docs: finalize qualified Windows release preparation

Author: ShadowfetchStudio

CHANGELOG.md

@@ -40,8 +40,9 @@
 - **Local model selection.** Selecting a configured GGUF model from a fresh
   CLI process no longer requires opening the picker first; stale catalog
   entries cannot select files removed from the profile's configuration.
-- **Native runtime pins** follow Alpine 3.21's libcurl and libexpat security
-  updates.
+- **Native runtime pins** follow Alpine 3.21's current package revisions,
+  including libcurl, libexpat, musl and zlib updates. Retained source archives
+  include the matching distribution patches and verified source checksums.
 
 ## 2.2.0: macOS, Flatpak downloads and your own model servers
 

docs/RELEASING.md

@@ -7,8 +7,8 @@ and authentication receipts to the exact candidate before publication.
 Pushing a `v*` tag starts `.github/workflows/release.yml`. Publication follows
 build/qualification, protected signing review and verification of all seven
 public assets. The signing environment must permit the tag being released. As verified
-on October 31, 2026, it still permits `v2.2.0`; before 2.3.0, change its
-deployment rule to `v2.3.0` after candidate review. Every later version needs reviewed trust-policy,
+on October 31, 2026, it permits `v2.3.0`, updated after PR #11 passed
+Windows, both macOS architectures, and both Linux qualification jobs. Every later version needs reviewed trust-policy,
 deployment-rule and tooling-pin updates. The workflow uses
 `docs/RELEASE_NOTES.md` as the release text.
 
@@ -190,16 +190,14 @@ Public trust in `release/trust` currently allows the x86_64 and aarch64 targets,
 (raise the key's maximum version in the release commit, as for earlier releases);
 `release/install-policy` fixes the first authenticated version at 0.33.0.
 The `release-signing` environment has the signing secret and requires review by
-`Shadowfetchapps` (User ID `209457103`). Self-review is allowed and GitHub's
+`ShadowfetchStudio` (User ID `209457103`). Self-review is allowed and GitHub's
 default administrator override remains unchanged. For 2.3.0 its sole
-deployment rule must be changed to `v2.3.0`. As verified on October 31,
-2026, the actual GitHub rule still permits only `v2.2.0` and
-`NATIVE_RELEASE_TOOLING_COMMIT` still points to the 2.2.0 commit,
-`444e75f13c3512d57c226b39d6edf59fdb08a4c6`.
-`NATIVE_RELEASE_SIGNING_ENVIRONMENT` points to `release-signing`. For 2.3.0,
-set the tooling pin to the reviewed tagged release commit itself, as was
-done for 0.33.1 (`e15c4480e65db5650af012bb2a9773dbe89acf84`).
-These are release prerequisites, not configuration already applied.
+deployment rule is `v2.3.0`, updated after candidate qualification on
+October 31, 2026. `NATIVE_RELEASE_SIGNING_ENVIRONMENT` points to
+`release-signing`. Before pushing the tag, set `NATIVE_RELEASE_TOOLING_COMMIT`
+to the reviewed tagged release commit itself and read it back. The prior
+2.2.0 pin was `444e75f13c3512d57c226b39d6edf59fdb08a4c6`; it must not be
+reused for this release. A permitted tag does not prove publication.
 
 Before tagging, finish review and push the tooling commit, then set
 `NATIVE_RELEASE_TOOLING_COMMIT` to that exact 40-character SHA. Read back this pin from GitHub configuration before dispatching the release. Verify the environment protections and source/candidate

docs/WINDOWS_LAPTOP_QUALIFICATION.md

@@ -243,5 +243,11 @@ artifact bytes, not a published release or a general model benchmark.
 The accompanying BusyBox source archive is byte-identical to the previously
 validated archive, SHA-256
 `c6345e913686ff61ab46757b19fad23e9bb1b5e1e273f132bc4333770bd55a96`.
-Windows and both macOS architectures passed at this source commit; Linux
-qualification remains pending and must pass before release.
+Windows and both macOS architectures passed at this source commit. Both
+Linux architectures also passed the full qualification workflow in
+[run 41223980842](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/41223980842),
+including package inspection, offline clean installation, offline runtime
+source rebuilding, installer recovery, and packaged CLI, terminal, desktop,
+Markdown and MCP checks. This closes the earlier Alpine packaging failure.
+PR #11 was merged after all candidate checks passed; tagged release builds
+and publication remain separate steps.