Document the Packages tab, publishing and signing key unlock

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 15 insertions, 0 deletions

diff --git a/README.md b/README.md
index 1ff0cc7..56cb829 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,21 @@ Every key is optional. `File > Reload config` rereads the GUI config.
   preview that lists `shadow:` or `unshadow:` lines, "Apply shadowing" runs
   `sbshadow --yes`.
 
+- **Open > Packages** (or click the Packages tile): every package of the
+  repository, with built version and status (`ok`, `failed`, `never`,
+  `outdated`). Search by name or summary, or with `cat:`, `maint:`, `req:`,
+  `status:`; toggle the overlay and status chips. The detail pane shows the
+  package's versions, its dependencies after hints (dropped ones struck
+  through), and what its hint file does, section by section.
+- Tick packages (or select one row) and press Build, Update, Rebuild or
+  Remove; Update all updates everything. Each first runs a slackrepo
+  `--preview` job. When the preview is fine, **Run it** in the Jobs tab starts
+  the real run; untick **publish** to keep the packages local and press
+  **Publish** later to push them.
+- Real runs sign the repository. When the package signing key is locked
+  (status bar 🔒), the GUI asks for its passphrase first and hands it to the
+  VM's gpg-agent; it is never stored.
+
 Jobs run on the VM detached from the ssh session, one at a time. Closing the
 GUI or losing the connection does not stop them; reopening the job resumes
 the log. Job state and logs live in `/var/lib/sb-builder/jobs/` on the VM.