release: freeze Nexus One AI 1.0.0-rc1

specs/001-enterprise-experience/research.md

@@ -92,3 +92,29 @@ repository contains multiple source and ISO delivery surfaces that can diverge.
 
 **Alternatives considered**: Direct general release after local tests; UI-only acceptance; checksum
 without journey validation. Each leaves a material enterprise-appliance risk untested.
+
+## Decision 9: Four Bootable Products, One Shared Offline Contract
+
+**Decision**: Maintain the Online Universal Server ISO and deliver offline products in this order:
+Workstation, Server S/M, then Server L/Max. Use separate signed large-model packs and one signed
+offline-update format across installed products.
+
+**Rationale**: Category/tier grouping keeps media and validation bounded while a shared artifact
+contract prevents incompatible trust, update, and recovery mechanisms. Workstation provides the first
+complete disconnected proof before the larger Server variants multiply risk.
+
+**Alternatives considered**: One enormous universal offline ISO; one ISO per tier; embedding every
+large model; separate update formats. Rejected because they duplicate payloads, expand media and test
+matrices, and create avoidable operational drift.
+
+## Decision 10: Offline Is an Evidence Claim
+
+**Decision**: “Offline” means successful clean installation and declared local capability with all
+non-loopback networking unavailable from boot through acceptance, not merely embedding source files.
+
+**Rationale**: Package managers, container runtimes, installers, license checks, time services, and
+model tooling can retain hidden fetch dependencies. A disconnected run plus attempted-fetch evidence
+is required to prove the boundary.
+
+**Alternatives considered**: Air-gap only after first boot; DNS blocking alone; code inspection only.
+Each can miss a required dependency or allow a false-positive fallback.