docs(readme): adopt candid local-first product voice

docs/distribution.md

@@ -86,14 +86,14 @@ App Store Connect record for `com.tcballard.sortinghat`. Then archive the
 Connect**, or export a correctly signed archive with
 `Configuration/AppStoreExportOptions.plist`.
 
-App Store Connect build **0.1.0 (1)** is uploaded and selectable. Before
-submission, complete the product page, support and privacy URLs, screenshots,
-age rating, App Privacy answers, export-compliance answers, and review notes.
-The submission pack under [`launch-pack/`](../launch-pack/) contains prepared
-copy, genuine screenshots, icon evidence, review instructions, and an explicit
-blocker checklist. Review notes explain the dashboard and menu-bar entry points,
-the required user-selected Inbox and output folders, how to enable the bundled
-Finder Action, and how to exercise sorting without credentials.
+App Store Connect build **0.1.0 (2)** passed Apple validation, processed as
+`VALID`, and is selected for version 0.1.0. The listing, screenshots,
+categories, age rating, review contact, and review notes are saved. Before
+submission, choose pricing, attest **Data Not Collected**, complete export
+compliance and content rights, and run the installed-build smoke test. The
+submission pack under [`launch-pack/`](../launch-pack/) contains the verified
+copy, genuine screenshots, icon evidence, review instructions, and remaining
+blocker checklist.
 
 An App Store/TestFlight build must still be manually verified for first-run
 setup, persisted folder access across relaunch, on-device sorting, manual review,

launch-pack/ASSET_INVENTORY.md

@@ -2,7 +2,7 @@
 
 | ID | Asset | Purpose | Source or provenance | Constraints | Output path | Status | Blocker or next action |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| A01 | 1024 px app icon | Embedded Store icon reference and visual handoff | Shipping AppIcon asset, SHA-256 recorded in evidence | Opaque 1024×1024 PNG | outputs/app-store/icon/app-icon-1024.png | Ready | Confirm the selected build displays this icon in App Store Connect |
-| A02 | Sorted Activity screenshot | Show the core result | Genuine app capture using synthetic fixtures | 1440×900 opaque JPEG | outputs/app-store/screenshots/01-sorted-activity.jpg | Ready | Upload in position 1 |
-| A03 | Plain-language Rules screenshot | Show rule creation and editing | Genuine app capture with no private data | 1440×900 opaque JPEG | outputs/app-store/screenshots/02-plain-language-rules.jpg | Ready | Upload in position 2 |
-| A04 | Privacy settings screenshot | Avoid a stale PCC claim | Earlier capture showed a non-shipping setting | Must reflect current product | Not included | Removed | Capture a replacement only after the privacy/provider decision |
+| A01 | 1024 px app icon | Embedded Store icon reference and visual handoff | Shipping AppIcon asset, SHA-256 recorded in evidence | Opaque 1024×1024 PNG | outputs/app-store/icon/app-icon-1024.png | Ready | Embedded in selected build 2 |
+| A02 | Sorted Activity screenshot | Show the core result | Genuine app capture using synthetic fixtures | 1440×900 opaque JPEG | outputs/app-store/screenshots/01-sorted-activity.jpg | Ready | Uploaded in position 1 |
+| A03 | Plain-language Rules screenshot | Show rule creation and editing | Genuine app capture with no private data | 1440×900 opaque JPEG | outputs/app-store/screenshots/02-plain-language-rules.jpg | Ready | Uploaded in position 2 |
+| A04 | Privacy settings screenshot | Avoid a stale PCC claim | Earlier capture showed a non-shipping setting | Must reflect current product | Not included | Removed | Not required for this submission |

launch-pack/CHANNEL_MATRIX.md

@@ -2,7 +2,8 @@
 
 | Channel | Audience | Desired action | Deliverable | Claim IDs | Assets and links | Owner or specialist | Output path | Authority | Status | Blocker or next action |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| Mac App Store listing | Mac users | Understand and download | Name, subtitle, promotional text, description, keywords, categories | C01, C02, C03 | A01-A03 | Tom Ballard | outputs/app-store/LISTING.md | Owner enters and submits | Ready | Resolve version and price before submission |
-| App Review | Apple reviewer | Exercise the app without credentials | Review notes and contact checklist | C01-C03 | Support and privacy URLs | Tom Ballard | outputs/app-store/REVIEW_NOTES.md | Owner enters and submits | Ready | Owner supplies phone number |
-| App Privacy | Apple reviewer and users | Understand data handling | Conservative questionnaire guidance and public policy | C02, C04, C05 | docs/privacy.md | Tom Ballard | outputs/app-store/APP_PRIVACY.md | Owner attests in App Store Connect | Blocked | Decide whether OpenAI remains in the Store build |
-| Support | Existing users | Resolve setup and review issues | Public support page | C01-C03 | docs/support.md | Tom Ballard | docs/support.md | Public after merge | Ready | Merge PR #30 before using the URL |
+| Repository front door | Evaluators and source users | Understand the product and inspect or build it | README identity, local-first contract, screenshot, source command, and proof link | C01, C02, C03, C07 | A02 and WWDC26 comparison | Merge & Tell + README Front Door | README.md | Owner merges PR #31 | Ready | Review and merge PR #31 |
+| Mac App Store listing | Mac users | Understand and download after approval | Name, subtitle, promotional text, description, keywords, categories | C01, C02, C03, C07 | A01-A03 | Tom Ballard | outputs/app-store/LISTING.md | Owner submits and releases | Ready | Choose price and complete declarations before submission |
+| App Review | Apple reviewer | Exercise the app without credentials | Review notes and contact checklist | C01, C02, C03, C07 | Support and privacy URLs | Tom Ballard | outputs/app-store/REVIEW_NOTES.md | Owner submits | Ready | Run installed-build smoke test before submission |
+| App Privacy | Apple reviewer and users | Understand data handling | Questionnaire guidance and public policy | C02, C04, C05, C07 | docs/privacy.md | Tom Ballard | outputs/app-store/APP_PRIVACY.md | Owner attests in App Store Connect | Ready | Select Data Not Collected |
+| Support | Existing users | Resolve setup and review issues | Public support page | C01-C03 | docs/support.md | Tom Ballard | docs/support.md | Public | Ready | Public URL verified with HTTP 200 on 22 July 2026 |

launch-pack/CLAIMS_LEDGER.md

@@ -2,9 +2,10 @@
 
 | ID | Claim | Importance | Evidence | Status | Qualification | Channels | Owner |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| C01 | Sorting Hat renames and files items using plain-language rules | Required | Shipping app, README product contract, genuine activity capture | Verified | Model decisions are validated; uncertain items remain for review | Listing, screenshots | Tom Ballard |
-| C02 | Apple model processing can stay on the Mac | Required | Current Model Settings UI and Foundation Models implementation | Verified | Requires macOS 26, Apple Intelligence, and a supported Mac | Listing, privacy | Tom Ballard |
-| C03 | Finder intake does not alter the original | Required | Finder Action copy-only implementation and docs | Verified | The staged copy is then processed by Sorting Hat | Listing, review notes, support | Tom Ballard |
+| C01 | Sorting Hat renames and files items using plain-language rules | Required | Shipping app, README product contract, genuine activity capture | Verified | Model decisions are validated; uncertain items remain for review | README, listing, screenshots | Tom Ballard |
+| C02 | Apple model processing can stay on the Mac | Required | Current Model Settings UI and Foundation Models implementation | Verified | Requires macOS 26, Apple Intelligence, and a supported Mac | README, listing, privacy | Tom Ballard |
+| C03 | Finder intake does not alter the original | Required | Finder Action copy-only implementation and docs | Verified | The staged copy is then processed by Sorting Hat | README, listing, review notes, support | Tom Ballard |
 | C04 | Sorting Hat does not track users or contain advertising | Required | Privacy manifest and dependency/runtime inspection | Verified | Optional providers receive content only when configured | Privacy, App Privacy | Tom Ballard |
 | C05 | The Mac App Store app collects no data | Required | Store compile condition, loopback provider policy, focused tests, archive marker, and privacy manifest | Verified | Applies to the Mac App Store build; other distribution channels retain separate provider choices | App Privacy | Tom Ballard |
 | C06 | Private Cloud Compute is a shipping option | Optional | Current app UI omits PCC and saved settings force it off | Removed | Legacy research and stale README wording are not product capabilities | None | Tom Ballard |
+| C07 | The Mac App Store build has no remote model route | Required | Store compile condition, loopback provider policy, focused tests, archive marker, and selected build 2 | Verified | Applies only to the Mac App Store build | README, listing, review notes, privacy | Tom Ballard |

launch-pack/HANDOFF.md

@@ -4,20 +4,21 @@
 - Release: First Mac App Store submission
 - Version: 0.1.0
 - Build: 2
-- Pack status: Local-only build 2 uploaded, processed, and selected; URL publication and installed verification remain
+- Pack status: Local-only build 2 uploaded, processed, and selected; owner declarations and installed verification remain
 - Publication authority: Tom Ballard only
-- Exact next action: Merge PR #30, verify the public support/privacy URLs, then complete the remaining owner declarations
+- Exact next action: Choose pricing, complete the remaining owner declarations, and run the installed-build smoke test
 
 ## Included deliverables
 
 | Channel | Output | Status | Claim IDs | Notes |
 | --- | --- | --- | --- | --- |
-| Mac App Store | outputs/app-store/LISTING.md | Ready | C01-C03 | Copy respects current product behavior |
+| Repository | README.md | Ready | C01, C02, C03, C07 | Merge & Tell rewrite is in PR #31 |
+| Mac App Store | outputs/app-store/LISTING.md | Ready | C01, C02, C03, C07 | Copy respects current product behavior |
 | Screenshots | outputs/app-store/screenshots | Ready | C01-C03 | Two opaque 1440×900 JPEGs |
 | Icon | outputs/app-store/icon/app-icon-1024.png | Ready | None | Reference copy of the icon embedded in selected build 2 |
-| App Review | outputs/app-store/REVIEW_NOTES.md | Ready | C01-C03 | Notes and review contact are saved in App Store Connect |
-| Privacy | outputs/app-store/APP_PRIVACY.md and docs/privacy.md | Ready | C02, C04, C05 | Build 2 is verified; select Data Not Collected |
-| Support | docs/support.md | Ready | C01-C03 | Public URL works only after merge |
+| App Review | outputs/app-store/REVIEW_NOTES.md | Ready | C01, C02, C03, C07 | Notes and review contact are saved in App Store Connect |
+| Privacy | outputs/app-store/APP_PRIVACY.md and docs/privacy.md | Ready | C02, C04, C05, C07 | Build 2 is verified; select Data Not Collected |
+| Support | docs/support.md | Ready | C01-C03 | Public support and privacy URLs return HTTP 200 |
 
 ## Omitted or not-applicable deliverables
 
@@ -35,11 +36,11 @@
 
 - Uploaded build 2, confirmed Apple processing state `VALID`, and selected it for version 0.1.0.
 - Saved the local-only listing, categories, age rating, review contact, and review notes in App Store Connect.
+- Confirmed PR #30 merged and both public support/privacy URLs return HTTP 200 on 22 July 2026.
 - Captured the real app with synthetic files, restored the user's configuration and activity, and removed fixture outputs.
 - Adapted screenshots proportionally to an accepted Mac size with provenance evidence.
 - Measured and visually reviewed the 1024 px shipping icon.
 
 ## Remaining decisions and blockers
 
-- Merge the support/privacy pages, then verify their public URLs.
 - Choose price, complete App Privacy, export compliance, and content rights, then run installed-build verification.

launch-pack/LAUNCH_BRIEF.md

@@ -3,17 +3,17 @@
 - Product: Sorting Hat: File Organiser
 - Release: First Mac App Store submission
 - Version: 0.1.0
-- Build: 1
-- Release state: Build uploaded and selectable; metadata and owner decisions remain
+- Build: 2
+- Release state: Local-only build uploaded, processed, and selected; owner declarations and installed verification remain
 - Release date or window: After App Review approval
-- Authoritative source: PR #30 at commit 06946dd plus App Store Connect build 0.1.0 (1)
+- Authoritative source: merged PR #30 at commit 7dcc9ef plus App Store Connect build 0.1.0 (2)
 
 ## Audience and outcome
 
 - Primary audience: Mac users who want files renamed and organised without writing automation
 - User outcome: Describe a filing plan once, then send files to one Inbox and see them renamed and routed into useful folders
 - Launch objective: Submit an accurate, reviewable first Mac App Store version
-- Primary call to action: Download Sorting Hat from the Mac App Store
+- Primary call to action: At launch, download Sorting Hat from the Mac App Store; before launch, complete the owner submission gates
 - Canonical destination: App Store Connect record 6792563259
 
 ## Availability and boundaries
@@ -22,20 +22,20 @@
 - Rollout or eligibility: Public Mac App Store after manual release and review approval
 - Pricing: Owner decision required; free is recommended for the first submission
 - Material limitations: Model availability affects sorting; uncertain items require review; Store Ollama connections are restricted to the same Mac
-- Required disclosures: Optional provider transmission, folder access, no developer account, and Finder Action copy-only intake
+- Required disclosures: same-Mac model boundary, folder access, no developer account, and Finder Action copy-only intake
 
 ## Delivery contract
 
-- Included channels: Mac App Store product page, screenshots, icon handoff, privacy policy, support page, App Review notes, submission checklist
+- Included channels: repository front door, Mac App Store product page, screenshots, icon handoff, privacy policy, support page, App Review notes, submission checklist
 - Deliberately omitted channels: Homebrew, Developer ID release, press, social, and demo video
 - Format or submission constraints: 1-10 opaque 16:10 Mac screenshots; icon embedded in the uploaded build; App Store field limits
 - Accessibility requirements: Screenshots remain legible at product-page scale and listing copy describes the visual outcome
-- Publication authority: Tom Ballard performs all App Store Connect edits and submission actions
+- Publication authority: Tom Ballard controls App Review submission and public release
 
 ## Evidence summary
 
-- Release artifact or verified build: App Store Connect shows selectable build 0.1.0 (1) with an included App Icon
-- Tests and measurements: PR #30 CI is green; Store archive and selected build were previously verified
+- Release artifact or verified build: App Store Connect build 0.1.0 (2) passed Apple validation, processed as `VALID`, and is selected with an included App Icon
+- Tests and measurements: PR #30 CI is green; Store structural preflight, archive validation, and selected-build verification passed
 - Specification and acceptance criteria: Issue #29 and docs/distribution.md
-- Build logs and decisions: PR #30 history and App Store Connect read-only audit on 20 July 2026
+- Build logs and decisions: merged PR #30 history and App Store Connect API verification on 21 July 2026
 - Existing assets and copy: Shipping app icon plus two genuine, sanitised application captures

launch-pack/RELEASE_CHECKLIST.md

@@ -3,11 +3,11 @@
 | Gate | Requirement | Evidence or observation | Result | Owner | Next action |
 | --- | --- | --- | --- | --- | --- |
 | Release identity | Version, build, date, and availability agree | App Store record is 0.1.0; local-only build 2 is valid and selected | Ready | Tom Ballard | Preserve build 2 through submission |
-| Claims | Every used claim is verified or visibly qualified | Claims ledger removes PCC and blocks no-data claim | Ready | Tom Ballard | Preserve qualifications when entering copy |
+| Claims | Every used claim is verified or visibly qualified | Claims ledger removes PCC and verifies the Store-only no-data claim | Ready | Tom Ballard | Preserve channel qualifications in public copy |
 | Assets | Required outputs exist and open correctly | Icon plus two real screenshots are present in App Store Connect | Ready | Tom Ballard | Visually confirm the final product-page preview |
 | Technical | Channel and submission constraints pass | Local-only build 2 passed structural preflight and Apple validation; installed-build Store smoke test remains | Blocked | Tom Ballard | Install and smoke-test build 2 |
 | Accessibility | Captions, contrast, text alternatives, and readability pass | Screens are legible at 1440×900; copy explains outcomes | Ready | Tom Ballard | Review App Store preview at normal scale |
 | Privacy | No secrets, private data, or embargoed details leak | Store runtime neutralizes OpenAI and non-loopback Ollama; privacy manifest declares no collection | Ready | Tom Ballard | Select Data Not Collected |
-| Links | Destinations and calls to action work | Repository links exist; support/privacy pages become public after merge | Blocked | Tom Ballard | Merge PR #30, then verify both public URLs anonymously |
+| Links | Destinations and calls to action work | Support and privacy URLs return HTTP 200 from merged `main` | Ready | Tom Ballard | Recheck in the final App Store preview |
 | Provenance | Required source and model contribution records exist | Per-asset JSON records source hashes and transformations | Ready | Tom Ballard | Retain evidence with the pack |
 | Authority | Publisher and manual action are explicit | Metadata and build are prepared; App Review submission remains owner-controlled | Ready | Tom Ballard | Owner answers remaining declarations and submits |

launch-pack/outputs/app-store/REVIEW_NOTES.md

@@ -25,4 +25,4 @@ The app does not require a network connection when Apple's on-device provider is
 
 - Name: Tom Ballard
 - Email: tom@armytage.co
-- Phone: owner entry required in App Store Connect
+- Phone: saved in App Store Connect; deliberately not duplicated in the repository

launch-pack/outputs/app-store/SUBMISSION_CHECKLIST.md

@@ -26,6 +26,6 @@
 
 - Confirm the saved review notes and contact details match `REVIEW_NOTES.md`.
 - Keep build 0.1.0 (2) selected.
-- Verify the public support and privacy URLs anonymously after PR #30 merges.
+- Public support and privacy URLs returned HTTP 200 on 22 July 2026; recheck them in the final preview.
 - Run an installed-build smoke test for first setup, persisted folder access, Apple on-device sorting, manual review, Finder intake, pause/resume, and launch at login.
 - Submit only after every blocker in `RELEASE_CHECKLIST.md` is resolved by the owner.

script/preflight_app_store.sh

@@ -58,12 +58,15 @@ if not any(
     raise SystemExit("Compiled asset catalog is missing the 512pt @2x AppIcon rendition.")
 PY
 
-if strings "$APP_BINARY" | grep -Fq "/usr/bin/fm"; then
+BINARY_STRINGS="$DERIVED_DATA/app-store-binary-strings.txt"
+strings "$APP_BINARY" > "$BINARY_STRINGS"
+
+if grep -Fq "/usr/bin/fm" "$BINARY_STRINGS"; then
   echo "App Store binary unexpectedly contains the legacy fm executable path." >&2
   exit 1
 fi
 
-if ! strings "$APP_BINARY" | grep -Fq "The Mac App Store build can connect only to Ollama running on this Mac"; then
+if ! grep -Fq "The Mac App Store build can connect only to Ollama running on this Mac" "$BINARY_STRINGS"; then
   echo "App Store binary is missing the local-only provider policy." >&2
   exit 1
 fi