policy: maintain Linux as the release target

Publishes the exact allowlisted snapshot from the private Beta 2 development line. Historical platform evidence remains truthful; native Windows and macOS are no longer release gates or support promises. Material AI assistance was reviewed by the maintainer.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

docs/V1_RELEASE_PLAN.md

@@ -28,17 +28,18 @@ private history or an indiscriminate Git mirror.
 
 Beta 1 is deliberately earlier than a release candidate. It creates a real,
 repeatable install for learners and evaluators without claiming that the final
-v1 compatibility, native-platform, artifact, signing, or soak gates are
-complete.
+v1 compatibility, Linux release, artifact, signing, or soak gates are complete.
 
 ### Demonstrated for Beta 1
 
 Public commit `b7a84054d755e42285e50298e41e47f06a8325a5` (tree
 `be9e118e38dfebed19f60403ededdadabe07d2aa`) passed maintainer-run Go
-1.25.12 and Go 1.26.5 matrices on native Windows/amd64, Linux/amd64 under WSL2,
-with the earlier pre-beta server-container run retained only as supplementary
-Linux evidence. The same generated golden SHA-256 was observed across the exact
-Beta Windows and Linux lanes.
+1.25.12 and Go 1.26.5 matrices on native Windows/amd64 and Linux/amd64 under
+WSL2, with the earlier pre-beta server-container run retained only as
+supplementary Linux evidence. The same generated golden SHA-256 was observed
+across the exact Beta Windows and Linux lanes. This is historical evidence,
+not the current support definition; Linux/amd64 is now the maintained release
+target.
 
 Other demonstrated controls include:
 
@@ -52,7 +53,7 @@ Other demonstrated controls include:
 
 ### Not demonstrated yet
 
-- native maintainer-run macOS execution; macOS is provisional for Beta 1;
+- final Linux/amd64 release-candidate evidence on the exact candidate;
 - stable final-v1 API, CLI, schema, diagnostic, and generated snapshots;
 - systematic browser-parser and `html/template` differential testing;
 - a long semantic fuzz campaign beyond bounded no-panic smoke;
@@ -60,7 +61,7 @@ Other demonstrated controls include:
 - complete real-browser development-supervisor evidence;
 - deterministic prebuilt archives, checksums, SBOMs, signed binaries, and
   tested signing/recovery procedures; or
-- native macOS installation of the published Beta 1 tags.
+- independently reproduced Linux release artifacts, checksums, and SBOMs.
 
 ## Beta 1 publication lane
 
@@ -68,9 +69,8 @@ Beta 1 is supported for learning, classroom projects, evaluation, prototypes,
 and compatibility feedback. It is not recommended as a production-stable
 dependency, and its interfaces may change.
 
-- [x] Define beta support, security, compatibility, and macOS-provisional
-  language.
-- [x] Establish the named public pre-beta Linux/Windows baseline.
+- [x] Define beta support, security, and compatibility language.
+- [x] Establish the historical public pre-beta Linux/Windows evidence baseline.
 - [x] Rerun the supported Go matrix and deterministic generation on the exact
   Beta 1 candidate.
 - [x] Run the candidate-version freshness, bounded fuzz, vulnerability, and
@@ -79,12 +79,10 @@ dependency, and its interfaces may change.
   `v1.0.0-beta.1`, from the same reviewed public commit.
 - [x] Verify clean runtime-first direct and public-proxy installs and record the
   result.
-- [ ] Add native macOS maintainer evidence before RC; community reports inform
-  that work but do not replace maintainer responsibility.
 
 ## Milestone 1: contract freeze
 
-Required before security/platform release-candidate work is declared complete:
+Required before security/Linux release-candidate work is declared complete:
 
 - [ ] Decide and specify whether generic component function signatures are v1.
 - [ ] Inventory and freeze every exported `sando` symbol, trusted type,
@@ -97,11 +95,11 @@ Required before security/platform release-candidate work is declared complete:
   output compatibility snapshots.
 - [ ] Define the v1 deprecation and security-support policy.
 
-## Milestone 2: security and native-platform evidence
+## Milestone 2: security and Linux release evidence
 
 - [ ] Run the minimum supported Go line and the latest two stable Go lines on
-  native Linux, macOS, and Windows hosts.
-- [ ] Prove identical generated bytes across those hosts and exercise native
+  Linux/amd64 runners and a Linux deployment-class host.
+- [ ] Prove identical generated bytes across those Linux lanes and exercise
   path, replacement, permission, race, process-tree, and watcher behavior.
 - [ ] Build a systematic differential corpus against Go's documented
   `html/template` safety baseline for overlapping supported contexts.
@@ -147,7 +145,7 @@ Required before security/platform release-candidate work is declared complete:
 2. Publish signed `sando/v1.0.0-rc.1`, then signed `v1.0.0-rc.1` from the same
    reviewed public Gitea commit.
 3. Verify documented installs through fresh `GOPROXY=direct` and
-   `proxy.golang.org` caches on supported Go versions and native platforms.
+   `proxy.golang.org` caches on supported Go versions under Linux/amd64.
 4. Run the complete evidence suite again from the exact public commit.
 5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
    observation period with no unresolved Hime render, security, accessibility,
@@ -172,6 +170,6 @@ marketing. New features do not outrank a small stable contract.
 ## Definition of confidence
 
 “Ready for v1” means a reviewer can trace each promise to a stable public
-contract, executable evidence from supported native environments, and a signed
+contract, executable evidence from supported Linux environments, and a signed
 artifact built from the exact canonical source. It does not mean perfect,
 invulnerable, or finished forever.