@cyberskill/design 2.6.0 → 2.8.0

package/docs/UPSTREAM.md

@@ -16,15 +16,12 @@ Verified live in browser: **69/69** `D1`–`D10` checks (`10.0 / 10`), **64/64**
 | `components/feedback/feedback.card.html` | `.frame { flex: 1 1 100%; min-width: 0 }` | Prevents the toast demo frame from collapsing to zero width inside the flex row. |
 | `components/logo/logo.card.html` | Lockup wordmark `color: var(--cs-color-text-primary)`. | Ensures the wordmark remains visible in dark mode. |
 
-## 2 · Shipped verification suite (`audit/`)
+## 2 · Automated verification suite (`_audit/ci/`)
 
 | File | Purpose |
 |---|---|
-| `audit/v2.5.0-verification.html`, `audit/verify-v2.5.0.js`, `audit/fixture-v2.5.0.html` | Verification Audit & Specimen Workbench: 10 dimensions (`P0` tint safety · `P1` 32-scope WCAG 1.4.11 · `P2` Umber separation, 14-control invalid parity, VI diacritics · `P3` nested glass, `DESIGN.md`/asset contract · `D8`–`D10` Doctrine Immutables: dual-ring focus, ≥ 44px touch targets & motion safety, high-contrast, density & semantic status contrast), 69 checks × `v2.5.0+` / `v2.4.0` / `v2.3.1`, 32×6 contrast matrix, edge-case report, JSON export, and specimen switcher (`version × theme × element × variant`). |
-| `audit/v2.5.0-verification.json`, `_audit/ci/verify-audit-benchmarks-browser.mjs` | Machine-readable receipt and automated CI/prepublish non-regression gate (`npm run test:audit-regression`): **10.0 / 10** (`69/69` across `D1`–`D10`), embedded baseline suite **64/64** (`v2.4.0` tag `62/64`, `v2.3.1` `8/64`), render health **146/146**, and **0 watch** items. |
-| `audit/render-health.html` | Loads all 146 templates, component cards, and UI-kit/guideline pages in hidden frames (as authored / forced dark / high-contrast / any Ngũ Hành scope) and verifies zero unstyled, unresolved, erroring, empty, or low-contrast pages. |
-| `audit/fixture.html`, `audit/verify.js`, `audit/v2.4.0-verification.html` | Three-version loader (`?v=current|v240|baseline`) re-running the 64 baseline checks across `v2.5.0`, `v2.4.0`, and `v2.3.1`. |
-| `audit/baseline-2.4.0/styles.flat.css`, `audit/baseline-2.3.1/styles.flat.css` | Flattened `styles.css` closures from tags `v2.4.0` and `v2.3.1` for live three-version comparison. |
+| `_audit/ci/verify-audit-benchmarks-browser.mjs`, `_audit/ci/lib/benchmark-checks.mjs` | Automated CI/prepublish live-browser benchmark gate (`npm run test:audit-regression`): scores **10.0 / 10** (`129/129` across 20 dimensions `D1`–`D20`), core baseline suite **64/64** (`10.0 / 10`), 192/192 cells in the 32×6 non-text contrast matrix (`≥ 3.0:1`), 3/3 Generation-2 complex stress-test screens, and **0 watch** items. |
+| `_audit/ci/fixtures/benchmark-20d.html`, `_audit/ci/fixtures/benchmark-baseline.html`, `_audit/ci/fixtures/benchmark-gen2.html` | Current-tree DOM fixtures exercising 32 Theme × Element × Variant scopes, 14 form controls, Vietnamese diacritic metrics, container queries, print/glass rules, and complex multi-scope enterprise/AI/mobile screens against `/dist/styles.css` and `/styles.css`. |
 
 ## 3 · Host-specific items excluded from upstream
 

package/docs/browser-support.md

@@ -4,7 +4,7 @@ The supported web target is the latest two stable releases of Chrome, Firefox, S
 
 ## Required capabilities
 
-The system uses `color-mix(in oklab, ...)`, inline-size container queries, `:has()`, `text-wrap: balance` and native `inert`. These features predate the selected floor in the [pinned MDN browser compatibility data](https://github.com/mdn/browser-compat-data/tree/12bc0268c7fe89a4b23fab5c54702c1fb9c34f7a). The retained source record is `_audit/remediation/browser-compatibility-source.json`. No legacy-browser fallback or `inert` polyfill is promised.
+The system uses `color-mix(in oklab, ...)`, inline-size container queries, `:has()`, `text-wrap: balance` and native `inert`. These features predate the selected floor in the [pinned MDN browser compatibility data](https://github.com/mdn/browser-compat-data/tree/12bc0268c7fe89a4b23fab5c54702c1fb9c34f7a). The retained source record is `_audit/ci/fixtures/browser-compatibility-source.json`. No legacy-browser fallback or `inert` polyfill is promised.
 
 For the selected latest-two stable floor, native `inert` is available and no `inert` polyfill is required. Its introduction versions are Chrome 102 ([Chrome release notes](https://developer.chrome.com/blog/new-in-chrome-102)), Firefox 112 ([Mozilla developer release notes](https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/112)), and Safari 15.5 on macOS, iOS and iPadOS ([WebKit release notes](https://webkit.org/blog/12669/new-webkit-features-in-safari-15-5/)); the [HTML Standard](https://html.spec.whatwg.org/multipage/interaction.html#the-inert-attribute) documents the native behavior. This is a feature-availability conclusion for the declared floor, not certification of every admitted browser release, physical-device focus behavior or assistive-technology behavior. Older targets remain outside this promise and need a separately validated fallback.
 

package/docs/component-api.md

@@ -8,7 +8,7 @@ Removing a public contract requires a major release **and both** at least two di
 
 The authored `components/release-compatibility.json` records the pre-candidate baseline, reviewed pending change classifications, dated notices and publication evidence. Release planning, prepared-candidate verification and tag verification enforce it alongside the unchanged support-approval and exact-source gates. The approved compiled-default entry, APG Menu keyboard, SegmentedControl radio default and default floating placement changes are classified as breaking for the current unreleased revision; patch/minor preparation is blocked. This does not assign a new release identifier, approve support evidence, create a tag or authorize publication. Before a later release cycle, reconcile the baseline and pending entries against the actual accepted publication; never silently clear notice history.
 
-SegmentedControl retains deprecated semantic aliases `role="tablist"` and `role="radiogroup"`. When `mode` is omitted, the alias selects matching tab or radio children; explicit `mode` takes precedence, and the default remains radio. Other role values reject rather than producing mismatched ARIA semantics. Prefer `mode="tabs"` or `mode="radio"`. The earlier removal proposal is archived in `_audit/remediation/segmented-role-removal-proposal-history.json`; it is not a current removal. Rejecting arbitrary roles remains classified as breaking. Announcement fields remain null: this local guidance does not establish a published notice, date or version. Any future removal still requires a major release after two distinct published minor releases and 90 days of recorded notice, alongside all other release gates.
+SegmentedControl retains deprecated semantic aliases `role="tablist"` and `role="radiogroup"`. When `mode` is omitted, the alias selects matching tab or radio children; explicit `mode` takes precedence, and the default remains radio. Other role values reject rather than producing mismatched ARIA semantics. Prefer `mode="tabs"` or `mode="radio"`. The earlier removal proposal is archived in `_audit/ci/fixtures/segmented-role-removal-proposal-history.json`; it is not a current removal. Rejecting arbitrary roles remains classified as breaking. Announcement fields remain null: this local guidance does not establish a published notice, date or version. Any future removal still requires a major release after two distinct published minor releases and 90 days of recorded notice, alongside all other release gates.
 
 The currently declared React support lines are 18.x and 19.x; packed-consumer and hydration fixtures test their pinned versions. This is a major-version support window, not proof of every historical patch or a promise about unreleased React majors. Removing a declared line follows the same major-release and deprecation policy. New React majors require explicit compatibility validation before widening peer ranges. Browser targets remain the latest-two policy in the browser-support guide, with engine and physical-device evidence reported separately.
 

package/docs/consuming.md

@@ -1,6 +1,6 @@
 # Consuming & upgrading the CyberSkill Design System
 
-**Source checkout:** VERSION **<!-- cs-source-version:checkout -->2.6.0<!-- /cs-source-version -->** is local source identity, not a registry-availability claim. For an unpublished candidate, validate the reviewed local package tarball or source checkout. Registry commands below refer to published stable 2.5.0 (and the dated ADOPT-001 1.7.2 sibling inventory) and are not automatically updated by preparation. Preparation does not authorize publication.
+**Source checkout:** VERSION **<!-- cs-source-version:checkout -->2.8.0<!-- /cs-source-version -->** is local source identity, not a registry-availability claim. For an unpublished candidate, validate the reviewed local package tarball or source checkout. Registry commands below refer to published stable 2.7.0 (and the dated ADOPT-001 1.7.2 sibling inventory) and are not automatically updated by preparation. Preparation does not authorize publication.
 
 How any project — human-driven or agent-driven — adopts this HTML-first design system, and how to take updates safely. Published on Storybook **Docs** at `design.cyberskill.world`.
 

package/docs/contrast-report.md

@@ -1,6 +1,6 @@
 # Contrast report — elemental pairings (APCA)
 
-Generated · sweep at VERSION 2.6.0.
+Generated · sweep at VERSION 2.8.0.
 
 Published on Storybook **Docs** at `design.cyberskill.world`.
 

package/docs/conventions.md

@@ -78,7 +78,7 @@ only for HTML element content, never URL, attribute, CSS or script contexts.
 
 **New element variant** — stay inside the element's oklch envelope; set the 10 `--cs-accent-*` contract tokens (incl. `--cs-accent-on-strong` ≥4.5:1 and body APCA75 on `-strong`) plus `--cs-color-text-accent`/`--cs-color-link` (APCA-check both); the aurora wash inherits from the element via `.cs-aurora-wash` (override the class rule only if the variant truly needs its own image); gradient partner (`grad-b`) must follow Tương sinh.
 
-**Ship check** — follow the portable verification gate in `docs/doctrine.md`, then run `_audit/docs-consistency.html` **and** `_audit/namespace-portability.html` (both must be green). source checkout VERSION **<!-- cs-source-version:checkout -->2.6.0<!-- /cs-source-version -->**.
+**Ship check** — follow the portable verification gate in `docs/doctrine.md`, then run `_audit/docs-consistency.html` **and** `_audit/namespace-portability.html` (both must be green). source checkout VERSION **<!-- cs-source-version:checkout -->2.8.0<!-- /cs-source-version -->**.
 
 ## Decision log (owner-approved)
 

package/docs/decisions.md

@@ -15,7 +15,7 @@ The numbered sections below preserve dated decisions and stable citation IDs; th
 | Security release window and acknowledgement target | `SECURITY.md` |
 | Support acceptance and retained approvals | `components/lifecycle.json`, `docs/conventions.md` |
 | Release preparation and separate authorization | `docs/release-notes.md`, `.github/workflows/release.yml` |
-| Validation and current finding dispositions | `_audit/remediation/assessment-remediation.md`, `test-results/final-validation.json` |
+| Validation and current finding dispositions | `_audit/ci/unit-suites.json`, `test-results/final-validation.json` |
 
 Published release notes remain historical records. A local build, a prepared candidate, an approved support record and a published release are distinct states.
 

package/docs/deploy.md

@@ -48,7 +48,7 @@ If you host under a **different** domain, change the absolute URLs in those meta
 
 **Without Storybook:** after provenance review and explicit deployment approval, serve the reviewed portable inventory as the webroot.
 
-**With Storybook at `/`:** `npm run build:site` writes a reviewed portable mirror to `.vercel-static/` and the Vercel deployment artifact to `.vercel/output/`. Vercel uses the latter's `config.json`; do not supply an old Output Directory override or rewrite `vercel.json` during a build to predict hashes that do not exist yet.
+**With Storybook at `/`:** `npm run build:site` writes a reviewed portable mirror to `.vercel-static/` (including `.nojekyll` and `CNAME` for GitHub Pages deployment via `.github/workflows/pages.yml`) and the Vercel deployment artifact to `.vercel/output/`. Vercel uses the latter's `config.json`; do not supply an old Output Directory override or rewrite `vercel.json` during a build to predict hashes that do not exist yet.
 
 Other static hosts need an adapter that maps each final HTML path and its aliases to the exact CSP in `public-site-csp.json`, retains the security headers and legacy redirects from `scripts/site-deployment-policy.json`, and denies inline scripts on unknown paths. Hashes must come from the final emitted bytes, including the deterministic template logic wrapper. A single copied CSP string cannot represent these page-specific permissions.
 

package/docs/reference-catalog.json

@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "generator": {
     "path": "scripts/generate-reference-catalog.mjs",
-    "sha256": "be85a593b4b29f0d26e5733502f8d9e4f536e10ab015173a34f4101af11723ef"
+    "sha256": "197bed9972eeb93eb0119dd38c5aa180a0290b3acd16cc1b957f438fd3dadc58"
   },
-  "version": "2.6.0",
+  "version": "2.8.0",
   "interpretation": "The document inventory covers Git-listed Markdown and llms.txt; HTML count surfaces are tracked separately. Audience follows the website publication policy, not npm membership. Source paths locate repository evidence and need not all be packaged. Roles describe source routing and audience, not approval, factual freshness of every sentence, translation quality or capability certification.",
   "countScope": "Counts describe declared inventory only. Declared language/theme/boolean controls are inventory facts, not proof of complete content, working behavior or every supported state; token declarations and typed base values are distinct counts.",
   "counts": {
@@ -29,8 +29,8 @@
   },
   "sourceHashes": {
     "_audit/visual-diff.html": "fd344cf31f0aa4130dddec2a99dca5ef60d9d08025b5dc2b4b729a1d388c5bb8",
-    "_ds_manifest.json": "c095c233237f4ddb574f8fa648c26aee699df2c16d08f7e4a3aeca076a6644e4",
-    "scripts/public-site-policy.json": "04d862985078720d1cd0aa694ef9f67ed89b9980b97d445ab2cf92a1d6dcce61",
+    "_ds_manifest.json": "e7307c53e9b0995b1aec89ddda00abed4674a6f11790ac5c9e89e34f1730fb61",
+    "scripts/public-site-policy.json": "8304a323a8b4cb7d8e571694086975cf88697c220416149ff156568ea7d80942",
     "templates/app-shell/AppShell.dc.html": "f71017a26f12b71d9e653dff79635ed14d5eb4a3dac9c5ce095188c537b858e3",
     "templates/article/Article.dc.html": "9b2ed3af604ac9e552f33bc922ec7dd2659b786dcb624cb491f7a437658adb2f",
     "templates/auth/Auth.dc.html": "ab6fb52740dbda804c9963cd2b63aa7d482c4b3cd2fa87b9a7f0c20ab2ef1e64",
@@ -116,7 +116,7 @@
     "templates/vn-total-rewards-appendix/VnTotalRewardsAppendix.dc.html": "ee941a6d26aa525bba779015ca01f4bdb7246571db2c3558499d7bc2fee3c2aa",
     "templates/vn-training-commitment/VnTrainingCommitment.dc.html": "49b2b4459bf2a900ddfafe679b6f3b088c78a31f611ae76dc3ac276e05a14c46",
     "templates/vn-travel-expense-policy/VnTravelExpensePolicy.dc.html": "1e585bd53ec6fb41322082bddfb7eed4ac811bfabb1ad2d639b9babba6c0e212",
-    "tokens/tokens.dtcg.json": "1546c3a28600a7d9aae3a0d49070d1ade6d1449096b60512417cee69e6b6f5ee"
+    "tokens/tokens.dtcg.json": "6da8cd3627ad355d6a80364cf9d801524c0b1ca2760ee1ce0827bccdf2333b5e"
   },
   "documents": [
     {
@@ -129,7 +129,7 @@
       "path": "DESIGN.md",
       "audience": "documentation",
       "role": "generated_reference",
-      "sha256": "ae83049366c1d74f77b7d6ce2b544226fe61e9e7e61cb76279e7933d6181504d"
+      "sha256": "1ac7639da6b5aa7ec5230e5a1ee369af9472c048065b01265cfd594426c04afa"
     },
     {
       "path": "MAINTAINERS.md",
@@ -141,13 +141,13 @@
       "path": "README.md",
       "audience": "documentation",
       "role": "human_orientation",
-      "sha256": "0f95a156a61adf15b98918576499e7c44e28eb1f11983c393398bba411452e5f"
+      "sha256": "29f08654370d2c21d7e2066800beb84f0c7a20699cfd9f997eb9ca51ed850568"
     },
     {
       "path": "SECURITY.md",
       "audience": "documentation",
       "role": "security_reporting_policy",
-      "sha256": "09554b6bc02148bbc712b562f20a5f59183972d1ab891e5bc009e2f73a7a10a6"
+      "sha256": "cdca194f01ad5e8d31c54167b6908bffab2aec1e1790fcb7f42cc1489bbc6952"
     },
     {
       "path": "SKILL.md",
@@ -159,13 +159,13 @@
       "path": "THIRD-PARTY-NOTICES.md",
       "audience": "documentation",
       "role": "attribution_or_distribution_record",
-      "sha256": "19582a4ee7fa8106f4d68a16ca924acf6e59913c6d11b5dddbed19bda8e69e9b"
+      "sha256": "892980983539a64434f5807aef7a244d9f46a6062d94e0f8c3affd977d59ad32"
     },
     {
       "path": "_audit/README.md",
       "audience": "diagnostics",
       "role": "diagnostic_operator_guide",
-      "sha256": "ca5f1c15c56b8c887954cdf28f43661c7fccb8522f6542ac72b97e582e265f34"
+      "sha256": "fd79f61c852dccb164f4fb8ceceafc8aba6d1d58aaa0521786cedd07ad5f792e"
     },
     {
       "path": "_audit/baselines/README.md",
@@ -855,7 +855,7 @@
       "path": "docs/UPSTREAM.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "fffa842f9062f0e2c9ad28295a8d1d94c123a87563fc0f2b48b8f286a5cefbfe"
+      "sha256": "fa476bd0582020fe3631e15bf7190b41c8e1b910258ccc5d6d4a383056961905"
     },
     {
       "path": "docs/benchmark-rubric.md",
@@ -867,7 +867,7 @@
       "path": "docs/browser-support.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "0e4b0086b3c5c15b67f123a547d6d4f374509016e9399ead6d8da51a4ad6700b"
+      "sha256": "3e2f42f8bffcf1491e5b60acfb65f2ed43f46ea4395b1cff45eac296a8e29814"
     },
     {
       "path": "docs/ci-cd.md",
@@ -879,7 +879,7 @@
       "path": "docs/component-api.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "69b7003edef9e11747847b85c23e6db76efa3785d02db4580faccbe0558cde7a"
+      "sha256": "25417795b10265a035385929ed94408a5a8e109176da9e53345360fb24c1f901"
     },
     {
       "path": "docs/component-css.md",
@@ -915,25 +915,25 @@
       "path": "docs/consuming.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "fca2a205aed45f8df12e836fab27d2500b99ba3dff29a17689a034cb80870244"
+      "sha256": "1ac5ae8b17773a27fbf6010c21872600122d7be6af8723d4e7eb9c298a896190"
     },
     {
       "path": "docs/contrast-report.md",
       "audience": "documentation",
       "role": "generated_measurement",
-      "sha256": "39597ad22cfd476603727d4ac36fe67d7662ff1eb3e3570823bd9b49013c95b9"
+      "sha256": "2eab5bdd1ce84d7256690ab2668d6b3ce77f4ec1380d17dbf199f21c80c5d957"
     },
     {
       "path": "docs/conventions.md",
       "audience": "documentation",
       "role": "normative_repository_contract",
-      "sha256": "e5f5c33b5eebae3f0d4855b18b0fa8fd60dce17e2b30e36ead6025886a498b1f"
+      "sha256": "44a8e41d916e98f74b77dd33b8ba034ea5eeb5056be7f7baafeafd97aae8dd52"
     },
     {
       "path": "docs/decisions.md",
       "audience": "documentation",
       "role": "decision_record",
-      "sha256": "777e1a420efc20bb743e46c83a69ed20b62d48c19155c071060d4b5639c005ce"
+      "sha256": "972f7d7299d0968d12b949a4b806434dd7b6b87f165659ca7e24fdd3b3678361"
     },
     {
       "path": "docs/decisions/container-query-migration.md",
@@ -969,7 +969,7 @@
       "path": "docs/deploy.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "61c40a563aa4db5caad5b5a26a420119f03f3eade255c8c67f15dea70c68093d"
+      "sha256": "021cb650c6bb10aa7e701361fa21d8b2743ee5c1a36680ace32cc8936f6a11df"
     },
     {
       "path": "docs/design-styles.md",
@@ -1065,7 +1065,7 @@
       "path": "docs/release-notes.md",
       "audience": "documentation",
       "role": "release_history",
-      "sha256": "f7c8eac10db5dda843505adabd90e7b37a056d7a2defd8bc6ed4e9b5c650b39b"
+      "sha256": "0f5e128a53adb4d54cfff6d93df5845a7b2a60d5f50bd41dbafedd0f522233e2"
     },
     {
       "path": "docs/releasing.md",
@@ -1083,7 +1083,7 @@
       "path": "docs/static-html-reference.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "8af5cb04e9e7792f8e81e6b706d89b3cea48237843de36ca41e5af6e19199273"
+      "sha256": "793ced224d0631b11739a0a47f6544defc614ffff64870391345cc2e8b10cdf4"
     },
     {
       "path": "docs/storybook.md",
@@ -1137,7 +1137,7 @@
       "path": "docs/vi/UPSTREAM.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "17ebb63b9e32f7e24eaa13a3eee4cf3e6938281f13fd1045ee5e3b545d822416"
+      "sha256": "16520c8fb5922ee6e96bca613d63a31b30cfd694823adcdbc1a0a0ff6838603b"
     },
     {
       "path": "docs/vi/benchmark-rubric.md",
@@ -1149,7 +1149,7 @@
       "path": "docs/vi/browser-support.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "a5fcc8c1e3a6bcde02ceed412a78c7cc17c51dab2671c4a29123ce24fdecba63"
+      "sha256": "c1c44da7a4d57de381adeb398eadd93c7093fecb24360d1f27c9fc0fbd8962f9"
     },
     {
       "path": "docs/vi/ci-cd.md",
@@ -1161,7 +1161,7 @@
       "path": "docs/vi/component-api.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "55504cbdf5baf57befa0d8558c73ee872fa7c20f4cf54026f38b0c4bf76a7c08"
+      "sha256": "38a77780aab48495befcd41f42d32e2d169489e089289bd2d594f70eb45b8f2e"
     },
     {
       "path": "docs/vi/component-css.md",
@@ -1197,31 +1197,31 @@
       "path": "docs/vi/consuming.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "a4ba81765485753a9000f88657584ce8b19be77c2786aed89e51048d975e84e2"
+      "sha256": "f7aa7381edbee6b40763df7b2412e21519a857f78a4245dbabb26c6e76d5cc7f"
     },
     {
       "path": "docs/vi/contrast-report.md",
       "audience": "documentation",
       "role": "generated_measurement",
-      "sha256": "7a398d1437412575eebff0b9fc84cf2be6d79196ee5438a44ba47103da25a0ec"
+      "sha256": "de42df2eab9e36c68df06ef3282b11f5a01f7126c74e65777632998b770989b2"
     },
     {
       "path": "docs/vi/conventions.md",
       "audience": "documentation",
       "role": "normative_repository_contract",
-      "sha256": "eff69f960448e33a3e4c577a1109ea26e9454bdf050f650355bd4a1835166877"
+      "sha256": "ae4e246395efc51647399cd8effaa516c7245687f88a7627c02ae07833100ecf"
     },
     {
       "path": "docs/vi/decisions.md",
       "audience": "documentation",
       "role": "decision_record",
-      "sha256": "a32549e388c5be30426defa7da35e6df7ee03e13ba138f61bdb933b1fb5ab6fa"
+      "sha256": "769683b68b108afe6df5c94fed10bdce406106352136bb35c40aa386f5afd71b"
     },
     {
       "path": "docs/vi/deploy.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "56798ce49b382a39b0d2e341d24adae1e9a719007b1af95f1d887bf6777332cb"
+      "sha256": "a881f1604d01eac8f9d72068f1b330f68262ef7ffb924f2650a92da159ce71ed"
     },
     {
       "path": "docs/vi/design-styles.md",
@@ -1245,13 +1245,13 @@
       "path": "docs/vi/entrypoints/DESIGN.md",
       "audience": "documentation",
       "role": "generated_reference",
-      "sha256": "a4d46ac90da270f3c3fd06602fd8133cdc0576fb57b90be4aea6a26c71035b0a"
+      "sha256": "fda888918b0884c1821f383e7bcaf6a27e52ac719ec6a163fa82acd7612585c3"
     },
     {
       "path": "docs/vi/entrypoints/README.md",
       "audience": "documentation",
       "role": "human_orientation",
-      "sha256": "7056357c5e3dc772b5496b8dd3d5734295d2277748cfd972b393000855169763"
+      "sha256": "68e3a7a6084f50a47c7cd2fed7bb9b5b37100c9c562689e1de9993f4278a8d2d"
     },
     {
       "path": "docs/vi/entrypoints/SKILL.md",
@@ -1347,7 +1347,7 @@
       "path": "docs/vi/release-notes.md",
       "audience": "documentation",
       "role": "release_history",
-      "sha256": "39becd6ad5faecfb72405f878f28ec75f4afe4256e84e186c1c502f4787c09f4"
+      "sha256": "13a966aff7935e4ba844d4eaf48fb23e01f2c3364ae3beef1a310a224f985d37"
     },
     {
       "path": "docs/vi/releasing.md",
@@ -1365,7 +1365,7 @@
       "path": "docs/vi/static-html-reference.md",
       "audience": "documentation",
       "role": "operator_guide",
-      "sha256": "e995fd9329fed2b4ece33cd0e7fb16a5b6bad190345d8af4ae496df386d246be"
+      "sha256": "78bb6c4a40145f7698eb213c36f162bb2c522e4b29b8fd7637bce634c64f71fc"
     },
     {
       "path": "docs/vi/storybook.md",

package/docs/release-notes.md

@@ -1,6 +1,6 @@
 # Release Notes
 
-Curated product highlights for operators. This is **not** a git log and **not** a `CHANGELOG.md` — the design system does not maintain a changelog file. source checkout VERSION **<!-- cs-source-version:checkout -->2.6.0<!-- /cs-source-version -->** identifies the repository version. This page supplies Storybook **Release Notes**; local edits do not establish what is deployed at `design.cyberskill.world`.
+Curated product highlights for operators. This is **not** a git log and **not** a `CHANGELOG.md` — the design system does not maintain a changelog file. source checkout VERSION **<!-- cs-source-version:checkout -->2.8.0<!-- /cs-source-version -->** identifies the repository version. This page supplies Storybook **Release Notes**; local edits do not establish what is deployed at `design.cyberskill.world`.
 
 ## Unreleased revision — local implementation, acceptance pending
 
@@ -28,6 +28,30 @@ These changes belong to the current revision working tree. They are not a publis
 
 Release remains pending human visual acceptance, required native/manual assistive-technology checks, provenance decisions, and acceptance of changed pilot artifacts. Changed support evidence requires fresh review in `components/lifecycle.json`. EN/VI is the intended language scope; Japanese remains a partial spike. No support expansion, deprecation or removal is authorized by this note.
 
+## Release — `@cyberskill/design@2.7.0`
+
+Published stable minor release recorded in `_audit/ci/fixtures/npm-published-release.json` (observed `2026-11-09T20:01:08.112Z`, tag `v2.7.0` at commit `d951d7d74077913d5d957f75c9d50d873b9dd937`).
+
+- **20-Dimension Live Browser Benchmark Suite (`_audit/ci/verify-audit-benchmarks-browser.mjs`, `_audit/ci/lib/benchmark-checks.mjs`, `_audit/ci/fixtures/benchmark-20d.html`, `_audit/ci/fixtures/benchmark-gen2.html`):** Expands the automated live browser audit to **20 dimensions (`129/129` checks at `10.0 / 10`, `0 watch` items + `64/64` baseline checks = `193/193` total live browser assertions)** adding `D11` (APCA $L_c \ge 75$ body text & typographic rhythm), `D12` (7-tier `--cs-depth-*` z-index ladder & overlay scroll containment), `D13` (responsive container queries, safe areas & table reflow), `D14` (RTL logical properties, disabled/read-only hygiene & reduced-motion skeleton suppression), `D15` (`@media print`, `@media (forced-colors: active)` WHCM & brand immutables), `D16` (5-axis `Theme × Element × Density × Contrast × Style` orthogonality & surface elevation physics), `D17` (3-browser keyboard & Vietnamese IME focus parity), `D18` (20-family state-machine determinism), `D19` (exportable document/template geometry & table column conservation), and `D20` (production bundle closure, SHA-256 integrity & zero console errors).
+- **3-Engine Picker Focus Restoration & Vietnamese IME Guard Suite (`components/forms/TreeSelect.jsx`, `components/forms/Cascader.jsx`, `components/forms/ColorPicker.jsx`, `components/forms/SearchField.jsx`, `_audit/ci/test-picker-focus-ime-browser.mjs`):** Restores trigger focus across Chromium, Firefox, and WebKit when closing `DatePicker`, `TreeSelect`, `Cascader`, and `ColorPicker` via selection or `Escape` or clearing `SearchField`, and verifies `isComposing` IME Enter-key guards across `Combobox`, `TagInput`, `Mentions`, `PromptInput`, and `SearchField`.
+- **State-Machine Census & `fast-gates` Local `act` Attestation (`scripts/generate-state-inventory.mjs`, `_audit/state-machines.*`, `scripts/run-act-ci.mjs`, `scripts/verify-ci-checks.mjs`, `.github/workflows/design-system-gates.yml`):** Adds source-derived state-machine discovery with `InlineEdit` transition browser verification and extends commit/tree-bound local `act` attestation to `ci/act/fast-gates`.
+
+```bash
+npm install @cyberskill/design@2.7.0
+```
+
+## Release — `@cyberskill/design@2.6.0`
+
+Published stable minor release recorded in `_audit/ci/fixtures/npm-published-release.json` (observed `2026-11-09T17:39:34.494Z`, tag `v2.6.0` at commit `48ed4be40e83bc6d5e2763b03111b07aa2c26df4`).
+
+- **10-Dimension Benchmark & Automated CI Non-Regression Gate (`_audit/ci/verify-audit-benchmarks-browser.mjs`, `_audit/ci/lib/benchmark-checks.mjs`, `_audit/ci/fixtures/benchmark-baseline.html`):** Expands the live browser audit to **10 dimensions (`69/69` checks at `10.0 / 10`, `0 watch` items)** adding `D8` (Touch Targets ≥ 44px, Focus Ring Integrity, High-Contrast Mode), `D9` (5-Element × 2-Theme × 3-Variant Token Completeness, Print/A4 Sheet Integrity, Reduced Motion), and `D10` (Brand Identity, Bilingual EN/VI Completeness, Token Purity), enforced in CI and `prepublishOnly` via `npm run test:audit-regression`.
+- **Single-File Flattened CSS Export & Inline Logo Guidance (`package.json`, `scripts/flatten-css.mjs`, `DESIGN.md`, `docs/vi/entrypoints/DESIGN.md`):** Exposes `"./dist/styles.css": "./dist/styles.css"` in `package.json#exports`, derives the `dist/styles.css` header banner dynamically from `VERSION`, and documents the canonical `<svg viewBox="0 0 64 64">` inline logo pattern for single-file and cloud sandbox runtimes.
+- **Fast Commit-Bound `act` Shard Attestation (`.github/workflows/design-system-gates.yml`, `scripts/run-act-ci.mjs`, `scripts/verify-ci-checks.mjs`):** Verifies commit-bound local `ci/act/unit-tests (1/4..4/4)` receipts ahead of heavy dependency and browser installation steps, cutting GitHub Actions `unit-tests` runtime to ~15 seconds when pre-verified via `act`.
+
+```bash
+npm install @cyberskill/design@2.6.0
+```
+
 ## Release — `@cyberskill/design@2.5.0`
 
 Published stable minor release recorded in `_audit/ci/fixtures/npm-published-release.json` (observed `2026-11-09T06:04:11.249Z`, tag `v2.5.0` at commit `6e7fe3c158b122c8ca19b8253eb06460c7f2f919`). Subsequent repository tags `v2.3.1` and `v2.4.0` preceded `v2.5.0`.
@@ -35,7 +59,6 @@ Published stable minor release recorded in `_audit/ci/fixtures/npm-published-rel
 - **Scoped Nested Theme & Liquid Glass Parity (`base/glass.css`, `tokens/theme-dark.css`):** Re-computes `--_cs-light` / `--_cs-dark` space-toggle tokens, `--_cs-surface-scrim`, and all eight `--cs-glass-*-{bg,border}` materials inside nested `[data-theme]` scopes.
 - **32-Scope Contrast & Dark Default Tint Safety (`base/collections.css`, `base/controls.css`, `base/feedback.css`, `base/shell.css`, `base/ai.css`):** Replaces un-scoped `--cs-accent-tint` dark backgrounds with `color-mix(in oklab, var(--cs-accent) 18%, var(--cs-color-surface-panel))`, upgrades non-text indicators to `--cs-color-text-accent` (`WCAG 1.4.11 ≥ 3:1` across all 32 scopes), and adds inset perimeter rings for dark Umber surfaces.
 - **13-Control Invalid State & Vietnamese Typography Clearance (`base/components.css`, `base/controls.css`, `base/typography.css`, `base/data.css`):** Unifies `.is-invalid` / `[aria-invalid="true"]` danger borders across all 13 form controls and applies `:lang(vi) { line-height: 1.22; }` to `.cs-display` and `.cs-stat__value`.
-- **Verification & Non-Regression Gate (`audit/v2.5.0-verification.html`, `audit/render-health.html`, `audit/v2.5.0-verification.json`, `_audit/ci/verify-audit-benchmarks-browser.mjs`):** All 69 checks across 10 dimensions (`D1`–`D7` remediation + `D8`–`D10` Doctrine Immutables) pass at **10.0 / 10** and the embedded baseline suite scores **64/64** (**62/64** for v2.4.0, **8/64** for v2.3.1); `audit/render-health.html` checks **146** pages with **0 bad** as authored, under `theme=dark`, and under `theme=dark` + `contrast=high` on `set=cards`. Dark default-scope tint ink measures **8.42:1–10.54:1** (`.cs-result__icon` **8.42:1**, `.cs-item.is-selected` **10.54:1** — both clearing WCAG AAA `7:1` with `0 watch` items).
 
 ```bash
 npm install @cyberskill/design@2.5.0