-
-    for (const ref of localReferences(html)) {
-      const assetPath = ref.startsWith('/')
-        ? path.join(rendererDir, ref.slice(1))
-        : path.resolve(path.dirname(pagePath), ref)
-      if (!existsSync(assetPath)) {
-        problems.push(`${page} references a missing asset: ${ref} -> ${assetPath}`)
-      }
-    }
-
-    // A classic script tag is never emitted by the renderer build.
-    if (/<script\b(?![^>]*\btype="module")[^>]*\bsrc=/.test(html)) {
-      problems.push(`${page} loads a classic script; add type="module" so Vite bundles it`)
-    }
-  }
-
-  return problems
-}
-
-function selfTest() {
-  const tmpRoot = mkdtempSync(path.join(os.tmpdir(), 'd3ro-renderer-bundles-'))
-  const failures = []
-
-  try {
-    const bundlePage = (root, scriptTag) => {
-      mkdirSync(path.join(root, 'assets'), { recursive: true })
-      mkdirSync(path.join(root, 'popups', 'recording-tip'), { recursive: true })
-      writeFileSync(path.join(root, 'assets', 'app.js'), '')
-      writeFileSync(
-        path.join(root, 'popups', 'recording-tip', 'index.html'),
-        `<!DOCTYPE html>\n<html><body>${scriptTag}</body></html>\n`,
-      )
-    }
-
-    const pages = ['popups/recording-tip/index.html']
-
-    const goodRoot = path.join(tmpRoot, 'good')
-    bundlePage(goodRoot, '<script type="module" src="../../assets/app.js"></script>')
-    const goodProblems = collectProblems(goodRoot, pages)
-    if (goodProblems.length !== 0) {
-      failures.push(`complete build reported problems: ${goodProblems.join('; ')}`)
-    }
-
-    const brokenRoot = path.join(tmpRoot, 'broken')
-    bundlePage(brokenRoot, '<script src="./script.js"></script>')
-    const brokenProblems = collectProblems(brokenRoot, pages)
-    if (!brokenProblems.some((problem) => problem.includes('missing asset'))) {
-      failures.push('missing asset was not detected')
-    }
-    if (!brokenProblems.some((problem) => problem.includes('classic script'))) {
-      failures.push('classic script tag was not detected')
-    }
-
-    const missingPageProblems = collectProblems(goodRoot, ['popups/absent/index.html'])
-    if (!missingPageProblems.some((problem) => problem.startsWith('missing built page'))) {
-      failures.push('missing page was not detected')
-    }
-  } finally {
-    rmSync(tmpRoot, { recursive: true, force: true })
-  }
-
-  if (failures.length > 0) {
-    console.error('verify-desktop-renderer-bundles self-test failed:')
-    for (const failure of failures) console.error(`- ${failure}`)
-    process.exit(1)
-  }
-  console.log('verify-desktop-renderer-bundles self-test: OK')
-}
-
-if (process.argv.slice(2).includes('--self-test')) {
-  selfTest()
-} else if (!existsSync(builtRendererDir)) {
-  console.error(`Renderer build not found: ${builtRendererDir}`)
-  console.error('  build: npm run build --workspace=@d3ro/desktop')
-  process.exit(1)
-} else {
-  const pages = expectedPages()
-  const problems = collectProblems(builtRendererDir, pages)
-
-  if (problems.length > 0) {
-    console.error('Desktop renderer bundle verification failed:')
-    for (const problem of problems) console.error(`- ${problem}`)
-    console.error('  rebuild: npm run build --workspace=@d3ro/desktop')
-    process.exit(1)
-  }
-
-  console.log(`Desktop renderer bundle verification passed: ${pages.length} page(s) with all assets on disk`)
-}
\ No newline at end of file
diff --git a/site/package-lock.json b/site/package-lock.json
index 4e3c001..e3778a9 100644
--- a/site/package-lock.json
+++ b/site/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "d3ro-voice-site",
-  "version": "1.3.7",
+  "version": "1.3.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "d3ro-voice-site",
-      "version": "1.3.7",
+      "version": "1.3.6",
       "dependencies": {
         "react": "^19.0.0",
         "react-dom": "^19.0.0"
diff --git a/site/package.json b/site/package.json
index 87c082a..2a62652 100644
--- a/site/package.json
+++ b/site/package.json
@@ -1,7 +1,7 @@
 {
   "name": "d3ro-voice-site",
   "private": true,
-  "version": "1.3.7",
+  "version": "1.3.6",
   "type": "module",
   "scripts": {
     "dev": "vite --port 5199 --host",