From 3f5797e58a775df82b092908415936992def2735 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Tue, 18 Aug 2026 21:19:02 +0200
Subject: [PATCH 1/8] docs: document Homebrew installation

---
 README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/README.md b/README.md
index c2bd5c1..2384ac5 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,20 @@ If you keep a German external keyboard next to a US MacBook keyboard, you alread
 
 ## Install
 
+With [Homebrew](https://brew.sh):
+
+```bash
+brew tap LucaGerlich/tap
+brew install --cask inputpilot
+```
+
+Or manually:
+
 1. Download **`InputPilot-x.y.z.dmg`** from the [latest release](https://github.com/LucaGerlich/InputPilot/releases/latest).
 2. Open the DMG and drag InputPilot into Applications.
+
+Then, either way:
+
 3. Launch it. A keyboard icon appears in the menu bar — there is no Dock icon and no main window.
 4. A welcome window asks for **Input Monitoring**. Grant it, then quit and reopen InputPilot if macOS asks.
 5. Press a key on each keyboard you want to configure, then open **Settings** from the menu bar icon and pick an input source per keyboard.

From 70e2a0521369ce2bab2099c6915214ff2abf17a6 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:17:42 +0200
Subject: [PATCH 2/8] fix: make the privacy, update and shortcut claims
 precisely true

- Structured data on the site still said the app never reads key codes;
  it reads the usage code to detect modifiers, then discards it.
- "Nothing leaves your Mac" ignored Sparkle's automatic daily update
  check; the welcome text, README, site and SECURITY.md now say so.
- Tab is not a modifier, so the claim that Cmd-Tab never changes the
  layout was false. Describe what is actually ignored.
- The layout switches within half a second of the first key press, not
  "the moment you start typing".
- SECURITY.md: the usage code is a local constant, the storage list is
  complete, redaction runs on record rather than export, and Sparkle
  checks a code signature rather than notarization.
- CHANGELOG: only update archives are signed, not the appcast itself.
- Name Keychange, the closest alternative, in the comparison FAQ.
- Note the corrected network claim in the pre-release audit and drop the
  work account's team ID from the published page.
---
 CHANGELOG.md                    |  4 ++--
 Config/AppInfo.plist            |  2 +-
 InputPilot/UI/WelcomeView.swift |  2 +-
 README.md                       |  2 +-
 SECURITY.md                     | 17 ++++++++++++-----
 docs/index.html                 | 26 +++++++++++++-------------
 docs/pre-release-audit.md       |  4 ++--
 7 files changed, 32 insertions(+), 25 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9faf7bd..7b82159 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,9 +24,9 @@ First public release.
 - Undo for the last automatic switch, and pause for 15 or 60 minutes.
 - Conflict detection for mappings pointing at removed or disabled input sources.
 - Debounce (400 ms) and cooldown (1.5 s) to prevent flapping between keyboards.
-- Optional switching on modifier-only key presses, off by default, so ⌘-Tab does not change the layout.
+- Optional switching on modifier-only key presses, off by default, so a lone ⇧ or ⌘ press does not change the layout. Any other key — including the Tab in ⌘-Tab — counts as typing on that keyboard.
 - In-app debug log with copy and export, containing device and status information only.
-- Automatic updates via Sparkle, over a signed appcast.
+- Automatic updates via Sparkle; every update archive is EdDSA-signed and verified before install.
 
 ### Fixed
 
diff --git a/Config/AppInfo.plist b/Config/AppInfo.plist
index 805c57b..b837939 100644
--- a/Config/AppInfo.plist
+++ b/Config/AppInfo.plist
@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>NSInputMonitoringUsageDescription</key>
-	<string>InputPilot detects which keyboard you are typing on to switch your input language automatically. It never reads or stores what you type.</string>
+	<string>InputPilot uses key presses only to tell which keyboard you are typing on and whether a modifier key was pressed, so it can switch your input language automatically. It never records, stores or sends what you type.</string>
 	<key>SUFeedURL</key>
 	<string>https://raw.githubusercontent.com/LucaGerlich/InputPilot/main/appcast.xml</string>
 	<!-- EdDSA public key; the matching private key lives in the release
diff --git a/InputPilot/UI/WelcomeView.swift b/InputPilot/UI/WelcomeView.swift
index d19e4a9..f0d3581 100644
--- a/InputPilot/UI/WelcomeView.swift
+++ b/InputPilot/UI/WelcomeView.swift
@@ -32,7 +32,7 @@ struct WelcomeView: View {
 				.fixedSize(horizontal: false, vertical: true)
 
 				Label {
-					Text("InputPilot only detects **which keyboard** sent a key press — never what you type. Nothing leaves your Mac.")
+					Text("InputPilot only uses key presses to tell **which keyboard** you are typing on — it never records what you type. Nothing you type leaves your Mac; the only network request is a daily update check.")
 				} icon: {
 					Image(systemName: "hand.raised")
 				}
diff --git a/README.md b/README.md
index 2384ac5..41eac66 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ The app is signed with a Developer ID certificate and notarized by Apple, so it
 
 To tell your keyboards apart, InputPilot has to see that *a* key was pressed and on *which* device. macOS puts that behind the Input Monitoring permission.
 
-It never reads what you type. The HID callback keeps exactly two things — the device that sent the event, and whether the key was a modifier. The key's usage code is read only to compute that second value and is then discarded: it is never stored, logged or transmitted, and no character or text is derived from it. Nothing is sent off your Mac: the only network traffic is the update check, and the only third-party dependency is the Sparkle updater.
+It never records what you type. The HID callback keeps exactly two things — the device that sent the event, and whether the key was a modifier. The key's usage code is read only to compute that second value and is then discarded: it is never stored, logged or transmitted, and no character or text is derived from it. Nothing you type is sent off your Mac: the only network traffic is Sparkle's update check (automatically once a day, or when you choose Check for Updates), and Sparkle is the only third-party dependency.
 
 See [SECURITY.md](SECURITY.md) for the full privacy statement and how to report a vulnerability.
 
diff --git a/SECURITY.md b/SECURITY.md
index 7becab3..b149ad9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -9,19 +9,26 @@ To decide which input source to activate, InputPilot needs to know **which keybo
 - the device that sent it (vendor ID, product ID, transport, product name, location)
 - whether the key was a modifier
 
-Nothing else leaves that callback. The key's usage code is read inside it, solely to decide whether the key was a modifier, and is discarded when the callback returns — it is never assigned, stored, logged or transmitted, and no character or typed text is derived from it anywhere in the app.
+Nothing else leaves that callback. The key's usage code is read inside it, solely to decide whether the key was a modifier. It exists only as a local constant within the callback and is gone when the callback returns — it is never kept in a property, stored, logged or transmitted, and no character or typed text is derived from it anywhere in the app.
 
 ## What InputPilot stores
 
-Settings and keyboard mappings live in `UserDefaults`: which input source belongs to which keyboard, your fallbacks, the pause timestamp, and a schema migration flag. That is all.
+Settings and keyboard mappings live in `UserDefaults` (`com.lucagerlich.InputPilot`):
 
-The debug log is an in-memory ring buffer of at most 200 entries, holding device identifiers, permission state, input source names, and errors. It is never written to disk unless you explicitly export it, and export runs the text through a redaction pass that strips any field resembling key codes, typed text, characters, or app contents — defence in depth for a log that should never contain them in the first place.
+- for each keyboard you have used: its identifiers (vendor ID, product ID, transport, product name, location) and the input source mapped to it
+- your fallbacks, the auto-switch and modifier-only settings, and the pause timestamp
+- a schema migration flag
+- only if stored mappings ever fail to decode: a `.corrupted` backup of that data, so it is not lost
+
+Sparkle keeps its own bookkeeping in the same place: when it last checked for updates, whether the app has launched before, and a random number it uses for staged rollouts. No key or typing data is stored anywhere.
+
+The debug log is an in-memory ring buffer of at most 200 entries, holding device identifiers, permission state, input source names, and errors. It is never written to disk unless you explicitly export it, and only reaches the clipboard if you copy it. As each entry is recorded, a filter replaces the words `keycode`, `typedtext`, `characters`, `appcontents` and `keystroke` with `[redacted]`. That filter is a tripwire, not the guarantee — the guarantee is that no code path sends key data to the log in the first place.
 
 ## What leaves your Mac
 
-Update checks against the appcast at `raw.githubusercontent.com`, and the download itself when you accept an update. Nothing else. There is no telemetry, no analytics, and no crash reporter.
+Update checks against the appcast at `raw.githubusercontent.com` — automatically about once a day, and whenever you choose Check for Updates — and the download itself when you accept an update. Each check is an ordinary HTTPS request, so GitHub sees your IP address and a user agent naming the app and Sparkle versions. Nothing else is sent. There is no telemetry, no analytics, and no crash reporter.
 
-Updates are verified twice: an EdDSA signature over the appcast enclosure, and Apple's notarization of the downloaded app.
+Sparkle verifies every update before installing it: an EdDSA signature over the downloaded archive, checked against the public key built into the app, and a code-signature check that the new app is signed by the same Developer ID team. Each release is also notarized by Apple.
 
 ## Supply chain
 
diff --git a/docs/index.html b/docs/index.html
index 2e13170..2fc6243 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -199,7 +199,7 @@
     "Works with USB and Bluetooth keyboards",
     "Per-device and global fallback input sources",
     "Debounce and cooldown prevent layout flapping",
-    "Reads only the source device and modifier flag, never key codes or typed text",
+    "Reads the source device and a modifier flag; the key's usage code is checked only to detect modifiers and is never stored, logged or transmitted",
     "No telemetry, no analytics, no crash reporting"
    ],
    "offers": {
@@ -256,7 +256,7 @@
      "name": "Why is it not on the App Store?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the thing you are granting keyboard access to. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings."
+      "text": "InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the app you are granting keyboard access to, and of Sparkle, the open-source updater inside it. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings."
      }
     },
     {
@@ -288,15 +288,15 @@
      "name": "I use a German external keyboard with a US MacBook. Does this fix it?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout is right the moment you start typing on either — no shortcut, no menu, nothing to remember."
+      "text": "That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on, switching within half a second of the first key press — no shortcut, no menu, nothing to remember."
      }
     },
     {
      "@type": "Question",
-     "name": "How is this different from autokbisw, OctoKeys or Input Source Pro?",
+     "name": "How is this different from Keychange, autokbisw, OctoKeys or Input Source Pro?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. InputPilot switches per keyboard too, but you assign the input source explicitly rather than relying on what was used last, it is open source so you can audit what it does with the permission, and it is free."
+      "text": "Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. It also runs on macOS 13 and has fallback layouts for keyboards you have not mapped yet."
      }
     },
     {
@@ -494,7 +494,7 @@ <h3>Pick a layout</h3>
 		<div class="step">
 			<div class="n">03</div>
 			<h3>Forget about it</h3>
-			<p>A 400 ms debounce and a 1.5 s cooldown keep it from flapping. Modifier-only presses are ignored, so ⌘-Tab never changes your layout.</p>
+			<p>A 400 ms debounce and a 1.5 s cooldown keep it from flapping. A lone modifier press (⇧, ⌘, ⌥, ⌃) is ignored; any other key — including the Tab in ⌘-Tab — counts as typing on that keyboard.</p>
 		</div>
 	</div>
 </section>
@@ -503,12 +503,12 @@ <h3>Forget about it</h3>
 	<h2>About that permission</h2>
 	<p class="lede">InputPilot asks for Input Monitoring — the permission that lets an app see keyboard events. That is a lot to ask for, so here is exactly what it does with it.</p>
 	<div class="panel" style="padding:1.4rem 1.5rem">
-		<p style="margin:0"><b>It reads which keyboard sent a key press, not what you typed.</b></p>
+		<p style="margin:0"><b>It looks at which keyboard sent a key press. It never records what you type.</b></p>
 		<ul class="checks">
 			<li>The HID callback takes two things from each event: <b>the device that sent it</b>, and <b>whether the key was a modifier</b>. Nothing else.</li>
 			<li>The key's usage code is read only to decide whether it was a modifier, then discarded. It is never stored, logged or transmitted, and no character or text is ever derived from it.</li>
-			<li>The only network traffic is the update check. <b>No telemetry, no analytics, no crash reporter.</b></li>
-			<li>The source is public and the app is about 3,200 lines of Swift. The keyboard handling is 15 lines and reads in a minute.</li>
+			<li>The only network traffic is Sparkle's update check — automatically once a day, and when you ask. <b>No telemetry, no analytics, no crash reporter.</b></li>
+			<li>The source is public: about 3,200 lines of Swift, plus Sparkle, the open-source updater it ships with. The keyboard handling is 15 lines and reads in a minute.</li>
 		</ul>
 		<p style="margin:1.1rem 0 0"><a href="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/LucaGerlich/InputPilot/blob/main/SECURITY.md">Full privacy statement →</a></p>
 	</div>
@@ -518,7 +518,7 @@ <h2>About that permission</h2>
 	<h2>Questions</h2>
 	<div class="narrow">
 	<details><summary>Why is it not on the App Store?</summary>
-		<p>InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the thing you are granting keyboard access to. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings.</p></details>
+		<p>InputPilot is not sandboxed — it talks to IOKit's HID layer directly, which is the most reliable way to tell one physical keyboard from another. App Store apps must be sandboxed, which constrains both HID access and input-source switching. That is not an absolute barrier — OctoKeys does per-keyboard switching on the App Store — but outside the store there is no review cycle, the app stays free, and you can read every line of the app you are granting keyboard access to, and of Sparkle, the open-source updater inside it. It is signed with a Developer ID certificate and notarized by Apple, so it opens without warnings.</p></details>
 	<details><summary>InputPilot does not appear under Input Monitoring.</summary>
 		<p>Some Macs do not populate that list automatically. Add it by hand: System Settings → Privacy &amp; Security → Input Monitoring → <b>+</b> → pick InputPilot in Applications, then switch it on.</p></details>
 	<details><summary>I granted permission but nothing happens.</summary>
@@ -526,9 +526,9 @@ <h2>Questions</h2>
 	<details><summary>Does it work with Bluetooth keyboards?</summary>
 		<p>Yes. Keyboards are identified by vendor, product, transport and name, so a Bluetooth keyboard is recognised again after reconnecting.</p></details>
 	<details><summary>I use a German external keyboard with a US MacBook. Does this fix it?</summary>
-		<p>That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout is right the moment you start typing on either — no shortcut, no menu, nothing to remember.</p></details>
-	<details><summary>How is this different from autokbisw, OctoKeys or Input Source Pro?</summary>
-		<p>Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. InputPilot switches per keyboard too, but you assign the input source explicitly rather than relying on what was used last, it is open source so you can audit what it does with the permission, and it is free.</p></details>
+		<p>That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on, switching within half a second of the first key press — no shortcut, no menu, nothing to remember.</p></details>
+	<details><summary>How is this different from Keychange, autokbisw, OctoKeys or Input Source Pro?</summary>
+		<p>Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. It also runs on macOS 13 and has fallback layouts for keyboards you have not mapped yet.</p></details>
 	<details><summary>What does it cost?</summary>
 		<p>Nothing. Free and open source under the Apache 2.0 licence.</p></details>
 	</div>
diff --git a/docs/pre-release-audit.md b/docs/pre-release-audit.md
index 6ea5ece..7992335 100644
--- a/docs/pre-release-audit.md
+++ b/docs/pre-release-audit.md
@@ -5,7 +5,7 @@
 Audited: 2026-08-18 · Scope: full repo · Method: 4 specialized reviews (correctness/concurrency, security/privacy, distribution, tests) + empirical verification
 Verification baseline at audit time: **build ✓ · all 30 tests pass ✓ · no third-party dependencies · security review clean (no keystroke logging, no network calls)**
 
-Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pass; Sparkle 2.9.6 was added deliberately as the update mechanism (finding H3) — its user-initiated update checks are now the app's only network activity. Finding texts below are preserved as written at audit time; checkboxes track resolution.
+Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pass; Sparkle 2.9.6 was added deliberately as the update mechanism (finding H3) — its update checks are now the app's only network activity. *(Correction, 2026-10-11: those checks are automatic, about once a day, as well as user-initiated — see [post-launch-audit.md](post-launch-audit.md).)* Finding texts below are preserved as written at audit time; checkboxes track resolution.
 
 ## Summary
 
@@ -20,7 +20,7 @@ Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pa
 
 ## Critical — blocks any public release
 
-- [x] **C1 · No Developer ID certificate / notarization** — resolved 2026-08-18: "Developer ID Application: Luca Gerlich (T5M4XW2T24)" installed, notarytool keychain profile `InputPilot` stored and validated, Sparkle EdDSA key pair generated (public key in `Config/AppInfo.plist`, private key in the release machine's Keychain). Signing config moved from team Q62GHM26RA to T5M4XW2T24 to match the certificate. Remaining: run `Scripts/release.sh 1.0.0` to produce the first notarized build. *Effort: medium*
+- [x] **C1 · No Developer ID certificate / notarization** — resolved 2026-08-18: "Developer ID Application: Luca Gerlich (T5M4XW2T24)" installed, notarytool keychain profile `InputPilot` stored and validated, Sparkle EdDSA key pair generated (public key in `Config/AppInfo.plist`, private key in the release machine's Keychain). Signing config moved from a work account's team to T5M4XW2T24 to match the certificate. Remaining: run `Scripts/release.sh 1.0.0` to produce the first notarized build. *Effort: medium*
 - [x] **C2 · No release pipeline** — no CI, no ExportOptions.plist, no DMG/zip packaging, no git tags. Add: archive → Developer ID export → notarize → staple → DMG → tagged GitHub Release. *Effort: large*
 - [x] **C3 · No LICENSE file** — public distribution is legally "all rights reserved". Add MIT/Apache-2.0 or explicit EULA + README section. *Effort: small*
 - [x] **C4 · Bundle ID `lucagerlich.InputPilot` is not reverse-DNS** (`project.pbxproj`) — must become e.g. `com.lucagerlich.InputPilot` **before** the first public build; changing later resets users' Input Monitoring TCC grant and UserDefaults. *Effort: small*

From 59452e020cf84fc943ac962ee6b95514628cea9c Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:17:42 +0200
Subject: [PATCH 3/8] test: assert the denied-permission warning text

The previous assertion compared a non-optional String to nil, so it could
never fail.
---
 InputPilotTests/AppStateFailurePathTests.swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/InputPilotTests/AppStateFailurePathTests.swift b/InputPilotTests/AppStateFailurePathTests.swift
index 1790f3f..f4d14f0 100644
--- a/InputPilotTests/AppStateFailurePathTests.swift
+++ b/InputPilotTests/AppStateFailurePathTests.swift
@@ -30,7 +30,7 @@ struct AppStateFailurePathTests {
 
         #expect(!keyboardMonitor.isRunning)
         #expect(appState.status.permissionStatus == .denied)
-        #expect(appState.permissionWarningMessage != nil)
+        #expect(appState.permissionWarningMessage == "Input Monitoring permission is denied or was revoked.")
         #expect(appState.activeKeyboardDevice == nil)
         #expect(appState.status.activeKeyboard == "none")
     }

From b7fac09bc8618d44d42c1727bfdccd617a4c35a0 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:17:42 +0200
Subject: [PATCH 4/8] fix: log a repeated keyboard-monitor start failure only
 once

The permission poll retries the HID monitor every second. While it cannot
start, the same error was appended to the debug log on every tick, so
within about 200 seconds the 200-entry log - the one users are asked to
attach to bug reports - held nothing else. Log each distinct failure once,
together with the existing de-duplicated failure record.
---
 InputPilot/App/AppState.swift                 |  6 ++--
 .../AppStateFailurePathTests.swift            | 36 +++++++++++++++++++
 InputPilotTests/ServiceMocks.swift            |  2 ++
 3 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/InputPilot/App/AppState.swift b/InputPilot/App/AppState.swift
index f9fda47..bd191bd 100644
--- a/InputPilot/App/AppState.swift
+++ b/InputPilot/App/AppState.swift
@@ -677,12 +677,14 @@ final class AppState: ObservableObject {
 
         guard didStart else {
             let failureMessage = hidKeyboardMonitor.lastStartErrorMessage ?? "HID monitor could not start although permission is granted."
+            // The permission poll retries every second; log each distinct
+            // failure once so it cannot crowd everything else out of the log.
             if lastMonitorStartFailure != failureMessage {
                 lastMonitorStartFailure = failureMessage
                 recordFailure(failureMessage)
+                debugLog(failureMessage)
+                logError(category: "hid-monitor", message: failureMessage)
             }
-            debugLog(failureMessage)
-            logError(category: "hid-monitor", message: failureMessage)
             return
         }
 
diff --git a/InputPilotTests/AppStateFailurePathTests.swift b/InputPilotTests/AppStateFailurePathTests.swift
index f4d14f0..24b48ee 100644
--- a/InputPilotTests/AppStateFailurePathTests.swift
+++ b/InputPilotTests/AppStateFailurePathTests.swift
@@ -113,6 +113,42 @@ struct AppStateFailurePathTests {
         #expect(appState.keyboardMonitorHint != nil)
     }
 
+    @Test
+    func repeatedMonitorStartFailureIsLoggedOnce() async throws {
+        let suiteName = "AppStateFailurePathTests.\(UUID().uuidString)"
+        guard let defaults = UserDefaults(suiteName: suiteName) else {
+            throw FailurePathTestError.failedToCreateUserDefaultsSuite
+        }
+
+        defer {
+            defaults.removePersistentDomain(forName: suiteName)
+        }
+
+        let keyboardMonitor = MockHIDKeyboardMonitor()
+        keyboardMonitor.startResult = false
+        keyboardMonitor.lastStartErrorMessage = "No matching keyboard HID device available."
+
+        let appState = AppState(
+            permissionService: MockPermissionService(accessType: kIOHIDAccessTypeGranted),
+            hidKeyboardMonitor: keyboardMonitor,
+            inputSourceService: MockInputSourceService(),
+            mappingStore: MockMappingStore(),
+            appSettingsStore: AppSettingsStore(defaults: defaults),
+            clock: ImmediateClock(),
+            permissionPollInterval: .milliseconds(10)
+        )
+
+        // The permission poll retries the start on every tick. The debug log
+        // that users attach to bug reports must not fill up with one line.
+        await waitFor {
+            keyboardMonitor.startCallCount >= 5
+        }
+
+        let monitorErrors = appState.debugLogEntries.filter { $0.category == "hid-monitor" && $0.level == .error }
+        #expect(keyboardMonitor.startCallCount >= 5)
+        #expect(monitorErrors.count == 1)
+    }
+
     @Test
     func selectInputSourceFailureRecordsErrorWithoutArmingCooldown() async throws {
         let suiteName = "AppStateFailurePathTests.\(UUID().uuidString)"
diff --git a/InputPilotTests/ServiceMocks.swift b/InputPilotTests/ServiceMocks.swift
index 9f09d2e..297ff01 100644
--- a/InputPilotTests/ServiceMocks.swift
+++ b/InputPilotTests/ServiceMocks.swift
@@ -32,10 +32,12 @@ final class MockHIDKeyboardMonitor: HIDKeyboardMonitoring {
     var startResult = true
     var isRunning = false
     var lastStartErrorMessage: String?
+    private(set) var startCallCount = 0
 
     @discardableResult
     func start(onEvent: @escaping (ActiveKeyboardDevice, KeyboardEventKind) -> Void) -> Bool {
         self.onEvent = onEvent
+        startCallCount += 1
 
         if startResult {
             isRunning = true

From 33488f29a9d69796a1a21ad21eedb9e2eb2b2545 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:17:42 +0200
Subject: [PATCH 5/8] fix: stop treating F6 as a modifier key

Usage 0x3F was meant to be Fn, but 0x3F is Fn only as a Carbon virtual
keycode. On the HID keyboard page it is F6, so a lone F6 press never
triggered a switch. The real Fn/Globe key arrives on Apple's vendor page
and is already filtered out before the modifier check.
---
 InputPilot/Services/HIDKeyboardMonitor.swift  | 13 +++++-------
 InputPilotTests/HIDKeyboardMonitorTests.swift | 21 +++++++++++++++++++
 2 files changed, 26 insertions(+), 8 deletions(-)
 create mode 100644 InputPilotTests/HIDKeyboardMonitorTests.swift

diff --git a/InputPilot/Services/HIDKeyboardMonitor.swift b/InputPilot/Services/HIDKeyboardMonitor.swift
index 85f19b6..e7a6b74 100644
--- a/InputPilot/Services/HIDKeyboardMonitor.swift
+++ b/InputPilot/Services/HIDKeyboardMonitor.swift
@@ -108,7 +108,7 @@ final class HIDKeyboardMonitor: HIDKeyboardMonitoring {
         let usage = IOHIDElementGetUsage(element)
 
         let device = IOHIDElementGetDevice(element)
-        onEvent?(makeActiveDevice(from: device), .keyDown(isModifier: isModifierUsage(usage)))
+        onEvent?(makeActiveDevice(from: device), .keyDown(isModifier: Self.isModifierUsage(usage)))
     }
 
     private func handleDeviceRemoval(_ device: IOHIDDevice) {
@@ -160,15 +160,12 @@ final class HIDKeyboardMonitor: HIDKeyboardMonitoring {
             || normalizedTransport == "ps2"
     }
 
-    private func isModifierUsage(_ usage: UInt32) -> Bool {
+    static func isModifierUsage(_ usage: UInt32) -> Bool {
         let leftControl = UInt32(kHIDUsage_KeyboardLeftControl)
         let rightGUI = UInt32(kHIDUsage_KeyboardRightGUI)
-        if (leftControl...rightGUI).contains(usage) {
-            return true
-        }
-
-        // Fn is not consistently exposed; 0x3F is commonly used when present.
-        return usage == 0x3F
+        // 0x3F on this page is F6, not Fn: Fn/Globe arrives on Apple's vendor
+        // page and is already filtered out before this is called.
+        return (leftControl...rightGUI).contains(usage)
     }
 
     private static let inputValueCallback: IOHIDValueCallback = { context, _, _, value in
diff --git a/InputPilotTests/HIDKeyboardMonitorTests.swift b/InputPilotTests/HIDKeyboardMonitorTests.swift
new file mode 100644
index 0000000..10d4b7f
--- /dev/null
+++ b/InputPilotTests/HIDKeyboardMonitorTests.swift
@@ -0,0 +1,21 @@
+import IOKit.hid
+import Testing
+@testable import InputPilot
+
+struct HIDKeyboardMonitorTests {
+    @Test(arguments: Array(UInt32(kHIDUsage_KeyboardLeftControl)...UInt32(kHIDUsage_KeyboardRightGUI)))
+    func modifierUsagesAreModifiers(usage: UInt32) {
+        #expect(HIDKeyboardMonitor.isModifierUsage(usage))
+    }
+
+    // 0x3F is F6 on the keyboard usage page. Fn/Globe never arrives on that
+    // page (it uses Apple's vendor page), so it needs no entry here.
+    @Test(arguments: [
+        UInt32(kHIDUsage_KeyboardF6),
+        UInt32(kHIDUsage_KeyboardA),
+        UInt32(kHIDUsage_KeyboardTab)
+    ])
+    func regularKeysAreNotModifiers(usage: UInt32) {
+        #expect(!HIDKeyboardMonitor.isModifierUsage(usage))
+    }
+}

From 5058f03b5f06e7d98053afb8442a96484b3f1688 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:23:22 +0200
Subject: [PATCH 6/8] fix: tighten the remaining shortcut, storage and network
 wording

- README and the Settings footer still implied Cmd-Tab is ignored; say
  that only a lone modifier is, and include Control.
- Only keyboards with a mapping or fallback are stored, not every
  keyboard you have used.
- Network traffic also includes downloading an update you accept.
- The layout switches about 0.4 s after typing starts on the other
  keyboard, so the first characters can still land in the old layout.
- Sparkle verifies a valid code signature; do not claim a team check.
- Phrase the macOS 13 and fallback points as InputPilot features rather
  than as gaps in Keychange.
- Drop a link to a page that is not published yet.
---
 InputPilot/App/AppState.swift    |  2 +-
 InputPilot/UI/SettingsView.swift |  2 +-
 InputPilot/UI/WelcomeView.swift  |  2 +-
 README.md                        |  4 ++--
 SECURITY.md                      |  6 +++---
 docs/index.html                  | 10 +++++-----
 docs/pre-release-audit.md        |  2 +-
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/InputPilot/App/AppState.swift b/InputPilot/App/AppState.swift
index bd191bd..5e2ec7b 100644
--- a/InputPilot/App/AppState.swift
+++ b/InputPilot/App/AppState.swift
@@ -740,7 +740,7 @@ final class AppState: ObservableObject {
             )
         }
 
-        // A lone modifier press (Cmd+Tab, shortcut chords) still updates the
+        // A lone modifier press (e.g. the Cmd before a shortcut) still updates the
         // active-device display above, but only triggers a switch when the user
         // opted in. Settings-driven re-evaluations use .deviceStabilized and
         // are never gated here.
diff --git a/InputPilot/UI/SettingsView.swift b/InputPilot/UI/SettingsView.swift
index 0d6c492..ee609bb 100644
--- a/InputPilot/UI/SettingsView.swift
+++ b/InputPilot/UI/SettingsView.swift
@@ -35,7 +35,7 @@ struct SettingsView: View {
             } header: {
                 Text("Auto-Switch")
             } footer: {
-                Text("When \"Switch on modifier-only key presses\" is off, a lone Shift, Command, or Option press (for example during Cmd+Tab) does not change the input source — only regular typing does.")
+                Text("When \"Switch on modifier-only key presses\" is off, a lone Shift, Control, Option, or Command press does not change the input source. Any other key, including the Tab in Cmd+Tab, counts as typing on that keyboard.")
             }
 
             Section("Input Monitoring") {
diff --git a/InputPilot/UI/WelcomeView.swift b/InputPilot/UI/WelcomeView.swift
index f0d3581..979b1e6 100644
--- a/InputPilot/UI/WelcomeView.swift
+++ b/InputPilot/UI/WelcomeView.swift
@@ -32,7 +32,7 @@ struct WelcomeView: View {
 				.fixedSize(horizontal: false, vertical: true)
 
 				Label {
-					Text("InputPilot only uses key presses to tell **which keyboard** you are typing on — it never records what you type. Nothing you type leaves your Mac; the only network request is a daily update check.")
+					Text("InputPilot only uses key presses to tell **which keyboard** you are typing on — it never records what you type. Nothing you type leaves your Mac; the only network traffic is a daily update check and any update you choose to install.")
 				} icon: {
 					Image(systemName: "hand.raised")
 				}
diff --git a/README.md b/README.md
index 41eac66..1a46e3b 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ The app is signed with a Developer ID certificate and notarized by Apple, so it
 
 To tell your keyboards apart, InputPilot has to see that *a* key was pressed and on *which* device. macOS puts that behind the Input Monitoring permission.
 
-It never records what you type. The HID callback keeps exactly two things — the device that sent the event, and whether the key was a modifier. The key's usage code is read only to compute that second value and is then discarded: it is never stored, logged or transmitted, and no character or text is derived from it. Nothing you type is sent off your Mac: the only network traffic is Sparkle's update check (automatically once a day, or when you choose Check for Updates), and Sparkle is the only third-party dependency.
+It never records what you type. The HID callback keeps exactly two things — the device that sent the event, and whether the key was a modifier. The key's usage code is read only to compute that second value and is then discarded: it is never stored, logged or transmitted, and no character or text is derived from it. Nothing you type is sent off your Mac: the only network traffic is Sparkle's update check (automatically once a day, or when you choose Check for Updates) and the download of any update you accept. Sparkle is the only third-party dependency.
 
 See [SECURITY.md](SECURITY.md) for the full privacy statement and how to report a vulnerability.
 
@@ -49,7 +49,7 @@ See [SECURITY.md](SECURITY.md) for the full privacy statement and how to report
 - **Pause** — silence auto-switching for 15 or 60 minutes when it would get in the way.
 - **Conflict detection** — spots mappings that point at an input source you have since removed or disabled, and offers to fix them.
 - **Stable device identity** — keyboards are matched on vendor, product, transport and name, so unplugging and replugging (or moving to another USB port) keeps your mapping.
-- **No flapping** — a 400 ms debounce and a 1.5 s cooldown stop rapid switching, and modifier-only presses (a lone ⇧ or ⌘ during ⌘-Tab) are ignored by default.
+- **No flapping** — a 400 ms debounce and a 1.5 s cooldown stop rapid switching, and a lone modifier press (⇧, ⌘, ⌥ or ⌃ on its own) is ignored by default. Any other key — including the Tab in ⌘-Tab — counts as typing on that keyboard.
 - **Debug log** — an in-app log window you can copy or export when reporting a bug. It contains device and status information only, never typed text.
 
 ## How it works
diff --git a/SECURITY.md b/SECURITY.md
index b149ad9..9223401 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -15,20 +15,20 @@ Nothing else leaves that callback. The key's usage code is read inside it, solel
 
 Settings and keyboard mappings live in `UserDefaults` (`com.lucagerlich.InputPilot`):
 
-- for each keyboard you have used: its identifiers (vendor ID, product ID, transport, product name, location) and the input source mapped to it
+- for each keyboard you have mapped or given a fallback: its identifiers (vendor ID, product ID, transport, product name, location) and the input source mapped to it
 - your fallbacks, the auto-switch and modifier-only settings, and the pause timestamp
 - a schema migration flag
 - only if stored mappings ever fail to decode: a `.corrupted` backup of that data, so it is not lost
 
 Sparkle keeps its own bookkeeping in the same place: when it last checked for updates, whether the app has launched before, and a random number it uses for staged rollouts. No key or typing data is stored anywhere.
 
-The debug log is an in-memory ring buffer of at most 200 entries, holding device identifiers, permission state, input source names, and errors. It is never written to disk unless you explicitly export it, and only reaches the clipboard if you copy it. As each entry is recorded, a filter replaces the words `keycode`, `typedtext`, `characters`, `appcontents` and `keystroke` with `[redacted]`. That filter is a tripwire, not the guarantee — the guarantee is that no code path sends key data to the log in the first place.
+The debug log is an in-memory ring buffer of at most 200 entries, holding device identifiers, permission state, input source names, and errors. It is never written to disk unless you explicitly export it, and only reaches the clipboard if you copy it. As each entry is recorded, a filter replaces any occurrence of `keycode`, `typedtext`, `characters`, `appcontents` and `keystroke` with `[redacted]`. That filter is a tripwire, not the guarantee — the guarantee is that no code path sends key data to the log in the first place.
 
 ## What leaves your Mac
 
 Update checks against the appcast at `raw.githubusercontent.com` — automatically about once a day, and whenever you choose Check for Updates — and the download itself when you accept an update. Each check is an ordinary HTTPS request, so GitHub sees your IP address and a user agent naming the app and Sparkle versions. Nothing else is sent. There is no telemetry, no analytics, and no crash reporter.
 
-Sparkle verifies every update before installing it: an EdDSA signature over the downloaded archive, checked against the public key built into the app, and a code-signature check that the new app is signed by the same Developer ID team. Each release is also notarized by Apple.
+Sparkle verifies every update before installing it: an EdDSA signature over the downloaded archive, checked against the public key built into the app, and a check that the new app carries a valid code signature. Each release is also notarized by Apple.
 
 ## Supply chain
 
diff --git a/docs/index.html b/docs/index.html
index 2fc6243..258d88e 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -288,7 +288,7 @@
      "name": "I use a German external keyboard with a US MacBook. Does this fix it?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on, switching within half a second of the first key press — no shortcut, no menu, nothing to remember."
+      "text": "That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on. It switches about 0.4 seconds after you start typing on the other keyboard, so the first character or two can still land in the old layout — but there is no shortcut, no menu, nothing to remember."
      }
     },
     {
@@ -296,7 +296,7 @@
      "name": "How is this different from Keychange, autokbisw, OctoKeys or Input Source Pro?",
      "acceptedAnswer": {
       "@type": "Answer",
-      "text": "Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. It also runs on macOS 13 and has fallback layouts for keyboards you have not mapped yet."
+      "text": "Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. InputPilot runs on macOS 13 as well, and lets you set fallback layouts for keyboards you have not mapped yet."
      }
     },
     {
@@ -507,7 +507,7 @@ <h2>About that permission</h2>
 		<ul class="checks">
 			<li>The HID callback takes two things from each event: <b>the device that sent it</b>, and <b>whether the key was a modifier</b>. Nothing else.</li>
 			<li>The key's usage code is read only to decide whether it was a modifier, then discarded. It is never stored, logged or transmitted, and no character or text is ever derived from it.</li>
-			<li>The only network traffic is Sparkle's update check — automatically once a day, and when you ask. <b>No telemetry, no analytics, no crash reporter.</b></li>
+			<li>The only network traffic is Sparkle's update check — automatically once a day, and when you ask — and the download of any update you accept. <b>No telemetry, no analytics, no crash reporter.</b></li>
 			<li>The source is public: about 3,200 lines of Swift, plus Sparkle, the open-source updater it ships with. The keyboard handling is 15 lines and reads in a minute.</li>
 		</ul>
 		<p style="margin:1.1rem 0 0"><a href="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/LucaGerlich/InputPilot/blob/main/SECURITY.md">Full privacy statement →</a></p>
@@ -526,9 +526,9 @@ <h2>Questions</h2>
 	<details><summary>Does it work with Bluetooth keyboards?</summary>
 		<p>Yes. Keyboards are identified by vendor, product, transport and name, so a Bluetooth keyboard is recognised again after reconnecting.</p></details>
 	<details><summary>I use a German external keyboard with a US MacBook. Does this fix it?</summary>
-		<p>That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on, switching within half a second of the first key press — no shortcut, no menu, nothing to remember.</p></details>
+		<p>That is the case it was written for. Map the external board to German and the built-in one to U.S. once. From then on the layout follows whichever one you type on. It switches about 0.4 seconds after you start typing on the other keyboard, so the first character or two can still land in the old layout — but there is no shortcut, no menu, nothing to remember.</p></details>
 	<details><summary>How is this different from Keychange, autokbisw, OctoKeys or Input Source Pro?</summary>
-		<p>Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. It also runs on macOS 13 and has fallback layouts for keyboards you have not mapped yet.</p></details>
+		<p>Keychange is the closest match: also free, open source and per keyboard, with layouts you assign explicitly. It needs macOS 14 and can optionally switch before the key press reaches the app, using the Accessibility permission. Input Source Pro and similar tools switch per app or per window. autokbisw switches per keyboard from the command line, with no interface. OctoKeys switches per keyboard on the App Store by remembering the last source you used with each one. Unlike autokbisw and OctoKeys, InputPilot uses the input source you assign rather than the one you used last; like Keychange, it is free and open source, so you can audit what it does with the permission. InputPilot runs on macOS 13 as well, and lets you set fallback layouts for keyboards you have not mapped yet.</p></details>
 	<details><summary>What does it cost?</summary>
 		<p>Nothing. Free and open source under the Apache 2.0 licence.</p></details>
 	</div>
diff --git a/docs/pre-release-audit.md b/docs/pre-release-audit.md
index 7992335..cd8c9d4 100644
--- a/docs/pre-release-audit.md
+++ b/docs/pre-release-audit.md
@@ -5,7 +5,7 @@
 Audited: 2026-08-18 · Scope: full repo · Method: 4 specialized reviews (correctness/concurrency, security/privacy, distribution, tests) + empirical verification
 Verification baseline at audit time: **build ✓ · all 30 tests pass ✓ · no third-party dependencies · security review clean (no keystroke logging, no network calls)**
 
-Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pass; Sparkle 2.9.6 was added deliberately as the update mechanism (finding H3) — its update checks are now the app's only network activity. *(Correction, 2026-10-11: those checks are automatic, about once a day, as well as user-initiated — see [post-launch-audit.md](post-launch-audit.md).)* Finding texts below are preserved as written at audit time; checkboxes track resolution.
+Post-hardening status (2026-08-18, branch `release-hardening`): 33 unit tests pass; Sparkle 2.9.6 was added deliberately as the update mechanism (finding H3) — its update checks are now the app's only network activity. *(Correction, 2026-10-11: those checks are automatic, about once a day, as well as user-initiated.)* Finding texts below are preserved as written at audit time; checkboxes track resolution.
 
 ## Summary
 

From b707f3af91fdae8455739a4f0ae12cfd154d8801 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:23:22 +0200
Subject: [PATCH 7/8] test: a changed monitor failure is still logged

Deduplicating repeated failures must not swallow a different one.
---
 InputPilotTests/AppStateFailurePathTests.swift | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/InputPilotTests/AppStateFailurePathTests.swift b/InputPilotTests/AppStateFailurePathTests.swift
index 24b48ee..13acd51 100644
--- a/InputPilotTests/AppStateFailurePathTests.swift
+++ b/InputPilotTests/AppStateFailurePathTests.swift
@@ -144,9 +144,21 @@ struct AppStateFailurePathTests {
             keyboardMonitor.startCallCount >= 5
         }
 
-        let monitorErrors = appState.debugLogEntries.filter { $0.category == "hid-monitor" && $0.level == .error }
+        func monitorErrors() -> [LogEntry] {
+            appState.debugLogEntries.filter { $0.category == "hid-monitor" && $0.level == .error }
+        }
         #expect(keyboardMonitor.startCallCount >= 5)
-        #expect(monitorErrors.count == 1)
+        #expect(monitorErrors().count == 1)
+
+        // A different failure is new information and must still be logged.
+        keyboardMonitor.lastStartErrorMessage = "HID monitor start failed with IOReturn -536870203."
+        await waitFor {
+            monitorErrors().count == 2
+        }
+        #expect(monitorErrors().map(\.message) == [
+            "No matching keyboard HID device available.",
+            "HID monitor start failed with IOReturn -536870203."
+        ])
     }
 
     @Test

From 34ec52f5e89eb73fd7d5f9f22fc176d354e42eb9 Mon Sep 17 00:00:00 2001
From: LucaGerlich <lucagerlich@gmail.com>
Date: Sun, 11 Oct 2026 02:23:22 +0200
Subject: [PATCH 8/8] docs: add an Unreleased changelog entry

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b82159..a111fdb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to InputPilot are documented here. This project follows [Semantic Versioning](https://semver.org).
 
+## [Unreleased]
+
+### Fixed
+
+- A lone F6 press was treated as a modifier key and never triggered a switch. HID usage 0x3F is F6; it had been mistaken for Fn.
+- While the keyboard monitor could not start, the same error was added to the debug log every second until it crowded out everything else. Each distinct failure is now logged once.
+- Public claims made precisely true: the app reads a key's usage code only to detect modifiers; update checks run automatically once a day; and the Tab in ⌘-Tab counts as typing.
+
 ## [1.0.1] — 2026-08-18
 
 ### Fixed