goldwav · goldwav · Aug 5, 2026
diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml
@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
 
@@ -64,7 +64,7 @@ jobs:
           Write-Host "Verified $($app.FullName)"
 
       - name: Upload unsigned SDK build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: TheNotepad-dotnet10-unsigned-${{ github.sha }}
           path: native/src/App/bin/Release/
@@ -78,7 +78,7 @@ jobs:
 
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run inbox-compiler compatibility check
         shell: pwsh
@@ -108,7 +108,7 @@ jobs:
           }
 
       - name: Upload verified unsigned portable build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: TheNotepad-portable-unsigned-${{ github.sha }}
           path: native/artifacts/release/${{ env.RELEASE_VERSION }}/

diff --git a/README.md b/README.md
@@ -1,61 +1,150 @@
-# The Notepad
+<h1 align="center">The Notepad</h1>
 
-The Notepad is a free, open-source Windows text editor that keeps the speed of
-classic Notepad while adding dependable tabs, a calm note navigator, and
-desktop sticky notes.
+<p align="center">
+  <strong>A dependable Windows text editor with tabs, recovery, and desktop stickies.</strong>
+</p>
 
-The repository currently contains an **alpha-quality native Windows build**.
-It is useful for contributor testing, but it is not yet a signed or
-Store-certified public release.
+<p align="center">
+  <a href="https://github.com/goldwav/The-Notepad/actions/workflows/windows-ci.yml">
+    <img src="https://github.com/goldwav/The-Notepad/actions/workflows/windows-ci.yml/badge.svg?branch=main" alt="Windows CI">
+  </a>
+  <img src="https://img.shields.io/badge/platform-Windows-0078D4?logo=windows11&logoColor=white" alt="Windows">
+  <img src="https://img.shields.io/badge/.NET-10-512BD4?logo=dotnet&logoColor=white" alt=".NET 10">
+  <a href="LICENSE">
+    <img src="https://img.shields.io/badge/license-MPL--2.0-blue" alt="MPL 2.0 license">
+  </a>
+</p>
 
-## What the alpha implements
+![The Notepad showing its Stickies navigator and tabbed full editor](docs/media/the-notepad-overview.png)
 
-- ordinary plain-text files: create, multi-select open, edit, save, and Save As;
-- keyboard-accessible tabs, recently closed tabs, and separate Notes and
-  Stickies views;
-- UTF-8, UTF-8 BOM, UTF-16 LE/BE, and CRLF/LF/CR preservation;
-- clear dirty state, external-change protection, and atomic file writes;
-- find, replace, go to line, undo/redo, word wrap, zoom, and printing;
-- automatic local recovery for open and unsaved work;
-- desktop sticky windows that share the editor's live note model;
-- sticky move, resize, hide/show, Keep on top, and visible-monitor recovery;
-- double-clicking a sticky header to reopen it in the full editor;
-- single-instance activation, a notification-area control, close-to-tray
-  behavior, and an optional per-user **Start with Windows** setting;
-- no account, ads, telemetry, or required network connection.
+The Notepad keeps plain-text editing direct while adding the safeguards and
+organization expected from a modern desktop application. Open ordinary text
+files, work across tabs, recover unsaved notes, and keep selected notes visible
+as independent desktop stickies.
 
-The current release gates are documented below rather than hidden behind a
-"ready" label: the packages are unsigned, Store identity is still a
-placeholder, and clean-machine, performance, Narrator, scaling, IME, and
-multi-monitor certification remain to be completed.
+A sticky window and its full-editor tab share the same note model. Changes stay
+synchronized, and double-clicking the sticky header returns that note to the
+editor without creating a copy.
 
-## Build and test
+## Highlights
 
-The primary solution targets .NET 10 on Windows:
+- **Plain-text fidelity** — opens and preserves UTF-8, UTF-8 BOM, UTF-16 LE/BE,
+  and CRLF/LF/CR line endings.
+- **Safer file editing** — atomic writes, visible dirty state, and external-file
+  change detection reduce accidental data loss.
+- **Automatic recovery** — open and unsaved work is restored locally, with
+  corrupt-state fallback rather than a blocked startup.
+- **Desktop stickies** — move, resize, pin, hide, restore, and reopen stickies
+  in the full editor.
+- **Native Windows behavior** — single-instance activation, notification-area
+  controls, close-to-tray behavior, printing, and optional per-user startup.
+- **Private by design** — no account, ads, analytics, telemetry, cloud service,
+  or network-client integration in the native editing path.
+
+## Sticky to editor
+
+![A desktop sticky being reopened in the full editor](docs/media/sticky-to-editor.gif)
+
+Create a sticky with `Ctrl+Shift+N`. Edit it from either surface, then
+double-click its header to continue in the full editor. Regular notes and
+stickies remain separated in their respective navigator views.
+
+## Try it
+
+> [!IMPORTANT]
+> The Notepad is currently an alpha engineering preview. No signed, versioned
+> release download is offered yet. Existing package outputs are unsigned; code signing,
+> clean-machine lifecycle testing, accessibility review, and broader release
+> certification remain open gates.
+
+To run the current application from source, use Windows with the .NET 10 SDK:
 
 ```powershell
-dotnet restore .\TheNotepad.sln
-dotnet build .\TheNotepad.sln -c Release --no-restore
-dotnet run --project .\native\tests\TheNotepad.Tests.csproj -c Release --no-build
+git clone https://github.com/goldwav/The-Notepad.git
+cd The-Notepad
+dotnet restore .\TheNotepad.sln --configfile .\NuGet.Config
+dotnet run --project .\native\src\App\TheNotepad.Desktop.csproj
 ```
 
-`.\native\build.ps1` remains as a package-free compatibility check using the
-Windows inbox C# compiler and WPF assemblies. CI runs both paths.
+Useful shortcuts:
+
+| Action | Shortcut |
+|---|---|
+| New regular note | `Ctrl+N` |
+| New desktop sticky | `Ctrl+Shift+N` |
+| Open text files | `Ctrl+O` |
+| Save / Save As | `Ctrl+S` / `Ctrl+Shift+S` |
+| Reopen closed tab | `Ctrl+Shift+T` |
+| Find / Replace / Go to line | `Ctrl+F` / `Ctrl+H` / `Ctrl+G` |
+| Move between major UI regions | `F6` |
+
+## Engineering highlights
+
+| Area | Implementation |
+|---|---|
+| Document engine | UI-independent model for text decoding, line-ending preservation, fingerprints, and safe writes |
+| Recovery | Local session snapshots for open tabs, unsaved content, sticky state, and window placement |
+| Shared note model | Editor tabs and sticky windows observe the same document state |
+| Desktop lifecycle | Single-instance handoff, tray lifecycle, startup registration, and visible-monitor placement recovery |
+| Verification | 21 document and recovery tests exercised through both the .NET 10 and compatibility build paths |
+| Release integrity | Portable packaging creates a ZIP, SHA-256 checksums, and a machine-verifiable release manifest |
+
+## Architecture
+
+The application separates document safety from Windows presentation so the
+most important behavior can be tested without constructing the WPF interface.
+
+| Component | Responsibility |
+|---|---|
+| [`native/src/Core`](native/src/Core) | Documents, encoding, atomic writes, recovery, recent files, and placement correction |
+| [`native/src/App`](native/src/App) | WPF editor shell, tabs, sticky windows, tray behavior, activation, and startup option |
+| [`native/tests`](native/tests) | Dependency-free document and recovery test harness |
+| [`native/benchmarks`](native/benchmarks) | Isolated 1 MiB, 10 MiB, and 100 MiB file-open measurements |
+| [`scripts`](scripts) | Portable/MSIX staging and release-integrity verification |
+
+The rationale for WPF on .NET 10, including its tradeoffs and the criteria for
+reconsidering WinUI 3, is recorded in
+[ADR 0001](docs/adr/0001-modern-wpf-for-v0.1.md).
+
+## Current evidence and release boundary
+
+| Surface | Verified now | Still pending |
+|---|---|---|
+| Build and tests | Windows CI builds the .NET 10 solution and compatibility path; 21 tests pass | Broader App/UI automation and coverage reporting |
+| Packaged workflows | Notes/Stickies separation, sticky-to-editor reopening, Save As, tray lifecycle, and single-instance reopening were manually smoke-tested in packaged builds | Full editor, multi-monitor, DPI, IME, and failure-injection matrix |
+| Artifact integrity | Portable ZIP, manifest, checksum generation, and independent verification are implemented | Signed executable, final installer identity, and durable public release |
+| Privacy | Source inspection found no account, advertising, analytics, telemetry, or native networking integration | Recorded runtime network-capture evidence |
+| Accessibility | Keyboard shortcuts and region navigation are implemented | Narrator, high contrast, focus, and 200% scaling certification |
+
+The complete, deliberately candid gate list is in
+[`docs/release-checklist.md`](docs/release-checklist.md). Performance methodology
+and its limits are documented in
+[`docs/performance-benchmarks.md`](docs/performance-benchmarks.md).
+
+## Build and verify
+
+```powershell
+dotnet restore .\TheNotepad.sln --configfile .\NuGet.Config
+dotnet build .\TheNotepad.sln --configuration Release --no-restore
+dotnet run --project .\native\tests\TheNotepad.Tests.csproj `
+  --configuration Release --no-build --no-restore
+.\native\build.ps1
+```
 
-Contributor run, packaging, and verification commands are in
-[`native/README.md`](native/README.md) and
+CI runs the SDK and package-free compatibility paths separately. Packaging and
+verification commands are documented in
 [`native/packaging/README.md`](native/packaging/README.md).
 
-## Project layout
+## Contributing
 
-- `native/` — the Windows application, document engine, tests, and packaging
-  templates;
-- `scripts/` — portable/MSIX staging and release-verification scripts;
-- `docs/` — architecture decisions, performance guidance, and release gates.
+The project is free and open source. Start with
+[`CONTRIBUTING.md`](CONTRIBUTING.md), review the longer direction in
+[`PRODUCT_PLAN.md`](PRODUCT_PLAN.md), and use the repository issue forms for
+bugs or feature proposals.
 
-The longer product direction remains in [`PRODUCT_PLAN.md`](PRODUCT_PLAN.md).
+Security reports should follow [`SECURITY.md`](SECURITY.md).
 
 ## License
 
-The Notepad is licensed under the
+The Notepad is available under the
 [Mozilla Public License 2.0](LICENSE).
diff --git a/docs/media/sticky-to-editor.gif b/docs/media/sticky-to-editor.gif
diff --git a/docs/media/the-notepad-overview.png b/docs/media/the-notepad-overview.png