security: publish hardened v1 initiative snapshot

Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan.

This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility.

Himesan-Output-Permission: v1.0
Signed-off-by: Cole Speelman <gamertan@noreply.localhost>

internal/devserver/proxy.go

@@ -104,6 +104,22 @@ func (d *developmentProxy) setTarget(address string) error {
 	return nil
 }
 
+// clearTarget forgets address only when it is still the selected upstream.
+// The compare-and-swap prevents a concurrently replaced target from being
+// cleared between the load and store. The supervisor serializes activation
+// and exit handling and calls this only for its current candidate.
+func (d *developmentProxy) clearTarget(address string) bool {
+	target := d.target.Load()
+	if target == nil || target.Host != address {
+		return false
+	}
+	if !d.target.CompareAndSwap(target, nil) {
+		return false
+	}
+	d.closeIdleConnections()
+	return true
+}
+
 func (d *developmentProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	if status, message := d.validateRequest(r); status != 0 {
 		w.Header().Set("Cache-Control", "no-store")