Writing software built around your screen reader.

Every command in QUILL announces a clear outcome: "Wrapped 3 words in bold", "Nothing selected", "Saved." A command that succeeds silently is treated as a bug, and NVDA, JAWS, and Narrator parity is a design requirement, not an afterthought. One announcement engine serves the whole application - every built-in command and every extension speaks through the same channel, with selectable backends and automatic screen-reader detection.

The Spoken Echo

Speech disappears the instant it is spoken - except in QUILL. The Spoken Echo keeps the last twenty announcements in a read-only dialog you can arrow through, re-read, and copy (Alt+Shift+E). Double-press any informational command - Describe Formatting, Document Summary, Context Help - and it opens the Echo instead of re-speaking.

Describe anything

Describe Formatting at Cursor speaks exactly what is in effect ("Arial, 14 point, centered, bold"). Describe Character at Cursor names the character under the caret - Unicode name, code point, category, notes for invisibles. Document summaries, context help, and F1 topics on every one of 460+ commands round it out: if you can reach it, QUILL can explain it.

Everything is reachable and operable from the keyboard alone. Dialogs have predictable focus, explicit defaults, and no traps - a contract audited by automated gates across 370+ dialog surfaces. The command palette (Ctrl+Shift+P) gives instant keyboard access to every command in the application.

A keymap manager that answers questions

The Keymap Editor searches two ways from one box: type part of a command name to filter, or type a shortcut - ctrl+alt+m, even a QUILL chord - to learn exactly which command owns it, or that it is free. Record Keys lets you press a combination instead of typing it. Assigning a taken key names its owner and offers to reassign, and Run Diagnostics audits the whole keymap for duplicates, orphans, and inert bindings, with one-press healing.

Keyboard packs

Whole shortcut schemes export and import as .kqp keyboard packs - share the muscle memory of a WordPerfect-style or word-processor-style layout, or publish your own on the Quillin Hub.

How much QUILL says - and when, and how - is tunable end to end. Verbosity profiles shape announcement detail; indentation can be spoken as "4 spaces" or "1 tab" or not at all; dialog enter/exit cues are off by default because your screen reader already announces dialogs, and one setting brings them back.

Sound events and sound packs

Saves, errors, sync states, and the nine voice-interaction cues are real, named sound events. Swap the entire palette with a sound pack, retune a single event, or silence any of them - and share your palette on the Hub.

Braille-aware, byte-exact

Status strings are short and meaning-first for braille displays. BRF files honor a strict byte-for-byte contract - form feeds, trailing spaces, and line endings survive exactly - and page-layout proofreading finds the longest line and longest page against your embosser's limits before you send it.

Structured selection tools let you start, extend, complete, and reselect by word, sentence, line, paragraph, or block - deliberate and reviewable, never dependent on visual feedback.

Move like the document is yours

Navigate by heading, paragraph, block, list, table, bookmark, code block, link, or search result. The Outline Navigator holds the whole structure - headings, bookmarks, sticky notes, search matches - at any moment. Alt+1 through Alt+0 jump straight to an open document instead of cycling.

Places that remember you

Named bookmarks belong to the specific file you set them in and persist across sessions. Your last cursor position returns when a document reopens. Inline notes anchor your comments to the text they are about and follow it through edits.

A status bar that acts

Word count, selection details, spelling state, background tasks, autosave state, copy tray, screen-reader detection - each status cell is keyboard-activatable. The status bar is an action hub, not a decoration.

The interface is translatable with a display-language switcher, themes follow system, light, or dark with real contrast in both, and motion is minimal by design. An optional system-tray presence keeps QUILL a keystroke away - with the Copy Tray reachable from the tray menu - and a notification center collects update and workflow events instead of interrupting your writing.

QUILL parla italiano - the first community translation

QUILL's first shipped display language beyond English arrived from the community, not a vendor: menus, dialogs, and spoken messages, translated in full by Elena Brescacin (elettrona) - 669 of 672 catalog strings at contribution, checked by the CI placeholder and coverage gates, and compiled into every build. Switch it under Tools > Writing and Language > Change Display Language - spoken messages change immediately, menus after a restart. Untranslated strings fall back to English, and the refreshed template ships in-repo so the translation keeps growing. Grazie mille, Elena.

Accessibility claims are tested, not asserted. Automated gates audit every dialog surface, every announcement path, and every UI-surface change on every commit. A nightly robot tester launches the real application, presses real keys, and checks what a screen reader would meet - named controls, honest titles, Escape that works, and the words QUILL actually speaks, read from the same announcement channel you hear.

Apply real document formatting - bold, italic, underline, strikethrough, super and subscript, font family and point size, color and highlight, plus paragraph alignment, line spacing, indent, and named styles - without ever seeing markup clutter. The buffer stays clean, fast plain text; the formatting rides along as invisible codes that materialize into real Word, RTF, and HTML formatting on save.

Reveal Codes, reborn

The beloved WordPerfect feature, reimagined screen-reader-first. Press Alt+F3 and your document becomes a stream of codes and text - [Bold On], [Font: Arial], [Center], [Hard Return] - every code an individually announced, navigable item. Jump from a [Bold On] to its matching [Bold Off] and hear its reach. F6 moves between editor, codes pane, and status bar with both carets in sync.

Illuminations

A plain .txt cannot hold fonts or colors, so QUILL can write an Illumination - a small companion file beside the text that carries the formatting. The .txt stays genuinely plain everywhere else; reopen it in QUILL and every font, color, and alignment returns exactly. If another program edits the text, QUILL notices and opens it plain rather than mis-applying old formatting.

Short triggers expand into longer text as you type. Snippets support placeholders, choices, date and time values, prompts, and cursor placement. Smart triggers like =todo(10) or =rand(3,4) generate content when you press Enter. Macros record and replay whole command sequences, and word prediction offers completions as you write.

The Copy Tray

Twelve persistent clipboard slots with labels and pinning. Paste a slot with a chord, double-press to hear what it holds before committing, triple-press to open the tray. Copy to Next Empty Slot routes around your pinned favorites, and the slots survive restarts - a small library of the fragments you reach for daily.

Watch folders

Point QUILL at a folder and let automation act on files as they arrive - transcribe recordings, convert documents, run transcript actions - hands-free, off by default, and visible in the Status Page while it works.

Find, replace, wildcard, and regular-expression search with history and find-all reporting. When a Replace All would change more than a handful of occurrences, a preview lists every change with before-and-after text so nothing surprising happens at scale.

The Regex Helper

Patterns explained in plain language - what the expression will match, piece by piece - so regular expressions become a tool you can hear your way through rather than a wall of punctuation.

Compare Mode

Review a document against another file or the clipboard in a keyboard-first diff: move by change, hear each hunk read in context, and act on what differs.

Hunspell-backed spell check with the F7 review dialog, next/previous misspelling navigation, a misspelling list, as-you-type hints, and custom word lists. Extra language dictionaries - Spanish, French, and more - download on demand the first time you pick them. A thesaurus sits on Shift+F7, and optional pre-save or pre-post proofreading opens the review right when it matters.

Autoformat that respects you

Smart quotes and dash merging follow your preferences. Markdown heading auto-numbering adds 1., 1.1, 1.1.1 across the document and removes them on a second run. Footnote helpers insert reference pairs, hop between reference and definition, and renumber everything into document order. Join Paragraph repairs email-mangled line wrapping in one keystroke.

Notebooks organize a folder of files into one working environment with entries, bookmarks, snapshots, and optional writing goals. Sticky Notes capture passing thoughts without losing your place. Sessions save and restore whole working sets - every open tab, back the way you left it. Trusted locations stop repeated prompts in the folders you work from every day.

In the WordPerfect Editor tradition: Repeat Next Command runs the next command N times - down twenty lines, delete ten words - in one gesture. Restore Deleted Text re-inserts any of the last three blocks removed by structured deletes, distinct from Undo. Describe Character at Cursor is the screen-reader descendant of Reveal Codes for a single character. A read-only guard protects reference documents from stray keystrokes.

Table Studio makes tables workable by ear: build one from scratch or open a CSV/TSV straight into a real keyboard grid where crossing a row speaks the column heading, F2 edits a cell, Alt+arrows move whole rows and columns, and Ctrl+Insert adds a row. Insert the result as a properly-headed Markdown or HTML table, or save it back out as CSV for a full round trip. Cell announcements flow through Windows accessibility for NVDA and JAWS, with a native UIA provider for even richer events on builds that include it.

Feature profiles - Essential, Writer, Developer, Accessibility Professional, or Full QUILL - shape the interface to your needs: keep QUILL simple, or light up automation, scripting, AI, remote files, and extensions when you want them.

Experimental surfaces, double-gated

The Experimental tab offers alternative editor controls - RichEdit generations, a plain Notepad-style control, Scintilla (the Notepad++ engine, the only alternative with full multi-level undo and redo) - each explained before you switch, all behind two deliberate consents so nothing changes under your hands by accident.

88 backslash-code abbreviations - \alpha, \sqrt, \ne, \pi, and more, seeded from the DAISY-published Word Math AutoCorrect list - expand to their symbol the instant you type the code and a space or punctuation, anywhere in ordinary prose. Ten ready-made formulas (the quadratic formula, the Pythagorean theorem, slope-intercept, distance, midpoint, and more) are one selection away in Insert > Snippet Gallery... - nothing to type from memory.

Explore Equation Structure... (Ctrl+Shift+Grave, F, or the Insert menu) steps through a formula's parts - numerator and denominator, base and exponent, a root's radicand - through an ordinary Windows single-select list you already know how to drive: arrow keys, type-ahead, Enter to choose. Escape ends the whole session at any depth; Back up one level is the dedicated choice for stepping out one layer instead.

"Read this part aloud" upgrades automatically to genuine natural-language math speech - the same MathCAT engine NVDA itself ships - once you install it from Help > Download Optional Components > MathCAT math speech engine (about 3 MB). Without it, the same command keeps working with QUILL's built-in template reading - nothing regresses either way.

Math Tutor

A read-only AI agent explains a selected equation in plain language - what it means, what each symbol is - without solving anything or touching your document.

File > Export > Word Document writes a genuine equation object for every formula in your document - editable in Word, read as math by JAWS, never a picture and never literal text. Open that file back in QUILL and the same plain, editable equation text returns, in either Word-reading engine.

Plain text, Markdown, HTML, Word (.docx and legacy .doc), RTF, EPUB, PDF, PowerPoint, Excel, Apple Pages, OpenDocument, CSV and TSV (as text or an accessible grid), Jupyter notebooks, JSON, YAML, TOML, XML, SQLite, and the braille family (.brf, .brl, .pef). Complex extractions come with an intake report that explains the confidence and quality of what QUILL recovered - honesty at the moment of opening. Open from URL brings a web document straight into a tab.

Save As genuinely converts. Choose Word and headings become Word heading styles, each editor line becomes one paragraph, and your fonts, colors, and alignment land on real Word runs. Choose HTML and you get a complete standalone page. And QUILL announces what happened, in words: "Saved as report.docx, Word format. You are still editing QUILL text; each save converts it to Word."

Your originals are protected

Open a PDF, EPUB, or spreadsheet and you are editing extracted text - so Ctrl+S will never overwrite the binary original. QUILL explains and routes you to Save As, and typing a name like notes.pdf offers the real PDF exporter instead of writing a file Acrobat cannot open.

Choose your converter

Word reading and saving engines are selectable - native, MarkItDown, or Pandoc - with each engine's trade-offs described in plain spoken language before you commit, backed by a published bake-off.

Everyone with a screen reader knows the feeling: the PDF turns out to be a photograph of a page. QUILL's rescue tool has one rule - free first, local first, and nothing is ever uploaded without you saying yes, out loud, that one time.

How the tiers work

The free local converter handles born-digital files instantly. When a PDF looks scanned, QUILL says so and asks before running free on-device OCR (the Tesseract engine - CPU-only, offline, a one-time verified 48 MB download). For the documents nothing local can rescue - dense tables, forms, handwriting - an optional bring-your-own-key cloud service is offered only after local OCR comes back weak, consent-gated on every single upload, with an extra caution when a filename suggests sensitive content.

Review exactly what needs reviewing

Review Last OCR Result lists every low-confidence line as "Page N: [confidence] text" - a checklist of exactly the trouble spots, by ear. A plain-language services page explains every converter: what it does, what it costs, and what stays on your machine.

Translation and embossing through liblouis, with the translation pack as a small on-demand download. BRF editing honors a strict byte-for-byte contract, and the Braille Repair tools read layout metrics against your cells-per-line and lines-per-page limits, jump to the longest line or page, and strip trailing spaces - NLS-style proofreading before anything embosses.

DAISY talking books

One export writes a DAISY 2.02 text-only talking book - the folder a Victor Reader Stream, Plextalk, or APH player reads aloud with its own voice, your headings becoming the player's navigation points.

Single files import and export through Pandoc - Word, ODT, EPUB, LaTeX, PDF, and more - with a per-conversion engine choice whose description updates as you arrow through it. Pandoc itself is an on-demand download (about 45 MB, checksum-verified), which alone halved the installer.

The batch wizard

Convert whole folders in the background with curated profiles - Clean Word Document, Accessible HTML Page, EPUB Book, Print PDF, Plain Text for Screen Readers - overwrite policies that keep you out of prompt loops, live rows in the Status Page, and one spoken completion line: "12 of 14 files converted in 4.2 seconds."

Open and save over FTP, SFTP, WebDAV, S3, and HTTPS - all off by default, never silent. Edit a file on a server over SSH and it uploads back on save with a tilde backup in its original newline style. A full GitHub repository browser opens files from your repos and saves changes back. Remote documents that cannot be written back say so and offer Save a Copy instead.

EPUB books open with chapter navigation for comfortable long reading. List Studio builds and reorders structured lists by ear. Encoding tools detect and convert the files that arrive mangled. And when your words go outward: post to Mastodon with an optional per-account pre-post spelling review, or browse your WordPress site's content through an experimental read-only connection - sending stays locked until it earns trust, and we say that plainly.

The voice lists are not English-only. The Windows engine shows every voice installed on your PC in any language - add Italian or German in Windows Settings and it appears in QUILL immediately. The on-device Kokoro neural engine speaks English, Spanish, French, Hindi, Italian, and Brazilian Portuguese from the same voice pack. Piper adds one-click voices including Italian's Paola and Riccardo, eSpeak NG covers a world of languages offline, and the classic DECtalk is a download away. Read Aloud, audiobook export, and batch speech all honor the chosen voice's language, end to end.

Premium voices, honestly labeled

Optional cloud voices - OpenAI, Gemini, ElevenLabs with your own key (cached sentence by sentence so repeats are never re-billed) - sit beside the free local engines, and an experimental browser reader unlocks Edge's Online Natural voices, with the privacy trade-off stated in the setting itself.

Drive QUILL by speaking, entirely on-device, in four levels: push-to-talk single commands ("save file", "word count", "next heading"); conversation mode that keeps listening through a follow-up window, ending your turn when you stop speaking (calibrated to your room); the always-listening "Hey QUILL" wake word, with a status-bar presence and periodic reminder so a live microphone is never a surprise; and spoken questions handed to Ask Quill with you pressing Send, so a person is always in the loop.

The safety law

Voice can only run a curated, non-destructive allowlist. Closing without saving, sending, publishing, and deleting are simply not in its vocabulary. A misheard phrase can never do harm - everything is off by default, off in Safe Mode, and abortable with "cancel."

Nine musical cues

Every state has a warm audio cue - a rising chime on, a soft two-note when the mic opens, a sparkle when the action lands, a calm fall on no-match - each a real sound event you can retune in any sound pack. Prompts can carry your name ("Listening, Jeff.") and stay silent whenever a screen reader is talking.

On-device speech recognition through whisper.cpp for accuracy or Vosk for a fast, light engine ideal for older, low-memory machines - both downloaded on demand, both working offline, with automatic fallback between them. Dictate into any document, or transcribe files and recordings with optional translation to English and speaker identification.

The gap between "I recorded it" and "I have the document" closes to a couple of keystrokes. Transcribe audio or video, then apply a Transcript Action: Meeting Minutes, Action Items, Executive Summary, Interview or Study Notes, Q&A, a Follow-Up Email, Key Quotes, a Decisions Log, or a clean draft. Build your own actions with the no-syntax Action Builder, run them on any document, or let a watch folder do it automatically as recordings arrive.

One guided, keyboard-first wizard, three journeys. Narrate documents into a chaptered M4B or MP3 audiobook - round-robin voices, explicit voice casting ("every chapter titled like interview gets the guest voice"), page-turn cues, spoken credits, and ACX loudness mastering, in translated editions across ~37 languages. Combine a folder of recordings into one book, each file a chapter, reviewed before the merge - or point library mode at a folder of folders and every subfolder builds unattended. Open any audiobook in the Chapter Workbench and fix it by ear: play to where a boundary belongs and split at the playhead, retime, merge, or let silences propose the chapters.

An authoring loop, not an exporter

Incremental rebuilds fingerprint every document and its settings - edit one chapter of a forty-document book and only that chapter re-synthesizes; the rest announce "reused, unchanged since last run." Propose AI titles names a folder of track files by transcribing each opening minute on your own machine and asking your AI for a short title - proposed for review, never applied blind. Even the cover finds itself: one lookup fills title, author, genre, year, and the jacket from Open Library.

Publish without leaving

Write a complete podcast feed offline (iTunes + Podcasting 2.0 tags), run a whole show from one folder with per-episode descriptions and an accessible show-notes page, upload over SFTP through QUILL's own SSH machinery with spoken, cancelable progress, or send the book to your own Auphonic account - credits and presets announced before a byte moves. Every network path asks first; every secret lives in the Windows Credential Manager.

Models load on demand and unload when idle. Low-resource mode keeps one model in memory at a time and prefers the smallest that fits - it turns itself on for very low-memory machines and tells you once, out loud. The whole suite - dictation, read-aloud, and AI - stays usable on an older CPU-only laptop, trading a moment of reloading for a footprint that fits.

A vault is a folder of plain-text notes that point at one another. Type [[Note Title]] anywhere and Follow Wikilink opens that note - at the exact heading with [[Note#Heading]] or block with [[Note#^block]]. A link to a note that does not exist offers to create it; an ambiguous name gets a spoken chooser, never a guess.

The graph, spoken

Show Backlinks answers "what links here?" as a list you can hear - "5 notes link here" - each entry read with the sentence its link sits in, Enter to open the source at that mention. For a screen-reader user this is more useful than the picture ever was.

Embeds

Write ![[Other Note]] and QUILL can pull that content in: Speak Embed reads what it points to without touching your text; Resolve Embed Inline drops the real content in place as one undoable change.

Go to Note is a type-to-filter jump box that speaks the match count as you narrow. Search Vault covers every note - with Regex and Whole Word modes - and opens a result at its exact line. Show Tags gathers notes by #tag with counts, and nested tags roll up so #area finds everything under #area/sub.

Templates and daily notes

Insert Template fills in {{date}}, {{time}}, and {{title}}, asks any {{prompt}} questions out loud one at a time, and leaves your cursor at {{cursor}}. Open Today's Note starts (or returns to) today's page, and Previous/Next Daily Note walk your journal.

Publish and sync

Export Vault as Website writes one accessible page per note with your links and embeds resolved. If the vault is a Git repository, Sync Vault commits, pulls, and pushes over your own remote - and lists conflicts rather than overwriting a word. A vault stays plain Markdown you own forever.

Tools > Story Studio opens a keyboard-navigable binder for a project folder: your manuscript's parts, chapters, and scenes drawn straight from the Markdown headings you already write, beside groups for Characters, Places, Plot threads, Research, and Brainstorm. Enter opens any item - a chapter at its heading.

Character sheets without a database

Edit Details opens a small accessible form - a character's Role, Goal, Motivation, and Arc; a plot thread's Status; tags - saved as tidy front matter in the file itself, so editing the form and editing the file are the same bytes.

Compile and ship

Compile Manuscript stitches every file together, in order, into one document - and from there, ordinary Export takes over: Word, EPUB, DAISY, audio. A project is a folder of plain text plus one small companion file; delete the companion and you still have every word.

GLOW is guided accessibility review and repair inside your editor. Audit the document or just the paragraph at your caret: findings open as a readable tab - heading levels that jump, links that just say "click here", images without alt text, tables without headers - each with a rule, a severity, and a plain-language suggestion.

Fix without fear

Fixes are safe, deterministic, and reviewable - a repaired preview opens in a compare session against the original, never a silent rewrite. GLOW Audit File and Fix File take on whole Word, PowerPoint, Excel, PDF, and EPUB documents with a scored, graded report; fixing always writes a repaired copy beside the untouched original.

Private by default

The everyday workflow runs entirely on your machine; the engine's optional networked helpers stay off unless you consent per action, and engine updates are signed, verified, and fetched only when you ask.

A short, screen-reader-first wizard offers one choice - on-device, an account, or not now - with one-step connect and Test Connection. Click any AI action before setup and QUILL offers the wizard right there instead of failing.

You never have to pay

The wizard leads with the best free options: most private, a model on your own computer (no account, works offline, nothing leaves your device); best quality, your own free OpenRouter key with a strong free model preselected. Every provider has a Get API Key button that opens the right signup page, model dropdowns replace typed ids, and models that cost nothing say "Free" out loud. Honest about trade-offs: free hosted models can be slower, and confidential writing belongs on the private on-device option.

One conversation that knows your document. Draft, rewrite, summarize, restructure, ask questions - and every proposed change arrives as an accessible accept/reject preview applied as a single undo step. Nothing is ever silently rewritten.

The everyday actions

Rewrite, summarize, expand, continue, fix grammar, generate a table of contents; AI spell check and grammar-and-style review; translate a selection or document; the AI Thesaurus; Document Q&A; and spoken answers plus audio export in natural voices, beside QUILL's on-device speech.

QUILL's agent can run on more than one engine. The built-in Native engine works on whichever provider you connected - on-device models, OpenAI, Claude, Gemini, OpenRouter, or custom endpoints. If you pay for GitHub Copilot, use that subscription directly: a short spoken device code signs you in, no API key at all. The Claude Agent and OpenAI Agents engines plug in with the API keys you already have.

The safety never changes

Whichever engine runs, QUILL owns every edit: the agent proposes, you approve a preview, one keystroke undoes it, and vendor agents run text-only - their own file and shell tools are off. Optional, off by default, off in Safe Mode.

Prompts, Skills, and Agents in one tabbed manager with a real promotion path: a Prompt graduates into a multi-step Skill, and a Skill into a first-class Agent - all reviewable, all yours, all running through the connection you set up once. Skill packs share on the Quillin Hub like everything else.

When your computer can comfortably run a more accurate on-device model, the model dialog says so - a one-step suggestion you can ignore. If a cloud request cannot reach the internet and a local model is installed, QUILL tells you that you can switch and keep working offline - it never switches for you, because your privacy choice stays yours. Idle models unload to give your memory back.

A JSON manifest adds menu items, hotkeys, and text snippets with placeholders like ${selection}, ${date}, and ${clipboard} - no code, no build tools. The Snippet Wizard builds one interactively in your browser: fill in the form, download your manifest, done.

Add a Python or Node.js entry module for genuine custom behavior. Your code runs in a sandboxed subprocess with import allowlists and resource caps, touches only the capabilities it declared - document access, filesystem, network, clipboard, and storage are each consent-gated at runtime - and announces through the same engine as built-in commands, with full screen-reader parity. A crashing Quillin cannot affect your editor or your document.

Deep integration

Quillins attach to any menu and the context menu, bind hotkeys in QUILL's own grammar (conflicts reported, never silently overridden), contribute abbreviations, define smart triggers like =bug(), and react to document events. The Quillins Manager lists every capability and signature state and lets you enable, disable, reload, or remove anything.

The community store for every shareable QUILL artifact - Quillins, AI agents and skill packs, sound packs, keyboard packs, verbosity packs, and pronunciation dictionaries. Submitting runs the full validator locally and reads you the verdict before anything touches the network; every published artifact is cryptographically signed, and the storefront and your Quillin Manager both speak its signature state. From "I made this for myself" to "everyone can have this."

A Developer Console scripts QUILL from inside QUILL. The sandboxed Python snippet runner executes quick transformations under strict isolation. Code-aware editing brings syntax-aware spell check and word navigation to source files. Quillin lint and validation tools check your extension before the Hub ever sees it, and the GitHub browser and remote workflows keep repository work inside the editor you can hear.

Undo and persistent undo cover the editing session - up to a hundred steps that survive closing the file. Autosave and backups surround every save, with crash-safe snapshots and recovery offered on the next launch. And restore points are the long memory: every save keeps a content-based snapshot, File > Restore Previous Version lists them as "Today at 4:12 PM - 2,341 words," and restoring is itself reversible because your current text is snapshotted first. A week of saves is kept fully, then daily, then weekly; the newest five are never pruned; and keeping a snapshot can never be the reason a save fails.

Atomic everything

All settings and data write to a temporary file first, then replace atomically - a crash mid-write leaves your existing file untouched, and schema-validated stores catch problems before they reach disk.

Update checks verify a signed manifest, downloads are checksum-verified, and optional components install only when you ask, with cancelable spoken progress.

The advisory system

If the community reports a shipped feature misbehaving badly, a signed advisory can switch off that one feature - loudly, with its reason announced - until the fix ships. Advisories only ever turn things off, persist offline, are lifted by the same signed feed, and QUILL_IGNORE_FEATURE_LOCKS=1 is your standing local override. Policy: used only on real community reports, when a fix cannot ship fast enough.

Secrets live in the OS credential vault, never in files. Sensitive settings are encrypted at rest. Crash reports pass a redaction scrubber so tokens and personal paths never leave your machine, and the crash dialog confirms out loud whether a report was sent or copied. Every outbound call site in the codebase is registered in a network egress audit that the build enforces - local-first is a gate in the test suite, not a slogan.

Over 7,000 automated tests run on every change. Style, typing, module-size, dialog-inventory, persistence, and egress gates enforce the contracts that keep QUILL predictable. And a nightly robot tester launches the real application on a real desktop, presses real keys, and checks what a screen reader would meet - named controls, honest titles, Escape that works, and the words QUILL actually speaks. It reports to humans; it never gates or auto-fixes.

0.9.0 is the final feature beta. From here to 1.0, every change is a bug fix, a polish pass, or a performance win - driven by community reports. Rough edges get smoothed, not shipped. Safety advisories stand guard between "you told us" and "it is fixed." The first promise was "we will build it all." The second is "it will all work." 1.0 will be boring, in the best way - and when something is not fixed yet, you hear that from us in exactly those words, with the reporter's name on the fix when it comes from the community.