Prepare Sandwich Hime v1 release candidate source

docs/V1_RELEASE_PLAN.md

@@ -28,7 +28,7 @@ private history or an indiscriminate Git mirror.
 
 Beta 1 is deliberately earlier than a release candidate. It creates a real,
 repeatable install for learners and evaluators without claiming that the final
-v1 compatibility, Linux release, artifact, signing, or soak gates are complete.
+v1 compatibility, native release, artifact, signing, or soak gates are complete.
 
 ### Demonstrated for Beta 1
 
@@ -38,8 +38,8 @@ Public commit `b7a84054d755e42285e50298e41e47f06a8325a5` (tree
 WSL2, with the earlier pre-beta server-container run retained only as
 supplementary Linux evidence. The same generated golden SHA-256 was observed
 across the exact Beta Windows and Linux lanes. This is historical evidence,
-not the current support definition; Linux/amd64 is now the maintained release
-target.
+not the current support definition; Linux/amd64 and Darwin/arm64 are the
+maintained v1 release targets.
 
 Other demonstrated controls include:
 
@@ -53,15 +53,16 @@ Other demonstrated controls include:
 
 ### Not demonstrated yet
 
-- final Linux/amd64 release-candidate evidence on the exact candidate;
-- stable final-v1 API, CLI, schema, diagnostic, and generated snapshots;
-- systematic browser-parser and `html/template` differential testing;
+- final Linux/amd64 and Darwin/arm64 release-candidate evidence on the exact
+  canonical candidate;
+- exact-public-candidate execution of the committed real-browser generated
+  document and development-supervisor gate on both maintained hosts;
 - a long semantic fuzz campaign beyond bounded no-panic smoke;
-- committed comparative benchmarks and predefined regression thresholds;
-- complete real-browser development-supervisor evidence;
+- exact-candidate comparative benchmark results on both maintained targets;
 - deterministic prebuilt archives, checksums, SBOMs, signed binaries, and
   tested signing/recovery procedures; or
-- independently reproduced Linux release artifacts, checksums, and SBOMs.
+- independently reproduced Linux and macOS release artifacts, checksums, and
+  SBOMs.
 
 ## Beta 1 publication lane
 
@@ -82,45 +83,50 @@ dependency, and its interfaces may change.
 
 ## Milestone 1: contract freeze
 
-Required before security/Linux release-candidate work is declared complete:
+Required before security/native release-candidate work is declared complete:
 
-- [ ] Decide and specify whether generic component function signatures are v1.
-- [ ] Inventory and freeze every exported `sando` symbol, trusted type,
+- [x] Specify generic component function signatures as ordinary Go-backed v1
+  APIs and compile them in a temporary consumer module.
+- [x] Inventory and freeze every exported `sando` symbol, trusted type,
   sentinel error, concrete error field, helper, and ABI marker.
-- [ ] Freeze CLI commands, exit-code meanings, diagnostic codes, JSON schemas,
+- [x] Freeze CLI commands, exit-code meanings, diagnostic codes, JSON schemas,
   `himesan.json` schema, and generated provenance fields.
-- [ ] Specify nil/stringification behavior, supported HTML-context matrix,
+- [x] Specify nil/stringification behavior, supported HTML-context matrix,
   component trust boundary, URL semantics, and explicit unsupported cases.
-- [ ] Add machine-checked public API, CLI, diagnostic, schema, and generated
+- [x] Add machine-checked public API, CLI, diagnostic, schema, and generated
   output compatibility snapshots.
-- [ ] Define the v1 deprecation and security-support policy.
+- [x] Define the v1 deprecation and security-support policy.
 
-## Milestone 2: security and Linux release evidence
+## Milestone 2: security and native release evidence
 
-- [ ] Run the minimum supported Go line and the latest two stable Go lines on
-  Linux/amd64 runners and a Linux deployment-class host.
-- [ ] Prove identical generated bytes across those Linux lanes and exercise
+- [ ] Run the pinned patched Go 1.26 and Go 1.27 lines on Linux/amd64 and
+  native Darwin/arm64 runners, plus a Linux deployment-class host.
+- [ ] Prove identical generated bytes across both native platforms and exercise
   path, replacement, permission, race, process-tree, and watcher behavior.
-- [ ] Build a systematic differential corpus against Go's documented
+- [x] Build a systematic differential corpus against Go's documented
   `html/template` safety baseline for overlapping supported contexts.
-- [ ] Parse representative outputs in real browsers and test structure/code
-  invariants rather than only byte equality.
+- [x] Commit a real-browser gate that generates and builds a representative
+  typed document, then tests parsed structure and hostile-value inertness in
+  Chrome rather than relying only on byte equality.
 - [ ] Extend semantic fuzzing across delimiters, HTML transitions, imports,
   paths, source maps, URL normalization, and filesystem operations.
 - [ ] Resolve or explicitly accept every open item in
   `SECURITY_EVIDENCE.md`; no accepted item may contradict a public guarantee.
 - [ ] Test delivery and reply through `security@sandwichhime.com`.
-- [ ] Define severity, advisory, retraction, and CVE-request handling.
+- [x] Define severity, advisory, retraction, and CVE-request handling.
 
 ## Milestone 3: measured performance and development UX
 
-- [ ] Commit a synthetic, repository-owned benchmark corpus comparing
+- [x] Commit a synthetic, repository-owned benchmark corpus comparing
   equivalent typed views and output with `html/template`.
-- [ ] Define “no material regression” before measuring the release candidate;
-  publish hardware, OS, Go version, commands, samples, allocations, and output
-  equivalence with every result.
-- [ ] Test SSE reconnect, reload, diagnostic overlays, CSP changes, fragment/API
-  exclusions, caching, and child cleanup in a real browser on supported hosts.
+- [x] Define “no material regression” before measuring the release candidate.
+- [ ] Measure the exact release candidate and publish hardware, OS, Go version,
+  commands, samples, allocations, and output equivalence with every result.
+- [x] Commit a real-browser development-supervisor gate covering SSE
+  diagnostics, reload, CSP behavior, fragment/API exclusions, caching, and
+  child cleanup.
+- [ ] Execute the committed browser gate on the exact public candidate on both
+  maintained hosts and preserve the browser identities and results.
 - [ ] Remove any v1 development-supervisor guarantee that cannot be evidenced
   reliably instead of substituting prose for a test.
 
@@ -134,7 +140,7 @@ Required before security/Linux release-candidate work is declared complete:
   and source/build provenance from a clean sanitized canonical checkout.
 - [ ] Test release-key backup and two-person recovery for Gitea, domains,
   signing material, and publication instructions.
-- [ ] Make evidence gates validate content and commit identity rather than only
+- [x] Make evidence gates validate content and commit identity rather than only
   the presence of non-empty files.
 - [ ] Rehearse runtime-first publication and rollback without creating public
   semver tags.
@@ -145,7 +151,8 @@ Required before security/Linux release-candidate work is declared complete:
 2. Publish signed `sando/v1.0.0-rc.1`, then signed `v1.0.0-rc.1` from the same
    reviewed public Gitea commit.
 3. Verify documented installs through fresh `GOPROXY=direct` and
-   `proxy.golang.org` caches on supported Go versions under Linux/amd64.
+   `proxy.golang.org` caches on supported Go versions under Linux/amd64 and
+   Darwin/arm64.
 4. Run the complete evidence suite again from the exact public commit.
 5. Operate the official Sandwich Hime website on the RC runtime for a 14-day
    observation period with no unresolved Hime render, security, accessibility,