Harden App Store build for review

APPSTORE.md

@@ -123,8 +123,8 @@ correct app/team association, and a matching Sandbox Apple Account.
    with the **App Group `group.com.apt.fuelboard`** capability AND the
    **In-App Purchase** capability enabled (the widget + app-group cache
    depend on the group; the tip jar needs IAP).
-3. ~~[ME] `PrivacyInfo.xcprivacy`~~ — **DONE 2026-08-16** (app + widget
-   manifests added; UserDefaults `1C8F.1`, Location + Diagnostics declared).
+3. ~~[ME] `PrivacyInfo.xcprivacy`~~ — **DONE** (app, widget, watch app, and
+   watch wrapper manifests added; UserDefaults `1C8F.1`; app declares Location).
 4. **[ME] Real Distribution signing** — Distribution certificate + App Store
    provisioning profile (or Xcode automatic signing once the account is in
    Xcode); then `xcodebuild archive` (no more `CODE_SIGNING_ALLOWED=NO`).
@@ -135,21 +135,20 @@ correct app/team association, and a matching Sandbox Apple Account.
 
 ## Required tasks — owner [ME] (technical, do after account exists)
 
-- [x] **PrivacyInfo.xcprivacy** — app + widget manifests added (2026-08-16):
-      UserDefaults reason `1C8F.1`; app also declares Location (linked, not
-      tracking) + Diagnostics (not linked, not tracking — the dev beacon)
+- [x] **PrivacyInfo.xcprivacy** — app, widget, watch app, and watch wrapper
+      manifests added: UserDefaults reason `1C8F.1`; app also declares Location
+      (linked, not tracking). Diagnostic network beacon removed with LAN relay.
 - [ ] Distribution archive + TestFlight upload (needs Apple account)
-- [x] **Version bump** → `1.0.1` (build 2), app + widget plists
+- [x] **Version/build aligned** → `1.0.0` (build 23), app + widget + watch targets
 - [x] **OGL attribution** — Settings → Data source footer now reads "Prices
       use the UK Fuel Finder dataset (Open Government Licence) and refresh
       up to twice a day." (2.3.1 hygiene)
 - [x] **Out-of-UK empty state** — "No X stations within N miles" + UK-only
       explainer + "Browse all UK stations" button (switches to Closest)
-- [ ] ~~Gate dev surface behind #if DEBUG~~ **DECLINED — kept in Release on
-      purpose**: the user's home-testing installs the Release IPA and toggles
-      `fuelboard.relayFallback` via Settings → Debug (revealed only by tapping
-      About → Version ×5 — invisible to reviewers; no credentials involved).
-      Gating it out of Release would break that workflow for zero review gain.
+- [x] **Remove LAN relay fallback entirely** — no private IP, Local Network
+      permission string, relay toggle, or diagnostic network beacon remains in
+      the app/widget/watch binary. Hidden Debug still exists for local notification
+      and widget diagnostics only.
 - [ ] Final pass: `swift test` green (95 tests), archive smoke test on device
 - [ ] ~~Capture screenshots from simulator~~ **RAW CAPTURES DONE (2026-08-16)** —
       native 6.9″ 1320×2868 PNGs of all four tabs (Stations, Favourites,
@@ -175,8 +174,7 @@ correct app/team association, and a matching Sandbox Apple Account.
       category (Utilities), pricing (Free), availability (UK first?)
 - [ ] Description, keywords, support URL, marketing URL, privacy policy URL
 - [ ] Privacy nutrition labels questionnaire (location: yes, linked to user
-      for alerts/nearby; diagnostics: yes — the widget-diag beacon, not
-      linked, not used for tracking; no ATT prompt needed)
+      for alerts/nearby; no tracking; no ATT prompt needed)
 - [ ] Age rating questionnaire (4+; no objectionable content)
 - [ ] Export compliance: HTTPS-only + keychain → standard encryption
       exemption (5A992a), no documentation needed
@@ -214,8 +212,8 @@ correct app/team association, and a matching Sandbox Apple Account.
   glance. It is declared in the plist already.
 - **Brand logos (Shell, BP, Tesco…)** — Simple Icons (CC0) + Wikimedia,
   nominative use (cf. GasBuddy); low risk, keep sources documented.
-- **GitHub raw as data source** — public data, no credentials; bundled dump
-  covers any regional GitHub unreachability.
+- **GitHub raw as data source** — public HTTPS data, no credentials or Local
+  Network permission; bundled dump covers any regional GitHub unreachability.
 
 ## Timeline (best case)