docs(release): pre-release sweep Phase 2 - README mobile note + dead-path scrub

Phase 2 follow-up to f851828 (Phase 1: 9 findings fixed).

README.md:

- Replace stale version example '2.0.0' with '1.0.0-rc1'

- Add desktop-only requirement (1280x720 min, no mobile/tablet)

docs/BACKWARD_COMPAT.md, docs/PRE_PUBLIC_AUDIT.md, docs/PUBLIC_FILE_INVENTORY.md:

- Scrub dead 'scripts/test_upgrade_path.sh' path strings while

  preserving historical context (deletion date + reason).

  doc-drift correctly flagged these as references to a deleted file

  per CLAUDE.md doc-drift rule.

doc-drift: OK (32 docs checked against build 660)

Author: RelativisticJet

README.md

@@ -107,7 +107,7 @@ Navigate to **Apps > Whitelist Manager** to start using the app.
 
 ### Install on Existing Splunk
 
-Download the latest `.spl` from the [Releases](https://github.com/RelativisticJet/wl_manager/releases) page. Replace `<VERSION>` in the commands below with the release tag you downloaded (e.g., `2.0.0`).
+Download the latest `.spl` from the [Releases](https://github.com/RelativisticJet/wl_manager/releases) page. Replace `<VERSION>` in the commands below with the release tag you downloaded (e.g., `1.0.0-rc1`).
 
 **Option A — Splunk Web UI:**
 
@@ -246,6 +246,10 @@ make package          # Outputs dist/wl_manager-VERSION.spl
 - Splunk Enterprise **9.3** (the only version on Splunk's currently-supported list as of 2026-05; tested on 9.3.1)
 - Python 3 (bundled with Splunk 9)
 - ~10 MB disk space for the app + audit data
+- A modern desktop browser (Chrome, Firefox, Edge) at **1280×720 minimum**.
+  Whitelist Manager is designed for SOC-analyst desktop workflows;
+  Splunk Web itself is not mobile-optimized, so mobile/tablet layouts
+  are out of scope.
 
 ## License
 

docs/BACKWARD_COMPAT.md

@@ -23,7 +23,7 @@ The v3.0 modular rewrite maintains full compatibility with:
 | Audit events | Golden event injection test | `tests/integration/test_backward_compat_audit.py` | Added, Removed, Edited, Revert, Auto-Removed (5 event types) | PASS ✓ |
 | Version manifests | Fixture-based manifest loading test | `tests/integration/test_backward_compat_versions.py` | Manifest parsing, version iteration, field preservation (8 test cases) | PASS ✓ |
 | Approval queue | Fixture-based queue entry test | `tests/integration/test_backward_compat_approval.py` | Queue parsing, action type recognition, payload structure (11 test cases) | PASS ✓ |
-| Full upgrade path | Docker end-to-end test | `scripts/test_upgrade_path.sh` | CSV accessibility, audit queries, dashboard loads, REST API (4 verification checks) | PASS ✓ |
+| Full upgrade path | Docker end-to-end test | _(test pending GA cut; previous upgrade-test script removed 2026-05-18 as stale v2.0->v3.0)_ | CSV accessibility, audit queries, dashboard loads, REST API (4 verification checks) | DEFERRED |
 
 ---
 
@@ -114,9 +114,15 @@ The v3.0 modular rewrite maintains full compatibility with:
 
 **Test Count:** 15 test cases
 
-### 4. Full Upgrade Path Test
+### 4. Full Upgrade Path Test (DEFERRED)
 
-**Test Script:** `scripts/test_upgrade_path.sh`
+**Test Script:** _Removed 2026-05-18._ The previous upgrade-test
+script targeted a v2.0->v3.0 upgrade that no longer matches the
+current version line, and stopped/removed the maintainer's primary
+dev container as a side effect. A replacement script (for
+v1.0.0-rc1 -> v1.0.0 GA -> v1.x point releases) will be written
+when the GA cut is scheduled. Until then, manual upgrade
+verification is documented in `docs/RUNBOOKS.md`.
 
 **What is tested:**
 - Fresh Docker container starts successfully
@@ -258,13 +264,9 @@ python -m pytest tests/integration/test_backward_compat_approval.py -v
 
 ### Run Docker Upgrade Test
 
-```bash
-# Start fresh test environment and perform full upgrade test
-bash scripts/test_upgrade_path.sh
-
-# Check results
-cat upgrade_test_results.txt
-```
+_The automated upgrade test was removed 2026-05-18; see "Full Upgrade
+Path Test (DEFERRED)" above. For manual verification follow the
+upgrade-checklist section in `docs/RUNBOOKS.md`._
 
 ---
 
@@ -322,7 +324,7 @@ For questions about v3.0 upgrade compatibility:
 - ✓ Audit event backward compatibility tests (test_backward_compat_audit.py)
 - ✓ Version manifest backward compatibility tests (test_backward_compat_versions.py)
 - ✓ Approval queue backward compatibility tests (test_backward_compat_approval.py)
-- ✓ End-to-end Docker upgrade test (test_upgrade_path.sh)
+- ✓ End-to-end Docker upgrade test (removed 2026-05-18 — see Test Matrix above for status)
 - ✓ Documentation for administrators (this file)
 
 **Coverage:** 100% of v2.0 data structures tested and verified

docs/PRE_PUBLIC_AUDIT.md

@@ -796,7 +796,7 @@ These rows tell a casual viewer "this is dev debris, not a curated demo set." Th
   - Email mentions in `docs/PRE_PUBLIC_AUDIT.md` are this audit doc's own findings registry (meta-reference, not a leak).
   - `tests/a11y/reports/*.json` show `DevLicense:communicate.oleh@gmail.com` in 12 places — these are the gitignored raw a11y reports (`.gitignore:163-164`); the file is NOT tracked. `git ls-files tests/a11y/` confirms only `README.md`, `baseline.json`, `lib_a11y.cjs`, `test_a11y_dashboards.cjs` are tracked, and `grep` shows zero email matches in those four.
 - Hardcoded-credential sweep (`password|secret|api_key|bearer|token` with 8+ char value) across all 252 files — only the documented `Chang3d!` dev-container password appears (in `demo/demo.sh`, `demo/generate_demo_guide.py`, `docs/PUBLIC_RELEASE_PLAN.md`, `docs/RING_FINDINGS.md`, `docs/PRE_PUBLIC_AUDIT.md`). Allowlisted in `.gitleaks.toml`. No other secrets.
-- RFC1918 IP regex — every match is intentional demo seed data (`demo/demo.sh:254-256`, `scripts/seed-demo-state.py:130`, `scripts/test_upgrade_path.sh:110/112`, `docs/api/README.md`, `docs/api/openapi.yaml`).
+- RFC1918 IP regex — every match is intentional demo seed data (`demo/demo.sh:254-256`, `scripts/seed-demo-state.py:130`, `docs/api/README.md`, `docs/api/openapi.yaml`). A previous upgrade-test script was in this list before removal on 2026-05-18 (see pre-release sweep commit).
 - `TODO|FIXME|XXX|HACK` — only false positives (UUID placeholder `XXXXXXXX-XXXX-XXXX` in `tests/integration/test_backward_compat_approval.py:166`, `'XXXX'` substring sentinel in `tests/unit/test_validation.py:407/424` and `docs/RING_FINDINGS.md:2090`).
 - `bench_results/` — three JSONs of 838-byte perf data each. Container name `wl_manager_test` is the documented dev container. Clean.
 

docs/PUBLIC_FILE_INVENTORY.md

@@ -312,7 +312,8 @@ All scripts here are **repo-only** — they don't run on the customer's Splunk.
 | `scripts/pre-commit-doc-drift.sh` | Drift guard for the tracked doc set — path-existence + build-number checks. | Repo-only | Yes |
 | `scripts/test_integration.sh` | Local runner for `tests/integration/` against the dev container. | Repo-only | Yes |
 | `scripts/test_backup_restore.sh` | Smoke test for the backup/restore runbook. | Repo-only | Yes |
-| `scripts/test_upgrade_path.sh` | Smoke test for an in-place upgrade from a prior `.spl` version. | Repo-only | Yes |
+<!-- The previous upgrade-test script (under scripts/) was removed 2026-05-18 — targeted a stale v2.0->v3.0 path and would have destroyed the live dev container. A fresh upgrade test will be written when v1.0.0 GA is cut. -->
+
 | `scripts/emergency_unlock.sh` | Out-of-band recovery: clears the emergency-lockdown sentinel. | Repo-only | Yes |
 | `scripts/reset_cooldowns.sh` | Out-of-band recovery: clears the `wl_cooldowns` KV record after tamper detection or GUID rotation. | Repo-only | Yes |
 | `scripts/fim_deploy_window.sh` | Operator helper to open/close a FIM deploy window without using the REST API. | Repo-only | Yes |