[Saffsanity]

Applies the confirmed findings of the 2026-10-11 public-surface review that live in this repository: the website, the README, SECURITY.md, the bug form, docs/DEVELOPMENT.md, docs/app-store-metadata.md, docs/BRIEF.md and one string in Sill.app's Settings. Findings about the launch posts, the GitHub release notes, the live App Store listing and the sill-site repository are handled elsewhere. Nothing here changes how either app behaves.

The website (site/)

• support.html, Direct Wireless Connection (must-fix): said to tap Search Nearby when the Mac isn't listed. A paired iPhone or iPad lists its Mac as a Remote row, so Search Nearby never shows. It now says that, when the device looks nearby by itself, and to connect once over a USB cable with the setting on (inside Remote Access markers, since Remote rows and the VPN are Remote Access's). "Your Mac isn't listed" and the landing page's "No shared network?" now link to that section.
• support.html, the picture stutters: lowering Quality in the Sill menu does nothing away from home, which runs its own quality. It now says where to lower that one (inside Remote Access markers).
• support.html, Remote Access: a port forward also needs Allow connections from the internet; macOS 14 calls Energy "Energy Saver"; 0.3.1 predates pairing at home, not pairing.
• privacy.html: "nothing about you ever reaches the developer" is no longer absolute now that TestFlight and App Store crash reports exist, so it says Sill never sends anything, and the short version names Apple's channel. The device's pairing key can be in that device's own backup, usable only on it. "None of it is sent anywhere" now allows for what travels between your devices and the Bonjour name and p. The Mac's version joins what the Mac sends. Dated October 11, 2026.
• download.html: Accessibility is also for the Mac's menus. Uninstall says to remove devices before quitting Sill for the last time, because the keys stay in the keychain.
• index.html: the iPhone Duo sentence follows how it is held (open flat on its side, half open like a laptop).
• terms.html: the one Remote Access mention outside the markers is now inside them. The App Store badge is credited as Apple's, and App Store is named as a service mark.

README.md

• Building from source over a downloaded Sill.app: grant permissions and pair every device again, because the download keeps its keys in the data-protection keychain and your own build uses the login keychain.
• SillHost without --pairing has a plain, open home door, which the App Store app never dials.
• A Mac on 0.3.1 or earlier admits anything that reaches it, not only "any iPhone or iPad with Sill".
• The camera prompt is listed, and a Terms link is added.

SECURITY.md and the bug form

• The "Known" paragraph said that until pairing at home ships, nearby devices connect unencrypted. It now covers what is true since 0.4.0: Require pairing turned off (still encrypted, and any app on the Mac also gets in), the CLI's plain door without --pairing, and Macs on 0.3.1 or earlier.
• The scope covers pairing at home and away, not only Remote Access's pairing.
• "Report a vulnerability" is on, so it is offered without a condition.
• The bug form's version example is 0.5.1 (563), and its route dropdown adds "Not paired" and "Update Sill".

docs/DEVELOPMENT.md

• "To start over" (twice) and Require pairing's storage sent download users to Keychain Access › login, which their Sill never reads. Each now names both keychains: data-protection for the download, login for a build without the profile.
• Direct Wireless no longer says anyone nearby can connect.
• Releasing:
  • Release builds need the provisioning profile. CI has none and would give every Mac a new key, so releases are published from a Mac with SILL_SIGN_IN_CI left off.
  • Both apps share one version number since 0.5.1, and the example is v0.5.1.
• The update check's 404 is no longer the normal state.
• The CLI's argument streams a match, and it lists nothing.
• The Duo hides the status bar sideways too.
• The iOS project's plists, the checks list, Packaging/, site/ and design/ are described as they are now, and the example versions are current.

docs/app-store-metadata.md

• Remote Access shipped (it was "1.0, undecided"), and 0.5.1 (4) is live, not next.
• The live description and subtitle differ from this file's blocks. They are noted, and the blocks are kept as the next version's text. The description gains the open-source bullet the public LICENSE allows.
• The review notes are App Store Connect's as sent, with 0.5.1's sentence and Sill for Mac 0.5.1. The attachment is a screen recording.
• The live six screenshots per set are listed.
• Section 10's counts were measured again (the 0.5.1 line predated the Duo text).

docs/BRIEF.md

The license question is settled (Apache-2.0, final since the repository went public), and a line says the brief is as of 2026-09-22.

Sill.app (one string)

Settings › General's Direct Wireless footnote said "Anyone nearby with Sill can find and connect to this Mac." It now says "Anyone nearby with Sill can find this Mac; only devices you paired can connect, unless Require pairing is off."

Also

• CLAUDE.md's Layout no longer calls the README's App Store badge a commented slot (it has been live since 2026-10-10).
• design/README.md describes design/screenshots/.
• CI's paths-ignore leaves out design/screenshots/**, so a screenshot-only change starts no run. The rest of design/ and all code still run CI.

Checks run

• swift build -c release: built, with only the known CaptureProbe warning. No check compiles SettingsPanes.swift, and no check or preview sample holds the old footnote, so Tests/checks/run-all.sh was not needed.
• Every page in site/ parses with balanced tags under Python's html.parser, and all 94 relative links, images and anchors resolve.
• The release checklist's Remote Access cut: with every marked block removed from copies of the pages, its grep prints nothing.
• The issue form and ci.yml parse as YAML.
• In docs/app-store-metadata.md, the description is 2,872 characters (2,651 local-only) and the review notes are 3,952 bytes (3,709), all ASCII.
• No added line contains an em-dash.

After this merges, republish the site (sill-site) so getsill.app shows the new pages.

🤖 Generated with Claude Code