/docs and /help answer a buyer before they answer a developer

[Apolloccrypt]

What this does

/docs, /developer and /help, rebased on main and reworked after two rounds of review. The rule from docs/brand/messaging.md: a sentence ships only when it already ships somewhere else and a test fails the moment it stops shipping. Every claim below is quoted from the page that owns it, and every quote is pinned to the markup a visitor actually sees.

The review points, one by one

1. The buyer line on /docs was not pinned. The old assertion matched Your IT can check everything here against the whole file, and the same words sit in four meta tags. Deleting the visible paragraph left the test green. The assertion is now anchored to <p class="docs-buyer">Evaluating Paramant? .... Sabotaged both ways: removing the paragraph is red, and leaving it while breaking only the meta copy is red too.

2. The buyer had no button on /docs. Quick start was the only real action and Pricing was a text link. There are now two buttons of the same size in the same row: Quick start (filled, still the primary CTA the guide asks for) and See plans and prices (outlined, straight to /pricing). Create account stays as a text link below them. On 390px both buttons go full width and stack. Pinned on both href and class, so demoting either one back to a text link fails.

3. "What does it cost?" on /help named no amount. It now names what /pricing prints: ParaSign Community is free, forever, no card required, 2 signatures per month; the first paid plan is ParaSign Pro at €49 a month excl. btw (€59.29 incl.) with 100 signatures a month. Each half is pinned against the card it came from, and the Community pin is scoped to the ParaSign grid because /pricing carries a second Community card for ParaSend.

4. "Pay for volume, never for security" was a sales line on a support page. It is gone from /help and stays on /pricing, which is the page that sells. The fact behind it is quoted instead, word for word: "Every plan gets the same encryption, the same post-quantum signatures and the same public proof log." A doesNotMatch fails if the slogan comes back. That gate, and the sales-vocabulary gate beside it, run on the whole /help body below </head>, not on the three answers alone, so the line cannot return through the lede, an article card or the footer.

5. "Where does my data live?" was a compliance table flattened into prose, with two colons in one sentence. It is four short sentences now, and the second round of review caught a real error in the first draft of them: it said the documents and keys live on servers at Hetzner. The keys do not. Five places on the site promise the opposite: "Generated on your device, never sent" (index.html), "relay holds only ciphertext, never keys" and "No plaintext, no keys" (security.html), "we never hold decryption keys, anywhere" (trust.html), "The relay never sees plaintext and never holds a private key" (docs.html). The answer now reads:

Your documents live on servers at Hetzner Nuremberg, Germany, and they sit there as ciphertext. The relay never sees plaintext and never holds a private key. Your files stay under EU law and the GDPR, and no US provider is in the data path. Email goes out via Resend, as /privacy sets out.

That is proof 1 of the messaging guide, scoped to the data path and naming the Resend exception in the same breath, plus the key sentence quoted from docs.html. The unqualified "no US company" row on /security is an open contradiction (guide section 9) and is deliberately not repeated here; a test fails if it appears.

Pinned in both directions. The positive half is a pair, the quote and docs.html. The negative half is a loop over every sentence in the /help body: a sentence naming a key and a piece of infrastructure in the same breath must be denying it, and may never put a locative verb between the two. Sabotage: putting "and keys" back is red, "your keys are stored on the relay" is red, and "Your keys are kept on servers at Hetzner Nuremberg, and there is no US provider" is red as well, so a stray "no" elsewhere in the sentence buys no pass.

6. The em-dash sweep stopped at the lede. The H1, the tab title, the meta description and the body of /help/api-key-vs-totp and /help/lost-authenticator still had them: eleven and six. All gone, plus an en-dash range in each of the two pages and one on /docs. A loop over the three help pages and /docs pins it.

7. /developer spoke to the wrong audience. The page is noindex and only reachable once signed in, so "so your IT can check everything before you connect anything" was addressing someone who is not there. It now reads "so you can read the whole surface before you connect anything." The plan boundary for API access stays, and a test forbids the buyer phrasing from returning.

Also fixed while here: two sentences on /docs that ran on double colons (the "Version 3.0.0 keeps ..." lede and the ADR line) now read as sentences.

Rebase

Rebased onto main twice. The first pass resolved a conflict in tests/ui-truthfulness.test.mjs where main's homepage, dashboard and Community-rename assertions (#327, #328) landed in the same place; both sides kept, the duplicate pricing.html read folded into the existing one. main's rename of the free tier to Community also changed the source sentence on /sign, so the /help quote follows it. The second pass took #332, which appends two console.log lines at the end of the same file: no name collision, both sides kept. Now current with #352 and #353. frontend/apply-nav.py ran after each rebase and produced no further changes.

Proof

Green: links, seo-contract, ui-truthfulness, site-claims, frontend-loading-contract, navigation-shell, check-csp-inline.sh, check-cache-bust.sh, eslint@9 ., tests/static-sanity.sh (PASS, all hard checks clear, 10/10), scripts/check-commit-style.sh over the whole range.

Sabotage: 37 mutations, one at a time, each reverted after the run. Every new pin went red, including the ones on the source pages (pricing.html, security.html, index.html, docs.html) and the four negative pins. Screenshots at 390x844: no horizontal scroll on either page, scrollWidth 390 = clientWidth 390, and all three /help answers still fit one screen.

Known gap, outside this PR: renaming the ParaSend Community card on /pricing stays green, because main's assertion from #328 is satisfied by the remaining ParaSign card. This branch's own pin is scoped and does catch the ParaSign one. That is a pin on main, not a regression here.

Scope: six files, all /docs, /developer, /help and their test. frontend/apply-nav.py, frontend/js/nav-auth.js and frontend/index.html are not edited.

[Apolloccrypt]

Follow-up commit 1611bc3: tests/developer-parasign-dashboard.test.mjs caught something the first push got wrong, and it was right to.

The test asserts the rendered text of /developer contains "ParaSign API", which is how it proves the page is the ParaSign surface and not the old transfer tool catalogue. The eyebrow above the h1 is text-transform:uppercase, so innerText renders it as "PARASIGN API" and never satisfies that check. The only lowercase occurrence sat inside the sentence this branch rewrote out.

The lede now reads "Every ParaSign API endpoint is in the API reference". Same meaning, and the phrase is back where the test can see it. The test itself is unchanged — it caught a real thinning of the page's own name, which is exactly the job.

The browser suites were run locally this time (all 18 subtests across the playwright-importing files in tests/), not just the non-browser ones.