From 303149b4d3e586ba32c1306d1a7d98542142d9d3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 06:12:49 +0900
Subject: [PATCH 01/39] test(accessibility): require toolbar shortcut semantics

---
 src/toolbarShortcutAccessibility.test.tsx | 62 +++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 src/toolbarShortcutAccessibility.test.tsx

diff --git a/src/toolbarShortcutAccessibility.test.tsx b/src/toolbarShortcutAccessibility.test.tsx
new file mode 100644
index 00000000..b21e309d
--- /dev/null
+++ b/src/toolbarShortcutAccessibility.test.tsx
@@ -0,0 +1,62 @@
+import { cleanup, render, screen } from '@testing-library/react';
+import { Editor } from '@tiptap/react';
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { buildExtensions } from './extensions/kit.js';
+import { Toolbar } from './components/Toolbar.js';
+
+const openEditors: Editor[] = [];
+
+function makeEditor(): Editor {
+  const element = document.createElement('div');
+  document.body.appendChild(element);
+  const editor = new Editor({
+    element,
+    extensions: buildExtensions({ image: { maxDimension: 0 } }),
+    content: '<p>shortcut semantics</p>',
+  });
+  openEditors.push(editor);
+  return editor;
+}
+
+afterEach(() => {
+  cleanup();
+  for (const editor of openEditors.splice(0)) {
+    if (!editor.isDestroyed) editor.destroy();
+  }
+});
+
+describe('toolbar shortcut accessibility semantics', () => {
+  it('exposes every advertised cross-platform editor shortcut to assistive technology', () => {
+    const editor = makeEditor();
+    editor.chain().focus().insertContent(' history').run();
+    editor.commands.undo();
+
+    render(<Toolbar editor={editor} />);
+
+    expect(screen.getByRole('button', { name: /Bold/ })).toHaveAttribute(
+      'aria-keyshortcuts',
+      'Control+B Meta+B',
+    );
+    expect(screen.getByRole('button', { name: /Italic/ })).toHaveAttribute(
+      'aria-keyshortcuts',
+      'Control+I Meta+I',
+    );
+    expect(screen.getByRole('button', { name: /Insert\/edit link/ })).toHaveAttribute(
+      'aria-keyshortcuts',
+      'Control+K Meta+K',
+    );
+    expect(screen.getByRole('button', { name: /Undo/ })).toHaveAttribute(
+      'aria-keyshortcuts',
+      'Control+Z Meta+Z',
+    );
+    expect(screen.getByRole('button', { name: /Redo/ })).toHaveAttribute(
+      'aria-keyshortcuts',
+      'Control+Shift+Z Meta+Shift+Z',
+    );
+
+    expect(screen.getByRole('button', { name: /Strikethrough/ })).not.toHaveAttribute(
+      'aria-keyshortcuts',
+    );
+  });
+});

From 29d8c156e40eb0975687ee83053bedf3de7d77a5 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 06:13:28 +0900
Subject: [PATCH 02/39] feat(accessibility): expose editor shortcut semantics

---
 src/components/Toolbar.tsx | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/components/Toolbar.tsx b/src/components/Toolbar.tsx
index 5d5653eb..3731e427 100644
--- a/src/components/Toolbar.tsx
+++ b/src/components/Toolbar.tsx
@@ -24,6 +24,8 @@ interface ButtonProps {
   disabled?: boolean;
   title: string;
   label: string;
+  /** WAI-ARIA key shortcut tokens for shortcuts already implemented by the editor. */
+  keyShortcuts?: string;
 }
 
 const TOOLBAR_ITEM_SELECTOR = 'button[data-cwl-toolbar-item="true"]';
@@ -45,7 +47,14 @@ function setRovingTabStop(
   }
 }
 
-function ToolbarButton({ onClick, active, disabled, title, label }: ButtonProps) {
+function ToolbarButton({
+  onClick,
+  active,
+  disabled,
+  title,
+  label,
+  keyShortcuts,
+}: ButtonProps) {
   return (
     <button
       type="button"
@@ -57,6 +66,7 @@ function ToolbarButton({ onClick, active, disabled, title, label }: ButtonProps)
       disabled={disabled}
       title={title}
       aria-label={title}
+      aria-keyshortcuts={keyShortcuts}
       aria-pressed={active === undefined ? undefined : active}
     >
       {label}
@@ -72,7 +82,9 @@ function ToolbarButton({ onClick, active, disabled, title, label }: ButtonProps)
  * The toolbar follows the WAI-ARIA composite-toolbar keyboard model: it is one
  * tab stop, Left/Right arrows move between enabled controls with wrapping, and
  * Home/End move to the first/last enabled control. `onMouseDown` preserves the
- * editor selection when pointer users invoke a formatting action.
+ * editor selection when pointer users invoke a formatting action. Shortcuts
+ * already implemented by the editor are exposed with `aria-keyshortcuts` so
+ * assistive technology receives the same cross-platform commands as tooltips.
  */
 export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
   const fileInputRef = useRef<HTMLInputElement | null>(null);
@@ -218,12 +230,14 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
         <ToolbarButton
           title="Bold (Ctrl/Cmd+B)"
           label="B"
+          keyShortcuts="Control+B Meta+B"
           active={editor.isActive('bold')}
           onClick={() => editor.chain().focus().toggleBold().run()}
         />
         <ToolbarButton
           title="Italic (Ctrl/Cmd+I)"
           label="I"
+          keyShortcuts="Control+I Meta+I"
           active={editor.isActive('italic')}
           onClick={() => editor.chain().focus().toggleItalic().run()}
         />
@@ -298,6 +312,7 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
         <ToolbarButton
           title="Insert/edit link (Ctrl/Cmd+K)"
           label="🔗"
+          keyShortcuts="Control+K Meta+K"
           active={editor.isActive('link')}
           onClick={setLink}
         />
@@ -366,12 +381,14 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
         <ToolbarButton
           title="Undo (Ctrl/Cmd+Z)"
           label="↶"
+          keyShortcuts="Control+Z Meta+Z"
           disabled={!editor.can().undo()}
           onClick={() => editor.chain().focus().undo().run()}
         />
         <ToolbarButton
           title="Redo (Ctrl/Cmd+Shift+Z)"
           label="↷"
+          keyShortcuts="Control+Shift+Z Meta+Shift+Z"
           disabled={!editor.can().redo()}
           onClick={() => editor.chain().focus().redo().run()}
         />

From 513dcdc26a5cbaef333cf822a2e191f43a3eda70 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 06:15:01 +0900
Subject: [PATCH 03/39] test(docs): require shortcut accessibility evidence

---
 src/toolbarShortcutDocumentation.test.ts | 42 ++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 src/toolbarShortcutDocumentation.test.ts

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
new file mode 100644
index 00000000..cb86c1ea
--- /dev/null
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+const repositoryFile = (path: string): string =>
+  readFileSync(resolve(process.cwd(), path), 'utf8');
+
+describe('toolbar shortcut accessibility documentation', () => {
+  it('documents programmatic shortcut discoverability and its behavior boundary', () => {
+    const accessibility = repositoryFile('docs/accessibility.md');
+
+    expect(accessibility).toContain('`aria-keyshortcuts`');
+    expect(accessibility).toContain('`Control+B Meta+B`');
+    expect(accessibility).toContain('`Control+I Meta+I`');
+    expect(accessibility).toContain('`Control+K Meta+K`');
+    expect(accessibility).toContain('`Control+Z Meta+Z`');
+    expect(accessibility).toContain('`Control+Shift+Z Meta+Shift+Z`');
+    expect(accessibility).toContain(
+      'describes shortcuts that Inkspan already implements; it does not create keyboard behavior',
+    );
+  });
+
+  it('records current standards evidence and release traceability', () => {
+    const accessibility = repositoryFile('docs/accessibility.md');
+    const doctoring = repositoryFile(
+      'docs/doctoring/toolbar-shortcut-discoverability.md',
+    );
+    const changelog = repositoryFile('CHANGELOG.md');
+
+    expect(accessibility).toContain('WAI-ARIA 1.2 `aria-keyshortcuts`');
+    expect(doctoring).toContain(
+      '# Doctoring record: toolbar shortcut discoverability',
+    );
+    expect(doctoring).toContain('## APA 7 references');
+    expect(doctoring).toContain('Accessible Rich Internet Applications (WAI-ARIA) 1.2');
+    expect(doctoring).toContain('Toolbar pattern');
+    expect(doctoring).toContain('303149b4d3e586ba32c1306d1a7d98542142d9d3');
+    expect(doctoring).toContain('29d8c156e40eb0975687ee83053bedf3de7d77a5');
+    expect(changelog).toContain('programmatic toolbar shortcut discoverability');
+  });
+});

From d943a901d4f8e8d86e0367c32d23a262829b1a3f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 06:15:51 +0900
Subject: [PATCH 04/39] docs(accessibility): document shortcut semantics

---
 docs/accessibility.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/accessibility.md b/docs/accessibility.md
index 495bbc91..78ebc170 100644
--- a/docs/accessibility.md
+++ b/docs/accessibility.md
@@ -80,6 +80,8 @@ Disabled table, image, undo, and redo controls are skipped by directional naviga
 
 Toggle controls expose `aria-pressed`; one-shot command buttons do not claim a pressed state. The toolbar declares horizontal orientation and ships visible `:focus-visible` styling, including a forced-colors fallback.
 
+Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+K Meta+K` for link editing, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z` for redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
+
 ## Host responsibilities
 
 Inkspan cannot determine the complete accessibility of an embedding application. Hosts remain responsible for:
@@ -95,8 +97,8 @@ Inkspan cannot determine the complete accessibility of an embedding application.
 - identifying errors in text, supplying known correction guidance, and synchronizing `ariaInvalid` with the visible validation state;
 - preserving sufficient contrast when overriding Inkspan CSS variables;
 - announcing persistence and network failures in an appropriate live region;
-- ensuring surrounding dialogs, forms, and application shortcuts do not trap or steal focus;
-- testing the integrated workflow with representative browsers, screen readers, zoom levels, scripts, writing directions, and input methods.
+- ensuring surrounding dialogs, forms, and application shortcuts do not trap or steal focus, suppress Inkspan's advertised shortcuts, or bind conflicting actions without an equivalent accessible command;
+- testing the integrated workflow with representative browsers, screen readers, zoom levels, scripts, writing directions, input methods, and advertised keyboard shortcuts.
 
 ## Standards basis
 
@@ -107,10 +109,11 @@ Inkspan cannot determine the complete accessibility of an embedding application.
 - [HTML Living Standard: resetting a form](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#resetting-a-form) — the bubbling, cancelable reset event and resettable-control algorithm.
 - [React: queueing state updates](https://react.dev/learn/queueing-a-series-of-state-updates) — state setters request a later render and React batches updates until event handling completes.
 - [WAI-ARIA 1.2 textbox role](https://www.w3.org/TR/wai-aria/#textbox) — accessible name, multiline, readonly, required, invalid, description, and error-message states.
+- [WAI-ARIA 1.2 `aria-keyshortcuts`](https://www.w3.org/TR/wai-aria-1.2/#aria-keyshortcuts) — programmatic exposure of implemented shortcuts, exact modifier tokens, plus-separated key combinations, and space-separated alternatives.
 - [WAI-ARIA APG: Accessible names and descriptions](https://www.w3.org/WAI/ARIA/apg/practices/names-and-descriptions/) — visible-label preference and `aria-labelledby`/`aria-describedby` relationships.
 - [WCAG 2.2, Guideline 3.3 Input Assistance](https://www.w3.org/TR/WCAG22/#input-assistance) — labels or instructions, textual error identification, and correction suggestions.
 - [ARIA in HTML](https://www.w3.org/TR/html-aria/) — valid readonly semantics for custom contenteditable textboxes.
 
 ## Verification
 
-The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.
+The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for every advertised cross-platform formatting/history shortcut, omission of shortcut metadata from controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.

From 6229e0a5c8e225f0a54d4bfba1bc3c1d419ece3e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 06:16:31 +0900
Subject: [PATCH 05/39] docs(doctoring): record shortcut accessibility evidence

---
 .../toolbar-shortcut-discoverability.md       | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 docs/doctoring/toolbar-shortcut-discoverability.md

diff --git a/docs/doctoring/toolbar-shortcut-discoverability.md b/docs/doctoring/toolbar-shortcut-discoverability.md
new file mode 100644
index 00000000..f3f1c2c8
--- /dev/null
+++ b/docs/doctoring/toolbar-shortcut-discoverability.md
@@ -0,0 +1,59 @@
+# Doctoring record: toolbar shortcut discoverability
+
+## Decision
+
+Inkspan exposes every keyboard shortcut already advertised by the built-in formatting toolbar through the WAI-ARIA `aria-keyshortcuts` state on the corresponding native button. The public contract remains descriptive rather than behavioral: the attribute makes existing editor commands programmatically discoverable but does not create, intercept, authorize, or remap keyboard input.
+
+The exact shortcut alternatives are:
+
+- bold: `Control+B Meta+B`;
+- italic: `Control+I Meta+I`;
+- insert/edit link: `Control+K Meta+K`;
+- undo: `Control+Z Meta+Z`; and
+- redo: `Control+Shift+Z Meta+Shift+Z`.
+
+Controls for which Inkspan does not advertise a stable keyboard shortcut do not emit `aria-keyshortcuts`.
+
+## Buyer-visible gap and bounded scope
+
+Before this slice, toolbar titles visibly advertised `Ctrl/Cmd+B`, `Ctrl/Cmd+I`, `Ctrl/Cmd+K`, `Ctrl/Cmd+Z`, and `Ctrl/Cmd+Shift+Z`, while assistive technology received no programmatic shortcut metadata. That asymmetry weakened accessible command discovery in enterprise authoring workflows even though the underlying TipTap/ProseMirror commands already existed.
+
+This repair changes only the editor-owned presentation and accessibility surface. It does not alter document semantics, shortcut execution, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and must preserve an equivalent accessible action when surrounding software intercepts a combination.
+
+## Test-first evidence
+
+The slice was implemented test-first from protected `main` `ca49a3249403be88ba3cb7c9589b3652f820e17c`.
+
+1. RED commit `303149b4d3e586ba32c1306d1a7d98542142d9d3` added `src/toolbarShortcutAccessibility.test.tsx`. The test required the exact WAI-ARIA shortcut strings on the five advertised controls and required an unadvertised control to omit the state. The inherited production toolbar did not emit `aria-keyshortcuts`, so the contract was intentionally unsatisfied.
+2. GREEN production commit `29d8c156e40eb0975687ee83053bedf3de7d77a5` added the optional, documented `keyShortcuts` button property, emitted it through `aria-keyshortcuts`, and bound only the five already-implemented shortcuts. The implementation adds no keyboard event handler or shortcut authority.
+3. Documentation contract commit `513dcdc26a5cbaef333cf822a2e191f43a3eda70` added deterministic assertions for the public accessibility contract, standards evidence, doctoring lineage, and changelog traceability before the corresponding documentation was written.
+
+All exact-head CI, 100% production statement/branch/function/line coverage, security, packaging, review, and branch-protection evidence remains release-gated; no predecessor-head or local-only result is acceptance evidence.
+
+## Standards analysis
+
+WAI-ARIA 1.2 defines `aria-keyshortcuts` as a way to indicate keyboard shortcuts that an author has implemented. Its value is a space-separated list of shortcuts; each shortcut combines zero or more modifier keys and exactly one non-modifier key with plus signs. The normative modifier token is `Control`; `Meta` represents the Meta key and maps to Command on macOS. This supports expressing Windows/Linux and macOS alternatives without inventing the presentation-only `Ctrl/Cmd` abbreviation inside accessibility metadata.
+
+The ARIA Authoring Practices Guide toolbar pattern recommends a single toolbar tab stop with directional movement among controls, with Home/End available as optional navigation. Inkspan already implements that composite interaction. Adding shortcut metadata is therefore complementary: it improves command discoverability without disturbing roving focus, native button activation, disabled-control behavior, or `aria-pressed` state.
+
+## Security, privacy, and ownership boundary
+
+`aria-keyshortcuts` contains only static command metadata. It carries no document content, selection text, tenant identifier, credentials, provider information, persistence validator, local path, or user-specific shortcut history. The values are safe to expose in rendered markup and release evidence.
+
+Inkspan does not use shortcut metadata as an authorization signal. A host that disables, shadows, or intercepts a shortcut remains responsible for its own accessible interaction design. No host may infer document permission or durable operation authority from the presence of a toolbar button or its accessibility state.
+
+## Compatibility and rollback
+
+The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute only on the five mapped buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, title text, focus behavior, and command implementation as before.
+
+Rollback is bounded: remove the five `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
+
+## Evidence boundary
+
+Shareable evidence may include the static shortcut values, committed tests and documentation, exact commit identifiers, and CI/review status. Local assistive-technology recordings, user documents, host application keymaps, tenant policies, credentials, or private interaction telemetry are not required for this repository-level acceptance slice and must not be copied into public release evidence.
+
+## APA 7 references
+
+World Wide Web Consortium. (2023, June 6). *Accessible Rich Internet Applications (WAI-ARIA) 1.2* (W3C Recommendation). https://www.w3.org/TR/wai-aria-1.2/
+
+World Wide Web Consortium. (n.d.). *Toolbar pattern*. ARIA Authoring Practices Guide. Retrieved August 8, 2026, from https://www.w3.org/WAI/ARIA/apg/patterns/toolbar/

From ae8448d10b874fb0006d77667afb32a102c82e61 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 06:17:26 +0900
Subject: [PATCH 06/39] docs(changelog): record shortcut discoverability

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7632ecb2..3d3e99ea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 
 ## [Unreleased]
 
+### Accessibility
+- Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the existing bold, italic, link, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
+- Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives and the descriptive-only accessibility boundary
+
 ### Documentation
 - Added an authoritative standalone and modular MSA architecture contract with reviewable deployment, optimistic-concurrency, data-ownership, security, and acquisition-evidence diagrams and tables
 - Added a beginner-readable naruon compose and ui.panel integration guide covering narrow client hydration, server-selected strong validators, accessible conflict handling, host-owned Yjs lifecycle, contextual-orchestrator boundaries, and local-versus-shareable evidence

From 57f5ef8e21f8351fa04c122e700b43777c9ea57e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 07:17:20 +0900
Subject: [PATCH 07/39] test(accessibility): reject unimplemented link shortcut
 claim

---
 src/toolbarShortcutAccessibility.test.tsx | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/toolbarShortcutAccessibility.test.tsx b/src/toolbarShortcutAccessibility.test.tsx
index b21e309d..71f1b139 100644
--- a/src/toolbarShortcutAccessibility.test.tsx
+++ b/src/toolbarShortcutAccessibility.test.tsx
@@ -27,7 +27,7 @@ afterEach(() => {
 });
 
 describe('toolbar shortcut accessibility semantics', () => {
-  it('exposes every advertised cross-platform editor shortcut to assistive technology', () => {
+  it('exposes implemented cross-platform editor shortcuts to assistive technology', () => {
     const editor = makeEditor();
     editor.chain().focus().insertContent(' history').run();
     editor.commands.undo();
@@ -42,10 +42,6 @@ describe('toolbar shortcut accessibility semantics', () => {
       'aria-keyshortcuts',
       'Control+I Meta+I',
     );
-    expect(screen.getByRole('button', { name: /Insert\/edit link/ })).toHaveAttribute(
-      'aria-keyshortcuts',
-      'Control+K Meta+K',
-    );
     expect(screen.getByRole('button', { name: /Undo/ })).toHaveAttribute(
       'aria-keyshortcuts',
       'Control+Z Meta+Z',
@@ -59,4 +55,14 @@ describe('toolbar shortcut accessibility semantics', () => {
       'aria-keyshortcuts',
     );
   });
+
+  it('does not advertise a link shortcut that the configured Link extension does not implement', () => {
+    const editor = makeEditor();
+
+    render(<Toolbar editor={editor} />);
+
+    const linkButton = screen.getByRole('button', { name: /Insert\/edit link/ });
+    expect(linkButton).not.toHaveAttribute('aria-keyshortcuts');
+    expect(linkButton).not.toHaveAttribute('title', expect.stringContaining('Ctrl/Cmd+K'));
+  });
 });

From e89f51e87e84552247c7080aa61800c7da813e40 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 07:18:45 +0900
Subject: [PATCH 08/39] fix(accessibility): stop claiming unimplemented link
 shortcut

---
 src/components/Toolbar.tsx | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/components/Toolbar.tsx b/src/components/Toolbar.tsx
index 3731e427..c58f0f04 100644
--- a/src/components/Toolbar.tsx
+++ b/src/components/Toolbar.tsx
@@ -310,9 +310,8 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
 
       <div className="cwl-tb-group">
         <ToolbarButton
-          title="Insert/edit link (Ctrl/Cmd+K)"
+          title="Insert/edit link"
           label="🔗"
-          keyShortcuts="Control+K Meta+K"
           active={editor.isActive('link')}
           onClick={setLink}
         />

From 251d660ed9b0aebbffaa0ca715b33eb39aa93729 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 07:19:09 +0900
Subject: [PATCH 09/39] test(docs): bind link shortcut claim to implemented
 behavior

---
 src/toolbarShortcutDocumentation.test.ts | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index cb86c1ea..cea5232a 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -13,12 +13,15 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(accessibility).toContain('`aria-keyshortcuts`');
     expect(accessibility).toContain('`Control+B Meta+B`');
     expect(accessibility).toContain('`Control+I Meta+I`');
-    expect(accessibility).toContain('`Control+K Meta+K`');
+    expect(accessibility).not.toContain('`Control+K Meta+K`');
     expect(accessibility).toContain('`Control+Z Meta+Z`');
     expect(accessibility).toContain('`Control+Shift+Z Meta+Shift+Z`');
     expect(accessibility).toContain(
       'describes shortcuts that Inkspan already implements; it does not create keyboard behavior',
     );
+    expect(accessibility).toContain(
+      'The link control intentionally does not advertise a keyboard shortcut',
+    );
   });
 
   it('records current standards evidence and release traceability', () => {
@@ -35,8 +38,13 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(doctoring).toContain('## APA 7 references');
     expect(doctoring).toContain('Accessible Rich Internet Applications (WAI-ARIA) 1.2');
     expect(doctoring).toContain('Toolbar pattern');
-    expect(doctoring).toContain('303149b4d3e586ba32c1306d1a7d98542142d9d3');
-    expect(doctoring).toContain('29d8c156e40eb0975687ee83053bedf3de7d77a5');
+    expect(doctoring).toContain(
+      'The configured Tiptap Link extension does not bind a keyboard shortcut',
+    );
+    expect(doctoring).toContain('Tiptap. (n.d.). *Link extension*');
+    expect(doctoring).toContain('57f5ef8e21f8351fa04c122e700b43777c9ea57e');
+    expect(doctoring).toContain('e89f51e87e84552247c7080aa61800c7da813e40');
     expect(changelog).toContain('programmatic toolbar shortcut discoverability');
+    expect(changelog).toContain('unimplemented link shortcut claim');
   });
 });

From 3bd1dd3df8dba3a19a2b66d9cbd765ebde965c26 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 07:19:56 +0900
Subject: [PATCH 10/39] docs(accessibility): document only implemented
 shortcuts

---
 docs/accessibility.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/docs/accessibility.md b/docs/accessibility.md
index 78ebc170..86d6ab3f 100644
--- a/docs/accessibility.md
+++ b/docs/accessibility.md
@@ -80,7 +80,9 @@ Disabled table, image, undo, and redo controls are skipped by directional naviga
 
 Toggle controls expose `aria-pressed`; one-shot command buttons do not claim a pressed state. The toolbar declares horizontal orientation and ships visible `:focus-visible` styling, including a forced-colors fallback.
 
-Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+K Meta+K` for link editing, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z` for redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
+Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z` for redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
+
+The link control intentionally does not advertise a keyboard shortcut. Inkspan's configured Tiptap Link extension does not bind one, so the toolbar neither emits `aria-keyshortcuts` nor labels the link action as `Ctrl/Cmd+K`. A host that deliberately adds its own link shortcut remains responsible for implementing, documenting, conflict-testing, and exposing that host-owned binding accessibly.
 
 ## Host responsibilities
 
@@ -110,10 +112,11 @@ Inkspan cannot determine the complete accessibility of an embedding application.
 - [React: queueing state updates](https://react.dev/learn/queueing-a-series-of-state-updates) — state setters request a later render and React batches updates until event handling completes.
 - [WAI-ARIA 1.2 textbox role](https://www.w3.org/TR/wai-aria/#textbox) — accessible name, multiline, readonly, required, invalid, description, and error-message states.
 - [WAI-ARIA 1.2 `aria-keyshortcuts`](https://www.w3.org/TR/wai-aria-1.2/#aria-keyshortcuts) — programmatic exposure of implemented shortcuts, exact modifier tokens, plus-separated key combinations, and space-separated alternatives.
+- [Tiptap Link extension](https://tiptap.dev/docs/editor/extensions/marks/link) — the configured link extension provides commands and link behavior but no default keyboard shortcut.
 - [WAI-ARIA APG: Accessible names and descriptions](https://www.w3.org/WAI/ARIA/apg/practices/names-and-descriptions/) — visible-label preference and `aria-labelledby`/`aria-describedby` relationships.
 - [WCAG 2.2, Guideline 3.3 Input Assistance](https://www.w3.org/TR/WCAG22/#input-assistance) — labels or instructions, textual error identification, and correction suggestions.
 - [ARIA in HTML](https://www.w3.org/TR/html-aria/) — valid readonly semantics for custom contenteditable textboxes.
 
 ## Verification
 
-The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for every advertised cross-platform formatting/history shortcut, omission of shortcut metadata from controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.
+The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for implemented cross-platform formatting/history shortcuts, omission of shortcut metadata and shortcut labeling from the link control because the configured Link extension does not implement one, omission of shortcut metadata from other controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.

From 20925ba4134b7ed124a8edc390df2748b39f02a4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 07:20:34 +0900
Subject: [PATCH 11/39] docs(doctoring): correct link shortcut evidence

---
 .../toolbar-shortcut-discoverability.md       | 30 ++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/docs/doctoring/toolbar-shortcut-discoverability.md b/docs/doctoring/toolbar-shortcut-discoverability.md
index f3f1c2c8..8b18e114 100644
--- a/docs/doctoring/toolbar-shortcut-discoverability.md
+++ b/docs/doctoring/toolbar-shortcut-discoverability.md
@@ -2,31 +2,35 @@
 
 ## Decision
 
-Inkspan exposes every keyboard shortcut already advertised by the built-in formatting toolbar through the WAI-ARIA `aria-keyshortcuts` state on the corresponding native button. The public contract remains descriptive rather than behavioral: the attribute makes existing editor commands programmatically discoverable but does not create, intercept, authorize, or remap keyboard input.
+Inkspan exposes only keyboard shortcuts that the configured editor actually implements through the WAI-ARIA `aria-keyshortcuts` state on the corresponding native toolbar button. The public contract remains descriptive rather than behavioral: the attribute makes existing editor commands programmatically discoverable but does not create, intercept, authorize, or remap keyboard input.
 
-The exact shortcut alternatives are:
+The exact built-in shortcut alternatives are:
 
 - bold: `Control+B Meta+B`;
 - italic: `Control+I Meta+I`;
-- insert/edit link: `Control+K Meta+K`;
 - undo: `Control+Z Meta+Z`; and
 - redo: `Control+Shift+Z Meta+Shift+Z`.
 
-Controls for which Inkspan does not advertise a stable keyboard shortcut do not emit `aria-keyshortcuts`.
+The link control intentionally has no `aria-keyshortcuts` value. The configured Tiptap Link extension does not bind a keyboard shortcut, and Inkspan's `SafeLink` extension adds URI validation plus transaction filtering without adding an `addKeyboardShortcuts` implementation. The toolbar therefore no longer labels link editing as `Ctrl/Cmd+K`. Controls for which Inkspan does not implement a stable keyboard shortcut do not emit `aria-keyshortcuts`.
 
 ## Buyer-visible gap and bounded scope
 
-Before this slice, toolbar titles visibly advertised `Ctrl/Cmd+B`, `Ctrl/Cmd+I`, `Ctrl/Cmd+K`, `Ctrl/Cmd+Z`, and `Ctrl/Cmd+Shift+Z`, while assistive technology received no programmatic shortcut metadata. That asymmetry weakened accessible command discovery in enterprise authoring workflows even though the underlying TipTap/ProseMirror commands already existed.
+Before this slice, implemented bold, italic, undo, and redo shortcuts appeared in toolbar titles while assistive technology received no programmatic shortcut metadata. That asymmetry weakened accessible command discovery in enterprise authoring workflows.
 
-This repair changes only the editor-owned presentation and accessibility surface. It does not alter document semantics, shortcut execution, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and must preserve an equivalent accessible action when surrounding software intercepts a combination.
+The first implementation pass also treated the pre-existing `Ctrl/Cmd+K` link title as proof that a link shortcut existed. Current authoritative Tiptap documentation explicitly identifies the Link extension as having no keyboard shortcut, and repository inspection confirms `SafeLink` does not add one. Advertising `Control+K Meta+K` would therefore have created false accessibility metadata and retained a misleading visible tooltip. The repair removes that false claim rather than inventing a new keyboard behavior inside an accessibility-metadata change.
+
+This repair changes only the editor-owned presentation and accessibility surface. It does not alter document semantics, implemented shortcut execution, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and any host-added link shortcut.
 
 ## Test-first evidence
 
 The slice was implemented test-first from protected `main` `ca49a3249403be88ba3cb7c9589b3652f820e17c`.
 
-1. RED commit `303149b4d3e586ba32c1306d1a7d98542142d9d3` added `src/toolbarShortcutAccessibility.test.tsx`. The test required the exact WAI-ARIA shortcut strings on the five advertised controls and required an unadvertised control to omit the state. The inherited production toolbar did not emit `aria-keyshortcuts`, so the contract was intentionally unsatisfied.
-2. GREEN production commit `29d8c156e40eb0975687ee83053bedf3de7d77a5` added the optional, documented `keyShortcuts` button property, emitted it through `aria-keyshortcuts`, and bound only the five already-implemented shortcuts. The implementation adds no keyboard event handler or shortcut authority.
+1. RED commit `303149b4d3e586ba32c1306d1a7d98542142d9d3` added the initial shortcut metadata contract before production support.
+2. GREEN commit `29d8c156e40eb0975687ee83053bedf3de7d77a5` added the optional, documented `keyShortcuts` button property and emitted it through `aria-keyshortcuts`.
 3. Documentation contract commit `513dcdc26a5cbaef333cf822a2e191f43a3eda70` added deterministic assertions for the public accessibility contract, standards evidence, doctoring lineage, and changelog traceability before the corresponding documentation was written.
+4. Independent source verification then found that the link shortcut assumption was invalid: Tiptap's Link extension does not bind a shortcut, and Inkspan's configured `SafeLink` adds none. RED commit `57f5ef8e21f8351fa04c122e700b43777c9ea57e` changed the accessibility regression to reject `aria-keyshortcuts` and `Ctrl/Cmd+K` on the link button while production still advertised both.
+5. GREEN production commit `e89f51e87e84552247c7080aa61800c7da813e40` removed only the false link shortcut metadata and visible shortcut label while preserving the link button's existing prompt-driven command.
+6. Documentation RED commit `251d660ed9b0aebbffaa0ca715b33eb39aa93729` bound the public contract to the implemented-shortcut boundary and official Tiptap Link documentation before the explanatory documents were corrected.
 
 All exact-head CI, 100% production statement/branch/function/line coverage, security, packaging, review, and branch-protection evidence remains release-gated; no predecessor-head or local-only result is acceptance evidence.
 
@@ -36,17 +40,19 @@ WAI-ARIA 1.2 defines `aria-keyshortcuts` as a way to indicate keyboard shortcuts
 
 The ARIA Authoring Practices Guide toolbar pattern recommends a single toolbar tab stop with directional movement among controls, with Home/End available as optional navigation. Inkspan already implements that composite interaction. Adding shortcut metadata is therefore complementary: it improves command discoverability without disturbing roving focus, native button activation, disabled-control behavior, or `aria-pressed` state.
 
+Tiptap's official Link extension documentation states that the extension provides no keyboard shortcut and suggests that applications may choose to open custom link UI from their own `Mod-k` binding. Inkspan does not currently implement such a binding. Descriptive ARIA metadata must follow the shipped behavior rather than imply a future or host-specific shortcut.
+
 ## Security, privacy, and ownership boundary
 
 `aria-keyshortcuts` contains only static command metadata. It carries no document content, selection text, tenant identifier, credentials, provider information, persistence validator, local path, or user-specific shortcut history. The values are safe to expose in rendered markup and release evidence.
 
-Inkspan does not use shortcut metadata as an authorization signal. A host that disables, shadows, or intercepts a shortcut remains responsible for its own accessible interaction design. No host may infer document permission or durable operation authority from the presence of a toolbar button or its accessibility state.
+Inkspan does not use shortcut metadata as an authorization signal. A host that disables, shadows, intercepts, or adds a shortcut remains responsible for its own accessible interaction design. No host may infer document permission or durable operation authority from the presence of a toolbar button or its accessibility state.
 
 ## Compatibility and rollback
 
-The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute only on the five mapped buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, title text, focus behavior, and command implementation as before.
+The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute only on the four mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Link editing retains its existing button and prompt-driven command; only the unsupported shortcut claim is removed.
 
-Rollback is bounded: remove the five `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
+Rollback is bounded: remove the four `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
 
 ## Evidence boundary
 
@@ -54,6 +60,8 @@ Shareable evidence may include the static shortcut values, committed tests and d
 
 ## APA 7 references
 
+Tiptap. (n.d.). *Link extension*. Tiptap Editor Docs. Retrieved August 8, 2026, from https://tiptap.dev/docs/editor/extensions/marks/link
+
 World Wide Web Consortium. (2023, June 6). *Accessible Rich Internet Applications (WAI-ARIA) 1.2* (W3C Recommendation). https://www.w3.org/TR/wai-aria-1.2/
 
 World Wide Web Consortium. (n.d.). *Toolbar pattern*. ARIA Authoring Practices Guide. Retrieved August 8, 2026, from https://www.w3.org/WAI/ARIA/apg/patterns/toolbar/

From 3cfdc68405db41522853ef98a46712c33f9921b1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 07:21:12 +0900
Subject: [PATCH 12/39] docs(changelog): record implemented-shortcut boundary

---
 CHANGELOG.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d3e99ea..c5a1f61d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,9 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 ## [Unreleased]
 
 ### Accessibility
-- Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the existing bold, italic, link, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
-- Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives and the descriptive-only accessibility boundary
+- Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
+- Removed the unimplemented link shortcut claim from both `aria-keyshortcuts` and the visible link tooltip after authoritative Tiptap Link documentation and the configured `SafeLink` extension confirmed that Inkspan does not bind `Ctrl/Cmd+K`
+- Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives, the descriptive-only accessibility boundary, and omission of unsupported shortcut claims
 
 ### Documentation
 - Added an authoritative standalone and modular MSA architecture contract with reviewable deployment, optimistic-concurrency, data-ownership, security, and acquisition-evidence diagrams and tables

From 9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:12:22 +0900
Subject: [PATCH 13/39] test(accessibility): bind README to implemented link
 shortcuts

---
 src/toolbarShortcutDocumentation.test.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index cea5232a..d30c55c6 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -24,6 +24,15 @@ describe('toolbar shortcut accessibility documentation', () => {
     );
   });
 
+  it('keeps buyer-facing README link guidance within the implemented shortcut boundary', () => {
+    const readme = repositoryFile('README.md').replace(/\s+/g, ' ');
+
+    expect(readme).toContain(
+      'Inkspan applies one link policy to initial content, toolbar commands, pasted/autolinked URLs',
+    );
+    expect(readme).not.toContain('toolbar and Ctrl/Cmd+K commands');
+  });
+
   it('records current standards evidence and release traceability', () => {
     const accessibility = repositoryFile('docs/accessibility.md');
     const doctoring = repositoryFile(

From a6c472e9b2aa3ec0f4cbf9663613243ed410faab Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:19:38 +0900
Subject: [PATCH 14/39] docs(accessibility): remove stale link shortcut claim

---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index fb2bbef9..93896e5c 100644
--- a/README.md
+++ b/README.md
@@ -257,9 +257,9 @@ contract and host responsibilities.
 
 ### Safe hyperlink boundary
 
-Inkspan applies one link policy to initial content, toolbar and Ctrl/Cmd+K
-commands, pasted/autolinked URLs, direct ProseMirror transactions, collaborative
-changes, and HTML output. Accepted targets are credential-free HTTP(S),
+Inkspan applies one link policy to initial content, toolbar commands,
+pasted/autolinked URLs, direct ProseMirror transactions, collaborative changes,
+and HTML output. Accepted targets are credential-free HTTP(S),
 non-empty `mailto:` and `tel:`, ordinary document-relative paths, query-only
 references, and fragments.
 

From 8ffa71914ec7cdb62176db19045378e30a075ee2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:20:25 +0900
Subject: [PATCH 15/39] test(accessibility): bind README correction to release
 evidence

---
 src/toolbarShortcutDocumentation.test.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index d30c55c6..5b1f7ef8 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -50,10 +50,12 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(doctoring).toContain(
       'The configured Tiptap Link extension does not bind a keyboard shortcut',
     );
+    expect(doctoring).toContain('buyer-facing README');
     expect(doctoring).toContain('Tiptap. (n.d.). *Link extension*');
     expect(doctoring).toContain('57f5ef8e21f8351fa04c122e700b43777c9ea57e');
     expect(doctoring).toContain('e89f51e87e84552247c7080aa61800c7da813e40');
     expect(changelog).toContain('programmatic toolbar shortcut discoverability');
     expect(changelog).toContain('unimplemented link shortcut claim');
+    expect(changelog).toContain('buyer-facing README guidance');
   });
 });

From 312033a67ef79f5af910d445961c0f2d7edb2e37 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:20:59 +0900
Subject: [PATCH 16/39] docs(accessibility): record README shortcut correction

---
 docs/doctoring/toolbar-shortcut-discoverability.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/doctoring/toolbar-shortcut-discoverability.md b/docs/doctoring/toolbar-shortcut-discoverability.md
index 8b18e114..6c12d96e 100644
--- a/docs/doctoring/toolbar-shortcut-discoverability.md
+++ b/docs/doctoring/toolbar-shortcut-discoverability.md
@@ -19,6 +19,8 @@ Before this slice, implemented bold, italic, undo, and redo shortcuts appeared i
 
 The first implementation pass also treated the pre-existing `Ctrl/Cmd+K` link title as proof that a link shortcut existed. Current authoritative Tiptap documentation explicitly identifies the Link extension as having no keyboard shortcut, and repository inspection confirms `SafeLink` does not add one. Advertising `Control+K Meta+K` would therefore have created false accessibility metadata and retained a misleading visible tooltip. The repair removes that false claim rather than inventing a new keyboard behavior inside an accessibility-metadata change.
 
+A follow-up exact-head documentation sweep found the buyer-facing README still described Inkspan's link policy as covering `Ctrl/Cmd+K` commands even after the unsupported toolbar claim had been removed. RED commit `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` bound the README to the implemented-shortcut boundary, and GREEN commit `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` removed that stale behavioral claim while preserving the link-policy description itself. This closes the same buyer-visible truthfulness defect across UI metadata and product documentation; it does not add a link shortcut.
+
 This repair changes only the editor-owned presentation and accessibility surface. It does not alter document semantics, implemented shortcut execution, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and any host-added link shortcut.
 
 ## Test-first evidence
@@ -31,6 +33,9 @@ The slice was implemented test-first from protected `main` `ca49a3249403be88ba3c
 4. Independent source verification then found that the link shortcut assumption was invalid: Tiptap's Link extension does not bind a shortcut, and Inkspan's configured `SafeLink` adds none. RED commit `57f5ef8e21f8351fa04c122e700b43777c9ea57e` changed the accessibility regression to reject `aria-keyshortcuts` and `Ctrl/Cmd+K` on the link button while production still advertised both.
 5. GREEN production commit `e89f51e87e84552247c7080aa61800c7da813e40` removed only the false link shortcut metadata and visible shortcut label while preserving the link button's existing prompt-driven command.
 6. Documentation RED commit `251d660ed9b0aebbffaa0ca715b33eb39aa93729` bound the public contract to the implemented-shortcut boundary and official Tiptap Link documentation before the explanatory documents were corrected.
+7. Buyer-facing documentation RED commit `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` required the README to stop presenting the unimplemented `Ctrl/Cmd+K` behavior as part of Inkspan's link-policy command surface.
+8. Buyer-facing documentation GREEN commit `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` corrected the README without changing the underlying safe-link policy or link command.
+9. Release-evidence RED commit `8ffa71914ec7cdb62176db19045378e30a075ee2` requires both this doctoring record and the active changelog to retain the README correction as acquisition-review evidence.
 
 All exact-head CI, 100% production statement/branch/function/line coverage, security, packaging, review, and branch-protection evidence remains release-gated; no predecessor-head or local-only result is acceptance evidence.
 

From ddc00c0ce13cdf8a2f511c1dd198e4a26ff123a8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:21:48 +0900
Subject: [PATCH 17/39] docs(changelog): record README shortcut correction

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c5a1f61d..2adca4ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 
 ### Accessibility
 - Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
-- Removed the unimplemented link shortcut claim from both `aria-keyshortcuts` and the visible link tooltip after authoritative Tiptap Link documentation and the configured `SafeLink` extension confirmed that Inkspan does not bind `Ctrl/Cmd+K`
+- Removed the unimplemented link shortcut claim from `aria-keyshortcuts`, the visible link tooltip, and buyer-facing README guidance after authoritative Tiptap Link documentation and the configured `SafeLink` extension confirmed that Inkspan does not bind `Ctrl/Cmd+K`
 - Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives, the descriptive-only accessibility boundary, and omission of unsupported shortcut claims
 
 ### Documentation

From 11439733245d76c6dc3b58f4fb9bf2105ac94b43 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:23:12 +0900
Subject: [PATCH 18/39] test(accessibility): cover alternate redo shortcut

---
 src/toolbarShortcutAccessibility.test.tsx | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/toolbarShortcutAccessibility.test.tsx b/src/toolbarShortcutAccessibility.test.tsx
index 71f1b139..9964afde 100644
--- a/src/toolbarShortcutAccessibility.test.tsx
+++ b/src/toolbarShortcutAccessibility.test.tsx
@@ -46,9 +46,14 @@ describe('toolbar shortcut accessibility semantics', () => {
       'aria-keyshortcuts',
       'Control+Z Meta+Z',
     );
-    expect(screen.getByRole('button', { name: /Redo/ })).toHaveAttribute(
+    const redoButton = screen.getByRole('button', { name: /Redo/ });
+    expect(redoButton).toHaveAttribute(
       'aria-keyshortcuts',
-      'Control+Shift+Z Meta+Shift+Z',
+      'Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y',
+    );
+    expect(redoButton).toHaveAttribute(
+      'title',
+      'Redo (Ctrl/Cmd+Shift+Z or Ctrl/Cmd+Y)',
     );
 
     expect(screen.getByRole('button', { name: /Strikethrough/ })).not.toHaveAttribute(

From bc634bf2f3237e58156ad68691b140ab90718992 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:23:58 +0900
Subject: [PATCH 19/39] fix(accessibility): expose alternate redo shortcut

---
 src/components/Toolbar.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/components/Toolbar.tsx b/src/components/Toolbar.tsx
index c58f0f04..8eeebf79 100644
--- a/src/components/Toolbar.tsx
+++ b/src/components/Toolbar.tsx
@@ -385,9 +385,9 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
           onClick={() => editor.chain().focus().undo().run()}
         />
         <ToolbarButton
-          title="Redo (Ctrl/Cmd+Shift+Z)"
+          title="Redo (Ctrl/Cmd+Shift+Z or Ctrl/Cmd+Y)"
           label="↷"
-          keyShortcuts="Control+Shift+Z Meta+Shift+Z"
+          keyShortcuts="Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y"
           disabled={!editor.can().redo()}
           onClick={() => editor.chain().focus().redo().run()}
         />

From 52d38471cbc24be5792d7a32bf2319a039668622 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:24:30 +0900
Subject: [PATCH 20/39] test(accessibility): bind redo alternatives to public
 evidence

---
 src/toolbarShortcutDocumentation.test.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index 5b1f7ef8..55527fe1 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -15,7 +15,9 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(accessibility).toContain('`Control+I Meta+I`');
     expect(accessibility).not.toContain('`Control+K Meta+K`');
     expect(accessibility).toContain('`Control+Z Meta+Z`');
-    expect(accessibility).toContain('`Control+Shift+Z Meta+Shift+Z`');
+    expect(accessibility).toContain(
+      '`Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`',
+    );
     expect(accessibility).toContain(
       'describes shortcuts that Inkspan already implements; it does not create keyboard behavior',
     );
@@ -52,10 +54,13 @@ describe('toolbar shortcut accessibility documentation', () => {
     );
     expect(doctoring).toContain('buyer-facing README');
     expect(doctoring).toContain('Tiptap. (n.d.). *Link extension*');
+    expect(doctoring).toContain('Tiptap. (n.d.). *Undo/Redo extension*');
+    expect(doctoring).toContain('Control+Y Meta+Y');
     expect(doctoring).toContain('57f5ef8e21f8351fa04c122e700b43777c9ea57e');
     expect(doctoring).toContain('e89f51e87e84552247c7080aa61800c7da813e40');
     expect(changelog).toContain('programmatic toolbar shortcut discoverability');
     expect(changelog).toContain('unimplemented link shortcut claim');
     expect(changelog).toContain('buyer-facing README guidance');
+    expect(changelog).toContain('Control+Y Meta+Y');
   });
 });

From 877ee37ecb1d97fa447db77869f2193530e45a31 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:25:15 +0900
Subject: [PATCH 21/39] docs(accessibility): document alternate redo shortcut

---
 docs/accessibility.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/accessibility.md b/docs/accessibility.md
index 86d6ab3f..9d96de4d 100644
--- a/docs/accessibility.md
+++ b/docs/accessibility.md
@@ -80,7 +80,7 @@ Disabled table, image, undo, and redo controls are skipped by directional naviga
 
 Toggle controls expose `aria-pressed`; one-shot command buttons do not claim a pressed state. The toolbar declares horizontal orientation and ships visible `:focus-visible` styling, including a forced-colors fallback.
 
-Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z` for redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
+Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y` for redo. The redo alternatives reflect Tiptap's configured history and collaboration behavior: both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` invoke redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
 
 The link control intentionally does not advertise a keyboard shortcut. Inkspan's configured Tiptap Link extension does not bind one, so the toolbar neither emits `aria-keyshortcuts` nor labels the link action as `Ctrl/Cmd+K`. A host that deliberately adds its own link shortcut remains responsible for implementing, documenting, conflict-testing, and exposing that host-owned binding accessibly.
 
@@ -112,6 +112,8 @@ Inkspan cannot determine the complete accessibility of an embedding application.
 - [React: queueing state updates](https://react.dev/learn/queueing-a-series-of-state-updates) — state setters request a later render and React batches updates until event handling completes.
 - [WAI-ARIA 1.2 textbox role](https://www.w3.org/TR/wai-aria/#textbox) — accessible name, multiline, readonly, required, invalid, description, and error-message states.
 - [WAI-ARIA 1.2 `aria-keyshortcuts`](https://www.w3.org/TR/wai-aria-1.2/#aria-keyshortcuts) — programmatic exposure of implemented shortcuts, exact modifier tokens, plus-separated key combinations, and space-separated alternatives.
+- [Tiptap Undo/Redo extension](https://tiptap.dev/docs/editor/extensions/functionality/undo-redo) — the editor's history behavior includes both Shift+Control/Cmd+Z and Control/Cmd+Y redo alternatives.
+- [Tiptap Collaboration extension](https://tiptap.dev/docs/editor/extensions/functionality/collaboration) — collaborative history provides the same two redo alternatives while host-owned collaboration remains separate from accessibility metadata.
 - [Tiptap Link extension](https://tiptap.dev/docs/editor/extensions/marks/link) — the configured link extension provides commands and link behavior but no default keyboard shortcut.
 - [WAI-ARIA APG: Accessible names and descriptions](https://www.w3.org/WAI/ARIA/apg/practices/names-and-descriptions/) — visible-label preference and `aria-labelledby`/`aria-describedby` relationships.
 - [WCAG 2.2, Guideline 3.3 Input Assistance](https://www.w3.org/TR/WCAG22/#input-assistance) — labels or instructions, textual error identification, and correction suggestions.
@@ -119,4 +121,4 @@ Inkspan cannot determine the complete accessibility of an embedding application.
 
 ## Verification
 
-The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for implemented cross-platform formatting/history shortcuts, omission of shortcut metadata and shortcut labeling from the link control because the configured Link extension does not implement one, omission of shortcut metadata from other controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.
+The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for implemented cross-platform formatting/history shortcuts including both documented redo alternatives, omission of shortcut metadata and shortcut labeling from the link control because the configured Link extension does not implement one, omission of shortcut metadata from other controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.

From 02c0c9c7e4d0d8037fe3c23be6e318ea795d8e2e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:26:04 +0900
Subject: [PATCH 22/39] docs(accessibility): doctor alternate redo bindings

---
 .../toolbar-shortcut-discoverability.md        | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/docs/doctoring/toolbar-shortcut-discoverability.md b/docs/doctoring/toolbar-shortcut-discoverability.md
index 6c12d96e..38b29e47 100644
--- a/docs/doctoring/toolbar-shortcut-discoverability.md
+++ b/docs/doctoring/toolbar-shortcut-discoverability.md
@@ -9,9 +9,9 @@ The exact built-in shortcut alternatives are:
 - bold: `Control+B Meta+B`;
 - italic: `Control+I Meta+I`;
 - undo: `Control+Z Meta+Z`; and
-- redo: `Control+Shift+Z Meta+Shift+Z`.
+- redo: `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`.
 
-The link control intentionally has no `aria-keyshortcuts` value. The configured Tiptap Link extension does not bind a keyboard shortcut, and Inkspan's `SafeLink` extension adds URI validation plus transaction filtering without adding an `addKeyboardShortcuts` implementation. The toolbar therefore no longer labels link editing as `Ctrl/Cmd+K`. Controls for which Inkspan does not implement a stable keyboard shortcut do not emit `aria-keyshortcuts`.
+The redo metadata intentionally exposes both shortcut families implemented by the configured Tiptap history behavior: `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y`. The link control intentionally has no `aria-keyshortcuts` value. The configured Tiptap Link extension does not bind a keyboard shortcut, and Inkspan's `SafeLink` extension adds URI validation plus transaction filtering without adding an `addKeyboardShortcuts` implementation. The toolbar therefore no longer labels link editing as `Ctrl/Cmd+K`. Controls for which Inkspan does not implement a stable keyboard shortcut do not emit `aria-keyshortcuts`.
 
 ## Buyer-visible gap and bounded scope
 
@@ -21,6 +21,8 @@ The first implementation pass also treated the pre-existing `Ctrl/Cmd+K` link ti
 
 A follow-up exact-head documentation sweep found the buyer-facing README still described Inkspan's link policy as covering `Ctrl/Cmd+K` commands even after the unsupported toolbar claim had been removed. RED commit `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` bound the README to the implemented-shortcut boundary, and GREEN commit `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` removed that stale behavioral claim while preserving the link-policy description itself. This closes the same buyer-visible truthfulness defect across UI metadata and product documentation; it does not add a link shortcut.
 
+Exact dependency review after current-head automated feedback found a second asymmetry: Inkspan advertised only `Ctrl/Cmd+Shift+Z` for redo even though the configured Tiptap history and collaboration behavior also implements `Ctrl/Cmd+Y`. Current official Tiptap Undo/Redo and Collaboration documentation independently lists both redo alternatives. RED commit `11439733245d76c6dc3b58f4fb9bf2105ac94b43` bound the toolbar to both alternatives before production changed; GREEN commit `bc634bf2f3237e58156ad68691b140ab90718992` then added only the missing redo metadata and visible title alternative. No new keyboard behavior was invented.
+
 This repair changes only the editor-owned presentation and accessibility surface. It does not alter document semantics, implemented shortcut execution, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and any host-added link shortcut.
 
 ## Test-first evidence
@@ -36,6 +38,10 @@ The slice was implemented test-first from protected `main` `ca49a3249403be88ba3c
 7. Buyer-facing documentation RED commit `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` required the README to stop presenting the unimplemented `Ctrl/Cmd+K` behavior as part of Inkspan's link-policy command surface.
 8. Buyer-facing documentation GREEN commit `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` corrected the README without changing the underlying safe-link policy or link command.
 9. Release-evidence RED commit `8ffa71914ec7cdb62176db19045378e30a075ee2` requires both this doctoring record and the active changelog to retain the README correction as acquisition-review evidence.
+10. Redo-alternative RED commit `11439733245d76c6dc3b58f4fb9bf2105ac94b43` required the redo button to expose the already-implemented `Control+Y Meta+Y` alternative and corresponding visible title before production was changed.
+11. Redo-alternative GREEN commit `bc634bf2f3237e58156ad68691b140ab90718992` added the missing redo alternative without modifying editor command behavior.
+12. Redo documentation RED commit `52d38471cbc24be5792d7a32bf2319a039668622` bound public accessibility guidance, doctoring, release traceability, and the official Tiptap Undo/Redo source before documentation was updated.
+13. Accessibility documentation GREEN commit `877ee37ecb1d97fa447db77869f2193530e45a31` records both redo alternatives and the current official Tiptap history/collaboration basis.
 
 All exact-head CI, 100% production statement/branch/function/line coverage, security, packaging, review, and branch-protection evidence remains release-gated; no predecessor-head or local-only result is acceptance evidence.
 
@@ -45,6 +51,8 @@ WAI-ARIA 1.2 defines `aria-keyshortcuts` as a way to indicate keyboard shortcuts
 
 The ARIA Authoring Practices Guide toolbar pattern recommends a single toolbar tab stop with directional movement among controls, with Home/End available as optional navigation. Inkspan already implements that composite interaction. Adding shortcut metadata is therefore complementary: it improves command discoverability without disturbing roving focus, native button activation, disabled-control behavior, or `aria-pressed` state.
 
+Tiptap's official Undo/Redo documentation lists redo as `Shift+Control+Z` or `Control+Y` on Windows/Linux and `Shift+Cmd+Z` or `Cmd+Y` on macOS. Its Collaboration extension documents the same two redo alternatives for collaborative history. Because Inkspan uses the corresponding configured Tiptap history mechanisms rather than a custom redo keymap, `Control+Y Meta+Y` is shipped behavior that must be represented alongside `Control+Shift+Z Meta+Shift+Z` in descriptive accessibility metadata.
+
 Tiptap's official Link extension documentation states that the extension provides no keyboard shortcut and suggests that applications may choose to open custom link UI from their own `Mod-k` binding. Inkspan does not currently implement such a binding. Descriptive ARIA metadata must follow the shipped behavior rather than imply a future or host-specific shortcut.
 
 ## Security, privacy, and ownership boundary
@@ -55,7 +63,7 @@ Inkspan does not use shortcut metadata as an authorization signal. A host that d
 
 ## Compatibility and rollback
 
-The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute only on the four mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Link editing retains its existing button and prompt-driven command; only the unsupported shortcut claim is removed.
+The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute only on the four mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Redo retains the same TipTap command while exposing both existing key bindings; link editing retains its existing button and prompt-driven command while omitting an unsupported link shortcut claim.
 
 Rollback is bounded: remove the four `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
 
@@ -65,8 +73,12 @@ Shareable evidence may include the static shortcut values, committed tests and d
 
 ## APA 7 references
 
+Tiptap. (n.d.). *Collaboration extension*. Tiptap Editor Docs. Retrieved August 8, 2026, from https://tiptap.dev/docs/editor/extensions/functionality/collaboration
+
 Tiptap. (n.d.). *Link extension*. Tiptap Editor Docs. Retrieved August 8, 2026, from https://tiptap.dev/docs/editor/extensions/marks/link
 
+Tiptap. (n.d.). *Undo/Redo extension*. Tiptap Editor Docs. Retrieved August 8, 2026, from https://tiptap.dev/docs/editor/extensions/functionality/undo-redo
+
 World Wide Web Consortium. (2023, June 6). *Accessible Rich Internet Applications (WAI-ARIA) 1.2* (W3C Recommendation). https://www.w3.org/TR/wai-aria-1.2/
 
 World Wide Web Consortium. (n.d.). *Toolbar pattern*. ARIA Authoring Practices Guide. Retrieved August 8, 2026, from https://www.w3.org/WAI/ARIA/apg/patterns/toolbar/

From df7696a5ad70fe0dfedbda7123904e7559be8975 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 08:26:48 +0900
Subject: [PATCH 23/39] docs(changelog): record alternate redo bindings

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2adca4ac..b81f1716 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 
 ### Accessibility
 - Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
+- Completed redo shortcut metadata with `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`, matching the configured Tiptap history and collaboration behavior and exposing both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` alternatives without adding new key handling
 - Removed the unimplemented link shortcut claim from `aria-keyshortcuts`, the visible link tooltip, and buyer-facing README guidance after authoritative Tiptap Link documentation and the configured `SafeLink` extension confirmed that Inkspan does not bind `Ctrl/Cmd+K`
 - Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives, the descriptive-only accessibility boundary, and omission of unsupported shortcut claims
 

From 8790b4e50bced266b38763c6301097aaeb775e4b Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:09:36 +0900
Subject: [PATCH 24/39] test(accessibility): require link shortcut
 discoverability

---
 src/toolbarShortcutAccessibility.test.tsx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/toolbarShortcutAccessibility.test.tsx b/src/toolbarShortcutAccessibility.test.tsx
index 9964afde..6bff1a82 100644
--- a/src/toolbarShortcutAccessibility.test.tsx
+++ b/src/toolbarShortcutAccessibility.test.tsx
@@ -61,13 +61,13 @@ describe('toolbar shortcut accessibility semantics', () => {
     );
   });
 
-  it('does not advertise a link shortcut that the configured Link extension does not implement', () => {
+  it('exposes the editor-surface link shortcut implemented by EditorFrame', () => {
     const editor = makeEditor();
 
     render(<Toolbar editor={editor} />);
 
     const linkButton = screen.getByRole('button', { name: /Insert\/edit link/ });
-    expect(linkButton).not.toHaveAttribute('aria-keyshortcuts');
-    expect(linkButton).not.toHaveAttribute('title', expect.stringContaining('Ctrl/Cmd+K'));
+    expect(linkButton).toHaveAttribute('aria-keyshortcuts', 'Control+K Meta+K');
+    expect(linkButton).toHaveAttribute('title', 'Insert/edit link (Ctrl/Cmd+K)');
   });
 });

From 19f4d99ab1d9a548b6a843806e9c3926f4ec0f75 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:10:19 +0900
Subject: [PATCH 25/39] fix(accessibility): expose implemented link shortcut

---
 src/components/Toolbar.tsx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/components/Toolbar.tsx b/src/components/Toolbar.tsx
index 8eeebf79..9706beef 100644
--- a/src/components/Toolbar.tsx
+++ b/src/components/Toolbar.tsx
@@ -310,8 +310,9 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
 
       <div className="cwl-tb-group">
         <ToolbarButton
-          title="Insert/edit link"
+          title="Insert/edit link (Ctrl/Cmd+K)"
           label="🔗"
+          keyShortcuts="Control+K Meta+K"
           active={editor.isActive('link')}
           onClick={setLink}
         />
@@ -348,7 +349,7 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
           title="Delete row"
           label="┼↑✕"
           disabled={!inTable}
-          onClick={() => editor.chain().focus().deleteRow().run()}
+          onClick={() => editor.chain().focus().deleteRowAfter().run()}
         />
         <ToolbarButton
           title="Delete table"

From 920fdb25c21022186acdf9782da6a16bb160a41d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:11:04 +0900
Subject: [PATCH 26/39] fix(toolbar): preserve existing delete-row command

---
 src/components/Toolbar.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/components/Toolbar.tsx b/src/components/Toolbar.tsx
index 9706beef..fa985dc2 100644
--- a/src/components/Toolbar.tsx
+++ b/src/components/Toolbar.tsx
@@ -349,7 +349,7 @@ export function Toolbar({ editor, image, onImageError }: ToolbarProps) {
           title="Delete row"
           label="┼↑✕"
           disabled={!inTable}
-          onClick={() => editor.chain().focus().deleteRowAfter().run()}
+          onClick={() => editor.chain().focus().deleteRow().run()}
         />
         <ToolbarButton
           title="Delete table"

From f38b09817e0af22a4df95c1b9d392ea3f2274b8d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:12:13 +0900
Subject: [PATCH 27/39] test(docs): require truthful link shortcut evidence

---
 src/toolbarShortcutDocumentation.test.ts | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index 55527fe1..bc7dc1b9 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -13,7 +13,7 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(accessibility).toContain('`aria-keyshortcuts`');
     expect(accessibility).toContain('`Control+B Meta+B`');
     expect(accessibility).toContain('`Control+I Meta+I`');
-    expect(accessibility).not.toContain('`Control+K Meta+K`');
+    expect(accessibility).toContain('`Control+K Meta+K`');
     expect(accessibility).toContain('`Control+Z Meta+Z`');
     expect(accessibility).toContain(
       '`Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`',
@@ -22,17 +22,19 @@ describe('toolbar shortcut accessibility documentation', () => {
       'describes shortcuts that Inkspan already implements; it does not create keyboard behavior',
     );
     expect(accessibility).toContain(
-      'The link control intentionally does not advertise a keyboard shortcut',
+      'The link shortcut is implemented by Inkspan\'s editor surface',
     );
   });
 
-  it('keeps buyer-facing README link guidance within the implemented shortcut boundary', () => {
+  it('keeps buyer-facing README link guidance aligned with the implemented shortcut boundary', () => {
     const readme = repositoryFile('README.md').replace(/\s+/g, ' ');
 
     expect(readme).toContain(
       'Inkspan applies one link policy to initial content, toolbar commands, pasted/autolinked URLs',
     );
-    expect(readme).not.toContain('toolbar and Ctrl/Cmd+K commands');
+    expect(readme).toContain(
+      'Ctrl/Cmd+K opens the same validated link command from the editor surface',
+    );
   });
 
   it('records current standards evidence and release traceability', () => {
@@ -50,16 +52,16 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(doctoring).toContain('Accessible Rich Internet Applications (WAI-ARIA) 1.2');
     expect(doctoring).toContain('Toolbar pattern');
     expect(doctoring).toContain(
-      'The configured Tiptap Link extension does not bind a keyboard shortcut',
+      'Inkspan implements `Control+K Meta+K` at the editor-surface level',
     );
     expect(doctoring).toContain('buyer-facing README');
     expect(doctoring).toContain('Tiptap. (n.d.). *Link extension*');
     expect(doctoring).toContain('Tiptap. (n.d.). *Undo/Redo extension*');
     expect(doctoring).toContain('Control+Y Meta+Y');
-    expect(doctoring).toContain('57f5ef8e21f8351fa04c122e700b43777c9ea57e');
-    expect(doctoring).toContain('e89f51e87e84552247c7080aa61800c7da813e40');
+    expect(doctoring).toContain('8790b4e50bced266b38763c6301097aaeb775e4b');
+    expect(doctoring).toContain('920fdb25c21022186acdf9782da6a16bb160a41d');
     expect(changelog).toContain('programmatic toolbar shortcut discoverability');
-    expect(changelog).toContain('unimplemented link shortcut claim');
+    expect(changelog).toContain('editor-surface `Ctrl/Cmd+K` link binding');
     expect(changelog).toContain('buyer-facing README guidance');
     expect(changelog).toContain('Control+Y Meta+Y');
   });

From 8d12af4a77b9dec028cf26bbb88454f495e95059 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:13:26 +0900
Subject: [PATCH 28/39] docs(accessibility): document shipped link shortcut

---
 docs/accessibility.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/accessibility.md b/docs/accessibility.md
index 9d96de4d..ceead7a6 100644
--- a/docs/accessibility.md
+++ b/docs/accessibility.md
@@ -80,9 +80,9 @@ Disabled table, image, undo, and redo controls are skipped by directional naviga
 
 Toggle controls expose `aria-pressed`; one-shot command buttons do not claim a pressed state. The toolbar declares horizontal orientation and ships visible `:focus-visible` styling, including a forced-colors fallback.
 
-Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y` for redo. The redo alternatives reflect Tiptap's configured history and collaboration behavior: both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` invoke redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
+Shortcuts that the editor already implements are also exposed programmatically with `aria-keyshortcuts` so assistive technology can discover the same commands that appear in the button titles. Inkspan publishes `Control+B Meta+B` for bold, `Control+I Meta+I` for italic, `Control+K Meta+K` for link editing, `Control+Z Meta+Z` for undo, and `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y` for redo. The redo alternatives reflect Tiptap's configured history and collaboration behavior: both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` invoke redo. `aria-keyshortcuts` describes shortcuts that Inkspan already implements; it does not create keyboard behavior, replace the visible button label, or authorize hosts to intercept those combinations. The explicit values remain `Control` and `Meta` rather than a presentation-only `Ctrl/Cmd` abbreviation because WAI-ARIA defines those modifier tokens and permits a space-separated list of alternatives.
 
-The link control intentionally does not advertise a keyboard shortcut. Inkspan's configured Tiptap Link extension does not bind one, so the toolbar neither emits `aria-keyshortcuts` nor labels the link action as `Ctrl/Cmd+K`. A host that deliberately adds its own link shortcut remains responsible for implementing, documenting, conflict-testing, and exposing that host-owned binding accessibly.
+The link shortcut is implemented by Inkspan's editor surface rather than by Tiptap's Link extension: `Ctrl/Cmd+K` opens the same prompt-driven, safe-link-validated command as the toolbar button. The Link extension itself still provides no default keyboard shortcut. Inkspan therefore exposes `Control+K Meta+K` on the link toolbar button because the shipped editor surface implements that binding. Hosts remain responsible for application-level shortcut conflicts and must not shadow an advertised command without an equivalent accessible path.
 
 ## Host responsibilities
 
@@ -114,11 +114,11 @@ Inkspan cannot determine the complete accessibility of an embedding application.
 - [WAI-ARIA 1.2 `aria-keyshortcuts`](https://www.w3.org/TR/wai-aria-1.2/#aria-keyshortcuts) — programmatic exposure of implemented shortcuts, exact modifier tokens, plus-separated key combinations, and space-separated alternatives.
 - [Tiptap Undo/Redo extension](https://tiptap.dev/docs/editor/extensions/functionality/undo-redo) — the editor's history behavior includes both Shift+Control/Cmd+Z and Control/Cmd+Y redo alternatives.
 - [Tiptap Collaboration extension](https://tiptap.dev/docs/editor/extensions/functionality/collaboration) — collaborative history provides the same two redo alternatives while host-owned collaboration remains separate from accessibility metadata.
-- [Tiptap Link extension](https://tiptap.dev/docs/editor/extensions/marks/link) — the configured link extension provides commands and link behavior but no default keyboard shortcut.
+- [Tiptap Link extension](https://tiptap.dev/docs/editor/extensions/marks/link) — the configured link extension provides commands and link behavior but no default keyboard shortcut; Inkspan's editor surface supplies its own `Ctrl/Cmd+K` binding.
 - [WAI-ARIA APG: Accessible names and descriptions](https://www.w3.org/WAI/ARIA/apg/practices/names-and-descriptions/) — visible-label preference and `aria-labelledby`/`aria-describedby` relationships.
 - [WCAG 2.2, Guideline 3.3 Input Assistance](https://www.w3.org/TR/WCAG22/#input-assistance) — labels or instructions, textual error identification, and correction suggestions.
 - [ARIA in HTML](https://www.w3.org/TR/html-aria/) — valid readonly semantics for custom contenteditable textboxes.
 
 ## Verification
 
-The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for implemented cross-platform formatting/history shortcuts including both documented redo alternatives, omission of shortcut metadata and shortcut labeling from the link control because the configured Link extension does not implement one, omission of shortcut metadata from other controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.
+The TypeScript test suite verifies the single-tab-stop invariant, remembered focus, disabled-control fallback, wrapping arrow navigation, Home/End behavior, toggle semantics, toolbar orientation, exact `aria-keyshortcuts` exposure for implemented cross-platform formatting/history shortcuts including the editor-surface link binding and both documented redo alternatives, omission of shortcut metadata from controls without a defined shortcut, accessible-name precedence, blank language and ID-reference omission, `lang`/`dir` propagation, validation states, read-only semantics, native form submission, same-task form-entry synchronization, disabled/external form behavior, live serialization-mode changes, imperative replacement, allowed and canceled standalone resets, reset-only form ownership, unrelated-form isolation, callback-only reset handling, queued-reset cleanup, collaborative automatic-reset rejection, collaborative callback-only observation without shared-state mutation, collaborative updates, and live prop updates for standalone and collaborative surfaces under the repository-wide 100% statement/branch/function/line coverage gate.

From b9af679a7480bb6613db310304909e814d7b5552 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:15:07 +0900
Subject: [PATCH 29/39] docs(doctoring): correct link shortcut evidence

---
 .../toolbar-shortcut-discoverability.md       | 38 +++++++++----------
 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/docs/doctoring/toolbar-shortcut-discoverability.md b/docs/doctoring/toolbar-shortcut-discoverability.md
index 38b29e47..abc9ca20 100644
--- a/docs/doctoring/toolbar-shortcut-discoverability.md
+++ b/docs/doctoring/toolbar-shortcut-discoverability.md
@@ -2,28 +2,29 @@
 
 ## Decision
 
-Inkspan exposes only keyboard shortcuts that the configured editor actually implements through the WAI-ARIA `aria-keyshortcuts` state on the corresponding native toolbar button. The public contract remains descriptive rather than behavioral: the attribute makes existing editor commands programmatically discoverable but does not create, intercept, authorize, or remap keyboard input.
+Inkspan exposes only keyboard shortcuts that the shipped editor actually implements through the WAI-ARIA `aria-keyshortcuts` state on the corresponding native toolbar button. The public contract remains descriptive rather than behavioral: the attribute makes existing editor commands programmatically discoverable but does not create, intercept, authorize, or remap keyboard input.
 
 The exact built-in shortcut alternatives are:
 
 - bold: `Control+B Meta+B`;
 - italic: `Control+I Meta+I`;
+- link editing: `Control+K Meta+K`;
 - undo: `Control+Z Meta+Z`; and
 - redo: `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`.
 
-The redo metadata intentionally exposes both shortcut families implemented by the configured Tiptap history behavior: `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y`. The link control intentionally has no `aria-keyshortcuts` value. The configured Tiptap Link extension does not bind a keyboard shortcut, and Inkspan's `SafeLink` extension adds URI validation plus transaction filtering without adding an `addKeyboardShortcuts` implementation. The toolbar therefore no longer labels link editing as `Ctrl/Cmd+K`. Controls for which Inkspan does not implement a stable keyboard shortcut do not emit `aria-keyshortcuts`.
+The redo metadata intentionally exposes both shortcut families implemented by the configured Tiptap history behavior: `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y`. Tiptap's Link extension itself does not provide a default shortcut, but Inkspan implements `Control+K Meta+K` at the editor-surface level in `EditorFrame`: the handler intercepts `Ctrl/Cmd+K`, prevents the browser default, and invokes the same prompt-driven safe-link command family used by the toolbar. The link button therefore exposes that shipped Inkspan binding rather than inferring behavior from the extension alone. Controls for which Inkspan does not implement a stable keyboard shortcut do not emit `aria-keyshortcuts`.
 
 ## Buyer-visible gap and bounded scope
 
 Before this slice, implemented bold, italic, undo, and redo shortcuts appeared in toolbar titles while assistive technology received no programmatic shortcut metadata. That asymmetry weakened accessible command discovery in enterprise authoring workflows.
 
-The first implementation pass also treated the pre-existing `Ctrl/Cmd+K` link title as proof that a link shortcut existed. Current authoritative Tiptap documentation explicitly identifies the Link extension as having no keyboard shortcut, and repository inspection confirms `SafeLink` does not add one. Advertising `Control+K Meta+K` would therefore have created false accessibility metadata and retained a misleading visible tooltip. The repair removes that false claim rather than inventing a new keyboard behavior inside an accessibility-metadata change.
+An early source review incorrectly scoped link-shortcut verification to Tiptap's Link extension and Inkspan's `SafeLink` extension. Those extensions do not add a default keymap, so the first repair removed the existing `Ctrl/Cmd+K` toolbar claim. A later exact-head repository-level review correctly inspected `src/components/EditorFrame.tsx` and found the already-shipped editor-surface binding. The prior conclusion was therefore false even though the extension-level observation was true. The bounded correction restores truthful discoverability for the existing command; it does not invent a new link shortcut.
 
-A follow-up exact-head documentation sweep found the buyer-facing README still described Inkspan's link policy as covering `Ctrl/Cmd+K` commands even after the unsupported toolbar claim had been removed. RED commit `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` bound the README to the implemented-shortcut boundary, and GREEN commit `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` removed that stale behavioral claim while preserving the link-policy description itself. This closes the same buyer-visible truthfulness defect across UI metadata and product documentation; it does not add a link shortcut.
+The same distinction applies to buyer-facing documentation. README link-policy text must describe the actual Inkspan command surface rather than attribute the shortcut to Tiptap. The relevant behavior is owned by Inkspan's editor shell: `Ctrl/Cmd+K` enters the same validated link workflow while SafeLink continues to own URI validation and transaction filtering.
 
-Exact dependency review after current-head automated feedback found a second asymmetry: Inkspan advertised only `Ctrl/Cmd+Shift+Z` for redo even though the configured Tiptap history and collaboration behavior also implements `Ctrl/Cmd+Y`. Current official Tiptap Undo/Redo and Collaboration documentation independently lists both redo alternatives. RED commit `11439733245d76c6dc3b58f4fb9bf2105ac94b43` bound the toolbar to both alternatives before production changed; GREEN commit `bc634bf2f3237e58156ad68691b140ab90718992` then added only the missing redo metadata and visible title alternative. No new keyboard behavior was invented.
+Exact dependency review also found a second asymmetry: Inkspan initially advertised only `Ctrl/Cmd+Shift+Z` for redo even though the configured Tiptap history and collaboration behavior also implements `Ctrl/Cmd+Y`. Current official Tiptap Undo/Redo and Collaboration documentation independently lists both redo alternatives. RED commit `11439733245d76c6dc3b58f4fb9bf2105ac94b43` bound the toolbar to both alternatives before production changed; GREEN commit `bc634bf2f3237e58156ad68691b140ab90718992` then added only the missing redo metadata and visible title alternative. No new keyboard behavior was invented.
 
-This repair changes only the editor-owned presentation and accessibility surface. It does not alter document semantics, implemented shortcut execution, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and any host-added link shortcut.
+This repair changes only the editor-owned presentation, shortcut-discovery, tests, and documentation surfaces. It does not alter document semantics, transport, authorization, tenant isolation, persistence, credentials, migration, retention, audit policy, model-use policy, collaboration ownership, or release authority. Hosts still own application-level shortcut conflict management and any host-added or host-remapped command.
 
 ## Test-first evidence
 
@@ -32,16 +33,13 @@ The slice was implemented test-first from protected `main` `ca49a3249403be88ba3c
 1. RED commit `303149b4d3e586ba32c1306d1a7d98542142d9d3` added the initial shortcut metadata contract before production support.
 2. GREEN commit `29d8c156e40eb0975687ee83053bedf3de7d77a5` added the optional, documented `keyShortcuts` button property and emitted it through `aria-keyshortcuts`.
 3. Documentation contract commit `513dcdc26a5cbaef333cf822a2e191f43a3eda70` added deterministic assertions for the public accessibility contract, standards evidence, doctoring lineage, and changelog traceability before the corresponding documentation was written.
-4. Independent source verification then found that the link shortcut assumption was invalid: Tiptap's Link extension does not bind a shortcut, and Inkspan's configured `SafeLink` adds none. RED commit `57f5ef8e21f8351fa04c122e700b43777c9ea57e` changed the accessibility regression to reject `aria-keyshortcuts` and `Ctrl/Cmd+K` on the link button while production still advertised both.
-5. GREEN production commit `e89f51e87e84552247c7080aa61800c7da813e40` removed only the false link shortcut metadata and visible shortcut label while preserving the link button's existing prompt-driven command.
-6. Documentation RED commit `251d660ed9b0aebbffaa0ca715b33eb39aa93729` bound the public contract to the implemented-shortcut boundary and official Tiptap Link documentation before the explanatory documents were corrected.
-7. Buyer-facing documentation RED commit `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` required the README to stop presenting the unimplemented `Ctrl/Cmd+K` behavior as part of Inkspan's link-policy command surface.
-8. Buyer-facing documentation GREEN commit `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` corrected the README without changing the underlying safe-link policy or link command.
-9. Release-evidence RED commit `8ffa71914ec7cdb62176db19045378e30a075ee2` requires both this doctoring record and the active changelog to retain the README correction as acquisition-review evidence.
-10. Redo-alternative RED commit `11439733245d76c6dc3b58f4fb9bf2105ac94b43` required the redo button to expose the already-implemented `Control+Y Meta+Y` alternative and corresponding visible title before production was changed.
-11. Redo-alternative GREEN commit `bc634bf2f3237e58156ad68691b140ab90718992` added the missing redo alternative without modifying editor command behavior.
-12. Redo documentation RED commit `52d38471cbc24be5792d7a32bf2319a039668622` bound public accessibility guidance, doctoring, release traceability, and the official Tiptap Undo/Redo source before documentation was updated.
-13. Accessibility documentation GREEN commit `877ee37ecb1d97fa447db77869f2193530e45a31` records both redo alternatives and the current official Tiptap history/collaboration basis.
+4. Extension-scoped verification found that Tiptap's Link extension does not bind a shortcut and Inkspan's `SafeLink` adds none. RED commit `57f5ef8e21f8351fa04c122e700b43777c9ea57e` therefore changed the accessibility regression to reject `aria-keyshortcuts` and `Ctrl/Cmd+K` on the link button.
+5. GREEN commit `e89f51e87e84552247c7080aa61800c7da813e40` removed that link metadata while preserving the prompt-driven command. Subsequent documentation commits propagated the same extension-scoped conclusion.
+6. Buyer-facing documentation RED `9c8a6b0c0332c4f6a3bd0c5e373be87eb79ac50b` and GREEN `a6c472e9b2aa3ec0f4cbf9663613243ed410faab` removed the stale README shortcut claim under that then-current interpretation; release-evidence RED `8ffa71914ec7cdb62176db19045378e30a075ee2` retained the traceability.
+7. Redo-alternative RED `11439733245d76c6dc3b58f4fb9bf2105ac94b43` and GREEN `bc634bf2f3237e58156ad68691b140ab90718992` exposed the already-implemented `Control+Y Meta+Y` redo alternative. Redo documentation RED `52d38471cbc24be5792d7a32bf2319a039668622` and accessibility GREEN `877ee37ecb1d97fa447db77869f2193530e45a31` bound that correction to official Tiptap evidence.
+8. Exact-head automated repository review then found the missed `EditorFrame` `Ctrl/Cmd+K` binding. RED commit `8790b4e50bced266b38763c6301097aaeb775e4b` requires the link button to expose `Control+K Meta+K` and the matching visible title.
+9. Production commit `19f4d99ab1d9a548b6a843806e9c3926f4ec0f75` restores link shortcut metadata without changing link execution. A full-file connector edit accidentally changed the unrelated delete-row command; corrective commit `920fdb25c21022186acdf9782da6a16bb160a41d` immediately restored the original `deleteRow()` call before further work.
+10. Documentation-contract RED commit `f38b09817e0af22a4df95c1b9d392ea3f2274b8d` requires accessibility, doctoring, README, and changelog evidence to state the repository-level shortcut truth. Accessibility documentation commit `8d12af4a77b9dec028cf26bbb88454f495e95059` records the shipped editor-surface binding and preserves the Tiptap-extension distinction.
 
 All exact-head CI, 100% production statement/branch/function/line coverage, security, packaging, review, and branch-protection evidence remains release-gated; no predecessor-head or local-only result is acceptance evidence.
 
@@ -53,19 +51,19 @@ The ARIA Authoring Practices Guide toolbar pattern recommends a single toolbar t
 
 Tiptap's official Undo/Redo documentation lists redo as `Shift+Control+Z` or `Control+Y` on Windows/Linux and `Shift+Cmd+Z` or `Cmd+Y` on macOS. Its Collaboration extension documents the same two redo alternatives for collaborative history. Because Inkspan uses the corresponding configured Tiptap history mechanisms rather than a custom redo keymap, `Control+Y Meta+Y` is shipped behavior that must be represented alongside `Control+Shift+Z Meta+Shift+Z` in descriptive accessibility metadata.
 
-Tiptap's official Link extension documentation states that the extension provides no keyboard shortcut and suggests that applications may choose to open custom link UI from their own `Mod-k` binding. Inkspan does not currently implement such a binding. Descriptive ARIA metadata must follow the shipped behavior rather than imply a future or host-specific shortcut.
+Tiptap's official Link extension documentation states that the extension provides no default keyboard shortcut and suggests that applications may choose to open custom link UI from their own `Mod-k` binding. Inkspan does exactly that at a different layer: `EditorFrame` implements the application-level `Ctrl/Cmd+K` handler. Therefore the absence of an extension default cannot be used as evidence that the finished Inkspan editor lacks the shortcut. `aria-keyshortcuts` follows observable shipped behavior across the repository, not only extension-local keymaps.
 
 ## Security, privacy, and ownership boundary
 
 `aria-keyshortcuts` contains only static command metadata. It carries no document content, selection text, tenant identifier, credentials, provider information, persistence validator, local path, or user-specific shortcut history. The values are safe to expose in rendered markup and release evidence.
 
-Inkspan does not use shortcut metadata as an authorization signal. A host that disables, shadows, intercepts, or adds a shortcut remains responsible for its own accessible interaction design. No host may infer document permission or durable operation authority from the presence of a toolbar button or its accessibility state.
+The link binding invokes the same SafeLink-governed command path as the toolbar and does not weaken URL validation. Inkspan does not use shortcut metadata as an authorization signal. A host that disables, shadows, intercepts, or adds a shortcut remains responsible for its own accessible interaction design. No host may infer document permission or durable operation authority from the presence of a toolbar button or its accessibility state.
 
 ## Compatibility and rollback
 
-The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute only on the four mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Redo retains the same TipTap command while exposing both existing key bindings; link editing retains its existing button and prompt-driven command while omitting an unsupported link shortcut claim.
+The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute on mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Redo retains the same TipTap command while exposing both existing key bindings. Link editing retains the pre-existing `EditorFrame` `Ctrl/Cmd+K` execution path and the same prompt-driven toolbar command while restoring truthful metadata.
 
-Rollback is bounded: remove the four `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
+Rollback is bounded: remove the mapped `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. Removing the link metadata alone would reintroduce an accessibility discoverability mismatch unless the `EditorFrame` binding were also intentionally removed in a separately reviewed behavior change. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
 
 ## Evidence boundary
 

From cbd6a403fdcb82ed749c9b5c193372e1f41cb990 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:15:35 +0900
Subject: [PATCH 30/39] test(docs): scope README shortcut assertion safely

---
 src/toolbarShortcutDocumentation.test.ts | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index bc7dc1b9..753ebd1e 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -26,14 +26,14 @@ describe('toolbar shortcut accessibility documentation', () => {
     );
   });
 
-  it('keeps buyer-facing README link guidance aligned with the implemented shortcut boundary', () => {
+  it('keeps buyer-facing README link guidance within the validated command boundary', () => {
     const readme = repositoryFile('README.md').replace(/\s+/g, ' ');
 
     expect(readme).toContain(
       'Inkspan applies one link policy to initial content, toolbar commands, pasted/autolinked URLs',
     );
-    expect(readme).toContain(
-      'Ctrl/Cmd+K opens the same validated link command from the editor surface',
+    expect(readme).not.toContain(
+      'Tiptap Link extension implements Ctrl/Cmd+K',
     );
   });
 
@@ -54,7 +54,7 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(doctoring).toContain(
       'Inkspan implements `Control+K Meta+K` at the editor-surface level',
     );
-    expect(doctoring).toContain('buyer-facing README');
+    expect(doctoring).toContain('buyer-facing documentation');
     expect(doctoring).toContain('Tiptap. (n.d.). *Link extension*');
     expect(doctoring).toContain('Tiptap. (n.d.). *Undo/Redo extension*');
     expect(doctoring).toContain('Control+Y Meta+Y');

From e23358b435191b1a8285910b00f980b450972f5c Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sat, 8 Aug 2026 09:16:10 +0900
Subject: [PATCH 31/39] docs(changelog): correct link shortcut provenance

---
 CHANGELOG.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b81f1716..42b2a2ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,11 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 ## [Unreleased]
 
 ### Accessibility
-- Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
+- Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, link, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
 - Completed redo shortcut metadata with `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`, matching the configured Tiptap history and collaboration behavior and exposing both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` alternatives without adding new key handling
-- Removed the unimplemented link shortcut claim from `aria-keyshortcuts`, the visible link tooltip, and buyer-facing README guidance after authoritative Tiptap Link documentation and the configured `SafeLink` extension confirmed that Inkspan does not bind `Ctrl/Cmd+K`
-- Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives, the descriptive-only accessibility boundary, and omission of unsupported shortcut claims
+- Corrected extension-scoped review evidence after exact-head repository review found the existing editor-surface `Ctrl/Cmd+K` link binding in `EditorFrame`; the link button now truthfully exposes `Control+K Meta+K` while the Tiptap Link extension itself remains documented as having no default shortcut
+- Preserved buyer-facing README guidance within the same validated safe-link command boundary and moved the shortcut-specific behavior contract to the authoritative accessibility and doctoring records so it is not misattributed to Tiptap
+- Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives, the descriptive-only accessibility boundary, repository-level shortcut verification, and omission of unsupported shortcut claims
 
 ### Documentation
 - Added an authoritative standalone and modular MSA architecture contract with reviewable deployment, optimistic-concurrency, data-ownership, security, and acquisition-evidence diagrams and tables

From bf1ef371bb3e048d2e505b7f32ad4763c49b09aa Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 9 Aug 2026 21:02:31 +0900
Subject: [PATCH 32/39] test(docs): require README link shortcut truth

---
 src/toolbarShortcutDocumentation.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index 753ebd1e..cb252eee 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -26,11 +26,11 @@ describe('toolbar shortcut accessibility documentation', () => {
     );
   });
 
-  it('keeps buyer-facing README link guidance within the validated command boundary', () => {
+  it('keeps buyer-facing README link guidance aligned with the shipped link command', () => {
     const readme = repositoryFile('README.md').replace(/\s+/g, ' ');
 
     expect(readme).toContain(
-      'Inkspan applies one link policy to initial content, toolbar commands, pasted/autolinked URLs',
+      'Inkspan applies one link policy to initial content, toolbar and Ctrl/Cmd+K commands, pasted/autolinked URLs',
     );
     expect(readme).not.toContain(
       'Tiptap Link extension implements Ctrl/Cmd+K',

From c847a21a61ca11d8e3934aebc63420b3826b4840 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 9 Aug 2026 21:04:24 +0900
Subject: [PATCH 33/39] docs(readme): restore shipped link shortcut guidance

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 93896e5c..7ab8dbbd 100644
--- a/README.md
+++ b/README.md
@@ -257,7 +257,7 @@ contract and host responsibilities.
 
 ### Safe hyperlink boundary
 
-Inkspan applies one link policy to initial content, toolbar commands,
+Inkspan applies one link policy to initial content, toolbar and Ctrl/Cmd+K commands,
 pasted/autolinked URLs, direct ProseMirror transactions, collaborative changes,
 and HTML output. Accepted targets are credential-free HTTP(S),
 non-empty `mailto:` and `tel:`, ordinary document-relative paths, query-only

From ba8256deed6c925b4f6bdab303d76bed4738fbd6 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 9 Aug 2026 21:36:38 +0900
Subject: [PATCH 34/39] test(accessibility): require consistent Tiptap
 terminology

---
 src/toolbarShortcutDocumentation.test.ts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/toolbarShortcutDocumentation.test.ts b/src/toolbarShortcutDocumentation.test.ts
index cb252eee..7df785b0 100644
--- a/src/toolbarShortcutDocumentation.test.ts
+++ b/src/toolbarShortcutDocumentation.test.ts
@@ -37,6 +37,19 @@ describe('toolbar shortcut accessibility documentation', () => {
     );
   });
 
+  it('keeps public doctoring terminology consistent with the Tiptap references', () => {
+    const doctoring = repositoryFile(
+      'docs/doctoring/toolbar-shortcut-discoverability.md',
+    );
+
+    expect(doctoring).toContain(
+      'Redo retains the same Tiptap command while exposing both existing key bindings.',
+    );
+    expect(doctoring).not.toContain(
+      'Redo retains the same TipTap command while exposing both existing key bindings.',
+    );
+  });
+
   it('records current standards evidence and release traceability', () => {
     const accessibility = repositoryFile('docs/accessibility.md');
     const doctoring = repositoryFile(
@@ -65,4 +78,4 @@ describe('toolbar shortcut accessibility documentation', () => {
     expect(changelog).toContain('buyer-facing README guidance');
     expect(changelog).toContain('Control+Y Meta+Y');
   });
-});
+});
\ No newline at end of file

From e56c0e2ef43d3389fd84ac6e81abba9844cc5b89 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 9 Aug 2026 21:37:13 +0900
Subject: [PATCH 35/39] docs(accessibility): align Tiptap product naming

---
 docs/doctoring/toolbar-shortcut-discoverability.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/doctoring/toolbar-shortcut-discoverability.md b/docs/doctoring/toolbar-shortcut-discoverability.md
index abc9ca20..63d38ae6 100644
--- a/docs/doctoring/toolbar-shortcut-discoverability.md
+++ b/docs/doctoring/toolbar-shortcut-discoverability.md
@@ -61,7 +61,7 @@ The link binding invokes the same SafeLink-governed command path as the toolbar
 
 ## Compatibility and rollback
 
-The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute on mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Redo retains the same TipTap command while exposing both existing key bindings. Link editing retains the pre-existing `EditorFrame` `Ctrl/Cmd+K` execution path and the same prompt-driven toolbar command while restoring truthful metadata.
+The property is optional within Inkspan's internal toolbar-button contract and serializes to an ordinary ARIA attribute on mapped built-in shortcut buttons. Browsers or assistive technologies that do not surface the state continue to receive the same native button labels, focus behavior, and command implementation as before. Redo retains the same Tiptap command while exposing both existing key bindings. Link editing retains the pre-existing `EditorFrame` `Ctrl/Cmd+K` execution path and the same prompt-driven toolbar command while restoring truthful metadata.
 
 Rollback is bounded: remove the mapped `keyShortcuts` assignments, the optional property and emitted `aria-keyshortcuts` state, the focused regression tests, and this doctoring entry. Removing the link metadata alone would reintroduce an accessibility discoverability mismatch unless the `EditorFrame` binding were also intentionally removed in a separately reviewed behavior change. No persisted document, schema, migration, host protocol, or package subpath requires conversion.
 

From 1340cacb0b15b49276aed477f3924d818616204d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 9 Aug 2026 23:14:28 +0900
Subject: [PATCH 36/39] chore(accessibility): reconcile protected release gate

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 42b2a2ab..161290e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 
 ## [Unreleased]
 
+### Security
+- Added a fail-closed draft release asset inventory gate that requires exactly one npm tarball, one Office wheel, and `SHA256SUMS`, rejects stale or unexpected draft assets before immutable publication, and verifies every GitHub-reported `sha256:` asset digest against the transferred local file
+
 ### Accessibility
 - Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, link, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
 - Completed redo shortcut metadata with `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`, matching the configured Tiptap history and collaboration behavior and exposing both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` alternatives without adding new key handling

From b74216e5e684bf13d48c452848ed46a1d1af2112 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 10 Aug 2026 00:39:29 +0900
Subject: [PATCH 37/39] chore(accessibility): preserve protected-main release
 and security state

---
 .github/workflows/ci.yml                      |   2 +-
 .github/workflows/release.yml                 | 126 +++++++-
 README.md                                     |  18 +-
 SECURITY.md                                   |  71 +++++
 .../office-python-support-contract.md         | 125 ++++++++
 .../release-draft-asset-inventory.md          |  81 +++++
 .../security-disclosure-lifecycle.md          | 116 ++++++++
 docs/release-security.md                      |  37 ++-
 office/README.md                              |  10 +-
 office/pyproject.toml                         |   2 +-
 office/requirements-ci.txt                    |  12 +-
 office/tests/test_python_support_contract.py  |  95 ++++++
 src/releaseDraftAssetEntryType.test.ts        |  96 ++++++
 src/releaseDraftAssetInventory.test.ts        | 277 ++++++++++++++++++
 src/securityPolicyDocumentation.test.ts       | 100 +++++++
 15 files changed, 1138 insertions(+), 30 deletions(-)
 create mode 100644 SECURITY.md
 create mode 100644 docs/doctoring/office-python-support-contract.md
 create mode 100644 docs/doctoring/release-draft-asset-inventory.md
 create mode 100644 docs/doctoring/security-disclosure-lifecycle.md
 create mode 100644 office/tests/test_python_support_contract.py
 create mode 100644 src/releaseDraftAssetEntryType.test.ts
 create mode 100644 src/releaseDraftAssetInventory.test.ts
 create mode 100644 src/securityPolicyDocumentation.test.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98f6708f..2444529a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.14"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     defaults:
       run:
         working-directory: office
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0afc694c..afc2d612 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ env:
 jobs:
   build-release-artifacts:
     if: github.repository == 'ContextualWisdomLab/inkspan'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out the tagged source
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -137,7 +137,7 @@ jobs:
   publish-release:
     if: github.repository == 'ContextualWisdomLab/inkspan'
     needs: build-release-artifacts
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       id-token: write
@@ -153,6 +153,30 @@ jobs:
           set -euo pipefail
           cd release
           sha256sum --check SHA256SUMS
+      - name: Verify bounded local release artifact set
+        run: |
+          set -euo pipefail
+          expected_asset_count=3
+          mapfile -t local_entries < <(
+            find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
+          )
+          mapfile -t local_assets < <(
+            find release -maxdepth 1 -type f -printf '%f\n' | LC_ALL=C sort
+          )
+          mapfile -t npm_assets < <(
+            printf '%s\n' "${local_assets[@]}" | grep -E '\.tgz$' || true
+          )
+          mapfile -t wheel_assets < <(
+            printf '%s\n' "${local_assets[@]}" | grep -E '\.whl$' || true
+          )
+          if [[ ${#local_entries[@]} -ne $expected_asset_count \
+            || ${#local_assets[@]} -ne $expected_asset_count \
+            || ${#npm_assets[@]} -ne 1 \
+            || ${#wheel_assets[@]} -ne 1 \
+            || ! -f release/SHA256SUMS ]]; then
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, and SHA256SUMS."
+            exit 1
+          fi
       - name: Attest release artifacts
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
@@ -168,7 +192,7 @@ jobs:
           for artifact in release/*.tgz release/*.whl release/SHA256SUMS; do
             gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
           done
-      - name: Publish immutable GitHub release
+      - name: Prepare draft GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -194,6 +218,102 @@ jobs:
           gh release upload "$GITHUB_REF_NAME" release/* \
             --repo "$GITHUB_REPOSITORY" \
             --clobber
+      - name: Verify exact draft release asset inventory
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          expected_asset_count=3
+          mapfile -t local_entries < <(
+            find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
+          )
+          mapfile -t local_assets < <(
+            find release -maxdepth 1 -type f -printf '%f\n' | LC_ALL=C sort
+          )
+          mapfile -t npm_assets < <(
+            printf '%s\n' "${local_assets[@]}" | grep -E '\.tgz$' || true
+          )
+          mapfile -t wheel_assets < <(
+            printf '%s\n' "${local_assets[@]}" | grep -E '\.whl$' || true
+          )
+          if [[ ${#local_entries[@]} -ne $expected_asset_count \
+            || ${#local_assets[@]} -ne $expected_asset_count \
+            || ${#npm_assets[@]} -ne 1 \
+            || ${#wheel_assets[@]} -ne 1 \
+            || ! -f release/SHA256SUMS ]]; then
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, and SHA256SUMS."
+            exit 1
+          fi
+
+          release_pages="$(gh api \
+            --paginate \
+            --slurp \
+            -H 'Accept: application/vnd.github+json' \
+            -H 'X-GitHub-Api-Version: 2026-03-10' \
+            "repos/$GITHUB_REPOSITORY/releases?per_page=100")"
+          release_match_count="$(jq -r --arg tag "$GITHUB_REF_NAME" \
+            '[.[][] | select(.tag_name == $tag)] | length' \
+            <<< "$release_pages")"
+          if [[ "$release_match_count" != '1' ]]; then
+            echo "::error::Expected exactly one draft release for tag $GITHUB_REF_NAME; found $release_match_count."
+            exit 1
+          fi
+          release_json="$(jq -ce --arg tag "$GITHUB_REF_NAME" \
+            '[.[][] | select(.tag_name == $tag)][0]' \
+            <<< "$release_pages")"
+          release_state='.draft'
+          asset_name='.assets[].name'
+          asset_state='.assets[].state'
+          asset_digest='.assets[].digest'
+
+          if [[ "$(jq -r "$release_state" <<< "$release_json")" != 'true' ]]; then
+            echo "::error::Release must remain a draft while its exact asset inventory is validated."
+            exit 1
+          fi
+
+          mapfile -t remote_assets < <(
+            jq -r "$asset_name" <<< "$release_json" | LC_ALL=C sort
+          )
+          if [[ ${#remote_assets[@]} -ne $expected_asset_count ]] \
+            || ! diff -u \
+              <(printf '%s\n' "${local_assets[@]}") \
+              <(printf '%s\n' "${remote_assets[@]}"); then
+            echo "::error::Unexpected draft release asset inventory; remove the stale draft or unexpected stale asset before retrying."
+            exit 1
+          fi
+
+          mapfile -t remote_states < <(jq -r "$asset_state" <<< "$release_json")
+          if [[ ${#remote_states[@]} -ne $expected_asset_count ]]; then
+            echo "::error::Unexpected draft release asset inventory; asset state evidence is incomplete."
+            exit 1
+          fi
+          for state in "${remote_states[@]}"; do
+            if [[ "$state" != 'uploaded' ]]; then
+              echo "::error::Draft release contains an asset that is not fully uploaded."
+              exit 1
+            fi
+          done
+
+          mapfile -t remote_digests < <(jq -r "$asset_digest" <<< "$release_json")
+          if [[ ${#remote_digests[@]} -ne $expected_asset_count ]]; then
+            echo "::error::Draft release asset digest evidence is incomplete."
+            exit 1
+          fi
+          for filename in "${local_assets[@]}"; do
+            local_digest="sha256:$(sha256sum -- "release/$filename" | awk '{print $1}')"
+            remote_digest="$(jq -r --arg filename "$filename" \
+              '.assets[] | select(.name == $filename) | .digest // empty' \
+              <<< "$release_json")"
+            if [[ "$remote_digest" != "$local_digest" ]]; then
+              echo "::error::Draft release asset digest mismatch for $filename."
+              exit 1
+            fi
+          done
+      - name: Publish immutable GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
           gh release edit "$GITHUB_REF_NAME" \
             --repo "$GITHUB_REPOSITORY" \
             --draft=false
diff --git a/README.md b/README.md
index 7ab8dbbd..48f46ce5 100644
--- a/README.md
+++ b/README.md
@@ -257,9 +257,9 @@ contract and host responsibilities.
 
 ### Safe hyperlink boundary
 
-Inkspan applies one link policy to initial content, toolbar and Ctrl/Cmd+K commands,
-pasted/autolinked URLs, direct ProseMirror transactions, collaborative changes,
-and HTML output. Accepted targets are credential-free HTTP(S),
+Inkspan applies one link policy to initial content, toolbar and Ctrl/Cmd+K
+commands, pasted/autolinked URLs, direct ProseMirror transactions, collaborative
+changes, and HTML output. Accepted targets are credential-free HTTP(S),
 non-empty `mailto:` and `tel:`, ordinary document-relative paths, query-only
 references, and fragments.
 
@@ -558,12 +558,12 @@ python -m pip wheel . --no-deps --wheel-dir dist
 ```
 
 The repository CI pins GitHub Actions by full commit SHA. The Office matrix uses
-hash-locked binary dependencies on Python 3.11 and 3.14. JavaScript and Python
-shipped code are gated at 100% coverage; the Python package additionally enforces
-100% shipped-symbol docstring coverage and verifies the contents of its built
-wheel. Link-policy tests cover parsing, commands, direct transactions,
-serialization, and redacted diagnostics; image-policy tests cover every editor
-and standalone serializer ingress path.
+hash-locked binary dependencies on Python 3.11, Python 3.12, Python 3.13, and
+Python 3.14. JavaScript and Python shipped code are gated at 100% coverage; the
+Python package additionally enforces 100% shipped-symbol docstring coverage and
+verifies the contents of its built wheel. Link-policy tests cover parsing,
+commands, direct transactions, serialization, and redacted diagnostics;
+image-policy tests cover every editor and standalone serializer ingress path.
 
 ## Architecture
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..43504a4e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,71 @@
+# Security Policy
+
+Inkspan treats vulnerability reporting and handling as part of the product contract. Please use a private channel for suspected security vulnerabilities so maintainers can reproduce, remediate, and coordinate disclosure before exploit details become public.
+
+## Supported releases
+
+Inkspan is still pre-1.0, so security support follows the newest released line rather than every historical minor release.
+
+| Surface | Actively supported security line | Notes |
+| --- | --- | --- |
+| `@contextualwisdomlab/cwl-editor` | latest released `0.5.x` | Security fixes target the newest released editor line. Older pre-1.0 releases may be superseded rather than backported unless a coordinated advisory requires a bounded backport. |
+| `inkspan-office` | latest released `0.1.x` | Security fixes target the newest released Office renderer line and its deterministic packaged artifacts. |
+
+Unreleased branches and pull requests are development evidence, not supported releases. A finding against an unreleased head is still useful and should be reported privately, but support and disclosure decisions are made against affected released artifacts as well as the development fix.
+
+A future stable release may define a broader support window. Until then, this table is the public support contract; an enterprise support agreement may define additional maintained versions separately.
+
+## Reporting a vulnerability
+
+1. Open the repository **Security** area. If GitHub shows **Report a vulnerability**, use that private reporting form. It creates a private GitHub Security Advisory discussion with the maintainers.
+2. If **Report a vulnerability** is unavailable, create a public issue that only asks for a private security contact without disclosing the vulnerability. Do not include vulnerability details, proof-of-concept payloads, secrets, or customer data in a public issue.
+3. Keep technical details in the resulting private channel until coordinated disclosure is agreed or the maintainers publish an advisory.
+
+A useful report includes, when known:
+
+- the exact affected version, package, entry point, and platform;
+- the security boundary or invariant that can be violated;
+- a minimal reproduction using synthetic data and the smallest safe proof of impact;
+- expected behavior and observed behavior;
+- exploit prerequisites and whether interaction, authentication, or a particular host configuration is required;
+- whether the issue is already public or known to another vendor; and
+- any proposed remediation or regression condition that may help reproduce the issue.
+
+Do not send production credentials, access tokens, private tenant identifiers, real customer documents, or other unnecessary sensitive material. Replace them with synthetic fixtures whenever possible. If sensitive evidence is essential to establish impact, first establish a private channel and minimize the disclosed material.
+
+## Scope and ownership boundary
+
+Reports are in scope when an Inkspan-controlled editor or deterministic conversion surface can violate its documented security boundary, including package parsing/serialization, strict link and image policy, rich-content handling, document-envelope validation, local revision/autosave contracts, provider-neutral collaboration adapters, deterministic Office rendering, packaged artifacts, or Inkspan-owned release evidence.
+
+Inkspan does not own host-owned transport, authorization, tenant isolation, persistence, credentials, migration, retention, collaboration-provider authorization, downstream deployment policy, or model-use policy. Report a host defect to the host that owns that boundary. An Inkspan flaw that crosses or undermines one of those documented boundaries remains in scope for Inkspan.
+
+Repository automation and organization-wide security/review infrastructure owned by `ContextualWisdomLab/.github` should be reported against that repository rather than treated as Inkspan runtime behavior. Model-routing defects owned by `ContextualWisdomLab/contextual-orchestrator` likewise belong to that service unless the defect originates in Inkspan's interface contract.
+
+Security research does not authorize access to third-party data, destructive testing, service degradation, credential theft, social engineering, or testing systems you do not own or have explicit permission to test.
+
+## Vulnerability handling lifecycle
+
+For a credible report, maintainers should:
+
+1. establish a private case and preserve the reporter's original evidence without copying sensitive payloads into ordinary logs or public CI output;
+2. reproduce the issue against the exact affected version and current development head, separating an Inkspan defect from host-owned configuration or infrastructure;
+3. assess impact, exploit prerequisites, affected release lines, dependency exposure, and whether other vendors need coordinated disclosure;
+4. implement the minimum root-cause fix with a root-cause regression test and any required security, compatibility, packaging, or rollback evidence;
+5. verify the exact fix head through exact-head CI, security scanning, coverage, packaging/provenance, and independent review gates that apply to the affected release;
+6. prepare a GitHub Security Advisory and request a CVE when appropriate for a publicly distributed vulnerability;
+7. coordinate release and disclosure timing around user risk, downstream-vendor needs, and availability of a verified remediation; and
+8. publish remediation guidance that identifies affected and fixed versions without exposing private customer data or unnecessary exploit detail.
+
+A failed, queued, cancelled, stale-head, predecessor-head, or synthetic-merge result is not release evidence. A security fix does not weaken tests, bypass branch protection, manufacture approval, or silently broaden Inkspan into a host authorization or persistence service.
+
+## Communication expectations
+
+This public policy does not promise a response-time SLA, remediation deadline, bounty, or payment. Those commitments require an explicit support or disclosure agreement. Maintainers should nevertheless keep the private reporter informed when the report is reproducible, when scope or severity changes materially, when a fix is ready for coordinated validation, and when disclosure timing is decided.
+
+Coordinated disclosure is preferred over unilateral premature publication because users need a verified remediation path. Reporters are also free to communicate reasonable disclosure expectations in the private case; the final schedule should reflect actual user risk rather than an arbitrary silence period.
+
+## Standards and claim boundary
+
+This policy is informed by ISO/IEC 29147 vulnerability disclosure guidance, ISO/IEC 30111 vulnerability-handling guidance, NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1, and GitHub's current security-policy and private vulnerability-reporting documentation. The corresponding decision and APA 7 references are recorded in [`docs/doctoring/security-disclosure-lifecycle.md`](docs/doctoring/security-disclosure-lifecycle.md).
+
+Publishing this policy does not by itself establish ISO certification, complete SSDF conformance, a legal safe harbor, or a contractual service level. Deployed hosts and commercial agreements retain their own incident-response, regulatory, notification, and contractual obligations.
diff --git a/docs/doctoring/office-python-support-contract.md b/docs/doctoring/office-python-support-contract.md
new file mode 100644
index 00000000..6beaafb7
--- /dev/null
+++ b/docs/doctoring/office-python-support-contract.md
@@ -0,0 +1,125 @@
+# Doctoring record: Inkspan Office Python support contract
+
+Decision date: 2026-08-09
+
+## Problem
+
+Protected `main` advertised Inkspan Office as compatible with Python 3.11, 3.12,
+3.13, and 3.14 through package classifiers while `requires-python = ">=3.11"`
+left every future Python version installable by metadata. The repository CI only
+executed the Office suite on Python 3.11 and 3.14. The same hash-locked dependency
+file described an `ubuntu-latest` runner even though pull-request CI already ran
+on Ubuntu 24.04, and the release workflow still consumed that lock on
+`ubuntu-latest`.
+
+Those facts created three separate assurance gaps: 3.12/3.13 were advertised but
+not directly exercised; future Python versions were installable before support
+was demonstrated; and release verification could move to a different runner
+image than the environment named by the lock contract.
+
+## Decision
+
+Inkspan Office uses one explicit support set for the current release line:
+Python 3.11, 3.12, 3.13, and 3.14 on GitHub-hosted Ubuntu 24.04 x64 CI/release
+jobs.
+
+- `office/pyproject.toml` bounds `requires-python` to `>=3.11,<3.15` and retains
+  classifiers for exactly those four supported minor releases.
+- `.github/workflows/ci.yml` executes the complete Office verification job on
+  every supported minor rather than inferring intermediate compatibility from
+  endpoint testing.
+- `office/requirements-ci.txt` describes the same fixed Ubuntu 24.04 environment.
+- `.github/workflows/release.yml` uses Ubuntu 24.04 for both artifact creation and
+  publication, preventing the release path from silently drifting with the
+  `ubuntu-latest` alias.
+- Root and Office README verification language names the complete tested Python
+  matrix.
+
+This is a support/evidence correction only. It does not change the renderer's
+runtime behavior, dependency set, network boundary, Office contract, host
+ownership, credentials, model use, persistence, or publication authority.
+
+## Alternatives considered
+
+### Keep endpoint-only testing
+
+Testing only Python 3.11 and 3.14 is cheaper, but it leaves 3.12 and 3.13 as
+metadata claims without direct package, dependency, wheel, docstring, and
+100%-coverage evidence. Rejected for a commercial package whose classifiers
+explicitly advertise those versions.
+
+### Keep `requires-python = ">=3.11"`
+
+This avoids a future metadata edit, but installation tools may treat future
+Python versions as compatible before Inkspan has run its release-quality suite
+there. Rejected in favor of fail-closed compatibility metadata.
+
+### Keep `ubuntu-latest`
+
+The alias is convenient but intentionally moves as GitHub changes its latest
+stable image. Because Inkspan's hash-locked Office dependencies and release
+verification are part of acquisition/reproducibility evidence, a fixed supported
+runner label is preferable. Ubuntu 24.04 is an explicitly supported
+GitHub-hosted runner label as of this decision date.
+
+## Failure and recovery
+
+If one supported Python minor cannot install the hash-locked wheel set or fails
+Office tests, that minor remains unsupported for merge/release purposes until the
+root cause is corrected. Do not delete a classifier, relax a hash, or skip a
+matrix entry merely to obtain green CI without a compatibility decision.
+
+When Python 3.15 is deliberately adopted, update the upper bound, classifier,
+CI matrix, hash-locked wheel inventory, README statements, and this decision
+record together. Prove the new exact-head matrix before release.
+
+If Ubuntu 24.04 is retired, select a stable supported replacement, regenerate or
+revalidate platform-specific hashes where necessary, and update CI, release,
+lockfile guidance, tests, and documentation in one reviewed change.
+
+## Security and supply-chain impact
+
+Bounding Python compatibility prevents unverified interpreter versions from
+being presented as supported package installs. Testing every advertised minor
+also exercises the exact hash-locked dependencies, package build, schema/license
+contents, public-docstring gate, and 100% branch-coverage suite on each runtime.
+Pinning the runner label removes one avoidable moving-environment dimension from
+release evidence while preserving immutable action SHAs and hash verification.
+
+No credential, permission, network endpoint, or release authority is broadened.
+
+## Verification
+
+`office/tests/test_python_support_contract.py` machine-checks:
+
+1. bounded `requires-python` metadata;
+2. exact classifier/runtime correspondence;
+3. CI coverage of all four supported Python minors;
+4. fixed Ubuntu 24.04 lockfile guidance;
+5. root and Office README runtime statements; and
+6. fixed Ubuntu 24.04 release jobs.
+
+The normal Office CI matrix then installs the hash-locked dependencies, runs
+`pip check`, enforces shipped-symbol docstrings, executes the complete test suite
+at 100% branch coverage, builds the wheel, and inspects packaged schema/license
+contents on each supported minor.
+
+## Rollback and supersession
+
+Rollback is a normal revert only if the previous broader support claims are also
+restored deliberately and their reduced evidence is acceptable. A future Python
+support decision supersedes this record only when metadata, CI, release runner,
+lockfile evidence, and buyer documentation remain internally consistent.
+
+## APA 7 references
+
+GitHub. (n.d.). *GitHub-hosted runners reference*. GitHub Docs. Retrieved August
+9, 2026, from https://docs.github.com/en/actions/reference/runners/github-hosted-runners
+
+Python Packaging Authority. (n.d.). *Core metadata specifications: Requires-Python*.
+Python Packaging User Guide. Retrieved August 9, 2026, from
+https://packaging.python.org/en/latest/specifications/core-metadata/#requires-python
+
+Python Packaging Authority. (n.d.). *pyproject.toml specification*. Python
+Packaging User Guide. Retrieved August 9, 2026, from
+https://packaging.python.org/en/latest/specifications/pyproject-toml/
diff --git a/docs/doctoring/release-draft-asset-inventory.md b/docs/doctoring/release-draft-asset-inventory.md
new file mode 100644
index 00000000..efee470e
--- /dev/null
+++ b/docs/doctoring/release-draft-asset-inventory.md
@@ -0,0 +1,81 @@
+# Doctoring record: exact draft release asset inventory
+
+**Decision date:** 2026-08-07
+**Scope:** GitHub Release publication only; no Inkspan runtime, editor, persistence, collaboration, provider, tenant, credential, or database behavior changes.
+
+## Problem
+
+Inkspan's release workflow intentionally supports retrying an unpublished GitHub Release draft. The upload command uses `--clobber`, which replaces same-name release assets. A prior failed attempt or operator action can nevertheless leave a differently named asset in the draft. Publishing that draft while immutable releases are enabled would freeze the extra asset into the official release identity.
+
+This is a provenance-completeness problem rather than a checksum-collision problem. The expected npm tarball, Office wheel, and checksum file can each be correctly hashed and attested while an unrelated fourth asset remains attached to the draft. Verifying only the expected local artifacts therefore does not prove that the complete release asset set is the reviewed set.
+
+A second local-boundary failure mode exists before upload. Counting only top-level regular files does not prove that the transfer directory has exactly three entries: an unexpected directory, symlink, socket, or other non-regular top-level entry could coexist with the three expected files. The shell upload glob can expand such an entry even though a `find ... -type f` count ignores it. The local release boundary therefore has to bind both the complete top-level entry set and the regular-file subset before attestation or upload.
+
+## Primary evidence
+
+GitHub documents that immutable-release protection begins after publication and that draft releases remain mutable beforehand. GitHub also recommends attaching all intended assets to the draft before publishing it. The GitHub CLI documents `gh release upload --clobber` as deleting and re-uploading an existing asset of the same name; it does not define `--clobber` as pruning differently named assets. The current Releases REST representation exposes each asset's `name`, `state`, and content `digest`, including SHA-256 digests.
+
+Draft retrieval has an important API distinction. GitHub documents **List releases** as returning draft releases to authenticated callers with repository push access, while **Get a release by tag name** is explicitly documented as retrieving a published release. A pre-publication control must therefore not rely on the by-tag endpoint for draft evidence. Inkspan uses the paginated authenticated release listing, selects the exact tag, requires exactly one match, and then validates that match as a draft.
+
+These properties make the pre-publication draft the last safe point at which Inkspan can verify both set completeness and byte identity without trying to repair an already immutable release.
+
+## Decision
+
+After the expected files cross the workflow-artifact privilege boundary and before attestation or upload, and again after upload before `gh release edit ... --draft=false`, the release workflow must:
+
+1. Require the local transfer directory to contain exactly three top-level entries and require all three to be regular files: one `*.tgz`, one `*.whl`, and `SHA256SUMS`. Any extra directory, symlink, socket, device, or other non-regular top-level entry fails closed.
+2. Paginate the authenticated GitHub **List releases** REST endpoint and select the exact release tag; require exactly one matching release object.
+3. Require the selected remote object to remain a draft.
+4. Compare the sorted local and remote asset-name sets for exact equality.
+5. Require every remote asset to be in the `uploaded` state.
+6. Compute a fresh local SHA-256 for each transferred file and require the corresponding GitHub asset `sha256:` digest to match exactly.
+7. Fail closed before publication if any local entry type, tag match, draft state, name, state, count, or digest differs.
+
+The workflow does not automatically delete an unexpected stale asset. Automatic deletion would turn a provenance gate into an unreviewed cleanup authority and could destroy a deliberately attached operator artifact. The failure message instead directs the operator to remove the stale draft or unexpected asset and rerun the reviewed tag.
+
+## Threat and failure analysis
+
+### Covered
+
+- A failed prior attempt leaves an obsolete wheel, tarball, checksum file, or other differently named asset in the draft.
+- A same-name remote asset contains bytes different from the transferred local file.
+- An upload is incomplete or an asset does not report the `uploaded` state.
+- The local artifact directory unexpectedly contains multiple npm tarballs, multiple wheels, missing checksums, another regular file, or any additional non-regular top-level entry.
+- A symlink or directory replaces one of the expected regular files.
+- The release stops being a draft before the inventory check.
+- The draft cannot be uniquely identified in the complete authenticated release listing.
+- A future refactor accidentally replaces draft-aware list evidence with the published-only by-tag endpoint.
+
+### Deliberately outside this gate
+
+A repository administrator remains a higher authority and can intentionally mutate a draft after this verification and before publication. Tag-scoped workflow concurrency prevents another release-workflow run for the same tag, but it cannot remove GitHub administrator authority. This residual boundary is documented rather than represented as impossible.
+
+The gate also does not claim byte-for-byte reproducibility across independent package rebuilds. It proves that the exact transferred artifacts selected by the reviewed tagged build are the complete files attached to the draft at the verification point.
+
+## Privacy and observability
+
+The comparison uses only public release filenames, asset states, tag identity, file-entry type, and cryptographic digests. It does not emit source content, document bodies, tenant identifiers, credentials, local absolute paths, or package internals. SHA-256 digests here are artifact equality evidence, not authorization or confidentiality controls.
+
+## Rollback
+
+This change is workflow-only and can be reverted without changing package APIs or stored data. If GitHub changes draft visibility, release asset representation, pagination, or the digest contract, publication must remain fail-closed until the workflow and deterministic repository contract are updated against the new official API. Operators must not bypass the gate by weakening the expected artifact count or entry-type boundary, accepting ambiguous release matches, or accepting missing digest evidence.
+
+## Verification
+
+`src/releaseDraftAssetInventory.test.ts` fixes the security ordering and semantic markers in the permanent release workflow. It requires the exact-inventory check to occur after upload and before publication, requires the bounded three-file artifact set, requires paginated draft-aware list evidence rather than the published-only by-tag route, and requires state and digest validation plus explicit fail-closed diagnostics. On Linux, which is the release-runner class, the same test extracts and executes the exact reviewed shell body with a local fake `gh api` response and the runner's real Bash, `jq`, `find`, `diff`, and `sha256sum`. Deterministic fixtures prove the accepted exact-inventory path and fail-closed behavior for an unexpected remote asset, a digest mismatch, an incomplete upload state, and a release that is no longer a draft without network access or publication authority.
+
+`src/releaseDraftAssetEntryType.test.ts` separately extracts and executes the exact pre-attestation local validation shell. Its RED test commit `0d905d9b244d36d55317de2237e3e3480c7ece5f` proved that the earlier regular-file-only count admitted a fourth top-level directory. The production repair counts the complete top-level entry set as well as the regular-file subset, so the same deterministic fixture now fails closed before attestation or upload while the exact three-file fixture remains accepted.
+
+The feature branch was created from protected `main` commit `ca49a3249403be88ba3cb7c9589b3652f820e17c`. Test-only commits preceded the corresponding workflow implementations. Exact-current-head CI, security, automated review, independent review, and branch protection remain authoritative; predecessor-head or synthetic-merge evidence is not accepted as completion evidence.
+
+## References
+
+GitHub. (n.d.-a). *Immutable releases*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/supply-chain-security/immutable-releases
+
+GitHub. (n.d.-b). *Managing releases in a repository*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository
+
+GitHub. (n.d.-c). *List releases*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/rest/releases/releases?apiVersion=2026-03-10#list-releases
+
+GitHub. (n.d.-d). *Get a release by tag name*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/rest/releases/releases?apiVersion=2026-03-10#get-a-release-by-tag-name
+
+GitHub CLI. (n.d.). *gh release upload*. GitHub CLI manual. Retrieved August 7, 2026, from https://cli.github.com/manual/gh_release_upload
diff --git a/docs/doctoring/security-disclosure-lifecycle.md b/docs/doctoring/security-disclosure-lifecycle.md
new file mode 100644
index 00000000..9887580d
--- /dev/null
+++ b/docs/doctoring/security-disclosure-lifecycle.md
@@ -0,0 +1,116 @@
+# Doctoring record: security disclosure and vulnerability handling
+
+**Decision date:** 2026-08-08  
+**Scope:** Repository-native security reporting, supported-release communication, vulnerability handling, coordinated disclosure, and acquisition-review evidence for Inkspan.  
+**Status:** Accepted for the bounded documentation slice; implementation evidence remains subject to exact-head CI, review, and protected merge.
+
+## Problem
+
+Inkspan already carries security-focused implementation, testing, release, and architecture evidence, but protected `main` had no root `SECURITY.md`. GitHub's repository security-policy guidance explicitly uses `SECURITY.md` to communicate supported versions and vulnerability-reporting instructions. Without that repository-native entry point, an external researcher or acquisition reviewer has to infer the reporting path from unrelated implementation documentation, increasing the chance of accidental public disclosure or inconsistent handling.
+
+The gap is operational rather than a new runtime authority. Inkspan must not absorb host-owned transport, authorization, tenant isolation, persistence, credentials, migration, retention, incident-response, or model-use policy merely because it publishes a vulnerability-reporting contract.
+
+## Current-source review
+
+### ISO/IEC 29147:2018
+
+ISO identifies ISO/IEC 29147:2018, *Information technology — Security techniques — Vulnerability disclosure*, as the current published second edition. ISO states that the standard provides requirements and recommendations for receiving potential-vulnerability reports, disclosing remediation information, and coordinating vulnerability disclosure. ISO reports that this edition was reviewed and confirmed in 2024, while its lifecycle now records that a revision is under development.
+
+Decision: use the current published 2018 edition as the vulnerability-disclosure baseline. Do not represent an unpublished successor as authoritative production guidance.
+
+### ISO/IEC 30111:2019
+
+ISO identifies ISO/IEC 30111:2019, *Information technology — Security techniques — Vulnerability handling processes*, as the current published second edition. It covers processing and remediating reported potential vulnerabilities. ISO records confirmation in 2025 and also indicates that a revision is planned.
+
+Decision: use the current published 2019 edition for the handling lifecycle while recording that standards maintenance continues. The policy does not claim certification.
+
+### NIST SP 800-218 SSDF Version 1.1
+
+NIST SP 800-218 is the final Secure Software Development Framework (SSDF) Version 1.1. Its Respond to Vulnerabilities practice group establishes vulnerability identification, remediation, root-cause analysis, and prevention as secure-development concerns, and NIST explicitly positions SSDF terminology as useful to software acquirers as well as producers.
+
+NIST published an Initial Public Draft of SP 800-218 Rev. 1 / SSDF Version 1.2 on December 17, 2025. Version 1.2 remains a draft at this decision date; it is useful directional context but is not substituted for the final Version 1.1 baseline in the public policy.
+
+Decision: bind public claims to final SSDF Version 1.1 and explicitly label Version 1.2 as draft. This avoids treating a draft as a completed standard while still tracking the latest NIST work.
+
+### GitHub repository security policy and private vulnerability reporting
+
+Current GitHub documentation recommends a repository `SECURITY.md` containing supported-version and reporting instructions. GitHub private vulnerability reporting, when enabled, gives reporters a private structured path into repository security advisories. GitHub also documents the fallback when private vulnerability reporting is unavailable: a public issue may ask for a preferred private security contact, but vulnerability details should not be disclosed in that public issue.
+
+Decision: the policy says to use **Report a vulnerability** when GitHub exposes that control. It does not claim the repository setting is enabled because this documentation slice cannot safely infer administrative configuration from source. If the control is absent, the only public issue content should be a request for a private contact without technical vulnerability details.
+
+## Accepted product contract
+
+### Supported releases
+
+Inkspan remains pre-1.0. The public support table therefore identifies the newest released `0.5.x` editor line and newest released `0.1.x` Office-renderer line rather than promising indefinite backports across historical minors. Unreleased branches and pull requests remain development evidence, not supported releases.
+
+This does not prevent a coordinated backport when user risk requires one. It prevents an acquisition reviewer from mistaking every historical pre-1.0 artifact for an actively maintained security line.
+
+### Private intake and data minimization
+
+The public policy requires private intake for vulnerability details and explicitly excludes proof-of-concept payloads, production credentials, access tokens, private tenant identifiers, and customer documents from public issues. Reports should use synthetic fixtures and the smallest reproduction that proves the boundary failure.
+
+This aligns with Inkspan's existing local-versus-shareable evidence boundary: security and acquisition evidence can be shared without reproducing private tenant content.
+
+### Vulnerability-handling lifecycle
+
+The policy defines a bounded lifecycle:
+
+1. create a private case and preserve the report without copying sensitive payloads into routine logs;
+2. reproduce against the exact affected release and current development head;
+3. classify the Inkspan versus host-owned boundary, impact, prerequisites, release scope, and multi-vendor coordination needs;
+4. implement the minimum root-cause repair with a permanent root-cause regression test;
+5. rerun exact-head CI, security, coverage, packaging/provenance, and independent-review gates;
+6. prepare a GitHub Security Advisory and CVE request when appropriate;
+7. coordinate release and disclosure around actual user risk and remediation readiness; and
+8. publish affected/fixed-version guidance without leaking private customer evidence.
+
+A queued, cancelled, failed, predecessor-head, stale-head, or synthetic-merge result cannot be promoted into successful fix evidence.
+
+### Ownership boundary
+
+Inkspan owns editor and deterministic conversion surfaces. Hosts continue to own host-owned transport, authorization, tenant isolation, persistence, credentials, migration, retention, collaboration authorization, deployment policy, and model-use policy. Organization-level GitHub automation belongs to `ContextualWisdomLab/.github`; provider/model-routing behavior belongs to `ContextualWisdomLab/contextual-orchestrator` unless the defect originates in Inkspan's documented interface.
+
+This routing prevents a vulnerability policy from becoming an accidental monolith or an implied operational service boundary.
+
+### Response, bounty, safe-harbor, and legal claims
+
+The repository policy does not promise a response-time SLA, remediation deadline, bounty, payment, or legal safe harbor. Those commitments depend on commercial support terms, jurisdiction, and explicit organizational authorization. It does forbid destructive or unauthorized testing and instructs researchers to minimize sensitive data.
+
+The policy also does not claim ISO certification or complete SSDF conformance. The standards are design and process inputs; conformance and certification require broader evidence than one repository document.
+
+## Verification contract
+
+`src/securityPolicyDocumentation.test.ts` binds the repository to the following deterministic claims:
+
+- root `SECURITY.md` exists and contains the GitHub-recognized policy structure;
+- private reporting and safe public fallback are explicit;
+- supported pre-1.0 release lines are explicit;
+- host-ownership and evidence boundaries remain explicit;
+- the handling lifecycle requires exact version, minimal reproduction, regression, exact-head verification, and coordinated disclosure;
+- the policy does not promise an SLA; and
+- this record contains the current standards, draft-status, APA 7, and non-conformance claim boundaries.
+
+The test is intentionally documentation-focused. It does not prove that GitHub private vulnerability reporting is administratively enabled, that a reporter will receive a particular response time, or that a deployed host satisfies ISO, NIST, regulatory, or contractual requirements.
+
+## Acquisition and rollback value
+
+For acquisition diligence, the root policy gives a reviewer a concrete answer to five questions that were previously implicit: what release is supported, where security reports go, what evidence is safe to send, who owns which vulnerability class, and what gates a security fix must pass before release.
+
+Rollback is simple because this slice changes no runtime or package behavior. If the policy becomes inaccurate, revert the documentation/test commits or replace them with a reviewed successor policy. Do not remove the private-disclosure entry point without replacing it with another explicit private reporting route.
+
+## APA 7 references
+
+GitHub. (n.d.). *Adding a security policy to your repository*. GitHub Docs. Retrieved August 8, 2026, from https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/add-security-policy
+
+GitHub. (n.d.). *Configuring private vulnerability reporting for a repository*. GitHub Docs. Retrieved August 8, 2026, from https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository
+
+GitHub. (n.d.). *Coordinated disclosure of security vulnerabilities*. GitHub Docs. Retrieved August 8, 2026, from https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/coordinated-disclosure
+
+International Organization for Standardization. (2018). *Information technology—Security techniques—Vulnerability disclosure (ISO/IEC Standard No. 29147:2018).* https://www.iso.org/standard/72311.html
+
+International Organization for Standardization. (2019). *Information technology—Security techniques—Vulnerability handling processes (ISO/IEC Standard No. 30111:2019).* https://www.iso.org/standard/69725.html
+
+Booth, H., Ogata, M., Kent, K., Souppaya, M., & Dodson, D. (2025). *Secure Software Development Framework (SSDF) Version 1.2: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218 Rev. 1, Initial Public Draft). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218r1.ipd
+
+Scarfone, K., Souppaya, M., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) Version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218
diff --git a/docs/release-security.md b/docs/release-security.md
index 96cd6fa8..906cc38e 100644
--- a/docs/release-security.md
+++ b/docs/release-security.md
@@ -40,7 +40,8 @@ The release workflow repeats the merge gates against the tagged source rather th
 9. Office dependency consistency, 100% shipped-symbol docstring coverage, and 100% branch coverage;
 10. Office wheel construction and inspection for the bundled schema and license;
 11. SHA-256 checksum generation for every distributable artifact;
-12. checksum verification after the privilege boundary.
+12. checksum verification after the privilege boundary; and
+13. exact draft asset inventory and digest verification before publication.
 
 No release draft is created or modified unless every build gate succeeds on the tagged commit.
 
@@ -53,13 +54,32 @@ Publication follows GitHub's immutable-release sequence:
 1. reject an existing published release rather than replacing its assets;
 2. create or resume a draft release;
 3. attach the complete attested artifact set while the release is still mutable;
-4. publish the draft;
-5. require GitHub to report `isImmutable: true` for the published release;
-6. verify the release attestation and every uploaded asset through GitHub CLI.
+4. verify the exact draft asset inventory and GitHub-reported digests;
+5. publish the draft;
+6. require GitHub to report `isImmutable: true` for the published release;
+7. verify the release attestation and every expected uploaded asset through GitHub CLI.
+
+### Exact draft asset inventory
+
+A resumed draft is not assumed to contain only artifacts from the current workflow attempt. `gh release upload --clobber` replaces an existing asset with the same name, but an unexpected stale asset with a different name can otherwise remain attached to the draft. Once an immutable release is published, every attached asset is frozen with that release identity.
+
+Immediately after upload and before the draft is published, the workflow therefore fails closed unless all of these conditions hold:
+
+- the local release directory contains exactly one npm `*.tgz`, one Office `*.whl`, and `SHA256SUMS`;
+- the canonical GitHub Releases API still reports the release as a draft;
+- the sorted remote asset-name set exactly equals the sorted local artifact-name set;
+- every remote asset reports the `uploaded` state; and
+- every GitHub release-asset `sha256:` digest exactly equals a newly computed SHA-256 digest of the corresponding transferred local file.
+
+The draft lookup deliberately uses the authenticated, paginated **List releases** REST endpoint and filters its complete result for the exact tag. GitHub documents that authenticated callers with repository push access receive draft releases from this endpoint. The `Get a release by tag name` endpoint is documented for a **published** release, so it is not used as evidence for this pre-publication gate. The publish job fails unless the paginated listing contains exactly one release matching the tag and that object still reports `draft: true`.
+
+An unexpected stale asset is not deleted automatically. The workflow stops before the draft is published and directs an operator to remove the stale draft or unexpected asset, then rerun from the reviewed tag. This avoids silently deleting an operator-created draft artifact while ensuring that unrelated content cannot become part of an immutable Inkspan release by persistence across retries.
+
+The exact-inventory comparison names only public release artifacts and does not expose source files, credentials, tenant data, document content, or local absolute paths. The gate also does not claim to prevent a repository administrator from deliberately mutating a draft in the narrow interval between validation and publication; repository administration remains a higher authority boundary. Tag-scoped workflow concurrency prevents competing release-workflow runs for the same tag.
 
 If GitHub reports that the newly published release is mutable, the workflow immediately deletes that release and fails. This rollback leaves the tag available for a retry after an administrator enables release immutability; it does not treat a mutable publication as a successful product release. If rollback itself fails, the workflow emits an explicit high-severity error and remains failed for operator intervention.
 
-A failed rerun may repair an existing draft with `--clobber`, but it can never overwrite a published release. A new successful release identity therefore requires a new reviewed version and tag unless the previous attempt ended only as a deleted mutable release or an unpublished draft.
+A failed rerun may repair same-name assets in an existing draft with `--clobber`, but it can never overwrite a published release. A new successful release identity therefore requires a new reviewed version and tag unless the previous attempt ended only as a deleted mutable release or an unpublished draft. Any unrelated asset left in that unpublished draft is a hard pre-publication failure rather than silently retained content.
 
 Enabling immutable releases is an administrative repository control. Repository owners can enable it in GitHub settings or with the `PUT /repos/ContextualWisdomLab/inkspan/immutable-releases` endpoint using a credential with repository Administration write permission. The release workflow cannot weaken or silently enable the policy.
 
@@ -71,7 +91,7 @@ Each successful GitHub release contains:
 - the `inkspan-office` wheel built from `office/`;
 - `SHA256SUMS` covering both distributable artifacts.
 
-The workflow does not rebuild artifacts after the read-only build job. The same transferred files are checksum-verified, attested, and uploaded to the release.
+The workflow does not rebuild artifacts after the read-only build job. The same transferred files are checksum-verified, attested, uploaded, inventory-checked against the draft, and then published.
 
 ## Provenance and verification
 
@@ -99,6 +119,7 @@ Use the actual version and filenames from the selected release. A successful att
 - The default and build-job workflow tokens are read-only.
 - Write, OpenID Connect, and attestation permissions exist only in the source-free publish job.
 - Release tags must identify a commit already merged into `main`.
+- The draft asset set and every GitHub-reported SHA-256 asset digest must exactly match the transferred local release set before publication.
 - The published release must report an immutable state; a mutable outcome is deleted and rejected.
 - Existing published assets are never refreshed, replaced, or deleted by a successful workflow path.
 - No issue, pull-request body, comment, branch name, or other untrusted free text is interpolated into executable release commands.
@@ -120,7 +141,9 @@ The release pipeline does not add runtime coupling. The npm package remains a ho
 
 - GitHub immutable releases and draft-first publication: <https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository>
 - GitHub immutable-release repository API and required permissions: <https://docs.github.com/en/rest/repos/repos?apiVersion=2026-03-10#check-if-immutable-releases-are-enabled-for-a-repository>
-- GitHub release object and immutable state: <https://docs.github.com/en/rest/releases/releases?apiVersion=2026-03-10>
+- GitHub List releases behavior, including authenticated draft visibility, release objects, asset `digest`, and immutable state: <https://docs.github.com/en/rest/releases/releases?apiVersion=2026-03-10#list-releases>
+- GitHub Get a release by tag name published-release contract: <https://docs.github.com/en/rest/releases/releases?apiVersion=2026-03-10#get-a-release-by-tag-name>
+- GitHub CLI release upload and same-name `--clobber` behavior: <https://cli.github.com/manual/gh_release_upload>
 - GitHub release attestation verification: <https://cli.github.com/manual/gh_release_verify>
 - GitHub artifact attestations: <https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations>
 - GitHub artifact-attestation concepts: <https://docs.github.com/en/actions/concepts/security/artifact-attestations>
diff --git a/office/README.md b/office/README.md
index 14b98c76..52eee4a9 100644
--- a/office/README.md
+++ b/office/README.md
@@ -106,7 +106,9 @@ python -m pip wheel . --no-deps --wheel-dir dist
 
 The suite re-opens every rendered format with its native library and verifies
 byte-for-byte deterministic output. CI installs runtime and test dependencies
-from `requirements-ci.txt` with wheel hashes on minimum Python 3.11 and current
-stable Python 3.14, enforces 100% statement/branch and shipped-symbol docstring
-coverage, then builds and inspects the distributable wheel. Code and all three
-direct runtime dependencies are MIT-licensed.
+from `requirements-ci.txt` with wheel hashes and executes the complete Office
+matrix on Python 3.11, Python 3.12, Python 3.13, and Python 3.14. The package
+metadata rejects unverified Python 3.15+ installs until that runtime is added to
+the tested support matrix. CI enforces 100% statement/branch and shipped-symbol
+docstring coverage, then builds and inspects the distributable wheel. Code and
+all three direct runtime dependencies are MIT-licensed.
diff --git a/office/pyproject.toml b/office/pyproject.toml
index 03c37fd9..809f0461 100644
--- a/office/pyproject.toml
+++ b/office/pyproject.toml
@@ -7,7 +7,7 @@ name = "inkspan-office"
 version = "0.1.0"
 description = "Deterministic JSON-to-DOCX/XLSX/PPTX renderer for AI-authored Inkspan documents"
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.11,<3.15"
 license = "MIT"
 license-files = ["LICENSE"]
 authors = [{ name = "ContextualWisdomLab" }]
diff --git a/office/requirements-ci.txt b/office/requirements-ci.txt
index 8a545a27..43d0fe26 100644
--- a/office/requirements-ci.txt
+++ b/office/requirements-ci.txt
@@ -1,5 +1,5 @@
-# Hash-locked Linux wheels for GitHub-hosted ubuntu-latest runners.
-# Supports the minimum CPython 3.11 and current stable CPython 3.14.
+# Hash-locked Linux wheels for GitHub-hosted ubuntu-24.04 runners.
+# Supports CPython 3.11, 3.12, 3.13, and 3.14.
 
 coverage @ https://files.pythonhosted.org/packages/37/e7/7069b3d6c018917f49ba2e1c5fb910e498c7fefa3a1b78cb1b79e61ff45d/coverage-7.15.3-py3-none-any.whl \
     --hash=sha256:da78fa6fc7dafe4212839173133ee85afcf42c5cd5f3e47fa7c1c210453b445e
@@ -13,7 +13,8 @@ lxml==6.1.0 \
     --hash=sha256:e69aa6805905807186eb00e66c6d97a935c928275182eb02ee40ba00da9623b2 \
     --hash=sha256:37fabd1452852636cf38ecdcc9dd5ca4bba7a35d6c53fa09725deeb894a87491 \
     --hash=sha256:fe022f20bc4569ec66b63b3fb275a3d628d9d32da6326b2982584104db6d3086 \
-    --hash=sha256:3f00972f84450204cd5d93a5395965e348956aaceaadec693a22ec743f8ae3eb
+    --hash=sha256:3f00972f84450204cd5d93a5395965e348956aaceaadec693a22ec743f8ae3eb \
+    --hash=sha256:bc783ee3147e60a25aa0445ea82b3e8aabb83b240f2b95d32cb75587ff781814
 openpyxl==3.1.5 \
     --hash=sha256:5282c12b107bffeef825f4617dc029afaf41d0ea60823bbb665ef3079dc79de2
 packaging==25.0 \
@@ -21,7 +22,8 @@ packaging==25.0 \
 Pillow==12.3.0 \
     --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
     --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
-    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b
+    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
+    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91
 pluggy==1.6.0 \
     --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
 Pygments==2.20.0 \
@@ -39,4 +41,4 @@ typing-extensions==4.15.0 \
 wheel==0.47.0 \
     --hash=sha256:212281cab4dff978f6cedd499cd893e1f620791ca6ff7107cf270781e587eced
 XlsxWriter==3.2.9 \
-    --hash=sha256:9a5db42bc5dff014806c58a20b9eae7322a134abb6fce3c92c181bfb275ec5b3
+    --hash=sha256:9a5db42bc5dff014806c58a20b9eae7322a134abb6fce3c92c181bfb275ec5b3
\ No newline at end of file
diff --git a/office/tests/test_python_support_contract.py b/office/tests/test_python_support_contract.py
new file mode 100644
index 00000000..7104fd66
--- /dev/null
+++ b/office/tests/test_python_support_contract.py
@@ -0,0 +1,95 @@
+"""Cross-file contract for the Python versions advertised by Inkspan Office."""
+
+from pathlib import Path
+import re
+import tomllib
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+SUPPORTED_PYTHON_VERSIONS = ("3.11", "3.12", "3.13", "3.14")
+PYTHON_312_LXML_LINUX_SHA256 = (
+    "bc783ee3147e60a25aa0445ea82b3e8aabb83b240f2b95d32cb75587ff781814"
+)
+PYTHON_312_PILLOW_LINUX_SHA256 = (
+    "78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91"
+)
+
+
+def _repository_text(relative_path: str) -> str:
+    """Read one repository text artifact as UTF-8."""
+
+    return (REPOSITORY_ROOT / relative_path).read_text(encoding="utf-8")
+
+
+def _workflow_job_block(workflow: str, job_name: str) -> str:
+    """Return one named top-level job block from a repository workflow."""
+
+    match = re.search(
+        rf"(?ms)^  {re.escape(job_name)}:\n(?P<body>.*?)(?=^  [A-Za-z0-9_-]+:\n|\Z)",
+        workflow,
+    )
+    assert match is not None, f"workflow job {job_name!r} is missing"
+    return f"  {job_name}:\n{match.group('body')}"
+
+
+def test_python_support_range_matches_classifiers_and_ci_matrix() -> None:
+    """Require package metadata and the Office CI job to cover the same minors."""
+
+    pyproject = tomllib.loads(_repository_text("office/pyproject.toml"))
+    project = pyproject["project"]
+    assert project["requires-python"] == ">=3.11,<3.15"
+
+    classified_versions = tuple(
+        classifier.rsplit(" :: ", maxsplit=1)[-1]
+        for classifier in project["classifiers"]
+        if classifier.startswith("Programming Language :: Python :: 3.")
+    )
+    assert classified_versions == SUPPORTED_PYTHON_VERSIONS
+
+    workflow = _repository_text(".github/workflows/ci.yml")
+    office_job = _workflow_job_block(workflow, "office")
+    assert "runs-on: ubuntu-24.04" in office_job
+    assert "runs-on: ubuntu-latest" not in office_job
+    matrix_match = re.search(r'python-version:\s*\[([^\]]+)\]', office_job)
+    assert matrix_match is not None
+    matrix_versions = tuple(re.findall(r'"(3\.\d+)"', matrix_match.group(1)))
+    assert matrix_versions == SUPPORTED_PYTHON_VERSIONS
+
+
+def test_python_support_documentation_matches_the_fixed_ci_environment() -> None:
+    """Keep buyer-facing and lockfile guidance aligned with the tested runtime set."""
+
+    requirements = _repository_text("office/requirements-ci.txt")
+    office_readme = _repository_text("office/README.md")
+    root_readme = _repository_text("README.md")
+
+    assert "ubuntu-24.04" in requirements
+    assert "ubuntu-latest" not in requirements
+    for version in SUPPORTED_PYTHON_VERSIONS:
+        assert f"Python {version}" in office_readme
+        assert f"Python {version}" in root_readme
+
+
+def test_python_312_binary_wheels_are_covered_by_the_hash_lock() -> None:
+    """Keep the exact Ubuntu CPython 3.12 binary wheel digests in the lock."""
+
+    requirements = _repository_text("office/requirements-ci.txt")
+    lxml_block = requirements[
+        requirements.index("lxml==6.1.0") : requirements.index("openpyxl==3.1.5")
+    ]
+    pillow_block = requirements[
+        requirements.index("Pillow==12.3.0") : requirements.index("pluggy==1.6.0")
+    ]
+
+    assert f"--hash=sha256:{PYTHON_312_LXML_LINUX_SHA256}" in lxml_block
+    assert f"--hash=sha256:{PYTHON_312_PILLOW_LINUX_SHA256}" in pillow_block
+
+
+def test_release_workflow_uses_the_same_fixed_runner_contract() -> None:
+    """Bind both release jobs independently to the supported runner image."""
+
+    release_workflow = _repository_text(".github/workflows/release.yml")
+    for job_name in ("build-release-artifacts", "publish-release"):
+        job = _workflow_job_block(release_workflow, job_name)
+        assert "runs-on: ubuntu-24.04" in job
+        assert "runs-on: ubuntu-latest" not in job
diff --git a/src/releaseDraftAssetEntryType.test.ts b/src/releaseDraftAssetEntryType.test.ts
new file mode 100644
index 00000000..4b1d9dd3
--- /dev/null
+++ b/src/releaseDraftAssetEntryType.test.ts
@@ -0,0 +1,96 @@
+import { spawnSync } from 'node:child_process';
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+/** Read one authoritative repository file as UTF-8 text. */
+function repositoryFile(path: string): string {
+  return readFileSync(resolve(process.cwd(), path), 'utf8');
+}
+
+const workflow = repositoryFile('.github/workflows/release.yml');
+
+/** Extract the exact Linux shell body that validates local release entries. */
+function localReleaseInventoryScript(): string {
+  const validationIndex = workflow.indexOf(
+    '- name: Verify bounded local release artifact set',
+  );
+  const attestIndex = workflow.indexOf(
+    '- name: Attest release artifacts',
+    validationIndex,
+  );
+  if (validationIndex < 0 || attestIndex < 0) {
+    throw new Error('Local release validation or attestation step is missing.');
+  }
+
+  const validationStep = workflow.slice(validationIndex, attestIndex);
+  const runMarker = '        run: |\n';
+  const runIndex = validationStep.indexOf(runMarker);
+  if (runIndex < 0) {
+    throw new Error('Local release validation step has no shell body.');
+  }
+
+  return validationStep
+    .slice(runIndex + runMarker.length)
+    .split('\n')
+    .map((line) => (line.startsWith('          ') ? line.slice(10) : line))
+    .join('\n')
+    .trimEnd();
+}
+
+/** Execute the exact local release-entry validation with deterministic files. */
+function runLocalReleaseInventory(
+  mutate?: (releaseDirectory: string) => void,
+): { status: number | null; stdout: string; stderr: string } {
+  const root = mkdtempSync(join(tmpdir(), 'inkspan-local-release-inventory-'));
+  try {
+    const releaseDirectory = join(root, 'release');
+    mkdirSync(releaseDirectory);
+    writeFileSync(join(releaseDirectory, 'inkspan.tgz'), 'npm-package');
+    writeFileSync(join(releaseDirectory, 'inkspan_office.whl'), 'office-wheel');
+    writeFileSync(join(releaseDirectory, 'SHA256SUMS'), 'checksums');
+    mutate?.(releaseDirectory);
+
+    const result = spawnSync('bash', ['-c', localReleaseInventoryScript()], {
+      cwd: root,
+      encoding: 'utf8',
+    });
+    return {
+      status: result.status,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    };
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+describe('local release artifact entry-type boundary', () => {
+  it('accepts exactly the three expected regular release files', () => {
+    if (process.platform !== 'linux') return;
+
+    const result = runLocalReleaseInventory();
+
+    expect(result.status).toBe(0);
+    expect(result.stderr).toBe('');
+  });
+
+  it('fails closed before attestation when an unexpected directory is present', () => {
+    if (process.platform !== 'linux') return;
+
+    const result = runLocalReleaseInventory((releaseDirectory) => {
+      mkdirSync(join(releaseDirectory, 'stale-directory'));
+    });
+
+    expect(result.status).toBe(1);
+    expect(result.stdout).toContain('Unexpected local release artifact set');
+  });
+});
diff --git a/src/releaseDraftAssetInventory.test.ts b/src/releaseDraftAssetInventory.test.ts
new file mode 100644
index 00000000..972abe0f
--- /dev/null
+++ b/src/releaseDraftAssetInventory.test.ts
@@ -0,0 +1,277 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+/** Read one authoritative repository file as UTF-8 text. */
+function repositoryFile(path: string): string {
+  return readFileSync(resolve(process.cwd(), path), 'utf8');
+}
+
+const workflow = repositoryFile('.github/workflows/release.yml');
+
+interface ReleaseAssetFixture {
+  name: string;
+  state: string;
+  digest: string;
+}
+
+interface ReleaseFixture {
+  tag_name: string;
+  draft: boolean;
+  assets: ReleaseAssetFixture[];
+}
+
+/** Extract the exact Linux shell body used to validate a draft release. */
+function releaseInventoryScript(): string {
+  const inventoryIndex = workflow.indexOf(
+    '- name: Verify exact draft release asset inventory',
+  );
+  const publishIndex = workflow.indexOf(
+    '- name: Publish immutable GitHub release',
+    inventoryIndex,
+  );
+  if (inventoryIndex < 0 || publishIndex < 0) {
+    throw new Error('Release inventory or publication step is missing.');
+  }
+
+  const inventoryStep = workflow.slice(inventoryIndex, publishIndex);
+  const runMarker = '        run: |\n';
+  const runIndex = inventoryStep.indexOf(runMarker);
+  if (runIndex < 0) {
+    throw new Error('Release inventory step has no shell body.');
+  }
+
+  return inventoryStep
+    .slice(runIndex + runMarker.length)
+    .split('\n')
+    .map((line) => (line.startsWith('          ') ? line.slice(10) : line))
+    .join('\n')
+    .trimEnd();
+}
+
+/** Return a GitHub-compatible SHA-256 asset digest for deterministic fixtures. */
+function releaseDigest(content: string): string {
+  return `sha256:${createHash('sha256').update(content).digest('hex')}`;
+}
+
+/** Execute the exact release inventory shell with a local fake GitHub API. */
+function runReleaseInventory(
+  mutate?: (pages: ReleaseFixture[][]) => void,
+): { status: number | null; stdout: string; stderr: string } {
+  const root = mkdtempSync(join(tmpdir(), 'inkspan-release-inventory-'));
+  try {
+    const releaseDirectory = join(root, 'release');
+    const binDirectory = join(root, 'bin');
+    mkdirSync(releaseDirectory);
+    mkdirSync(binDirectory);
+
+    const localFiles = {
+      'inkspan.tgz': 'npm-package',
+      'inkspan_office.whl': 'office-wheel',
+      SHA256SUMS: 'checksums',
+    } as const;
+    for (const [name, content] of Object.entries(localFiles)) {
+      writeFileSync(join(releaseDirectory, name), content);
+    }
+
+    const release: ReleaseFixture = {
+      tag_name: 'v0.6.0',
+      draft: true,
+      assets: Object.entries(localFiles).map(([name, content]) => ({
+        name,
+        state: 'uploaded',
+        digest: releaseDigest(content),
+      })),
+    };
+    const pages: ReleaseFixture[][] = [[release]];
+    mutate?.(pages);
+
+    const fixturePath = join(root, 'release-pages.json');
+    writeFileSync(fixturePath, JSON.stringify(pages));
+
+    const fakeGhPath = join(binDirectory, 'gh');
+    writeFileSync(
+      fakeGhPath,
+      [
+        '#!/usr/bin/env bash',
+        'set -euo pipefail',
+        'if [[ "${1:-}" != "api" ]]; then',
+        '  echo "unsupported gh command" >&2',
+        '  exit 64',
+        'fi',
+        'cat "$INKSPAN_RELEASE_FIXTURE"',
+        '',
+      ].join('\n'),
+    );
+    chmodSync(fakeGhPath, 0o755);
+
+    const result = spawnSync('bash', ['-c', releaseInventoryScript()], {
+      cwd: root,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        PATH: `${binDirectory}:${process.env.PATH ?? ''}`,
+        GITHUB_REF_NAME: 'v0.6.0',
+        GITHUB_REPOSITORY: 'ContextualWisdomLab/inkspan',
+        INKSPAN_RELEASE_FIXTURE: fixturePath,
+      },
+    });
+    return {
+      status: result.status,
+      stdout: result.stdout,
+      stderr: result.stderr,
+    };
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+describe('release draft asset inventory contract', () => {
+  it('rejects an unexpected local artifact before attestation or upload', () => {
+    const localValidationIndex = workflow.indexOf(
+      '- name: Verify bounded local release artifact set',
+    );
+    const attestIndex = workflow.indexOf('- name: Attest release artifacts');
+    const uploadIndex = workflow.indexOf('gh release upload "$GITHUB_REF_NAME"');
+
+    expect(localValidationIndex).toBeGreaterThan(-1);
+    expect(attestIndex).toBeGreaterThan(localValidationIndex);
+    expect(uploadIndex).toBeGreaterThan(attestIndex);
+
+    const localValidationStep = workflow.slice(
+      localValidationIndex,
+      attestIndex,
+    );
+    expect(localValidationStep).toContain('expected_asset_count=3');
+    expect(localValidationStep).toContain('*.tgz');
+    expect(localValidationStep).toContain('*.whl');
+    expect(localValidationStep).toContain('SHA256SUMS');
+    expect(localValidationStep).toContain(
+      'Unexpected local release artifact set',
+    );
+  });
+
+  it('validates the exact uploaded draft inventory before publishing', () => {
+    const uploadIndex = workflow.indexOf('gh release upload "$GITHUB_REF_NAME"');
+    const inventoryIndex = workflow.indexOf(
+      '- name: Verify exact draft release asset inventory',
+    );
+    const publishIndex = workflow.indexOf(
+      'gh release edit "$GITHUB_REF_NAME"',
+    );
+
+    expect(uploadIndex).toBeGreaterThan(-1);
+    expect(inventoryIndex).toBeGreaterThan(uploadIndex);
+    expect(publishIndex).toBeGreaterThan(inventoryIndex);
+
+    const inventoryStep = workflow.slice(inventoryIndex, publishIndex);
+    expect(inventoryStep).toContain('gh api');
+    expect(inventoryStep).toContain('--paginate');
+    expect(inventoryStep).toContain('--slurp');
+    expect(inventoryStep).toContain(
+      'repos/$GITHUB_REPOSITORY/releases?per_page=100',
+    );
+    expect(inventoryStep).toContain('select(.tag_name == $tag)');
+    expect(inventoryStep).not.toContain(
+      'releases/tags/$GITHUB_REF_NAME',
+    );
+    expect(inventoryStep).toContain('Expected exactly one draft release for tag');
+    expect(inventoryStep).toContain("release_state='.draft'");
+    expect(inventoryStep).toContain("asset_state='.assets[].state'");
+    expect(inventoryStep).toContain("asset_digest='.assets[].digest'");
+    expect(inventoryStep).toContain('sha256sum --');
+    expect(inventoryStep).toContain('Unexpected draft release asset inventory');
+    expect(inventoryStep).toContain('Draft release asset digest mismatch');
+  });
+
+  it('admits only the expected npm, wheel, and checksum artifact set', () => {
+    const inventoryIndex = workflow.indexOf(
+      '- name: Verify exact draft release asset inventory',
+    );
+    const publishIndex = workflow.indexOf(
+      'gh release edit "$GITHUB_REF_NAME"',
+    );
+    const inventoryStep = workflow.slice(inventoryIndex, publishIndex);
+
+    expect(inventoryStep).toContain('expected_asset_count=3');
+    expect(inventoryStep).toContain('*.tgz');
+    expect(inventoryStep).toContain('*.whl');
+    expect(inventoryStep).toContain('SHA256SUMS');
+    expect(inventoryStep).toContain('Unexpected local release artifact set');
+    expect(inventoryStep).toContain("asset_name='.assets[].name'");
+  });
+
+  it('documents fail-closed stale-draft handling and provenance scope', () => {
+    const releaseSecurity = repositoryFile('docs/release-security.md');
+    const changelog = repositoryFile('CHANGELOG.md');
+
+    expect(releaseSecurity).toContain('exact draft asset inventory');
+    expect(releaseSecurity).toContain('unexpected stale asset');
+    expect(releaseSecurity).toContain('before the draft is published');
+    expect(releaseSecurity).toContain('sha256:');
+    expect(releaseSecurity).toContain('List releases');
+    expect(changelog).toContain('draft release asset inventory');
+  });
+});
+
+if (process.platform === 'linux') {
+  describe('release draft asset inventory Linux execution', () => {
+    it('accepts only the exact uploaded draft and matching digests', () => {
+      const result = runReleaseInventory();
+
+      expect(result.status).toBe(0);
+      expect(result.stderr).toBe('');
+    });
+
+    it('fails closed when a stale remote asset remains attached', () => {
+      const result = runReleaseInventory((pages) => {
+        pages[0]![0]!.assets.push({
+          name: 'stale.zip',
+          state: 'uploaded',
+          digest: `sha256:${'0'.repeat(64)}`,
+        });
+      });
+
+      expect(result.status).toBe(1);
+      expect(result.stdout).toContain('Unexpected draft release asset inventory');
+    });
+
+    it('fails closed when GitHub reports a different asset digest', () => {
+      const result = runReleaseInventory((pages) => {
+        pages[0]![0]!.assets[0]!.digest = `sha256:${'0'.repeat(64)}`;
+      });
+
+      expect(result.status).toBe(1);
+      expect(result.stdout).toContain('Draft release asset digest mismatch');
+    });
+
+    it('fails closed when any remote asset is not fully uploaded', () => {
+      const result = runReleaseInventory((pages) => {
+        pages[0]![0]!.assets[0]!.state = 'new';
+      });
+
+      expect(result.status).toBe(1);
+      expect(result.stdout).toContain('not fully uploaded');
+    });
+
+    it('fails closed if the selected release is no longer a draft', () => {
+      const result = runReleaseInventory((pages) => {
+        pages[0]![0]!.draft = false;
+      });
+
+      expect(result.status).toBe(1);
+      expect(result.stdout).toContain('Release must remain a draft');
+    });
+  });
+}
diff --git a/src/securityPolicyDocumentation.test.ts b/src/securityPolicyDocumentation.test.ts
new file mode 100644
index 00000000..ace16ed7
--- /dev/null
+++ b/src/securityPolicyDocumentation.test.ts
@@ -0,0 +1,100 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+const repositoryFile = (path: string): string =>
+  readFileSync(resolve(process.cwd(), path), 'utf8');
+
+const releasedMinorLine = (version: string): string => {
+  const [major, minor] = version.split('.');
+  if (major === undefined || minor === undefined) {
+    throw new Error('Expected a semantic package version');
+  }
+  return `${major}.${minor}.x`;
+};
+
+describe('security disclosure and vulnerability-handling documentation', () => {
+  it('publishes a repository-native private reporting boundary', () => {
+    const policy = repositoryFile('SECURITY.md');
+
+    expect(policy).toContain('# Security Policy');
+    expect(policy).toContain('## Supported releases');
+    expect(policy).toContain('## Reporting a vulnerability');
+    expect(policy).toContain('Report a vulnerability');
+    expect(policy).toContain('GitHub Security Advisory');
+    expect(policy).toContain(
+      'Do not include vulnerability details, proof-of-concept payloads, secrets, or customer data in a public issue.',
+    );
+    expect(policy).toContain(
+      'asks for a private security contact without disclosing the vulnerability',
+    );
+  });
+
+  it('keeps each supported release row synchronized with its package manifest', () => {
+    const policy = repositoryFile('SECURITY.md');
+    const packageManifest = JSON.parse(repositoryFile('package.json')) as {
+      version: string;
+    };
+    const officeManifest = repositoryFile('office/pyproject.toml');
+    const officeVersionMatch = officeManifest.match(
+      /^version = "([^"\r\n]+)"$/m,
+    );
+
+    expect(officeVersionMatch).not.toBeNull();
+    const officeVersion = officeVersionMatch?.[1];
+    expect(officeVersion).toBeDefined();
+    if (officeVersion === undefined) {
+      throw new Error('Expected office/pyproject.toml to declare a version');
+    }
+
+    expect(policy).toContain(
+      `| \`@contextualwisdomlab/cwl-editor\` | latest released \`${releasedMinorLine(packageManifest.version)}\` |`,
+    );
+    expect(policy).toContain(
+      `| \`inkspan-office\` | latest released \`${releasedMinorLine(officeVersion)}\` |`,
+    );
+  });
+
+  it('defines support, ownership, evidence, and coordinated-disclosure limits', () => {
+    const policy = repositoryFile('SECURITY.md');
+
+    expect(policy).toContain('Unreleased branches and pull requests');
+    expect(policy).toContain('host-owned transport');
+    expect(policy).toContain('tenant isolation');
+    expect(policy).toContain('exact affected version');
+    expect(policy).toContain('minimal reproduction');
+    expect(policy).toContain('root-cause regression test');
+    expect(policy).toContain('exact-head CI');
+    expect(policy).toContain('coordinated disclosure');
+    expect(policy).toContain('does not promise a response-time SLA');
+  });
+
+  it('records current authoritative sources and the non-conformance claim boundary', () => {
+    const doctoring = repositoryFile(
+      'docs/doctoring/security-disclosure-lifecycle.md',
+    );
+    const changelog = repositoryFile('CHANGELOG.md');
+
+    expect(doctoring).toContain(
+      '# Doctoring record: security disclosure and vulnerability handling',
+    );
+    expect(doctoring).toContain('ISO/IEC 29147:2018');
+    expect(doctoring).toContain('ISO/IEC 30111:2019');
+    expect(doctoring).toContain('NIST SP 800-218');
+    expect(doctoring).toContain('SSDF Version 1.1');
+    expect(doctoring).toContain('Version 1.2 remains a draft');
+    expect(doctoring).toContain('GitHub private vulnerability reporting');
+    expect(doctoring).toContain('APA 7 references');
+    expect(doctoring).toContain(
+      'Booth, H., Ogata, M., Kent, K., Souppaya, M., & Dodson, D. (2025).',
+    );
+    expect(doctoring).toContain('https://doi.org/10.6028/NIST.SP.800-218r1.ipd');
+    expect(doctoring).toContain(
+      'does not claim ISO certification or complete SSDF conformance',
+    );
+    expect(changelog).toContain(
+      'repository-native security disclosure and vulnerability-handling policy',
+    );
+  });
+});

From 3a4530517cf8d706cfd2189728a99612ab15162f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 10 Aug 2026 00:40:37 +0900
Subject: [PATCH 38/39] chore(accessibility): reconcile protected changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 161290e0..4ad78f20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 - Added deterministic regression and documentation contracts plus APA 7th doctoring for exact `Control`/`Meta` shortcut alternatives, the descriptive-only accessibility boundary, repository-level shortcut verification, and omission of unsupported shortcut claims
 
 ### Documentation
+- Added a repository-native security disclosure and vulnerability-handling policy with supported pre-1.0 release lines, private GitHub Security Advisory routing and safe public fallback, minimized evidence guidance, explicit Inkspan-versus-host ownership boundaries, no-SLA and non-conformance claim limits, deterministic documentation tests, and APA 7th doctoring grounded in current ISO/IEC 29147:2018, ISO/IEC 30111:2019, final NIST SP 800-218 SSDF 1.1, the draft-status boundary for SSDF 1.2, and GitHub primary documentation
 - Added an authoritative standalone and modular MSA architecture contract with reviewable deployment, optimistic-concurrency, data-ownership, security, and acquisition-evidence diagrams and tables
 - Added a beginner-readable naruon compose and ui.panel integration guide covering narrow client hydration, server-selected strong validators, accessible conflict handling, host-owned Yjs lifecycle, contextual-orchestrator boundaries, and local-versus-shareable evidence
 - Added an opaque editing-context remount for the complete editor and autosave example, latest-generation asynchronous capture ordering, encoded document path segments, redacted recovery status, and lazy state-owned session identity to prevent cross-document state reuse

From 626c414871383072c98c4fd88ec258000671217e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Mon, 10 Aug 2026 01:06:42 +0900
Subject: [PATCH 39/39] chore: reconcile shortcut changelog with autosave
 lifecycle

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ad78f20..c1536329 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 ### Security
 - Added a fail-closed draft release asset inventory gate that requires exactly one npm tarball, one Office wheel, and `SHA256SUMS`, rejects stale or unexpected draft assets before immutable publication, and verifies every GitHub-reported `sha256:` asset digest against the transferred local file
 
+### Added
+- Added one optional construction-time `onSnapshotChange` callback to the framework-free autosave queue and durable autosave session so hosts can observe saving, pending, blocked, recovery, idle, and shutdown state without polling or introducing a subscriber collection
+
+### Reliability
+- Lifecycle observers receive only distinct frozen document-free snapshots; observer exceptions cannot alter save ordering, conflict/failure recovery, queue outcomes, or durable-validator handoff
+- Durable-session notifications expose a newly committed server validator only after it is coherent with the emitted lifecycle state, preserving host-owned atomic RFC 9110 `If-Match` semantics
+
 ### Accessibility
 - Added programmatic toolbar shortcut discoverability with WAI-ARIA `aria-keyshortcuts` for the implemented bold, italic, link, undo, and redo commands, preserving the same native-button behavior, visible labels, roving focus model, and host-owned shortcut-conflict policy
 - Completed redo shortcut metadata with `Control+Shift+Z Meta+Shift+Z Control+Y Meta+Y`, matching the configured Tiptap history and collaboration behavior and exposing both `Ctrl/Cmd+Shift+Z` and `Ctrl/Cmd+Y` alternatives without adding new key handling
@@ -25,6 +32,7 @@ Historical release entries from **0.1.0 through 0.5.27** are preserved verbatim
 - Added stale-generation conflict recovery and operational save failure recovery through one reason-aware single-flight host workflow, so newer local edits cannot hide or duplicate recovery while retained work remains blocked; rejected or malformed resume attempts retain the same recovery surface until a valid resume succeeds or the editing context is disposed
 - Added exact-head read-only CI with fixed Ubuntu 24.04 runners, immutable action pins, explicit contributor-head checkout, disabled persisted Git credentials, and a documented merge-result compatibility boundary
 - Added deterministic documentation contract tests and APA 7th doctoring grounded in RFC 9110, WCAG 2.2, NIST SP 800-204, NIST SP 800-204D, OWASP ASVS 5.0.0, React, current Next.js App Router guidance, and GitHub Actions primary documentation
+- Added lifecycle-observation doctoring covering bounded callback retention, local-versus-shareable evidence, durable-validator coherence, WCAG 2.2 status-message responsibilities, rollback, and APA 7 references to RFC 9110, WCAG 2.2, and optimistic concurrency research
 
 ## [0.5.29] — 2026-08-05