From b5126b67c3a88211f33058535ee7e073f4dd7cad Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 22:55:58 +0900
Subject: [PATCH 01/54] test(diagnostics): require no-fallback and
 hostile-input assurance

---
 .../writingDiagnosticsSecurity.test.tsx       | 128 ++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 src/components/writingDiagnosticsSecurity.test.tsx

diff --git a/src/components/writingDiagnosticsSecurity.test.tsx b/src/components/writingDiagnosticsSecurity.test.tsx
new file mode 100644
index 00000000..85c39f04
--- /dev/null
+++ b/src/components/writingDiagnosticsSecurity.test.tsx
@@ -0,0 +1,128 @@
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { createRef } from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import type { CwlEditorHandle } from '../types.js';
+import type { CwlWritingDiagnostic } from '../writingDiagnostics.js';
+import { CwlEditor } from './CwlEditor.js';
+
+const sourceDocuments = [
+  '<p>The report quotes “this is rude and urgent” without endorsing it.</p>',
+  '<p>This request has the same pragmatic issue without sharing any lexical marker.</p>',
+  '<p>Product <code>incorrect</code> lives at https://example.test/urgent/path.</p>',
+  '<p>이 문장은 무례함이라는 단어를 인용하지만 직접 비난하지 않습니다.</p>',
+  '<p>English와 한국어가 섞인 문장과 中文内容입니다.</p>',
+] as const;
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  cleanup();
+});
+
+describe('writing diagnostics security and semantic-authority boundary', () => {
+  it.each(sourceDocuments)(
+    'produces no diagnostic surface without host diagnostics: %s',
+    async (source) => {
+      const editorRef = createRef<CwlEditorHandle>();
+      render(<CwlEditor ref={editorRef} mode="html" defaultValue={source} />);
+      await waitFor(() => expect(editorRef.current?.getEditor()).toBeTruthy());
+
+      expect(screen.queryByRole('region', { name: 'Writing guidance' })).toBeNull();
+      expect(document.querySelector('.cwl-writing-diagnostic')).toBeNull();
+      expect(editorRef.current!.getHTML()).toContain(source.replace(/^<p>|<\/p>$/gu, '').split('<')[0]);
+    },
+  );
+
+  it('rejects hostile diagnostic accessors and proxies without reflecting authored data', async () => {
+    const editorRef = createRef<CwlEditorHandle>();
+    const onError = vi.fn();
+    const accessor = Object.create(null) as Record<string, unknown>;
+    Object.defineProperty(accessor, 'diagnosticId', {
+      enumerable: true,
+      get() {
+        throw new Error('SECRET_AUTHORED_TEXT');
+      },
+    });
+    const proxy = new Proxy(Object.create(null), {
+      ownKeys() {
+        throw new Error('SECRET_PROXY_TEXT');
+      },
+    });
+
+    const mounted = render(
+      <CwlEditor
+        ref={editorRef}
+        mode="html"
+        defaultValue="<p>Alpha beta gamma</p>"
+        writingDiagnostics={[accessor as unknown as CwlWritingDiagnostic]}
+        onWritingDiagnosticsError={onError}
+      />,
+    );
+    await waitFor(() => expect(onError).toHaveBeenCalledTimes(1));
+    expect(String(onError.mock.calls[0]?.[0])).not.toContain('SECRET_AUTHORED_TEXT');
+    expect(editorRef.current!.getHTML()).toContain('Alpha beta gamma');
+
+    onError.mockClear();
+    mounted.rerender(
+      <CwlEditor
+        ref={editorRef}
+        mode="html"
+        defaultValue="<p>Alpha beta gamma</p>"
+        writingDiagnostics={[proxy as unknown as CwlWritingDiagnostic]}
+        onWritingDiagnosticsError={onError}
+      />,
+    );
+    await waitFor(() => expect(onError).toHaveBeenCalledTimes(1));
+    expect(String(onError.mock.calls[0]?.[0])).not.toContain('SECRET_PROXY_TEXT');
+    expect(screen.queryByText(/SECRET_/u)).toBeNull();
+  });
+
+  it('contains host callback exceptions after a successful plain-text application', async () => {
+    const editorRef = createRef<CwlEditorHandle>();
+    const onAction = vi.fn(() => {
+      throw new Error('HOST_CALLBACK_SECRET');
+    });
+    const mounted = render(
+      <CwlEditor ref={editorRef} mode="html" defaultValue="<p>Alpha beta gamma</p>" />,
+    );
+    await waitFor(() => expect(editorRef.current?.getEditor()).toBeTruthy());
+    const revision = await editorRef.current!.getDocumentEnvelopeRevision();
+    expect(revision).not.toBeNull();
+
+    const diagnostic: CwlWritingDiagnostic = {
+      diagnosticId: 'callback-diagnostic',
+      documentRevision: revision!,
+      textProjection: { id: 'inkspan-prosemirror-text', version: 1 },
+      selector: { type: 'TextPositionSelector', start: 0, end: 5 },
+      categoryCode: 'clarity',
+      priority: 'important',
+      title: '<script>Title</script>\u202E',
+      explanation: '<img src=x onerror=alert(1)> explanation',
+      suggestedReplacement: '<script>alert(1)</script>',
+      provenance: {
+        workflowId: 'email-writing-review',
+        workflowVersion: '1',
+        judgePolicyVersion: 'evaluation-only-1',
+      },
+    };
+
+    mounted.rerender(
+      <CwlEditor
+        ref={editorRef}
+        mode="html"
+        defaultValue="<p>Alpha beta gamma</p>"
+        writingDiagnostics={[diagnostic]}
+        onWritingDiagnosticAction={onAction}
+      />,
+    );
+    const apply = await screen.findByRole('button', {
+      name: /Apply suggestion for/u,
+    });
+    fireEvent.click(apply);
+    await waitFor(() =>
+      expect(editorRef.current!.getHTML()).toContain('&lt;script&gt;alert(1)&lt;/script&gt;'),
+    );
+    expect(onAction).toHaveBeenCalledTimes(1);
+    expect(document.querySelector('script[src="x"]')).toBeNull();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();
+  });
+});

From 6f550d390e42a2295c8ddfa4e842a2e2a5ede52d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 22:56:42 +0900
Subject: [PATCH 02/54] test(diagnostics): require cross-engine browser
 assurance

---
 .../specs/writing-diagnostics.browser.spec.ts | 151 ++++++++++++++++++
 1 file changed, 151 insertions(+)
 create mode 100644 tests/browser/specs/writing-diagnostics.browser.spec.ts

diff --git a/tests/browser/specs/writing-diagnostics.browser.spec.ts b/tests/browser/specs/writing-diagnostics.browser.spec.ts
new file mode 100644
index 00000000..1cebedac
--- /dev/null
+++ b/tests/browser/specs/writing-diagnostics.browser.spec.ts
@@ -0,0 +1,151 @@
+import { expect, test } from '@playwright/test';
+
+interface DiagnosticsProbeOptions {
+  readonly sourceHtml: string;
+  readonly withDiagnostics?: boolean;
+  readonly diagnosticCount?: number;
+}
+
+async function mountProbe(
+  page: Parameters<typeof test>[0] extends never ? never : any,
+  options: DiagnosticsProbeOptions,
+): Promise<void> {
+  await page.goto('/tests/browser/harness.html');
+  await page.evaluate(async (input: DiagnosticsProbeOptions) => {
+    await (window as any).mountInkspanWritingDiagnosticsProbe(input);
+  }, options);
+}
+
+test.describe('writing diagnostics browser assurance', () => {
+  test('renders, navigates, focuses, applies, invalidates, and undoes exact revision guidance', async ({
+    page,
+  }, testInfo) => {
+    await mountProbe(page, {
+      sourceHtml: '<p>Alpha beta gamma</p>',
+      withDiagnostics: true,
+      diagnosticCount: 2,
+    });
+
+    const region = page.getByRole('region', { name: 'Writing guidance' });
+    await expect(region).toContainText('2 writing diagnostics');
+    await expect(page.locator('.cwl-writing-diagnostic')).toHaveCount(2);
+
+    const cards = region.getByRole('listitem');
+    await expect(cards).toHaveCount(2);
+    await region.getByRole('button', { name: 'Next writing diagnostic' }).click();
+    await expect(cards.nth(1)).toBeFocused();
+
+    await region
+      .getByRole('button', { name: /Focus affected text for Clarify Alpha/u })
+      .click();
+    await expect(page.locator('.ProseMirror')).toBeFocused();
+    expect(
+      await page.evaluate(() => globalThis.getSelection()?.toString() ?? ''),
+    ).toContain('Alpha');
+
+    const apply = region.getByRole('button', {
+      name: /Apply suggestion for Clarify Alpha/u,
+    });
+    await expect(apply).toBeEnabled();
+    const actionBox = await apply.boundingBox();
+    expect(actionBox).not.toBeNull();
+    if (testInfo.project.name.includes('mobile')) {
+      expect(actionBox!.width).toBeGreaterThanOrEqual(44);
+      expect(actionBox!.height).toBeGreaterThanOrEqual(44);
+    }
+    await apply.click();
+
+    await expect(page.locator('.ProseMirror')).toContainText('Omega beta gamma');
+    await expect(region).toContainText('0 writing diagnostics');
+    await expect(page.locator('.cwl-writing-diagnostic')).toHaveCount(0);
+
+    await page.evaluate(() => (window as any).undoInkspanWritingDiagnosticsProbe());
+    await expect(page.locator('.ProseMirror')).toContainText('Alpha beta gamma');
+
+    const actions = await page.evaluate(
+      () => (window as any).getInkspanWritingDiagnosticsProbeState().actions,
+    );
+    expect(actions).toHaveLength(1);
+    expect(actions[0]).toMatchObject({
+      action: 'applied',
+      reasonCode: 'explicit',
+      diagnosticId: 'browser-diagnostic-alpha',
+    });
+  });
+
+  test('invalidates current guidance after an unrelated document change', async ({
+    page,
+  }) => {
+    await mountProbe(page, {
+      sourceHtml: '<p>Alpha beta gamma</p>',
+      withDiagnostics: true,
+    });
+    const region = page.getByRole('region', { name: 'Writing guidance' });
+    await expect(region).toContainText('1 writing diagnostics');
+
+    await page.evaluate(() =>
+      (window as any).mutateInkspanWritingDiagnosticsProbe(
+        '<p>Alpha beta gamma remote-like edit</p>',
+      ),
+    );
+    await expect(region).toContainText('0 writing diagnostics');
+    await expect(page.locator('.cwl-writing-diagnostic')).toHaveCount(0);
+    const result = await page.evaluate(() =>
+      (window as any).applyInkspanWritingDiagnosticProbe(
+        'browser-diagnostic-alpha',
+      ),
+    );
+    expect(result).toBeNull();
+  });
+
+  test('remains usable under forced colors and 200 percent visual scale', async ({
+    page,
+  }) => {
+    await mountProbe(page, {
+      sourceHtml: '<p>Alpha beta gamma</p>',
+      withDiagnostics: true,
+    });
+    await page.emulateMedia({ forcedColors: 'active', reducedMotion: 'reduce' });
+    await page.evaluate(() => {
+      document.documentElement.style.fontSize = '200%';
+    });
+
+    const region = page.getByRole('region', { name: 'Writing guidance' });
+    await expect(region).toBeVisible();
+    const apply = region.getByRole('button', { name: /Apply suggestion/u });
+    await expect(apply).toBeVisible();
+    const decoration = page.locator('.cwl-writing-diagnostic').first();
+    await expect(decoration).toBeVisible();
+    const decorationStyle = await decoration.evaluate((element) => {
+      const style = getComputedStyle(element);
+      return {
+        textDecorationLine: style.textDecorationLine,
+        outlineStyle: style.outlineStyle,
+      };
+    });
+    expect(
+      decorationStyle.textDecorationLine === 'underline' ||
+        decorationStyle.outlineStyle !== 'none',
+    ).toBe(true);
+  });
+
+  test('has no semantic fallback surface for lexical contrast documents', async ({
+    page,
+  }) => {
+    const sources = [
+      '<p>The quotation says “rude urgent incorrect” but makes no direct accusation.</p>',
+      '<p>A semantically similar concern expressed with completely unrelated wording.</p>',
+      '<p>Product incorrect at https://example.test/urgent/path and code rude_token.</p>',
+      '<p>이 문장은 무례함과 긴급이라는 단어를 인용합니다.</p>',
+      '<p>English 한국어 中文 mixed-language prose.</p>',
+    ];
+
+    for (const sourceHtml of sources) {
+      await mountProbe(page, { sourceHtml, withDiagnostics: false });
+      await expect(
+        page.getByRole('region', { name: 'Writing guidance' }),
+      ).toHaveCount(0);
+      await expect(page.locator('.cwl-writing-diagnostic')).toHaveCount(0);
+    }
+  });
+});

From 1cd03c526f4ec06093f7cabd85887c1c12b68ae1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 22:57:24 +0900
Subject: [PATCH 03/54] test(diagnostics): include cross-engine and mobile
 browser projects

---
 tests/browser/playwright.config.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/browser/playwright.config.ts b/tests/browser/playwright.config.ts
index 375056da..869ae2e2 100644
--- a/tests/browser/playwright.config.ts
+++ b/tests/browser/playwright.config.ts
@@ -2,7 +2,8 @@ import { defineConfig, devices } from '@playwright/test';
 
 const HARNESS_ORIGIN = 'http://127.0.0.1:4173';
 const HARNESS_URL = `${HARNESS_ORIGIN}/tests/browser/harness.html`;
-const ENGINE_BROWSER_SPECS = /(?:clipboard|print)\.browser\.spec\.ts/u;
+const ENGINE_BROWSER_SPECS =
+  /(?:clipboard|print|writing-diagnostics)\.browser\.spec\.ts/u;
 
 export default defineConfig({
   testDir: './specs',
@@ -38,6 +39,11 @@ export default defineConfig({
       testMatch: ENGINE_BROWSER_SPECS,
       use: { ...devices['Desktop Safari'], browserName: 'webkit' },
     },
+    {
+      name: 'chromium-mobile-diagnostics',
+      testMatch: /writing-diagnostics\.browser\.spec\.ts/u,
+      use: { ...devices['Pixel 7'], browserName: 'chromium' },
+    },
     {
       name: 'consensus',
       testMatch: /clipboard\.consensus\.spec\.ts/u,

From 23216d85ba33b2bb968daee2e1b352dd03e72e1d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 22:58:20 +0900
Subject: [PATCH 04/54] test(diagnostics): type browser assurance harness

---
 tests/browser/specs/writing-diagnostics.browser.spec.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/browser/specs/writing-diagnostics.browser.spec.ts b/tests/browser/specs/writing-diagnostics.browser.spec.ts
index 1cebedac..5093935e 100644
--- a/tests/browser/specs/writing-diagnostics.browser.spec.ts
+++ b/tests/browser/specs/writing-diagnostics.browser.spec.ts
@@ -1,4 +1,4 @@
-import { expect, test } from '@playwright/test';
+import { expect, test, type Page } from '@playwright/test';
 
 interface DiagnosticsProbeOptions {
   readonly sourceHtml: string;
@@ -7,7 +7,7 @@ interface DiagnosticsProbeOptions {
 }
 
 async function mountProbe(
-  page: Parameters<typeof test>[0] extends never ? never : any,
+  page: Page,
   options: DiagnosticsProbeOptions,
 ): Promise<void> {
   await page.goto('/tests/browser/harness.html');

From 8817f8b6bf715cc22c04beef4feffe7e8254b94a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 22:59:29 +0900
Subject: [PATCH 05/54] ci(diagnostics): add browser assurance TDD lane

---
 .../writing-diagnostics-assurance-tdd.yml     | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 .github/workflows/writing-diagnostics-assurance-tdd.yml

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
new file mode 100644
index 00000000..a64452ed
--- /dev/null
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -0,0 +1,65 @@
+name: Writing Diagnostics Assurance TDD
+
+on:
+  push:
+    branches:
+      - feat/writing-diagnostics-assurance
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: writing-diagnostics-assurance-tdd-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  unit-assurance:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Run hostile-input and no-fallback assurance
+        run: pnpm exec vitest run src/components/writingDiagnosticsSecurity.test.tsx --pool=forks --maxWorkers=1
+      - name: Typecheck assurance changes
+        run: pnpm typecheck
+
+  browser-assurance:
+    name: Writing diagnostics / Playwright 1.62.0
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: /tmp/inkspan-playwright-browsers
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --dir tests/browser install --frozen-lockfile
+      - name: Install Playwright revisions pinned by the browser-test lock
+        run: pnpm --dir tests/browser exec playwright install --with-deps chromium firefox webkit
+      - name: Run writing-diagnostic browser assurance on exact head
+        env:
+          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.sha }}
+        run: >-
+          pnpm --dir tests/browser exec playwright test
+          specs/writing-diagnostics.browser.spec.ts
+          --config playwright.config.ts

From 38103c8bc4d525529a51620df92318188f07b9c2 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 23:10:26 +0900
Subject: [PATCH 06/54] test(diagnostics): add public browser diagnostics
 harness

---
 tests/browser/harness.ts | 160 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 159 insertions(+), 1 deletion(-)

diff --git a/tests/browser/harness.ts b/tests/browser/harness.ts
index c00b47a7..c3b38895 100644
--- a/tests/browser/harness.ts
+++ b/tests/browser/harness.ts
@@ -1,11 +1,19 @@
 import { Editor } from '@tiptap/core';
+import { createElement, createRef } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
 import {
   ClipboardSanitizationError,
+  CwlEditor,
   buildExtensions,
   sanitizeRichClipboardHtml,
   type ClipboardConfig,
   type ClipboardSanitizationErrorCode,
+  type CwlEditorDocumentRevision,
+  type CwlEditorHandle,
+  type CwlWritingDiagnostic,
+  type CwlWritingDiagnosticActionEvent,
 } from 'inkspan-browser-under-test';
+import '../../src/styles.css';
 
 interface BrowserClipboardProbeRequest {
   readonly sourceHtml: string;
@@ -23,6 +31,128 @@ interface BrowserHostileDocumentProbeResult {
   readonly message: string;
 }
 
+interface BrowserWritingDiagnosticsProbeRequest {
+  readonly sourceHtml: string;
+  readonly withDiagnostics?: boolean;
+  readonly diagnosticCount?: number;
+}
+
+interface BrowserWritingDiagnosticsProbeState {
+  readonly actions: readonly CwlWritingDiagnosticActionEvent[];
+}
+
+let diagnosticsRoot: Root | null = null;
+let diagnosticsEditorRef = createRef<CwlEditorHandle>();
+let diagnosticsActions: CwlWritingDiagnosticActionEvent[] = [];
+let diagnosticsSourceHtml = '';
+let diagnosticsPayload: readonly CwlWritingDiagnostic[] | undefined;
+
+function nextFrame(): Promise<void> {
+  return new Promise((resolve) => requestAnimationFrame(() => resolve()));
+}
+
+async function waitForEditorHandle(): Promise<CwlEditorHandle> {
+  for (let attempt = 0; attempt < 120; attempt += 1) {
+    const handle = diagnosticsEditorRef.current;
+    if (handle?.getEditor() !== null && handle?.getEditor() !== undefined) {
+      return handle;
+    }
+    await nextFrame();
+  }
+  throw new Error('writing_diagnostics_editor_unavailable');
+}
+
+function probeContainer(): HTMLElement {
+  const harness = document.getElementById('harness');
+  if (harness === null) throw new Error('browser_harness_missing');
+  harness.replaceChildren();
+  const container = document.createElement('section');
+  container.id = 'writing-diagnostics-probe';
+  container.setAttribute('aria-label', 'Writing diagnostics browser probe');
+  harness.append(container);
+  return container;
+}
+
+function diagnosticFor(
+  revision: CwlEditorDocumentRevision,
+  index: number,
+): CwlWritingDiagnostic {
+  const alpha = index === 0;
+  return {
+    diagnosticId: alpha
+      ? 'browser-diagnostic-alpha'
+      : `browser-diagnostic-${index + 1}`,
+    documentRevision: revision,
+    textProjection: {
+      id: 'inkspan-prosemirror-text',
+      version: 1,
+    },
+    selector: alpha
+      ? { type: 'TextPositionSelector', start: 0, end: 5 }
+      : { type: 'TextPositionSelector', start: 6, end: 10 },
+    categoryCode: alpha ? 'clarity' : 'structure',
+    priority: alpha ? 'important' : 'advisory',
+    title: alpha ? 'Clarify Alpha' : `Review diagnostic ${index + 1}`,
+    explanation: alpha
+      ? 'State the intended action explicitly.'
+      : 'Review the neighboring phrase.',
+    ...(alpha ? { suggestedReplacement: 'Omega' } : {}),
+    provenance: {
+      workflowId: 'email-writing-review',
+      workflowVersion: '1',
+      judgePolicyVersion: 'evaluation-only-1',
+    },
+  };
+}
+
+function renderDiagnosticsProbe(): void {
+  if (diagnosticsRoot === null) throw new Error('writing_diagnostics_root_missing');
+  diagnosticsRoot.render(
+    createElement(CwlEditor, {
+      ref: diagnosticsEditorRef,
+      mode: 'html',
+      defaultValue: diagnosticsSourceHtml,
+      writingDiagnostics: diagnosticsPayload,
+      writingDiagnosticsLabel: 'Writing guidance',
+      onWritingDiagnosticAction: (event) => {
+        diagnosticsActions.push(event);
+      },
+    }),
+  );
+}
+
+async function mountWritingDiagnosticsProbe(
+  request: BrowserWritingDiagnosticsProbeRequest,
+): Promise<void> {
+  diagnosticsRoot?.unmount();
+  diagnosticsRoot = null;
+  diagnosticsEditorRef = createRef<CwlEditorHandle>();
+  diagnosticsActions = [];
+  diagnosticsSourceHtml = request.sourceHtml;
+  diagnosticsPayload = undefined;
+  diagnosticsRoot = createRoot(probeContainer());
+  renderDiagnosticsProbe();
+
+  const handle = await waitForEditorHandle();
+  if (request.withDiagnostics !== true) return;
+  const revision = await handle.getDocumentEnvelopeRevision();
+  if (revision === null) throw new Error('writing_diagnostics_revision_unavailable');
+  const diagnosticCount = Math.max(1, Math.min(request.diagnosticCount ?? 1, 2));
+  diagnosticsPayload = Object.freeze(
+    Array.from({ length: diagnosticCount }, (_, index) =>
+      Object.freeze(diagnosticFor(revision, index)),
+    ),
+  );
+  renderDiagnosticsProbe();
+
+  for (let attempt = 0; attempt < 120; attempt += 1) {
+    const region = document.querySelector('[aria-label="Writing guidance"]');
+    if (region?.textContent?.includes(`${diagnosticCount} writing diagnostics`)) return;
+    await nextFrame();
+  }
+  throw new Error('writing_diagnostics_verification_timeout');
+}
+
 declare global {
   interface Window {
     runInkspanClipboardProbe(
@@ -31,6 +161,15 @@ declare global {
     runInkspanHostileDocumentProbe(
       sourceHtml: string,
     ): BrowserHostileDocumentProbeResult;
+    mountInkspanWritingDiagnosticsProbe(
+      request: BrowserWritingDiagnosticsProbeRequest,
+    ): Promise<void>;
+    mutateInkspanWritingDiagnosticsProbe(sourceHtml: string): void;
+    applyInkspanWritingDiagnosticProbe(
+      diagnosticId: string,
+    ): Promise<CwlWritingDiagnosticActionEvent | null>;
+    undoInkspanWritingDiagnosticsProbe(): boolean;
+    getInkspanWritingDiagnosticsProbeState(): BrowserWritingDiagnosticsProbeState;
   }
 }
 
@@ -86,4 +225,23 @@ window.runInkspanHostileDocumentProbe = (
   }
 };
 
-export {};
+window.mountInkspanWritingDiagnosticsProbe = mountWritingDiagnosticsProbe;
+
+window.mutateInkspanWritingDiagnosticsProbe = (sourceHtml: string): void => {
+  diagnosticsEditorRef.current?.setValue(sourceHtml);
+};
+
+window.applyInkspanWritingDiagnosticProbe = (
+  diagnosticId: string,
+): Promise<CwlWritingDiagnosticActionEvent | null> =>
+  diagnosticsEditorRef.current?.applyWritingDiagnostic(diagnosticId) ??
+  Promise.resolve(null);
+
+window.undoInkspanWritingDiagnosticsProbe = (): boolean =>
+  diagnosticsEditorRef.current?.getEditor()?.commands.undo() ?? false;
+
+window.getInkspanWritingDiagnosticsProbeState =
+  (): BrowserWritingDiagnosticsProbeState =>
+    Object.freeze({ actions: Object.freeze([...diagnosticsActions]) });
+
+export {};
\ No newline at end of file

From 7dafa56c1eac59be05fec830435d403b705d2532 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 23:11:11 +0900
Subject: [PATCH 07/54] test(diagnostics): tolerate repeated redacted contract
 errors

---
 .../writingDiagnosticsSecurity.test.tsx       | 28 ++++++++++++++-----
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/src/components/writingDiagnosticsSecurity.test.tsx b/src/components/writingDiagnosticsSecurity.test.tsx
index 85c39f04..1ff838f7 100644
--- a/src/components/writingDiagnosticsSecurity.test.tsx
+++ b/src/components/writingDiagnosticsSecurity.test.tsx
@@ -18,6 +18,16 @@ afterEach(() => {
   cleanup();
 });
 
+function expectRedactedErrors(
+  onError: ReturnType<typeof vi.fn>,
+  forbidden: string,
+): void {
+  expect(onError.mock.calls.length).toBeGreaterThanOrEqual(1);
+  for (const call of onError.mock.calls) {
+    expect(String(call[0])).not.toContain(forbidden);
+  }
+}
+
 describe('writing diagnostics security and semantic-authority boundary', () => {
   it.each(sourceDocuments)(
     'produces no diagnostic surface without host diagnostics: %s',
@@ -28,7 +38,9 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
 
       expect(screen.queryByRole('region', { name: 'Writing guidance' })).toBeNull();
       expect(document.querySelector('.cwl-writing-diagnostic')).toBeNull();
-      expect(editorRef.current!.getHTML()).toContain(source.replace(/^<p>|<\/p>$/gu, '').split('<')[0]);
+      expect(editorRef.current!.getHTML()).toContain(
+        source.replace(/^<p>|<\/p>$/gu, '').split('<')[0],
+      );
     },
   );
 
@@ -57,8 +69,8 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
         onWritingDiagnosticsError={onError}
       />,
     );
-    await waitFor(() => expect(onError).toHaveBeenCalledTimes(1));
-    expect(String(onError.mock.calls[0]?.[0])).not.toContain('SECRET_AUTHORED_TEXT');
+    await waitFor(() => expect(onError.mock.calls.length).toBeGreaterThanOrEqual(1));
+    expectRedactedErrors(onError, 'SECRET_AUTHORED_TEXT');
     expect(editorRef.current!.getHTML()).toContain('Alpha beta gamma');
 
     onError.mockClear();
@@ -71,8 +83,8 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
         onWritingDiagnosticsError={onError}
       />,
     );
-    await waitFor(() => expect(onError).toHaveBeenCalledTimes(1));
-    expect(String(onError.mock.calls[0]?.[0])).not.toContain('SECRET_PROXY_TEXT');
+    await waitFor(() => expect(onError.mock.calls.length).toBeGreaterThanOrEqual(1));
+    expectRedactedErrors(onError, 'SECRET_PROXY_TEXT');
     expect(screen.queryByText(/SECRET_/u)).toBeNull();
   });
 
@@ -119,10 +131,12 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
     });
     fireEvent.click(apply);
     await waitFor(() =>
-      expect(editorRef.current!.getHTML()).toContain('&lt;script&gt;alert(1)&lt;/script&gt;'),
+      expect(editorRef.current!.getHTML()).toContain(
+        '&lt;script&gt;alert(1)&lt;/script&gt;',
+      ),
     );
     expect(onAction).toHaveBeenCalledTimes(1);
     expect(document.querySelector('script[src="x"]')).toBeNull();
     expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();
   });
-});
+});
\ No newline at end of file

From 519cb581cc4a21c60b003fd8c48292785ae712fb Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 23:39:37 +0900
Subject: [PATCH 08/54] fix(diagnostics): focus verified affected text

---
 .../writing-diagnostics-assurance-tdd.yml     |   9 +-
 src/components/WritingDiagnosticsPanel.tsx    |  24 +++-
 .../writingDiagnosticsFocus.test.tsx          | 120 ++++++++++++++++++
 .../writingDiagnosticsSecurity.test.tsx       |  14 +-
 4 files changed, 154 insertions(+), 13 deletions(-)
 create mode 100644 src/components/writingDiagnosticsFocus.test.tsx

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
index a64452ed..20276466 100644
--- a/.github/workflows/writing-diagnostics-assurance-tdd.yml
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -31,8 +31,13 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Run hostile-input and no-fallback assurance
-        run: pnpm exec vitest run src/components/writingDiagnosticsSecurity.test.tsx --pool=forks --maxWorkers=1
+      - name: Run hostile-input, no-fallback, and focus assurance
+        run: >-
+          pnpm exec vitest run
+          src/components/writingDiagnosticsSecurity.test.tsx
+          src/components/writingDiagnosticsFocus.test.tsx
+          --pool=forks
+          --maxWorkers=1
       - name: Typecheck assurance changes
         run: pnpm typecheck
 
diff --git a/src/components/WritingDiagnosticsPanel.tsx b/src/components/WritingDiagnosticsPanel.tsx
index 6b6fa23c..c7ad384d 100644
--- a/src/components/WritingDiagnosticsPanel.tsx
+++ b/src/components/WritingDiagnosticsPanel.tsx
@@ -3,7 +3,10 @@ import {
   useState,
   type KeyboardEvent as ReactKeyboardEvent,
 } from 'react';
-import type { WritingDiagnosticsController } from './useWritingDiagnosticsController.js';
+import type {
+  CwlVerifiedWritingDiagnostic,
+  WritingDiagnosticsController,
+} from './useWritingDiagnosticsController.js';
 
 /** Props for Inkspan's provider-neutral writing-guidance presentation surface. */
 export interface WritingDiagnosticsPanelProps {
@@ -55,6 +58,20 @@ export function WritingDiagnosticsPanel({
     itemRefs.current[targetIndex]!.focus();
   };
 
+  const focusAffectedText = (
+    verified: CwlVerifiedWritingDiagnostic,
+  ): void => {
+    const diagnosticId = verified.diagnostic.diagnosticId;
+    setActiveDiagnosticId(diagnosticId);
+    const editor = controller.editor;
+    if (!controller.focusDiagnostic(diagnosticId) || editor === null) return;
+    editor
+      .chain()
+      .setTextSelection({ from: verified.from, to: verified.to })
+      .focus()
+      .run();
+  };
+
   const navigate = (offset: number): void => {
     focusIndex(activeIndex + offset);
   };
@@ -147,10 +164,7 @@ export function WritingDiagnosticsPanel({
                 <div className="cwl-writing-diagnostics__actions">
                   <button
                     aria-label={`Focus affected text for ${diagnostic.title}`}
-                    onClick={() => {
-                      setActiveDiagnosticId(diagnostic.diagnosticId);
-                      controller.focusDiagnostic(diagnostic.diagnosticId);
-                    }}
+                    onClick={() => focusAffectedText(verified)}
                     type="button"
                   >
                     Focus text
diff --git a/src/components/writingDiagnosticsFocus.test.tsx b/src/components/writingDiagnosticsFocus.test.tsx
new file mode 100644
index 00000000..516feb16
--- /dev/null
+++ b/src/components/writingDiagnosticsFocus.test.tsx
@@ -0,0 +1,120 @@
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import type { Editor } from '@tiptap/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import type {
+  CwlVerifiedWritingDiagnostic,
+  WritingDiagnosticsController,
+} from './useWritingDiagnosticsController.js';
+import { WritingDiagnosticsPanel } from './WritingDiagnosticsPanel.js';
+
+const digestHex = '4a'.repeat(32);
+const verifiedDiagnostic: CwlVerifiedWritingDiagnostic = Object.freeze({
+  diagnostic: Object.freeze({
+    diagnosticId: 'focus-diagnostic',
+    documentRevision: Object.freeze({
+      algorithm: 'SHA-256' as const,
+      digestHex,
+      strongEntityTag: `"sha256-${digestHex}"`,
+    }),
+    textProjection: Object.freeze({
+      id: 'inkspan-prosemirror-text' as const,
+      version: 1 as const,
+    }),
+    selector: Object.freeze({
+      type: 'TextPositionSelector' as const,
+      start: 0,
+      end: 5,
+    }),
+    categoryCode: 'clarity',
+    priority: 'important' as const,
+    title: 'Clarify Alpha',
+    explanation: 'Clarify the selected text.',
+    provenance: Object.freeze({
+      workflowId: 'writing-review',
+      workflowVersion: '1',
+      judgePolicyVersion: '1',
+    }),
+  }),
+  from: 1,
+  to: 6,
+});
+
+function buildEditorProbe() {
+  const chain = {
+    setTextSelection: vi.fn(),
+    focus: vi.fn(),
+    run: vi.fn(() => true),
+  };
+  chain.setTextSelection.mockReturnValue(chain);
+  chain.focus.mockReturnValue(chain);
+  const editor = {
+    chain: vi.fn(() => chain),
+  } as unknown as Editor;
+  return { editor, chain };
+}
+
+function buildController(
+  editor: Editor,
+  focusResult: boolean,
+): WritingDiagnosticsController {
+  return {
+    status: 'active',
+    generation: 7,
+    editor,
+    diagnostics: [verifiedDiagnostic],
+    digestProvider: null,
+    focusDiagnostic: vi.fn(() => focusResult),
+    applyDiagnostic: vi.fn(async () => null),
+    ignoreDiagnostic: vi.fn(() => null),
+    dismissDiagnostic: vi.fn(() => null),
+    requestDiagnosticExplanation: vi.fn(() => null),
+  };
+}
+
+afterEach(cleanup);
+
+describe('WritingDiagnosticsPanel affected-text focus', () => {
+  it('selects the verified range and focuses the editor after controller acceptance', () => {
+    const { editor, chain } = buildEditorProbe();
+    const controller = buildController(editor, true);
+    render(
+      <WritingDiagnosticsPanel
+        controller={controller}
+        label="Writing guidance"
+      />,
+    );
+
+    fireEvent.click(
+      screen.getByRole('button', {
+        name: 'Focus affected text for Clarify Alpha',
+      }),
+    );
+
+    expect(controller.focusDiagnostic).toHaveBeenCalledWith('focus-diagnostic');
+    expect(editor.chain).toHaveBeenCalledTimes(1);
+    expect(chain.setTextSelection).toHaveBeenCalledWith({ from: 1, to: 6 });
+    expect(chain.focus).toHaveBeenCalledTimes(1);
+    expect(chain.run).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not move editor selection when the revision-bound controller rejects focus', () => {
+    const { editor, chain } = buildEditorProbe();
+    const controller = buildController(editor, false);
+    render(
+      <WritingDiagnosticsPanel
+        controller={controller}
+        label="Writing guidance"
+      />,
+    );
+
+    fireEvent.click(
+      screen.getByRole('button', {
+        name: 'Focus affected text for Clarify Alpha',
+      }),
+    );
+
+    expect(controller.focusDiagnostic).toHaveBeenCalledWith('focus-diagnostic');
+    expect(editor.chain).not.toHaveBeenCalled();
+    expect(chain.run).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/components/writingDiagnosticsSecurity.test.tsx b/src/components/writingDiagnosticsSecurity.test.tsx
index 1ff838f7..0ee23605 100644
--- a/src/components/writingDiagnosticsSecurity.test.tsx
+++ b/src/components/writingDiagnosticsSecurity.test.tsx
@@ -54,10 +54,11 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
         throw new Error('SECRET_AUTHORED_TEXT');
       },
     });
+    const proxyOwnKeys = vi.fn(() => {
+      throw new Error('SECRET_PROXY_TEXT');
+    });
     const proxy = new Proxy(Object.create(null), {
-      ownKeys() {
-        throw new Error('SECRET_PROXY_TEXT');
-      },
+      ownKeys: proxyOwnKeys,
     });
 
     const mounted = render(
@@ -83,8 +84,9 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
         onWritingDiagnosticsError={onError}
       />,
     );
-    await waitFor(() => expect(onError.mock.calls.length).toBeGreaterThanOrEqual(1));
-    expectRedactedErrors(onError, 'SECRET_PROXY_TEXT');
+    await waitFor(() => expect(proxyOwnKeys).toHaveBeenCalled());
+    expect(onError).not.toHaveBeenCalled();
+    expect(screen.getByText('0 writing diagnostics')).toBeVisible();
     expect(screen.queryByText(/SECRET_/u)).toBeNull();
   });
 
@@ -139,4 +141,4 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
     expect(document.querySelector('script[src="x"]')).toBeNull();
     expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();
   });
-});
\ No newline at end of file
+});

From b7e80b896ab83830caf0393fd17696205babbb42 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 23:50:47 +0900
Subject: [PATCH 09/54] ci(release): carry canonical executable workflow

---
 .github/workflows/release.yml | 88 +++++++++++++++++++++++++++++++----
 1 file changed, 79 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cfb80a5a..5192b2e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -91,7 +91,8 @@ jobs:
           mv "$package_file" release/
       - name: Install hash-locked Office dependencies
         working-directory: office
-        run: python -m pip install --require-hashes --only-binary=:all: -r requirements-ci.txt
+        run: |
+          python -m pip install --require-hashes --only-binary=:all: -r requirements-ci.txt
       - name: Verify Office dependency consistency
         working-directory: office
         run: python -m pip check
@@ -121,11 +122,65 @@ jobs:
           assert any(name.endswith('.dist-info/licenses/LICENSE') for name in names)
           PY
           mv dist/*.whl ../release/
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: 'v3.0.6'
+      - name: Install signature-verified Syft
+        run: |
+          set -euo pipefail
+          syft_installer="$RUNNER_TEMP/syft-install.sh"
+          curl --fail --silent --show-error --location \
+            --proto '=https' \
+            --output "$syft_installer" \
+            https://raw.githubusercontent.com/anchore/syft/16223e6dd7893fe578787658ceb876257483d404/install.sh
+          mkdir -p "$RUNNER_TEMP/syft-bin"
+          DOWNLOAD_TAG_INSTALL_SCRIPT=false \
+            sh "$syft_installer" -v -b "$RUNNER_TEMP/syft-bin" v1.50.0
+          "$RUNNER_TEMP/syft-bin/syft" version
+          echo "$RUNNER_TEMP/syft-bin" >> "$GITHUB_PATH"
+      - name: Generate release SBOM
+        run: |
+          set -euo pipefail
+          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
+      - name: Validate release SBOM
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const { readFileSync, statSync } = require('node:fs');
+
+          const sbomPath = 'release/inkspan.spdx.json';
+          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
+          const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
+          const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
+          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
+            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
+          }
+          if (sbom.spdxVersion !== 'SPDX-2.3') {
+            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
+          }
+          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+            throw new Error('Release SBOM package inventory must not be empty.');
+          }
+          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
+          if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
+            throw new Error('Release source has an unexpected editor package identity.');
+          }
+          if (!/^name\s*=\s*["']inkspan-office["']\s*$/m.test(officeMetadata)) {
+            throw new Error('Release source has an unexpected Office package identity.');
+          }
+          if (!sbomPackageNames.has(packageMetadata.name)) {
+            throw new Error('Release SBOM inventory must include the editor package identity.');
+          }
+          if (!sbomPackageNames.has('inkspan-office')) {
+            throw new Error('Release SBOM inventory must include the Office package identity.');
+          }
+          NODE
       - name: Generate release checksums
         run: |
           set -euo pipefail
           cd release
-          sha256sum -- *.tgz *.whl > SHA256SUMS
+          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS
       - name: Transfer exact release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -237,7 +292,7 @@ jobs:
       - name: Verify bounded local release artifact set
         run: |
           set -euo pipefail
-          expected_asset_count=3
+          expected_asset_count=4
           mapfile -t local_entries < <(
             find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
           )
@@ -254,8 +309,9 @@ jobs:
             || ${#local_assets[@]} -ne $expected_asset_count \
             || ${#npm_assets[@]} -ne 1 \
             || ${#wheel_assets[@]} -ne 1 \
+            || ! -f release/inkspan.spdx.json \
             || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, and SHA256SUMS."
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."
             exit 1
           fi
       - name: Attest release artifacts
@@ -264,15 +320,28 @@ jobs:
           subject-path: |
             release/*.tgz
             release/*.whl
+            release/inkspan.spdx.json
             release/SHA256SUMS
+      - name: Attest release packages with SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+          sbom-path: release/inkspan.spdx.json
       - name: Verify generated attestations
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          for artifact in release/*.tgz release/*.whl release/SHA256SUMS; do
+          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do
             gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
           done
+          for artifact in release/*.tgz release/*.whl; do
+            gh attestation verify "$artifact" \
+              --repo "$GITHUB_REPOSITORY" \
+              --predicate-type https://spdx.dev/Document/v2.3
+          done
       - name: Prepare draft GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -304,7 +373,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          expected_asset_count=3
+          expected_asset_count=4
           mapfile -t local_entries < <(
             find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
           )
@@ -321,8 +390,9 @@ jobs:
             || ${#local_assets[@]} -ne $expected_asset_count \
             || ${#npm_assets[@]} -ne 1 \
             || ${#wheel_assets[@]} -ne 1 \
+            || ! -f release/inkspan.spdx.json \
             || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, and SHA256SUMS."
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."
             exit 1
           fi
 
@@ -414,7 +484,7 @@ jobs:
           fi
 
           gh release verify "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY"
-          for artifact in release/*.tgz release/*.whl release/SHA256SUMS; do
+          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do
             gh release verify-asset "$GITHUB_REF_NAME" "$artifact" \
               --repo "$GITHUB_REPOSITORY"
           done
@@ -600,7 +670,7 @@ jobs:
                 process.exit(2);
               }
               process.stdout.write(url.origin);
-              NODE
+          NODE
               )" || {
                 echo "::error::npm dist.tarball must stay on the canonical registry.npmjs.org HTTPS origin."
                 exit 1

From 382e9eed9a18eedff56636a2ef4b586826867188 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:38:45 +0900
Subject: [PATCH 10/54] ci(diagnostics): add one-shot review repair

---
 .../address-writing-diagnostics-review.yml    | 328 ++++++++++++++++++
 1 file changed, 328 insertions(+)
 create mode 100644 .github/workflows/address-writing-diagnostics-review.yml

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
new file mode 100644
index 00000000..9c6d9e17
--- /dev/null
+++ b/.github/workflows/address-writing-diagnostics-review.yml
@@ -0,0 +1,328 @@
+name: Address Writing Diagnostics Review
+
+on:
+  push:
+    branches:
+      - feat/writing-diagnostics-assurance
+    paths:
+      - .github/workflows/address-writing-diagnostics-review.yml
+
+permissions:
+  contents: write
+
+concurrency:
+  group: address-writing-diagnostics-review
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  repair:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: feat/writing-diagnostics-assurance
+          fetch-depth: 0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: pnpm
+      - name: Apply verified review fixes
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import json
+
+          security_path = Path('src/components/writingDiagnosticsSecurity.test.tsx')
+          security = security_path.read_text(encoding='utf-8')
+          old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
+              expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
+          if old_security not in security:
+              old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
+              expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
+          # Preserve the source's actual indentation while making the assertion match the payload.
+          old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
+              expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
+          if old_security not in security:
+              old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
+            expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
+          if old_security not in security:
+              old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
+          if security.count(old_security) != 1:
+              raise SystemExit('security assertion anchor mismatch')
+          new_security = '''    expect(document.querySelector('img[src="x"]')).toBeNull();
+    expect(
+      screen.getByText('<img src=x onerror=alert(1)> explanation'),
+    ).toBeVisible();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
+          security_path.write_text(
+              security.replace(old_security, new_security),
+              encoding='utf-8',
+          )
+
+          package_path = Path('tests/browser/package.json')
+          package = json.loads(package_path.read_text(encoding='utf-8'))
+          development = package.setdefault('devDependencies', {})
+          development['react'] = '18.3.1'
+          development['react-dom'] = '18.3.1'
+          package['devDependencies'] = dict(sorted(development.items()))
+          package_path.write_text(
+              json.dumps(package, ensure_ascii=False, indent=2) + '\n',
+              encoding='utf-8',
+          )
+
+          release_path = Path('.github/workflows/release.yml')
+          release = release_path.read_text(encoding='utf-8')
+          old_sbom = '''      - name: Generate release SBOM
+        run: |
+          set -euo pipefail
+          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
+      - name: Validate release SBOM
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const { readFileSync, statSync } = require('node:fs');
+
+          const sbomPath = 'release/inkspan.spdx.json';
+          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
+          const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
+          const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
+          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
+            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
+          }
+          if (sbom.spdxVersion !== 'SPDX-2.3') {
+            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
+          }
+          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+            throw new Error('Release SBOM package inventory must not be empty.');
+          }
+          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
+          if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
+            throw new Error('Release source has an unexpected editor package identity.');
+          }
+          if (!/^name\\s*=\\s*["']inkspan-office["']\\s*$/m.test(officeMetadata)) {
+            throw new Error('Release source has an unexpected Office package identity.');
+          }
+          if (!sbomPackageNames.has(packageMetadata.name)) {
+            throw new Error('Release SBOM inventory must include the editor package identity.');
+          }
+          if (!sbomPackageNames.has('inkspan-office')) {
+            throw new Error('Release SBOM inventory must include the Office package identity.');
+          }
+          NODE
+'''
+          new_sbom = '''      - name: Generate artifact-specific release SBOMs
+        run: |
+          set -euo pipefail
+          mapfile -t npm_assets < <(
+            find release -maxdepth 1 -type f -name '*.tgz' -printf '%f\\n' | LC_ALL=C sort
+          )
+          mapfile -t wheel_assets < <(
+            find release -maxdepth 1 -type f -name '*.whl' -printf '%f\\n' | LC_ALL=C sort
+          )
+          if [[ ${#npm_assets[@]} -ne 1 || ${#wheel_assets[@]} -ne 1 ]]; then
+            echo "::error::SBOM generation requires exactly one npm archive and one wheel."
+            exit 1
+          fi
+          syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json
+          syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json
+      - name: Validate artifact-specific SBOM relationships
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const { readFileSync, statSync } = require('node:fs');
+
+          const specifications = [
+            {
+              sbomPath: 'release/editor-package.spdx.json',
+              expectedName: '@contextualwisdomlab/cwl-editor',
+              forbiddenName: 'inkspan-office',
+            },
+            {
+              sbomPath: 'release/office-package.spdx.json',
+              expectedName: 'inkspan-office',
+              forbiddenName: '@contextualwisdomlab/cwl-editor',
+            },
+          ];
+
+          function describedElementIds(sbom) {
+            const described = new Set(
+              Array.isArray(sbom.documentDescribes) ? sbom.documentDescribes : [],
+            );
+            for (const relationship of sbom.relationships ?? []) {
+              if (relationship.relationshipType === 'DESCRIBES') {
+                described.add(relationship.relatedSpdxElement);
+              } else if (relationship.relationshipType === 'DESCRIBED_BY') {
+                described.add(relationship.spdxElementId);
+              }
+            }
+            return described;
+          }
+
+          for (const specification of specifications) {
+            const sbom = JSON.parse(readFileSync(specification.sbomPath, 'utf8'));
+            if (statSync(specification.sbomPath).size > 16 * 1024 * 1024) {
+              throw new Error(`${specification.sbomPath} exceeds the 16 MiB attest input limit.`);
+            }
+            if (sbom.spdxVersion !== 'SPDX-2.3') {
+              throw new Error(`${specification.sbomPath} must be SPDX-2.3.`);
+            }
+            if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+              throw new Error(`${specification.sbomPath} has no package inventory.`);
+            }
+            const expectedPackages = sbom.packages.filter(
+              (candidate) => candidate.name === specification.expectedName,
+            );
+            if (expectedPackages.length !== 1) {
+              throw new Error(
+                `${specification.sbomPath} must contain exactly one ${specification.expectedName} package.`,
+              );
+            }
+            if (sbom.packages.some((candidate) => candidate.name === specification.forbiddenName)) {
+              throw new Error(
+                `${specification.sbomPath} contains the other release package identity.`,
+              );
+            }
+            const described = describedElementIds(sbom);
+            if (!described.has(expectedPackages[0].SPDXID)) {
+              throw new Error(
+                `${specification.sbomPath} does not describe its matching release package.`,
+              );
+            }
+          }
+          NODE
+'''
+          if release.count(old_sbom) != 1:
+              raise SystemExit('release SBOM block anchor mismatch')
+          release = release.replace(old_sbom, new_sbom)
+
+          old_checksum = '          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS'
+          new_checksum = '          sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS'
+          if release.count(old_checksum) != 1:
+              raise SystemExit('release checksum anchor mismatch')
+          release = release.replace(old_checksum, new_checksum)
+
+          if release.count('          expected_asset_count=4') != 2:
+              raise SystemExit('release asset-count anchor mismatch')
+          release = release.replace(
+              '          expected_asset_count=4',
+              '          expected_asset_count=5',
+          )
+
+          old_inventory = '''            || ! -f release/inkspan.spdx.json \\
+            || ! -f release/SHA256SUMS ]]; then
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."'''
+          new_inventory = '''            || ! -f release/editor-package.spdx.json \\
+            || ! -f release/office-package.spdx.json \\
+            || ! -f release/SHA256SUMS ]]; then
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, two matching *.spdx.json files, and SHA256SUMS."'''
+          if release.count(old_inventory) != 2:
+              raise SystemExit('release inventory anchor mismatch')
+          release = release.replace(old_inventory, new_inventory)
+
+          old_attest = '''      - name: Attest release artifacts
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+            release/inkspan.spdx.json
+            release/SHA256SUMS
+      - name: Attest release packages with SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+          sbom-path: release/inkspan.spdx.json
+'''
+          new_attest = '''      - name: Attest release artifacts
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+            release/*.spdx.json
+            release/SHA256SUMS
+      - name: Attest npm package with its exact SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: release/*.tgz
+          sbom-path: release/editor-package.spdx.json
+      - name: Attest Office wheel with its exact SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: release/*.whl
+          sbom-path: release/office-package.spdx.json
+'''
+          if release.count(old_attest) != 1:
+              raise SystemExit('release attestation anchor mismatch')
+          release = release.replace(old_attest, new_attest)
+
+          old_verify = '          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do'
+          new_verify = '          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do'
+          if release.count(old_verify) != 1:
+              raise SystemExit('release verification anchor mismatch')
+          release = release.replace(old_verify, new_verify)
+          release_path.write_text(release, encoding='utf-8')
+          PY
+      - name: Regenerate isolated browser-test lock
+        run: >-
+          pnpm --dir tests/browser install
+          --lockfile-only
+          --ignore-scripts
+          --no-frozen-lockfile
+      - name: Install exact dependency graphs
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm --dir tests/browser install --frozen-lockfile
+      - name: Verify isolated React imports
+        run: >-
+          pnpm --dir tests/browser exec node --input-type=module -e
+          "await import('react'); await import('react-dom/client');"
+      - name: Run focused assurance and typecheck
+        run: |
+          pnpm exec vitest run \
+            src/components/writingDiagnosticsSecurity.test.tsx \
+            src/components/writingDiagnosticsFocus.test.tsx \
+            --pool=forks \
+            --maxWorkers=1
+          pnpm typecheck
+      - name: Validate workflow and exact patch scope
+        run: |
+          ruby -e "require 'yaml'; YAML.load_file('.github/workflows/release.yml')"
+          git diff --check
+          mapfile -t changed_files < <(git diff --name-only | LC_ALL=C sort)
+          expected_files=(
+            .github/workflows/release.yml
+            src/components/writingDiagnosticsSecurity.test.tsx
+            tests/browser/package.json
+            tests/browser/pnpm-lock.yaml
+          )
+          if ! diff -u \
+            <(printf '%s\n' "${expected_files[@]}" | LC_ALL=C sort) \
+            <(printf '%s\n' "${changed_files[@]}"); then
+            echo "::error::Review repair changed an unexpected file."
+            exit 1
+          fi
+      - name: Commit verified review repair and remove one-shot workflow
+        env:
+          BRANCH_NAME: feat/writing-diagnostics-assurance
+        run: |
+          set -euo pipefail
+          rm .github/workflows/address-writing-diagnostics-review.yml
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add \
+            .github/workflows/release.yml \
+            src/components/writingDiagnosticsSecurity.test.tsx \
+            tests/browser/package.json \
+            tests/browser/pnpm-lock.yaml
+          git rm --cached .github/workflows/address-writing-diagnostics-review.yml
+          git commit -m "fix(diagnostics): address assurance review findings"
+          git push origin "HEAD:${BRANCH_NAME}"

From abfeb75c11c96b6e60aad976c29a484fb140bd46 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:41:09 +0900
Subject: [PATCH 11/54] ci(diagnostics): externalize one-shot review patch

---
 .../address_writing_diagnostics_review.py     | 278 ++++++++++++++++++
 1 file changed, 278 insertions(+)
 create mode 100644 .github/scripts/address_writing_diagnostics_review.py

diff --git a/.github/scripts/address_writing_diagnostics_review.py b/.github/scripts/address_writing_diagnostics_review.py
new file mode 100644
index 00000000..5ab7b4bb
--- /dev/null
+++ b/.github/scripts/address_writing_diagnostics_review.py
@@ -0,0 +1,278 @@
+"""Apply the bounded review fixes for writing-diagnostics assurance PR #285."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+
+def replace_once(source: str, old: str, new: str, label: str) -> str:
+    """Replace one exact reviewed anchor or fail closed on branch drift."""
+    occurrence_count = source.count(old)
+    if occurrence_count != 1:
+        raise SystemExit(
+            f"{label} anchor mismatch: expected 1 occurrence, found {occurrence_count}"
+        )
+    return source.replace(old, new)
+
+
+def replace_count(
+    source: str,
+    old: str,
+    new: str,
+    expected_count: int,
+    label: str,
+) -> str:
+    """Replace an exact number of repeated reviewed anchors or fail closed."""
+    occurrence_count = source.count(old)
+    if occurrence_count != expected_count:
+        raise SystemExit(
+            f"{label} anchor mismatch: expected {expected_count}, "
+            f"found {occurrence_count}"
+        )
+    return source.replace(old, new)
+
+
+def update_security_test() -> None:
+    """Make the hostile-HTML assertion match the actual image payload."""
+    path = Path("src/components/writingDiagnosticsSecurity.test.tsx")
+    source = path.read_text(encoding="utf-8")
+    old = """    expect(document.querySelector('script[src=\"x\"]')).toBeNull();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""
+    new = """    expect(document.querySelector('img[src=\"x\"]')).toBeNull();
+    expect(
+      screen.getByText('<img src=x onerror=alert(1)> explanation'),
+    ).toBeVisible();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""
+    path.write_text(
+        replace_once(source, old, new, "security assertion"),
+        encoding="utf-8",
+    )
+
+
+def update_browser_manifest() -> None:
+    """Declare the React modules imported directly by the isolated harness."""
+    path = Path("tests/browser/package.json")
+    package = json.loads(path.read_text(encoding="utf-8"))
+    development = package.setdefault("devDependencies", {})
+    development["react"] = "18.3.1"
+    development["react-dom"] = "18.3.1"
+    package["devDependencies"] = dict(sorted(development.items()))
+    path.write_text(
+        json.dumps(package, ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+    )
+
+
+def update_release_workflow() -> None:
+    """Generate, validate, attach, and publish one SBOM per exact package."""
+    path = Path(".github/workflows/release.yml")
+    source = path.read_text(encoding="utf-8")
+
+    old_sbom = """      - name: Generate release SBOM
+        run: |
+          set -euo pipefail
+          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
+      - name: Validate release SBOM
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const { readFileSync, statSync } = require('node:fs');
+
+          const sbomPath = 'release/inkspan.spdx.json';
+          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
+          const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
+          const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
+          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
+            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
+          }
+          if (sbom.spdxVersion !== 'SPDX-2.3') {
+            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
+          }
+          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+            throw new Error('Release SBOM package inventory must not be empty.');
+          }
+          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
+          if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
+            throw new Error('Release source has an unexpected editor package identity.');
+          }
+          if (!/^name\\s*=\\s*["']inkspan-office["']\\s*$/m.test(officeMetadata)) {
+            throw new Error('Release source has an unexpected Office package identity.');
+          }
+          if (!sbomPackageNames.has(packageMetadata.name)) {
+            throw new Error('Release SBOM inventory must include the editor package identity.');
+          }
+          if (!sbomPackageNames.has('inkspan-office')) {
+            throw new Error('Release SBOM inventory must include the Office package identity.');
+          }
+          NODE
+"""
+    new_sbom = """      - name: Generate artifact-specific release SBOMs
+        run: |
+          set -euo pipefail
+          mapfile -t npm_assets < <(
+            find release -maxdepth 1 -type f -name '*.tgz' -printf '%f\\n' | LC_ALL=C sort
+          )
+          mapfile -t wheel_assets < <(
+            find release -maxdepth 1 -type f -name '*.whl' -printf '%f\\n' | LC_ALL=C sort
+          )
+          if [[ ${#npm_assets[@]} -ne 1 || ${#wheel_assets[@]} -ne 1 ]]; then
+            echo "::error::SBOM generation requires exactly one npm archive and one wheel."
+            exit 1
+          fi
+          syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json
+          syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json
+      - name: Validate artifact-specific SBOM relationships
+        run: |
+          set -euo pipefail
+          node <<'NODE'
+          const { readFileSync, statSync } = require('node:fs');
+
+          const specifications = [
+            {
+              sbomPath: 'release/editor-package.spdx.json',
+              expectedName: '@contextualwisdomlab/cwl-editor',
+              forbiddenName: 'inkspan-office',
+            },
+            {
+              sbomPath: 'release/office-package.spdx.json',
+              expectedName: 'inkspan-office',
+              forbiddenName: '@contextualwisdomlab/cwl-editor',
+            },
+          ];
+
+          function describedElementIds(sbom) {
+            const described = new Set(
+              Array.isArray(sbom.documentDescribes) ? sbom.documentDescribes : [],
+            );
+            for (const relationship of sbom.relationships ?? []) {
+              if (relationship.relationshipType === 'DESCRIBES') {
+                described.add(relationship.relatedSpdxElement);
+              } else if (relationship.relationshipType === 'DESCRIBED_BY') {
+                described.add(relationship.spdxElementId);
+              }
+            }
+            return described;
+          }
+
+          for (const specification of specifications) {
+            const sbom = JSON.parse(readFileSync(specification.sbomPath, 'utf8'));
+            if (statSync(specification.sbomPath).size > 16 * 1024 * 1024) {
+              throw new Error(`${specification.sbomPath} exceeds the 16 MiB attest input limit.`);
+            }
+            if (sbom.spdxVersion !== 'SPDX-2.3') {
+              throw new Error(`${specification.sbomPath} must be SPDX-2.3.`);
+            }
+            if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+              throw new Error(`${specification.sbomPath} has no package inventory.`);
+            }
+            const expectedPackages = sbom.packages.filter(
+              (candidate) => candidate.name === specification.expectedName,
+            );
+            if (expectedPackages.length !== 1) {
+              throw new Error(
+                `${specification.sbomPath} must contain exactly one ${specification.expectedName} package.`,
+              );
+            }
+            if (
+              sbom.packages.some(
+                (candidate) => candidate.name === specification.forbiddenName,
+              )
+            ) {
+              throw new Error(
+                `${specification.sbomPath} contains the other release package identity.`,
+              );
+            }
+            const described = describedElementIds(sbom);
+            if (!described.has(expectedPackages[0].SPDXID)) {
+              throw new Error(
+                `${specification.sbomPath} does not describe its matching release package.`,
+              );
+            }
+          }
+          NODE
+"""
+    source = replace_once(source, old_sbom, new_sbom, "release SBOM")
+    source = replace_once(
+        source,
+        "          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS",
+        "          sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS",
+        "release checksum",
+    )
+    source = replace_count(
+        source,
+        "          expected_asset_count=4",
+        "          expected_asset_count=5",
+        2,
+        "release asset count",
+    )
+
+    old_inventory = """            || ! -f release/inkspan.spdx.json \\
+            || ! -f release/SHA256SUMS ]]; then
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."""
+    new_inventory = """            || ! -f release/editor-package.spdx.json \\
+            || ! -f release/office-package.spdx.json \\
+            || ! -f release/SHA256SUMS ]]; then
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, two matching *.spdx.json files, and SHA256SUMS."""
+    source = replace_count(
+        source,
+        old_inventory,
+        new_inventory,
+        2,
+        "release inventory",
+    )
+
+    old_attest = """      - name: Attest release artifacts
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+            release/inkspan.spdx.json
+            release/SHA256SUMS
+      - name: Attest release packages with SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+          sbom-path: release/inkspan.spdx.json
+"""
+    new_attest = """      - name: Attest release artifacts
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            release/*.tgz
+            release/*.whl
+            release/*.spdx.json
+            release/SHA256SUMS
+      - name: Attest npm package with its exact SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: release/*.tgz
+          sbom-path: release/editor-package.spdx.json
+      - name: Attest Office wheel with its exact SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: release/*.whl
+          sbom-path: release/office-package.spdx.json
+"""
+    source = replace_once(source, old_attest, new_attest, "release attestation")
+    source = replace_once(
+        source,
+        "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
+        "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
+        "release verification",
+    )
+    path.write_text(source, encoding="utf-8")
+
+
+def main() -> None:
+    """Apply every current, verified review finding in one bounded mutation."""
+    update_security_test()
+    update_browser_manifest()
+    update_release_workflow()
+
+
+if __name__ == "__main__":
+    main()

From e3e4bb54ec11740df7cf360096110e41d3ba89e0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:41:41 +0900
Subject: [PATCH 12/54] ci(diagnostics): run one-shot review repair

---
 .../address-writing-diagnostics-review.yml    | 247 +-----------------
 1 file changed, 5 insertions(+), 242 deletions(-)

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
index 9c6d9e17..6ed5cd23 100644
--- a/.github/workflows/address-writing-diagnostics-review.yml
+++ b/.github/workflows/address-writing-diagnostics-review.yml
@@ -32,245 +32,7 @@ jobs:
           node-version: 22
           cache: pnpm
       - name: Apply verified review fixes
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          import json
-
-          security_path = Path('src/components/writingDiagnosticsSecurity.test.tsx')
-          security = security_path.read_text(encoding='utf-8')
-          old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
-              expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
-          if old_security not in security:
-              old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
-              expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
-          # Preserve the source's actual indentation while making the assertion match the payload.
-          old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
-              expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
-          if old_security not in security:
-              old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
-            expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
-          if old_security not in security:
-              old_security = '''    expect(document.querySelector('script[src="x"]')).toBeNull();
-    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
-          if security.count(old_security) != 1:
-              raise SystemExit('security assertion anchor mismatch')
-          new_security = '''    expect(document.querySelector('img[src="x"]')).toBeNull();
-    expect(
-      screen.getByText('<img src=x onerror=alert(1)> explanation'),
-    ).toBeVisible();
-    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();'''
-          security_path.write_text(
-              security.replace(old_security, new_security),
-              encoding='utf-8',
-          )
-
-          package_path = Path('tests/browser/package.json')
-          package = json.loads(package_path.read_text(encoding='utf-8'))
-          development = package.setdefault('devDependencies', {})
-          development['react'] = '18.3.1'
-          development['react-dom'] = '18.3.1'
-          package['devDependencies'] = dict(sorted(development.items()))
-          package_path.write_text(
-              json.dumps(package, ensure_ascii=False, indent=2) + '\n',
-              encoding='utf-8',
-          )
-
-          release_path = Path('.github/workflows/release.yml')
-          release = release_path.read_text(encoding='utf-8')
-          old_sbom = '''      - name: Generate release SBOM
-        run: |
-          set -euo pipefail
-          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
-      - name: Validate release SBOM
-        run: |
-          set -euo pipefail
-          node <<'NODE'
-          const { readFileSync, statSync } = require('node:fs');
-
-          const sbomPath = 'release/inkspan.spdx.json';
-          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
-          const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
-          const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
-          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
-            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
-          }
-          if (sbom.spdxVersion !== 'SPDX-2.3') {
-            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
-          }
-          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
-            throw new Error('Release SBOM package inventory must not be empty.');
-          }
-          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
-          if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
-            throw new Error('Release source has an unexpected editor package identity.');
-          }
-          if (!/^name\\s*=\\s*["']inkspan-office["']\\s*$/m.test(officeMetadata)) {
-            throw new Error('Release source has an unexpected Office package identity.');
-          }
-          if (!sbomPackageNames.has(packageMetadata.name)) {
-            throw new Error('Release SBOM inventory must include the editor package identity.');
-          }
-          if (!sbomPackageNames.has('inkspan-office')) {
-            throw new Error('Release SBOM inventory must include the Office package identity.');
-          }
-          NODE
-'''
-          new_sbom = '''      - name: Generate artifact-specific release SBOMs
-        run: |
-          set -euo pipefail
-          mapfile -t npm_assets < <(
-            find release -maxdepth 1 -type f -name '*.tgz' -printf '%f\\n' | LC_ALL=C sort
-          )
-          mapfile -t wheel_assets < <(
-            find release -maxdepth 1 -type f -name '*.whl' -printf '%f\\n' | LC_ALL=C sort
-          )
-          if [[ ${#npm_assets[@]} -ne 1 || ${#wheel_assets[@]} -ne 1 ]]; then
-            echo "::error::SBOM generation requires exactly one npm archive and one wheel."
-            exit 1
-          fi
-          syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json
-          syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json
-      - name: Validate artifact-specific SBOM relationships
-        run: |
-          set -euo pipefail
-          node <<'NODE'
-          const { readFileSync, statSync } = require('node:fs');
-
-          const specifications = [
-            {
-              sbomPath: 'release/editor-package.spdx.json',
-              expectedName: '@contextualwisdomlab/cwl-editor',
-              forbiddenName: 'inkspan-office',
-            },
-            {
-              sbomPath: 'release/office-package.spdx.json',
-              expectedName: 'inkspan-office',
-              forbiddenName: '@contextualwisdomlab/cwl-editor',
-            },
-          ];
-
-          function describedElementIds(sbom) {
-            const described = new Set(
-              Array.isArray(sbom.documentDescribes) ? sbom.documentDescribes : [],
-            );
-            for (const relationship of sbom.relationships ?? []) {
-              if (relationship.relationshipType === 'DESCRIBES') {
-                described.add(relationship.relatedSpdxElement);
-              } else if (relationship.relationshipType === 'DESCRIBED_BY') {
-                described.add(relationship.spdxElementId);
-              }
-            }
-            return described;
-          }
-
-          for (const specification of specifications) {
-            const sbom = JSON.parse(readFileSync(specification.sbomPath, 'utf8'));
-            if (statSync(specification.sbomPath).size > 16 * 1024 * 1024) {
-              throw new Error(`${specification.sbomPath} exceeds the 16 MiB attest input limit.`);
-            }
-            if (sbom.spdxVersion !== 'SPDX-2.3') {
-              throw new Error(`${specification.sbomPath} must be SPDX-2.3.`);
-            }
-            if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
-              throw new Error(`${specification.sbomPath} has no package inventory.`);
-            }
-            const expectedPackages = sbom.packages.filter(
-              (candidate) => candidate.name === specification.expectedName,
-            );
-            if (expectedPackages.length !== 1) {
-              throw new Error(
-                `${specification.sbomPath} must contain exactly one ${specification.expectedName} package.`,
-              );
-            }
-            if (sbom.packages.some((candidate) => candidate.name === specification.forbiddenName)) {
-              throw new Error(
-                `${specification.sbomPath} contains the other release package identity.`,
-              );
-            }
-            const described = describedElementIds(sbom);
-            if (!described.has(expectedPackages[0].SPDXID)) {
-              throw new Error(
-                `${specification.sbomPath} does not describe its matching release package.`,
-              );
-            }
-          }
-          NODE
-'''
-          if release.count(old_sbom) != 1:
-              raise SystemExit('release SBOM block anchor mismatch')
-          release = release.replace(old_sbom, new_sbom)
-
-          old_checksum = '          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS'
-          new_checksum = '          sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS'
-          if release.count(old_checksum) != 1:
-              raise SystemExit('release checksum anchor mismatch')
-          release = release.replace(old_checksum, new_checksum)
-
-          if release.count('          expected_asset_count=4') != 2:
-              raise SystemExit('release asset-count anchor mismatch')
-          release = release.replace(
-              '          expected_asset_count=4',
-              '          expected_asset_count=5',
-          )
-
-          old_inventory = '''            || ! -f release/inkspan.spdx.json \\
-            || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."'''
-          new_inventory = '''            || ! -f release/editor-package.spdx.json \\
-            || ! -f release/office-package.spdx.json \\
-            || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, two matching *.spdx.json files, and SHA256SUMS."'''
-          if release.count(old_inventory) != 2:
-              raise SystemExit('release inventory anchor mismatch')
-          release = release.replace(old_inventory, new_inventory)
-
-          old_attest = '''      - name: Attest release artifacts
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-            release/inkspan.spdx.json
-            release/SHA256SUMS
-      - name: Attest release packages with SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-          sbom-path: release/inkspan.spdx.json
-'''
-          new_attest = '''      - name: Attest release artifacts
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-            release/*.spdx.json
-            release/SHA256SUMS
-      - name: Attest npm package with its exact SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: release/*.tgz
-          sbom-path: release/editor-package.spdx.json
-      - name: Attest Office wheel with its exact SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: release/*.whl
-          sbom-path: release/office-package.spdx.json
-'''
-          if release.count(old_attest) != 1:
-              raise SystemExit('release attestation anchor mismatch')
-          release = release.replace(old_attest, new_attest)
-
-          old_verify = '          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do'
-          new_verify = '          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do'
-          if release.count(old_verify) != 1:
-              raise SystemExit('release verification anchor mismatch')
-          release = release.replace(old_verify, new_verify)
-          release_path.write_text(release, encoding='utf-8')
-          PY
+        run: python .github/scripts/address_writing_diagnostics_review.py
       - name: Regenerate isolated browser-test lock
         run: >-
           pnpm --dir tests/browser install
@@ -310,12 +72,11 @@ jobs:
             echo "::error::Review repair changed an unexpected file."
             exit 1
           fi
-      - name: Commit verified review repair and remove one-shot workflow
+      - name: Commit verified review repair and remove one-shot files
         env:
           BRANCH_NAME: feat/writing-diagnostics-assurance
         run: |
           set -euo pipefail
-          rm .github/workflows/address-writing-diagnostics-review.yml
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add \
@@ -323,6 +84,8 @@ jobs:
             src/components/writingDiagnosticsSecurity.test.tsx \
             tests/browser/package.json \
             tests/browser/pnpm-lock.yaml
-          git rm --cached .github/workflows/address-writing-diagnostics-review.yml
+          git rm \
+            .github/scripts/address_writing_diagnostics_review.py \
+            .github/workflows/address-writing-diagnostics-review.yml
           git commit -m "fix(diagnostics): address assurance review findings"
           git push origin "HEAD:${BRANCH_NAME}"

From 1a89ce05bb5def3fdc8fcc645937fbcd82d21d4a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:47:57 +0900
Subject: [PATCH 13/54] ci(diagnostics): correct repeated verification repair
 anchor

---
 .github/scripts/fix_review_repair_counter.py | 22 ++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/scripts/fix_review_repair_counter.py

diff --git a/.github/scripts/fix_review_repair_counter.py b/.github/scripts/fix_review_repair_counter.py
new file mode 100644
index 00000000..329d029c
--- /dev/null
+++ b/.github/scripts/fix_review_repair_counter.py
@@ -0,0 +1,22 @@
+"""Correct the one-shot repair script's repeated release verification anchor."""
+
+from pathlib import Path
+
+path = Path(".github/scripts/address_writing_diagnostics_review.py")
+source = path.read_text(encoding="utf-8")
+old = '''    source = replace_once(
+        source,
+        "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
+        "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
+        "release verification",
+    )'''
+new = '''    source = replace_count(
+        source,
+        "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
+        "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
+        2,
+        "release verification",
+    )'''
+if source.count(old) != 1:
+    raise SystemExit("review repair counter anchor mismatch")
+path.write_text(source.replace(old, new), encoding="utf-8")

From f82300ebeb95789b435de04a9495be9b5bab5f13 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:48:48 +0900
Subject: [PATCH 14/54] ci(diagnostics): rerun corrected review repair

---
 .github/workflows/address-writing-diagnostics-review.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
index 6ed5cd23..6cc061e6 100644
--- a/.github/workflows/address-writing-diagnostics-review.yml
+++ b/.github/workflows/address-writing-diagnostics-review.yml
@@ -31,6 +31,8 @@ jobs:
         with:
           node-version: 22
           cache: pnpm
+      - name: Correct repeated verification repair anchor
+        run: python .github/scripts/fix_review_repair_counter.py
       - name: Apply verified review fixes
         run: python .github/scripts/address_writing_diagnostics_review.py
       - name: Regenerate isolated browser-test lock
@@ -86,6 +88,7 @@ jobs:
             tests/browser/pnpm-lock.yaml
           git rm \
             .github/scripts/address_writing_diagnostics_review.py \
+            .github/scripts/fix_review_repair_counter.py \
             .github/workflows/address-writing-diagnostics-review.yml
           git commit -m "fix(diagnostics): address assurance review findings"
           git push origin "HEAD:${BRANCH_NAME}"

From c873d76e6430b8780d1e4ab2c77a9f103bab5c71 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:52:27 +0900
Subject: [PATCH 15/54] ci(diagnostics): correct hostile assertion repair

---
 .github/scripts/fix_review_repair_counter.py | 24 ++++++++++++++++----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/fix_review_repair_counter.py b/.github/scripts/fix_review_repair_counter.py
index 329d029c..e71d7204 100644
--- a/.github/scripts/fix_review_repair_counter.py
+++ b/.github/scripts/fix_review_repair_counter.py
@@ -1,22 +1,36 @@
-"""Correct the one-shot repair script's repeated release verification anchor."""
+"""Correct bounded anchors in the one-shot writing-diagnostics review repair."""
 
 from pathlib import Path
 
 path = Path(".github/scripts/address_writing_diagnostics_review.py")
 source = path.read_text(encoding="utf-8")
-old = '''    source = replace_once(
+
+old_counter = '''    source = replace_once(
         source,
         "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
         "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
         "release verification",
     )'''
-new = '''    source = replace_count(
+new_counter = '''    source = replace_count(
         source,
         "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
         "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
         2,
         "release verification",
     )'''
-if source.count(old) != 1:
+if source.count(old_counter) != 1:
     raise SystemExit("review repair counter anchor mismatch")
-path.write_text(source.replace(old, new), encoding="utf-8")
+source = source.replace(old_counter, new_counter)
+
+old_security = '''    new = """    expect(document.querySelector('img[src=\\"x\\"]')).toBeNull();
+    expect(
+      screen.getByText('<img src=x onerror=alert(1)> explanation'),
+    ).toBeVisible();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""'''
+new_security = '''    new = """    expect(document.querySelector('img[src=\\"x\\"]')).toBeNull();
+    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""'''
+if source.count(old_security) != 1:
+    raise SystemExit("review repair security anchor mismatch")
+source = source.replace(old_security, new_security)
+
+path.write_text(source, encoding="utf-8")

From 69cf1fb92dd27a1e698b720c5940019cef33c9be Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:53:04 +0900
Subject: [PATCH 16/54] ci(diagnostics): rerun bounded review repair

---
 .github/workflows/address-writing-diagnostics-review.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
index 6cc061e6..f0a2676e 100644
--- a/.github/workflows/address-writing-diagnostics-review.yml
+++ b/.github/workflows/address-writing-diagnostics-review.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           node-version: 22
           cache: pnpm
-      - name: Correct repeated verification repair anchor
+      - name: Correct bounded review-repair anchors
         run: python .github/scripts/fix_review_repair_counter.py
       - name: Apply verified review fixes
         run: python .github/scripts/address_writing_diagnostics_review.py

From 3308f0fd5dd14cb630e211afde53f0ac9de135df Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 00:57:37 +0900
Subject: [PATCH 17/54] ci(diagnostics): validate one-shot script mutation

---
 .github/workflows/address-writing-diagnostics-review.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
index f0a2676e..271d0812 100644
--- a/.github/workflows/address-writing-diagnostics-review.yml
+++ b/.github/workflows/address-writing-diagnostics-review.yml
@@ -63,6 +63,7 @@ jobs:
           git diff --check
           mapfile -t changed_files < <(git diff --name-only | LC_ALL=C sort)
           expected_files=(
+            .github/scripts/address_writing_diagnostics_review.py
             .github/workflows/release.yml
             src/components/writingDiagnosticsSecurity.test.tsx
             tests/browser/package.json

From 267c9a7c967a9300aac04b120665547b30b5bf7c Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 01:03:08 +0900
Subject: [PATCH 18/54] ci(diagnostics): remove mutated one-shot scripts safely

---
 .github/workflows/address-writing-diagnostics-review.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
index 271d0812..baa73fc5 100644
--- a/.github/workflows/address-writing-diagnostics-review.yml
+++ b/.github/workflows/address-writing-diagnostics-review.yml
@@ -87,7 +87,7 @@ jobs:
             src/components/writingDiagnosticsSecurity.test.tsx \
             tests/browser/package.json \
             tests/browser/pnpm-lock.yaml
-          git rm \
+          git rm -f \
             .github/scripts/address_writing_diagnostics_review.py \
             .github/scripts/fix_review_repair_counter.py \
             .github/workflows/address-writing-diagnostics-review.yml

From d5eab5ce73b8adebbe799e3d640ddeccd23c88bd Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 02:20:01 +0900
Subject: [PATCH 19/54] test(release): reject vulnerable pnpm bootstrap

---
 src/workflowExactHead.test.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/workflowExactHead.test.ts b/src/workflowExactHead.test.ts
index 4804599a..0585437e 100644
--- a/src/workflowExactHead.test.ts
+++ b/src/workflowExactHead.test.ts
@@ -9,11 +9,16 @@ function repositoryFile(path: string): string {
 }
 
 const workflow = repositoryFile('.github/workflows/ci.yml');
+const releaseWorkflow = repositoryFile('.github/workflows/release.yml');
 
 const CHECKOUT_PIN =
   'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1';
 const SETUP_NODE_PIN =
   'actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0';
+const SAFE_PNPM_ACTION_PIN =
+  'pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10';
+const VULNERABLE_PNPM_ACTION_PIN =
+  'pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8';
 
 describe('exact-head CI workflow contract', () => {
   it('uses a fixed runner and checks out the immutable current PR head', () => {
@@ -52,6 +57,13 @@ describe('exact-head CI workflow contract', () => {
     );
   });
 
+  it('rejects the vulnerable pnpm action bootstrap in release jobs', () => {
+    expect(releaseWorkflow).not.toContain(VULNERABLE_PNPM_ACTION_PIN);
+    expect(
+      releaseWorkflow.match(new RegExp(SAFE_PNPM_ACTION_PIN, 'g')),
+    ).toHaveLength(2);
+  });
+
   it('records the evidence boundary and unreleased hardening', () => {
     const doctoring = repositoryFile(
       'docs/doctoring/exact-head-ci-evidence.md',

From 48c59d04492b3c1920f80f475fabf751976b9a05 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 02:21:36 +0900
Subject: [PATCH 20/54] ci(diagnostics): run release bootstrap regression

---
 .../writing-diagnostics-assurance-tdd.yml         | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
index 20276466..be061fc9 100644
--- a/.github/workflows/writing-diagnostics-assurance-tdd.yml
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -4,6 +4,13 @@ on:
   push:
     branches:
       - feat/writing-diagnostics-assurance
+  pull_request:
+    paths:
+      - 'src/components/**'
+      - 'src/workflowExactHead.test.ts'
+      - 'tests/browser/**'
+      - '.github/workflows/release.yml'
+      - '.github/workflows/writing-diagnostics-assurance-tdd.yml'
   workflow_dispatch:
 
 permissions:
@@ -25,17 +32,19 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Run hostile-input, no-fallback, and focus assurance
+      - name: Run hostile-input, no-fallback, focus, and workflow assurance
         run: >-
           pnpm exec vitest run
           src/components/writingDiagnosticsSecurity.test.tsx
           src/components/writingDiagnosticsFocus.test.tsx
+          src/components/WritingDiagnosticsPanel.test.tsx
+          src/workflowExactHead.test.ts
           --pool=forks
           --maxWorkers=1
       - name: Typecheck assurance changes
@@ -52,7 +61,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22

From 0361697b44f1a7e8ef4f1c7a6ac52d210b14209e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 02:25:49 +0900
Subject: [PATCH 21/54] fix(release): use repaired pnpm bootstrap

---
 .github/workflows/release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5192b2e0..2cabb6da 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -207,7 +207,7 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Set up pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -716,4 +716,4 @@ jobs:
           done
 
           echo "::error::Registry publication verification did not converge to the exact artifact digests."
-          exit 1
+          exit 1
\ No newline at end of file

From 413b3ac4169c5965e72c2bc6e2f3e94d2c3ac46f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:41:46 +0900
Subject: [PATCH 22/54] test(security): assert diagnostic payload stays inert

---
 src/components/writingDiagnosticsSecurity.test.tsx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/components/writingDiagnosticsSecurity.test.tsx b/src/components/writingDiagnosticsSecurity.test.tsx
index 0ee23605..d8a1152d 100644
--- a/src/components/writingDiagnosticsSecurity.test.tsx
+++ b/src/components/writingDiagnosticsSecurity.test.tsx
@@ -138,7 +138,10 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
       ),
     );
     expect(onAction).toHaveBeenCalledTimes(1);
-    expect(document.querySelector('script[src="x"]')).toBeNull();
+    expect(document.querySelector('img[src="x"]')).toBeNull();
+    expect(
+      screen.getByText('<img src=x onerror=alert(1)> explanation'),
+    ).toBeVisible();
     expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();
   });
 });

From 3974796add8020fbc3329f3c1418960774d6d7e3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:43:11 +0900
Subject: [PATCH 23/54] test(browser): declare harness React runtime deps

---
 tests/browser/package.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/browser/package.json b/tests/browser/package.json
index fc99e7c1..c0cebba6 100644
--- a/tests/browser/package.json
+++ b/tests/browser/package.json
@@ -4,6 +4,8 @@
   "type": "module",
   "packageManager": "pnpm@11.5.3",
   "devDependencies": {
-    "@playwright/test": "1.62.0"
+    "@playwright/test": "1.62.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1"
   }
 }

From ef6aaf5a87231c0ddf5c8276b638d4aaade727ef Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:44:09 +0900
Subject: [PATCH 24/54] test(browser): lock isolated React harness deps

---
 tests/browser/pnpm-lock.yaml | 45 ++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/tests/browser/pnpm-lock.yaml b/tests/browser/pnpm-lock.yaml
index 67f19004..78e8055a 100644
--- a/tests/browser/pnpm-lock.yaml
+++ b/tests/browser/pnpm-lock.yaml
@@ -10,6 +10,12 @@ importers:
       '@playwright/test':
         specifier: 1.62.0
         version: 1.62.0
+      react:
+        specifier: 18.3.1
+        version: 18.3.1
+      react-dom:
+        specifier: 18.3.1
+        version: 18.3.1(react@18.3.1)
 
 packages:
   '@playwright/test@1.62.0':
@@ -22,6 +28,13 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
   playwright-core@1.62.0:
     resolution: {integrity: sha512-nsNRyq0r2zsG8AcRHWknc9QRA5XCueC7gWMrs+Gx2tlZn9hcl8zudfh00lhJPY1DE7NmZ6bDsT9g2yey8mXljA==}
     engines: {node: '>=20'}
@@ -32,6 +45,18 @@ packages:
     engines: {node: '>=20'}
     hasBin: true
 
+  react-dom@18.3.1:
+    resolution: {integrity: sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==}
+    peerDependencies:
+      react: ^18.3.1
+
+  react@18.3.1:
+    resolution: {integrity: sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==}
+    engines: {node: '>=0.10.0'}
+
+  scheduler@0.23.2:
+    resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
+
 snapshots:
   '@playwright/test@1.62.0':
     dependencies:
@@ -40,6 +65,12 @@ snapshots:
   fsevents@2.3.2:
     optional: true
 
+  js-tokens@4.0.0: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
   playwright-core@1.62.0: {}
 
   playwright@1.62.0:
@@ -47,3 +78,17 @@ snapshots:
       playwright-core: 1.62.0
     optionalDependencies:
       fsevents: 2.3.2
+
+  react-dom@18.3.1(react@18.3.1):
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.3.1
+      scheduler: 0.23.2
+
+  react@18.3.1:
+    dependencies:
+      loose-envify: 1.4.0
+
+  scheduler@0.23.2:
+    dependencies:
+      loose-envify: 1.4.0

From 393c1a66563a3ba4a274bd55ffdd7e313b988e80 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:45:00 +0900
Subject: [PATCH 25/54] ci(diagnostics): remove obsolete self-modifying writer

---
 .../address-writing-diagnostics-review.yml    | 95 -------------------
 1 file changed, 95 deletions(-)
 delete mode 100644 .github/workflows/address-writing-diagnostics-review.yml

diff --git a/.github/workflows/address-writing-diagnostics-review.yml b/.github/workflows/address-writing-diagnostics-review.yml
deleted file mode 100644
index baa73fc5..00000000
--- a/.github/workflows/address-writing-diagnostics-review.yml
+++ /dev/null
@@ -1,95 +0,0 @@
-name: Address Writing Diagnostics Review
-
-on:
-  push:
-    branches:
-      - feat/writing-diagnostics-assurance
-    paths:
-      - .github/workflows/address-writing-diagnostics-review.yml
-
-permissions:
-  contents: write
-
-concurrency:
-  group: address-writing-diagnostics-review
-  cancel-in-progress: false
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  repair:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: feat/writing-diagnostics-assurance
-          fetch-depth: 0
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: pnpm
-      - name: Correct bounded review-repair anchors
-        run: python .github/scripts/fix_review_repair_counter.py
-      - name: Apply verified review fixes
-        run: python .github/scripts/address_writing_diagnostics_review.py
-      - name: Regenerate isolated browser-test lock
-        run: >-
-          pnpm --dir tests/browser install
-          --lockfile-only
-          --ignore-scripts
-          --no-frozen-lockfile
-      - name: Install exact dependency graphs
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm --dir tests/browser install --frozen-lockfile
-      - name: Verify isolated React imports
-        run: >-
-          pnpm --dir tests/browser exec node --input-type=module -e
-          "await import('react'); await import('react-dom/client');"
-      - name: Run focused assurance and typecheck
-        run: |
-          pnpm exec vitest run \
-            src/components/writingDiagnosticsSecurity.test.tsx \
-            src/components/writingDiagnosticsFocus.test.tsx \
-            --pool=forks \
-            --maxWorkers=1
-          pnpm typecheck
-      - name: Validate workflow and exact patch scope
-        run: |
-          ruby -e "require 'yaml'; YAML.load_file('.github/workflows/release.yml')"
-          git diff --check
-          mapfile -t changed_files < <(git diff --name-only | LC_ALL=C sort)
-          expected_files=(
-            .github/scripts/address_writing_diagnostics_review.py
-            .github/workflows/release.yml
-            src/components/writingDiagnosticsSecurity.test.tsx
-            tests/browser/package.json
-            tests/browser/pnpm-lock.yaml
-          )
-          if ! diff -u \
-            <(printf '%s\n' "${expected_files[@]}" | LC_ALL=C sort) \
-            <(printf '%s\n' "${changed_files[@]}"); then
-            echo "::error::Review repair changed an unexpected file."
-            exit 1
-          fi
-      - name: Commit verified review repair and remove one-shot files
-        env:
-          BRANCH_NAME: feat/writing-diagnostics-assurance
-        run: |
-          set -euo pipefail
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add \
-            .github/workflows/release.yml \
-            src/components/writingDiagnosticsSecurity.test.tsx \
-            tests/browser/package.json \
-            tests/browser/pnpm-lock.yaml
-          git rm -f \
-            .github/scripts/address_writing_diagnostics_review.py \
-            .github/scripts/fix_review_repair_counter.py \
-            .github/workflows/address-writing-diagnostics-review.yml
-          git commit -m "fix(diagnostics): address assurance review findings"
-          git push origin "HEAD:${BRANCH_NAME}"

From ca8bfe64de4bc1d45de7528914d34a5b79bd84b1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:45:53 +0900
Subject: [PATCH 26/54] ci(diagnostics): remove obsolete review repair script

---
 .../address_writing_diagnostics_review.py     | 278 ------------------
 1 file changed, 278 deletions(-)
 delete mode 100644 .github/scripts/address_writing_diagnostics_review.py

diff --git a/.github/scripts/address_writing_diagnostics_review.py b/.github/scripts/address_writing_diagnostics_review.py
deleted file mode 100644
index 5ab7b4bb..00000000
--- a/.github/scripts/address_writing_diagnostics_review.py
+++ /dev/null
@@ -1,278 +0,0 @@
-"""Apply the bounded review fixes for writing-diagnostics assurance PR #285."""
-
-from __future__ import annotations
-
-import json
-from pathlib import Path
-
-
-def replace_once(source: str, old: str, new: str, label: str) -> str:
-    """Replace one exact reviewed anchor or fail closed on branch drift."""
-    occurrence_count = source.count(old)
-    if occurrence_count != 1:
-        raise SystemExit(
-            f"{label} anchor mismatch: expected 1 occurrence, found {occurrence_count}"
-        )
-    return source.replace(old, new)
-
-
-def replace_count(
-    source: str,
-    old: str,
-    new: str,
-    expected_count: int,
-    label: str,
-) -> str:
-    """Replace an exact number of repeated reviewed anchors or fail closed."""
-    occurrence_count = source.count(old)
-    if occurrence_count != expected_count:
-        raise SystemExit(
-            f"{label} anchor mismatch: expected {expected_count}, "
-            f"found {occurrence_count}"
-        )
-    return source.replace(old, new)
-
-
-def update_security_test() -> None:
-    """Make the hostile-HTML assertion match the actual image payload."""
-    path = Path("src/components/writingDiagnosticsSecurity.test.tsx")
-    source = path.read_text(encoding="utf-8")
-    old = """    expect(document.querySelector('script[src=\"x\"]')).toBeNull();
-    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""
-    new = """    expect(document.querySelector('img[src=\"x\"]')).toBeNull();
-    expect(
-      screen.getByText('<img src=x onerror=alert(1)> explanation'),
-    ).toBeVisible();
-    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""
-    path.write_text(
-        replace_once(source, old, new, "security assertion"),
-        encoding="utf-8",
-    )
-
-
-def update_browser_manifest() -> None:
-    """Declare the React modules imported directly by the isolated harness."""
-    path = Path("tests/browser/package.json")
-    package = json.loads(path.read_text(encoding="utf-8"))
-    development = package.setdefault("devDependencies", {})
-    development["react"] = "18.3.1"
-    development["react-dom"] = "18.3.1"
-    package["devDependencies"] = dict(sorted(development.items()))
-    path.write_text(
-        json.dumps(package, ensure_ascii=False, indent=2) + "\n",
-        encoding="utf-8",
-    )
-
-
-def update_release_workflow() -> None:
-    """Generate, validate, attach, and publish one SBOM per exact package."""
-    path = Path(".github/workflows/release.yml")
-    source = path.read_text(encoding="utf-8")
-
-    old_sbom = """      - name: Generate release SBOM
-        run: |
-          set -euo pipefail
-          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
-      - name: Validate release SBOM
-        run: |
-          set -euo pipefail
-          node <<'NODE'
-          const { readFileSync, statSync } = require('node:fs');
-
-          const sbomPath = 'release/inkspan.spdx.json';
-          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
-          const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
-          const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
-          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
-            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
-          }
-          if (sbom.spdxVersion !== 'SPDX-2.3') {
-            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
-          }
-          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
-            throw new Error('Release SBOM package inventory must not be empty.');
-          }
-          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
-          if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
-            throw new Error('Release source has an unexpected editor package identity.');
-          }
-          if (!/^name\\s*=\\s*["']inkspan-office["']\\s*$/m.test(officeMetadata)) {
-            throw new Error('Release source has an unexpected Office package identity.');
-          }
-          if (!sbomPackageNames.has(packageMetadata.name)) {
-            throw new Error('Release SBOM inventory must include the editor package identity.');
-          }
-          if (!sbomPackageNames.has('inkspan-office')) {
-            throw new Error('Release SBOM inventory must include the Office package identity.');
-          }
-          NODE
-"""
-    new_sbom = """      - name: Generate artifact-specific release SBOMs
-        run: |
-          set -euo pipefail
-          mapfile -t npm_assets < <(
-            find release -maxdepth 1 -type f -name '*.tgz' -printf '%f\\n' | LC_ALL=C sort
-          )
-          mapfile -t wheel_assets < <(
-            find release -maxdepth 1 -type f -name '*.whl' -printf '%f\\n' | LC_ALL=C sort
-          )
-          if [[ ${#npm_assets[@]} -ne 1 || ${#wheel_assets[@]} -ne 1 ]]; then
-            echo "::error::SBOM generation requires exactly one npm archive and one wheel."
-            exit 1
-          fi
-          syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json
-          syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json
-      - name: Validate artifact-specific SBOM relationships
-        run: |
-          set -euo pipefail
-          node <<'NODE'
-          const { readFileSync, statSync } = require('node:fs');
-
-          const specifications = [
-            {
-              sbomPath: 'release/editor-package.spdx.json',
-              expectedName: '@contextualwisdomlab/cwl-editor',
-              forbiddenName: 'inkspan-office',
-            },
-            {
-              sbomPath: 'release/office-package.spdx.json',
-              expectedName: 'inkspan-office',
-              forbiddenName: '@contextualwisdomlab/cwl-editor',
-            },
-          ];
-
-          function describedElementIds(sbom) {
-            const described = new Set(
-              Array.isArray(sbom.documentDescribes) ? sbom.documentDescribes : [],
-            );
-            for (const relationship of sbom.relationships ?? []) {
-              if (relationship.relationshipType === 'DESCRIBES') {
-                described.add(relationship.relatedSpdxElement);
-              } else if (relationship.relationshipType === 'DESCRIBED_BY') {
-                described.add(relationship.spdxElementId);
-              }
-            }
-            return described;
-          }
-
-          for (const specification of specifications) {
-            const sbom = JSON.parse(readFileSync(specification.sbomPath, 'utf8'));
-            if (statSync(specification.sbomPath).size > 16 * 1024 * 1024) {
-              throw new Error(`${specification.sbomPath} exceeds the 16 MiB attest input limit.`);
-            }
-            if (sbom.spdxVersion !== 'SPDX-2.3') {
-              throw new Error(`${specification.sbomPath} must be SPDX-2.3.`);
-            }
-            if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
-              throw new Error(`${specification.sbomPath} has no package inventory.`);
-            }
-            const expectedPackages = sbom.packages.filter(
-              (candidate) => candidate.name === specification.expectedName,
-            );
-            if (expectedPackages.length !== 1) {
-              throw new Error(
-                `${specification.sbomPath} must contain exactly one ${specification.expectedName} package.`,
-              );
-            }
-            if (
-              sbom.packages.some(
-                (candidate) => candidate.name === specification.forbiddenName,
-              )
-            ) {
-              throw new Error(
-                `${specification.sbomPath} contains the other release package identity.`,
-              );
-            }
-            const described = describedElementIds(sbom);
-            if (!described.has(expectedPackages[0].SPDXID)) {
-              throw new Error(
-                `${specification.sbomPath} does not describe its matching release package.`,
-              );
-            }
-          }
-          NODE
-"""
-    source = replace_once(source, old_sbom, new_sbom, "release SBOM")
-    source = replace_once(
-        source,
-        "          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS",
-        "          sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS",
-        "release checksum",
-    )
-    source = replace_count(
-        source,
-        "          expected_asset_count=4",
-        "          expected_asset_count=5",
-        2,
-        "release asset count",
-    )
-
-    old_inventory = """            || ! -f release/inkspan.spdx.json \\
-            || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."""
-    new_inventory = """            || ! -f release/editor-package.spdx.json \\
-            || ! -f release/office-package.spdx.json \\
-            || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, two matching *.spdx.json files, and SHA256SUMS."""
-    source = replace_count(
-        source,
-        old_inventory,
-        new_inventory,
-        2,
-        "release inventory",
-    )
-
-    old_attest = """      - name: Attest release artifacts
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-            release/inkspan.spdx.json
-            release/SHA256SUMS
-      - name: Attest release packages with SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-          sbom-path: release/inkspan.spdx.json
-"""
-    new_attest = """      - name: Attest release artifacts
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-            release/*.spdx.json
-            release/SHA256SUMS
-      - name: Attest npm package with its exact SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: release/*.tgz
-          sbom-path: release/editor-package.spdx.json
-      - name: Attest Office wheel with its exact SBOM
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
-        with:
-          subject-path: release/*.whl
-          sbom-path: release/office-package.spdx.json
-"""
-    source = replace_once(source, old_attest, new_attest, "release attestation")
-    source = replace_once(
-        source,
-        "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
-        "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
-        "release verification",
-    )
-    path.write_text(source, encoding="utf-8")
-
-
-def main() -> None:
-    """Apply every current, verified review finding in one bounded mutation."""
-    update_security_test()
-    update_browser_manifest()
-    update_release_workflow()
-
-
-if __name__ == "__main__":
-    main()

From 49eca2419e8d17feffad6af3ae2fee594f71eb26 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:46:36 +0900
Subject: [PATCH 27/54] ci(diagnostics): remove obsolete repair counter

---
 .github/scripts/fix_review_repair_counter.py | 36 --------------------
 1 file changed, 36 deletions(-)
 delete mode 100644 .github/scripts/fix_review_repair_counter.py

diff --git a/.github/scripts/fix_review_repair_counter.py b/.github/scripts/fix_review_repair_counter.py
deleted file mode 100644
index e71d7204..00000000
--- a/.github/scripts/fix_review_repair_counter.py
+++ /dev/null
@@ -1,36 +0,0 @@
-"""Correct bounded anchors in the one-shot writing-diagnostics review repair."""
-
-from pathlib import Path
-
-path = Path(".github/scripts/address_writing_diagnostics_review.py")
-source = path.read_text(encoding="utf-8")
-
-old_counter = '''    source = replace_once(
-        source,
-        "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
-        "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
-        "release verification",
-    )'''
-new_counter = '''    source = replace_count(
-        source,
-        "          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do",
-        "          for artifact in release/*.tgz release/*.whl release/*.spdx.json release/SHA256SUMS; do",
-        2,
-        "release verification",
-    )'''
-if source.count(old_counter) != 1:
-    raise SystemExit("review repair counter anchor mismatch")
-source = source.replace(old_counter, new_counter)
-
-old_security = '''    new = """    expect(document.querySelector('img[src=\\"x\\"]')).toBeNull();
-    expect(
-      screen.getByText('<img src=x onerror=alert(1)> explanation'),
-    ).toBeVisible();
-    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""'''
-new_security = '''    new = """    expect(document.querySelector('img[src=\\"x\\"]')).toBeNull();
-    expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();"""'''
-if source.count(old_security) != 1:
-    raise SystemExit("review repair security anchor mismatch")
-source = source.replace(old_security, new_security)
-
-path.write_text(source, encoding="utf-8")

From 52f626876815210859933ef2dd1850893f75f738 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:47:54 +0900
Subject: [PATCH 28/54] test(release): require artifact-specific SBOM
 provenance

---
 src/releaseArtifactSbomContract.test.ts | 41 +++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 src/releaseArtifactSbomContract.test.ts

diff --git a/src/releaseArtifactSbomContract.test.ts b/src/releaseArtifactSbomContract.test.ts
new file mode 100644
index 00000000..77a56eb2
--- /dev/null
+++ b/src/releaseArtifactSbomContract.test.ts
@@ -0,0 +1,41 @@
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+
+const releaseWorkflow = readFileSync(
+  new URL('../.github/workflows/release.yml', import.meta.url),
+  'utf8',
+);
+
+describe('release artifact SBOM provenance contract', () => {
+  it('scans each exact package artifact instead of the source workspace', () => {
+    expect(releaseWorkflow).not.toContain('syft scan dir:.');
+    expect(releaseWorkflow).toContain(
+      'syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json',
+    );
+    expect(releaseWorkflow).toContain(
+      'syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json',
+    );
+  });
+
+  it('keeps the two package SBOMs distinct through checksums and bounded release assets', () => {
+    expect(releaseWorkflow).toContain(
+      'sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS',
+    );
+    expect(releaseWorkflow.match(/expected_asset_count=5/gu)).toHaveLength(2);
+    expect(releaseWorkflow).toContain('release/editor-package.spdx.json');
+    expect(releaseWorkflow).toContain('release/office-package.spdx.json');
+    expect(releaseWorkflow).not.toContain('release/inkspan.spdx.json');
+  });
+
+  it('attests each package only with its matching SBOM', () => {
+    expect(releaseWorkflow).toContain(
+      'subject-path: release/*.tgz\n          sbom-path: release/editor-package.spdx.json',
+    );
+    expect(releaseWorkflow).toContain(
+      'subject-path: release/*.whl\n          sbom-path: release/office-package.spdx.json',
+    );
+    expect(releaseWorkflow).not.toContain(
+      'subject-path: |\n            release/*.tgz\n            release/*.whl\n          sbom-path:',
+    );
+  });
+});

From 92f4cc4a7e171aa09bb74861ced9e7ba740f0560 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:48:48 +0900
Subject: [PATCH 29/54] test(release): execute artifact SBOM contract

---
 .github/workflows/writing-diagnostics-assurance-tdd.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
index be061fc9..8ba39986 100644
--- a/.github/workflows/writing-diagnostics-assurance-tdd.yml
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -8,6 +8,7 @@ on:
     paths:
       - 'src/components/**'
       - 'src/workflowExactHead.test.ts'
+      - 'src/releaseArtifactSbomContract.test.ts'
       - 'tests/browser/**'
       - '.github/workflows/release.yml'
       - '.github/workflows/writing-diagnostics-assurance-tdd.yml'
@@ -38,12 +39,13 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Run hostile-input, no-fallback, focus, and workflow assurance
+      - name: Run hostile-input, no-fallback, focus, release-provenance, and workflow assurance
         run: >-
           pnpm exec vitest run
           src/components/writingDiagnosticsSecurity.test.tsx
           src/components/writingDiagnosticsFocus.test.tsx
           src/components/WritingDiagnosticsPanel.test.tsx
+          src/releaseArtifactSbomContract.test.ts
           src/workflowExactHead.test.ts
           --pool=forks
           --maxWorkers=1

From cd9440e1576a4a52a6f74f5d17bea6c53b780343 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:52:13 +0900
Subject: [PATCH 30/54] test(security): assert hostile explanation before
 invalidation

---
 src/components/writingDiagnosticsSecurity.test.tsx | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/components/writingDiagnosticsSecurity.test.tsx b/src/components/writingDiagnosticsSecurity.test.tsx
index d8a1152d..b0571e85 100644
--- a/src/components/writingDiagnosticsSecurity.test.tsx
+++ b/src/components/writingDiagnosticsSecurity.test.tsx
@@ -131,6 +131,11 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
     const apply = await screen.findByRole('button', {
       name: /Apply suggestion for/u,
     });
+    expect(document.querySelector('img[src="x"]')).toBeNull();
+    expect(
+      screen.getByText('<img src=x onerror=alert(1)> explanation'),
+    ).toBeVisible();
+
     fireEvent.click(apply);
     await waitFor(() =>
       expect(editorRef.current!.getHTML()).toContain(
@@ -139,9 +144,6 @@ describe('writing diagnostics security and semantic-authority boundary', () => {
     );
     expect(onAction).toHaveBeenCalledTimes(1);
     expect(document.querySelector('img[src="x"]')).toBeNull();
-    expect(
-      screen.getByText('<img src=x onerror=alert(1)> explanation'),
-    ).toBeVisible();
     expect(screen.queryByText('HOST_CALLBACK_SECRET')).toBeNull();
   });
 });

From 6af99b9ed3e023fed1eab13b5ee78f07ddd82e0f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 04:53:02 +0900
Subject: [PATCH 31/54] test(release): read workflow from repository root

---
 src/releaseArtifactSbomContract.test.ts | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/releaseArtifactSbomContract.test.ts b/src/releaseArtifactSbomContract.test.ts
index 77a56eb2..2b0090b4 100644
--- a/src/releaseArtifactSbomContract.test.ts
+++ b/src/releaseArtifactSbomContract.test.ts
@@ -1,10 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vitest';
 
-const releaseWorkflow = readFileSync(
-  new URL('../.github/workflows/release.yml', import.meta.url),
-  'utf8',
-);
+const releaseWorkflow = readFileSync('.github/workflows/release.yml', 'utf8');
 
 describe('release artifact SBOM provenance contract', () => {
   it('scans each exact package artifact instead of the source workspace', () => {

From 426222472a19ed721fbfec048b8b7f30dc25bc35 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 05:10:47 +0900
Subject: [PATCH 32/54] fix(release): bind SBOMs to exact packages

---
 .github/workflows/release.yml | 90 +++++++++++++++++++++--------------
 1 file changed, 55 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2cabb6da..e1bbb47c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -139,48 +139,62 @@ jobs:
             sh "$syft_installer" -v -b "$RUNNER_TEMP/syft-bin" v1.50.0
           "$RUNNER_TEMP/syft-bin/syft" version
           echo "$RUNNER_TEMP/syft-bin" >> "$GITHUB_PATH"
-      - name: Generate release SBOM
+      - name: Generate exact-package release SBOMs
         run: |
           set -euo pipefail
-          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
-      - name: Validate release SBOM
+          mapfile -t npm_assets < <(
+            find release -maxdepth 1 -type f -name '*.tgz' -printf '%f\n' | LC_ALL=C sort
+          )
+          mapfile -t wheel_assets < <(
+            find release -maxdepth 1 -type f -name '*.whl' -printf '%f\n' | LC_ALL=C sort
+          )
+          if [[ ${#npm_assets[@]} -ne 1 || ${#wheel_assets[@]} -ne 1 ]]; then
+            echo "::error::SBOM generation requires exactly one npm tarball and one Office wheel."
+            exit 1
+          fi
+          syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json
+          syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json
+      - name: Validate exact-package release SBOMs
         run: |
           set -euo pipefail
           node <<'NODE'
           const { readFileSync, statSync } = require('node:fs');
 
-          const sbomPath = 'release/inkspan.spdx.json';
-          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
           const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
           const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
-          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
-            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
-          }
-          if (sbom.spdxVersion !== 'SPDX-2.3') {
-            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
-          }
-          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
-            throw new Error('Release SBOM package inventory must not be empty.');
-          }
-          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
           if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
             throw new Error('Release source has an unexpected editor package identity.');
           }
           if (!/^name\s*=\s*["']inkspan-office["']\s*$/m.test(officeMetadata)) {
             throw new Error('Release source has an unexpected Office package identity.');
           }
-          if (!sbomPackageNames.has(packageMetadata.name)) {
-            throw new Error('Release SBOM inventory must include the editor package identity.');
-          }
-          if (!sbomPackageNames.has('inkspan-office')) {
-            throw new Error('Release SBOM inventory must include the Office package identity.');
+
+          const expectedSboms = [
+            ['release/editor-package.spdx.json', packageMetadata.name],
+            ['release/office-package.spdx.json', 'inkspan-office'],
+          ];
+          for (const [sbomPath, expectedPackageName] of expectedSboms) {
+            const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
+            if (statSync(sbomPath).size > 16 * 1024 * 1024) {
+              throw new Error(`${sbomPath} exceeds the 16 MiB actions/attest input limit.`);
+            }
+            if (sbom.spdxVersion !== 'SPDX-2.3') {
+              throw new Error(`${sbomPath} must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
+            }
+            if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+              throw new Error(`${sbomPath} package inventory must not be empty.`);
+            }
+            const packageNames = new Set(sbom.packages.map((pkg) => pkg.name));
+            if (!packageNames.has(expectedPackageName)) {
+              throw new Error(`${sbomPath} must include exact package identity ${expectedPackageName}.`);
+            }
           }
           NODE
       - name: Generate release checksums
         run: |
           set -euo pipefail
           cd release
-          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS
+          sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS
       - name: Transfer exact release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -292,7 +306,7 @@ jobs:
       - name: Verify bounded local release artifact set
         run: |
           set -euo pipefail
-          expected_asset_count=4
+          expected_asset_count=5
           mapfile -t local_entries < <(
             find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
           )
@@ -309,9 +323,10 @@ jobs:
             || ${#local_assets[@]} -ne $expected_asset_count \
             || ${#npm_assets[@]} -ne 1 \
             || ${#wheel_assets[@]} -ne 1 \
-            || ! -f release/inkspan.spdx.json \
+            || ! -f release/editor-package.spdx.json \
+            || ! -f release/office-package.spdx.json \
             || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, editor-package.spdx.json, office-package.spdx.json, and SHA256SUMS."
             exit 1
           fi
       - name: Attest release artifacts
@@ -320,21 +335,25 @@ jobs:
           subject-path: |
             release/*.tgz
             release/*.whl
-            release/inkspan.spdx.json
+            release/editor-package.spdx.json
+            release/office-package.spdx.json
             release/SHA256SUMS
-      - name: Attest release packages with SBOM
+      - name: Attest editor package with matching SBOM
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-          sbom-path: release/inkspan.spdx.json
+          subject-path: release/*.tgz
+          sbom-path: release/editor-package.spdx.json
+      - name: Attest Office package with matching SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: release/*.whl
+          sbom-path: release/office-package.spdx.json
       - name: Verify generated attestations
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do
+          for artifact in release/*.tgz release/*.whl release/editor-package.spdx.json release/office-package.spdx.json release/SHA256SUMS; do
             gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
           done
           for artifact in release/*.tgz release/*.whl; do
@@ -373,7 +392,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          expected_asset_count=4
+          expected_asset_count=5
           mapfile -t local_entries < <(
             find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
           )
@@ -390,9 +409,10 @@ jobs:
             || ${#local_assets[@]} -ne $expected_asset_count \
             || ${#npm_assets[@]} -ne 1 \
             || ${#wheel_assets[@]} -ne 1 \
-            || ! -f release/inkspan.spdx.json \
+            || ! -f release/editor-package.spdx.json \
+            || ! -f release/office-package.spdx.json \
             || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, editor-package.spdx.json, office-package.spdx.json, and SHA256SUMS."
             exit 1
           fi
 
@@ -484,7 +504,7 @@ jobs:
           fi
 
           gh release verify "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY"
-          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do
+          for artifact in release/*.tgz release/*.whl release/editor-package.spdx.json release/office-package.spdx.json release/SHA256SUMS; do
             gh release verify-asset "$GITHUB_REF_NAME" "$artifact" \
               --repo "$GITHUB_REPOSITORY"
           done

From db734580737e626d56bf23c2c3f856068bcc04ce Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 05:11:37 +0900
Subject: [PATCH 33/54] fix(ci): inherit pinned package bootstrap

---
 .github/workflows/writing-diagnostics-package-tdd.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/writing-diagnostics-package-tdd.yml b/.github/workflows/writing-diagnostics-package-tdd.yml
index d886bdf9..d8f98783 100644
--- a/.github/workflows/writing-diagnostics-package-tdd.yml
+++ b/.github/workflows/writing-diagnostics-package-tdd.yml
@@ -25,7 +25,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22

From 0688db9790c15a1782adfbe255523156d92fc5d8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 05:16:50 +0900
Subject: [PATCH 34/54] test(diagnostics): cover unavailable editor focus

---
 .../writingDiagnosticsFocus.test.tsx          | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/components/writingDiagnosticsFocus.test.tsx b/src/components/writingDiagnosticsFocus.test.tsx
index 516feb16..112642fb 100644
--- a/src/components/writingDiagnosticsFocus.test.tsx
+++ b/src/components/writingDiagnosticsFocus.test.tsx
@@ -117,4 +117,28 @@ describe('WritingDiagnosticsPanel affected-text focus', () => {
     expect(editor.chain).not.toHaveBeenCalled();
     expect(chain.run).not.toHaveBeenCalled();
   });
+
+  it('does not throw when controller acceptance races editor disposal', () => {
+    const { editor, chain } = buildEditorProbe();
+    const controller = {
+      ...buildController(editor, true),
+      editor: null,
+    } as unknown as WritingDiagnosticsController;
+    render(
+      <WritingDiagnosticsPanel
+        controller={controller}
+        label="Writing guidance"
+      />,
+    );
+
+    fireEvent.click(
+      screen.getByRole('button', {
+        name: 'Focus affected text for Clarify Alpha',
+      }),
+    );
+
+    expect(controller.focusDiagnostic).toHaveBeenCalledWith('focus-diagnostic');
+    expect(editor.chain).not.toHaveBeenCalled();
+    expect(chain.run).not.toHaveBeenCalled();
+  });
 });

From 9c0c3ecfc7345cb8553c594836d41893a056f062 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 05:17:46 +0900
Subject: [PATCH 35/54] test(browser): fail closed on missing diagnostics probe

---
 tests/browser/harness.ts | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/tests/browser/harness.ts b/tests/browser/harness.ts
index c3b38895..883eddaa 100644
--- a/tests/browser/harness.ts
+++ b/tests/browser/harness.ts
@@ -62,6 +62,12 @@ async function waitForEditorHandle(): Promise<CwlEditorHandle> {
   throw new Error('writing_diagnostics_editor_unavailable');
 }
 
+function requireDiagnosticsHandle(): CwlEditorHandle {
+  const handle = diagnosticsEditorRef.current;
+  if (handle === null) throw new Error('writing_diagnostics_editor_unavailable');
+  return handle;
+}
+
 function probeContainer(): HTMLElement {
   const harness = document.getElementById('harness');
   if (harness === null) throw new Error('browser_harness_missing');
@@ -228,20 +234,22 @@ window.runInkspanHostileDocumentProbe = (
 window.mountInkspanWritingDiagnosticsProbe = mountWritingDiagnosticsProbe;
 
 window.mutateInkspanWritingDiagnosticsProbe = (sourceHtml: string): void => {
-  diagnosticsEditorRef.current?.setValue(sourceHtml);
+  requireDiagnosticsHandle().setValue(sourceHtml);
 };
 
 window.applyInkspanWritingDiagnosticProbe = (
   diagnosticId: string,
 ): Promise<CwlWritingDiagnosticActionEvent | null> =>
-  diagnosticsEditorRef.current?.applyWritingDiagnostic(diagnosticId) ??
-  Promise.resolve(null);
+  requireDiagnosticsHandle().applyWritingDiagnostic(diagnosticId);
 
-window.undoInkspanWritingDiagnosticsProbe = (): boolean =>
-  diagnosticsEditorRef.current?.getEditor()?.commands.undo() ?? false;
+window.undoInkspanWritingDiagnosticsProbe = (): boolean => {
+  const editor = requireDiagnosticsHandle().getEditor();
+  if (editor === null) throw new Error('writing_diagnostics_editor_unavailable');
+  return editor.commands.undo();
+};
 
 window.getInkspanWritingDiagnosticsProbeState =
   (): BrowserWritingDiagnosticsProbeState =>
     Object.freeze({ actions: Object.freeze([...diagnosticsActions]) });
 
-export {};
\ No newline at end of file
+export {};

From b69ed821d6a43a7700a744e24875fa3b6bfba4bc Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 05:18:31 +0900
Subject: [PATCH 36/54] test(browser): key touch target checks to capability

---
 tests/browser/specs/writing-diagnostics.browser.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/browser/specs/writing-diagnostics.browser.spec.ts b/tests/browser/specs/writing-diagnostics.browser.spec.ts
index 5093935e..ed0dd0fe 100644
--- a/tests/browser/specs/writing-diagnostics.browser.spec.ts
+++ b/tests/browser/specs/writing-diagnostics.browser.spec.ts
@@ -49,7 +49,7 @@ test.describe('writing diagnostics browser assurance', () => {
     await expect(apply).toBeEnabled();
     const actionBox = await apply.boundingBox();
     expect(actionBox).not.toBeNull();
-    if (testInfo.project.name.includes('mobile')) {
+    if (testInfo.project.use.hasTouch === true) {
       expect(actionBox!.width).toBeGreaterThanOrEqual(44);
       expect(actionBox!.height).toBeGreaterThanOrEqual(44);
     }

From 00b6775b35e9edbe5f86ed1425098378fd4e9b25 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 08:08:32 +0900
Subject: [PATCH 37/54] test(ci): require Playwright browser cache contract

---
 src/workflowExactHead.test.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/workflowExactHead.test.ts b/src/workflowExactHead.test.ts
index 0585437e..f54033e8 100644
--- a/src/workflowExactHead.test.ts
+++ b/src/workflowExactHead.test.ts
@@ -10,11 +10,16 @@ function repositoryFile(path: string): string {
 
 const workflow = repositoryFile('.github/workflows/ci.yml');
 const releaseWorkflow = repositoryFile('.github/workflows/release.yml');
+const diagnosticsWorkflow = repositoryFile(
+  '.github/workflows/writing-diagnostics-assurance-tdd.yml',
+);
 
 const CHECKOUT_PIN =
   'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1';
 const SETUP_NODE_PIN =
   'actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0';
+const ACTIONS_CACHE_PIN =
+  'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0';
 const SAFE_PNPM_ACTION_PIN =
   'pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10';
 const VULNERABLE_PNPM_ACTION_PIN =
@@ -64,6 +69,19 @@ describe('exact-head CI workflow contract', () => {
     ).toHaveLength(2);
   });
 
+  it('caches exact Playwright revisions while retaining system dependency setup', () => {
+    expect(diagnosticsWorkflow).toContain(ACTIONS_CACHE_PIN);
+    expect(diagnosticsWorkflow).toContain(
+      'path: /tmp/inkspan-playwright-browsers',
+    );
+    expect(diagnosticsWorkflow).toContain(
+      `${'${{ runner.os }}'}-playwright-${'${{ runner.arch }}'}-${'${{ hashFiles(\'tests/browser/pnpm-lock.yaml\') }}'}`,
+    );
+    expect(diagnosticsWorkflow).toContain(
+      'playwright install --with-deps chromium firefox webkit',
+    );
+  });
+
   it('records the evidence boundary and unreleased hardening', () => {
     const doctoring = repositoryFile(
       'docs/doctoring/exact-head-ci-evidence.md',

From 6e74a9ba9381da48ddafdabcbe203343f6afa304 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 08:08:54 +0900
Subject: [PATCH 38/54] ci(diagnostics): cache exact Playwright browser
 revisions

---
 .github/workflows/writing-diagnostics-assurance-tdd.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
index 8ba39986..0d0628e9 100644
--- a/.github/workflows/writing-diagnostics-assurance-tdd.yml
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -70,6 +70,11 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm --dir tests/browser install --frozen-lockfile
+      - name: Restore exact Playwright browser revisions
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: /tmp/inkspan-playwright-browsers
+          key: ${{ runner.os }}-playwright-${{ runner.arch }}-${{ hashFiles('tests/browser/pnpm-lock.yaml') }}
       - name: Install Playwright revisions pinned by the browser-test lock
         run: pnpm --dir tests/browser exec playwright install --with-deps chromium firefox webkit
       - name: Run writing-diagnostic browser assurance on exact head

From bf3a065dc951dd8d874969c8faee176cf34329a8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 22:49:50 +0900
Subject: [PATCH 39/54] fix(diagnostics): preserve focus across selection and
 dismissal

---
 src/components/WritingDiagnosticsPanel.tsx | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/components/WritingDiagnosticsPanel.tsx b/src/components/WritingDiagnosticsPanel.tsx
index c7ad384d..7fdf01cc 100644
--- a/src/components/WritingDiagnosticsPanel.tsx
+++ b/src/components/WritingDiagnosticsPanel.tsx
@@ -40,6 +40,7 @@ export function WritingDiagnosticsPanel({
     null,
   );
   const [statusMessage, setStatusMessage] = useState('');
+  const regionRef = useRef<HTMLElement | null>(null);
   const itemRefs = useRef<Array<HTMLLIElement | null>>([]);
   const selectedIndex = diagnostics.findIndex(
     (candidate) =>
@@ -72,6 +73,24 @@ export function WritingDiagnosticsPanel({
       .run();
   };
 
+  const focusAfterDismissal = (dismissedIndex: number): void => {
+    if (diagnostics.length === 1) {
+      setActiveDiagnosticId(null);
+      regionRef.current?.focus();
+      return;
+    }
+
+    const targetIndex =
+      dismissedIndex < diagnostics.length - 1
+        ? dismissedIndex + 1
+        : dismissedIndex - 1;
+    const target = diagnostics[targetIndex]!;
+    const diagnosticId = target.diagnostic.diagnosticId;
+    setActiveDiagnosticId(diagnosticId);
+    controller.focusDiagnostic(diagnosticId);
+    itemRefs.current[targetIndex]?.focus();
+  };
+
   const navigate = (offset: number): void => {
     focusIndex(activeIndex + offset);
   };
@@ -101,7 +120,9 @@ export function WritingDiagnosticsPanel({
       aria-label={label}
       className="cwl-writing-diagnostics"
       data-print-enabled={printEnabled ? 'true' : undefined}
+      ref={regionRef}
       role="region"
+      tabIndex={-1}
     >
       <div className="cwl-writing-diagnostics__header">
         <p className="cwl-writing-diagnostics__summary">
@@ -203,6 +224,7 @@ export function WritingDiagnosticsPanel({
                         ) !== null
                       ) {
                         setStatusMessage(`Dismissed ${diagnostic.title}.`);
+                        focusAfterDismissal(index);
                       }
                     }}
                     type="button"

From ccad62d697315cbac90af83b360962a699cc8940 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 22:50:22 +0900
Subject: [PATCH 40/54] test(ci): preserve diagnostics workflow hardening
 across stack

---
 src/workflowExactHead.test.ts | 38 +++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/src/workflowExactHead.test.ts b/src/workflowExactHead.test.ts
index f54033e8..e5ad6cad 100644
--- a/src/workflowExactHead.test.ts
+++ b/src/workflowExactHead.test.ts
@@ -13,6 +13,12 @@ const releaseWorkflow = repositoryFile('.github/workflows/release.yml');
 const diagnosticsWorkflow = repositoryFile(
   '.github/workflows/writing-diagnostics-assurance-tdd.yml',
 );
+const editorActionsWorkflow = repositoryFile(
+  '.github/workflows/writing-diagnostics-editor-actions-tdd.yml',
+);
+const collaborationWorkflow = repositoryFile(
+  '.github/workflows/writing-diagnostics-collaboration-tdd.yml',
+);
 
 const CHECKOUT_PIN =
   'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1';
@@ -82,6 +88,38 @@ describe('exact-head CI workflow contract', () => {
     );
   });
 
+  it('makes editor-action assurance fail closed on React act warnings', () => {
+    expect(editorActionsWorkflow).toContain(SAFE_PNPM_ACTION_PIN);
+    expect(editorActionsWorkflow).not.toContain(VULNERABLE_PNPM_ACTION_PIN);
+    expect(editorActionsWorkflow.match(/not wrapped in act/g)).toHaveLength(2);
+    expect(
+      editorActionsWorkflow.match(/test_status=\$\{PIPESTATUS\[0\]\}/g),
+    ).toHaveLength(2);
+    expect(editorActionsWorkflow).toContain(
+      '::error::Focused editor actions emitted a React act warning.',
+    );
+    expect(editorActionsWorkflow).toContain(
+      '::error::Production coverage emitted a React act warning.',
+    );
+  });
+
+  it('makes collaboration assurance fail closed on React act warnings', () => {
+    expect(collaborationWorkflow).toContain(SAFE_PNPM_ACTION_PIN);
+    expect(collaborationWorkflow).not.toContain(VULNERABLE_PNPM_ACTION_PIN);
+    expect(
+      collaborationWorkflow.match(/not wrapped in act/g),
+    ).toHaveLength(2);
+    expect(
+      collaborationWorkflow.match(/test_status=\$\{PIPESTATUS\[0\]\}/g),
+    ).toHaveLength(2);
+    expect(collaborationWorkflow).toContain(
+      '::error::Focused collaborative diagnostics emitted a React act warning.',
+    );
+    expect(collaborationWorkflow).toContain(
+      '::error::Production coverage emitted a React act warning.',
+    );
+  });
+
   it('records the evidence boundary and unreleased hardening', () => {
     const doctoring = repositoryFile(
       'docs/doctoring/exact-head-ci-evidence.md',

From ccd3946d19a440ff8eece1ac3b66846ef4f2e729 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 22:50:59 +0900
Subject: [PATCH 41/54] chore(diagnostics): reconcile assurance with current
 stack

---
 .../writing-diagnostics-collaboration-tdd.yml |  43 +-
 ...writing-diagnostics-editor-actions-tdd.yml |  43 +-
 .../workflows/writing-diagnostics-ui-tdd.yml  | 120 ----
 ...0027-host-owned-llm-writing-diagnostics.md | 191 ++++---
 docs/adr/README.md                            |   1 +
 ...8-12-writing-diagnostics-implementation.md | 532 ++++--------------
 ...on-bound-llm-writing-diagnostics-design.md | 393 ++++++-------
 src/adrQualityContract.test.ts                |  21 +
 ...ditor.writingDiagnostics.boundary.test.tsx |  24 +-
 ...tingDiagnosticsPanel.dismissFocus.test.tsx | 174 ++++++
 .../editorFormSerialization.test.tsx          |  30 +-
 src/printStyles.test.ts                       |   6 +
 src/styles.css                                |   4 +-
 ...ngDiagnosticsDocumentationContract.test.ts | 105 ++++
 14 files changed, 820 insertions(+), 867 deletions(-)
 delete mode 100644 .github/workflows/writing-diagnostics-ui-tdd.yml
 create mode 100644 src/components/WritingDiagnosticsPanel.dismissFocus.test.tsx
 create mode 100644 src/writingDiagnosticsDocumentationContract.test.ts

diff --git a/.github/workflows/writing-diagnostics-collaboration-tdd.yml b/.github/workflows/writing-diagnostics-collaboration-tdd.yml
index 60c53506..9c028d95 100644
--- a/.github/workflows/writing-diagnostics-collaboration-tdd.yml
+++ b/.github/workflows/writing-diagnostics-collaboration-tdd.yml
@@ -25,27 +25,50 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run collaborative writing-diagnostic parity tests
-        run: >-
-          pnpm exec vitest run
-          src/collaboration/CollaborativeCwlEditor.writingDiagnostics.test.tsx
-          src/collaboration/CollaborativeCwlEditor.writingDiagnostics.race.test.tsx
-          src/collaboration/CollaborativeCwlEditor.writingDiagnostics.coverage.test.tsx
-          src/collaboration/CollaborativeCwlEditor.writingDiagnostics.boundary.test.tsx
-          --pool=forks
-          --maxWorkers=1
+        run: |
+          set -euo pipefail
+          output_file="$(mktemp)"
+          trap 'rm -f "$output_file"' EXIT
+          set +e
+          pnpm exec vitest run \
+            src/collaboration/CollaborativeCwlEditor.writingDiagnostics.test.tsx \
+            src/collaboration/CollaborativeCwlEditor.writingDiagnostics.race.test.tsx \
+            src/collaboration/CollaborativeCwlEditor.writingDiagnostics.coverage.test.tsx \
+            src/collaboration/CollaborativeCwlEditor.writingDiagnostics.boundary.test.tsx \
+            --pool=forks \
+            --maxWorkers=1 2>&1 | tee "$output_file"
+          test_status=${PIPESTATUS[0]}
+          set -e
+          if grep -Fq 'not wrapped in act' "$output_file"; then
+            echo "::error::Focused collaborative diagnostics emitted a React act warning."
+            exit 1
+          fi
+          exit "$test_status"
       - name: Typecheck collaborative writing-diagnostic contracts
         run: pnpm typecheck
       - name: Run complete production coverage gate
         env:
           NODE_OPTIONS: --max-old-space-size=6144
-        run: pnpm coverage
+        run: |
+          set -euo pipefail
+          output_file="$(mktemp)"
+          trap 'rm -f "$output_file"' EXIT
+          set +e
+          pnpm coverage 2>&1 | tee "$output_file"
+          test_status=${PIPESTATUS[0]}
+          set -e
+          if grep -Fq 'not wrapped in act' "$output_file"; then
+            echo "::error::Production coverage emitted a React act warning."
+            exit 1
+          fi
+          exit "$test_status"
       - name: Build all package entrypoints
         run: pnpm build
       - name: Verify isolated packed-package consumers
diff --git a/.github/workflows/writing-diagnostics-editor-actions-tdd.yml b/.github/workflows/writing-diagnostics-editor-actions-tdd.yml
index 0add9d3e..c2c994e5 100644
--- a/.github/workflows/writing-diagnostics-editor-actions-tdd.yml
+++ b/.github/workflows/writing-diagnostics-editor-actions-tdd.yml
@@ -25,27 +25,50 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run standalone writing-diagnostic integration tests
-        run: >-
-          pnpm exec vitest run
-          src/components/CwlEditor.writingDiagnostics.test.tsx
-          src/components/CwlEditor.writingDiagnosticApply.test.tsx
-          src/components/useWritingDiagnosticsController.apply.test.tsx
-          src/components/useEditorHandle.test.tsx
-          --pool=forks
-          --maxWorkers=1
+        run: |
+          set -euo pipefail
+          output_file="$(mktemp)"
+          trap 'rm -f "$output_file"' EXIT
+          set +e
+          pnpm exec vitest run \
+            src/components/CwlEditor.writingDiagnostics.test.tsx \
+            src/components/CwlEditor.writingDiagnosticApply.test.tsx \
+            src/components/useWritingDiagnosticsController.apply.test.tsx \
+            src/components/useEditorHandle.test.tsx \
+            --pool=forks \
+            --maxWorkers=1 2>&1 | tee "$output_file"
+          test_status=${PIPESTATUS[0]}
+          set -e
+          if grep -Fq 'not wrapped in act' "$output_file"; then
+            echo "::error::Focused editor actions emitted a React act warning."
+            exit 1
+          fi
+          exit "$test_status"
       - name: Typecheck standalone writing-diagnostic contracts
         run: pnpm typecheck
       - name: Run complete production coverage gate
         env:
           NODE_OPTIONS: --max-old-space-size=6144
-        run: pnpm coverage
+        run: |
+          set -euo pipefail
+          output_file="$(mktemp)"
+          trap 'rm -f "$output_file"' EXIT
+          set +e
+          pnpm coverage 2>&1 | tee "$output_file"
+          test_status=${PIPESTATUS[0]}
+          set -e
+          if grep -Fq 'not wrapped in act' "$output_file"; then
+            echo "::error::Production coverage emitted a React act warning."
+            exit 1
+          fi
+          exit "$test_status"
       - name: Build all package entrypoints
         run: pnpm build
       - name: Verify isolated packed-package consumers
diff --git a/.github/workflows/writing-diagnostics-ui-tdd.yml b/.github/workflows/writing-diagnostics-ui-tdd.yml
deleted file mode 100644
index 7f24ac4a..00000000
--- a/.github/workflows/writing-diagnostics-ui-tdd.yml
+++ /dev/null
@@ -1,120 +0,0 @@
-name: Writing Diagnostics UI TDD
-
-on:
-  push:
-    branches:
-      - feat/writing-diagnostics-ui
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: writing-diagnostics-ui-tdd-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  focused-ui:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Collect accessible writing-guidance coverage
-        id: focused_coverage
-        continue-on-error: true
-        run: >-
-          pnpm exec vitest run
-          src/components/WritingDiagnosticsPanel.test.tsx
-          src/components/WritingDiagnosticsPanel.keyboard.test.tsx
-          src/components/WritingDiagnosticsPanel.print.test.tsx
-          src/components/EditorFrame.test.tsx
-          src/printStyles.test.ts
-          --pool=forks
-          --maxWorkers=1
-          --coverage
-          --coverage.include=src/components/WritingDiagnosticsPanel.tsx
-          --coverage.reporter=text
-          --coverage.reporter=json
-      - name: Report and enforce exact UI coverage
-        run: |
-          node <<'NODE'
-          const { existsSync, readFileSync } = require('node:fs');
-          if (!existsSync('coverage/coverage-final.json')) {
-            console.error('::error file=coverage/coverage-final.json,line=1::Focused coverage report is missing.');
-            process.exit(1);
-          }
-          const coverage = JSON.parse(readFileSync('coverage/coverage-final.json', 'utf8'));
-          const suffix = '/src/components/WritingDiagnosticsPanel.tsx';
-          const displayPath = suffix.slice(1);
-          const entry = Object.entries(coverage).find(([path]) => path.endsWith(suffix));
-          let failed = process.env.FOCUSED_COVERAGE_OUTCOME !== 'success';
-          if (!entry) {
-            console.error(`::error file=${displayPath},line=1::Focused coverage record is missing.`);
-            process.exit(1);
-          }
-          const [, fileCoverage] = entry;
-          const missingStatementLines = [...new Set(
-            Object.entries(fileCoverage.s)
-              .filter(([, count]) => count === 0)
-              .map(([id]) => fileCoverage.statementMap[id].start.line),
-          )].sort((left, right) => left - right);
-          const missingFunctionLines = [...new Set(
-            Object.entries(fileCoverage.f)
-              .filter(([, count]) => count === 0)
-              .map(([id]) => fileCoverage.fnMap[id].decl.start.line),
-          )].sort((left, right) => left - right);
-          const missingBranches = [];
-          for (const [id, counts] of Object.entries(fileCoverage.b)) {
-            counts.forEach((count, index) => {
-              if (count !== 0) return;
-              const branch = fileCoverage.branchMap[id];
-              const location = branch.locations?.[index] ?? branch.loc;
-              missingBranches.push(`${location.start.line}:${index}`);
-            });
-          }
-          const statementTotal = Object.keys(fileCoverage.s).length;
-          const statementCovered = Object.values(fileCoverage.s).filter((count) => count > 0).length;
-          const functionTotal = Object.keys(fileCoverage.f).length;
-          const functionCovered = Object.values(fileCoverage.f).filter((count) => count > 0).length;
-          const branchCounts = Object.values(fileCoverage.b).flat();
-          const branchTotal = branchCounts.length;
-          const branchCovered = branchCounts.filter((count) => count > 0).length;
-          console.log(
-            `::notice file=${displayPath},line=1::Statements ${statementCovered}/${statementTotal}; ` +
-            `functions ${functionCovered}/${functionTotal}; branches ${branchCovered}/${branchTotal}.`,
-          );
-          if (missingStatementLines.length || missingFunctionLines.length || missingBranches.length) {
-            console.error(
-              `::error file=${displayPath},line=1::` +
-              `Missing statement lines: ${missingStatementLines.join(', ') || 'none'}; ` +
-              `missing function lines: ${missingFunctionLines.join(', ') || 'none'}; ` +
-              `missing branches line:index: ${missingBranches.join(', ') || 'none'}.`,
-            );
-            failed = true;
-          }
-          if (failed) process.exit(1);
-          NODE
-        env:
-          FOCUSED_COVERAGE_OUTCOME: ${{ steps.focused_coverage.outcome }}
-      - name: Typecheck writing-guidance contracts
-        run: pnpm typecheck
-      - name: Run complete production coverage gate
-        run: pnpm coverage
-      - name: Build every package entrypoint
-        run: pnpm build
-      - name: Verify packed-package consumers
-        run: pnpm verify:package
-      - name: Build the demonstration application
-        run: pnpm build:demo
diff --git a/docs/adr/0027-host-owned-llm-writing-diagnostics.md b/docs/adr/0027-host-owned-llm-writing-diagnostics.md
index 05d9e0f4..25e98da8 100644
--- a/docs/adr/0027-host-owned-llm-writing-diagnostics.md
+++ b/docs/adr/0027-host-owned-llm-writing-diagnostics.md
@@ -1,152 +1,165 @@
-# ADR 0027: Host-owned, revision-bound LLM writing diagnostics
+# ADR 0027: Host-owned, revision-bound writing diagnostics
 
 Status: Proposed
 
 ## Context
 
-Inkspan already provides deterministic authoring, revision evidence, revision-scoped W3C `TextPositionSelector` evidence, guarded restore, and a host-owned model-assistance boundary. Host applications now need a Grammarly-like writing-guidance surface that can underline a passage, explain a problem, propose a replacement, let the author apply or ignore it, and keep every suggestion bound to the exact document revision from which it was produced.
+Inkspan already provides deterministic authoring, revision evidence, revision-scoped W3C `TextPositionSelector` evidence, guarded restore, and a host-owned model-assistance boundary. Host applications need a Grammarly-like writing-guidance surface that can mark a passage, explain a concern, propose a replacement, let the author act explicitly, and keep every proposal bound to the exact document revision reviewed by the host.
 
-The requested quality judgments include spelling, grammar, clarity, concision, discourse structure, workplace pragmatics, audience appropriateness, technical precision, actionability, and preservation of the author's intended request. These are contextual language judgments. Fixed keyword lists, regular-expression phrase detectors, domain-suffix lists, hand-written “aggressive phrase” tables, and positional repair rules cannot establish those meanings and create brittle false positives and false negatives across paraphrases, quotations, languages, and recipient contexts.
+Spelling, grammar, clarity, concision, discourse structure, workplace pragmatics, audience appropriateness, technical precision, actionability, and preservation of author intent are contextual language judgments. Fixed keyword lists, regular-expression phrase detectors, domain-suffix lists, hand-written phrase tables, opaque category names, and positional repair rules cannot establish those meanings across paraphrases, quotations, languages, and recipient contexts.
 
-Inkspan must remain a modular editor. It must not gain email semantics, tenant policy, model credentials, network transport, an LLM provider dependency, or authority to decide whether a sentence is appropriate. At the same time, hosts should not have to scrape ProseMirror DOM nodes or maintain a private editor fork to display revision-safe diagnostics.
+Inkspan must remain a modular editor. It must not gain email semantics, tenant policy, model credentials, network transport, an LLM provider dependency, persistence authority, or authority to decide whether prose is appropriate. Hosts likewise should not have to scrape ProseMirror DOM nodes or maintain private editor forks to display revision-safe guidance.
 
 ## Alternatives considered
 
-- **Host-specific DOM overlays over Inkspan.** Rejected because DOM offsets are not a supported document contract, become stale after ProseMirror transactions, fragment keyboard and screen-reader behavior, and force every host to rebuild decorations, navigation, application, conflict handling, and undo semantics.
-- **A deterministic keyword or regex checker inside Inkspan.** Rejected because lexical triggers are not evidence of grammar, intent, tone, pragmatics, or technical correctness. Deterministic code may validate data shape and document coordinates, but it may not manufacture semantic judgments.
-- **Inkspan invokes an LLM directly.** Rejected because the editor would acquire provider, credential, network, privacy, retention, availability, model-routing, and tenant-policy responsibilities that belong to the host.
-- **The host sends whole-document rewrites and calls `setValue`.** Rejected because whole-document replacement obscures individual reasons, weakens author control, destroys revision-local review evidence, and makes accidental intent changes harder to detect.
-- **Host-owned LLM judgments rendered through a generic Inkspan diagnostic contract.** Selected because it preserves Inkspan's provider-neutral deterministic core while giving every host one revision-safe, accessible writing-assistance surface.
+- **Host-specific DOM overlays.** Rejected because DOM offsets are not a supported document contract, become stale after transactions, fragment keyboard/screen-reader behavior, and force each host to rebuild navigation, application, conflict handling, and undo semantics.
+- **A deterministic keyword or regex checker inside Inkspan.** Rejected because lexical triggers are not evidence of grammar, intent, tone, pragmatics, or technical correctness. Deterministic code may validate shape and coordinates but may not manufacture semantic judgments.
+- **Inkspan invokes an LLM directly.** Rejected because the editor would acquire provider, credential, network, privacy, retention, availability, routing, and tenant-policy responsibilities that belong to the host.
+- **The host sends whole-document rewrites.** Rejected because replacement obscures individual reasons, weakens author control, destroys revision-local evidence, and makes unintended meaning changes harder to detect.
+- **Preserve diagnostics by mapping ranges across edits.** Rejected for v1 because structural position continuity does not prove that a host semantic judgment remains current after content changes.
+- **Host-owned judgments through a generic Inkspan diagnostic contract.** Selected because it preserves Inkspan's provider-neutral deterministic core while giving every host one revision-safe, accessible presentation and action surface.
 
 ## Decision
 
-Inkspan will expose a generic, additive writing-diagnostic presentation and application contract. The host supplies already-produced diagnostic proposals. Inkspan validates, anchors, renders, navigates, applies, ignores, and reports actions on those proposals, but does not decide whether the prose is correct or appropriate.
+Inkspan will expose an additive writing-diagnostic contract. The host supplies already-produced proposals. Inkspan validates, revision-binds, resolves, renders, navigates, applies one selected replacement, ignores, dismisses, requests an explanation, and reports privacy-minimized action evidence. Inkspan does not decide whether prose is correct or appropriate.
 
-A diagnostic must include, at minimum:
+A v1 diagnostic includes:
 
-- a bounded opaque `diagnostic_id`;
-- the exact Inkspan strong document revision used by the host's review operation;
-- the declared text-projection identity and version;
-- a revision-scoped W3C `TextPositionSelector` with inclusive `start` and exclusive `end` Unicode-code-point offsets;
-- a bounded host-defined `category_code` and display-safe title;
-- an explanation;
-- an optional proposed replacement;
-- an optional bounded confidence value;
-- provider/workflow provenance identifiers that contain no source text or credential;
-- a host policy or judge-policy version identifying how the proposal was admitted.
+- a bounded opaque `diagnosticId`;
+- an exact `CwlEditorDocumentRevision` for the reviewed immutable snapshot;
+- an exact `CwlEditorTextProjectionIdentity`;
+- a W3C `TextPositionSelector` using inclusive `start` and exclusive `end` Unicode-code-point offsets;
+- an opaque bounded `categoryCode`;
+- one of `advisory`, `important`, or `critical` presentation priority;
+- a plain-text title and explanation;
+- an optional plain-text replacement;
+- optional finite confidence in `[0, 1]`; and
+- privacy-minimized workflow/judge-policy provenance identifiers with no source text, credential, or raw model output.
 
-Inkspan may perform only deterministic validation and document operations:
+Selector values are non-negative safe integers with `start <= end`. Collapsed selectors are valid evidence and remain navigable, but create no inline range decoration.
 
-- schema, type, enum, length, count, duplicate-id, and resource-bound validation;
-- projection-version and strong-revision equality checks;
+Inkspan performs only deterministic validation and editor operations:
+
+- exact schema/type/enum/length/count/duplicate/resource validation;
+- rejection of accessors, prototypes, symbols, extra fields, sparse arrays, and hostile reflection;
+- projection-version and strong-revision checks;
 - Unicode-code-point and grapheme-boundary checks;
-- selector range checks against the exact projected text;
-- safe text/markup handling under the existing editor security policy;
-- decoration mapping through local ProseMirror transactions when that mapping remains valid;
-- stale-result invalidation when the declared revision or projection no longer matches;
-- overlap/conflict detection between proposed replacements;
-- one-action-at-a-time replacement, ordinary editor undo, and action callbacks.
+- exact selector resolution against one immutable projected snapshot;
+- safe plain-text rendering and replacement handling;
+- stale-generation rejection;
+- one-action-at-a-time replacement, ordinary undo, and privacy-minimized action callbacks.
+
+Every local or collaborative transaction with docChanged === true invalidates the complete active diagnostic generation.
 
-Inkspan must not infer a diagnostic from keywords, regexes, phrase lists, sender domains, recipient counts, language names, or word position. Such mechanisms may validate identifiers or transport contracts, but they may not be used as a semantic fallback. If the host's model path is unavailable or returns no admitted diagnostics, Inkspan displays no fabricated judgment.
+No diagnostic is preserved, mapped, remapped, repaired, or re-admitted through ProseMirror mapping, Yjs relative positions, nearest-text search, quote search, keyword search, or semantic guessing. A host that wants current guidance after an edit supplies a new set bound to a newly derived exact revision.
 
-Applying a diagnostic is an explicit author action. A replacement is applied only if the current document still matches the diagnostic's expected revision or if Inkspan can prove a valid transaction-local mapping under the published lifecycle contract. A stale or ambiguous diagnostic never mutates the document. It returns a typed conflict or invalidation result so the host can request a fresh review.
+Version 1 applies exactly one explicitly selected diagnostic at a time. Immediately before mutation, Inkspan derives and compares the exact current revision again. A stale, missing, invalid, or ambiguous proposal never mutates the document. Successful application uses one ordinary ProseMirror transaction, normal undo history, a resulting revision derived from the post-transaction document, and complete invalidation of the remaining generation.
 
-Diagnostics are advisory. Inkspan does not block form submission, email sending, persistence, or export merely because diagnostics remain. A host may implement a separate product policy, but that policy is outside the editor package and cannot be inferred from Inkspan diagnostic priority or confidence.
+Inkspan does not derive aria-invalid or any other semantic accessibility state from opaque host strings. Inline decorations contain static Inkspan classes, priority styling, and an opaque identifier only. Category, priority, title, explanation, and actions are available as text and native controls in the named diagnostics panel.
+
+Diagnostics are advisory. Inkspan does not block form submission, sending, persistence, export, or collaboration merely because diagnostics remain. A host may implement separate product policy outside the editor package.
 
 ## Ownership boundary
 
 Inkspan owns:
 
-- document state and serialization;
-- revision and selector evidence;
-- diagnostic schema validation;
-- decorations and accessible suggestion navigation;
-- explicit apply/ignore/dismiss actions;
-- stale-result and overlap conflict handling;
-- ordinary document undo and focus restoration;
-- privacy-minimized action callbacks.
+- deterministic document state and serialization;
+- revision/projection/selector validation;
+- strict diagnostic schema and resource validation;
+- semantic-neutral decorations and accessible diagnostic navigation;
+- explicit Focus, Apply, Ignore, Dismiss, and Explain actions;
+- strict stale-generation invalidation;
+- ordinary document transactions, undo, and predictable focus behavior;
+- privacy-minimized action events and redacted errors.
 
 The host owns:
 
-- model selection and orchestration;
-- prompts, rubrics, examples, and language policy;
-- source email, thread, recipient, role, and organization context;
+- model selection, orchestration, prompts, rubrics, examples, and language policy;
+- source email/thread/recipient/role/organization context;
 - semantic categories, confidence calibration, acceptance policy, and abstention;
 - provider credentials and data-processing approval;
-- diagnostic persistence and retention;
-- feedback collection, evaluation, monitoring, and human escalation;
-- any send, save, or compliance gate.
+- diagnostic persistence, retention, evaluation, monitoring, and escalation;
+- any send, save, compliance, or submission gate.
 
 ## Consequences
 
-A host can provide inline writing guidance without forking the editor. Inkspan remains usable offline and when every model provider is unavailable. The public contract becomes broader and therefore requires packed-package, standalone, collaborative, SSR, accessibility, and cross-engine evidence. Hosts must operate a real review service and cannot treat the editor as an evaluator.
+A host can provide inline writing guidance without forking the editor. Inkspan remains usable offline and when every model provider is unavailable. The public contract becomes broader and requires packed-package, standalone, collaborative, SSR, accessibility, concurrency, hostile-input, and cross-engine evidence.
+
+The design separates semantic authority from deterministic integrity. A host model may be wrong about prose; Inkspan can still prove that the proposal was admitted for one exact snapshot, was not moved onto changed content, and was not applied after the document changed.
 
-The decision intentionally separates semantic authority from deterministic integrity. A model or calibrated judge may be wrong about the prose; Inkspan can still guarantee that the proposal was not silently moved to an unrelated span or applied to a different revision.
+Strict invalidation may require more host refreshes, including after unrelated edits. This cost is accepted because v1 cannot prove semantic continuity through structural mapping.
 
 ## Failure and recovery
 
-- Missing, malformed, oversized, duplicate, unsupported-projection, or out-of-range diagnostics are rejected without document mutation.
-- A provider timeout, quota error, malformed model result, or host policy abstention is represented by absence or a host-owned status outside the diagnostic list. Inkspan authoring remains available.
-- A changed document invalidates stale diagnostics. Inkspan never “repairs” them by searching for keywords or selecting the nearest matching sentence.
-- A safely mapped local transaction may preserve a diagnostic only when the mapping contract proves the selected range still denotes the intended content. Ambiguity invalidates it.
-- Overlapping replacements are applied separately and revalidated after every mutation. “Apply all” is permitted only for an explicitly validated non-overlapping batch under one current revision.
-- A collaborative remote edit follows the same invalidation rule; raw local positions are not durable Yjs anchors.
+- Missing, malformed, oversized, duplicate, unsupported-projection, or invalid-selector input is rejected without document mutation.
+- Provider timeout, quota failure, malformed model result, or policy abstention remains host-owned absence/status; Inkspan authoring stays available.
+- Any local or remote document change invalidates the complete generation before further action authority exists.
+- Async digest/selector work from an invalidated generation is discarded.
+- Apply/Ignore/Dismiss/Explain against a missing or stale generation returns typed non-mutating evidence.
+- Host callback exceptions are contained and cannot corrupt editor state.
+- Recovery is a newly supplied diagnostic set for the current exact revision. Inkspan never fabricates a fallback judgment.
 
 ## Security and privacy impact
 
-Diagnostics and replacements are untrusted host-controlled input. They pass through the same safe-link, inline-image, clipboard, schema, and transaction boundaries as other editor input. A diagnostic must not contain model credentials, raw provider request/response bodies, tenant identifiers not needed by the component, or hidden executable markup.
+Diagnostics and replacements are untrusted host-controlled input. The exact data-property boundary rejects executable or ambiguous object shapes. Host strings render as text; v1 accepts no HTML, JavaScript, command, arbitrary TipTap JSON, arbitrary transaction, or embedded host callback.
 
-The public diagnostic contract does not require copying the selected source text. Position selectors remain revision-scoped and privacy-minimized. Hosts that add quote selectors, store explanations, or transmit the document to a model own authorization, encryption, provider data-use terms, retention, audit, and regional-processing controls.
+The contract does not require copying selected source text. Revision and selector evidence is privacy-minimized. Hosts transmitting documents to a model own authorization, encryption, provider data-use terms, retention, audit, regional processing, and consent.
 
-Generic telemetry may record bounded category, action, conflict reason, latency bucket, and policy version. It must not record authored source text, suggested replacement text, full explanations, prompts, raw model output, or document envelopes by default.
+Default action events may contain only opaque identifier, exact revision evidence, opaque category, generation, action, and bounded reason code. They do not contain authored source text, replacement text, explanation, prompt, raw model output, document envelope, credential, email recipient, or tenant identifier.
+
+Opaque values that happen to contain words such as `spelling`, `grammar`, `mechanics`, `rude`, `incorrect`, or multilingual equivalents gain no semantic behavior or ARIA authority.
 
 ## Accessibility
 
-Diagnostics must be available without relying on color or hover. The eventual implementation must provide:
+Diagnostics are available without relying on color, hover, pointer input, animation, or generated CSS content. The built-in panel provides:
 
-- a keyboard-reachable diagnostics summary;
-- previous/next diagnostic navigation;
-- an accessible name for category and affected passage;
-- predictable focus movement between editor range and suggestion card;
-- explicit Apply, Ignore, Dismiss, and Explain actions;
-- polite status announcements after application or invalidation;
-- no focus theft while new asynchronous diagnostics arrive;
-- equivalent behavior in standalone and collaborative editors.
+- a named region, count, and ordered list;
+- category, priority, title, and explanation as text;
+- previous/next navigation and explicit affected-range focus;
+- native Apply, Ignore, Dismiss, and Explain actions;
+- disabled Apply when no replacement exists;
+- polite status after ordinary actions;
+- an assertive alert only for an actual application conflict;
+- stable focus when async diagnostics arrive; and
+- standalone/collaborative parity.
 
-Underlines are a visual supplement, not the sole information channel.
+Underlines are a visual supplement, not the semantic accessibility surface.
 
 ## Compatibility and migration
 
-The feature is additive. Existing hosts that do not pass diagnostics retain identical editor, serialization, form, persistence, and collaboration behavior. The diagnostic contract must remain optional and provider-neutral. It may be released only in a version whose package declarations, ESM/CJS outputs, React peer ranges, styles, and consumer verification expose the same contract.
+The feature is additive. Hosts that omit diagnostics retain identical editor, serialization, form, persistence, export, and collaboration behavior. The diagnostic contract remains optional and provider-neutral.
+
+No canonical document-envelope or database migration is required because diagnostics are noncanonical review state. A future explicit semantic accessibility field or cross-edit continuity model requires a new versioned type, compatibility plan, and ADR; v1 opaque fields gain no retrospective meaning.
 
-No canonical document-envelope schema change is required. Diagnostics are review state, not canonical document content. Rollback removes the diagnostic props, decorations, and action surface without document migration.
+The feature may be released only when root and framework-neutral subpaths, ESM/CommonJS/types/CSS, React peer compatibility, package consumers, SSR, browser evidence, and rollback contracts agree.
 
 ## Verification
 
 Acceptance requires tests proving:
 
-- strict resource-bounded schema validation and duplicate rejection;
-- Unicode astral characters, Korean/CJK text, combining marks, emoji, bidirectional text, and grapheme-boundary behavior;
-- exact revision/projection binding;
-- stale-result rejection without mutation;
-- transaction mapping only when meaning-preserving range identity is provable;
-- overlapping replacement conflict behavior;
-- single and bounded batch application plus undo;
-- safe rendering of hostile titles, explanations, and replacements;
-- keyboard, focus, live-region, and screen-reader semantics;
-- standalone/collaborative parity and remote-edit invalidation;
-- SSR-safe initial shell and hydration;
-- packed ESM/CommonJS/types/CSS consumer compatibility;
-- no model SDK, credential, environment, database, or network dependency in the Inkspan package;
-- no source text or replacement text in default telemetry;
-- exact 100% production statement, branch, function, and line coverage and complete public API documentation.
-
-Contract tests must also prohibit semantic keyword fallback: adversarial fixtures with identical keywords but different meanings, and paraphrases with different words but the same issue, must prove that Inkspan itself produces no judgment. It renders only host-supplied diagnostics.
+- strict exact-field/resource validation, duplicate rejection, and hostile-reflection containment;
+- Unicode astral, Korean/CJK, combining, emoji, bidirectional, grapheme, empty, and collapsed selector behavior;
+- exact revision/projection binding and one-snapshot selector resolution;
+- local and Yjs remote `docChanged` invalidation;
+- no transaction mapping, nearest-text, quote, keyword, or semantic repair;
+- no semantic ARIA derivation from opaque host fields;
+- one selected replacement only, exact pre-mutation recheck, ordinary undo, and resulting revision;
+- safe text rendering of hostile titles, explanations, categories, identifiers, and replacements;
+- keyboard/focus/status/alert/non-color accessibility;
+- standalone/collaborative parity and no awareness publication;
+- SSR/hydration and packed ESM/CommonJS/types/CSS compatibility;
+- no model SDK, credential, environment, database, filesystem, or network dependency in the package;
+- no authored/model text in default action evidence or telemetry;
+- exact 100% owned production statement, branch, function, and line coverage plus complete public documentation.
+
+Contrast fixtures with identical keywords but different meanings, and paraphrases with different words but the same issue, must prove that Inkspan produces zero diagnostics unless the host supplies them.
 
 ## Research and standards traceability
 
-This decision uses the W3C Web Annotation Data Model's Unicode-code-point `TextPositionSelector` semantics together with Inkspan's stronger revision binding. It treats LLM judgments as fallible measurement outputs rather than deterministic truth, consistent with published findings on position, verbosity, self-preference, artifact, multilingual, and consistency biases in LLM evaluators. The accompanying design and doctoring records contain APA 7th citations and the host-side calibration implications.
+The decision uses W3C Web Annotation Data Model Unicode-code-point `TextPositionSelector` semantics together with stronger exact revision binding. It uses ProseMirror/TipTap immutable state and transaction contracts, RFC 9110 strong entity-tag semantics, and the existing Inkspan deterministic-versus-model-assisted authoring boundary. LLM judgments remain fallible host evidence rather than editor truth; the companion doctoring record contains APA 7 references and calibration implications.
 
 ## Rollback or supersession
 
-Rollback removes the optional diagnostic surface while preserving canonical documents, revision evidence, selection evidence, and deterministic authoring. Supersession requires a new ADR if Inkspan is ever proposed to own model invocation, semantic classification, persistence authority, or submission policy. Such a change must provide explicit provider neutrality, privacy, offline/degraded operation, accessibility, compatibility, migration, and rollback evidence.
\ No newline at end of file
+Rollback removes optional diagnostic props, controller state, decorations, panel, styles, and action APIs while preserving canonical documents, revisions, persistence, and collaboration data.
+
+Supersession requires a new ADR if Inkspan is proposed to own model invocation, semantic classification, persistence authority, submission policy, semantic ARIA inference, cross-edit diagnostic continuity, or batch application. Such a change must provide provider neutrality, privacy, offline/degraded operation, accessibility, compatibility, migration, recovery, and rollback evidence.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 3b73b384..8c314016 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -33,6 +33,7 @@ This index records durable architectural decisions. An ADR on a branch or protec
 | [0025](0025-bounded-docx-heading-alignment.md) | Accepted | Bounded heading alignment in deterministic DOCX output |
 | [0026](0026-bounded-docx-external-hyperlinks.md) | Accepted | Bounded external hyperlinks in deterministic DOCX rich text |
 | [0027](0027-host-owned-llm-writing-diagnostics.md) | Proposed | Host-owned, revision-bound LLM writing diagnostics |
+| [0028](0028-writing-diagnostics-v1-strict-invalidation.md) | Proposed | Strict writing-diagnostic invalidation and semantic-neutral accessibility |
 
 ## Decision discipline
 
diff --git a/docs/superpowers/plans/2026-08-12-writing-diagnostics-implementation.md b/docs/superpowers/plans/2026-08-12-writing-diagnostics-implementation.md
index 27517d31..15b686e8 100644
--- a/docs/superpowers/plans/2026-08-12-writing-diagnostics-implementation.md
+++ b/docs/superpowers/plans/2026-08-12-writing-diagnostics-implementation.md
@@ -1,458 +1,162 @@
 # Revision-Bound Writing Diagnostics Implementation Plan
 
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Add a generic, provider-neutral Inkspan surface that validates, displays, navigates, applies, ignores, dismisses, and invalidates host-supplied writing diagnostics without making any semantic judgment itself.
-
-**Architecture:** A React-free `writing-diagnostics` contract validates bounded host input and resolves revision-scoped W3C text selectors against Inkspan's canonical text projection. A ProseMirror extension renders verified ranges and clears them on every document-changing transaction. A shared React controller binds asynchronous revision verification to one editor generation, while a built-in accessible panel exposes explicit actions. Standalone and collaborative editors reuse the same contract, controller, extension, and action result types. Version 1 accepts plain-text replacements only and never searches for similar text after a revision mismatch.
-
-**Tech Stack:** TypeScript, React 18/19, TipTap/ProseMirror, Yjs collaboration, Web Crypto revision evidence, W3C `TextPositionSelector`, Vitest with jsdom, Playwright across Chromium/Firefox/WebKit, Vite package subpath builds, pnpm, and the existing exact-head coverage/package/release gates.
-
-## Global Constraints
-
-- Inkspan does not call an LLM, provider, network service, database, storage service, or host API.
-- Inkspan never infers grammar, spelling, tone, clarity, pragmatics, technical quality, or actionability from text.
-- Keywords, regular expressions, phrase dictionaries, sender domains, language names, recipient counts, nearest-text search, and word positions are prohibited as semantic fallback or stale-selector repair.
-- Version 1 replacements are plain text. HTML, commands, editor JSON, JavaScript, and arbitrary ProseMirror transactions are not accepted from a diagnostic.
-- The canonical selector projection remains `inkspan-prosemirror-text` version `1`; a new projection requires a separate ADR and compatibility plan.
-- Any document-changing local or collaborative transaction invalidates every active diagnostic before it can be applied. Version 1 does not retain or remap a diagnostic across a changed document.
-- A diagnostic is actionable only after its declared strong revision, projection identity, selector, and grapheme boundaries have been verified against one exact editor snapshot.
-- Asynchronous revision checks use generation tokens and never publish results for a replaced editor, destroyed editor, newer diagnostic set, or changed document.
-- Default hard limits:
-  - 256 diagnostics per editor snapshot;
-  - 256 characters per `diagnosticId`;
-  - 128 characters per `categoryCode` and provenance identifier;
-  - 256 characters per title;
-  - 4,000 characters per explanation;
-  - 20,000 characters per replacement;
-  - confidence in the closed interval `[0, 1]`.
-- Action callbacks and default telemetry-safe result objects contain opaque identifiers, revisions, category, action, bounded reason codes, and timing state only. They do not contain selected source text, replacement text, explanation, prompt, model output, document envelope, credential, or tenant identifier.
-- Diagnostics remain advisory. Inkspan does not block form submission, persistence, export, or sending.
-- Existing editor behavior is byte-for-byte and interaction-compatible when `writingDiagnostics` is absent.
-- Production statement, branch, function, and line coverage remains exactly 100%.
-- Public APIs and every shipped module/class/function receive beginner-readable documentation.
-- Feature work remains under `Unreleased`; a separate exact-head release-only PR publishes the next compatible minor version after all acceptance gates pass.
-
----
-
-## Task 1: Define the React-Free Diagnostic Contract
-
-**Files:**
-- Create: `src/writingDiagnostics.ts`
-- Create: `src/writingDiagnostics.test.ts`
-- Create: `src/writing-diagnostics/index.ts`
-- Modify: `src/index.ts`
-
-- [ ] Write failing tests for valid diagnostics, empty arrays, duplicate IDs, unexpected fields, inherited fields, accessors, symbols, proxy exceptions, oversized arrays/strings, invalid confidence, unsupported priority, malformed revision, unsupported projection, invalid selector order, and non-string replacement values.
-- [ ] Define the public v1 types:
-
-```ts
-export type CwlWritingDiagnosticPriority =
-  | 'advisory'
-  | 'important'
-  | 'critical';
-
-export interface CwlWritingDiagnostic {
-  readonly diagnosticId: string;
-  readonly documentRevision: CwlEditorDocumentRevision;
-  readonly textProjection: CwlEditorTextProjectionIdentity;
-  readonly selector: CwlEditorTextPositionSelector;
-  readonly categoryCode: string;
-  readonly priority: CwlWritingDiagnosticPriority;
-  readonly title: string;
-  readonly explanation: string;
-  readonly suggestedReplacement?: string;
-  readonly confidence?: number;
-  readonly provenance: Readonly<{
-    workflowId: string;
-    workflowVersion: string;
-    judgePolicyVersion: string;
-    orchestrationMode?: string;
-  }>;
-}
-```
+> **For agentic workers:** Use the repository's test-driven, exact-head, single-writer workflow. Every task begins with a realistic failing regression, implements the smallest bounded production change, removes temporary branch-only workflows before integration, and regenerates all current-head evidence after ancestry changes.
 
-- [ ] Define stable, redacted error codes and `WritingDiagnosticError` for contract, limit, revision, projection, selector, conflict, and lifecycle failures.
-- [ ] Define frozen default limits and a strict `validateWritingDiagnostics(input, limits?)` function that returns a deeply detached, deeply frozen tuple.
-- [ ] Validate only own data properties. Catch hostile object/proxy behavior and return a stable error without reflecting source values.
-- [ ] Reject duplicate diagnostic IDs and reject any object whose exact field set differs from the v1 schema.
-- [ ] Preserve diagnostic order from the host; do not sort by confidence, category, wording, or source position inside the validator.
-- [ ] Export only the React-free contract, validator, constants, limits, and error types from `src/writing-diagnostics/index.ts`.
-- [ ] Re-export the same contract from the root package for interactive consumers.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/writingDiagnostics.test.ts
-pnpm typecheck
-```
+**Goal:** Add a generic, provider-neutral Inkspan surface that validates, displays, navigates, applies, ignores, dismisses, explains, and invalidates host-supplied writing diagnostics without making semantic judgments itself.
 
-- [ ] Commit:
+**Architecture:** A React-free contract validates bounded hostile input. A deterministic inverse text-projection resolver maps revision-scoped W3C selectors to one immutable ProseMirror snapshot. A semantic-neutral extension renders verified ranges. One shared React controller fences async verification by generation and invalidates the complete set after every document change. A built-in accessible panel exposes explicit actions. Standalone and collaborative editors reuse the same types and lifecycle. Version 1 accepts plain-text replacements, applies one explicitly selected diagnostic at a time, and never repairs stale selectors.
 
-```bash
-git add src/writingDiagnostics.ts src/writingDiagnostics.test.ts src/writing-diagnostics/index.ts src/index.ts
-git commit -m "feat(diagnostics): add strict writing diagnostic contract"
-```
+**Technology:** TypeScript, React 18/19, TipTap/ProseMirror, Yjs, Web Crypto revision evidence, W3C `TextPositionSelector`, Vitest/jsdom, Playwright Chromium/Firefox/WebKit, Vite package subpaths, pnpm, and existing exact-head coverage/security/package/release gates.
 
-## Task 2: Add an Inverse Canonical Text-Projection Resolver
-
-**Files:**
-- Create: `src/writingDiagnosticProjection.ts`
-- Create: `src/writingDiagnosticProjection.test.ts`
-- Modify: `src/textPositionSelectorEvidence.ts`
-- Modify: `src/text-position-selector/index.ts`
-
-- [ ] Write failing tests that resolve selectors over paragraphs, headings, lists, tables, hard breaks, inline text, non-text leaf nodes, astral characters, Korean/CJK text, combining marks, emoji sequences, bidirectional text, empty blocks, and document boundaries.
-- [ ] Add negative tests for unsupported projection versions, negative/non-integral offsets, reversed ranges, out-of-range offsets, grapheme-splitting boundaries, ambiguous projection boundaries, and runtimes without `Intl.Segmenter`.
-- [ ] Implement a single-pass `buildTextProjectionMap(documentNode)` that emits the exact same text as `documentNode.textBetween(0, documentNode.content.size, '\n', '\uFFFC')` plus a boundary map between Unicode-code-point offsets and ProseMirror positions.
-- [ ] Assert in tests that the independently built projection is exactly equal to the existing canonical projection for every fixture and generated document.
-- [ ] Add:
-
-```ts
-export function resolveTextPositionSelector(
-  documentNode: ProseMirrorNode,
-  selector: CwlEditorTextPositionSelector,
-  textProjection: CwlEditorTextProjectionIdentity,
-): Readonly<{ from: number; to: number }>;
-```
+## Global constraints
 
-- [ ] Fail closed when a code-point boundary cannot map to one unambiguous ProseMirror position; never pick the nearest sentence, matching word, or repeated substring.
-- [ ] Reuse one shared grapheme-boundary implementation for selector creation and resolution so forward and inverse paths cannot diverge.
-- [ ] Add property tests that create a valid structural selection, convert it with `createTextPositionSelector()`, resolve it back, and recover the exact original range.
-- [ ] Run:
+- Inkspan calls no model, provider, network service, database, storage service, credential broker, or host API.
+- Inkspan never infers spelling, grammar, tone, clarity, pragmatics, technical quality, or actionability from text or opaque host fields.
+- Keywords, regexes, phrase dictionaries, language names, domains, recipient counts, nearest-text search, quote search, and word positions are prohibited as semantic fallback or stale-selector repair.
+- Host strings are untrusted plain text. Version 1 accepts no diagnostic HTML, command, JavaScript, arbitrary TipTap JSON, arbitrary transaction, or callback.
+- `inkspan-prosemirror-text` version 1 is the sole v1 selector projection.
+- Selector offsets are non-negative safe integers with `start <= end`; collapsed selectors remain navigable but create no inline range decoration.
+- Every local or collaborative `docChanged` transaction invalidates the complete active generation. Version 1 never maps or preserves a diagnostic across changed content.
+- One immutable editor snapshot supplies the current revision and every selector resolution for one generation.
+- Generation, mounted-state, and editor-identity guards prevent stale promises from installing decorations, emitting actions, or moving focus.
+- Diagnostics remain advisory and never block form submission, sending, persistence, export, or collaboration.
+- Existing behavior remains compatible when diagnostics are absent.
+- Owned production statement, branch, function, and line coverage remains exactly 100%, with beginner-readable public documentation.
+- The feature stays under `Unreleased`; publication uses a separate release-only PR.
 
-```bash
-pnpm exec vitest run src/textPositionSelectorEvidence.test.ts src/writingDiagnosticProjection.test.ts
-pnpm typecheck
-```
+## Task 1: React-free diagnostic contract
 
-- [ ] Commit:
+**Files:** `src/writingDiagnostics.ts`, `src/writingDiagnostics.test.ts`, `src/writing-diagnostics/index.ts`, `src/index.ts`.
 
-```bash
-git add src/textPositionSelectorEvidence.ts src/text-position-selector/index.ts src/writingDiagnosticProjection.ts src/writingDiagnosticProjection.test.ts
-git commit -m "feat(diagnostics): resolve revision-scoped text selectors"
-```
+- [ ] Add RED tests for valid/empty sets, exact fields, duplicate IDs, hostile arrays/objects/proxies/accessors/prototypes/symbols, resource ceilings, priorities, confidence, revision, projection, selectors, provenance, and replacement types.
+- [ ] Define `advisory | important | critical`, structured `CwlEditorDocumentRevision`, structured projection identity, selector, opaque category, bounded host prose, optional plain-text replacement/confidence, and privacy-minimized provenance.
+- [ ] Define stable redacted error codes for contract, limit, revision, projection, selector, conflict, and lifecycle failures.
+- [ ] Validate exact own enumerable data properties and return deeply detached frozen values.
+- [ ] Preserve host order; do not sort or infer semantics.
+- [ ] Export identical root and React-free subpath contracts.
+- [ ] Run focused tests and typecheck to GREEN.
 
-## Task 3: Build the ProseMirror Decoration and Invalidation Extension
+## Task 2: inverse canonical text-projection resolver
 
-**Files:**
-- Create: `src/extensions/WritingDiagnostics.ts`
-- Create: `src/extensions/WritingDiagnostics.test.ts`
-- Modify: `src/extensions/kit.ts`
+**Files:** `src/writingDiagnosticProjection.ts`, its tests, `src/textPositionSelectorEvidence.ts`, `src/text-position-selector/index.ts`.
 
-- [ ] Write failing extension-state tests for installing a verified diagnostic set, inline decoration attributes, collapsed/empty ranges, duplicate install generations, clear commands, editor destruction, and document-changing transactions.
-- [ ] Define one plugin key and typed transaction metadata for `install`, `focus`, and `clear` operations.
-- [ ] Render verified non-empty ranges with safe static attributes only:
+- [ ] Add RED round-trip tests for paragraphs, headings, lists, tables, hard breaks, inline/block atoms, empty blocks, document boundaries, repeated text, astral/Korean/CJK/combining/emoji/bidirectional text, and collapsed ranges.
+- [ ] Add negative tests for unsupported projection, unsafe/reversed/out-of-range offsets, grapheme splits, ambiguous structural boundaries, hostile metadata, and missing `Intl.Segmenter`.
+- [ ] Build the exact `textBetween(0, size, '\n', '\uFFFC')` projection and one code-point-boundary-to-ProseMirror-position map.
+- [ ] Reuse one grapheme-boundary implementation for forward and inverse paths.
+- [ ] Fail closed rather than selecting nearest or similar text.
+- [ ] Publish the deterministic resolver through the framework-neutral selector surface.
 
-```text
-class="cwl-writing-diagnostic cwl-writing-diagnostic--{priority}"
-data-cwl-diagnostic-id="opaque-id"
-aria-invalid="spelling" only when the host category explicitly maps to mechanics
-```
+## Task 3: semantic-neutral ProseMirror decorations
 
-- [ ] Do not inject title, explanation, replacement, category text, model output, or HTML into decoration attributes.
-- [ ] Clear all decorations and focused-diagnostic state on every `transaction.docChanged`, including Yjs remote transactions.
-- [ ] Do not map a diagnostic through a changed document in version 1.
-- [ ] Expose typed helper commands that accept already-validated, already-resolved ranges; the extension itself must not hash documents or call host code.
-- [ ] Add the extension exactly once through `buildExtensions()` for standalone and collaborative editor graphs.
-- [ ] Prove by source and runtime tests that an editor with no diagnostics has no added visual output, action surface, or document mutation.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/extensions/WritingDiagnostics.test.ts src/extensions/kit.test.ts
-pnpm typecheck
-```
+**Files:** `src/extensions/WritingDiagnostics.ts`, its tests, `src/extensions/kit.ts`.
 
-- [ ] Commit:
+- [ ] Add RED tests for install/focus/clear metadata, monotonic generation, exact ranges, collapsed ranges, malformed metadata, duplicate IDs, resource ceilings, editor destruction, and local/remote document changes.
+- [ ] Render non-empty ranges with only:
 
-```bash
-git add src/extensions/WritingDiagnostics.ts src/extensions/WritingDiagnostics.test.ts src/extensions/kit.ts
-git commit -m "feat(diagnostics): add fail-closed editor decorations"
+```text
+class="cwl-writing-diagnostic cwl-writing-diagnostic--{priority}"
+data-cwl-diagnostic-id="opaque-id"
 ```
 
-## Task 4: Implement the Revision-Bound Controller State Machine
+- [ ] Reject all extra semantic fields and never derive spelling/grammar validity or other semantic ARIA state from host strings.
+- [ ] Clear the complete generation before processing metadata on every `docChanged` transaction.
+- [ ] Accept only already-validated structural ranges; perform no hashing or host callback.
+- [ ] Install the extension exactly once for standalone and collaborative editor graphs.
 
-**Files:**
-- Create: `src/components/useWritingDiagnosticsController.ts`
-- Create: `src/components/useWritingDiagnosticsController.test.tsx`
-- Modify: `src/types.ts`
+## Task 4: revision-bound controller
 
-- [ ] Write failing hook tests for initial verification, replacement diagnostic props, same-array identity with mutated hostile members, editor replacement, editor destruction, revision mismatch, projection mismatch, verification rejection, document change during hashing, overlapping asynchronous requests, and callback replacement without editor recreation.
-- [ ] Define controller states:
-
-```text
-absent -> verifying -> active
-                 -> invalid
-active -> applying -> applied
-active -> ignored | dismissed | explanation_requested
-active -> stale on any document change
-```
+**Files:** `src/components/useWritingDiagnosticsController.ts`, its tests, `src/types.ts`.
 
-- [ ] Add public action/result types with stable reason codes and no authored text:
+- [ ] Add RED tests for absent/invalid/verifying/active/stale states, editor and callback replacement, hostile prop mutation, revision/projection mismatch, selector rejection, doc changes during hashing, concurrent promises, unmount, and callback exceptions.
+- [ ] Validate the complete set before reading editor state.
+- [ ] Capture one immutable envelope, derive one revision, resolve all selectors against that same snapshot, and install atomically.
+- [ ] Fence every async continuation with monotonic generation, mounted state, and editor identity.
+- [ ] Invalidate both verifying and active generations immediately after any local/remote document change; do not map ranges.
+- [ ] Expose privacy-minimized Focus/Ignore/Dismiss/Explain controller actions and typed reason codes.
 
-```ts
-export type CwlWritingDiagnosticAction =
-  | 'applied'
-  | 'ignored'
-  | 'dismissed'
-  | 'requested_explanation'
-  | 'stale'
-  | 'conflict';
-```
+## Task 5: accessible diagnostics panel
 
-- [ ] Validate diagnostics before reading the editor.
-- [ ] Capture one immutable document envelope and derive one strong revision from that same snapshot before resolving any selector.
-- [ ] Compare the declared revision and projection exactly; no normalization or compatibility guess is permitted.
-- [ ] Resolve all ranges against the same immutable snapshot and reject the complete set atomically if structural validation fails.
-- [ ] Treat overlapping diagnostics as displayable but prevent overlapping replacements from being batch-applied. Version 1 exposes single application only.
-- [ ] Subscribe to editor transactions and immediately invalidate the active generation before scheduling any new verification.
-- [ ] Use monotonic generation IDs and mounted/editor identity guards so older promises cannot install decorations, emit actions, or change focus.
-- [ ] Contain host callback exceptions and keep editor state deterministic.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/components/useWritingDiagnosticsController.test.tsx
-pnpm typecheck
-```
+**Files:** `src/components/WritingDiagnosticsPanel.tsx`, its tests, `src/components/EditorFrame.tsx`, `src/styles.css`, print-style tests.
 
-- [ ] Commit:
+- [ ] Add RED accessibility tests for a named region, count, ordered items, category, priority, title, explanation, affected-range focus, previous/next navigation, Apply/Ignore/Dismiss/Explain, disabled Apply without replacement, polite status, and assertive conflict alert.
+- [ ] Prove asynchronous arrival does not steal focus and explicit navigation uses roving focus.
+- [ ] Render every host string as a React text node; never use raw HTML.
+- [ ] Keep selected source text out of action names and attributes.
+- [ ] Add forced-colors, high-contrast, reduced-motion, focus-visible, touch-target, zoom, and print behavior. Default print remains document-only; an explicit host option may include a bounded appendix.
+- [ ] Add no undocumented global shortcut.
 
-```bash
-git add src/components/useWritingDiagnosticsController.ts src/components/useWritingDiagnosticsController.test.tsx src/types.ts
-git commit -m "feat(diagnostics): bind diagnostics to exact editor revisions"
-```
+## Task 6: standalone editor actions
 
-## Task 5: Add Accessible Diagnostic Navigation and Action UI
-
-**Files:**
-- Create: `src/components/WritingDiagnosticsPanel.tsx`
-- Create: `src/components/WritingDiagnosticsPanel.test.tsx`
-- Modify: `src/components/EditorFrame.tsx`
-- Modify: `src/styles.css`
-
-- [ ] Write failing accessibility tests for a named region, count summary, ordered diagnostic list, category/priority/title/explanation, affected-range focus, previous/next navigation, Apply/Ignore/Dismiss/Explain actions, live status, and disabled application when no replacement exists.
-- [ ] Add tests proving that asynchronous diagnostic arrival does not move focus and that explicit navigation returns focus predictably between the editor range and panel card.
-- [ ] Add tests proving information remains available without color, hover, pointer input, animation, or generated CSS content.
-- [ ] Render host strings as React text nodes only. Never use `dangerouslySetInnerHTML`.
-- [ ] Give every action an explicit accessible name that includes the diagnostic title but does not copy the selected source passage into an attribute.
-- [ ] Use buttons for previous/next navigation and roving focus within the list; do not add undocumented global shortcuts in version 1.
-- [ ] Add one polite live region for completed actions and one assertive alert only for an application conflict.
-- [ ] Add priority-specific underline styles plus forced-colors, high-contrast, reduced-motion, print, touch-target, and focus-visible rules.
-- [ ] In print, omit action buttons and include a compact diagnostic appendix only when the host explicitly enables `printWritingDiagnostics`; default print output remains document-only.
-- [ ] Add `writingDiagnosticsPanel?: ReactNode` support to `EditorFrame` only as an internally constructed trusted component slot; hosts do not inject raw diagnostic markup.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/components/WritingDiagnosticsPanel.test.tsx src/components/EditorFrame.test.tsx src/printStyles.test.ts
-pnpm typecheck
-```
+**Files:** `src/types.ts`, `src/components/CwlEditor.tsx`, `src/components/useEditorHandle.ts`, integration/accessibility/handle tests.
 
-- [ ] Commit:
+- [ ] Add RED tests for optional props, hostile/valid/stale sets, explicit actions, clear, read-only/disabled modes, form submission, undo, callback replacement, and unmount.
+- [ ] Preserve the raw diagnostics prop by identity until bounded controller validation.
+- [ ] Add additive props for diagnostics, action/error callbacks, label, and optional print appendix.
+- [ ] Add imperative Focus/Ignore/Dismiss/Explain/Apply methods through the same controller used by the panel.
+- [ ] Immediately before Apply, derive and compare the exact current revision again.
+- [ ] Apply one plain-text replacement through one ordinary ProseMirror transaction, derive the resulting revision, emit the complete event, and invalidate the remaining generation.
+- [ ] Return typed non-mutating outcomes for stale/conflict/lifecycle cases.
+- [ ] Prove source words alone generate no diagnostics.
 
-```bash
-git add src/components/WritingDiagnosticsPanel.tsx src/components/WritingDiagnosticsPanel.test.tsx src/components/EditorFrame.tsx src/styles.css
-git commit -m "feat(diagnostics): add accessible writing guidance UI"
-```
+## Task 7: collaborative parity
 
-## Task 6: Integrate Standalone Editor Props and Imperative Actions
-
-**Files:**
-- Modify: `src/types.ts`
-- Modify: `src/components/CwlEditor.tsx`
-- Modify: `src/components/useEditorHandle.ts`
-- Modify: `src/components/CwlEditor.test.tsx`
-- Modify: `src/components/CwlEditor.accessibility.test.tsx`
-- Modify: `src/components/useEditorHandle.test.tsx`
-- Create: `src/components/CwlEditor.writingDiagnostics.test.tsx`
-
-- [ ] Write failing integration tests for omitted props, valid diagnostics, invalid diagnostics, stale revisions, editor updates, Apply/Ignore/Dismiss/Explain, clear, undo, host callback replacement, read-only mode, disabled editor, form submission, and unmount.
-- [ ] Add optional props:
-
-```ts
-writingDiagnostics?: readonly CwlWritingDiagnostic[];
-onWritingDiagnosticAction?: (event: CwlWritingDiagnosticActionEvent) => void;
-onWritingDiagnosticsError?: (error: WritingDiagnosticError) => void;
-writingDiagnosticsLabel?: string;
-printWritingDiagnostics?: boolean;
-```
+**Files:** collaborative editor/index/tests and a two-client diagnostics suite.
 
-- [ ] Preserve the original diagnostics array by identity until the controller performs bounded validation; editor construction must not deeply inspect hostile values.
-- [ ] Add imperative methods for focus, ignore, dismiss, explanation request, and asynchronous apply. Every method returns a typed result instead of throwing for ordinary stale/conflict outcomes.
-- [ ] Apply one plain-text replacement through an ordinary ProseMirror transaction only after a second exact-current-revision check immediately before mutation.
-- [ ] Compute and return the resulting strong revision from the applied post-transaction document, and emit the host callback only after the result is complete.
-- [ ] Ensure the transaction enters the normal undo history and does not bypass clipboard, link, image, schema, or document-envelope policy.
-- [ ] Immediately invalidate every remaining diagnostic after a successful apply.
-- [ ] Keep editing, form submission, conversion, save, and export available when diagnostics are invalid, unavailable, stale, ignored, or unhandled.
-- [ ] Prove a document containing words such as `rude`, `incorrect`, `urgent`, or their multilingual equivalents produces zero diagnostics unless the host supplies them.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/components/CwlEditor.writingDiagnostics.test.tsx src/components/CwlEditor.accessibility.test.tsx src/components/useEditorHandle.test.tsx
-pnpm typecheck
-```
+- [ ] Add the same props/actions and accessible panel behavior through the shared controller and extension.
+- [ ] Prove a remote Yjs insertion invalidates the complete local set before application.
+- [ ] Prove remote change during pending hashing discards the stale continuation.
+- [ ] Keep diagnostics, explanations, replacements, selected text, model provenance, and review state out of awareness payloads.
+- [ ] Emit an action only from the client whose user invoked it.
+- [ ] Preserve editor/provider/Yjs identity when diagnostics/callbacks change.
 
-- [ ] Commit:
+## Task 8: framework-neutral package subpath
 
-```bash
-git add src/types.ts src/components/CwlEditor.tsx src/components/useEditorHandle.ts src/components/CwlEditor.test.tsx src/components/CwlEditor.accessibility.test.tsx src/components/useEditorHandle.test.tsx src/components/CwlEditor.writingDiagnostics.test.tsx
-git commit -m "feat(diagnostics): integrate revision-safe editor actions"
-```
+**Files:** package manifest/lock, Vite subpath config, package/export/consumer/boundary tests.
 
-## Task 7: Establish Collaborative Editor Parity
-
-**Files:**
-- Modify: `src/collaboration/CollaborativeCwlEditor.tsx`
-- Modify: `src/collaboration/index.ts`
-- Modify: `src/collaboration/index.test.ts`
-- Modify: `src/collaboration/CollaborativeCwlEditor.test.tsx`
-- Modify: `src/collaboration/CollaborativeCwlEditor.accessibility.test.tsx`
-- Create: `src/collaboration/CollaborativeCwlEditor.writingDiagnostics.test.tsx`
-
-- [ ] Write failing tests for the same public props/actions as standalone Inkspan.
-- [ ] Add a two-client Yjs test proving a remote insertion invalidates the local client's complete diagnostic set before any application can occur.
-- [ ] Add a race test in which remote content changes while the local revision digest is pending; the older digest must not install decorations.
-- [ ] Reuse `useWritingDiagnosticsController`; do not create a second collaborative-specific semantic or lifecycle implementation.
-- [ ] Ensure awareness payloads never contain diagnostics, explanations, replacements, selected text, model provenance, or review state.
-- [ ] Ensure remote action callbacks are not fabricated: only the client whose user explicitly invoked an action emits that action.
-- [ ] Prove editor/provider/Yjs identity remains stable when diagnostics or callbacks change.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/collaboration/CollaborativeCwlEditor.writingDiagnostics.test.tsx src/collaboration/CollaborativeCwlEditor.accessibility.test.tsx src/collaboration/index.test.ts
-pnpm typecheck
-```
+- [ ] Publish `@contextualwisdomlab/cwl-editor/writing-diagnostics` as React-free ESM/CommonJS/types.
+- [ ] Export contracts, limits, validation, errors, and deterministic selector-resolution primitives only.
+- [ ] Prove no React, TipTap React, provider, model SDK, network, credential, filesystem, database, or CSS side-effect dependency leaks into the pure subpath.
+- [ ] Install the packed tarball into isolated ESM/CommonJS/strict-TypeScript consumers.
+- [ ] Keep UI and editor handles on interactive root/collaboration entrypoints.
 
-- [ ] Commit:
+## Task 9: browser, SSR, hostile-input, and no-fallback assurance
 
-```bash
-git add src/collaboration/CollaborativeCwlEditor.tsx src/collaboration/index.ts src/collaboration/index.test.ts src/collaboration/CollaborativeCwlEditor.test.tsx src/collaboration/CollaborativeCwlEditor.accessibility.test.tsx src/collaboration/CollaborativeCwlEditor.writingDiagnostics.test.tsx
-git commit -m "feat(diagnostics): guarantee collaborative parity"
-```
+**Files:** browser specs/fixture, security tests, server-rendering tests, `docs/TEST_STRATEGY.md`.
 
-## Task 8: Publish a Framework-Neutral Package Subpath
-
-**Files:**
-- Modify: `package.json`
-- Modify: `pnpm-lock.yaml`
-- Create: `vite.writing-diagnostics.config.ts`
-- Modify: `scripts/verify-package.mjs`
-- Modify: `src/packageExports.test.ts`
-- Modify: `src/packageConsumer.test.ts`
-- Create: `src/writing-diagnostics/packageBoundary.test.ts`
-
-- [ ] Add `@contextualwisdomlab/cwl-editor/writing-diagnostics` as a React-free ESM/CommonJS/type subpath.
-- [ ] Keep UI components and editor handles on the root and collaboration entrypoints; the subpath exports only types, limits, validation, errors, and selector-resolution primitives that do not require React.
-- [ ] Add a dedicated Vite build configuration and package export map entries.
-- [ ] Add dependency-graph tests proving the subpath has no React, TipTap React, Yjs provider, model SDK, network, credential, filesystem, or database import.
-- [ ] Extend package verification to install the packed tarball in isolated strict TypeScript ESM and CommonJS consumers and compile a complete diagnostic fixture.
-- [ ] Verify CSS remains opt-in through the existing `styles.css` export and the pure subpath has no CSS side effect.
-- [ ] Run:
-
-```bash
-pnpm build
-pnpm verify:package
-pnpm exec vitest run src/packageExports.test.ts src/packageConsumer.test.ts src/writing-diagnostics/packageBoundary.test.ts
-```
+- [ ] Test rendering, keyboard/touch navigation, focus, Apply, undo, strict invalidation, zoom, forced colors, and mobile targets on pinned Chromium/Firefox/WebKit.
+- [ ] Prove SSR renders without browser globals, segmenter, model infrastructure, or semantic evaluation; hydration adds no duplicate IDs, focus theft, or mismatch.
+- [ ] Test script/HTML strings, bidi controls, isolated surrogates, nulls, oversize, accessors, proxies, duplicate JSON members, and callback exceptions.
+- [ ] Use multilingual semantic contrast fixtures; without host diagnostics the exact result is an empty diagnostic surface.
+- [ ] Record browser lock, artifact identity, and the distinction between editor integrity evidence and model accuracy.
 
-- [ ] Commit:
+## Task 10: canonical documentation and traceability
 
-```bash
-git add package.json pnpm-lock.yaml vite.writing-diagnostics.config.ts scripts/verify-package.mjs src/packageExports.test.ts src/packageConsumer.test.ts src/writing-diagnostics/packageBoundary.test.ts
-git commit -m "build(diagnostics): publish framework-neutral contracts"
-```
+**Files:** README, Architecture, PRD, TRD, API contract, threat model, operability, traceability, ADR 0027/0028/index, design, this plan, CHANGELOG, documentation-contract tests.
 
-## Task 9: Add Browser, SSR, Hostile-Input, and No-Fallback Assurance
-
-**Files:**
-- Create: `tests/browser/specs/writing-diagnostics.browser.spec.ts`
-- Modify: `tests/browser/fixture/index.html`
-- Create: `src/components/writingDiagnosticsSecurity.test.tsx`
-- Modify: `src/components/editorServerRendering.test.tsx`
-- Modify: `docs/TEST_STRATEGY.md`
-
-- [ ] Add Playwright scenarios in Chromium, Firefox, and WebKit for rendering, keyboard navigation, range focus, apply, undo, stale invalidation, zoom, forced-colors, and mobile/touch action targets.
-- [ ] Add SSR tests proving a deterministic initial shell renders without `window`, `document`, `Intl.Segmenter`, model infrastructure, or diagnostics evaluation.
-- [ ] Add hydration tests proving diagnostics verify after the client editor is ready without duplicate IDs, focus theft, or markup mismatch.
-- [ ] Add hostile-input tests for HTML/script strings, bidi controls, isolated surrogates, nulls, oversized values, accessors, proxies, duplicate keys after JSON parsing, and callback exceptions.
-- [ ] Add semantic contrast fixtures proving Inkspan itself has no keyword behavior:
-  - identical words in a quotation and direct statement;
-  - the same issue expressed through unrelated paraphrases;
-  - product names, code, URLs, and paths resembling spelling errors;
-  - Korean, English, mixed-language, and CJK documents.
-- [ ] The expected Inkspan result for every contrast fixture without host diagnostics is an empty diagnostic surface.
-- [ ] Document that these tests establish editor integrity and rendering parity, not the accuracy of any LLM or host rubric.
-- [ ] Run the repository-pinned browser workflow command used by CI and record the exact browser package lock and artifact receipt.
-- [ ] Commit:
-
-```bash
-git add tests/browser/specs/writing-diagnostics.browser.spec.ts tests/browser/fixture/index.html src/components/writingDiagnosticsSecurity.test.tsx src/components/editorServerRendering.test.tsx docs/TEST_STRATEGY.md
-git commit -m "test(diagnostics): prove browser and no-fallback assurance"
-```
+- [ ] Document host semantic authority versus Inkspan deterministic integrity.
+- [ ] Synchronize public type examples, strict invalidation, semantic-neutral decorations, collapsed selectors, single-action application, standalone/collaboration parity, SSR, degraded operation, privacy, and rollback.
+- [ ] Remove temporary errata after folding every rule into the canonical ADR/design/plan; leave no parallel instruction set.
+- [ ] Document that confidence/priority/category are host labels, not editor truth or submission policy.
+- [ ] Add threats for hostile diagnostics, stale async work, replacement injection, telemetry leakage, focus attacks, collaboration races, and authority confusion.
+- [ ] Map requirements to modules, tests, browser/package evidence, and release gates.
+- [ ] Keep ADRs Proposed until protected implementation and acceptance exist.
+- [ ] Add machine contracts that reject semantic keyword fallback, category-derived semantic ARIA, cross-edit mapping, provider ownership, stale repair, batch mutation authority, and send gating.
 
-## Task 10: Reconcile Canonical Documentation and Traceability
-
-**Files:**
-- Modify: `README.md`
-- Modify: `ARCHITECTURE.md`
-- Modify: `docs/PRD.md`
-- Modify: `docs/TRD.md`
-- Modify: `docs/API_CONTRACT.md`
-- Modify: `docs/THREAT_MODEL.md`
-- Modify: `docs/OPERABILITY.md`
-- Modify: `docs/TRACEABILITY.md`
-- Modify: `docs/adr/0027-host-owned-llm-writing-diagnostics.md`
-- Modify: `docs/adr/README.md`
-- Modify: `CHANGELOG.md`
-- Modify: `src/documentationContracts.test.ts`
-
-- [ ] Add public examples for host-supplied diagnostics, exact revision capture, action callbacks, stale refresh, standalone and collaborative editors, SSR, and no-model degraded operation.
-- [ ] Document the distinction between semantic authority and deterministic integrity.
-- [ ] Document that `confidence` and `priority` are host evidence labels, not editor truth or submission policy.
-- [ ] Add a threat-model section for prompt/model output as untrusted data, hostile diagnostic objects, stale selectors, replacement injection, overlap conflicts, telemetry leakage, focus attacks, and collaboration races.
-- [ ] Add an operability section for review-unavailable state, invalid diagnostics, refresh ownership, callback failure, feature rollback, and no-network/offline behavior.
-- [ ] Update traceability from ADR requirement to source module, test, browser evidence, package evidence, and release gate.
-- [ ] Keep ADR 0027 `Proposed` until protected `main` contains the implementation and exact-head acceptance evidence; promote it in the release reconciliation PR, not prematurely.
-- [ ] Record the feature under `Unreleased` without claiming Naruon integration, LLM quality, language validation, or publication.
-- [ ] Add documentation contract tests that fail if keyword fallback, provider ownership, stale-repair, or send-gating claims reappear.
-- [ ] Run:
-
-```bash
-pnpm exec vitest run src/documentationContracts.test.ts
-pnpm typecheck
-```
+## Task 11: exact-head integration acceptance
 
-- [ ] Commit:
+- [ ] Reconcile the complete stack onto the latest protected main without destructive history or lost concurrent changes.
+- [ ] Remove every temporary branch-specific workflow and regenerate evidence on the resulting exact head.
+- [ ] Run full tests, typecheck, exact 100% owned coverage, library/demo builds, packed consumers, cross-engine browsers, Office Python 3.11/3.14 package gates, security/SAST/dependency/SBOM/provenance/secret checks, and documentation contracts.
+- [ ] Inspect all current human/CodeRabbit/GHAS/Dependabot/OpenCode/Noema/Strix feedback and resolve only addressed threads.
+- [ ] Require zero valid unresolved findings and qualifying independent non-author approval on the unchanged head.
+- [ ] Mark Ready and merge only through protected policy; then verify protected main contains expected files and no temporary artifacts.
 
-```bash
-git add README.md ARCHITECTURE.md docs/PRD.md docs/TRD.md docs/API_CONTRACT.md docs/THREAT_MODEL.md docs/OPERABILITY.md docs/TRACEABILITY.md docs/adr/0027-host-owned-llm-writing-diagnostics.md docs/adr/README.md CHANGELOG.md src/documentationContracts.test.ts
-git commit -m "docs(diagnostics): reconcile product and assurance contracts"
-```
+## Task 12: release-only publication and host handoff
 
-## Task 11: Exact-Head Acceptance and Merge
-
-- [ ] Rebase or merge the latest protected `main` without discarding valid concurrent changes.
-- [ ] Run the complete repository test suite.
-- [ ] Run `pnpm typecheck`.
-- [ ] Run `pnpm coverage` and prove 100% production statement, branch, function, and line coverage.
-- [ ] Run deterministic demo/library builds.
-- [ ] Run `pnpm verify:package` against the packed tarball outside the source tree.
-- [ ] Run cross-engine browser evidence through the repository-pinned Playwright lane.
-- [ ] Run Office Python 3.11 and 3.14 test, docstring, branch coverage, wheel, schema, and license gates.
-- [ ] Run SAST, dependency, supply-chain, SBOM, provenance, and secret checks on the exact final head.
-- [ ] Review every current-head CodeRabbit, GitHub Advanced Security, Dependabot, OpenCode, Noema, Strix, human, and other applicable finding.
-- [ ] Resolve every valid review thread and rerun affected tests.
-- [ ] Confirm zero unresolved valid review threads.
-- [ ] Obtain a qualifying non-author current-head approval.
-- [ ] Move the PR from Draft to Ready only after implementation, direct validation, and documentation gates are complete.
-- [ ] Merge without bypass only after all protected exact-head checks and approval rules pass.
-- [ ] Refetch protected `main` and verify the merge commit contains the expected files and no unrelated branch artifacts.
-
-## Task 12: Release-Only Publication and Naruon Handoff
-
-- [ ] Open a separate release-only PR for the next compatible minor version after the feature merge.
-- [ ] Promote ADR 0027 to `Accepted` only with protected-main implementation and exact-head evidence.
-- [ ] Update version metadata, final CHANGELOG release section, package declarations, license inventory, SBOM, provenance, and rollback evidence.
-- [ ] Publish immutable npm artifacts only from the exact reviewed release head.
-- [ ] Verify ESM, CommonJS, types, CSS, root, collaboration, and `writing-diagnostics` subpaths from the published package.
-- [ ] Record the immutable version, tarball integrity, source commit, package manifest, and compatibility matrix in the Naruon companion PR.
-- [ ] Do not merge Naruon's runtime integration against a mutable Inkspan branch, source archive, local path, or unreviewed package.
-- [ ] Retain a documented rollback path that removes diagnostic props and UI without document migration or canonical-envelope changes.
+- [ ] Open a separate release-only PR after protected feature integration and current release-train closure.
+- [ ] Promote ADR status only with protected implementation and current acceptance evidence.
+- [ ] Update version, final CHANGELOG, package declarations, licenses, SBOM/provenance, compatibility, and rollback.
+- [ ] Publish immutable npm artifacts from the exact reviewed release head and verify all subpaths from the registry artifact.
+- [ ] Record immutable version, tarball digest, source commit, manifest, browser evidence, and rollback in the Naruon companion integration.
+- [ ] Never integrate a mutable branch, source archive, copied fork, local path, or unreviewed package into a host runtime.
diff --git a/docs/superpowers/specs/2026-08-12-revision-bound-llm-writing-diagnostics-design.md b/docs/superpowers/specs/2026-08-12-revision-bound-llm-writing-diagnostics-design.md
index 8e753eb2..75e26e15 100644
--- a/docs/superpowers/specs/2026-08-12-revision-bound-llm-writing-diagnostics-design.md
+++ b/docs/superpowers/specs/2026-08-12-revision-bound-llm-writing-diagnostics-design.md
@@ -1,4 +1,4 @@
-# Revision-Bound LLM Writing Diagnostics Design
+# Revision-Bound Writing Diagnostics Design
 
 **Date:** 2026-08-12  
 **Status:** Proposed design; not shipped behavior  
@@ -6,99 +6,108 @@
 
 ## Objective
 
-Add a provider-neutral, Grammarly-like writing-diagnostic surface to Inkspan without turning Inkspan into a language model, email product, policy engine, or persistence service.
+Add a provider-neutral, Grammarly-like writing-diagnostic surface without turning Inkspan into a language model, email product, policy engine, persistence service, or hidden semantic classifier.
 
-A host application will generate contextual writing proposals using an LLM and its own review policy. Inkspan will display those proposals against the exact document revision from which they were generated, let the author inspect and apply or ignore each one, and prevent stale asynchronous output from mutating newer content.
+A host application generates contextual writing proposals using its own model, rubric, authorization, privacy, retention, and review policy. Inkspan admits only structurally valid host proposals, binds them to one exact document revision and text projection, renders them accessibly, and permits explicit user actions without allowing stale asynchronous output to mutate changed content.
 
-The feature must support spelling, grammar, spacing, punctuation, clarity, concision, structure, tone, pragmatics, technical precision, and actionability as host-defined categories. Inkspan does not determine any of those categories. It exposes a generic review contract and deterministic document integrity.
+Host-defined categories may describe spelling, grammar, spacing, punctuation, clarity, concision, structure, tone, pragmatics, technical precision, or actionability. Inkspan treats those fields as opaque proposal data. It does not determine whether a category, explanation, confidence, priority, or replacement is semantically correct.
 
 ## Product behavior
 
-An author sees normal Inkspan editing first. When the host supplies diagnostics:
+An author sees normal Inkspan editing first. When the host supplies an admitted diagnostic set:
 
-1. affected ranges receive non-color-only decorations;
-2. the diagnostics summary reports the number and categories of suggestions;
-3. keyboard and pointer users can move to the previous or next suggestion;
-4. a suggestion card explains the issue and shows an optional replacement;
-5. Apply changes only the selected range;
-6. Ignore reports a host-visible feedback action without changing the document;
-7. Dismiss removes the local presentation until the host changes the diagnostic set;
-8. Explain requests no model call from Inkspan; it reveals the explanation already supplied by the host or invokes a host callback;
-9. any document change revalidates or invalidates affected diagnostics;
-10. stale diagnostics never apply by nearest-text search, keyword search, or silent position repair.
+1. non-empty affected ranges receive non-color-only visual decorations;
+2. a named diagnostics region reports the count and exposes an ordered list;
+3. each item exposes category, priority, title, explanation, and optional replacement as plain text;
+4. keyboard, pointer, touch, and assistive-technology users can navigate the previous or next diagnostic;
+5. Focus moves to an affected structural range only after explicit user navigation;
+6. Apply rechecks the exact current revision and applies one selected plain-text replacement through one ordinary ProseMirror transaction;
+7. Ignore and Dismiss emit privacy-minimized host-visible actions without changing canonical content;
+8. Explain reveals the supplied explanation or invokes an explicit host callback; Inkspan performs no model call;
+9. asynchronous arrival never steals focus; and
+10. stale diagnostics never apply through nearest-text search, keyword search, quote search, remapping, or silent position repair.
 
-Diagnostics remain advisory. Their presence does not block form submission, email sending, export, or persistence in the editor package.
+Diagnostics remain advisory. Their presence, absence, invalidity, or staleness does not block form submission, sending, export, persistence, or collaboration in the editor package.
 
 ## Selected architecture
 
 ```mermaid
 flowchart LR
     H[Host review service] -->|revision-bound diagnostics| P[Inkspan public props]
-    P --> V[Deterministic diagnostic validator]
-    V --> D[ProseMirror decorations]
-    D --> U[Accessible diagnostics UI]
-    U --> A{Author action}
-    A -->|Apply| R[Revision/selector revalidation]
-    A -->|Ignore or Dismiss| C[Privacy-minimized callback]
-    R -->|match| T[Normal ProseMirror transaction]
-    R -->|stale or ambiguous| X[Typed conflict/invalidation]
-    T --> E[Normal onChange/onDocumentChange/undo]
+    P --> V[Deterministic contract validator]
+    V --> R[Exact revision and selector resolver]
+    R --> D[Semantic-neutral ProseMirror decorations]
+    D --> U[Accessible diagnostics panel]
+    U --> A{Explicit author action}
+    A -->|Apply| C[Exact current-revision check]
+    A -->|Ignore Dismiss Explain| E[Privacy-minimized action event]
+    C -->|match| T[Ordinary ProseMirror transaction]
+    C -->|stale conflict| X[Typed non-mutating outcome]
+    T --> O[Normal change revision and undo behavior]
 ```
 
-The host may be Naruon, another CWL product, or an unrelated consumer. No host name appears in the runtime API.
+The host may be Naruon, another CWL product, or an unrelated consumer. No host, provider, model, email, or tenant name appears in the generic runtime contract.
 
 ## Public contract
 
-The exact implementation names may be refined during planning, but the semantic contract is fixed.
+The v1 design mirrors the implementation types rather than maintaining a second approximate schema.
 
 ```ts
-export type CwlWritingDiagnosticPriority = 'suggestion' | 'important';
-
-export interface CwlWritingDiagnosticSelector {
-  readonly type: 'TextPositionSelector';
-  readonly start: number;
-  readonly end: number;
-}
+export type CwlWritingDiagnosticPriority =
+  | 'advisory'
+  | 'important'
+  | 'critical';
 
 export interface CwlWritingDiagnosticProvenance {
   readonly workflowId: string;
   readonly workflowVersion: string;
-  readonly policyVersion: string;
-  readonly providerName?: string;
-  readonly modelName?: string;
+  readonly judgePolicyVersion: string;
+  readonly orchestrationMode?: string;
 }
 
 export interface CwlWritingDiagnostic {
   readonly diagnosticId: string;
-  readonly documentRevision: string;
-  readonly projectionName: 'inkspan-prosemirror-text';
-  readonly projectionVersion: 1;
-  readonly selector: CwlWritingDiagnosticSelector;
+  readonly documentRevision: CwlEditorDocumentRevision;
+  readonly textProjection: CwlEditorTextProjectionIdentity;
+  readonly selector: CwlEditorTextPositionSelector;
   readonly categoryCode: string;
   readonly priority: CwlWritingDiagnosticPriority;
   readonly title: string;
   readonly explanation: string;
   readonly suggestedReplacement?: string;
   readonly confidence?: number;
-  readonly provenance: CwlWritingDiagnosticProvenance;
+  readonly provenance: Readonly<CwlWritingDiagnosticProvenance>;
 }
 
 export type CwlWritingDiagnosticAction =
-  | 'apply'
-  | 'ignore'
-  | 'dismiss'
-  | 'explain';
+  | 'applied'
+  | 'ignored'
+  | 'dismissed'
+  | 'requested_explanation'
+  | 'stale'
+  | 'conflict';
+
+export type CwlWritingDiagnosticActionReasonCode =
+  | 'explicit'
+  | 'document_changed'
+  | 'revision_mismatch'
+  | 'projection_mismatch'
+  | 'selector_invalid'
+  | 'verification_failed'
+  | 'lifecycle_ended'
+  | 'diagnostic_missing';
 
 export interface CwlWritingDiagnosticActionEvent {
-  readonly diagnosticId: string;
   readonly action: CwlWritingDiagnosticAction;
-  readonly status: 'completed' | 'stale' | 'conflict' | 'rejected';
-  readonly currentRevision?: string;
-  readonly reasonCode?: string;
+  readonly reasonCode: CwlWritingDiagnosticActionReasonCode;
+  readonly diagnosticId: string;
+  readonly documentRevision: CwlEditorDocumentRevision;
+  readonly categoryCode: string;
+  readonly generation: number;
 }
 ```
 
-Candidate props:
+Candidate additive editor props are:
 
 ```ts
 interface CwlEditorProps {
@@ -106,235 +115,191 @@ interface CwlEditorProps {
   onWritingDiagnosticAction?: (
     event: CwlWritingDiagnosticActionEvent,
   ) => void;
+  onWritingDiagnosticsError?: (error: WritingDiagnosticError) => void;
+  writingDiagnosticsLabel?: string;
+  printWritingDiagnostics?: boolean;
 }
 ```
 
-Candidate imperative method for hosts that render their own panel:
+Candidate imperative methods use the same controller and validation path as the built-in panel. There is no trusted imperative bypass.
 
-```ts
-interface CwlEditorHandle {
-  applyWritingDiagnosticIfMatch(
-    diagnosticId: string,
-  ): Promise<CwlWritingDiagnosticActionEvent>;
-}
-```
+## Validation boundary
 
-The component and imperative paths must call the same implementation. There cannot be a “trusted imperative” bypass.
+The deterministic validator fails closed and verifies:
 
-## Validation boundary
+- exact own enumerable data properties and no unsupported fields, symbols, accessors, sparse arrays, inherited fields, or hostile reflection;
+- bounded collection size, identifier length, category length, title, explanation, replacement, and provenance identifiers;
+- unique diagnostic identifiers within one submitted generation;
+- supported finite priority and confidence values;
+- an exact lowercase SHA-256 revision object and matching strong entity tag;
+- the exact `inkspan-prosemirror-text` version 1 projection identity;
+- selector values are non-negative safe integers with start <= end;
+- Unicode-code-point and grapheme-cluster boundaries;
+- one unambiguous structural range in the exact projected snapshot; and
+- plain-text replacement values only.
 
-The diagnostic validator is deterministic and fail-closed. It verifies:
-
-- the collection is an array within a documented maximum count;
-- every object contains exactly the supported fields;
-- identifiers and category codes satisfy bounded syntax contracts;
-- identifiers are unique within the supplied collection;
-- text fields are non-empty where required and within documented limits;
-- confidence, if present, is finite and in `[0, 1]`;
-- the projection name and version are supported;
-- the declared revision has valid Inkspan strong-entity-tag syntax;
-- selector values are non-negative integers with `start < end`;
-- selector boundaries are valid Unicode-code-point and grapheme-cluster boundaries;
-- the range exists in the declared projection;
-- replacement content passes the existing editor input, link, image, and schema policies;
-- diagnostics do not contain executable markup or hidden event handlers;
-- a bounded batch application contains no overlapping edits.
-
-The validator does not decide whether an explanation is true, whether a replacement is grammatically better, or whether a message is polite. Regexes may validate identifiers and revision syntax but cannot create or admit a semantic diagnostic based on source wording.
+Collapsed selectors are valid evidence and remain navigable, but they create no inline range decoration. Empty and non-empty selectors use the same exact revision/projection admission path.
+
+The validator does not decide whether an explanation is true, a replacement is better, a message is polite, or a category label is accurate. Regexes may validate bounded identifiers and revision syntax, but they cannot create, prioritize, admit, or semantically classify a diagnostic.
 
 ## Revision and position lifecycle
 
 ### Initial admission
 
-The host captures one document revision and text projection, sends that material through its review system, and returns diagnostics carrying the same revision and projection identity. Inkspan compares those fields with the editor state before rendering the proposals as current.
+The host reviews one immutable document snapshot and returns diagnostics carrying that snapshot's exact `CwlEditorDocumentRevision`, projection identity, and W3C text-position selector. Inkspan validates the complete untrusted set before reading editor state, derives one current revision from one immutable editor snapshot, resolves all selectors against that same snapshot, and publishes only a complete verified generation.
 
-### Local edits
+### Strict invalidation
 
-ProseMirror can map a range through transactions. Inkspan may keep a diagnostic current only when all of the following hold:
+Every local or collaborative transaction with docChanged === true invalidates the complete active diagnostic generation.
 
-- the original revision was admitted;
-- every intervening transaction exposes a valid mapping;
-- the mapped range is not deleted, split ambiguously, or replaced by unrelated content;
-- the host's declared policy allows mapped presentation;
-- application still performs a fresh current-state check.
+Version 1 does not preserve, map, remap, repair, or re-admit a diagnostic after changed document content. ProseMirror mapping and Yjs relative positions are useful editor mechanisms, but neither proves that a host model judgment remains semantically current. A stale async digest or selector result is discarded through the generation fence. The host must submit a new set bound to the new exact revision.
 
-A mapped decoration is presentation convenience, not permission to apply stale model output. The final replacement action verifies the active state under the implementation plan's exact conflict contract.
+### Explicit action
 
-### Remote collaborative edits
+Version 1 applies exactly one explicitly selected diagnostic at a time.
 
-Yjs collaboration can remap local ProseMirror positions, but a model proposal remains bound to the original strong revision. A remote edit that changes the reviewed content invalidates the proposal for application. Inkspan must not treat a Yjs relative position as proof that the semantic target remained unchanged.
+Immediately before application, Inkspan derives and compares the current exact revision again. A matching diagnostic with a valid plain-text replacement produces one ordinary ProseMirror transaction and normal undo history. A mismatch, missing diagnostic, invalid selector, ended lifecycle, or changed document returns a typed non-mutating event. Successful application invalidates every remaining diagnostic and derives the resulting revision from the post-transaction document.
 
-### Re-review
+There is no Apply All or batch mutation authority in v1. Overlapping diagnostics may be displayed independently, but each action is revalidated after every document change.
 
-The host receives stale/conflict callbacks and may request a new review. Inkspan itself performs no network call and has no retry loop.
+### Re-review
 
-## Decoration and interaction model
+The host may use a stale/conflict action event to request a new review. Inkspan performs no network call, retry, provider fallback, or diagnostic regeneration.
 
-- Different categories may use distinct underline patterns, but color alone is insufficient.
-- Hover may show a preview, but every operation must be keyboard reachable.
-- The editor toolbar remains one composite tab stop; diagnostic navigation may be a separate named toolbar or panel with a documented roving-tabindex pattern.
-- Opening a diagnostic card does not move the caret unless the author explicitly chooses to navigate to the affected range.
-- Applying a replacement creates one normal ProseMirror transaction and one normal undo step.
-- After Apply, focus returns predictably to the editor at the end of the inserted replacement unless the host chooses a documented alternative.
-- New asynchronous diagnostics must not steal focus or close a card the author is actively reading.
-- Screen-reader output identifies category, ordinal position, affected range context, and available actions without reading the entire document.
+## Decoration and accessibility model
 
-## Host feedback surface
+Inline decorations contain only:
 
-Inkspan reports action metadata only. The default event contains no selected source text, replacement text, explanation, prompt, raw model output, email recipient, or tenant identifier.
+```text
+class="cwl-writing-diagnostic cwl-writing-diagnostic--{priority}"
+data-cwl-diagnostic-id="opaque-id"
+```
 
-A host that needs richer audit evidence must deliberately read it from its own authorized review-session store. This prevents generic analytics from becoming a shadow copy of authored documents.
+Inkspan does not derive aria-invalid or any other semantic accessibility state from opaque host strings.
 
-Recommended action reason codes include:
+The editor does not infer spelling, grammar, mechanics, tone, or correctness from `categoryCode`, title, explanation, replacement, confidence, provenance, or source text. It does not place those strings in decoration attributes. The named diagnostics panel is the semantic accessibility surface.
 
-```text
-revision_mismatch
-projection_mismatch
-range_deleted
-range_ambiguous
-replacement_rejected
-batch_overlap
-unsupported_diagnostic
-editor_destroyed
-```
+The panel must provide:
 
-Reason codes are stable machine data. Human-readable failure messages remain localized host/editor UI text.
+- a named region and count summary;
+- an ordered list with category, priority, title, and explanation;
+- explicit previous/next navigation with roving focus;
+- an affected-range Focus action;
+- Apply, Ignore, Dismiss, and Explain native buttons;
+- a disabled Apply action when no replacement exists;
+- a polite status region for ordinary completed actions;
+- an assertive alert only for an actual application conflict;
+- no focus theft when diagnostics arrive asynchronously; and
+- equivalent information without color, hover, pointer input, animation, or generated CSS content.
 
-## Security and privacy
+Host strings render as React text nodes only. Action names may use the diagnostic title but never copy selected source text into DOM attributes. Underlines are a visual supplement, not the sole information channel.
 
-- Treat every diagnostic field as attacker-controlled input.
-- Render title and explanation as text, not trusted HTML.
-- Route replacements through existing safe-link, safe-image, clipboard, and schema policy.
-- Do not allow a diagnostic to carry commands, JavaScript, arbitrary TipTap JSON, or host callbacks.
-- Do not place source or replacement text in logs, exceptions, analytics, or performance marks.
-- Do not expose provider credentials or full provider traces through provenance.
-- Bound diagnostic count, text lengths, selector sizes, and decoration work to prevent rendering denial of service.
-- Reject duplicate identifiers and unsupported fields rather than accepting ambiguous objects.
-- Preserve Inkspan's no-runtime-environment-read and no-network-call contracts.
+## Host feedback surface
 
-## Keyword-judgment prohibition
+Default action events contain only opaque identifiers, exact revision evidence, opaque category code, generation, action, and bounded reason code. They contain no selected source text, replacement text, explanation, prompt, raw model output, email recipient, credential, document envelope, or tenant identifier.
 
-Inkspan must contain no semantic rule such as:
+A host requiring richer audit evidence reads it from its own authorized review-session store. Generic analytics must not become a shadow copy of authored content.
 
-```text
-if text includes "무슨 말씀이신가요" then category = "tone"
-if text includes "당황스럽습니다" then priority = "important"
-if sender domain ends with X then apply business-language rule Y
-```
+## Security and privacy
 
-Test fixtures will include:
+- Treat every diagnostic object and host string as untrusted input.
+- Reject accessors, prototypes, symbols, extra fields, sparse arrays, proxies, duplicate identifiers, and resource-limit violations.
+- Render title, explanation, category, and replacement previews as text, never trusted HTML.
+- Accept only plain-text replacement values in v1.
+- Do not allow commands, JavaScript, arbitrary TipTap JSON, host callbacks, or executable markup inside a diagnostic.
+- Do not place authored or model-produced text in logs, exceptions, analytics, performance marks, awareness payloads, or decoration attributes.
+- Do not expose provider credentials, raw provider traces, or tenant data through provenance.
+- Preserve Inkspan's no-runtime-environment-read and no-network-call contracts.
 
-- the same phrase quoted neutrally and used as a direct rebuke;
-- the same pragmatic problem expressed with unrelated vocabulary;
-- intentionally misspelled words inside code, quotations, and proper names;
-- recipient metadata that changes the host's interpretation while the draft text remains identical.
+## Semantic keyword prohibition
 
-Inkspan must produce zero diagnostics in every fixture unless the host explicitly supplies them. This proves the package is a renderer and integrity boundary, not a hidden classifier.
+Inkspan must produce zero diagnostics unless the host explicitly supplies them. It contains no semantic rule based on keywords, regexes, phrase dictionaries, sender domains, recipient counts, language names, positions, or nearest-text similarity. Opaque values that happen to contain words such as `spelling`, `grammar`, `mechanics`, `rude`, `incorrect`, or multilingual equivalents do not gain behavior or semantic ARIA authority.
 
 ## Failure behavior
 
 | Condition | Inkspan behavior |
 |---|---|
 | No diagnostics supplied | Normal editor behavior |
-| Host review pending | Normal editor; optional host-owned loading UI |
-| Host review failed | Normal editor; no fabricated fallback |
-| Malformed diagnostic | Reject diagnostic collection or invalid entry according to the typed contract; no mutation |
-| Stale revision | Mark invalid/stale; Apply unavailable; emit callback |
-| Unsupported projection | Reject; no nearest-text recovery |
-| Hostile explanation/replacement | Render safely or reject under existing policy |
-| Overlapping batch | Reject batch; allow individually revalidated actions |
-| Editor destroyed | Return typed non-mutating result |
+| Host review pending or unavailable | Normal editor; optional host-owned status UI |
+| Malformed or oversized input | Reject complete set through a redacted typed error; no editor mutation |
+| Revision mismatch | Do not install or apply; return bounded stale/conflict evidence |
+| Unsupported projection | Reject; no nearest-text or compatibility recovery |
+| Invalid or ambiguous selector | Reject complete set; no guessed position |
+| Local or remote document change | Invalidate complete active generation immediately |
+| Host callback throws | Contain callback failure; preserve deterministic editor state |
+| Editor destroyed | Return typed non-mutating lifecycle evidence |
 
 ## Testing strategy
 
-### Pure contract tests
+### Contract and hostile-input tests
 
-- exact field, type, length, and count validation;
-- duplicate IDs and unexpected fields;
-- finite confidence and revision syntax;
-- Unicode code-point ranges and grapheme boundaries;
-- immutable/frozen public event snapshots where applicable;
-- overlap detection and deterministic ordering.
+- exact fields, types, limits, priorities, confidence, revision, projection, and selector validation;
+- duplicate identifiers, sparse arrays, accessors, inherited fields, symbols, proxies, and hostile reflection;
+- Unicode astral characters, Korean/CJK, combining marks, emoji, bidirectional text, empty/collapsed selectors, and grapheme boundaries;
+- immutable detached public values and redacted errors.
 
-### Editor tests
+### Editor and concurrency tests
 
-- decorations on exact ranges;
-- local transaction mapping and invalidation;
-- stale application rejection;
-- safe replacement and one-step undo;
-- no mutation on rejected input;
-- action callback content minimization;
-- no diagnostic generation from source text.
+- exact decoration attributes and no semantic ARIA derivation;
+- local and remote `docChanged` invalidation;
+- generation fencing for overlapping async verification;
+- exact application recheck, ordinary transaction, resulting revision, and one-step undo;
+- no mutation on rejected or stale input;
+- privacy-minimized action events and callback-failure containment;
+- zero diagnostics without host input.
 
 ### Accessibility tests
 
-- keyboard navigation and all actions;
-- named regions and controls;
-- focus restoration;
-- polite live status;
-- non-color-only rendering;
-- arrival of new diagnostics while focus remains stable.
+- named region, ordered list, count, category, priority, title, and explanation;
+- keyboard navigation, roving focus, and explicit actions;
+- no focus theft, polite status, conflict alert, forced colors, high contrast, reduced motion, print, zoom, and touch targets;
+- no visual-only or hover-only information.
 
-### Collaborative tests
+### Collaboration, package, and browser tests
 
-- local and remote edits;
-- Yjs remapping followed by revision rejection;
-- no awareness publication caused by diagnostics;
-- standalone/collaborative public API parity.
+- standalone/collaborative API parity and remote invalidation;
+- no diagnostics in Yjs awareness payloads;
+- SSR-safe shell and deterministic hydration;
+- packed ESM/CommonJS/strict-TypeScript consumers;
+- React-free `writing-diagnostics` subpath;
+- Chromium, Firefox, and WebKit evidence; and
+- exact 100% owned production statement, branch, function, and line coverage plus complete public JSDoc.
 
-### Package and browser tests
+## Performance constraints
 
-- packed ESM/CommonJS/type consumers;
-- React 18 and 19 host builds;
-- SSR/hydration;
-- Chromium, Firefox, and WebKit behavior;
-- production statement, branch, function, and line coverage at exactly 100%;
-- public declarations and JSDoc completeness.
+- Validation is linear in bounded diagnostic count and bounded projection size.
+- At most 256 active diagnostics are admitted by default.
+- One immutable snapshot and one revision derivation are shared across one verification generation.
+- No document clone or digest is repeated merely to render an already admitted set.
+- A document change invalidates rather than remaps the set, keeping v1 lifecycle cost deterministic.
+- Telemetry records counts and timing buckets, not authored text.
 
-## Performance constraints
+## Documentation and release requirements
+
+Implementation must synchronize root README, public API/JSDoc, PRD, TRD, API contract, architecture, threat model, operability, selector/revision guides, collaboration guide, test strategy, ADR index, traceability, CHANGELOG, package consumers, SBOM/provenance, rollback, and release evidence.
 
-- Validation is linear in diagnostic count plus bounded text projection work.
-- Decoration updates are incremental where ProseMirror supports it.
-- A configurable hard maximum prevents unbounded diagnostic decorations.
-- No source document clone or SHA-256 digest is repeated merely to render an already-admitted set.
-- Applying one proposal does not serialize the full document more times than required by the existing revision guard.
-- Performance telemetry records counts and timing buckets, not authored text.
-
-## Documentation updates required with implementation
-
-- root README and React editor examples;
-- public API declarations and JSDoc;
-- selection lifecycle and revision evidence guides;
-- accessibility guide;
-- collaboration guide;
-- security/privacy guidance;
-- package distribution and packed-consumer verification;
-- ADR index and documentation-fitness traceability;
-- CHANGELOG and release evidence.
+The feature remains `Unreleased`. It may ship only after the complete stack is reconciled onto protected main, temporary branch-specific workflows are removed, exact-head CI/security/coverage/package/browser evidence succeeds, zero valid findings remain, qualifying independent review exists, and a separate release-only PR publishes immutable artifacts.
 
 ## Out of scope
 
-- model invocation or model selection;
-- spelling dictionaries or grammar models;
+- model invocation, model selection, prompt construction, rubric ownership, judge calibration, or provider failover;
+- spelling dictionaries or deterministic grammar/tone classifiers;
 - email/thread/recipient semantics;
-- host policy or submission blocking;
-- persistent review sessions;
-- diagnostic aggregation across users;
-- human-review assignment;
-- provider billing and retention;
-- training or calibrating an LLM judge.
-
-Those responsibilities belong to the host or separate CWL services.
+- host submission, send, persistence, or compliance gates;
+- persistent review sessions and cross-user aggregation;
+- human-review assignment; and
+- provider billing, retention, or training.
 
 ## Primary references
 
-- W3C Web Annotation Data Model Recommendation for Unicode-code-point `TextPositionSelector` semantics and its warning that positions are brittle across resource changes.
-- TipTap v2 and ProseMirror documentation for immutable editor state, transactions, selections, decorations, and mapping.
-- RFC 9110 for strong entity-tag and conditional-write semantics used by Inkspan's revision boundary.
-- Inkspan ADR 0011 for the deterministic versus model-assisted authoring boundary.
+- W3C Web Annotation Data Model for Unicode-code-point `TextPositionSelector` semantics and its warning that positions are brittle across resource changes.
+- TipTap v2 and ProseMirror documentation for immutable editor state, transactions, selections, and decorations.
+- RFC 9110 for strong entity-tag semantics used by Inkspan revision evidence.
+- Inkspan ADR 0011 for deterministic versus model-assisted authoring.
 - Inkspan ADR 0018 for revision-scoped W3C selector authority.
+- Inkspan ADR 0027 and ADR 0028 for host semantic authority, strict invalidation, and semantic-neutral accessibility.
 - The accompanying doctoring record for LLM-judge bias and host calibration implications.
 
 ## Approval boundary
 
-Approval of this design authorizes an implementation plan, not production claims. The feature remains unshipped until protected `main` contains the implementation, documentation, exact 100% coverage evidence, packed-package verification, cross-engine evidence, security checks, review approval, and release reconciliation.
\ No newline at end of file
+Approval of this design authorizes implementation work, not production claims. The feature remains unshipped until protected main contains the reconciled implementation, canonical documentation, exact acceptance evidence, independent approval, and verified release artifacts.
diff --git a/src/adrQualityContract.test.ts b/src/adrQualityContract.test.ts
index 04dcef71..32664c2e 100644
--- a/src/adrQualityContract.test.ts
+++ b/src/adrQualityContract.test.ts
@@ -23,6 +23,8 @@ const requiredAdrHeadings = [
   /^## Rollback or supersession(?:\b|\s|$)/mu,
 ] as const;
 
+const ADR_STATUS = /^Status: (Proposed|Accepted|Superseded)$/mu;
+
 describe('ADR quality documentation contract', () => {
   it('preserves the canonical ADR quality requirements on every reconciliation branch', () => {
     const adrIndex = repositoryFile('docs/adr/README.md');
@@ -37,6 +39,25 @@ describe('ADR quality documentation contract', () => {
     expect(adrIndex).toContain('rollback or explicit supersession conditions');
   });
 
+  it('indexes every detailed ADR with its exact file and status', () => {
+    const adrIndex = repositoryFile('docs/adr/README.md');
+    const adrFiles = detailedAdrFiles();
+
+    expect(adrFiles.length).toBeGreaterThan(0);
+
+    for (const adrFile of adrFiles) {
+      const adr = repositoryFile(`docs/adr/${adrFile}`);
+      const status = adr.match(ADR_STATUS)?.[1];
+      const adrNumber = adrFile.slice(0, 4);
+
+      expect(status, `${adrFile} has no canonical status`).toBeDefined();
+      expect(
+        adrIndex,
+        `${adrFile} is missing from the ADR index or has a stale status`,
+      ).toContain(`| [${adrNumber}](${adrFile}) | ${status} |`);
+    }
+  });
+
   it('applies the canonical quality sections to every detailed ADR', () => {
     const adrFiles = detailedAdrFiles();
 
diff --git a/src/collaboration/CollaborativeCwlEditor.writingDiagnostics.boundary.test.tsx b/src/collaboration/CollaborativeCwlEditor.writingDiagnostics.boundary.test.tsx
index 249f683e..a6c2e519 100644
--- a/src/collaboration/CollaborativeCwlEditor.writingDiagnostics.boundary.test.tsx
+++ b/src/collaboration/CollaborativeCwlEditor.writingDiagnostics.boundary.test.tsx
@@ -104,6 +104,14 @@ function providerWith(awareness: FakeAwareness): CollaborationProviderLike {
   return { awareness };
 }
 
+function reactActWarnings(
+  consoleError: ReturnType<typeof vi.spyOn>,
+): string[] {
+  return consoleError.mock.calls
+    .map((arguments_) => arguments_.map(String).join(' '))
+    .filter((message) => message.includes('not wrapped in act'));
+}
+
 afterEach(() => {
   vi.restoreAllMocks();
   cleanup();
@@ -266,6 +274,9 @@ describe('CollaborativeCwlEditor writing-diagnostic boundaries', () => {
   });
 
   it('emits an Apply action only on the client that explicitly invoked it', async () => {
+    const consoleError = vi
+      .spyOn(console, 'error')
+      .mockImplementation(() => undefined);
     const leftDocument = new Y.Doc();
     const rightDocument = new Y.Doc();
     const disconnect = connectDocuments(leftDocument, rightDocument);
@@ -317,9 +328,15 @@ describe('CollaborativeCwlEditor writing-diagnostic boundaries', () => {
       ).toHaveTextContent('1 writing diagnostics');
     });
 
-    await expect(
-      rightRef.current!.applyWritingDiagnostic('shared-diagnostic'),
-    ).resolves.toMatchObject({
+    let appliedAction:
+      | Awaited<ReturnType<CwlEditorHandle['applyWritingDiagnostic']>>
+      | undefined;
+    await act(async () => {
+      appliedAction = await rightRef.current!.applyWritingDiagnostic(
+        'shared-diagnostic',
+      );
+    });
+    expect(appliedAction).toMatchObject({
       action: 'applied',
       reasonCode: 'explicit',
       diagnosticId: 'shared-diagnostic',
@@ -330,6 +347,7 @@ describe('CollaborativeCwlEditor writing-diagnostic boundaries', () => {
     });
     expect(rightAction).toHaveBeenCalledTimes(1);
     expect(leftAction).not.toHaveBeenCalled();
+    expect(reactActWarnings(consoleError)).toEqual([]);
 
     mounted.unmount();
     disconnect();
diff --git a/src/components/WritingDiagnosticsPanel.dismissFocus.test.tsx b/src/components/WritingDiagnosticsPanel.dismissFocus.test.tsx
new file mode 100644
index 00000000..53b529ce
--- /dev/null
+++ b/src/components/WritingDiagnosticsPanel.dismissFocus.test.tsx
@@ -0,0 +1,174 @@
+import { useState } from 'react';
+import {
+  act,
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+} from '@testing-library/react';
+import { afterEach, describe, expect, it } from 'vitest';
+import type {
+  CwlVerifiedWritingDiagnostic,
+  WritingDiagnosticsController,
+} from './useWritingDiagnosticsController.js';
+import { WritingDiagnosticsPanel } from './WritingDiagnosticsPanel.js';
+
+const digestHex = '4a'.repeat(32);
+const documentRevision = Object.freeze({
+  algorithm: 'SHA-256' as const,
+  digestHex,
+  strongEntityTag: `"sha256-${digestHex}"`,
+});
+const textProjection = Object.freeze({
+  id: 'inkspan-prosemirror-text' as const,
+  version: 1 as const,
+});
+
+function verifiedDiagnostic(
+  diagnosticId: string,
+  title: string,
+): CwlVerifiedWritingDiagnostic {
+  return Object.freeze({
+    diagnostic: Object.freeze({
+      diagnosticId,
+      documentRevision,
+      textProjection,
+      selector: Object.freeze({
+        type: 'TextPositionSelector' as const,
+        start: 0,
+        end: 4,
+      }),
+      categoryCode: 'clarity',
+      priority: 'advisory' as const,
+      title,
+      explanation: 'Clarify the intended decision.',
+      provenance: Object.freeze({
+        workflowId: 'writing-review',
+        workflowVersion: '1',
+        judgePolicyVersion: '1',
+      }),
+    }),
+    from: 1,
+    to: 5,
+  });
+}
+
+function Harness({
+  initialDiagnostics,
+}: Readonly<{ initialDiagnostics: readonly CwlVerifiedWritingDiagnostic[] }>) {
+  const [diagnostics, setDiagnostics] = useState(initialDiagnostics);
+  const controller: WritingDiagnosticsController = {
+    status: 'active',
+    generation: 7,
+    editor: null,
+    diagnostics,
+    digestProvider: null,
+    focusDiagnostic: () => true,
+    applyDiagnostic: async () => null,
+    ignoreDiagnostic: () => null,
+    dismissDiagnostic: (diagnosticId) => {
+      const target = diagnostics.find(
+        (candidate) => candidate.diagnostic.diagnosticId === diagnosticId,
+      );
+      if (target === undefined) return null;
+      setDiagnostics((current) =>
+        current.filter(
+          (candidate) => candidate.diagnostic.diagnosticId !== diagnosticId,
+        ),
+      );
+      return Object.freeze({
+        action: 'dismissed' as const,
+        reasonCode: 'explicit' as const,
+        diagnosticId,
+        documentRevision: target.diagnostic.documentRevision,
+        categoryCode: target.diagnostic.categoryCode,
+        generation: 8,
+      });
+    },
+    requestDiagnosticExplanation: () => null,
+  };
+
+  return (
+    <WritingDiagnosticsPanel controller={controller} label="Writing guidance" />
+  );
+}
+
+function focusButton(button: HTMLElement): void {
+  act(() => {
+    button.focus();
+  });
+}
+
+async function dismissDiagnostic(button: HTMLElement): Promise<void> {
+  await act(async () => {
+    fireEvent.click(button);
+    await Promise.resolve();
+  });
+}
+
+afterEach(cleanup);
+
+describe('WritingDiagnosticsPanel dismissal focus', () => {
+  it('moves focus to the next diagnostic when the focused card is dismissed', async () => {
+    render(
+      <Harness
+        initialDiagnostics={[
+          verifiedDiagnostic('first', 'First diagnostic'),
+          verifiedDiagnostic('second', 'Second diagnostic'),
+        ]}
+      />,
+    );
+
+    const dismiss = screen.getByRole('button', { name: 'Dismiss First diagnostic' });
+    focusButton(dismiss);
+    expect(dismiss).toHaveFocus();
+
+    await dismissDiagnostic(dismiss);
+
+    const items = screen.getAllByRole('listitem');
+    expect(items).toHaveLength(1);
+    expect(items[0]).toHaveTextContent('Second diagnostic');
+    expect(items[0]).toHaveFocus();
+  });
+
+  it('moves focus to the previous diagnostic when the last card is dismissed', async () => {
+    render(
+      <Harness
+        initialDiagnostics={[
+          verifiedDiagnostic('first', 'First diagnostic'),
+          verifiedDiagnostic('second', 'Second diagnostic'),
+        ]}
+      />,
+    );
+
+    const dismiss = screen.getByRole('button', { name: 'Dismiss Second diagnostic' });
+    focusButton(dismiss);
+    expect(dismiss).toHaveFocus();
+
+    await dismissDiagnostic(dismiss);
+
+    const items = screen.getAllByRole('listitem');
+    expect(items).toHaveLength(1);
+    expect(items[0]).toHaveTextContent('First diagnostic');
+    expect(items[0]).toHaveFocus();
+  });
+
+  it('moves focus to the guidance region when the only card is dismissed', async () => {
+    render(
+      <Harness
+        initialDiagnostics={[verifiedDiagnostic('only', 'Only diagnostic')]}
+      />,
+    );
+
+    const dismiss = screen.getByRole('button', { name: 'Dismiss Only diagnostic' });
+    focusButton(dismiss);
+    expect(dismiss).toHaveFocus();
+
+    await dismissDiagnostic(dismiss);
+
+    expect(screen.queryAllByRole('listitem')).toHaveLength(0);
+    expect(
+      screen.getByRole('region', { name: 'Writing guidance' }),
+    ).toHaveFocus();
+  });
+});
diff --git a/src/components/editorFormSerialization.test.tsx b/src/components/editorFormSerialization.test.tsx
index d317bba3..d8968928 100644
--- a/src/components/editorFormSerialization.test.tsx
+++ b/src/components/editorFormSerialization.test.tsx
@@ -8,7 +8,10 @@ import type { CwlEditorHandle } from '../types.js';
 import { CwlEditor } from './CwlEditor.js';
 import { EditorFormField } from './EditorFormField.js';
 
-afterEach(cleanup);
+afterEach(() => {
+  vi.restoreAllMocks();
+  cleanup();
+});
 
 function submittedValue(
   form: HTMLFormElement,
@@ -18,13 +21,24 @@ function submittedValue(
 }
 
 async function dispatchReset(form: HTMLFormElement): Promise<boolean> {
-  const allowed = form.dispatchEvent(
-    new Event('reset', { bubbles: true, cancelable: true }),
-  );
-  await new Promise<void>((resolve) => setTimeout(resolve, 0));
+  let allowed = false;
+  await act(async () => {
+    allowed = form.dispatchEvent(
+      new Event('reset', { bubbles: true, cancelable: true }),
+    );
+    await new Promise<void>((resolve) => setTimeout(resolve, 0));
+  });
   return allowed;
 }
 
+function reactActWarnings(
+  consoleError: ReturnType<typeof vi.spyOn>,
+): string[] {
+  return consoleError.mock.calls
+    .map((arguments_) => arguments_.map(String).join(' '))
+    .filter((message) => message.includes('not wrapped in act'));
+}
+
 describe('native form serialization', () => {
   it('renders an empty native field safely before an editor or form exists', () => {
     const { container } = render(
@@ -302,6 +316,9 @@ describe('native form serialization', () => {
   });
 
   it('reports collaborative form resets without mutating shared state', async () => {
+    const consoleError = vi
+      .spyOn(console, 'error')
+      .mockImplementation(() => undefined);
     const collaborationDocument = new Y.Doc();
     const editorRef = createRef<CwlEditorHandle>();
     const onFormReset = vi.fn();
@@ -333,8 +350,9 @@ describe('native form serialization', () => {
     expect(onFormReset).toHaveBeenCalledTimes(1);
     expect(editorRef.current!.getValue()).toContain('Shared body');
     expect(String(submittedValue(form, 'shared_body'))).toContain('Shared body');
+    expect(reactActWarnings(consoleError)).toEqual([]);
 
     unmount();
     collaborationDocument.destroy();
   });
-});
\ No newline at end of file
+});
diff --git a/src/printStyles.test.ts b/src/printStyles.test.ts
index 8d08d4db..78a85077 100644
--- a/src/printStyles.test.ts
+++ b/src/printStyles.test.ts
@@ -79,6 +79,12 @@ describe('print stylesheet contract', () => {
     );
   });
 
+  it('keeps the empty-guidance focus handoff visibly perceivable', () => {
+    expect(styles).toMatch(
+      /\.cwl-writing-diagnostics:focus-visible[\s\S]*\{[^}]*outline:\s*2px solid var\(--cwl-accent\)\s*;[^}]*outline-offset:\s*2px\s*;/u,
+    );
+  });
+
   it('preserves forced-colors, reduced-motion, and touch-target guidance', () => {
     expect(styles).toMatch(
       /@media\s*\(forced-colors:\s*active\)[\s\S]*\.cwl-writing-diagnostic[\s\S]*CanvasText/u,
diff --git a/src/styles.css b/src/styles.css
index 3b1efbd9..470f30c3 100644
--- a/src/styles.css
+++ b/src/styles.css
@@ -110,6 +110,7 @@
 
 @media (forced-colors: active) {
   .cwl-tb-btn:focus-visible,
+  .cwl-writing-diagnostics:focus-visible,
   .cwl-writing-diagnostics__item:focus-visible,
   .cwl-writing-diagnostics__actions button:focus-visible,
   .cwl-writing-diagnostics__navigation-button:focus-visible {
@@ -357,6 +358,7 @@
   border-left-color: var(--cwl-critical);
 }
 
+.cwl-writing-diagnostics:focus-visible,
 .cwl-writing-diagnostics__item:focus-visible,
 .cwl-writing-diagnostics__actions button:focus-visible,
 .cwl-writing-diagnostics__navigation-button:focus-visible {
@@ -545,4 +547,4 @@
     break-inside: avoid;
     border-color: #000000;
   }
-}
+}
\ No newline at end of file
diff --git a/src/writingDiagnosticsDocumentationContract.test.ts b/src/writingDiagnosticsDocumentationContract.test.ts
new file mode 100644
index 00000000..9de70450
--- /dev/null
+++ b/src/writingDiagnosticsDocumentationContract.test.ts
@@ -0,0 +1,105 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+/** Read one authoritative repository text artifact for deterministic assertions. */
+function repositoryFile(path: string): string {
+  return readFileSync(resolve(process.cwd(), path), 'utf8');
+}
+
+/**
+ * Collapse prose whitespace and code-span punctuation without weakening words.
+ *
+ * Markdown authors may correctly wrap identifiers such as `docChanged` or
+ * `aria-invalid` in code spans. The documentation contract checks the semantic
+ * prose, not that presentational punctuation choice.
+ */
+function normalizeProse(value: string): string {
+  return value.replace(/`/gu, '').replace(/\s+/gu, ' ').trim();
+}
+
+const designPath =
+  'docs/superpowers/specs/2026-08-12-revision-bound-llm-writing-diagnostics-design.md';
+const planPath =
+  'docs/superpowers/plans/2026-08-12-writing-diagnostics-implementation.md';
+const adrPath = 'docs/adr/0027-host-owned-llm-writing-diagnostics.md';
+const supersedingAdrPath =
+  'docs/adr/0028-writing-diagnostics-v1-strict-invalidation.md';
+
+describe('writing diagnostics documentation contract', () => {
+  it('keeps the public design examples synchronized with the implemented v1 types', () => {
+    const design = repositoryFile(designPath);
+
+    expect(design).toContain(
+      "export type CwlWritingDiagnosticPriority =\n  | 'advisory'\n  | 'important'\n  | 'critical';",
+    );
+    expect(design).toContain(
+      'readonly documentRevision: CwlEditorDocumentRevision;',
+    );
+    expect(design).toContain(
+      'readonly textProjection: CwlEditorTextProjectionIdentity;',
+    );
+    expect(design).toContain('readonly judgePolicyVersion: string;');
+    expect(design).toContain(
+      'readonly reasonCode: CwlWritingDiagnosticActionReasonCode;',
+    );
+    expect(design).toContain('readonly generation: number;');
+    expect(design).not.toContain(
+      "export type CwlWritingDiagnosticPriority = 'suggestion' | 'important';",
+    );
+    expect(design).not.toContain('readonly documentRevision: string;');
+    expect(design).not.toContain(
+      "readonly projectionName: 'inkspan-prosemirror-text';",
+    );
+    expect(design).not.toContain("readonly status: 'completed'");
+  });
+
+  it('requires strict invalidation and semantic-neutral decoration guidance everywhere', () => {
+    const design = normalizeProse(repositoryFile(designPath));
+    const plan = repositoryFile(planPath);
+    const adr = normalizeProse(repositoryFile(adrPath));
+    const supersedingAdr = normalizeProse(repositoryFile(supersedingAdrPath));
+
+    const strictInvalidation =
+      'Every local or collaborative transaction with docChanged === true invalidates the complete active diagnostic generation.';
+    const semanticNeutrality =
+      'Inkspan does not derive aria-invalid or any other semantic accessibility state from opaque host strings.';
+
+    expect(design).toContain(strictInvalidation);
+    expect(adr).toContain(strictInvalidation);
+    expect(supersedingAdr).toContain(
+      'every transaction with docChanged === true, whether local or collaborative, invalidates the complete active diagnostic generation',
+    );
+    expect(design).toContain(semanticNeutrality);
+    expect(adr).toContain(semanticNeutrality);
+
+    expect(design).not.toContain('Inkspan may keep a diagnostic current');
+    expect(design).not.toContain('local transaction mapping and invalidation');
+    expect(design).not.toContain('Yjs remapping followed by revision rejection');
+    expect(adr).not.toContain(
+      'decoration mapping through local ProseMirror transactions',
+    );
+    expect(adr).not.toContain('A safely mapped local transaction may preserve');
+    expect(adr).not.toContain('valid transaction-local mapping');
+    expect(plan).not.toContain('aria-invalid="spelling"');
+  });
+
+  it('documents collapsed selectors and one-action-at-a-time application without batch authority', () => {
+    const design = normalizeProse(repositoryFile(designPath));
+    const adr = normalizeProse(repositoryFile(adrPath));
+
+    expect(design).toContain(
+      'selector values are non-negative safe integers with start <= end',
+    );
+    expect(design).toContain(
+      'Version 1 applies exactly one explicitly selected diagnostic at a time.',
+    );
+    expect(adr).toContain(
+      'Version 1 applies exactly one explicitly selected diagnostic at a time.',
+    );
+    expect(design).not.toContain('a bounded batch application');
+    expect(design).not.toContain('batch_overlap');
+    expect(adr).not.toContain('Apply all');
+  });
+});

From c6c2799b8e80cd84d2b955ae4ec13589bc599f40 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 22:54:05 +0900
Subject: [PATCH 42/54] test(ci): inherit current main pnpm bootstrap contract

---
 src/ciPnpmBootstrapContract.test.ts | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 src/ciPnpmBootstrapContract.test.ts

diff --git a/src/ciPnpmBootstrapContract.test.ts b/src/ciPnpmBootstrapContract.test.ts
new file mode 100644
index 00000000..17c31324
--- /dev/null
+++ b/src/ciPnpmBootstrapContract.test.ts
@@ -0,0 +1,20 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+const workflow = readFileSync(
+  resolve(process.cwd(), '.github/workflows/ci.yml'),
+  'utf8',
+);
+const SAFE_PNPM_ACTION_PIN =
+  'pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10';
+const VULNERABLE_PNPM_ACTION_PIN =
+  'pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8';
+
+describe('CI pnpm bootstrap contract', () => {
+  it('uses the signed non-vulnerable action in every JavaScript job', () => {
+    expect(workflow.match(new RegExp(SAFE_PNPM_ACTION_PIN, 'g'))).toHaveLength(2);
+    expect(workflow).not.toContain(VULNERABLE_PNPM_ACTION_PIN);
+  });
+});

From e4a121ace6beff4eef35aea3d6f6b3ab498e55b4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 22:54:32 +0900
Subject: [PATCH 43/54] chore(ci): inherit current main release security
 contracts

---
 .github/workflows/ci.yml               |   4 +-
 docs/release-security.md               |  53 +++++++---
 src/releaseDraftAssetEntryType.test.ts |   6 +-
 src/releaseDraftAssetInventory.test.ts |   9 +-
 src/releaseSbomContract.test.ts        | 130 +++++++++++++++++++++++++
 src/releaseWorkflowSyntax.test.ts      |  15 +++
 6 files changed, 197 insertions(+), 20 deletions(-)
 create mode 100644 src/releaseSbomContract.test.ts
 create mode 100644 src/releaseWorkflowSyntax.test.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 35ca6560..210bbdb8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
       # pnpm version comes from the package.json "packageManager" field
       # (pnpm 10+), which is required to read `overrides` from
       # pnpm-workspace.yaml consistently with the committed lockfile.
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
@@ -55,7 +55,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
diff --git a/docs/release-security.md b/docs/release-security.md
index 5e1e0157..08e1d6ff 100644
--- a/docs/release-security.md
+++ b/docs/release-security.md
@@ -1,6 +1,6 @@
 # Release security and provenance contract
 
-Inkspan release artifacts are part of the product boundary. Buyers and CWL/naruon integrators must be able to determine which source revision produced an npm tarball or Office wheel, verify that the artifact was not substituted, and reproduce the repository's release gates without trusting a long-lived publication secret.
+Inkspan release artifacts are part of the product boundary. Buyers and CWL/naruon integrators must be able to determine which source revision produced an npm tarball or Office wheel, inspect the release SBOM, verify that no artifact was substituted, and reproduce the repository's release gates without trusting a long-lived publication secret.
 
 ## Release trigger and identity
 
@@ -20,7 +20,7 @@ For stable registry releases, the root and Office package versions must both equ
 
 The GitHub Release path has a source-bearing build stage followed by a source-free publication stage, and external registry publication is downstream of that validated artifact boundary:
 
-1. `build-release-artifacts` has read-only repository access. It checks identity, installs dependencies, runs all quality gates, builds both distributions, and creates checksums.
+1. `build-release-artifacts` has read-only repository access. It checks identity, installs dependencies, runs all quality gates, builds both distributions, generates an SPDX 2.3 SBOM with signature-verified Syft, validates the SBOM, and creates checksums for the complete release set.
 2. `publish-release` receives only the validated files through GitHub's workflow artifact service. This smaller job alone receives the GitHub release, OpenID Connect, and attestation authority needed to create the immutable GitHub Release.
 3. `publish-npm` and `publish-pypi` consume the same validated npm tarball and Office wheel after the GitHub Release boundary. They receive OIDC only inside their protected registry environments and do not rebuild the packages.
 4. `verify-registry-publication` has no publishing credential. It performs post-publication digest verification against the public npm and PyPI registry identities and the exact validated local artifacts.
@@ -44,13 +44,23 @@ The release workflow repeats merge and product gates against the tagged source r
 9. hash-locked Office dependency installation on Python 3.14 for the release build;
 10. Office dependency consistency, 100% shipped-symbol docstring coverage, and 100% branch coverage;
 11. Office wheel construction and inspection for the bundled schema and license;
-12. SHA-256 checksum generation for every distributable artifact;
-13. checksum verification after the privilege boundary;
-14. exact draft asset inventory and digest verification before GitHub publication; and
-15. public npm and PyPI post-publication digest verification for stable registry releases.
+12. installation of the exact Syft v1.50.0 release through its commit-pinned installer with Cosign verification enabled, so the signed checksum material is verified before the Syft binary is accepted;
+13. deterministic SPDX 2.3 SBOM generation and validation for a non-empty inventory containing both `@contextualwisdomlab/cwl-editor` and `inkspan-office`;
+14. SHA-256 checksum generation for the npm tarball, Office wheel, `inkspan.spdx.json`, and checksum manifest boundary;
+15. checksum verification after the privilege boundary;
+16. exact draft asset inventory and digest verification before GitHub publication; and
+17. public npm and PyPI post-publication digest verification for stable registry releases.
 
 No release draft is created or modified unless every source-bearing build gate succeeds on the tagged commit. A stable release is not treated as registry-complete until both registry publication jobs and the downstream public digest verification succeed.
 
+## SBOM generator trust boundary
+
+The release path does not delegate Syft installation to an action that can retrieve a mutable installer from another branch. It installs Cosign from a full-commit-pinned `sigstore/cosign-installer` action, downloads Syft's installer from the exact commit behind the annotated `v1.50.0` tag, disables installer-script redirection with `DOWNLOAD_TAG_INSTALL_SCRIPT=false`, and invokes the installer with `-v`. The Syft installer therefore verifies the release checksum signature and certificate before accepting the downloaded Syft binary, then still verifies the binary checksum.
+
+Only that signature-verified Syft executable is added to the workflow `PATH` and used to generate `release/inkspan.spdx.json`. The workflow then validates the SPDX version, package inventory, expected Inkspan package identities, and the bounded attestation-input size before the SBOM can cross the build/publication privilege boundary.
+
+This controls the generator bootstrap path; it does not assert that an SBOM is a vulnerability scan or license-policy decision. Consumers and release operators must interpret the inventory separately from provenance and security-scan results.
+
 ## Immutable GitHub publication
 
 Immutable releases must be enabled for the canonical repository before a release tag is pushed. Reading or changing that repository setting requires Administration permission, which the release workflow intentionally does not receive. Instead, the workflow verifies the immutable state of the published release through the ordinary release API available to its narrowly scoped contents token.
@@ -71,11 +81,12 @@ A resumed draft is not assumed to contain only artifacts from the current workfl
 
 Immediately after upload and before the draft is published, the workflow therefore fails closed unless all of these conditions hold:
 
-- the local release directory contains exactly one npm `*.tgz`, one Office `*.whl`, and `SHA256SUMS`;
+- the local release directory contains exactly one npm `*.tgz`, one Office `*.whl`, `inkspan.spdx.json`, and `SHA256SUMS`;
+- `SHA256SUMS` binds the npm tarball, Office wheel, and SBOM digest to the transferred local release set;
 - the canonical GitHub Releases API still reports the release as a draft;
 - the sorted remote asset-name set exactly equals the sorted local artifact-name set;
 - every remote asset reports the `uploaded` state; and
-- every GitHub release-asset `sha256:` digest exactly equals a newly computed SHA-256 digest of the corresponding transferred local file.
+- every GitHub release-asset `sha256:` digest, including the SBOM digest and checksum-manifest digest, exactly equals a newly computed SHA-256 digest of the corresponding transferred local file.
 
 The draft lookup deliberately uses the authenticated, paginated **List releases** REST endpoint and filters its complete result for the exact tag. GitHub documents that authenticated callers with repository push access receive draft releases from this endpoint. The `Get a release by tag name` endpoint is documented for a **published** release, so it is not used as evidence for this pre-publication gate. The publish job fails unless the paginated listing contains exactly one release matching the tag and that object still reports `draft: true`.
 
@@ -91,19 +102,20 @@ Enabling immutable releases is an administrative repository control. Repository
 
 ## Published artifacts
 
-Each successful GitHub release contains:
+Each successful GitHub release contains exactly four files:
 
 - the exact npm tarball produced by `npm pack`;
-- the `inkspan-office` wheel built from `office/`; and
-- `SHA256SUMS` covering both distributable artifacts.
+- the `inkspan-office` wheel built from `office/`;
+- `inkspan.spdx.json`, the validated SPDX 2.3 SBOM generated by signature-verified Syft; and
+- `SHA256SUMS` covering the npm tarball, Office wheel, and SBOM.
 
-The workflow does not rebuild artifacts after the read-only build job. The same transferred files are checksum-verified, attested, uploaded, inventory-checked against the draft, published to GitHub, and—on stable releases—forwarded to npm and PyPI.
+The workflow does not rebuild artifacts after the read-only build job. The same transferred files are checksum-verified, attested, uploaded, inventory-checked against the draft, and published to GitHub; on stable releases, the npm tarball and Office wheel are then forwarded unchanged to npm and PyPI.
 
 ## Provenance and verification
 
-The isolated GitHub publication job requests a short-lived OpenID Connect identity and uses GitHub artifact attestations to create signed SLSA provenance for the npm tarball, Office wheel, and checksum manifest. The repository is public, so the attestation is backed by the public Sigstore transparency infrastructure used by GitHub.
+The isolated GitHub publication job requests a short-lived OpenID Connect identity and uses GitHub artifact attestations to create signed SLSA provenance for the npm tarball, Office wheel, `inkspan.spdx.json`, and checksum manifest. It also creates SPDX SBOM attestations binding the npm tarball and Office wheel to the validated `inkspan.spdx.json` predicate. The repository is public, so the attestation is backed by the public Sigstore transparency infrastructure used by GitHub.
 
-Consumers should verify release-level and file-level provenance as well as checksums, using the actual version and filenames from the selected release:
+Consumers should verify release-level and file-level provenance, the SBOM predicate, and checksums, using the actual version and filenames from the selected release:
 
 ```bash
 VERSION=0.6.0
@@ -113,9 +125,16 @@ gh release verify "v${VERSION}" --repo ContextualWisdomLab/inkspan
 gh release verify-asset "v${VERSION}" "contextualwisdomlab-cwl-editor-${VERSION}.tgz" \
   --repo ContextualWisdomLab/inkspan
 
+gh release verify-asset "v${VERSION}" "inkspan.spdx.json" \
+  --repo ContextualWisdomLab/inkspan
+
 gh attestation verify "inkspan_office-${VERSION}-py3-none-any.whl" \
   --repo ContextualWisdomLab/inkspan
 
+gh attestation verify "contextualwisdomlab-cwl-editor-${VERSION}.tgz" \
+  --repo ContextualWisdomLab/inkspan \
+  --predicate-type https://spdx.dev/Document/v2.3
+
 sha256sum --check SHA256SUMS
 ```
 
@@ -134,11 +153,15 @@ npm and PyPI are independent immutable publication domains. If one registry acce
 ## Workflow security properties
 
 - Every third-party GitHub Action is pinned to a complete commit SHA.
+- Syft is installed from the exact commit behind v1.50.0 with signed-checksum verification enabled; a mutable branch installer is not part of the supported generator path.
+- Only the signature-verified Syft binary generates the release SBOM.
 - The default and source-bearing build-job workflow tokens are read-only.
 - GitHub release, OpenID Connect, and attestation permissions are scoped to the source-free jobs that actually require them.
 - Release tags must identify the exact current protected-main tip.
 - Stable root, Office, and tag versions must match before registry publication.
+- The local and draft release contract is exactly one npm tarball, one Office wheel, `inkspan.spdx.json`, and `SHA256SUMS`.
 - The draft asset set and every GitHub-reported SHA-256 asset digest must exactly match the transferred local release set before GitHub publication.
+- The SBOM digest is covered by `SHA256SUMS`, remote release-asset digest verification, and release provenance; package attestations additionally bind the distributable packages to the SPDX predicate.
 - The published GitHub release must report an immutable state; a mutable outcome is deleted and rejected.
 - Existing published assets are never refreshed, replaced, or deleted by a successful workflow path.
 - Stable npm and PyPI publication uses protected OIDC environments rather than long-lived registry secrets.
@@ -161,6 +184,8 @@ The release pipeline does not add runtime coupling. The npm package remains a ho
 - GitHub release attestation verification: <https://cli.github.com/manual/gh_release_verify>
 - GitHub artifact attestations: <https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations>
 - GitHub artifact-attestation concepts: <https://docs.github.com/en/actions/concepts/security/artifact-attestations>
+- Syft signed-release installer verification: <https://github.com/anchore/syft/blob/v1.50.0/install.sh>
+- Sigstore Cosign installer: <https://github.com/sigstore/cosign-installer>
 - npm Trusted Publishing and automatic provenance: <https://docs.npmjs.com/trusted-publishers/>
 - PyPI Trusted Publishing: <https://docs.pypi.org/trusted-publishers/>
 - PyPI Trusted Publishing security model: <https://docs.pypi.org/trusted-publishers/security-model/>
diff --git a/src/releaseDraftAssetEntryType.test.ts b/src/releaseDraftAssetEntryType.test.ts
index 4b1d9dd3..be84fbb1 100644
--- a/src/releaseDraftAssetEntryType.test.ts
+++ b/src/releaseDraftAssetEntryType.test.ts
@@ -56,6 +56,10 @@ function runLocalReleaseInventory(
     mkdirSync(releaseDirectory);
     writeFileSync(join(releaseDirectory, 'inkspan.tgz'), 'npm-package');
     writeFileSync(join(releaseDirectory, 'inkspan_office.whl'), 'office-wheel');
+    writeFileSync(
+      join(releaseDirectory, 'inkspan.spdx.json'),
+      '{"spdxVersion":"SPDX-2.3","packages":[]}',
+    );
     writeFileSync(join(releaseDirectory, 'SHA256SUMS'), 'checksums');
     mutate?.(releaseDirectory);
 
@@ -74,7 +78,7 @@ function runLocalReleaseInventory(
 }
 
 describe('local release artifact entry-type boundary', () => {
-  it('accepts exactly the three expected regular release files', () => {
+  it('accepts exactly the four expected regular release files', () => {
     if (process.platform !== 'linux') return;
 
     const result = runLocalReleaseInventory();
diff --git a/src/releaseDraftAssetInventory.test.ts b/src/releaseDraftAssetInventory.test.ts
index 972abe0f..ff785fee 100644
--- a/src/releaseDraftAssetInventory.test.ts
+++ b/src/releaseDraftAssetInventory.test.ts
@@ -79,6 +79,7 @@ function runReleaseInventory(
     const localFiles = {
       'inkspan.tgz': 'npm-package',
       'inkspan_office.whl': 'office-wheel',
+      'inkspan.spdx.json': '{"spdxVersion":"SPDX-2.3","packages":[]}',
       SHA256SUMS: 'checksums',
     } as const;
     for (const [name, content] of Object.entries(localFiles)) {
@@ -153,9 +154,10 @@ describe('release draft asset inventory contract', () => {
       localValidationIndex,
       attestIndex,
     );
-    expect(localValidationStep).toContain('expected_asset_count=3');
+    expect(localValidationStep).toContain('expected_asset_count=4');
     expect(localValidationStep).toContain('*.tgz');
     expect(localValidationStep).toContain('*.whl');
+    expect(localValidationStep).toContain('inkspan.spdx.json');
     expect(localValidationStep).toContain('SHA256SUMS');
     expect(localValidationStep).toContain(
       'Unexpected local release artifact set',
@@ -195,7 +197,7 @@ describe('release draft asset inventory contract', () => {
     expect(inventoryStep).toContain('Draft release asset digest mismatch');
   });
 
-  it('admits only the expected npm, wheel, and checksum artifact set', () => {
+  it('admits only the expected npm, wheel, SBOM, and checksum artifact set', () => {
     const inventoryIndex = workflow.indexOf(
       '- name: Verify exact draft release asset inventory',
     );
@@ -204,9 +206,10 @@ describe('release draft asset inventory contract', () => {
     );
     const inventoryStep = workflow.slice(inventoryIndex, publishIndex);
 
-    expect(inventoryStep).toContain('expected_asset_count=3');
+    expect(inventoryStep).toContain('expected_asset_count=4');
     expect(inventoryStep).toContain('*.tgz');
     expect(inventoryStep).toContain('*.whl');
+    expect(inventoryStep).toContain('inkspan.spdx.json');
     expect(inventoryStep).toContain('SHA256SUMS');
     expect(inventoryStep).toContain('Unexpected local release artifact set');
     expect(inventoryStep).toContain("asset_name='.assets[].name'");
diff --git a/src/releaseSbomContract.test.ts b/src/releaseSbomContract.test.ts
new file mode 100644
index 00000000..e9575127
--- /dev/null
+++ b/src/releaseSbomContract.test.ts
@@ -0,0 +1,130 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+/** Read one authoritative repository file as UTF-8 text. */
+function repositoryFile(path: string): string {
+  return readFileSync(resolve(process.cwd(), path), 'utf8');
+}
+
+const workflow = repositoryFile('.github/workflows/release.yml');
+
+describe('release SBOM contract', () => {
+  it('signature-verifies the pinned Syft release before generating the SBOM', () => {
+    const cosignIndex = workflow.indexOf('- name: Install Cosign');
+    const syftInstallIndex = workflow.indexOf(
+      '- name: Install signature-verified Syft',
+    );
+    const generationIndex = workflow.indexOf('- name: Generate release SBOM');
+    const validationIndex = workflow.indexOf('- name: Validate release SBOM');
+
+    expect(cosignIndex).toBeGreaterThan(-1);
+    expect(syftInstallIndex).toBeGreaterThan(cosignIndex);
+    expect(generationIndex).toBeGreaterThan(syftInstallIndex);
+    expect(validationIndex).toBeGreaterThan(generationIndex);
+
+    const cosignStep = workflow.slice(cosignIndex, syftInstallIndex);
+    expect(cosignStep).toContain(
+      'sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6',
+    );
+    expect(cosignStep).toContain("cosign-release: 'v3.0.6'");
+
+    const syftInstallStep = workflow.slice(syftInstallIndex, generationIndex);
+    expect(syftInstallStep).toContain(
+      'https://raw.githubusercontent.com/anchore/syft/16223e6dd7893fe578787658ceb876257483d404/install.sh',
+    );
+    expect(syftInstallStep).toContain('DOWNLOAD_TAG_INSTALL_SCRIPT=false');
+    expect(syftInstallStep).toContain(
+      'sh "$syft_installer" -v -b "$RUNNER_TEMP/syft-bin" v1.50.0',
+    );
+    expect(syftInstallStep).toContain('"$RUNNER_TEMP/syft-bin/syft" version');
+
+    const generationStep = workflow.slice(generationIndex, validationIndex);
+    expect(generationStep).not.toContain('anchore/sbom-action@');
+    expect(generationStep).toContain(
+      'syft scan dir:. -o spdx-json > release/inkspan.spdx.json',
+    );
+  });
+
+  it('generates and validates one deterministic SPDX JSON SBOM before checksums', () => {
+    const generationIndex = workflow.indexOf('- name: Generate release SBOM');
+    const validationIndex = workflow.indexOf('- name: Validate release SBOM');
+    const checksumIndex = workflow.indexOf('- name: Generate release checksums');
+
+    expect(generationIndex).toBeGreaterThan(-1);
+    expect(validationIndex).toBeGreaterThan(generationIndex);
+    expect(checksumIndex).toBeGreaterThan(validationIndex);
+
+    const generationStep = workflow.slice(generationIndex, validationIndex);
+    expect(generationStep).toContain(
+      'syft scan dir:. -o spdx-json > release/inkspan.spdx.json',
+    );
+
+    const validationStep = workflow.slice(validationIndex, checksumIndex);
+    expect(validationStep).toContain('release/inkspan.spdx.json');
+    expect(validationStep).toContain('16 * 1024 * 1024');
+    expect(validationStep).toContain('SPDX-2.3');
+    expect(validationStep).toContain('@contextualwisdomlab/cwl-editor');
+    expect(validationStep).toContain('inkspan-office');
+    expect(validationStep).toContain('packages');
+  });
+
+  it('requires both release package identities to exist in the generated SBOM inventory', () => {
+    const validationIndex = workflow.indexOf('- name: Validate release SBOM');
+    const checksumIndex = workflow.indexOf('- name: Generate release checksums');
+    const validationStep = workflow.slice(validationIndex, checksumIndex);
+
+    expect(validationStep).toContain(
+      'const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));',
+    );
+    expect(validationStep).toContain(
+      'if (!sbomPackageNames.has(packageMetadata.name))',
+    );
+    expect(validationStep).toContain(
+      "if (!sbomPackageNames.has('inkspan-office'))",
+    );
+  });
+
+  it('checksums, inventories, publishes, and provenance-attests the SBOM asset', () => {
+    expect(workflow).toContain('sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS');
+    expect(workflow).toContain('expected_asset_count=4');
+    expect(workflow).toContain('release/inkspan.spdx.json');
+    expect(workflow).toContain('one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS');
+  });
+
+  it('binds the release packages to the SBOM and verifies the SBOM predicate', () => {
+    const sbomAttestIndex = workflow.indexOf('- name: Attest release packages with SBOM');
+    const verificationIndex = workflow.indexOf('- name: Verify generated attestations');
+
+    expect(sbomAttestIndex).toBeGreaterThan(-1);
+    expect(verificationIndex).toBeGreaterThan(sbomAttestIndex);
+
+    const attestationStep = workflow.slice(sbomAttestIndex, verificationIndex);
+    expect(attestationStep).toContain(
+      'actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26',
+    );
+    expect(attestationStep).toContain('release/*.tgz');
+    expect(attestationStep).toContain('release/*.whl');
+    expect(attestationStep).toContain('sbom-path: release/inkspan.spdx.json');
+
+    const verificationStep = workflow.slice(
+      verificationIndex,
+      workflow.indexOf('- name: Prepare draft GitHub release', verificationIndex),
+    );
+    expect(verificationStep).toContain(
+      '--predicate-type https://spdx.dev/Document/v2.3',
+    );
+  });
+
+  it('documents the four-asset release and SBOM digest-verification boundary', () => {
+    const releaseSecurity = repositoryFile('docs/release-security.md');
+
+    expect(releaseSecurity).toContain('inkspan.spdx.json');
+    expect(releaseSecurity).toContain(
+      'exactly one npm `*.tgz`, one Office `*.whl`, `inkspan.spdx.json`, and `SHA256SUMS`',
+    );
+    expect(releaseSecurity).toContain('SBOM digest');
+    expect(releaseSecurity).toContain('signature-verified Syft');
+  });
+});
diff --git a/src/releaseWorkflowSyntax.test.ts b/src/releaseWorkflowSyntax.test.ts
new file mode 100644
index 00000000..d7425763
--- /dev/null
+++ b/src/releaseWorkflowSyntax.test.ts
@@ -0,0 +1,15 @@
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+
+const releaseWorkflow = readFileSync('.github/workflows/release.yml', 'utf8');
+
+describe('release workflow YAML syntax contract', () => {
+  it('uses a block scalar for the hash-locked Office install command', () => {
+    expect(releaseWorkflow).toMatch(
+      /- name: Install hash-locked Office dependencies\n\s+working-directory: office\n\s+run: \|\n\s+python -m pip install --require-hashes --only-binary=:all: -r requirements-ci\.txt/,
+    );
+    expect(releaseWorkflow).not.toMatch(
+      /^\s+run:\s+python .*--only-binary=:all:\s+-r requirements-ci\.txt$/m,
+    );
+  });
+});

From eb6351792a7d26b21acc4409bda05a06127f7c12 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 13 Aug 2026 22:57:07 +0900
Subject: [PATCH 44/54] test(docs): require canonical writing diagnostics guide

---
 ...gDiagnosticsCanonicalDocumentation.test.ts | 59 +++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 src/writingDiagnosticsCanonicalDocumentation.test.ts

diff --git a/src/writingDiagnosticsCanonicalDocumentation.test.ts b/src/writingDiagnosticsCanonicalDocumentation.test.ts
new file mode 100644
index 00000000..9564432c
--- /dev/null
+++ b/src/writingDiagnosticsCanonicalDocumentation.test.ts
@@ -0,0 +1,59 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+function repositoryFile(path: string): string {
+  return readFileSync(resolve(process.cwd(), path), 'utf8');
+}
+
+function normalizeProse(value: string): string {
+  return value.replace(/`/gu, '').replace(/\s+/gu, ' ').trim();
+}
+
+describe('canonical writing diagnostics documentation', () => {
+  it('publishes the complete host and Inkspan authority contract', () => {
+    const guide = normalizeProse(
+      repositoryFile('docs/WRITING_DIAGNOSTICS.md'),
+    );
+
+    expect(guide).toContain('Host semantic authority');
+    expect(guide).toContain('Inkspan deterministic integrity');
+    expect(guide).toContain(
+      '@contextualwisdomlab/cwl-editor/writing-diagnostics',
+    );
+    expect(guide).toContain(
+      'Every local or collaborative transaction with docChanged === true invalidates the complete active diagnostic generation.',
+    );
+    expect(guide).toContain(
+      'Version 1 applies exactly one explicitly selected diagnostic at a time.',
+    );
+    expect(guide).toContain(
+      'Confidence, priority, and category are host labels, not editor truth or submission policy.',
+    );
+    expect(guide).toContain('Focus, Apply, Ignore, Dismiss, and Explain');
+    expect(guide).toContain(
+      'Diagnostics never block submission, sending, persistence, export, or collaboration.',
+    );
+    expect(guide).toContain('server rendering');
+    expect(guide).toContain('collaborative editing');
+    expect(guide).toContain('privacy');
+    expect(guide).toContain('rollback');
+  });
+
+  it('prohibits semantic fallback and indexes the guide canonically', () => {
+    const guide = normalizeProse(
+      repositoryFile('docs/WRITING_DIAGNOSTICS.md'),
+    );
+    const index = repositoryFile('docs/README.md');
+
+    expect(guide).toContain(
+      'No keyword, regex, phrase-list, language-name, sender-domain, recipient-count, nearest-text, quote-search, or word-position fallback is permitted.',
+    );
+    expect(guide).not.toContain('Inkspan infers grammar');
+    expect(guide).not.toContain('Apply all');
+    expect(index).toContain(
+      '[`WRITING_DIAGNOSTICS.md`](WRITING_DIAGNOSTICS.md)',
+    );
+  });
+});

From d6cdb5c92b6f67a17ab57d8fc76acc6c3b9d5eca Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 23:18:04 -0700
Subject: [PATCH 45/54] docs(diagnostics): satisfy canonical guide contract

---
 docs/WRITING_DIAGNOSTICS.md | 59 +++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 docs/WRITING_DIAGNOSTICS.md

diff --git a/docs/WRITING_DIAGNOSTICS.md b/docs/WRITING_DIAGNOSTICS.md
new file mode 100644
index 00000000..f449b715
--- /dev/null
+++ b/docs/WRITING_DIAGNOSTICS.md
@@ -0,0 +1,59 @@
+# Writing diagnostics
+
+Status: Active PR / Proposed
+
+Writing diagnostics are a host-supplied, revision-bound review surface for local Inkspan authoring. This document describes the active writing-diagnostics stack only; it is not protected-main authority until the owning stack integrates under then-live governance.
+
+## Authority model
+
+### Host semantic authority
+
+The host decides whether to request diagnostics, which provider or deterministic service to use, what text may leave the host boundary, and which proposed observations are admissible for presentation. The host owns model/provider selection, credentials, authorization, tenant isolation, redaction, retention, prompt and response logging, external-data-use policy, semantic policy, audit, and any human-review requirement.
+
+Confidence, priority, and category are host labels, not editor truth or submission policy. Model or service output is untrusted proposal data. Diagnostics never block submission, sending, persistence, export, or collaboration.
+
+### Inkspan deterministic integrity
+
+Inkspan validates the bounded diagnostic envelope, binds accepted diagnostics to the document revision supplied by the host, projects deterministic text positions, renders inert proposal data, and applies only explicitly selected deterministic editor actions after rechecking the current revision. The framework-neutral package surface is `@contextualwisdomlab/cwl-editor/writing-diagnostics`.
+
+Inkspan performs no grammar, tone, clarity, pragmatics, technical-quality, actionability, sender, recipient, language, or policy inference. No keyword, regex, phrase-list, language-name, sender-domain, recipient-count, nearest-text, quote-search, or word-position fallback is permitted.
+
+## Revision and invalidation contract
+
+Every local or collaborative transaction with docChanged === true invalidates the complete active diagnostic generation. This intentionally favors stale-proposal rejection over attempting semantic re-anchoring. Hosts may request a new generation against the new revision.
+
+Focus is allowed only after the controller verifies that the diagnostic belongs to the current revision and resolves its already-validated text-position range. If the editor is unavailable or the revision no longer matches, the action fails closed rather than guessing another range.
+
+Version 1 applies exactly one explicitly selected diagnostic at a time. Focus, Apply, Ignore, Dismiss, and Explain are discrete author actions; none grants semantic or authorization authority to Inkspan. Apply mutates only the selected accepted proposal through the existing editor transaction boundary. Ignore and Dismiss affect local diagnostic presentation state, not source-of-truth document semantics. Explain may expose host-supplied explanatory proposal data but does not create a model call inside Inkspan.
+
+## Hostile input and privacy
+
+Diagnostic objects, strings, HTML-like content, getters, Proxies, and callback failures are untrusted. Contract validation is bounded and fail-closed; public errors are payload-redacted. Authored text, provider messages, file names, URLs, credentials, and private thrown values are not reflected into ordinary public diagnostics errors.
+
+Browser presentation uses text-safe rendering rather than granting diagnostic content executable markup authority. Rejected, aborted, malformed, stale, or unavailable diagnostic responses do not trigger lexical or positional fallback behavior.
+
+The privacy boundary is deliberately narrow: Inkspan needs only the accepted bounded proposal fields required to render and deterministically act on a diagnostic. The host remains responsible for deciding whether text can be sent to any external service and for downstream retention, logging, tenant, and access-control policy.
+
+## Collaborative editing
+
+Collaborative editing does not change semantic ownership. Yjs/provider transport, room authorization, awareness privacy, lifecycle, durable persistence, and audit remain host-owned. A collaborative document transaction that changes the document invalidates the current generation exactly like a local document transaction. Remote presence or awareness metadata is never diagnostic authorization evidence.
+
+## Server rendering and packaging
+
+The framework-neutral validation/projection package must remain importable without React UI, browser DOM, Yjs, a model SDK, credentials, network access, persistence, naruon, or contextual-orchestrator. Server rendering must not initialize provider, collaboration, model, or browser authority merely because the package is imported. Browser-only interaction begins only in the explicit editor/UI layer.
+
+Packed-package verification is expected to exercise ESM, CommonJS, strict TypeScript, server-rendering-safe imports, and authority scans for the public subpath.
+
+## Accessibility and interaction
+
+The presentation layer must keep diagnostics keyboard reachable, preserve visible focus, tolerate 200% scaling and forced-colors behavior, and expose status changes without using visual styling as the only state signal. Touch interaction is detected by capability rather than viewport width. Browser assurance should cover the supported Chromium, Firefox, WebKit, and mobile interaction paths before integration claims are made.
+
+## Failure handling and rollback
+
+Malformed or hostile diagnostics fail closed without manufacturing a substitute proposal. A rejected host request, aborted route, unavailable editor, stale revision, failed deterministic action, or callback exception must not grant additional authority or silently mutate the document.
+
+Rollback for an applied diagnostic uses the editor's ordinary deterministic undo/revision semantics; Inkspan does not maintain a parallel semantic history. Hosts own durable recovery, persistence rollback, audit reconciliation, and regeneration policy. If package or browser assurance regresses, the safe rollback is to remove or disable the active-PR diagnostics integration while preserving standalone authoring and the framework-neutral package boundary.
+
+## Claim boundary
+
+This guide is canonical for the active diagnostics stack only when its owning branch is the current source. Protected `main` remains shipped truth. Tests, PR prose, browser runs, model verdicts, and status checks are evidence for an exact source generation; they do not by themselves promote this active-PR behavior to protected-main authority.

From b3aa916afb5cd9ecf10870f7ddeaec851c0f2df8 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 23:18:32 -0700
Subject: [PATCH 46/54] docs(diagnostics): index canonical active guide

---
 docs/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/README.md b/docs/README.md
index 2b617f7c..fdefd8a3 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -16,6 +16,7 @@ This directory is the discoverable index for Inkspan's product, technical, secur
 | [`TRD.md`](TRD.md) | Technical invariants, runtime boundaries, failure semantics and release evidence |
 | [`CONTRACTS.md`](CONTRACTS.md) | Public package/API/event/schema/plugin/collaboration and host-integration contracts |
 | [`package-distribution.md`](package-distribution.md) | Buyer-facing public npm package entrypoints, packaged contents, runtime dependency boundaries, and consumer verification |
+| [`WRITING_DIAGNOSTICS.md`](WRITING_DIAGNOSTICS.md) | Active-PR host-owned semantic diagnostics boundary, deterministic revision integrity, privacy, accessibility and rollback contract |
 | [`email-output.md`](email-output.md) | Deterministic email fragment/full-document authority, language/direction metadata, accessibility and host-owned transport boundary |
 | [`print-output.md`](print-output.md) | Browser print/paged-media presentation, accessibility/fidelity limits, host-owned governed-export boundary, and rollback |
 | [`UML.md`](UML.md) | Component, sequence, state and authority-flow diagrams |

From 56af8aa557c35b40152c733b03871b40c9dc2985 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 23:19:39 -0700
Subject: [PATCH 47/54] ci(diagnostics): execute canonical documentation
 contract

---
 .github/workflows/writing-diagnostics-assurance-tdd.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
index 0d0628e9..fa26f3e4 100644
--- a/.github/workflows/writing-diagnostics-assurance-tdd.yml
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -7,9 +7,12 @@ on:
   pull_request:
     paths:
       - 'src/components/**'
+      - 'src/writingDiagnosticsCanonicalDocumentation.test.ts'
       - 'src/workflowExactHead.test.ts'
       - 'src/releaseArtifactSbomContract.test.ts'
       - 'tests/browser/**'
+      - 'docs/WRITING_DIAGNOSTICS.md'
+      - 'docs/README.md'
       - '.github/workflows/release.yml'
       - '.github/workflows/writing-diagnostics-assurance-tdd.yml'
   workflow_dispatch:
@@ -39,12 +42,13 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Run hostile-input, no-fallback, focus, release-provenance, and workflow assurance
+      - name: Run hostile-input, no-fallback, focus, documentation, release-provenance, and workflow assurance
         run: >-
           pnpm exec vitest run
           src/components/writingDiagnosticsSecurity.test.tsx
           src/components/writingDiagnosticsFocus.test.tsx
           src/components/WritingDiagnosticsPanel.test.tsx
+          src/writingDiagnosticsCanonicalDocumentation.test.ts
           src/releaseArtifactSbomContract.test.ts
           src/workflowExactHead.test.ts
           --pool=forks

From 91dfddd6268d05e17980e8c0be97bbf61533b4e3 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 23:20:20 -0700
Subject: [PATCH 48/54] fix(docs): satisfy diagnostics guide vocabulary
 contract

---
 docs/WRITING_DIAGNOSTICS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/WRITING_DIAGNOSTICS.md b/docs/WRITING_DIAGNOSTICS.md
index f449b715..edc24fdd 100644
--- a/docs/WRITING_DIAGNOSTICS.md
+++ b/docs/WRITING_DIAGNOSTICS.md
@@ -2,7 +2,7 @@
 
 Status: Active PR / Proposed
 
-Writing diagnostics are a host-supplied, revision-bound review surface for local Inkspan authoring. This document describes the active writing-diagnostics stack only; it is not protected-main authority until the owning stack integrates under then-live governance.
+Writing diagnostics are a host-supplied, revision-bound review surface for local Inkspan authoring. This document describes the active writing-diagnostics stack only; it is not protected-main authority until the owning stack integrates under then-live governance. The same deterministic boundary covers collaborative editing and remains safe for server rendering without acquiring host authority.
 
 ## Authority model
 

From f9ab67c65357192f4433e972476d425b9405bca1 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 20 Aug 2026 01:11:56 -0700
Subject: [PATCH 49/54] test(release): require browser evidence setup headroom

---
 src/releaseWorkflowSyntax.test.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/releaseWorkflowSyntax.test.ts b/src/releaseWorkflowSyntax.test.ts
index d7425763..89f1cdbd 100644
--- a/src/releaseWorkflowSyntax.test.ts
+++ b/src/releaseWorkflowSyntax.test.ts
@@ -12,4 +12,10 @@ describe('release workflow YAML syntax contract', () => {
       /^\s+run:\s+python .*--only-binary=:all:\s+-r requirements-ci\.txt$/m,
     );
   });
+
+  it('gives release browser evidence the proven finite setup budget', () => {
+    expect(releaseWorkflow).toMatch(
+      /browser-release-evidence:\n\s+name: Cross-engine Clipboard \/ Playwright 1\.62\.0\n\s+if: [^\n]+\n\s+needs: build-release-artifacts\n\s+runs-on: ubuntu-24\.04\n\s+timeout-minutes: 60/,
+    );
+  });
 });

From 599d2eb86bf60750a26dcfa6b0d69facc1588cc4 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Thu, 20 Aug 2026 01:14:35 -0700
Subject: [PATCH 50/54] fix(release): give browser evidence finite setup
 headroom

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1bbb47c..532284b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -209,7 +209,7 @@ jobs:
     if: github.repository == 'ContextualWisdomLab/inkspan'
     needs: build-release-artifacts
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 60
     permissions:
       contents: read
     env:
@@ -736,4 +736,4 @@ jobs:
           done
 
           echo "::error::Registry publication verification did not converge to the exact artifact digests."
-          exit 1
\ No newline at end of file
+          exit 1

From 4bbef628cb097b39f75c3c78ddde5ac8288a2bab Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 21 Aug 2026 22:19:02 -0700
Subject: [PATCH 51/54] fix(release): preserve package SBOM contract across
 stack merge

---
 .github/workflows/release.yml | 95 +++++++++++++++++++++--------------
 1 file changed, 58 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1d41ef6..743e8e62 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -148,48 +148,62 @@ jobs:
             sh "$syft_installer" -v -b "$RUNNER_TEMP/syft-bin" v1.50.0
           "$RUNNER_TEMP/syft-bin/syft" version
           echo "$RUNNER_TEMP/syft-bin" >> "$GITHUB_PATH"
-      - name: Generate release SBOM
+      - name: Generate exact-package release SBOMs
         run: |
           set -euo pipefail
-          syft scan dir:. -o spdx-json > release/inkspan.spdx.json
-      - name: Validate release SBOM
+          mapfile -t npm_assets < <(
+            find release -maxdepth 1 -type f -name '*.tgz' -printf '%f\n' | LC_ALL=C sort
+          )
+          mapfile -t wheel_assets < <(
+            find release -maxdepth 1 -type f -name '*.whl' -printf '%f\n' | LC_ALL=C sort
+          )
+          if [[ ${#npm_assets[@]} -ne 1 || ${#wheel_assets[@]} -ne 1 ]]; then
+            echo "::error::SBOM generation requires exactly one npm tarball and one Office wheel."
+            exit 1
+          fi
+          syft scan "release/${npm_assets[0]}" -o spdx-json > release/editor-package.spdx.json
+          syft scan "release/${wheel_assets[0]}" -o spdx-json > release/office-package.spdx.json
+      - name: Validate exact-package release SBOMs
         run: |
           set -euo pipefail
           node <<'NODE'
           const { readFileSync, statSync } = require('node:fs');
 
-          const sbomPath = 'release/inkspan.spdx.json';
-          const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
           const packageMetadata = JSON.parse(readFileSync('package.json', 'utf8'));
           const officeMetadata = readFileSync('office/pyproject.toml', 'utf8');
-          if (statSync(sbomPath).size > 16 * 1024 * 1024) {
-            throw new Error('Release SBOM exceeds the 16 MiB actions/attest input limit.');
-          }
-          if (sbom.spdxVersion !== 'SPDX-2.3') {
-            throw new Error(`Release SBOM must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
-          }
-          if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
-            throw new Error('Release SBOM package inventory must not be empty.');
-          }
-          const sbomPackageNames = new Set(sbom.packages.map((pkg) => pkg.name));
           if (packageMetadata.name !== '@contextualwisdomlab/cwl-editor') {
             throw new Error('Release source has an unexpected editor package identity.');
           }
           if (!/^name\s*=\s*["']inkspan-office["']\s*$/m.test(officeMetadata)) {
             throw new Error('Release source has an unexpected Office package identity.');
           }
-          if (!sbomPackageNames.has(packageMetadata.name)) {
-            throw new Error('Release SBOM inventory must include the editor package identity.');
-          }
-          if (!sbomPackageNames.has('inkspan-office')) {
-            throw new Error('Release SBOM inventory must include the Office package identity.');
+
+          const expectedSboms = [
+            ['release/editor-package.spdx.json', packageMetadata.name],
+            ['release/office-package.spdx.json', 'inkspan-office'],
+          ];
+          for (const [sbomPath, expectedPackageName] of expectedSboms) {
+            const sbom = JSON.parse(readFileSync(sbomPath, 'utf8'));
+            if (statSync(sbomPath).size > 16 * 1024 * 1024) {
+              throw new Error(`${sbomPath} exceeds the 16 MiB actions/attest input limit.`);
+            }
+            if (sbom.spdxVersion !== 'SPDX-2.3') {
+              throw new Error(`${sbomPath} must be SPDX-2.3; found ${sbom.spdxVersion ?? 'missing'}.`);
+            }
+            if (!Array.isArray(sbom.packages) || sbom.packages.length === 0) {
+              throw new Error(`${sbomPath} package inventory must not be empty.`);
+            }
+            const packageNames = new Set(sbom.packages.map((pkg) => pkg.name));
+            if (!packageNames.has(expectedPackageName)) {
+              throw new Error(`${sbomPath} must include exact package identity ${expectedPackageName}.`);
+            }
           }
           NODE
       - name: Generate release checksums
         run: |
           set -euo pipefail
           cd release
-          sha256sum -- *.tgz *.whl inkspan.spdx.json > SHA256SUMS
+          sha256sum -- *.tgz *.whl *.spdx.json > SHA256SUMS
       - name: Transfer exact release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -204,7 +218,7 @@ jobs:
     if: github.repository == 'ContextualWisdomLab/inkspan'
     needs: build-release-artifacts
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 60
     permissions:
       contents: read
     env:
@@ -301,7 +315,7 @@ jobs:
       - name: Verify bounded local release artifact set
         run: |
           set -euo pipefail
-          expected_asset_count=4
+          expected_asset_count=5
           mapfile -t local_entries < <(
             find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
           )
@@ -318,9 +332,10 @@ jobs:
             || ${#local_assets[@]} -ne $expected_asset_count \
             || ${#npm_assets[@]} -ne 1 \
             || ${#wheel_assets[@]} -ne 1 \
-            || ! -f release/inkspan.spdx.json \
+            || ! -f release/editor-package.spdx.json \
+            || ! -f release/office-package.spdx.json \
             || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, editor-package.spdx.json, office-package.spdx.json, and SHA256SUMS."
             exit 1
           fi
       - name: Attest release artifacts
@@ -329,21 +344,25 @@ jobs:
           subject-path: |
             release/*.tgz
             release/*.whl
-            release/inkspan.spdx.json
+            release/editor-package.spdx.json
+            release/office-package.spdx.json
             release/SHA256SUMS
-      - name: Attest release packages with SBOM
+      - name: Attest editor package with matching SBOM
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
-          subject-path: |
-            release/*.tgz
-            release/*.whl
-          sbom-path: release/inkspan.spdx.json
+          subject-path: release/*.tgz
+          sbom-path: release/editor-package.spdx.json
+      - name: Attest Office package with matching SBOM
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: release/*.whl
+          sbom-path: release/office-package.spdx.json
       - name: Verify generated attestations
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do
+          for artifact in release/*.tgz release/*.whl release/editor-package.spdx.json release/office-package.spdx.json release/SHA256SUMS; do
             gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
           done
           for artifact in release/*.tgz release/*.whl; do
@@ -382,7 +401,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          expected_asset_count=4
+          expected_asset_count=5
           mapfile -t local_entries < <(
             find release -mindepth 1 -maxdepth 1 -printf '%f\n' | LC_ALL=C sort
           )
@@ -399,9 +418,10 @@ jobs:
             || ${#local_assets[@]} -ne $expected_asset_count \
             || ${#npm_assets[@]} -ne 1 \
             || ${#wheel_assets[@]} -ne 1 \
-            || ! -f release/inkspan.spdx.json \
+            || ! -f release/editor-package.spdx.json \
+            || ! -f release/office-package.spdx.json \
             || ! -f release/SHA256SUMS ]]; then
-            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, inkspan.spdx.json, and SHA256SUMS."
+            echo "::error::Unexpected local release artifact set; require exactly one *.tgz, one *.whl, editor-package.spdx.json, office-package.spdx.json, and SHA256SUMS."
             exit 1
           fi
 
@@ -477,6 +497,7 @@ jobs:
           gh release edit "$GITHUB_REF_NAME" \
             --repo "$GITHUB_REPOSITORY" \
             --draft=false
+
           release_immutable="$(gh release view "$GITHUB_REF_NAME" \
             --repo "$GITHUB_REPOSITORY" \
             --json isImmutable \
@@ -492,7 +513,7 @@ jobs:
           fi
 
           gh release verify "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY"
-          for artifact in release/*.tgz release/*.whl release/inkspan.spdx.json release/SHA256SUMS; do
+          for artifact in release/*.tgz release/*.whl release/editor-package.spdx.json release/office-package.spdx.json release/SHA256SUMS; do
             gh release verify-asset "$GITHUB_REF_NAME" "$artifact" \
               --repo "$GITHUB_REPOSITORY"
           done
@@ -724,4 +745,4 @@ jobs:
           done
 
           echo "::error::Registry publication verification did not converge to the exact artifact digests."
-          exit 1
\ No newline at end of file
+          exit 1

From 5835a278d7657a4bf81057f9c555d14dd3451e23 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 21 Aug 2026 23:06:04 -0700
Subject: [PATCH 52/54] test(ci): require diagnostics assurance exact-head
 checkout

---
 src/workflowExactHead.test.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/workflowExactHead.test.ts b/src/workflowExactHead.test.ts
index e5ad6cad..19ffc12f 100644
--- a/src/workflowExactHead.test.ts
+++ b/src/workflowExactHead.test.ts
@@ -27,7 +27,7 @@ const SETUP_NODE_PIN =
 const ACTIONS_CACHE_PIN =
   'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0';
 const SAFE_PNPM_ACTION_PIN =
-  'pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10';
+  'pnpm/action-setup@0977fd99725dab4007ccb2928dbb4e90d06cc86 # v6.0.10';
 const VULNERABLE_PNPM_ACTION_PIN =
   'pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8';
 
@@ -44,6 +44,17 @@ describe('exact-head CI workflow contract', () => {
     expect(workflow.match(/persist-credentials: false/g)).toHaveLength(3);
   });
 
+  it('checks diagnostics assurance out at the immutable contributor head', () => {
+    const exactHeadRef =
+      'ref: ${{ github.event.pull_request.head.sha || github.sha }}';
+    const exactExpectedHead =
+      'INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}';
+
+    expect(diagnosticsWorkflow.split(exactHeadRef)).toHaveLength(3);
+    expect(diagnosticsWorkflow).not.toContain('ref: ${{ github.sha }}');
+    expect(diagnosticsWorkflow).toContain(exactExpectedHead);
+  });
+
   it('keeps the workflow read-only and hash-pins every third-party action', () => {
     expect(workflow).toContain('permissions:\n  contents: read');
     expect(workflow).not.toContain('contents: write');

From 99157b3c448d08b40cd71bebdb4e2bba88d8023f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 21 Aug 2026 23:07:00 -0700
Subject: [PATCH 53/54] fix(test): preserve safe pnpm action pin oracle

---
 src/workflowExactHead.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/workflowExactHead.test.ts b/src/workflowExactHead.test.ts
index 19ffc12f..d425424b 100644
--- a/src/workflowExactHead.test.ts
+++ b/src/workflowExactHead.test.ts
@@ -27,7 +27,7 @@ const SETUP_NODE_PIN =
 const ACTIONS_CACHE_PIN =
   'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0';
 const SAFE_PNPM_ACTION_PIN =
-  'pnpm/action-setup@0977fd99725dab4007ccb2928dbb4e90d06cc86 # v6.0.10';
+  'pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10';
 const VULNERABLE_PNPM_ACTION_PIN =
   'pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8';
 

From 35902610d17a4e6ebeedc3d7cc99cb40fe8d7d8e Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 21 Aug 2026 23:08:38 -0700
Subject: [PATCH 54/54] fix(ci): run diagnostics assurance on exact PR head

---
 .github/workflows/writing-diagnostics-assurance-tdd.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/writing-diagnostics-assurance-tdd.yml b/.github/workflows/writing-diagnostics-assurance-tdd.yml
index fa26f3e4..446b6c04 100644
--- a/.github/workflows/writing-diagnostics-assurance-tdd.yml
+++ b/.github/workflows/writing-diagnostics-assurance-tdd.yml
@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -65,7 +65,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
       - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -83,7 +83,7 @@ jobs:
         run: pnpm --dir tests/browser exec playwright install --with-deps chromium firefox webkit
       - name: Run writing-diagnostic browser assurance on exact head
         env:
-          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.sha }}
+          INKSPAN_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: >-
           pnpm --dir tests/browser exec playwright test
           specs/writing-diagnostics.browser.spec.ts