diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9faf7bd..a111fdb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to InputPilot are documented here. This project follows [Semantic Versioning](https://semver.org).
 
+## [Unreleased]
+
+### Fixed
+
+- A lone F6 press was treated as a modifier key and never triggered a switch. HID usage 0x3F is F6; it had been mistaken for Fn.
+- While the keyboard monitor could not start, the same error was added to the debug log every second until it crowded out everything else. Each distinct failure is now logged once.
+- Public claims made precisely true: the app reads a key's usage code only to detect modifiers; update checks run automatically once a day; and the Tab in ⌘-Tab counts as typing.
+
 ## [1.0.1] — 2026-08-18
 
 ### Fixed
@@ -24,9 +32,9 @@ First public release.
 - Undo for the last automatic switch, and pause for 15 or 60 minutes.
 - Conflict detection for mappings pointing at removed or disabled input sources.
 - Debounce (400 ms) and cooldown (1.5 s) to prevent flapping between keyboards.
-- Optional switching on modifier-only key presses, off by default, so ⌘-Tab does not change the layout.
+- Optional switching on modifier-only key presses, off by default, so a lone ⇧ or ⌘ press does not change the layout. Any other key — including the Tab in ⌘-Tab — counts as typing on that keyboard.
 - In-app debug log with copy and export, containing device and status information only.
-- Automatic updates via Sparkle, over a signed appcast.
+- Automatic updates via Sparkle; every update archive is EdDSA-signed and verified before install.
 
 ### Fixed
 
diff --git a/Config/AppInfo.plist b/Config/AppInfo.plist
index 805c57b..b837939 100644
--- a/Config/AppInfo.plist
+++ b/Config/AppInfo.plist
@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>NSInputMonitoringUsageDescription</key>
-	<string>InputPilot detects which keyboard you are typing on to switch your input language automatically. It never reads or stores what you type.</string>
+	<string>InputPilot uses key presses only to tell which keyboard you are typing on and whether a modifier key was pressed, so it can switch your input language automatically. It never records, stores or sends what you type.</string>
 	<key>SUFeedURL</key>
 	<string>https://raw.githubusercontent.com/LucaGerlich/InputPilot/main/appcast.xml</string>
 	<!-- EdDSA public key; the matching private key lives in the release
diff --git a/InputPilot/App/AppState.swift b/InputPilot/App/AppState.swift
index f9fda47..5e2ec7b 100644
--- a/InputPilot/App/AppState.swift
+++ b/InputPilot/App/AppState.swift
@@ -677,12 +677,14 @@ final class AppState: ObservableObject {
 
         guard didStart else {
             let failureMessage = hidKeyboardMonitor.lastStartErrorMessage ?? "HID monitor could not start although permission is granted."
+            // The permission poll retries every second; log each distinct
+            // failure once so it cannot crowd everything else out of the log.
             if lastMonitorStartFailure != failureMessage {
                 lastMonitorStartFailure = failureMessage
                 recordFailure(failureMessage)
+                debugLog(failureMessage)
+                logError(category: "hid-monitor", message: failureMessage)
             }
-            debugLog(failureMessage)
-            logError(category: "hid-monitor", message: failureMessage)
             return
         }
 
@@ -738,7 +740,7 @@ final class AppState: ObservableObject {
             )
         }
 
-        // A lone modifier press (Cmd+Tab, shortcut chords) still updates the
+        // A lone modifier press (e.g. the Cmd before a shortcut) still updates the
         // active-device display above, but only triggers a switch when the user
         // opted in. Settings-driven re-evaluations use .deviceStabilized and
         // are never gated here.
diff --git a/InputPilot/Services/HIDKeyboardMonitor.swift b/InputPilot/Services/HIDKeyboardMonitor.swift
index 85f19b6..e7a6b74 100644
--- a/InputPilot/Services/HIDKeyboardMonitor.swift
+++ b/InputPilot/Services/HIDKeyboardMonitor.swift
@@ -108,7 +108,7 @@ final class HIDKeyboardMonitor: HIDKeyboardMonitoring {
         let usage = IOHIDElementGetUsage(element)
 
         let device = IOHIDElementGetDevice(element)
-        onEvent?(makeActiveDevice(from: device), .keyDown(isModifier: isModifierUsage(usage)))
+        onEvent?(makeActiveDevice(from: device), .keyDown(isModifier: Self.isModifierUsage(usage)))
     }
 
     private func handleDeviceRemoval(_ device: IOHIDDevice) {
@@ -160,15 +160,12 @@ final class HIDKeyboardMonitor: HIDKeyboardMonitoring {
             || normalizedTransport == "ps2"
     }
 
-    private func isModifierUsage(_ usage: UInt32) -> Bool {
+    static func isModifierUsage(_ usage: UInt32) -> Bool {
         let leftControl = UInt32(kHIDUsage_KeyboardLeftControl)
         let rightGUI = UInt32(kHIDUsage_KeyboardRightGUI)
-        if (leftControl...rightGUI).contains(usage) {
-            return true
-        }
-
-        // Fn is not consistently exposed; 0x3F is commonly used when present.
-        return usage == 0x3F
+        // 0x3F on this page is F6, not Fn: Fn/Globe arrives on Apple's vendor
+        // page and is already filtered out before this is called.
+        return (leftControl...rightGUI).contains(usage)
     }
 
     private static let inputValueCallback: IOHIDValueCallback = { context, _, _, value in
diff --git a/InputPilot/UI/SettingsView.swift b/InputPilot/UI/SettingsView.swift
index 0d6c492..ee609bb 100644
--- a/InputPilot/UI/SettingsView.swift
+++ b/InputPilot/UI/SettingsView.swift
@@ -35,7 +35,7 @@ struct SettingsView: View {
             } header: {
                 Text("Auto-Switch")
             } footer: {
-                Text("When \"Switch on modifier-only key presses\" is off, a lone Shift, Command, or Option press (for example during Cmd+Tab) does not change the input source — only regular typing does.")
+                Text("When \"Switch on modifier-only key presses\" is off, a lone Shift, Control, Option, or Command press does not change the input source. Any other key, including the Tab in Cmd+Tab, counts as typing on that keyboard.")
             }
 
             Section("Input Monitoring") {
diff --git a/InputPilot/UI/WelcomeView.swift b/InputPilot/UI/WelcomeView.swift
index d19e4a9..979b1e6 100644
--- a/InputPilot/UI/WelcomeView.swift
+++ b/InputPilot/UI/WelcomeView.swift
@@ -32,7 +32,7 @@ struct WelcomeView: View {
 				.fixedSize(horizontal: false, vertical: true)
 
 				Label {
-					Text("InputPilot only detects **which keyboard** sent a key press — never what you type. Nothing leaves your Mac.")
+					Text("InputPilot only uses key presses to tell **which keyboard** you are typing on — it never records what you type. Nothing you type leaves your Mac; the only network traffic is a daily update check and any update you choose to install.")
 				} icon: {
 					Image(systemName: "hand.raised")
 				}
diff --git a/InputPilotTests/AppStateFailurePathTests.swift b/InputPilotTests/AppStateFailurePathTests.swift
index 1790f3f..13acd51 100644
--- a/InputPilotTests/AppStateFailurePathTests.swift
+++ b/InputPilotTests/AppStateFailurePathTests.swift
@@ -30,7 +30,7 @@ struct AppStateFailurePathTests {
 
         #expect(!keyboardMonitor.isRunning)
         #expect(appState.status.permissionStatus == .denied)
-        #expect(appState.permissionWarningMessage != nil)
+        #expect(appState.permissionWarningMessage == "Input Monitoring permission is denied or was revoked.")
         #expect(appState.activeKeyboardDevice == nil)
         #expect(appState.status.activeKeyboard == "none")
     }
@@ -113,6 +113,54 @@ struct AppStateFailurePathTests {
         #expect(appState.keyboardMonitorHint != nil)
     }
 
+    @Test
+    func repeatedMonitorStartFailureIsLoggedOnce() async throws {
+        let suiteName = "AppStateFailurePathTests.\(UUID().uuidString)"
+        guard let defaults = UserDefaults(suiteName: suiteName) else {
+            throw FailurePathTestError.failedToCreateUserDefaultsSuite
+        }
+
+        defer {
+            defaults.removePersistentDomain(forName: suiteName)
+        }
+
+        let keyboardMonitor = MockHIDKeyboardMonitor()
+        keyboardMonitor.startResult = false
+        keyboardMonitor.lastStartErrorMessage = "No matching keyboard HID device available."
+
+        let appState = AppState(
+            permissionService: MockPermissionService(accessType: kIOHIDAccessTypeGranted),
+            hidKeyboardMonitor: keyboardMonitor,
+            inputSourceService: MockInputSourceService(),
+            mappingStore: MockMappingStore(),
+            appSettingsStore: AppSettingsStore(defaults: defaults),
+            clock: ImmediateClock(),
+            permissionPollInterval: .milliseconds(10)
+        )
+
+        // The permission poll retries the start on every tick. The debug log
+        // that users attach to bug reports must not fill up with one line.
+        await waitFor {
+            keyboardMonitor.startCallCount >= 5
+        }
+
+        func monitorErrors() -> [LogEntry] {
+            appState.debugLogEntries.filter { $0.category == "hid-monitor" && $0.level == .error }
+        }
+        #expect(keyboardMonitor.startCallCount >= 5)
+        #expect(monitorErrors().count == 1)
+
+        // A different failure is new information and must still be logged.
+        keyboardMonitor.lastStartErrorMessage = "HID monitor start failed with IOReturn -536870203."
+        await waitFor {
+            monitorErrors().count == 2
+        }
+        #expect(monitorErrors().map(\.message) == [
+            "No matching keyboard HID device available.",
+            "HID monitor start failed with IOReturn -536870203."
+        ])
+    }
+
     @Test
     func selectInputSourceFailureRecordsErrorWithoutArmingCooldown() async throws {
         let suiteName = "AppStateFailurePathTests.\(UUID().uuidString)"
diff --git a/InputPilotTests/HIDKeyboardMonitorTests.swift b/InputPilotTests/HIDKeyboardMonitorTests.swift
new file mode 100644
index 0000000..10d4b7f
--- /dev/null
+++ b/InputPilotTests/HIDKeyboardMonitorTests.swift
@@ -0,0 +1,21 @@
+import IOKit.hid
+import Testing
+@testable import InputPilot
+
+struct HIDKeyboardMonitorTests {
+    @Test(arguments: Array(UInt32(kHIDUsage_KeyboardLeftControl)...UInt32(kHIDUsage_KeyboardRightGUI)))
+    func modifierUsagesAreModifiers(usage: UInt32) {
+        #expect(HIDKeyboardMonitor.isModifierUsage(usage))
+    }
+
+    // 0x3F is F6 on the keyboard usage page. Fn/Globe never arrives on that
+    // page (it uses Apple's vendor page), so it needs no entry here.
+    @Test(arguments: [
+        UInt32(kHIDUsage_KeyboardF6),
+        UInt32(kHIDUsage_KeyboardA),
+        UInt32(kHIDUsage_KeyboardTab)
+    ])
+    func regularKeysAreNotModifiers(usage: UInt32) {
+        #expect(!HIDKeyboardMonitor.isModifierUsage(usage))
+    }
+}
diff --git a/InputPilotTests/ServiceMocks.swift b/InputPilotTests/ServiceMocks.swift
index 9f09d2e..297ff01 100644
--- a/InputPilotTests/ServiceMocks.swift
+++ b/InputPilotTests/ServiceMocks.swift
@@ -32,10 +32,12 @@ final class MockHIDKeyboardMonitor: HIDKeyboardMonitoring {
     var startResult = true
     var isRunning = false
     var lastStartErrorMessage: String?
+    private(set) var startCallCount = 0
 
     @discardableResult
     func start(onEvent: @escaping (ActiveKeyboardDevice, KeyboardEventKind) -> Void) -> Bool {
         self.onEvent = onEvent
+        startCallCount += 1
 
         if startResult {
             isRunning = true
diff --git a/README.md b/README.md
index c2bd5c1..1a46e3b 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,20 @@ If you keep a German external keyboard next to a US MacBook keyboard, you alread
 
 ## Install
 
+With [Homebrew](https://brew.sh):
+
+```bash
+brew tap LucaGerlich/tap
+brew install --cask inputpilot
+```
+
+Or manually:
+
 1. Download **`InputPilot-x.y.z.dmg`** from the [latest release](https://github.com/LucaGerlich/InputPilot/releases/latest).
 2. Open the DMG and drag InputPilot into Applications.
+
+Then, either way:
+
 3. Launch it. A keyboard icon appears in the menu bar — there is no Dock icon and no main window.
 4. A welcome window asks for **Input Monitoring**. Grant it, then quit and reopen InputPilot if macOS asks.
 5. Press a key on each keyboard you want to configure, then open **Settings** from the menu bar icon and pick an input source per keyboard.
@@ -25,7 +37,7 @@ The app is signed with a Developer ID certificate and notarized by Apple, so it
 
 To tell your keyboards apart, InputPilot has to see that *a* key was pressed and on *which* device. macOS puts that behind the Input Monitoring permission.
 
-It never reads what you type. The HID callback keeps exactly two things — the device that sent the event, and whether the key was a modifier. The key's usage code is read only to compute that second value and is then discarded: it is never stored, logged or transmitted, and no character or text is derived from it. Nothing is sent off your Mac: the only network traffic is the update check, and the only third-party dependency is the Sparkle updater.
+It never records what you type. The HID callback keeps exactly two things — the device that sent the event, and whether the key was a modifier. The key's usage code is read only to compute that second value and is then discarded: it is never stored, logged or transmitted, and no character or text is derived from it. Nothing you type is sent off your Mac: the only network traffic is Sparkle's update check (automatically once a day, or when you choose Check for Updates) and the download of any update you accept. Sparkle is the only third-party dependency.
 
 See [SECURITY.md](SECURITY.md) for the full privacy statement and how to report a vulnerability.
 
@@ -37,7 +49,7 @@ See [SECURITY.md](SECURITY.md) for the full privacy statement and how to report
 - **Pause** — silence auto-switching for 15 or 60 minutes when it would get in the way.
 - **Conflict detection** — spots mappings that point at an input source you have since removed or disabled, and offers to fix them.
 - **Stable device identity** — keyboards are matched on vendor, product, transport and name, so unplugging and replugging (or moving to another USB port) keeps your mapping.
-- **No flapping** — a 400 ms debounce and a 1.5 s cooldown stop rapid switching, and modifier-only presses (a lone ⇧ or ⌘ during ⌘-Tab) are ignored by default.
+- **No flapping** — a 400 ms debounce and a 1.5 s cooldown stop rapid switching, and a lone modifier press (⇧, ⌘, ⌥ or ⌃ on its own) is ignored by default. Any other key — including the Tab in ⌘-Tab — counts as typing on that keyboard.
 - **Debug log** — an in-app log window you can copy or export when reporting a bug. It contains device and status information only, never typed text.
 
 ## How it works
diff --git a/SECURITY.md b/SECURITY.md
index 7becab3..9223401 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -9,19 +9,26 @@ To decide which input source to activate, InputPilot needs to know **which keybo
 - the device that sent it (vendor ID, product ID, transport, product name, location)
 - whether the key was a modifier
 
-Nothing else leaves that callback. The key's usage code is read inside it, solely to decide whether the key was a modifier, and is discarded when the callback returns — it is never assigned, stored, logged or transmitted, and no character or typed text is derived from it anywhere in the app.
+Nothing else leaves that callback. The key's usage code is read inside it, solely to decide whether the key was a modifier. It exists only as a local constant within the callback and is gone when the callback returns — it is never kept in a property, stored, logged or transmitted, and no character or typed text is derived from it anywhere in the app.
 
 ## What InputPilot stores
 
-Settings and keyboard mappings live in `UserDefaults`: which input source belongs to which keyboard, your fallbacks, the pause timestamp, and a schema migration flag. That is all.
+Settings and keyboard mappings live in `UserDefaults` (`com.lucagerlich.InputPilot`):
 
-The debug log is an in-memory ring buffer of at most 200 entries, holding device identifiers, permission state, input source names, and errors. It is never written to disk unless you explicitly export it, and export runs the text through a redaction pass that strips any field resembling key codes, typed text, characters, or app contents — defence in depth for a log that should never contain them in the first place.
+- for each keyboard you have mapped or given a fallback: its identifiers (vendor ID, product ID, transport, product name, location) and the input source mapped to it
+- your fallbacks, the auto-switch and modifier-only settings, and the pause timestamp
+- a schema migration flag
+- only if stored mappings ever fail to decode: a `.corrupted` backup of that data, so it is not lost
+
+Sparkle keeps its own bookkeeping in the same place: when it last checked for updates, whether the app has launched before, and a random number it uses for staged rollouts. No key or typing data is stored anywhere.
+
+The debug log is an in-memory ring buffer of at most 200 entries, holding device identifiers, permission state, input source names, and errors. It is never written to disk unless you explicitly export it, and only reaches the clipboard if you copy it. As each entry is recorded, a filter replaces any occurrence of `keycode`, `typedtext`, `characters`, `appcontents` and `keystroke` with `[redacted]`. That filter is a tripwire, not the guarantee — the guarantee is that no code path sends key data to the log in the first place.
 
 ## What leaves your Mac
 
-Update checks against the appcast at `raw.githubusercontent.com`, and the download itself when you accept an update. Nothing else. There is no telemetry, no analytics, and no crash reporter.
+Update checks against the appcast at `raw.githubusercontent.com` — automatically about once a day, and whenever you choose Check for Updates — and the download itself when you accept an update. Each check is an ordinary HTTPS request, so GitHub sees your IP address and a user agent naming the app and Sparkle versions. Nothing else is sent. There is no telemetry, no analytics, and no crash reporter.
 
-Updates are verified twice: an EdDSA signature over the appcast enclosure, and Apple's notarization of the downloaded app.
+Sparkle verifies every update before installing it: an EdDSA signature over the downloaded archive, checked against the public key built into the app, and a check that the new app carries a valid code signature. Each release is also notarized by Apple.
 
 ## Supply chain
 
diff --git a/docs/index.html b/docs/index.html
index 2e13170..258d88e 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -199,7 +199,7 @@
     "Works with USB and Bluetooth keyboards",
     "Per-device and global fallback input sources",
     "Debounce and cooldown prevent layout flapping",
-    "Reads only the source device and modifier flag, never key codes or typed text",
+    "Reads the source device and a modifier flag; the key's usage code is checked only to detect modifiers and is never stored, logged or transmitted",
     "No telemetry, no analytics, no crash reporting"
    ],
    "offers": {
@@ -256,7 +256,7 @@
      "name": "Why is it not on the App Store?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the thing you are granting keyboard access to. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings."
+      "text": "InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the app you are granting keyboard access to, and of Sparkle, the open-source updater inside it. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings."
      }
     },
     {
@@ -288,15 +288,15 @@
      "name": "I use a German external keyboard with a US MacBook. Does this fix it?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout is right the moment you start typing on either — no shortcut, no menu, nothing to remember."
+      "text": "That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on. It switches about 0.4 seconds after you start typing on the other keyboard, so the first character or two can still land in the old layout — but there is no shortcut, no menu, nothing to remember."
      }
     },
     {
      "@type": "Question",
-     "name": "How is this different from autokbisw, OctoKeys or Input Source Pro?",
+     "name": "How is this different from Keychange, autokbisw, OctoKeys or Input Source Pro?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. InputPilot switches per keyboard too, but you assign the input source explicitly rather than relying on what was used last, it is open source so you can audit what it does with the permission, and it is free."
+      "text": "Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. InputPilot runs on macOS 13 as well, and lets you set fallback layouts for keyboards you have not mapped yet."
      }
     },
     {
@@ -494,7 +494,7 @@ <h3>Pick a layout</h3>
 		<div class="step">
 			<div class="n">03</div>
 			<h3>Forget about it</h3>
-			<p>A 400 ms debounce and a 1.5 s cooldown keep it from flapping. Modifier-only presses are ignored, so ⌘-Tab never changes your layout.</p>
+			<p>A 400 ms debounce and a 1.5 s cooldown keep it from flapping. A lone modifier press (⇧, ⌘, ⌥, ⌃) is ignored; any other key — including the Tab in ⌘-Tab — counts as typing on that keyboard.</p>
 		</div>
 	</div>
 </section>
@@ -503,12 +503,12 @@ <h3>Forget about it</h3>
 	<h2>About that permission</h2>
 	<p class="lede">InputPilot asks for Input Monitoring — the permission that lets an app see keyboard events. That is a lot to ask for, so here is exactly what it does with it.</p>
 	<div class="panel" style="padding:1.4rem 1.5rem">
-		<p style="margin:0"><b>It reads which keyboard sent a key press, not what you typed.</b></p>
+		<p style="margin:0"><b>It looks at which keyboard sent a key press. It never records what you type.</b></p>
 		<ul class="checks">
 			<li>The HID callback takes two things from each event: <b>the device that sent it</b>, and <b>whether the key was a modifier</b>. Nothing else.</li>
 			<li>The key's usage code is read only to decide whether it was a modifier, then discarded. It is never stored, logged or transmitted, and no character or text is ever derived from it.</li>
-			<li>The only network traffic is the update check. <b>No telemetry, no analytics, no crash reporter.</b></li>
-			<li>The source is public and the app is about 3,200 lines of Swift. The keyboard handling is 15 lines and reads in a minute.</li>
+			<li>The only network traffic is Sparkle's update check — automatically once a day, and when you ask — and the download of any update you accept. <b>No telemetry, no analytics, no crash reporter.</b></li>
+			<li>The source is public: about 3,200 lines of Swift, plus Sparkle, the open-source updater it ships with. The keyboard handling is 15 lines and reads in a minute.</li>
 		</ul>
 		<p style="margin:1.1rem 0 0"><a href="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/LucaGerlich/InputPilot/blob/main/SECURITY.md">Full privacy statement →</a></p>
 	</div>
@@ -518,7 +518,7 @@ <h2>About that permission</h2>
 	<h2>Questions</h2>
 	<div class="narrow">
 	<details><summary>Why is it not on the App Store?</summary>
-		<p>InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the thing you are granting keyboard access to. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings.</p></details>
+		<p>InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the app you are granting keyboard access to, and of Sparkle, the open-source updater inside it. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings.</p></details>
 	<details><summary>InputPilot does not appear under Input Monitoring.</summary>
 		<p>Some Macs do not populate that list automatically. Add it by hand: System Settings → Privacy &amp; Security → Input Monitoring → <b>+</b> → pick InputPilot in Applications, then switch it on.</p></details>
 	<details><summary>I granted permission but nothing happens.</summary>
@@ -526,9 +526,9 @@ <h2>Questions</h2>
 	<details><summary>Does it work with Bluetooth keyboards?</summary>
 		<p>Yes. Keyboards are identified by vendor, product, transport and name, so a Bluetooth keyboard is recognised again after reconnecting.</p></details>
 	<details><summary>I use a German external keyboard with a US MacBook. Does this fix it?</summary>
-		<p>That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout is right the moment you start typing on either — no shortcut, no menu, nothing to remember.</p></details>
-	<details><summary>How is this different from autokbisw, OctoKeys or Input Source Pro?</summary>
-		<p>Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. InputPilot switches per keyboard too, but you assign the input source explicitly rather than relying on what was used last, it is open source so you can audit what it does with the permission, and it is free.</p></details>
+		<p>That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on. It switches about 0.4 seconds after you start typing on the other keyboard, so the first character or two can still land in the old layout — but there is no shortcut, no menu, nothing to remember.</p></details>
+	<details><summary>How is this different from Keychange, autokbisw, OctoKeys or Input Source Pro?</summary>
+		<p>Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. InputPilot runs on macOS 13 as well, and lets you set fallback layouts for keyboards you have not mapped yet.</p></details>
 	<details><summary>What does it cost?</summary>
 		<p>Nothing. Free and open source under the Apache 2.0 licence.</p></details>
 	</div>
diff --git a/docs/pre-release-audit.md b/docs/pre-release-audit.md
index 6ea5ece..cd8c9d4 100644
--- a/docs/pre-release-audit.md
+++ b/docs/pre-release-audit.md
@@ -5,7 +5,7 @@
 Audited: 2026-08-18 · Scope: full repo · Method: 4 specialized reviews (correctness/concurrency, security/privacy, distribution, tests) + empirical verification
 Verification baseline at audit time: **build ✓ · all 30 tests pass ✓ · no third-party dependencies · security review clean (no keystroke logging, no network calls)**
 
-Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pass; Sparkle 2.9.6 was added deliberately as the update mechanism (finding H3) — its user-initiated update checks are now the app's only network activity. Finding texts below are preserved as written at audit time; checkboxes track resolution.
+Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pass; Sparkle 2.9.6 was added deliberately as the update mechanism (finding H3) — its update checks are now the app's only network activity. *(Correction, 2026-10-11: those checks are automatic, about once a day, as well as user-initiated.)* Finding texts below are preserved as written at audit time; checkboxes track resolution.
 
 ## Summary
 
@@ -20,7 +20,7 @@ Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pa
 
 ## Critical — blocks any public release
 
-- [x] **C1 · No Developer ID certificate / notarization** — resolved 2026-08-18: "Developer ID Application: Luca Gerlich (T5M4XW2T24)" installed, notarytool keychain profile `InputPilot` stored and validated, Sparkle EdDSA key pair generated (public key in `Config/AppInfo.plist`, private key in the release machine's Keychain). Signing config moved from team Q62GHM26RA to T5M4XW2T24 to match the certificate. Remaining: run `Scripts/release.sh 1.0.0` to produce the first notarized build. *Effort: medium*
+- [x] **C1 · No Developer ID certificate / notarization** — resolved 2026-08-18: "Developer ID Application: Luca Gerlich (T5M4XW2T24)" installed, notarytool keychain profile `InputPilot` stored and validated, Sparkle EdDSA key pair generated (public key in `Config/AppInfo.plist`, private key in the release machine's Keychain). Signing config moved from a work account's team to T5M4XW2T24 to match the certificate. Remaining: run `Scripts/release.sh 1.0.0` to produce the first notarized build. *Effort: medium*
 - [x] **C2 · No release pipeline** — no CI, no ExportOptions.plist, no DMG/zip packaging, no git tags. Add: archive → Developer ID export → notarize → staple → DMG → tagged GitHub Release. *Effort: large*
 - [x] **C3 · No LICENSE file** — public distribution is legally "all rights reserved". Add MIT/Apache-2.0 or explicit EULA + README section. *Effort: small*
 - [x] **C4 · Bundle ID `lucagerlich.InputPilot` is not reverse-DNS** (`project.pbxproj`) — must become e.g. `com.lucagerlich.InputPilot` **before** the first public build; changing later resets users' Input Monitoring TCC grant and UserDefaults. *Effort: small*