docs(router): clarify stable module guidance

CHANGELOG.md

@@ -30,6 +30,11 @@ Versioning.
 
 ### Documentation
 
+- Clarify the stable v1 support baseline and canonical installation command,
+  expose support and vulnerability-reporting entry points, and correct the
+  security advisory repository identity.
+- Record the latest Go releases-feed digest as behavior-neutral after
+  re-verifying every pinned Go 1.26.6 source and contract binding.
 - Preserve the reviewed Go release and RFC 9110 errata dispositions in an
   append-only upstream authority history.
 - Make the [specification decision register](docs/specification-decisions.md)

README.md

@@ -15,14 +15,21 @@ programming model. It adds deterministic composition, groups, names, safe URL
 generation, metadata, introspection, mounts, and route-scoped middleware while
 keeping handlers as ordinary `http.Handler` values.
 
-The minimum supported toolchain is Go 1.26.6. The package has no runtime
-dependencies and no global router, reflection discovery, controller resolver,
-container, session, template, or application lifecycle.
+The module is active and has a stable v1 API. The minimum supported toolchain
+is Go 1.26.6. The package has no runtime dependencies and no global router,
+reflection discovery, controller resolver, container, session, template, or
+application lifecycle.
 
 See the versioned [Golib ecosystem index](https://github.com/faustbrian/go-library-tools/blob/v1.4.0/docs/ecosystem/README.md)
 and its [service-edge package guidance](https://github.com/faustbrian/go-library-tools/blob/v1.4.0/docs/ecosystem/design-language.md#package-families-and-selection)
 for the shared design language and related packages.
 
+## Installation
+
+```sh
+go get github.com/faustbrian/go-router@v1
+```
+
 ## Five-minute start
 
 ```go
@@ -58,6 +65,8 @@ immutable `http.Handler` safe for concurrent serving and introspection.
 - [Behavior matrices](docs/matrices.md)
 - [Resource limits](docs/limits.md)
 - [Security](docs/security.md)
+- [Support](SUPPORT.md)
+- [Vulnerability reporting](SECURITY.md)
 - [Architecture](docs/architecture.md)
 - [Five-minute quickstarts](docs/quickstart.md)
 - [API reference](docs/api.md)

SECURITY.md

@@ -4,6 +4,6 @@ Security fixes are provided for the latest released major version and the Go
 versions supported by that release.
 
 Do not open a public issue for a suspected vulnerability. Use GitHub's private
-security advisory flow for `faustbrian/router`. Include an impact summary,
+security advisory flow for `faustbrian/go-router`. Include an impact summary,
 affected versions, reproduction, and any suggested mitigation. You should
 receive an acknowledgement within seven days.

docs/README.md

@@ -20,6 +20,8 @@
 
 - [Performance](performance.md)
 - [Security](security.md)
+- [Support](../SUPPORT.md)
+- [Vulnerability reporting](../SECURITY.md)
 
 ## Reference and maintenance
 

specification/monitoring.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "reviewed_at": "2026-09-03",
+  "reviewed_at": "2026-09-06",
   "review_interval_days": 90,
   "authorities": [
     {
@@ -32,7 +32,7 @@
       "kind": "releases",
       "version": "",
       "url": "https://go.dev/dl/?mode=json&include=all",
-      "sha256": "638127a053a86576fc235aa196b26145c6f2fce8ce839ded767212a18d1c9415",
+      "sha256": "1ed915f72633d0a72eaa2f462740153db4fe347cb56f7d1e25ec44868568f13e",
       "specifications": ["Go 1.26.6 net/http and net/url contracts"]
     },
     {

specification/upstream-reviews.md

@@ -5,6 +5,32 @@ by [`monitoring.json`](monitoring.json). A monitoring digest changes only after
 the corresponding upstream delta has been classified against the applicable
 specification decisions.
 
+## 2026-09-06: Go releases feed
+
+- **Authority:** `go-releases`
+- **URL:** https://go.dev/dl/?mode=json&include=all
+- **Previous SHA-256:**
+  `638127a053a86576fc235aa196b26145c6f2fce8ce839ded767212a18d1c9415`
+- **Reviewed SHA-256:**
+  `1ed915f72633d0a72eaa2f462740153db4fe347cb56f7d1e25ec44868568f13e`
+- **Retrieved and reviewed:** 2026-09-06
+- **Applicability:** `ROUTER-DEC-001` and `ROUTER-DEC-005`
+- **Disposition:** Behavior-neutral for the selected Go 1.26.6 contracts.
+
+The current feed retains Go 1.27.1 and Go 1.26.8 as its newest stable patch
+releases, matching the versions classified in the previous review. The prior
+response body was not retained, so this review cannot attribute the byte-level
+feed change to a specific archived download entry. Three consecutive current
+responses were byte-identical.
+
+The Go 1.26.6 feed entry still identifies `go1.26.6.src.tar.gz` with SHA-256
+`a0721c54c688901448d77ad9b3ec7ea7c474730755ff891382e92ecb93ff2cb1`,
+which matches the pinned source archive in `manifest.tsv`. The monitored
+`server.go`, `request.go`, and `url.go` bytes were independently re-fetched
+from the immutable `go1.26.6` tag and continue to match their recorded hashes.
+The selected source, minimum supported Go version, decisions, and executable
+evidence therefore remain unchanged.
+
 ## 2026-09-03: Go releases feed
 
 - **Authority:** `go-releases`