docs: align documentation with actual behavior (TASK-008)

[osmcgrgenc]

TASK-008 (audit P1-8). Docs only: no Swift, script, workflow or Package.swift changes. Every claim below was checked against Sources/ and Tests/ on main (9770154).

Removed or corrected claims

README.md

• Safety notice: "A fixed, signed release is in progress" → "v2.1.0–v3.0.0 contain known safety defects; use v3.1.0 or later" (v3.1.0 = first signed and notarized release, in preparation).
• "Download the notarized MacOptimizer.dmg" → signed and notarized DMGs start with v3.1.0; earlier releases were not notarized.
• Badges "Tests: 36 Suites | 200+ Passed", "Security: Zero-Harm Engine" and "Apple Silicon | Intel" removed (the release DMG is built on one runner architecture). License, macOS and Swift badges kept.
• "36 suites / 200+ assertions" → 87 XCTest test methods (grep -c "func test"), hermetic, run in full by CI.
• "7/24 Autonomous Watchdog … with auto-healing" → runs while the app runs (also with the window closed), only raises alerts, never terminates anything.
• "Encrypted SQLite WAL Audit Trail" in the diagram → removed; the real pipeline (plan → preview → confirmation → SafeOperationExecutor → Trash) is described instead, plus the unencrypted SQLite telemetry store and the UserDefaults history.
• CLI purge-ram and "memory optimization" → removed (RAM purge was removed in fix: report real results, remove placebo claims #5); clean --execute → clean --execute --yes, --include-trash documented.
• "Multi-Provider AI: Ollama / OpenAI-compatible" → local heuristics by default, NVIDIA NIM optional with disclosure, app names only with a separate opt-in.
• "Microsecond" telemetry/parser and "Liquid Glass" marketing → plain descriptions.
• Benchmarks section (0.04 ms, < 0.02 ms, 0.42 s, 1.2 GB/s, ~0.01 %) → removed.
• "Audits … TCC permissions" → SIP, Gatekeeper, firewall and Accessibility permission only.
• "Sandboxed command execution (dscacheutil, killall, …)" → accurate allow-list; no shell anywhere.
• Added: English/Turkish follows the system language; CLI English only.

ARCHITECTURE.md

• "Clean, layered, unidirectional data flow" → the real structure (AppState, LiveMetricsStore, MonitoringCoordinator, services, ProcessExecutor).
• AI platform with Ollama/OpenAI providers → LocalHeuristicProvider + NvidiaNIMProvider only.
• "AI actions pass through SafetyPolicyEngine" → AI actions open the normal screen or ask for confirmation; cleaning goes through the plan preview.
• Added the real deletion pipeline, command runners, persistence (no audit log), networking, build/release state and known limitations.

SECURITY.md

• Repository URL osmancagrigenc/MacOsOptimizer → Codifya/MacOptimizer; the broken private-advisory link removed (private vulnerability reporting is not enabled on the repo).
• "No arbitrary shell string execution" was false for ≤ 3.0.0 → now true and stated with the fix; supported-versions table added.
• "Encrypted/WAL Audit Log" / "Strict audit logging" (Repudiation) → there is no audit log.
• "Non-cache items are moved to the Trash" → Trash by default; permanent removal only inside approved cache folders; Trash emptying is separate and confirmed.
• "Safe memory clamped limits (64–256 MB)" (DoS row) → removed (RAM purge is gone).
• "System prompts only include anonymous hardware counters" → points to PRIVACY.md for the exact payload.
• "Whitelisted binaries: dscacheutil, killall, mdutil, qlmanage" → the full 11-entry allow-list plus the no-shell SystemCommandRunner (ps, kill, brew).
• Process protection: now states that the dashboard's quit button sends a normal quit without a prompt; force quit and AI suggestions ask first.

PRIVACY.md (verified; small updates)

• Turkish setting label → English "Include running app names".
• Added: number of apps with pending updates is sent to NIM; local storage (SQLite path, 48 h, not encrypted; UserDefaults history); "custom OpenAI endpoint tokens" removed.

ROADMAP.md

• v2.0/v2.1 "completed" items (7/24 watchdog, multi-provider AI, "23+ suites / 120+ assertions", Liquid Glass) → a short honest history and a v3.1.0 checklist of merged fixes; signing/notarization and one version source listed as remaining.

CHANGELOG.md

• New ## [3.1.0] - Unreleased entry summarising perf: harden monitoring, process execution, scanners and memory bounds #1–feat(l10n): localize app state, English cloud context, fix Turkish percent #19 and the release pipeline in progress (marked not merged).
• 2.1.0: "23 test suites with 120+ assertions" → 23 test methods; Ollama/OpenAI providers noted as never wired in; shell runner and empty telemetry store noted.
• 2.0.0 (never tagged, no commit) folded into 2.1.0; "7/24" and "safe RAM release" corrected.
• Added a 2.2.0–3.0.0 note (released without entries, unsafe).

BENCHMARKS.md

• All unverified numbers and the fictional test environment (M3 Pro, Swift 5.10) removed; points to the labelled measurements in docs/PERFORMANCE_* and explains how to measure.

CONTRIBUTING.md

• Clone URL → Codifya/MacOptimizer; "Swift 5.9+ / Xcode 15" → Swift 6 / Xcode 16+ (swift-tools 6.0); "property-based safety tests" → hermetic tests with the CI host canary; guidelines now match the real safety APIs, no-shell rule and localization.

docs/

• PERFORMANCE_REPORT.md: status note; resolved remaining risks (macOS build, CPU placeholder, RAM purge, benchmark numbers); CI runner macos-14 → macos-15/Xcode 16.4.
• PERFORMANCE_BASELINE.md: marked as a historical v3.0.0 snapshot.
• LOCALIZATION.md: states system-language behaviour and English-only CLI.

MASTER_IMPLEMENTATION_PROMPT.md

• Kept; one-line note at the top that it is the historical generation prompt, not a description of current behaviour.

Test plan

• swift build succeeds (docs-only change)
• All relative Markdown links resolve to existing files
• Test count verified: 87 (MacOptimizerTests 54, PerformanceHardeningTests 29, LocalizationTests 4)
• CI green

🤖 Generated with Claude Code