README, docs and site: one story (the whole job, no avoidable rejections, the desktop app, your AI, install)

README is a short front page (about 120 lines) with one real visual per section; every former section moved
unchanged into docs/*.md with a docs/README.md index (journey, rejections, getting-started, commands, growth,
studios, store-art, listing-languages, api, skills, mcp, safety, faq, project). The site tells the same story on one
page: the teaser in the hero, real CLI output as text, the desktop app as a section with light/dark captures of eight
screens and the per-system downloads (desktop/latest.json); /desktop/ redirects to /#download. New capture tools:
tools/site-desktop-shots.ts (fixture-mode desktop frames) and tools/site-term-shots.ts (real CLI output as text and
WebP). tests/docs-links.test.ts checks README, docs and site links resolve.

docs/mcp.md

@@ -0,0 +1,47 @@
+# MCP server and the desktop machine interface
+
+`storebound mcp` speaks MCP over stdio, tools only: spec revision **2026-07-28** (stateless: `server/discover`,
+per-request `_meta`, `resultType`, cacheable `tools/list`) and, on the same process, clients that still open with
+`initialize` (2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05). It runs each tool as a CLI call in the project directory
+(the server's working directory, or `STOREBOUND_PROJECT`) and returns the output.
+
+- One tool per command. Read-only: `scan`, `check`, `check_aso`, `aso_competitors` (no snapshot saved), `aso_suggest` (never writes), `aso_audit`, `validate`, `catalog_diff`, `health`, `reviews_list`, `prices_diff`,
+  `analytics_compare`, `apple_status`, `apple_next_build`, `apple_testflight_status`, `apple_ppo_status`,
+  `play_status`, `play_next_version_code`, `privacy_manifest`, `shots_check`, `workspace_list`, `workspace_status`,
+  `release_status`, `release_plan`, `flow_list`, `flow_run` (dry mode only), `listing_check`, `api_get` (any App Store
+  Connect or Google Play GET operation by id). Local writes: `import_fastlane`, `whats_new`, `listing_translate`, `icons`,
+  `health_report`, `reviews_draft`, `prices_export`, `analytics_snapshot`, `shots_capture`, `shots_render`,
+  `shots_gallery`, `shots_record`, `shots_video`. Store writes: `play_listing`, `play_images`, `play_products`,
+  `play_data_safety`, `play_subscriptions`, `play_release_testing`, `apple_bundle`, `apple_iap`, `apple_iap_review`,
+  `apple_subscriptions`, `apple_listing`,
+  `apple_screenshots`, `apple_previews`, `apple_appinfo`, `apple_review_details`, `apple_encryption`,
+  `apple_phased_release`, `apple_testflight_groups`, `apple_testflight_what_to_test`, `apple_testflight_info`,
+  `apple_testflight_distribute` (internal groups only), `apple_ppo_create`, `apple_ppo_upload`, `analytics_setup`.
+- Annotations say what is read-only, destructive (replaces data), idempotent and network-bound.
+- No MCP SDK: a small newline-delimited JSON-RPC server (server/discover, initialize, ping, tools/list, tools/call,
+  cancellation), so storebound keeps zero runtime dependencies.
+
+Manual config for a tool that `install` does not know: command `bunx` with args `["storebound", "mcp"]` (or the
+absolute path of `bin/storebound` plus `mcp`).
+
+## Desktop machine interface
+
+`storebound serve --stdio` is what the desktop app (`apps/desktop`, in progress) runs as its sidecar: newline-delimited
+JSON-RPC on the same core as the MCP server (tool list, validation, forbidden flags, child-process runner), with typed
+methods (`check`, `validate`, `apple.status`, `play.listing`, ... plus `project.inspect` and `portfolio.status` over
+many project folders), structured results (the commands' `--json` output), progress notifications and cancellation.
+The first request is `session.hello` with a per-session secret only the host knows. Write methods are dry runs unless
+the call carries a single-use confirm token (HMAC over method, arguments and expiry) that the host mints after the
+owner confirmed a native dialog showing that dry run. Sending for review is there only as **owner actions**
+(`owner.apple_submit`, `owner.apple_resubmit`, `owner.apple_iap_submit`, `owner.play_production`, next to the rollout,
+phased release, price and reply owner actions): the window shows the plan (dry run) with the build or versionCode the
+owner picked by number, then a native dialog, and only the host's token after that dialog runs it. Nothing publishes,
+releases an approved version or cancels a submission, and the MCP server (AI tools) has none of the owner actions.
+Play's "Send changes for review" has no API: the Releases tab shows its console plan and a deep link. Types:
+`cli/lib/desktop-protocol.ts`.
+`bun tools/build-sidecars.ts` compiles the CLI for macOS, Linux and Windows (`bun build --compile`). Design, safety
+model and the Dependencies screen (tool sources and licenses): [docs/desktop.md](desktop.md).
+
+---
+
+[All docs](README.md) · [README](../README.md)